@desplega.ai/agent-swarm 1.130.0 → 1.131.0

package/dist/{http-xdbbtmhx.js → http-jewj0syk.js}

@@ -152,7 +152,7 @@ import {
   withRemoteContext,
   withSpanContext,
   writeSkillsToFilesystem
-} from "./cli-haanc4qd.js";
+} from "./cli-t76vw5db.js";
 import"./cli-1z7048dy.js";
 import {
   Anthropic
@@ -173,34 +173,34 @@ import {
   checkHeartbeatChecklist,
   runHeartbeatSweep,
   stopHeartbeat
-} from "./cli-z9q7pb38.js";
+} from "./cli-d2tfkcga.js";
 import {
   createResumeFollowUp,
   createWorkerTaskFollowUp
-} from "./cli-tfw3c0y1.js";
+} from "./cli-nm5gtp1x.js";
 import {
   calculateNextRun,
   dispatchScheduleTarget,
   ensure,
   initialize,
   require_dist
-} from "./cli-dakxgk70.js";
+} from "./cli-5ze9rv97.js";
 import {
   getModelsCatalog
-} from "./cli-qbb2ten8.js";
+} from "./cli-t55yw3a1.js";
 import {
   normalizeModelKey
-} from "./cli-vr2f46zj.js";
+} from "./cli-t1xze5qh.js";
 import {
   getUserGrant
-} from "./cli-tp519bjz.js";
+} from "./cli-5v4rw6yd.js";
 import {
   can,
   clearAuditSink,
   decideToolAdmission,
   isRbacEnabled,
   setAuditSink
-} from "./cli-hntzdchd.js";
+} from "./cli-bqw0mt1n.js";
 import {
   ensureAgentFsCredentialsForAgent,
   extractArgsJsonSchema,
@@ -210,11 +210,12 @@ import {
   scriptSdkTypesWithGeneratedApis,
   scriptStdlibTypesWithGeneratedApis,
   typecheckScript
-} from "./cli-fs153s3x.js";
+} from "./cli-efxfnq6q.js";
 import {
   collectScriptReferences,
+  getApp,
   listAppRecords
-} from "./cli-brebbsen.js";
+} from "./cli-2q72qz2s.js";
 import {
   RawLlmConfigSchema,
   RawLlmOutputSchema,
@@ -234,7 +235,7 @@ import {
   validateDefinition,
   validateJsonSchema,
   verifyHmacSignature
-} from "./cli-xdrmxvd4.js";
+} from "./cli-yw8vghx2.js";
 import"./cli-3dpj7atn.js";
 import {
   ConnectionAuthInputSchema,
@@ -242,6 +243,7 @@ import {
   MIN_SCRIPT_WALL_CLOCK_MS,
   applyMcpOAuthRefresh,
   assertUrlSafe,
+  authMethodForStoredClient,
   buildAuthorizeUrl,
   buildSandboxedCommand,
   buildScriptCredentialBindingsWithFailures,
@@ -281,6 +283,7 @@ import {
   listScripts,
   listVendoredOpenapiEntries,
   markMcpOAuthTokenStatus,
+  normalizeTokenEndpointAuthMethod,
   oauthAppToProviderConfig,
   publicEndpointSsrfOptions,
   readStreamCapped,
@@ -289,10 +292,12 @@ import {
   refreshScriptConnection,
   registerClient,
   require_typescript,
+  resolveAdvertisedTokenEndpointAuthMethod,
   revokeMcpToken,
   rotateScriptApiSecret,
   runScript,
   sandboxSpawnEnv,
+  selectDcrTokenEndpointAuthMethod,
   setMcpServerAuthMethod,
   setScriptConnectionEnabled,
   updateScriptApi,
@@ -300,14 +305,14 @@ import {
   upsertMcpOAuthToken,
   upsertScriptByName,
   upsertScriptConnection
-} from "./cli-q8zwffx0.js";
+} from "./cli-pm6xbh84.js";
 import"./cli-epan13p1.js";
 import {
   getApiKey
 } from "./cli-f14fvzag.js";
 import {
   searchScripts
-} from "./cli-1px8pn1s.js";
+} from "./cli-qv61hp37.js";
 import {
   CANDIDATE_SET_MULTIPLIER,
   getEmbeddingProvider,
@@ -315,7 +320,7 @@ import {
   init_constants as init_constants2,
   init_reranker,
   rerank
-} from "./cli-mf009e0j.js";
+} from "./cli-rzbpmxdr.js";
 import"./cli-0258203w.js";
 import {
   acquireOAuthRefreshLock,
@@ -340,14 +345,14 @@ import {
   updateAuthorizationIdentity,
   updateOAuthAppById,
   upsertAuthorization
-} from "./cli-1mj7yz1r.js";
+} from "./cli-g6b8x1h8.js";
 import"./cli-fad8m16k.js";
 import {
   FilesError,
   getFileStorageProvider,
   normalizeFilesError
 } from "./cli-bnx54kxv.js";
-import"./cli-r62me33w.js";
+import"./cli-d3x3x1c9.js";
 import {
   findUserById,
   fingerprintApiKey,
@@ -363,15 +368,15 @@ import {
   resolveUserByToken,
   revokeToken,
   unlinkIdentity
-} from "./cli-m8fs5ttq.js";
+} from "./cli-psh3c4va.js";
 import {
   createTaskWithSiblingAwareness
-} from "./cli-mhr8tq3v.js";
+} from "./cli-cdeg08wx.js";
 import {
   getSlackApp,
   startSlackApp,
   stopSlackApp
-} from "./cli-qcsjdppx.js";
+} from "./cli-cvgjwnh1.js";
 import"./cli-k9qkf1hw.js";
 import"./cli-b0p7rfnd.js";
 import"./cli-t930g0xh.js";
@@ -749,7 +754,7 @@ import {
   upsertSwarmConfig,
   validateConfigValue,
   withFavoriteFlags
-} from "./cli-s18zzkfp.js";
+} from "./cli-a4jzdpa3.js";
 import {
   getAllTemplateDefinitions,
   getTemplateDefinition,
@@ -762,7 +767,7 @@ import {
   isEnvFlagEnabled,
   isSteeringEnabled,
   resolveTemplate
-} from "./cli-4n4mdv21.js";
+} from "./cli-xpxde7rm.js";
 import {
   MAX_PROFILE_FILE_LENGTH,
   getAppUrl,
@@ -784,7 +789,7 @@ import {
 import {
   init_package,
   package_default
-} from "./cli-7v5dhmc8.js";
+} from "./cli-72q8m8gk.js";
 import {
   array,
   exports_external,
@@ -799,20 +804,20 @@ import {
 } from "./cli-9aryf9tv.js";
 import {
   bedrockProviderModule
-} from "./cli-t5tsq67k.js";
+} from "./cli-9dr5qzc0.js";
 import"./cli-cwy5hqbq.js";
 import {
   setBedrockProviderModule
-} from "./cli-6nh2qxvh.js";
+} from "./cli-darcwax3.js";
 import"./cli-jvv0g8bh.js";
 import"./cli-r6kqqbj0.js";
-import"./cli-ch7t5v7n.js";
+import"./cli-6map995v.js";
 import"./cli-4wgngmwv.js";
 import"./cli-vapyk8sw.js";
 import"./cli-zyxs93y9.js";
-import"./cli-vgexpfsr.js";
+import"./cli-57khth04.js";
 import"./cli-y2apkfe2.js";
-import"./cli-w10fkrf1.js";
+import"./cli-akdvwc9v.js";
 import"./cli-8wrympd7.js";
 import"./cli-7sgrxg9a.js";
 import"./cli-3fj60etf.js";
@@ -2619,7 +2624,7 @@ var listAssetsRoute = route({
   tags: ["Assets"],
   query: exports_external.object({
     keyPrefix: AssetKeySchema.optional(),
-    types: exports_external.string().optional().describe("Comma-separated task,workflow,schedule,page,file list"),
+    types: exports_external.string().optional().describe("Comma-separated task,workflow,schedule,page,app,script,file list"),
     limit: exports_external.coerce.number().int().min(1).max(1000).optional()
   }),
   responses: {
@@ -2659,6 +2664,41 @@ function ensureOperator(req, res) {
   jsonError(res, "Operator access required", 403);
   return false;
 }
+var moveAssetBodySchema = exports_external.object({ key: AssetKeySchema });
+var moveAssetSuccessSchema = exports_external.object({
+  entityType: AssetEntityTypeSchema,
+  id: exports_external.string(),
+  key: AssetKeySchema
+});
+var moveAssetResponses = {
+  200: { description: "Asset namespace updated", schema: moveAssetSuccessSchema },
+  400: { description: "Invalid namespace" },
+  403: { description: "Move not authorized" },
+  404: { description: "Asset not found" },
+  409: { description: "Moves blocked until audit warnings are repaired" }
+};
+var moveAppAssetRoute = route({
+  method: "patch",
+  path: "/api/assets/app/{id}/key",
+  pattern: ["api", "assets", "app", null, "key"],
+  summary: "Move an app to another logical namespace",
+  tags: ["Assets"],
+  params: exports_external.object({ id: exports_external.string().min(1) }),
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
+  rbac: { permission: "app.manage" }
+});
+var moveScriptAssetRoute = route({
+  method: "patch",
+  path: "/api/assets/script/{id}/key",
+  pattern: ["api", "assets", "script", null, "key"],
+  summary: "Move a script to another logical namespace",
+  tags: ["Assets"],
+  params: exports_external.object({ id: exports_external.string().min(1) }),
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
+  rbac: { permission: "script.global.write" }
+});
 var moveAssetRoute = route({
   method: "patch",
   path: "/api/assets/{entityType}/{id}/key",
@@ -2667,25 +2707,23 @@ var moveAssetRoute = route({
   description: "Updates namespace metadata only. Provider-backed files keep the same provider key, org, and drive; no remote move occurs. Personal keys are labels, not a privacy guarantee.",
   tags: ["Assets"],
   params: exports_external.object({ entityType: AssetEntityTypeSchema, id: exports_external.string().min(1) }),
-  body: exports_external.object({ key: AssetKeySchema }),
-  responses: {
-    200: {
-      description: "Asset namespace updated",
-      schema: exports_external.object({
-        entityType: AssetEntityTypeSchema,
-        id: exports_external.string(),
-        key: AssetKeySchema
-      })
-    },
-    400: { description: "Invalid namespace" },
-    403: { description: "Move not authorized" },
-    404: { description: "Asset not found" },
-    409: { description: "Moves blocked until audit warnings are repaired" }
-  },
+  body: moveAssetBodySchema,
+  responses: moveAssetResponses,
   rbac: {
-    ungated: "preserves each entity's current mutation posture; task moves additionally use task.fs.mutate, file moves require operator authentication, and personal destinations require a matching trusted user"
+    ungated: "preserves each entity's current mutation posture; task moves use task.fs.mutate, app moves use app.manage, scripts preserve agent ownership/global-lead rules, file moves require operator authentication, and personal destinations require a matching trusted user"
   }
 });
+function assetMovePrincipal(req, myAgentId) {
+  const auth = getRequestAuth(req);
+  if (auth?.kind === "operator")
+    return { kind: "operator" };
+  if (auth?.kind === "user")
+    return { kind: "user", userId: auth.userId };
+  if (!myAgentId)
+    return null;
+  const agent = getAgentById(myAgentId);
+  return { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
+}
 function canMutateTaskNamespace(task, myAgentId, req) {
   const resource = {
     kind: "task",
@@ -2693,20 +2731,32 @@ function canMutateTaskNamespace(task, myAgentId, req) {
     agentId: task.agentId,
     creatorAgentId: task.creatorAgentId
   };
-  const auth = getRequestAuth(req);
-  let principal;
-  if (auth?.kind === "operator") {
-    principal = { kind: "operator" };
-  } else if (auth?.kind === "user") {
-    principal = { kind: "user", userId: auth.userId };
-  } else {
-    if (!myAgentId)
-      return false;
-    const agent = getAgentById(myAgentId);
-    principal = { kind: "agent", agentId: myAgentId, isLead: agent?.isLead ?? false };
-  }
+  const principal = assetMovePrincipal(req, myAgentId);
+  if (!principal)
+    return false;
   return can({ principal, verb: "task.fs.mutate", resource, source: "http" }).allow;
 }
+function canManageAppNamespace(id, req, myAgentId) {
+  const principal = assetMovePrincipal(req, myAgentId);
+  return !!principal && can({ principal, verb: "app.manage", resource: { kind: "app", appId: id }, source: "http" }).allow;
+}
+function canManageScriptNamespace(script, req, myAgentId) {
+  const principal = assetMovePrincipal(req, myAgentId);
+  if (!principal)
+    return false;
+  if (principal.kind === "operator")
+    return true;
+  if (principal.kind !== "agent")
+    return false;
+  if (script.scope === "agent")
+    return script.scopeId === principal.agentId;
+  return can({
+    principal,
+    verb: "script.global.write",
+    resource: { kind: "owned", scope: "global" },
+    source: "http"
+  }).allow;
+}
 async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
   if (keyAuditRoute.match(req.method, pathSegments)) {
     const parsed = await keyAuditRoute.parse(req, res, pathSegments, queryParams);
@@ -2768,7 +2818,7 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
     }
     return true;
   }
-  if (moveAssetRoute.match(req.method, pathSegments)) {
+  if (moveAppAssetRoute.match(req.method, pathSegments) || moveScriptAssetRoute.match(req.method, pathSegments) || moveAssetRoute.match(req.method, pathSegments)) {
     const parsed = await moveAssetRoute.parse(req, res, pathSegments, queryParams);
     if (!parsed)
       return true;
@@ -2785,6 +2835,27 @@ async function handleAssets(req, res, pathSegments, queryParams, myAgentId) {
         return true;
       }
     }
+    if (parsed.params.entityType === "app") {
+      if (!getApp(parsed.params.id)) {
+        jsonError(res, "Asset not found", 404);
+        return true;
+      }
+      if (!canManageAppNamespace(parsed.params.id, req, myAgentId)) {
+        jsonError(res, "Not authorized to move this app namespace", 403);
+        return true;
+      }
+    }
+    if (parsed.params.entityType === "script") {
+      const script = getScriptById(parsed.params.id);
+      if (!script) {
+        jsonError(res, "Asset not found", 404);
+        return true;
+      }
+      if (!canManageScriptNamespace(script, req, myAgentId)) {
+        jsonError(res, "Not authorized to move this script namespace", 403);
+        return true;
+      }
+    }
     try {
       const actor = resolveHttpAuditUserId(req, myAgentId);
       const key = authorizeAssetKeyWrite(parsed.body.key, actor);
@@ -6589,7 +6660,8 @@ var DiscoveryResultSchema = exports_external.object({
   scopes: exports_external.array(exports_external.string()),
   requiresOAuth: exports_external.literal(true),
   dcrSupported: exports_external.boolean(),
-  bearerMethodsSupported: exports_external.array(exports_external.string()).nullable()
+  bearerMethodsSupported: exports_external.array(exports_external.string()).nullable(),
+  tokenEndpointAuthMethodsSupported: exports_external.array(exports_external.string()).nullable()
 });
 var MetadataResponseSchema = exports_external.union([
   exports_external.object({ requiresOAuth: exports_external.literal(false) }),
@@ -6645,7 +6717,8 @@ function manualClientFromToken(token) {
     authorizeUrl: token.authorizeUrl,
     tokenUrl: token.tokenUrl,
     revocationUrl: token.revocationUrl,
-    scopes: splitScopes(token.scope)
+    scopes: splitScopes(token.scope),
+    tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod)
   };
 }
 async function discoverForMcp(resourceUrl) {
@@ -6667,7 +6740,8 @@ async function discoverForMcp(resourceUrl) {
     scopes: prmd.scopes_supported ?? as.scopes_supported ?? [],
     requiresOAuth: true,
     dcrSupported: !!as.registration_endpoint,
-    bearerMethodsSupported: prmd.bearer_methods_supported ?? null
+    bearerMethodsSupported: prmd.bearer_methods_supported ?? null,
+    tokenEndpointAuthMethodsSupported: as.token_endpoint_auth_methods_supported ?? null
   };
 }
 function getMcpOrError(res, mcpServerId) {
@@ -6824,7 +6898,8 @@ var manualClientRoute = route({
     authorizeUrl: exports_external.string().url().optional(),
     tokenUrl: exports_external.string().url().optional(),
     revocationUrl: exports_external.string().url().optional(),
-    scopes: exports_external.array(exports_external.string()).optional()
+    scopes: exports_external.array(exports_external.string()).optional(),
+    tokenEndpointAuthMethod: exports_external.enum(["client_secret_basic", "client_secret_post", "none"]).optional()
   }),
   responses: {
     200: {
@@ -6886,7 +6961,8 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
         authorizeUrl: discovery.authorizeUrl,
         tokenUrl: discovery.tokenUrl,
         revocationUrl: discovery.revocationUrl,
-        scopes: reusable.scopes.length > 0 ? reusable.scopes : discovery.scopes
+        scopes: reusable.scopes.length > 0 ? reusable.scopes : discovery.scopes,
+        tokenEndpointAuthMethod: authMethodForStoredClient(reusable.tokenEndpointAuthMethod)
       };
     }
   }
@@ -6900,15 +6976,17 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
       return null;
     }
     const scopes2 = q.scopes ? splitScopes(q.scopes) : discovery.scopes;
+    const requestedAuthMethod = selectDcrTokenEndpointAuthMethod(discovery.tokenEndpointAuthMethodsSupported ?? undefined);
     const dcr = await registerClient(discovery.registrationEndpoint, {
       client_name: `agent-swarm (${server.name})`,
       redirect_uris: [callbackRedirectUri()],
       grant_types: ["authorization_code", "refresh_token"],
       response_types: ["code"],
-      token_endpoint_auth_method: "client_secret_basic",
+      token_endpoint_auth_method: requestedAuthMethod,
       application_type: "web",
       scope: scopes2.join(" ") || undefined
     });
+    const registeredAuthMethod = dcr.token_endpoint_auth_method ? resolveAdvertisedTokenEndpointAuthMethod(dcr.token_endpoint_auth_method, "returned") : requestedAuthMethod;
     registeredScopes = scopes2;
     client = {
       clientId: dcr.client_id,
@@ -6918,7 +6996,8 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
       authorizeUrl: discovery.authorizeUrl,
       tokenUrl: discovery.tokenUrl,
       revocationUrl: discovery.revocationUrl,
-      scopes: scopes2
+      scopes: scopes2,
+      tokenEndpointAuthMethod: registeredAuthMethod
     };
   }
   const scopes = q.scopes ? splitScopes(q.scopes) : client.scopes;
@@ -6957,6 +7036,7 @@ async function runAuthorizeFlow(res, mcpServerId, server, q, userId) {
     registeredScopes,
     dcrClientId: client.clientId,
     dcrClientSecret: client.clientSecret,
+    tokenEndpointAuthMethod: client.tokenEndpointAuthMethod,
     redirectUri: callbackRedirectUri(),
     finalRedirect: q.redirect ?? null
   });
@@ -6996,6 +7076,7 @@ async function completeMcpOAuthCallback(res, query) {
       tokenUrl: pending.tokenUrl,
       clientId: pending.dcrClientId ?? "",
       clientSecret: pending.dcrClientSecret ?? undefined,
+      tokenEndpointAuthMethod: authMethodForStoredClient(pending.tokenEndpointAuthMethod),
       redirectUri: pending.redirectUri,
       code: query.code,
       codeVerifier: pending.codeVerifier,
@@ -7021,6 +7102,7 @@ async function completeMcpOAuthCallback(res, query) {
       registeredScopes: pending.registeredScopes ?? undefined,
       dcrClientId: pending.dcrClientId,
       dcrClientSecret: pending.dcrClientSecret,
+      tokenEndpointAuthMethod: authMethodForStoredClient(pending.tokenEndpointAuthMethod),
       clientSource,
       lastRefreshedAt: new Date().toISOString()
     });
@@ -7166,6 +7248,7 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
         tokenUrl: existing.tokenUrl,
         clientId: existing.dcrClientId ?? "",
         clientSecret: existing.dcrClientSecret ?? undefined,
+        tokenEndpointAuthMethod: authMethodForStoredClient(existing.tokenEndpointAuthMethod),
         refreshToken: existing.refreshToken,
         resource: existing.resourceUrl
       });
@@ -7208,7 +7291,8 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
           token: token.accessToken,
           tokenTypeHint: "access_token",
           clientId: token.dcrClientId ?? "",
-          clientSecret: token.dcrClientSecret ?? undefined
+          clientSecret: token.dcrClientSecret ?? undefined,
+          tokenEndpointAuthMethod: authMethodForStoredClient(token.tokenEndpointAuthMethod)
         });
       } catch (err) {
         console.warn("[mcp-oauth] revocation call failed (continuing with local delete):", err instanceof Error ? err.message : err);
@@ -7234,6 +7318,8 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
       let authorizationServerIssuer = overrides.authorizationServerIssuer ?? null;
       let resourceUrl = server.url;
       let scopes = overrides.scopes ?? [];
+      let tokenEndpointAuthMethod = overrides.tokenEndpointAuthMethod ? normalizeTokenEndpointAuthMethod(overrides.tokenEndpointAuthMethod) : undefined;
+      let advertisedAuthMethods = null;
       if (!authorizeUrl || !tokenUrl) {
         const discovery = await discoverForMcp(server.url);
         if (!discovery) {
@@ -7247,6 +7333,11 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
         resourceUrl = discovery.resourceUrl;
         if (scopes.length === 0)
           scopes = discovery.scopes;
+        advertisedAuthMethods = discovery.tokenEndpointAuthMethodsSupported;
+      }
+      if (!tokenEndpointAuthMethod) {
+        const postUnsupported = advertisedAuthMethods !== null && advertisedAuthMethods.length > 0 && !advertisedAuthMethods.includes("client_secret_post");
+        tokenEndpointAuthMethod = postUnsupported ? selectDcrTokenEndpointAuthMethod(advertisedAuthMethods ?? undefined) : authMethodForStoredClient(undefined);
       }
       if (!authorizationServerIssuer) {
         jsonError(res, "authorizationServerIssuer is required when endpoints are provided manually.", 400);
@@ -7265,6 +7356,7 @@ async function handleMcpOAuth(req, res, pathSegments, queryParams) {
         revocationUrl,
         dcrClientId: overrides.clientId,
         dcrClientSecret: overrides.clientSecret ?? null,
+        tokenEndpointAuthMethod,
         clientSource: "manual",
         status: "error",
         lastErrorMessage: "Manual client pre-registered; awaiting authorize flow."
@@ -20766,6 +20858,7 @@ async function handleTrackers(req, res, pathSegments) {
 init_zod();
 init_db();
 init_types();
+init_request_auth_context();
 
 // src/http/operator-actor.ts
 init_request_auth_context();
@@ -20852,6 +20945,24 @@ var UnmappedIdentitySchema = exports_external.object({
   sampleEventType: exports_external.string().nullable(),
   sampleContext: exports_external.unknown().nullable()
 });
+var whoamiRoute = route({
+  method: "get",
+  path: "/api/whoami",
+  pattern: ["api", "whoami"],
+  summary: "Resolve the authenticated principal behind the presented bearer",
+  tags: ["Users"],
+  responses: {
+    200: {
+      description: "Authenticated principal",
+      schema: exports_external.object({
+        kind: exports_external.enum(["operator", "user"]),
+        user: exports_external.union([UserSchema, exports_external.null()])
+      })
+    },
+    401: { description: "Unauthorized" }
+  },
+  auth: { apiKey: true }
+});
 var listUsers = route({
   method: "get",
   path: "/api/users",
@@ -21165,6 +21276,18 @@ function collectUnmappedForKind(kind, limit) {
   return Array.from(byId.values());
 }
 async function handleUsers(req, res, pathSegments, queryParams) {
+  if (whoamiRoute.match(req.method, pathSegments)) {
+    const parsed = await whoamiRoute.parse(req, res, pathSegments, queryParams);
+    if (!parsed)
+      return true;
+    const auth = getRequestAuth(req);
+    if (auth?.kind === "user") {
+      whoamiRoute.respond(res, 200, { kind: "user", user: auth.user });
+    } else {
+      whoamiRoute.respond(res, 200, { kind: "operator", user: null });
+    }
+    return true;
+  }
   if (listUsers.match(req.method, pathSegments)) {
     const parsed = await listUsers.parse(req, res, pathSegments, queryParams);
     if (!parsed)
@@ -23345,14 +23468,14 @@ async function shutdown() {
     sessionsProcessed: getServerSessionsProcessed()
   });
   if (hasCapability("scheduling")) {
-    const { stopScheduler } = await import("./index-9vnkprkh.js");
+    const { stopScheduler } = await import("./index-hfvggd0z.js");
     stopScheduler();
   }
   stopHeartbeat();
   stopScriptRunSupervisor();
   await stopSlackApp();
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { stopOAuthKeepalive } = await import("./keepalive-fc7a2hw9.js");
+    const { stopOAuthKeepalive } = await import("./keepalive-j0fjvqfd.js");
     await stopOAuthKeepalive();
   }
   stopOAuthPendingGc();
@@ -23414,15 +23537,15 @@ try {
   console.warn("[startup] CAPABILITIES upgrade seed failed (non-fatal):", err);
 }
 try {
-  const { seedPricingFromModelsDev } = await import("./seed-pricing-47q77nw4.js");
+  const { seedPricingFromModelsDev } = await import("./seed-pricing-yhpv35fr.js");
   seedPricingFromModelsDev();
-  const { startPricingRefreshLoop } = await import("./pricing-refresh-n0ve0kh6.js");
+  const { startPricingRefreshLoop } = await import("./pricing-refresh-k49rcyed.js");
   startPricingRefreshLoop();
 } catch (err) {
   console.error("[startup] Failed to seed pricing rows:", err);
 }
 try {
-  const { ensureRbacSeedsSynced } = await import("./rbac-roles-bbwb4wrm.js");
+  const { ensureRbacSeedsSynced } = await import("./rbac-roles-30pspvy7.js");
   ensureRbacSeedsSynced();
 } catch (err) {
   console.error("[startup] Failed to sync RBAC seed rows:", err);
@@ -23430,7 +23553,7 @@ try {
     throw err;
 }
 try {
-  const { runAllSeeders } = await import("./index-5fdsemf0.js");
+  const { runAllSeeders } = await import("./index-7n2xpbd4.js");
   await runAllSeeders({ scriptEmbeddingMode: "skip" });
 } catch (err) {
   console.error("[startup] Failed to seed built-in entities:", err);
@@ -23466,35 +23589,35 @@ httpServer.listen(port, async () => {
   initWorkflows();
   startScriptRunSupervisor(getMcpBaseUrl());
   if (hasCapability("scheduling")) {
-    const { startScheduler } = await import("./index-9vnkprkh.js");
-    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-c0qedjh6.js");
+    const { startScheduler } = await import("./index-hfvggd0z.js");
+    const { getExecutorRegistry: getExecutorRegistry2 } = await import("./index-6gm5he8h.js");
     const intervalMs = Number(process.env.SCHEDULER_INTERVAL_MS) || 1e4;
     startScheduler(getExecutorRegistry2(), intervalMs, {
       runId: globalState.__runId
     });
   }
   if (!isEnvFlagEnabled("HEARTBEAT_DISABLE", false)) {
-    const { startHeartbeat } = await import("./index-fnack5vh.js");
+    const { startHeartbeat } = await import("./index-hp1kdbjj.js");
     const heartbeatMs = Number(process.env.HEARTBEAT_INTERVAL_MS) || 90000;
     startHeartbeat(heartbeatMs);
   }
   if (process.env.OAUTH_KEEPALIVE_DISABLE !== "true") {
-    const { startOAuthKeepalive } = await import("./keepalive-fc7a2hw9.js");
+    const { startOAuthKeepalive } = await import("./keepalive-j0fjvqfd.js");
     startOAuthKeepalive();
   }
   if (process.env.OAUTH_REFRESH_SWEEP_DISABLE !== "true") {
-    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-f9rptqbt.js");
+    const { startOAuthRefreshSweep } = await import("./oauth-refresh-sweep-s9ecsvh0.js");
     startOAuthRefreshSweep();
   }
   startOAuthPendingGc();
   startMemoryGc();
-  import("./boot-reembed-5bgan3cd.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
+  import("./boot-reembed-62p0at2k.js").then(({ runBootReembed }) => runBootReembed()).catch((err) => {
     console.error("[boot-reembed] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-reembed-z7ykyeq8.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
+  import("./boot-reembed-xmfp6wdh.js").then(({ runBootReembedScripts }) => runBootReembedScripts()).catch((err) => {
     console.error("[boot-reembed-scripts] startup backfill failed (non-fatal):", err);
   });
-  import("./boot-scrub-logs-b2rjk8mv.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
+  import("./boot-scrub-logs-rr8q2dms.js").then(({ runBootScrubLogs }) => runBootScrubLogs()).catch((err) => {
     console.error("[boot-scrub-logs] startup scrub failed (non-fatal):", err);
   });
 }).on("error", (err) => {