@femtomc/mu-server 26.2.70 → 26.2.71

package/dist/server_routing.js

@@ -1,11 +1,14 @@
 import { extname, join, resolve } from "node:path";
-import { getControlPlanePaths, IdentityStore, ROLE_SCOPES, } from "@femtomc/mu-control-plane";
+import { activityRoutes } from "./api/activities.js";
+import { configRoutes } from "./api/config.js";
+import { controlPlaneRoutes } from "./api/control_plane.js";
+import { cronRoutes } from "./api/cron.js";
 import { eventRoutes } from "./api/events.js";
 import { forumRoutes } from "./api/forum.js";
+import { heartbeatRoutes } from "./api/heartbeats.js";
+import { identityRoutes } from "./api/identities.js";
 import { issueRoutes } from "./api/issues.js";
-import { applyMuConfigPatch, getMuConfigPath, muConfigPresence, redactMuConfigSecrets, } from "./config.js";
-import { cronScheduleInputFromBody, hasCronScheduleInput, parseCronTarget, } from "./cron_request.js";
-import { normalizeWakeMode } from "./server_types.js";
+import { runRoutes } from "./api/runs.js";
 const DEFAULT_MIME_TYPES = {
     ".html": "text/html; charset=utf-8",
     ".js": "text/javascript; charset=utf-8",
@@ -36,73 +39,23 @@ export function createServerRequestHandler(deps) {
         if (path === "/healthz" || path === "/health") {
             return new Response("ok", { status: 200, headers });
         }
-        if (path === "/api/config") {
-            if (request.method === "GET") {
-                try {
-                    const config = await deps.loadConfigFromDisk();
-                    return Response.json({
-                        repo_root: deps.context.repoRoot,
-                        config_path: getMuConfigPath(deps.context.repoRoot),
-                        config: redactMuConfigSecrets(config),
-                        presence: muConfigPresence(config),
-                    }, { headers });
-                }
-                catch (err) {
-                    return Response.json({ error: `failed to read config: ${deps.describeError(err)}` }, { status: 500, headers });
-                }
-            }
-            if (request.method === "POST") {
-                let body;
-                try {
-                    body = (await request.json());
-                }
-                catch {
-                    return Response.json({ error: "invalid json body" }, { status: 400, headers });
-                }
-                if (!body || !("patch" in body)) {
-                    return Response.json({ error: "missing patch payload" }, { status: 400, headers });
-                }
-                try {
-                    const base = await deps.loadConfigFromDisk();
-                    const next = applyMuConfigPatch(base, body.patch);
-                    const configPath = await deps.writeConfig(deps.context.repoRoot, next);
-                    return Response.json({
-                        ok: true,
-                        repo_root: deps.context.repoRoot,
-                        config_path: configPath,
-                        config: redactMuConfigSecrets(next),
-                        presence: muConfigPresence(next),
-                    }, { headers });
-                }
-                catch (err) {
-                    return Response.json({ error: `failed to write config: ${deps.describeError(err)}` }, { status: 500, headers });
-                }
-            }
-            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-        }
-        if (path === "/api/control-plane/reload") {
+        if (path === "/api/server/shutdown") {
             if (request.method !== "POST") {
                 return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
             }
-            let reason = "api_control_plane_reload";
-            try {
-                const body = (await request.json());
-                if (typeof body.reason === "string" && body.reason.trim().length > 0) {
-                    reason = body.reason.trim();
-                }
-            }
-            catch {
-                // ignore invalid body for reason
+            if (!deps.initiateShutdown) {
+                return Response.json({ error: "shutdown not supported" }, { status: 501, headers });
             }
-            const result = await deps.reloadControlPlane(reason);
-            return Response.json(result, { status: result.ok ? 200 : 500, headers });
+            const shutdown = deps.initiateShutdown;
+            // Respond before shutting down so the client receives the response.
+            setTimeout(() => { void shutdown(); }, 100);
+            return Response.json({ ok: true, message: "shutdown initiated" }, { headers });
         }
-        if (path === "/api/control-plane/rollback") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const result = await deps.reloadControlPlane("rollback");
-            return Response.json(result, { status: result.ok ? 200 : 500, headers });
+        if (path === "/api/config") {
+            return configRoutes(request, url, deps, headers);
+        }
+        if (path === "/api/control-plane/reload" || path === "/api/control-plane/rollback") {
+            return controlPlaneRoutes(request, url, deps, headers);
         }
         if (path === "/api/status") {
             const issues = await deps.context.issueStore.list();
@@ -210,845 +163,20 @@ export function createServerRequestHandler(deps) {
                 return Response.json({ error: `command failed: ${deps.describeError(err)}` }, { status: 500, headers });
             }
         }
-        if (path === "/api/runs") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const status = url.searchParams.get("status")?.trim() || undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const runs = await deps.controlPlaneProxy.listRuns?.({ status, limit });
-            return Response.json({ count: runs?.length ?? 0, runs: runs ?? [] }, { headers });
-        }
-        if (path === "/api/runs/start") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const prompt = typeof body.prompt === "string" ? body.prompt.trim() : "";
-            if (prompt.length === 0) {
-                return Response.json({ error: "prompt is required" }, { status: 400, headers });
-            }
-            const maxSteps = typeof body.max_steps === "number" && Number.isFinite(body.max_steps)
-                ? Math.max(1, Math.trunc(body.max_steps))
-                : undefined;
-            try {
-                const run = await deps.controlPlaneProxy.startRun?.({ prompt, maxSteps });
-                if (!run) {
-                    return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-                }
-                await deps.registerAutoRunHeartbeatProgram(run).catch(async (error) => {
-                    await deps.context.eventLog.emit("run.auto_heartbeat.lifecycle", {
-                        source: "mu-server.runs",
-                        payload: {
-                            action: "register_failed",
-                            run_job_id: run.job_id,
-                            error: deps.describeError(error),
-                        },
-                    });
-                });
-                return Response.json({ ok: true, run }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: deps.describeError(err) }, { status: 500, headers });
-            }
-        }
-        if (path === "/api/runs/resume") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const rootIssueId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : "";
-            if (rootIssueId.length === 0) {
-                return Response.json({ error: "root_issue_id is required" }, { status: 400, headers });
-            }
-            const maxSteps = typeof body.max_steps === "number" && Number.isFinite(body.max_steps)
-                ? Math.max(1, Math.trunc(body.max_steps))
-                : undefined;
-            try {
-                const run = await deps.controlPlaneProxy.resumeRun?.({ rootIssueId, maxSteps });
-                if (!run) {
-                    return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-                }
-                await deps.registerAutoRunHeartbeatProgram(run).catch(async (error) => {
-                    await deps.context.eventLog.emit("run.auto_heartbeat.lifecycle", {
-                        source: "mu-server.runs",
-                        payload: {
-                            action: "register_failed",
-                            run_job_id: run.job_id,
-                            error: deps.describeError(error),
-                        },
-                    });
-                });
-                return Response.json({ ok: true, run }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: deps.describeError(err) }, { status: 500, headers });
-            }
-        }
-        if (path === "/api/runs/interrupt") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const rootIssueId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : null;
-            const jobId = typeof body.job_id === "string" ? body.job_id.trim() : null;
-            const result = await deps.controlPlaneProxy.interruptRun?.({
-                rootIssueId,
-                jobId,
-            });
-            if (!result) {
-                return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-            }
-            if (!result.ok && result.reason === "not_running" && result.run) {
-                await deps.disableAutoRunHeartbeatProgram({
-                    jobId: result.run.job_id,
-                    status: result.run.status,
-                    reason: "interrupt_not_running",
-                }).catch(() => {
-                    // best effort cleanup only
-                });
-            }
-            return Response.json(result, { status: result.ok ? 200 : 404, headers });
-        }
-        if (path === "/api/runs/heartbeat") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const rootIssueId = typeof body.root_issue_id === "string" ? body.root_issue_id.trim() : null;
-            const jobId = typeof body.job_id === "string" ? body.job_id.trim() : null;
-            const reason = typeof body.reason === "string" ? body.reason.trim() : null;
-            const wakeMode = normalizeWakeMode(body.wake_mode);
-            const result = await deps.controlPlaneProxy.heartbeatRun?.({
-                rootIssueId,
-                jobId,
-                reason,
-                wakeMode,
-            });
-            if (!result) {
-                return Response.json({ error: "run supervisor unavailable" }, { status: 503, headers });
-            }
-            if (!result.ok && result.reason === "not_running" && result.run) {
-                await deps.disableAutoRunHeartbeatProgram({
-                    jobId: result.run.job_id,
-                    status: result.run.status,
-                    reason: "run_not_running",
-                }).catch(() => {
-                    // best effort cleanup only
-                });
-            }
-            if (result.ok) {
-                return Response.json(result, { status: 200, headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
-        }
-        if (path.startsWith("/api/runs/")) {
-            const rest = path.slice("/api/runs/".length);
-            const [rawId, maybeSub] = rest.split("/");
-            const idOrRoot = decodeURIComponent(rawId ?? "").trim();
-            if (idOrRoot.length === 0) {
-                return Response.json({ error: "missing run id" }, { status: 400, headers });
-            }
-            if (maybeSub === "trace") {
-                if (request.method !== "GET") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                const limitRaw = url.searchParams.get("limit");
-                const limit = limitRaw && /^\d+$/.test(limitRaw)
-                    ? Math.max(1, Math.min(2_000, Number.parseInt(limitRaw, 10)))
-                    : undefined;
-                const trace = await deps.controlPlaneProxy.traceRun?.({ idOrRoot, limit });
-                if (!trace) {
-                    return Response.json({ error: "run trace not found" }, { status: 404, headers });
-                }
-                return Response.json(trace, { headers });
-            }
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const run = await deps.controlPlaneProxy.getRun?.(idOrRoot);
-            if (!run) {
-                return Response.json({ error: "run not found" }, { status: 404, headers });
-            }
-            if (run.status !== "running") {
-                await deps.disableAutoRunHeartbeatProgram({
-                    jobId: run.job_id,
-                    status: run.status,
-                    reason: "run_terminal_snapshot",
-                }).catch(() => {
-                    // best effort cleanup only
-                });
-            }
-            return Response.json(run, { headers });
-        }
-        if (path === "/api/cron/status") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const status = await deps.cronPrograms.status();
-            return Response.json(status, { headers });
-        }
-        if (path === "/api/cron") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const enabledRaw = url.searchParams.get("enabled")?.trim().toLowerCase();
-            const enabled = enabledRaw === "true" ? true : enabledRaw === "false" ? false : undefined;
-            const targetKindRaw = url.searchParams.get("target_kind")?.trim().toLowerCase();
-            const targetKind = targetKindRaw === "run" || targetKindRaw === "activity" ? targetKindRaw : undefined;
-            const scheduleKindRaw = url.searchParams.get("schedule_kind")?.trim().toLowerCase();
-            const scheduleKind = scheduleKindRaw === "at" || scheduleKindRaw === "every" || scheduleKindRaw === "cron"
-                ? scheduleKindRaw
-                : undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const programs = await deps.cronPrograms.list({ enabled, targetKind, scheduleKind, limit });
-            return Response.json({ count: programs.length, programs }, { headers });
-        }
-        if (path === "/api/cron/create") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const title = typeof body.title === "string" ? body.title.trim() : "";
-            if (!title) {
-                return Response.json({ error: "title is required" }, { status: 400, headers });
-            }
-            const parsedTarget = parseCronTarget(body);
-            if (!parsedTarget.target) {
-                return Response.json({ error: parsedTarget.error ?? "invalid target" }, { status: 400, headers });
-            }
-            if (!hasCronScheduleInput(body)) {
-                return Response.json({ error: "schedule is required" }, { status: 400, headers });
-            }
-            const schedule = cronScheduleInputFromBody(body);
-            const reason = typeof body.reason === "string" ? body.reason.trim() : undefined;
-            const wakeMode = normalizeWakeMode(body.wake_mode);
-            const enabled = typeof body.enabled === "boolean" ? body.enabled : undefined;
-            try {
-                const program = await deps.cronPrograms.create({
-                    title,
-                    target: parsedTarget.target,
-                    schedule,
-                    reason,
-                    wakeMode,
-                    enabled,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                return Response.json({ ok: true, program }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/cron/update") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            let target;
-            if (typeof body.target_kind === "string") {
-                const parsedTarget = parseCronTarget(body);
-                if (!parsedTarget.target) {
-                    return Response.json({ error: parsedTarget.error ?? "invalid target" }, { status: 400, headers });
-                }
-                target = parsedTarget.target;
-            }
-            const schedule = hasCronScheduleInput(body) ? cronScheduleInputFromBody(body) : undefined;
-            const wakeMode = Object.hasOwn(body, "wake_mode") ? normalizeWakeMode(body.wake_mode) : undefined;
-            try {
-                const result = await deps.cronPrograms.update({
-                    programId,
-                    title: typeof body.title === "string" ? body.title : undefined,
-                    reason: typeof body.reason === "string" ? body.reason : undefined,
-                    wakeMode,
-                    enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
-                    target,
-                    schedule,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                if (result.ok) {
-                    return Response.json(result, { headers });
-                }
-                if (result.reason === "not_found") {
-                    return Response.json(result, { status: 404, headers });
-                }
-                return Response.json(result, { status: 400, headers });
-            }
-            catch (err) {
-                return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/cron/delete") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            const result = await deps.cronPrograms.remove(programId);
-            return Response.json(result, { status: result.ok ? 200 : result.reason === "not_found" ? 404 : 400, headers });
-        }
-        if (path === "/api/cron/trigger") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = await deps.cronPrograms.trigger({
-                programId: typeof body.program_id === "string" ? body.program_id : null,
-                reason: typeof body.reason === "string" ? body.reason : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_found") {
-                return Response.json(result, { status: 404, headers });
-            }
-            return Response.json(result, { status: 409, headers });
-        }
-        if (path.startsWith("/api/cron/")) {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const id = decodeURIComponent(path.slice("/api/cron/".length)).trim();
-            if (!id) {
-                return Response.json({ error: "missing program id" }, { status: 400, headers });
-            }
-            const program = await deps.cronPrograms.get(id);
-            if (!program) {
-                return Response.json({ error: "program not found" }, { status: 404, headers });
-            }
-            return Response.json(program, { headers });
-        }
-        if (path === "/api/heartbeats") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const enabledRaw = url.searchParams.get("enabled")?.trim().toLowerCase();
-            const enabled = enabledRaw === "true" ? true : enabledRaw === "false" ? false : undefined;
-            const targetKindRaw = url.searchParams.get("target_kind")?.trim().toLowerCase();
-            const targetKind = targetKindRaw === "run" || targetKindRaw === "activity" ? targetKindRaw : undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const programs = await deps.heartbeatPrograms.list({ enabled, targetKind, limit });
-            return Response.json({ count: programs.length, programs }, { headers });
-        }
-        if (path === "/api/heartbeats/create") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const title = typeof body.title === "string" ? body.title.trim() : "";
-            if (!title) {
-                return Response.json({ error: "title is required" }, { status: 400, headers });
-            }
-            const targetKind = typeof body.target_kind === "string" ? body.target_kind.trim().toLowerCase() : "";
-            let target = null;
-            if (targetKind === "run") {
-                const jobId = typeof body.run_job_id === "string" ? body.run_job_id.trim() : "";
-                const rootIssueId = typeof body.run_root_issue_id === "string" ? body.run_root_issue_id.trim() : "";
-                if (!jobId && !rootIssueId) {
-                    return Response.json({ error: "run target requires run_job_id or run_root_issue_id" }, { status: 400, headers });
-                }
-                target = {
-                    kind: "run",
-                    job_id: jobId || null,
-                    root_issue_id: rootIssueId || null,
-                };
-            }
-            else if (targetKind === "activity") {
-                const activityId = typeof body.activity_id === "string" ? body.activity_id.trim() : "";
-                if (!activityId) {
-                    return Response.json({ error: "activity target requires activity_id" }, { status: 400, headers });
-                }
-                target = {
-                    kind: "activity",
-                    activity_id: activityId,
-                };
-            }
-            else {
-                return Response.json({ error: "target_kind must be run or activity" }, { status: 400, headers });
-            }
-            const everyMs = typeof body.every_ms === "number" && Number.isFinite(body.every_ms)
-                ? Math.max(0, Math.trunc(body.every_ms))
-                : undefined;
-            const reason = typeof body.reason === "string" ? body.reason.trim() : undefined;
-            const wakeMode = normalizeWakeMode(body.wake_mode);
-            const enabled = typeof body.enabled === "boolean" ? body.enabled : undefined;
-            try {
-                const program = await deps.heartbeatPrograms.create({
-                    title,
-                    target,
-                    everyMs,
-                    reason,
-                    wakeMode,
-                    enabled,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                return Response.json({ ok: true, program }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/heartbeats/update") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            let target;
-            if (typeof body.target_kind === "string") {
-                const targetKind = body.target_kind.trim().toLowerCase();
-                if (targetKind === "run") {
-                    const jobId = typeof body.run_job_id === "string" ? body.run_job_id.trim() : "";
-                    const rootIssueId = typeof body.run_root_issue_id === "string" ? body.run_root_issue_id.trim() : "";
-                    if (!jobId && !rootIssueId) {
-                        return Response.json({ error: "run target requires run_job_id or run_root_issue_id" }, { status: 400, headers });
-                    }
-                    target = {
-                        kind: "run",
-                        job_id: jobId || null,
-                        root_issue_id: rootIssueId || null,
-                    };
-                }
-                else if (targetKind === "activity") {
-                    const activityId = typeof body.activity_id === "string" ? body.activity_id.trim() : "";
-                    if (!activityId) {
-                        return Response.json({ error: "activity target requires activity_id" }, { status: 400, headers });
-                    }
-                    target = {
-                        kind: "activity",
-                        activity_id: activityId,
-                    };
-                }
-                else {
-                    return Response.json({ error: "target_kind must be run or activity" }, { status: 400, headers });
-                }
-            }
-            const wakeMode = Object.hasOwn(body, "wake_mode") ? normalizeWakeMode(body.wake_mode) : undefined;
-            try {
-                const result = await deps.heartbeatPrograms.update({
-                    programId,
-                    title: typeof body.title === "string" ? body.title : undefined,
-                    target,
-                    everyMs: typeof body.every_ms === "number" && Number.isFinite(body.every_ms)
-                        ? Math.max(0, Math.trunc(body.every_ms))
-                        : undefined,
-                    reason: typeof body.reason === "string" ? body.reason : undefined,
-                    wakeMode,
-                    enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
-                    metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
-                        ? body.metadata
-                        : undefined,
-                });
-                if (result.ok) {
-                    return Response.json(result, { headers });
-                }
-                return Response.json(result, { status: result.reason === "not_found" ? 404 : 400, headers });
-            }
-            catch (err) {
-                return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
-            }
-        }
-        if (path === "/api/heartbeats/delete") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
-            if (!programId) {
-                return Response.json({ error: "program_id is required" }, { status: 400, headers });
-            }
-            const result = await deps.heartbeatPrograms.remove(programId);
-            return Response.json(result, { status: result.ok ? 200 : result.reason === "not_found" ? 404 : 400, headers });
-        }
-        if (path === "/api/heartbeats/trigger") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = await deps.heartbeatPrograms.trigger({
-                programId: typeof body.program_id === "string" ? body.program_id : null,
-                reason: typeof body.reason === "string" ? body.reason : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_found") {
-                return Response.json(result, { status: 404, headers });
-            }
-            return Response.json(result, { status: 409, headers });
-        }
-        if (path.startsWith("/api/heartbeats/")) {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const id = decodeURIComponent(path.slice("/api/heartbeats/".length)).trim();
-            if (!id) {
-                return Response.json({ error: "missing program id" }, { status: 400, headers });
-            }
-            const program = await deps.heartbeatPrograms.get(id);
-            if (!program) {
-                return Response.json({ error: "program not found" }, { status: 404, headers });
-            }
-            return Response.json(program, { headers });
-        }
-        if (path === "/api/activities") {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const statusRaw = url.searchParams.get("status")?.trim().toLowerCase();
-            const status = statusRaw === "running" || statusRaw === "completed" || statusRaw === "failed" || statusRaw === "cancelled"
-                ? statusRaw
-                : undefined;
-            const kind = url.searchParams.get("kind")?.trim() || undefined;
-            const limitRaw = url.searchParams.get("limit");
-            const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
-            const activities = deps.activitySupervisor.list({ status, kind, limit });
-            return Response.json({ count: activities.length, activities }, { headers });
+        if (path === "/api/runs" || path.startsWith("/api/runs/")) {
+            return runRoutes(request, url, deps, headers);
         }
-        if (path === "/api/activities/start") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const title = typeof body.title === "string" ? body.title.trim() : "";
-            if (!title) {
-                return Response.json({ error: "title is required" }, { status: 400, headers });
-            }
-            const kind = typeof body.kind === "string" ? body.kind.trim() : undefined;
-            const heartbeatEveryMs = typeof body.heartbeat_every_ms === "number" && Number.isFinite(body.heartbeat_every_ms)
-                ? Math.max(0, Math.trunc(body.heartbeat_every_ms))
-                : undefined;
-            const source = body.source === "api" || body.source === "command" || body.source === "system" ? body.source : "api";
-            try {
-                const activity = deps.activitySupervisor.start({
-                    title,
-                    kind,
-                    heartbeatEveryMs,
-                    metadata: body.metadata ?? undefined,
-                    source,
-                });
-                return Response.json({ ok: true, activity }, { status: 201, headers });
-            }
-            catch (err) {
-                return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
-            }
+        if (path === "/api/cron" || path.startsWith("/api/cron/")) {
+            return cronRoutes(request, url, deps, headers);
         }
-        if (path === "/api/activities/progress") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = deps.activitySupervisor.progress({
-                activityId: typeof body.activity_id === "string" ? body.activity_id : null,
-                message: typeof body.message === "string" ? body.message : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
+        if (path === "/api/heartbeats" || path.startsWith("/api/heartbeats/")) {
+            return heartbeatRoutes(request, url, deps, headers);
         }
-        if (path === "/api/activities/heartbeat") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const result = deps.activitySupervisor.heartbeat({
-                activityId: typeof body.activity_id === "string" ? body.activity_id : null,
-                reason: typeof body.reason === "string" ? body.reason : null,
-            });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
-        }
-        if (path === "/api/activities/complete" || path === "/api/activities/fail" || path === "/api/activities/cancel") {
-            if (request.method !== "POST") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            let body;
-            try {
-                body = (await request.json());
-            }
-            catch {
-                return Response.json({ error: "invalid json body" }, { status: 400, headers });
-            }
-            const activityId = typeof body.activity_id === "string" ? body.activity_id : null;
-            const message = typeof body.message === "string" ? body.message : null;
-            const result = path === "/api/activities/complete"
-                ? deps.activitySupervisor.complete({ activityId, message })
-                : path === "/api/activities/fail"
-                    ? deps.activitySupervisor.fail({ activityId, message })
-                    : deps.activitySupervisor.cancel({ activityId, message });
-            if (result.ok) {
-                return Response.json(result, { headers });
-            }
-            if (result.reason === "missing_target") {
-                return Response.json(result, { status: 400, headers });
-            }
-            if (result.reason === "not_running") {
-                return Response.json(result, { status: 409, headers });
-            }
-            return Response.json(result, { status: 404, headers });
-        }
-        if (path.startsWith("/api/activities/")) {
-            if (request.method !== "GET") {
-                return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-            }
-            const rest = path.slice("/api/activities/".length);
-            const [rawId, maybeSub] = rest.split("/");
-            const activityId = decodeURIComponent(rawId ?? "").trim();
-            if (activityId.length === 0) {
-                return Response.json({ error: "missing activity id" }, { status: 400, headers });
-            }
-            if (maybeSub === "events") {
-                const limitRaw = url.searchParams.get("limit");
-                const limit = limitRaw && /^\d+$/.test(limitRaw)
-                    ? Math.max(1, Math.min(2_000, Number.parseInt(limitRaw, 10)))
-                    : undefined;
-                const events = deps.activitySupervisor.events(activityId, { limit });
-                if (!events) {
-                    return Response.json({ error: "activity not found" }, { status: 404, headers });
-                }
-                return Response.json({ count: events.length, events }, { headers });
-            }
-            const activity = deps.activitySupervisor.get(activityId);
-            if (!activity) {
-                return Response.json({ error: "activity not found" }, { status: 404, headers });
-            }
-            return Response.json(activity, { headers });
+        if (path === "/api/activities" || path.startsWith("/api/activities/")) {
+            return activityRoutes(request, url, deps, headers);
         }
         if (path === "/api/identities" || path === "/api/identities/link" || path === "/api/identities/unlink") {
-            const cpPaths = getControlPlanePaths(deps.context.repoRoot);
-            const identityStore = new IdentityStore(cpPaths.identitiesPath);
-            await identityStore.load();
-            if (path === "/api/identities") {
-                if (request.method !== "GET") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                const includeInactive = url.searchParams.get("include_inactive")?.trim().toLowerCase() === "true";
-                const bindings = identityStore.listBindings({ includeInactive });
-                return Response.json({ count: bindings.length, bindings }, { headers });
-            }
-            if (path === "/api/identities/link") {
-                if (request.method !== "POST") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                let body;
-                try {
-                    body = (await request.json());
-                }
-                catch {
-                    return Response.json({ error: "invalid json body" }, { status: 400, headers });
-                }
-                const channel = typeof body.channel === "string" ? body.channel.trim() : "";
-                if (!channel || (channel !== "slack" && channel !== "discord" && channel !== "telegram")) {
-                    return Response.json({ error: "channel is required (slack, discord, telegram)" }, { status: 400, headers });
-                }
-                const actorId = typeof body.actor_id === "string" ? body.actor_id.trim() : "";
-                if (!actorId) {
-                    return Response.json({ error: "actor_id is required" }, { status: 400, headers });
-                }
-                const tenantId = typeof body.tenant_id === "string" ? body.tenant_id.trim() : "";
-                if (!tenantId) {
-                    return Response.json({ error: "tenant_id is required" }, { status: 400, headers });
-                }
-                const roleKey = typeof body.role === "string" ? body.role.trim() : "operator";
-                const roleScopes = ROLE_SCOPES[roleKey];
-                if (!roleScopes) {
-                    return Response.json({ error: `invalid role: ${roleKey} (operator, contributor, viewer)` }, { status: 400, headers });
-                }
-                const bindingId = typeof body.binding_id === "string" && body.binding_id.trim().length > 0
-                    ? body.binding_id.trim()
-                    : `bind-${crypto.randomUUID()}`;
-                const operatorId = typeof body.operator_id === "string" && body.operator_id.trim().length > 0
-                    ? body.operator_id.trim()
-                    : "default";
-                const decision = await identityStore.link({
-                    bindingId,
-                    operatorId,
-                    channel: channel,
-                    channelTenantId: tenantId,
-                    channelActorId: actorId,
-                    scopes: [...roleScopes],
-                });
-                switch (decision.kind) {
-                    case "linked":
-                        return Response.json({ ok: true, kind: "linked", binding: decision.binding }, { status: 201, headers });
-                    case "binding_exists":
-                        return Response.json({ ok: false, kind: "binding_exists", binding: decision.binding }, { status: 409, headers });
-                    case "principal_already_linked":
-                        return Response.json({ ok: false, kind: "principal_already_linked", binding: decision.binding }, { status: 409, headers });
-                }
-            }
-            if (path === "/api/identities/unlink") {
-                if (request.method !== "POST") {
-                    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
-                }
-                let body;
-                try {
-                    body = (await request.json());
-                }
-                catch {
-                    return Response.json({ error: "invalid json body" }, { status: 400, headers });
-                }
-                const bindingId = typeof body.binding_id === "string" ? body.binding_id.trim() : "";
-                if (!bindingId) {
-                    return Response.json({ error: "binding_id is required" }, { status: 400, headers });
-                }
-                const actorBindingId = typeof body.actor_binding_id === "string" ? body.actor_binding_id.trim() : "";
-                if (!actorBindingId) {
-                    return Response.json({ error: "actor_binding_id is required" }, { status: 400, headers });
-                }
-                const reason = typeof body.reason === "string" ? body.reason.trim() : null;
-                const decision = await identityStore.unlinkSelf({
-                    bindingId,
-                    actorBindingId,
-                    reason: reason || null,
-                });
-                switch (decision.kind) {
-                    case "unlinked":
-                        return Response.json({ ok: true, kind: "unlinked", binding: decision.binding }, { headers });
-                    case "not_found":
-                        return Response.json({ ok: false, kind: "not_found" }, { status: 404, headers });
-                    case "invalid_actor":
-                        return Response.json({ ok: false, kind: "invalid_actor" }, { status: 403, headers });
-                    case "already_inactive":
-                        return Response.json({ ok: false, kind: "already_inactive", binding: decision.binding }, { status: 409, headers });
-                }
-            }
+            return identityRoutes(request, url, deps, headers);
         }
         if (path.startsWith("/api/issues")) {
             const response = await issueRoutes(request, deps.context);