@femtomc/mu-server 26.2.70 → 26.2.72

package/dist/api/activities.d.ts

@@ -0,0 +1,2 @@
+import type { ServerRoutingDependencies } from "../server_routing.js";
+export declare function activityRoutes(request: Request, url: URL, deps: ServerRoutingDependencies, headers: Headers): Promise<Response>;

package/dist/api/activities.js

@@ -0,0 +1,160 @@
+export async function activityRoutes(request, url, deps, headers) {
+    const path = url.pathname;
+    if (path === "/api/activities") {
+        if (request.method !== "GET") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const statusRaw = url.searchParams.get("status")?.trim().toLowerCase();
+        const status = statusRaw === "running" || statusRaw === "completed" || statusRaw === "failed" || statusRaw === "cancelled"
+            ? statusRaw
+            : undefined;
+        const kind = url.searchParams.get("kind")?.trim() || undefined;
+        const limitRaw = url.searchParams.get("limit");
+        const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
+        const activities = deps.activitySupervisor.list({ status, kind, limit });
+        return Response.json({ count: activities.length, activities }, { headers });
+    }
+    if (path === "/api/activities/start") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const title = typeof body.title === "string" ? body.title.trim() : "";
+        if (!title) {
+            return Response.json({ error: "title is required" }, { status: 400, headers });
+        }
+        const kind = typeof body.kind === "string" ? body.kind.trim() : undefined;
+        const heartbeatEveryMs = typeof body.heartbeat_every_ms === "number" && Number.isFinite(body.heartbeat_every_ms)
+            ? Math.max(0, Math.trunc(body.heartbeat_every_ms))
+            : undefined;
+        const source = body.source === "api" || body.source === "command" || body.source === "system" ? body.source : "api";
+        try {
+            const activity = deps.activitySupervisor.start({
+                title,
+                kind,
+                heartbeatEveryMs,
+                metadata: body.metadata ?? undefined,
+                source,
+            });
+            return Response.json({ ok: true, activity }, { status: 201, headers });
+        }
+        catch (err) {
+            return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
+        }
+    }
+    if (path === "/api/activities/progress") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const result = deps.activitySupervisor.progress({
+            activityId: typeof body.activity_id === "string" ? body.activity_id : null,
+            message: typeof body.message === "string" ? body.message : null,
+        });
+        if (result.ok) {
+            return Response.json(result, { headers });
+        }
+        if (result.reason === "missing_target") {
+            return Response.json(result, { status: 400, headers });
+        }
+        if (result.reason === "not_running") {
+            return Response.json(result, { status: 409, headers });
+        }
+        return Response.json(result, { status: 404, headers });
+    }
+    if (path === "/api/activities/heartbeat") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const result = deps.activitySupervisor.heartbeat({
+            activityId: typeof body.activity_id === "string" ? body.activity_id : null,
+            reason: typeof body.reason === "string" ? body.reason : null,
+        });
+        if (result.ok) {
+            return Response.json(result, { headers });
+        }
+        if (result.reason === "missing_target") {
+            return Response.json(result, { status: 400, headers });
+        }
+        if (result.reason === "not_running") {
+            return Response.json(result, { status: 409, headers });
+        }
+        return Response.json(result, { status: 404, headers });
+    }
+    if (path === "/api/activities/complete" || path === "/api/activities/fail" || path === "/api/activities/cancel") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const activityId = typeof body.activity_id === "string" ? body.activity_id : null;
+        const message = typeof body.message === "string" ? body.message : null;
+        const result = path === "/api/activities/complete"
+            ? deps.activitySupervisor.complete({ activityId, message })
+            : path === "/api/activities/fail"
+                ? deps.activitySupervisor.fail({ activityId, message })
+                : deps.activitySupervisor.cancel({ activityId, message });
+        if (result.ok) {
+            return Response.json(result, { headers });
+        }
+        if (result.reason === "missing_target") {
+            return Response.json(result, { status: 400, headers });
+        }
+        if (result.reason === "not_running") {
+            return Response.json(result, { status: 409, headers });
+        }
+        return Response.json(result, { status: 404, headers });
+    }
+    if (path.startsWith("/api/activities/")) {
+        if (request.method !== "GET") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const rest = path.slice("/api/activities/".length);
+        const [rawId, maybeSub] = rest.split("/");
+        const activityId = decodeURIComponent(rawId ?? "").trim();
+        if (activityId.length === 0) {
+            return Response.json({ error: "missing activity id" }, { status: 400, headers });
+        }
+        if (maybeSub === "events") {
+            const limitRaw = url.searchParams.get("limit");
+            const limit = limitRaw && /^\d+$/.test(limitRaw)
+                ? Math.max(1, Math.min(2_000, Number.parseInt(limitRaw, 10)))
+                : undefined;
+            const events = deps.activitySupervisor.events(activityId, { limit });
+            if (!events) {
+                return Response.json({ error: "activity not found" }, { status: 404, headers });
+            }
+            return Response.json({ count: events.length, events }, { headers });
+        }
+        const activity = deps.activitySupervisor.get(activityId);
+        if (!activity) {
+            return Response.json({ error: "activity not found" }, { status: 404, headers });
+        }
+        return Response.json(activity, { headers });
+    }
+    return Response.json({ error: "Not Found" }, { status: 404, headers });
+}

package/dist/api/config.d.ts

@@ -0,0 +1,2 @@
+import type { ServerRoutingDependencies } from "../server_routing.js";
+export declare function configRoutes(request: Request, _url: URL, deps: ServerRoutingDependencies, headers: Headers): Promise<Response>;

package/dist/api/config.js

@@ -0,0 +1,45 @@
+import { applyMuConfigPatch, getMuConfigPath, muConfigPresence, redactMuConfigSecrets, } from "../config.js";
+export async function configRoutes(request, _url, deps, headers) {
+    if (request.method === "GET") {
+        try {
+            const config = await deps.loadConfigFromDisk();
+            return Response.json({
+                repo_root: deps.context.repoRoot,
+                config_path: getMuConfigPath(deps.context.repoRoot),
+                config: redactMuConfigSecrets(config),
+                presence: muConfigPresence(config),
+            }, { headers });
+        }
+        catch (err) {
+            return Response.json({ error: `failed to read config: ${deps.describeError(err)}` }, { status: 500, headers });
+        }
+    }
+    if (request.method === "POST") {
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        if (!body || !("patch" in body)) {
+            return Response.json({ error: "missing patch payload" }, { status: 400, headers });
+        }
+        try {
+            const base = await deps.loadConfigFromDisk();
+            const next = applyMuConfigPatch(base, body.patch);
+            const configPath = await deps.writeConfig(deps.context.repoRoot, next);
+            return Response.json({
+                ok: true,
+                repo_root: deps.context.repoRoot,
+                config_path: configPath,
+                config: redactMuConfigSecrets(next),
+                presence: muConfigPresence(next),
+            }, { headers });
+        }
+        catch (err) {
+            return Response.json({ error: `failed to write config: ${deps.describeError(err)}` }, { status: 500, headers });
+        }
+    }
+    return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+}

package/dist/api/control_plane.d.ts

@@ -0,0 +1,2 @@
+import type { ServerRoutingDependencies } from "../server_routing.js";
+export declare function controlPlaneRoutes(request: Request, url: URL, deps: ServerRoutingDependencies, headers: Headers): Promise<Response>;

package/dist/api/control_plane.js

@@ -0,0 +1,28 @@
+export async function controlPlaneRoutes(request, url, deps, headers) {
+    const path = url.pathname;
+    if (path === "/api/control-plane/reload") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let reason = "api_control_plane_reload";
+        try {
+            const body = (await request.json());
+            if (typeof body.reason === "string" && body.reason.trim().length > 0) {
+                reason = body.reason.trim();
+            }
+        }
+        catch {
+            // ignore invalid body for reason
+        }
+        const result = await deps.reloadControlPlane(reason);
+        return Response.json(result, { status: result.ok ? 200 : 500, headers });
+    }
+    if (path === "/api/control-plane/rollback") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const result = await deps.reloadControlPlane("rollback");
+        return Response.json(result, { status: result.ok ? 200 : 500, headers });
+    }
+    return Response.json({ error: "Not Found" }, { status: 404, headers });
+}

package/dist/api/cron.d.ts

@@ -0,0 +1,2 @@
+import type { ServerRoutingDependencies } from "../server_routing.js";
+export declare function cronRoutes(request: Request, url: URL, deps: ServerRoutingDependencies, headers: Headers): Promise<Response>;

package/dist/api/cron.js

@@ -0,0 +1,182 @@
+import { cronScheduleInputFromBody, hasCronScheduleInput, parseCronTarget, } from "../cron_request.js";
+import { normalizeWakeMode } from "../server_types.js";
+export async function cronRoutes(request, url, deps, headers) {
+    const path = url.pathname;
+    if (path === "/api/cron/status") {
+        if (request.method !== "GET") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const status = await deps.cronPrograms.status();
+        return Response.json(status, { headers });
+    }
+    if (path === "/api/cron") {
+        if (request.method !== "GET") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const enabledRaw = url.searchParams.get("enabled")?.trim().toLowerCase();
+        const enabled = enabledRaw === "true" ? true : enabledRaw === "false" ? false : undefined;
+        const targetKindRaw = url.searchParams.get("target_kind")?.trim().toLowerCase();
+        const targetKind = targetKindRaw === "run" || targetKindRaw === "activity" ? targetKindRaw : undefined;
+        const scheduleKindRaw = url.searchParams.get("schedule_kind")?.trim().toLowerCase();
+        const scheduleKind = scheduleKindRaw === "at" || scheduleKindRaw === "every" || scheduleKindRaw === "cron"
+            ? scheduleKindRaw
+            : undefined;
+        const limitRaw = url.searchParams.get("limit");
+        const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
+        const programs = await deps.cronPrograms.list({ enabled, targetKind, scheduleKind, limit });
+        return Response.json({ count: programs.length, programs }, { headers });
+    }
+    if (path === "/api/cron/create") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const title = typeof body.title === "string" ? body.title.trim() : "";
+        if (!title) {
+            return Response.json({ error: "title is required" }, { status: 400, headers });
+        }
+        const parsedTarget = parseCronTarget(body);
+        if (!parsedTarget.target) {
+            return Response.json({ error: parsedTarget.error ?? "invalid target" }, { status: 400, headers });
+        }
+        if (!hasCronScheduleInput(body)) {
+            return Response.json({ error: "schedule is required" }, { status: 400, headers });
+        }
+        const schedule = cronScheduleInputFromBody(body);
+        const reason = typeof body.reason === "string" ? body.reason.trim() : undefined;
+        const wakeMode = normalizeWakeMode(body.wake_mode);
+        const enabled = typeof body.enabled === "boolean" ? body.enabled : undefined;
+        try {
+            const program = await deps.cronPrograms.create({
+                title,
+                target: parsedTarget.target,
+                schedule,
+                reason,
+                wakeMode,
+                enabled,
+                metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
+                    ? body.metadata
+                    : undefined,
+            });
+            return Response.json({ ok: true, program }, { status: 201, headers });
+        }
+        catch (err) {
+            return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
+        }
+    }
+    if (path === "/api/cron/update") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
+        if (!programId) {
+            return Response.json({ error: "program_id is required" }, { status: 400, headers });
+        }
+        let target;
+        if (typeof body.target_kind === "string") {
+            const parsedTarget = parseCronTarget(body);
+            if (!parsedTarget.target) {
+                return Response.json({ error: parsedTarget.error ?? "invalid target" }, { status: 400, headers });
+            }
+            target = parsedTarget.target;
+        }
+        const schedule = hasCronScheduleInput(body) ? cronScheduleInputFromBody(body) : undefined;
+        const wakeMode = Object.hasOwn(body, "wake_mode") ? normalizeWakeMode(body.wake_mode) : undefined;
+        try {
+            const result = await deps.cronPrograms.update({
+                programId,
+                title: typeof body.title === "string" ? body.title : undefined,
+                reason: typeof body.reason === "string" ? body.reason : undefined,
+                wakeMode,
+                enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
+                target,
+                schedule,
+                metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
+                    ? body.metadata
+                    : undefined,
+            });
+            if (result.ok) {
+                return Response.json(result, { headers });
+            }
+            if (result.reason === "not_found") {
+                return Response.json(result, { status: 404, headers });
+            }
+            return Response.json(result, { status: 400, headers });
+        }
+        catch (err) {
+            return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
+        }
+    }
+    if (path === "/api/cron/delete") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
+        if (!programId) {
+            return Response.json({ error: "program_id is required" }, { status: 400, headers });
+        }
+        const result = await deps.cronPrograms.remove(programId);
+        return Response.json(result, { status: result.ok ? 200 : result.reason === "not_found" ? 404 : 400, headers });
+    }
+    if (path === "/api/cron/trigger") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const result = await deps.cronPrograms.trigger({
+            programId: typeof body.program_id === "string" ? body.program_id : null,
+            reason: typeof body.reason === "string" ? body.reason : null,
+        });
+        if (result.ok) {
+            return Response.json(result, { headers });
+        }
+        if (result.reason === "missing_target") {
+            return Response.json(result, { status: 400, headers });
+        }
+        if (result.reason === "not_found") {
+            return Response.json(result, { status: 404, headers });
+        }
+        return Response.json(result, { status: 409, headers });
+    }
+    if (path.startsWith("/api/cron/")) {
+        if (request.method !== "GET") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const id = decodeURIComponent(path.slice("/api/cron/".length)).trim();
+        if (!id) {
+            return Response.json({ error: "missing program id" }, { status: 400, headers });
+        }
+        const program = await deps.cronPrograms.get(id);
+        if (!program) {
+            return Response.json({ error: "program not found" }, { status: 404, headers });
+        }
+        return Response.json(program, { headers });
+    }
+    return Response.json({ error: "Not Found" }, { status: 404, headers });
+}

package/dist/api/heartbeats.d.ts

@@ -0,0 +1,2 @@
+import type { ServerRoutingDependencies } from "../server_routing.js";
+export declare function heartbeatRoutes(request: Request, url: URL, deps: ServerRoutingDependencies, headers: Headers): Promise<Response>;

package/dist/api/heartbeats.js

@@ -0,0 +1,211 @@
+import { normalizeWakeMode } from "../server_types.js";
+export async function heartbeatRoutes(request, url, deps, headers) {
+    const path = url.pathname;
+    if (path === "/api/heartbeats") {
+        if (request.method !== "GET") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const enabledRaw = url.searchParams.get("enabled")?.trim().toLowerCase();
+        const enabled = enabledRaw === "true" ? true : enabledRaw === "false" ? false : undefined;
+        const targetKindRaw = url.searchParams.get("target_kind")?.trim().toLowerCase();
+        const targetKind = targetKindRaw === "run" || targetKindRaw === "activity" ? targetKindRaw : undefined;
+        const limitRaw = url.searchParams.get("limit");
+        const limit = limitRaw && /^\d+$/.test(limitRaw) ? Math.max(1, Math.min(500, Number.parseInt(limitRaw, 10))) : undefined;
+        const programs = await deps.heartbeatPrograms.list({ enabled, targetKind, limit });
+        return Response.json({ count: programs.length, programs }, { headers });
+    }
+    if (path === "/api/heartbeats/create") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const title = typeof body.title === "string" ? body.title.trim() : "";
+        if (!title) {
+            return Response.json({ error: "title is required" }, { status: 400, headers });
+        }
+        const targetKind = typeof body.target_kind === "string" ? body.target_kind.trim().toLowerCase() : "";
+        let target = null;
+        if (targetKind === "run") {
+            const jobId = typeof body.run_job_id === "string" ? body.run_job_id.trim() : "";
+            const rootIssueId = typeof body.run_root_issue_id === "string" ? body.run_root_issue_id.trim() : "";
+            if (!jobId && !rootIssueId) {
+                return Response.json({ error: "run target requires run_job_id or run_root_issue_id" }, { status: 400, headers });
+            }
+            target = {
+                kind: "run",
+                job_id: jobId || null,
+                root_issue_id: rootIssueId || null,
+            };
+        }
+        else if (targetKind === "activity") {
+            const activityId = typeof body.activity_id === "string" ? body.activity_id.trim() : "";
+            if (!activityId) {
+                return Response.json({ error: "activity target requires activity_id" }, { status: 400, headers });
+            }
+            target = {
+                kind: "activity",
+                activity_id: activityId,
+            };
+        }
+        else {
+            return Response.json({ error: "target_kind must be run or activity" }, { status: 400, headers });
+        }
+        const everyMs = typeof body.every_ms === "number" && Number.isFinite(body.every_ms)
+            ? Math.max(0, Math.trunc(body.every_ms))
+            : undefined;
+        const reason = typeof body.reason === "string" ? body.reason.trim() : undefined;
+        const wakeMode = normalizeWakeMode(body.wake_mode);
+        const enabled = typeof body.enabled === "boolean" ? body.enabled : undefined;
+        try {
+            const program = await deps.heartbeatPrograms.create({
+                title,
+                target,
+                everyMs,
+                reason,
+                wakeMode,
+                enabled,
+                metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
+                    ? body.metadata
+                    : undefined,
+            });
+            return Response.json({ ok: true, program }, { status: 201, headers });
+        }
+        catch (err) {
+            return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
+        }
+    }
+    if (path === "/api/heartbeats/update") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
+        if (!programId) {
+            return Response.json({ error: "program_id is required" }, { status: 400, headers });
+        }
+        let target;
+        if (typeof body.target_kind === "string") {
+            const targetKind = body.target_kind.trim().toLowerCase();
+            if (targetKind === "run") {
+                const jobId = typeof body.run_job_id === "string" ? body.run_job_id.trim() : "";
+                const rootIssueId = typeof body.run_root_issue_id === "string" ? body.run_root_issue_id.trim() : "";
+                if (!jobId && !rootIssueId) {
+                    return Response.json({ error: "run target requires run_job_id or run_root_issue_id" }, { status: 400, headers });
+                }
+                target = {
+                    kind: "run",
+                    job_id: jobId || null,
+                    root_issue_id: rootIssueId || null,
+                };
+            }
+            else if (targetKind === "activity") {
+                const activityId = typeof body.activity_id === "string" ? body.activity_id.trim() : "";
+                if (!activityId) {
+                    return Response.json({ error: "activity target requires activity_id" }, { status: 400, headers });
+                }
+                target = {
+                    kind: "activity",
+                    activity_id: activityId,
+                };
+            }
+            else {
+                return Response.json({ error: "target_kind must be run or activity" }, { status: 400, headers });
+            }
+        }
+        const wakeMode = Object.hasOwn(body, "wake_mode") ? normalizeWakeMode(body.wake_mode) : undefined;
+        try {
+            const result = await deps.heartbeatPrograms.update({
+                programId,
+                title: typeof body.title === "string" ? body.title : undefined,
+                target,
+                everyMs: typeof body.every_ms === "number" && Number.isFinite(body.every_ms)
+                    ? Math.max(0, Math.trunc(body.every_ms))
+                    : undefined,
+                reason: typeof body.reason === "string" ? body.reason : undefined,
+                wakeMode,
+                enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
+                metadata: body.metadata && typeof body.metadata === "object" && !Array.isArray(body.metadata)
+                    ? body.metadata
+                    : undefined,
+            });
+            if (result.ok) {
+                return Response.json(result, { headers });
+            }
+            return Response.json(result, { status: result.reason === "not_found" ? 404 : 400, headers });
+        }
+        catch (err) {
+            return Response.json({ error: deps.describeError(err) }, { status: 400, headers });
+        }
+    }
+    if (path === "/api/heartbeats/delete") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const programId = typeof body.program_id === "string" ? body.program_id.trim() : "";
+        if (!programId) {
+            return Response.json({ error: "program_id is required" }, { status: 400, headers });
+        }
+        const result = await deps.heartbeatPrograms.remove(programId);
+        return Response.json(result, { status: result.ok ? 200 : result.reason === "not_found" ? 404 : 400, headers });
+    }
+    if (path === "/api/heartbeats/trigger") {
+        if (request.method !== "POST") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        let body;
+        try {
+            body = (await request.json());
+        }
+        catch {
+            return Response.json({ error: "invalid json body" }, { status: 400, headers });
+        }
+        const result = await deps.heartbeatPrograms.trigger({
+            programId: typeof body.program_id === "string" ? body.program_id : null,
+            reason: typeof body.reason === "string" ? body.reason : null,
+        });
+        if (result.ok) {
+            return Response.json(result, { headers });
+        }
+        if (result.reason === "missing_target") {
+            return Response.json(result, { status: 400, headers });
+        }
+        if (result.reason === "not_found") {
+            return Response.json(result, { status: 404, headers });
+        }
+        return Response.json(result, { status: 409, headers });
+    }
+    if (path.startsWith("/api/heartbeats/")) {
+        if (request.method !== "GET") {
+            return Response.json({ error: "Method Not Allowed" }, { status: 405, headers });
+        }
+        const id = decodeURIComponent(path.slice("/api/heartbeats/".length)).trim();
+        if (!id) {
+            return Response.json({ error: "missing program id" }, { status: 400, headers });
+        }
+        const program = await deps.heartbeatPrograms.get(id);
+        if (!program) {
+            return Response.json({ error: "program not found" }, { status: 404, headers });
+        }
+        return Response.json(program, { headers });
+    }
+    return Response.json({ error: "Not Found" }, { status: 404, headers });
+}

package/dist/api/identities.d.ts

@@ -0,0 +1,2 @@
+import type { ServerRoutingDependencies } from "../server_routing.js";
+export declare function identityRoutes(request: Request, url: URL, deps: ServerRoutingDependencies, headers: Headers): Promise<Response>;