@lensagent/core 0.1.0 → 0.1.2

package/dist/http/server.js

@@ -1,12 +1,18 @@
-import { applyPurge } from '../runtime/cleanup.js';
+import { dirname, resolve } from 'node:path';
+import { once } from 'node:events';
+import { ConfigFiles } from '../config/files.js';
+import { applyPurge, commitPurge } from '../runtime/cleanup.js';
 import Fastify from 'fastify';
 import { digest, expectedRevision, integer, jsonValue, optionalText, record, text } from '../core/codec.js';
 import { LensError, fail } from '../core/domain.js';
+import { loopbackAddress } from '../core/access-policy.js';
 import { ExecutorCallError } from '../adapters/executor.js';
-import { resolveReasoningEffort } from '../runtime/profile.js';
+import { modelReasoningEfforts, resolveReasoningEffort } from '../runtime/profile.js';
 import { componentIdentity } from '../core/identity.js';
 export function createServer(dependencies) {
     const app = Fastify({ logger: false, bodyLimit: 4 * 1024 * 1024, requestIdHeader: 'x-correlation-id', ajv: { customOptions: { removeAdditional: false } }, ...(dependencies.https === undefined ? {} : { https: dependencies.https }) });
+    let managedFiles;
+    const files = () => managedFiles ??= new ConfigFiles(dirname(dependencies.config.path), [dependencies.config.path, dependencies.pair.path]);
     const contexts = new WeakMap();
     const starts = new WeakMap();
     const specs = [];
@@ -20,19 +26,34 @@ export function createServer(dependencies) {
                 error_code: typeof error === 'object' && error !== null && 'code' in error && typeof error.code === 'string' ? error.code : null
             });
         }
+        dependencies.observability.record('http', 'request_error', 'failed', 0, { status: failure.status, error_code: failure.code });
         void reply.status(failure.status).send({
             error: { code: failure.code, message: failure.message, retryable: retryableFailure(failure.status), details: failure.details },
             correlation_id: request.id
         });
     });
-    app.addHook('onRequest', async (request) => {
+    app.addHook('onRequest', async (request, reply) => {
         starts.set(request, performance.now());
         if (!request.url.startsWith('/api/v1/'))
             return;
+        if (!dependencies.config.current.config.tls.enabled && !loopbackAddress(request.socket.remoteAddress)) {
+            fail('HTTPS_REQUIRED', 403, 'Remote clients must use HTTPS.');
+        }
         const readiness = dependencies.ready();
         if (readiness.mode !== 'full')
             fail('RUNTIME_NOT_READY', 503, 'Lens Core is not ready.', { blockers: readiness.blockers });
-        const ingress = await dependencies.pair.authorize(request.headers, dependencies.config.current.config.tls.enabled ? 'https' : 'http', request.id);
+        const ingress = await dependencies.pair.authorize(request.headers, dependencies.config.current.config.tls.enabled ? 'https' : 'http', request.id, true, 
+        // The raw socket address, never `request.ip`: the latter honours forwarded headers, and a caller-supplied
+        // header must not be able to make a remote caller look local enough to admit itself.
+        request.socket.remoteAddress);
+        const path = request.url.split('?')[0] ?? '';
+        const sensitive = path === '/api/v1/config' || path === '/api/v1/config/validate' || path.startsWith('/api/v1/config/files') || /^\/api\/v1\/tasks\/[^/]+\/audit$/.test(path);
+        if (sensitive || !['GET', 'HEAD', 'OPTIONS'].includes(request.method)) {
+            if (!ingress.strongTrust)
+                fail('STRONG_TRUST_REQUIRED', 403, 'This operation requires a strongly trusted client.');
+        }
+        if (sensitive)
+            reply.header('Cache-Control', 'no-store');
         const projectId = resolveProjectId(request, dependencies.defaultProjectId);
         // Name the Project that was not found. An anonymous 404 here is indistinguishable from a
         // missing Route, and the id is supplied by the caller in a header, so echoing it back is
@@ -86,6 +107,7 @@ export function createServer(dependencies) {
         const bodySchema = requestBody(normalizedMethod, path);
         app.route({ method, url: path, handler, ...(bodySchema === null ? {} : { schema: { body: bodySchema } }) });
     };
+    const page = (request) => pageOptions(request, dependencies.config.current.config.snapshot);
     const project = (request) => {
         const context = contexts.get(request);
         if (context === undefined)
@@ -113,7 +135,7 @@ export function createServer(dependencies) {
         // in the 503 the two look alike, and offering a hard kill on that basis can terminate an
         // unrelated process. `pid` is what the endpoint-owner lookup verifies against.
         if (ready.mode !== 'full')
-            return reply.status(503).send({ error: { code: 'RUNTIME_NOT_READY', message: 'Lens Core is not ready.', details: { blockers: ready.blockers, ...componentSummary() } } });
+            return reply.status(503).send({ error: { code: 'RUNTIME_NOT_READY', message: 'Lens Core is not ready.', retryable: true, details: { blockers: ready.blockers, ...componentSummary() } } });
         return {
             data: {
                 status: 'ready',
@@ -156,9 +178,35 @@ export function createServer(dependencies) {
     });
     route('PUT', '/api/v1/config', async (request) => {
         const input = body(request);
-        await dependencies.config.replace(text(input.content, 'content', 4 * 1024 * 1024), text(input.expected_file_digest, 'expected_file_digest'));
+        await dependencies.config.replace(text(input.content, 'content', 4 * 1024 * 1024), text(input.expected_file_digest, 'expected_file_digest'), () => dependencies.pair.requireStrong(request.headers));
         return { data: dependencies.config.document(), meta: configMeta(dependencies) };
     });
+    route('GET', '/api/v1/access', (request) => ({ data: { client_id: contexts.get(request)?.ingress.clientId ?? null, strong_trust: contexts.get(request)?.ingress.strongTrust === true } }));
+    route('GET', '/api/v1/config/files', async () => ({ data: [{ id: 'lens', format: 'jsonc' }, { id: 'pair', format: 'json' }, ...(await files().list()).map(id => ({ id, format: id.endsWith('jsonc') ? 'jsonc' : 'json' }))] }));
+    route('GET', '/api/v1/config/files/:file_id', async (request) => {
+        const fileId = param(request, 'file_id');
+        if (fileId === 'lens')
+            return { data: dependencies.config.document() };
+        if (fileId === 'pair')
+            return { data: await dependencies.pair.document() };
+        return { data: await files().document(fileId) };
+    });
+    route('PUT', '/api/v1/config/files/:file_id', async (request) => {
+        const input = body(request);
+        const source = text(input.content, 'content', 4 * 1024 * 1024);
+        const expected = text(input.expected_file_digest, 'expected_file_digest');
+        const fileId = param(request, 'file_id');
+        if (fileId === 'lens') {
+            await dependencies.config.replace(source, expected, () => dependencies.pair.requireStrong(request.headers));
+            return { data: dependencies.config.document() };
+        }
+        if (fileId === 'pair') {
+            await dependencies.pair.replace(source, expected, request.headers);
+            return { data: { saved: true } };
+        }
+        await files().replace(fileId, source, expected, () => dependencies.pair.requireStrong(request.headers));
+        return { data: await files().document(fileId) };
+    });
     route('GET', '/api/v1/config/options', (request) => ({ data: configOptions(dependencies, project(request)) }));
     route('GET', '/api/v1/capabilities', (request) => {
         // 02A: Page<CapabilityCatalogEntry>. A bare array shares no shape with that, so a client
@@ -167,15 +215,58 @@ export function createServer(dependencies) {
         return { data: wholePage(dependencies.runtime(project(request)).registry.catalog(), dependencies) };
     });
     route('GET', '/api/v1/capabilities/:capability_id', (request) => ({ data: dependencies.runtime(project(request)).registry.get(param(request, 'capability_id')) }));
+    async function projectExecutorOperation(operation) {
+        try {
+            return await operation();
+        }
+        catch (error) {
+            if (error instanceof ExecutorCallError) {
+                if ([7, 16].includes(error.grpcCode))
+                    fail('EXECUTOR_ACCESS_DENIED', 403, 'Executor denied access. Check Core approval, directory authorization and whether this operation is allowed before retrying.');
+                if ([3, 5].includes(error.grpcCode))
+                    fail('EXECUTOR_PATH_INVALID', 400, 'Executor could not browse the requested server directory.');
+                fail('EXECUTOR_UNAVAILABLE', 503, 'Executor is unavailable.');
+            }
+            throw error;
+        }
+    }
     route('GET', '/api/v1/projects', (request) => ({ data: dependencies.store.listProjects(page(request), archiveMode(request)) }));
-    route('GET', '/api/v1/projects/browse', async (request, reply) => ({ data: await dependencies.executor.browse(optionalText(query(request).path, 'path') ?? process.cwd(), clientSignal(request, reply)) }));
-    route('POST', '/api/v1/projects/browse/open', async (request, reply) => ({ data: await dependencies.executor.open(paths(body(request).workspace_paths), text(body(request).path, 'path'), clientSignal(request, reply)) }));
-    route('POST', '/api/v1/projects/choose-folder', async (request, reply) => ({ data: await dependencies.executor.chooseFolder(optionalText(body(request).initial_path, 'initial_path'), clientSignal(request, reply)) }));
+    const endpoint = (value) => {
+        const selected = executorId(value);
+        if (dependencies.executorRouter)
+            return dependencies.executorRouter.endpoint(selected);
+        if (selected === 'remote')
+            return dependencies.executor;
+        if (selected !== 'local')
+            fail('EXECUTOR_NOT_CONFIGURED', 409, 'Executor is not configured.');
+        if (!dependencies.localExecutor)
+            fail('LOCAL_EXECUTOR_NOT_CONFIGURED', 409, 'Local Executor is not configured.');
+        return dependencies.localExecutor;
+    };
+    route('GET', '/api/v1/executors', () => {
+        const config = dependencies.config.current.config;
+        const entries = [
+            { executor_id: 'remote', name: config.executor.sharedFilesystem === true && !dependencies.localExecutor ? 'This computer' : 'Primary Executor', is_local: config.executor.sharedFilesystem === true && !dependencies.localExecutor, default_workspace_path: config.executor.sharedFilesystem === true ? resolve(dirname(dependencies.config.path), '../workspace') : null },
+            ...(dependencies.localExecutor ? [{ executor_id: 'local', name: 'This computer', is_local: true, default_workspace_path: resolve(dirname(dependencies.config.path), '../workspace') }] : []),
+            ...Object.entries(config.executors ?? {}).map(([id, value]) => ({ executor_id: id, name: value.name, is_local: false, default_workspace_path: null }))
+        ];
+        return { data: { items: entries } };
+    });
+    route('GET', '/api/v1/projects/browse', async (request, reply) => ({ data: await projectExecutorOperation(() => endpoint(query(request).executor_id).browse(optionalText(query(request).path, 'path') ?? '.', clientSignal(request, reply))) }));
+    route('POST', '/api/v1/projects/browse/open', async (request, reply) => ({ data: await endpoint(body(request).executor_id).open(paths(body(request).workspace_paths), text(body(request).path, 'path'), clientSignal(request, reply)) }));
+    route('POST', '/api/v1/projects/choose-folder', async (request, reply) => {
+        const selected = executorId(body(request).executor_id);
+        const isLocal = selected === 'local' ? dependencies.localExecutor !== undefined : selected === 'remote' && dependencies.config.current.config.executor.sharedFilesystem === true && !dependencies.localExecutor;
+        if (!isLocal)
+            fail('NATIVE_FOLDER_PICKER_LOCAL_ONLY', 400, 'Native folder selection is only available on this computer. Enter a remote folder path manually.');
+        return { data: await projectExecutorOperation(() => endpoint(selected).chooseFolder(optionalText(body(request).initial_path, 'initial_path'), clientSignal(request, reply))) };
+    });
     route('POST', '/api/v1/projects', async (request, reply) => {
         const input = body(request);
         const workspacePaths = paths(input.workspace_paths ?? input.paths);
-        const validation = await validateWorkspacePaths(dependencies, workspacePaths, input.create_if_missing === true);
-        return reply.status(201).send({ data: dependencies.store.createProject(text(input.name, 'name', 256), validatedWorkspacePaths(validation)) });
+        const selected = executorId(input.executor_id);
+        const validation = await validateWorkspacePaths({ executor: endpoint(selected) }, workspacePaths, input.create_if_missing === true);
+        return reply.status(201).send({ data: dependencies.store.createProject(text(input.name, 'name', 256), validatedWorkspacePaths(validation), selected) });
     });
     route('GET', '/api/v1/projects/:project_id', (request) => ({ data: dependencies.store.projectDetail(param(request, 'project_id')) }));
     route('PATCH', '/api/v1/projects/:project_id', (request) => ({ data: dependencies.store.updateProject(param(request, 'project_id'), expectedRevision(body(request).expected_revision), text(body(request).name, 'name', 256)) }));
@@ -186,8 +277,9 @@ export function createServer(dependencies) {
         const projectId = param(request, 'project_id');
         const input = body(request);
         const workspacePaths = paths(input.paths);
-        const validation = await validateWorkspacePaths(dependencies, workspacePaths, input.create_if_missing === true);
-        const workspace = dependencies.store.createWorkspace(projectId, text(input.name, 'name', 256), validatedWorkspacePaths(validation), input.is_default === true);
+        const selected = executorId(input.executor_id);
+        const validation = await validateWorkspacePaths({ executor: endpoint(selected) }, workspacePaths, input.create_if_missing === true);
+        const workspace = dependencies.store.createWorkspace(projectId, text(input.name, 'name', 256), validatedWorkspacePaths(validation), input.is_default === true, selected);
         dependencies.refreshProject(projectId);
         return reply.status(201).send({ data: workspace });
     });
@@ -196,7 +288,10 @@ export function createServer(dependencies) {
         const projectId = param(request, 'project_id');
         const input = body(request);
         const workspacePaths = paths(input.paths);
-        const validation = await validateWorkspacePaths(dependencies, workspacePaths, input.create_if_missing === true);
+        const existing = dependencies.store.getWorkspace(projectId, param(request, 'workspace_id'));
+        if (input.executor_id !== undefined && input.executor_id !== existing.executor_id)
+            fail('WORKSPACE_EXECUTOR_IMMUTABLE', 409, 'Create another Workspace to change execution endpoint.');
+        const validation = await validateWorkspacePaths({ executor: endpoint(existing.executor_id) }, workspacePaths, input.create_if_missing === true);
         const workspace = dependencies.store.updateWorkspace(projectId, param(request, 'workspace_id'), expectedRevision(input.expected_revision), text(input.name, 'name', 256), validatedWorkspacePaths(validation), input.is_default === true);
         dependencies.refreshProject(projectId);
         return { data: workspace };
@@ -212,12 +307,50 @@ export function createServer(dependencies) {
     route('GET', '/api/v1/tasks', (request) => ({ data: dependencies.store.listAllTasks(project(request), page(request), query(request).archived === 'all') }));
     route('POST', '/api/v1/tasks', (request, reply) => reply.status(201).send({ data: dependencies.store.createTask(project(request), text(body(request).title, 'title', 256)) }));
     route('GET', '/api/v1/tasks/:task_id', (request) => ({ data: dependencies.store.taskDetail(project(request), param(request, 'task_id')) }));
+    route('GET', '/api/v1/tasks/:task_id/audit', async (request) => {
+        const projectId = project(request);
+        const taskId = param(request, 'task_id');
+        dependencies.store.getTask(projectId, taskId);
+        const options = page(request);
+        const source = optionalText(query(request).source, 'source') ?? 'core';
+        if (source !== 'core' && source !== 'executor')
+            fail('AUDIT_SOURCE_INVALID', 400, 'Audit source must be core or executor.');
+        if (source === 'executor') {
+            try {
+                return { data: await endpoint(query(request).executor_id).taskAudit(projectId, taskId, options.limit, options.cursor) };
+            }
+            catch (error) {
+                if (error instanceof ExecutorCallError) {
+                    if (error.grpcCode === 3)
+                        fail('AUDIT_CURSOR_INVALID', 400, 'Executor rejected the audit query or cursor.');
+                    if (error.grpcCode === 9)
+                        fail('AUDIT_CURSOR_STALE', 409, 'Executor audit cursor is stale.');
+                    if ([7, 16].includes(error.grpcCode))
+                        fail('EXECUTOR_AUDIT_FORBIDDEN', 403, 'Executor refused the audit query.');
+                    if (error.grpcCode === 15)
+                        fail('AUDIT_INTEGRITY_ERROR', 503, 'Executor audit integrity check failed.');
+                    if (error.grpcCode === 8)
+                        fail('AUDIT_QUERY_LIMIT', 503, 'Executor audit query exceeded its scan or response limits.');
+                    if (error.grpcCode === 12)
+                        fail('EXECUTOR_AUDIT_UNSUPPORTED', 503, 'Executor does not support audit queries; deploy a matching protocol version.');
+                }
+                if (error instanceof LensError)
+                    throw error;
+                fail('EXECUTOR_AUDIT_UNAVAILABLE', 503, 'Executor audit storage or transport is unavailable.');
+            }
+        }
+        if (dependencies.taskAudit === undefined)
+            fail('AUDIT_UNAVAILABLE', 503, 'Task audit storage is not configured.');
+        return { data: await dependencies.taskAudit.query(projectId, taskId, options.limit, options.cursor) };
+    });
     route('PATCH', '/api/v1/tasks/:task_id', (request) => ({ data: dependencies.store.updateTask(project(request), param(request, 'task_id'), expectedRevision(body(request).expected_revision), text(body(request).title, 'title', 256)) }));
     route('POST', '/api/v1/tasks/:task_id/archive', (request) => ({ data: dependencies.store.archiveTask(project(request), param(request, 'task_id'), expectedRevision(body(request).expected_revision), true) }));
     route('POST', '/api/v1/tasks/:task_id/restore', (request) => ({ data: dependencies.store.archiveTask(project(request), param(request, 'task_id'), expectedRevision(body(request).expected_revision), false) }));
     route('DELETE', '/api/v1/tasks/:task_id', async (request) => {
-        const purged = dependencies.store.deleteTask(project(request), param(request, 'task_id'), queryRevision(request));
-        await applyPurge(purged, dependencies.artifacts, dependencies.executor);
+        const purged = await commitPurge(dependencies.executorRouter ?? dependencies.executor, stateId => dependencies.store.deleteTask(project(request), param(request, 'task_id'), queryRevision(request), stateId));
+        if ([purged.purged_calls, purged.orphaned_artifact_paths].some(value => Array.isArray(value) && value.length > 0)) {
+            await applyPurge(project(request), dependencies.store, dependencies.artifacts, dependencies.executorRouter ?? dependencies.executor);
+        }
         return { data: { ok: true } };
     });
     route('GET', '/api/v1/tasks/:task_id/sessions', (request) => ({ data: dependencies.store.listSessions(project(request), param(request, 'task_id'), page(request), query(request).archived === 'all') }));
@@ -238,7 +371,8 @@ export function createServer(dependencies) {
             model_reasoning_effort: defaults.modelReasoningEffort,
             policy_preset: defaults.policyPreset,
             initial_prompt: initialPrompt ?? null,
-            initial_message: initialMessage ?? null
+            initial_message: initialMessage ?? null,
+            agent_name: optionalText(input.agent_name, 'agent_name', 256) ?? title
         };
         const command = ingressCommand(request, 'session.create', payload, 'SESSION_REQUEST_KEY_REQUIRED');
         const created = dependencies.store.createSessionWithAgent(projectId, {
@@ -273,10 +407,14 @@ export function createServer(dependencies) {
     route('PATCH', '/api/v1/agents/:agent_id', (request) => {
         const input = body(request);
         const current = dependencies.store.getAgent(project(request), param(request, 'agent_id'));
+        const model = optionalText(input.model_reference, 'model_reference') ?? stringValue(current.model);
+        const effort = optionalText(input.model_reasoning_effort, 'model_reasoning_effort') ?? stringValue(current.model_reasoning_effort);
+        dependencies.models.resolve(model);
+        resolveReasoningEffort(dependencies.config.current.config, model, effort);
         return { data: dependencies.store.updateAgent(project(request), param(request, 'agent_id'), expectedRevision(input.expected_revision), {
                 name: optionalText(input.name, 'name', 256) ?? stringValue(current.name),
-                model: optionalText(input.model_reference, 'model_reference') ?? stringValue(current.model),
-                modelReasoningEffort: optionalText(input.model_reasoning_effort, 'model_reasoning_effort') ?? stringValue(current.model_reasoning_effort),
+                model,
+                modelReasoningEffort: effort,
                 policyPreset: optionalText(input.policy_preset, 'policy_preset') ?? stringValue(current.policy_preset)
             }) };
     });
@@ -322,6 +460,7 @@ export function createServer(dependencies) {
         const runId = stringValue(dependencies.store.getStep(project(request), param(request, 'step_id')).run_id);
         return { data: dependencies.store.getRunGoal(project(request), runId) };
     });
+    route('GET', '/api/v1/agents/:agent_id/cache-usage', (request) => ({ data: dependencies.store.cacheUsage(project(request), param(request, 'agent_id')) }));
     route('GET', '/api/v1/agents/:agent_id/model-attempts', (request) => ({ data: dependencies.store.listAttempts(project(request), 'agent_id', param(request, 'agent_id'), page(request)) }));
     route('GET', '/api/v1/steps/:step_id/model-attempts', (request) => ({ data: dependencies.store.listAttempts(project(request), 'step_id', param(request, 'step_id'), page(request)) }));
     route('GET', '/api/v1/model-attempts/:attempt_id', (request) => ({ data: dependencies.store.getAttempt(project(request), param(request, 'attempt_id')) }));
@@ -345,19 +484,21 @@ export function createServer(dependencies) {
     route('POST', '/api/v1/agents/:agent_id/context/preview', (request) => {
         const agent = dependencies.store.getAgent(project(request), param(request, 'agent_id'));
         const model = dependencies.models.resolve(stringValue(agent.model));
-        const prepared = dependencies.runtime(project(request)).context.prepare(project(request), param(request, 'agent_id'), dependencies.config.current.config, model.contextWindowTokens, model.profile);
-        if (prepared.sourceRevision !== expectedRevision(body(request).expected_context_revision))
+        if (agent.context_revision !== expectedRevision(body(request).expected_context_revision))
             fail('REVISION_CONFLICT', 409, 'The Context changed before preview.');
+        const source = dependencies.store.contextSource(project(request), param(request, 'agent_id'));
+        const prepared = dependencies.runtime(project(request)).context.prepareSource(source, dependencies.config.current.config, model.contextWindowTokens, model.profile);
         return { data: prepared };
     });
-    route('POST', '/api/v1/agents/:agent_id/context/compact', async (request, reply) => ({ data: await dependencies.runtime(project(request)).agents.compact(project(request), param(request, 'agent_id'), expectedRevision(body(request).expected_context_revision), optionalText(body(request).pivot_turn_group_id, 'pivot_turn_group_id'), clientSignal(request, reply)) }));
+    route('POST', '/api/v1/agents/:agent_id/context/compact', async (request, reply) => ({ data: await dependencies.runtime(project(request)).agents.compact(project(request), param(request, 'agent_id'), expectedRevision(body(request).expected_context_revision), optionalText(body(request).focus, 'focus'), clientSignal(request, reply)) }));
     route('POST', '/api/v1/agents/:agent_id/context/fork', (request, reply) => {
         const projectId = project(request);
         const source = dependencies.store.getAgent(projectId, param(request, 'agent_id'));
         const input = body(request);
         const model = optionalText(input.model_reference, 'model_reference') ?? stringValue(source.model);
         const effort = optionalText(input.model_reasoning_effort, 'model_reasoning_effort') ?? stringValue(source.model_reasoning_effort);
-        resolveReasoningEffort(dependencies.models.resolve(model).profile, effort);
+        dependencies.models.resolve(model);
+        resolveReasoningEffort(dependencies.config.current.config, model, effort);
         return reply.status(201).send({ data: dependencies.store.createContextFork(projectId, param(request, 'agent_id'), {
                 throughTurnGroupId: text(input.through_turn_group_id, 'through_turn_group_id'),
                 expectedContextRevision: expectedRevision(input.expected_context_revision),
@@ -368,6 +509,8 @@ export function createServer(dependencies) {
     });
     route('GET', '/api/v1/agents/:agent_id/context/turn-groups', (request) => ({ data: dependencies.store.listTurnGroups(project(request), param(request, 'agent_id'), page(request)) }));
     route('GET', '/api/v1/agents/:agent_id/context/projection/decisions', (request) => ({ data: dependencies.store.listProjectionDecisions(project(request), param(request, 'agent_id'), page(request)) }));
+    route('GET', '/api/v1/agents/:agent_id/context/working', (request) => ({ data: dependencies.store.workingContext(project(request), param(request, 'agent_id')) }));
+    route('GET', '/api/v1/context/:context_item_id/sources', (request) => ({ data: dependencies.store.compactionSources(project(request), param(request, 'context_item_id')) }));
     route('GET', '/api/v1/calls', (request) => ({ data: dependencies.store.listCalls(project(request), page(request), { ...(typeof query(request).state === 'string' ? { state: query(request).state } : {}) }) }));
     route('POST', '/api/v1/calls', (request, reply) => {
         const input = body(request);
@@ -382,7 +525,7 @@ export function createServer(dependencies) {
         }, 'DIRECT_REQUEST_KEY_REQUIRED');
         const replay = dependencies.store.ingressReplay(command);
         if (replay !== null)
-            return reply.status(202).send({ data: replay });
+            return reply.status(202).send({ data: dependencies.store.callSummary(project(request), stringValue(replay.id)) });
         const effect = dependencies.runtime(project(request)).registry.effect(capabilityId, argumentsValue);
         const call = dependencies.store.createCall(project(request), {
             workspaceId,
@@ -468,7 +611,7 @@ export function createServer(dependencies) {
             fail('INVALID_INPUT', 400, 'call_ids must all belong to one Workspace.');
         const workspaceId = [...workspaceIds][0] ?? '';
         const paths = dependencies.store.projectWorkspacePaths(projectId, workspaceId);
-        return { data: await dependencies.executor.describeCallHistory(workspaceId, callIds, paths, false) };
+        return { data: await (dependencies.executorRouter?.workspace(project(request), workspaceId) ?? dependencies.executor).describeCallHistory(workspaceId, callIds, paths, false) };
     });
     route('POST', '/api/v1/agents/:agent_id/subagents', async (request, reply) => {
         const projectId = project(request);
@@ -482,6 +625,9 @@ export function createServer(dependencies) {
             model: defaults.model,
             model_reasoning_effort: defaults.modelReasoningEffort,
             policy_preset: defaults.policyPreset,
+            focus: typeof input.focus === 'string' ? input.focus : null,
+            fork_context: jsonValue(input.fork_context),
+            initial_prompt: optionalText(input.initial_prompt, 'initial_prompt') ?? null,
             message: message ?? null
         }, 'IDEMPOTENCY_KEY_INVALID');
         const forkContext = input.fork_context;
@@ -494,6 +640,7 @@ export function createServer(dependencies) {
             model: defaults.model,
             modelReasoningEffort: defaults.modelReasoningEffort,
             ...(typeof input.initial_prompt === 'string' ? { initialPrompt: input.initial_prompt } : {}),
+            ...(typeof input.focus === 'string' ? { compactFocus: input.focus } : {}),
             ...(message === undefined ? {} : { initialMessage: message }),
             ingress: command
         }, clientSignal(request, reply));
@@ -537,8 +684,8 @@ export function createServer(dependencies) {
             meta: runtimeMeta(dependencies, projectId)
         };
     });
-    route('GET', '/api/v1/events', async (request, reply) => streamEvents(dependencies, contexts.get(request), reply, request));
-    route('GET', '/api/v1/runtime/diagnostics', () => ({ data: { readiness: dependencies.ready(), config: configMeta(dependencies), state_revision: dependencies.store.stateRevision(), storage: dependencies.store.storageStats() } }));
+    route('GET', '/api/v1/events', async (request, reply) => streamEvents(dependencies, contexts.get(request), reply));
+    route('GET', '/api/v1/runtime/diagnostics', () => ({ data: { readiness: dependencies.ready(), config: configMeta(dependencies), state_revision: dependencies.store.stateRevision(), storage: dependencies.store.storageStats(), observability: dependencies.observability.status() } }));
     // The three diagnostic windows are documented as RuntimeRecordWindow<T>, not bare arrays.
     // They are bounded in-process buffers with no replay, so `next_sequence` is the highest
     // sequence returned and `has_more` reports whether the window filled the requested limit.
@@ -548,13 +695,14 @@ export function createServer(dependencies) {
     route('GET', '/api/v1/runtime/metrics', (_request, reply) => reply.type('text/plain; version=0.0.4').send(dependencies.observability.metrics()));
     route('GET', '/api/v1/runtime/operations', (request) => ({ data: { calls: dependencies.store.listCalls(project(request), { limit: dependencies.config.current.config.snapshot.pageSizeMax }, { state: 'RUNNING' }) } }));
     route('POST', '/api/v1/runtime/maintenance/run', async (request) => {
-        const purged = dependencies.store.purgeArchived(project(request), optionalText(body(request).before, 'before') ?? new Date().toISOString());
-        const files = await applyPurge(purged, dependencies.artifacts, dependencies.executor);
+        const before = optionalText(body(request).before, 'before') ?? new Date().toISOString();
+        const purged = await commitPurge(dependencies.executorRouter ?? dependencies.executor, stateId => dependencies.store.purgeArchived(project(request), before, stateId));
+        const files = await applyPurge(project(request), dependencies.store, dependencies.artifacts, dependencies.executorRouter ?? dependencies.executor);
         // purged_calls is an instruction for applyPurge, not part of the Route response.
         return { data: { purged_tasks: purged.purged_tasks, orphaned_artifact_paths: purged.orphaned_artifact_paths, files } };
     });
     route('GET', '/api/v1/runtime/storage', () => ({ data: dependencies.store.storageStats() }));
-    app.setNotFoundHandler((_request, reply) => reply.status(404).send({ error: { code: 'ROUTE_NOT_FOUND', message: 'The requested Route does not exist.', details: {} } }));
+    app.setNotFoundHandler((_request, reply) => reply.status(404).send({ error: { code: 'ROUTE_NOT_FOUND', message: 'The requested Route does not exist.', retryable: false, details: {} } }));
     return app;
 }
 function createAgent(dependencies, projectId, taskId, input) {
@@ -583,8 +731,8 @@ function agentDefaults(dependencies, projectId, roleName, input) {
     const preset = dependencies.config.current.config.policyPresets[policyPreset];
     if (preset === undefined)
         fail('POLICY_PRESET_MISSING', 409, 'The selected Policy preset does not exist.');
-    const resolved = dependencies.models.resolve(model);
-    resolveReasoningEffort(resolved.profile, modelReasoningEffort);
+    dependencies.models.resolve(model);
+    resolveReasoningEffort(dependencies.config.current.config, model, modelReasoningEffort);
     const registry = dependencies.runtime(projectId).registry;
     const capabilityIds = [...new Set([
             ...registry.list().filter((definition) => definition.defaultAssignment === 'all_new_agents').map((definition) => definition.id),
@@ -631,14 +779,23 @@ function refreshCapabilities(dependencies, projectId, agentId) {
     });
     return dependencies.store.replaceCapabilities(projectId, agentId, capabilities, loaded);
 }
-async function streamEvents(dependencies, context, reply, request) {
+async function streamEvents(dependencies, context, reply) {
     if (context === undefined)
         fail('TRUSTED_INGRESS_REQUIRED', 500, 'Trusted ingress is missing.');
     const subscription = dependencies.events.subscribe(context.ingress.clientId, context.projectId);
     reply.hijack();
     reply.raw.writeHead(200, { 'content-type': 'text/event-stream', 'cache-control': 'no-cache, no-transform', connection: 'keep-alive' });
     const controller = new AbortController();
-    request.raw.once('close', () => controller.abort());
+    const abort = () => controller.abort();
+    reply.raw.once('close', abort);
+    reply.raw.once('error', abort);
+    const drain = async () => {
+        if (reply.raw.writableNeedDrain)
+            await once(reply.raw, 'drain', {
+                signal: AbortSignal.any([controller.signal, AbortSignal.timeout(dependencies.config.current.config.sse.heartbeatIntervalMs)])
+            });
+        controller.signal.throwIfAborted();
+    };
     let sequence = 0;
     /**
      * Writes one SSE frame. `kind` and `occurred_at` go in the JSON body, not only in the
@@ -666,12 +823,17 @@ async function streamEvents(dependencies, context, reply, request) {
         state_revision: String(dependencies.store.stateRevision()),
         ...runtimeMeta(dependencies, context.projectId)
     });
-    const heartbeat = setInterval(() => send('runtime.notice', { code: 'heartbeat', state_revision: String(dependencies.store.stateRevision()), ...runtimeMeta(dependencies, context.projectId) }), dependencies.config.current.config.sse.heartbeatIntervalMs);
+    const heartbeat = setInterval(() => {
+        if (!reply.raw.writableNeedDrain && !controller.signal.aborted)
+            send('runtime.notice', { code: 'heartbeat', state_revision: String(dependencies.store.stateRevision()), ...runtimeMeta(dependencies, context.projectId) });
+    }, dependencies.config.current.config.sse.heartbeatIntervalMs);
     try {
         for (;;) {
+            await drain();
             const event = await subscription.next(controller.signal);
             if (event === null)
                 break;
+            await drain();
             send(event.type, {
                 event_id: event.id,
                 project_id: event.projectId,
@@ -682,10 +844,19 @@ async function streamEvents(dependencies, context, reply, request) {
             });
         }
     }
+    catch (error) {
+        if (!controller.signal.aborted)
+            dependencies.observability.record('http', 'sse', 'failed', 0, { error_code: error instanceof Error && error.name === 'TimeoutError' ? 'SSE_BACKPRESSURE_TIMEOUT' : 'SSE_STREAM_FAILED' });
+    }
     finally {
         clearInterval(heartbeat);
         subscription.close();
-        reply.raw.end();
+        reply.raw.off('close', abort);
+        reply.raw.off('error', abort);
+        if (reply.raw.writableNeedDrain)
+            reply.raw.destroy();
+        else
+            reply.raw.end();
     }
 }
 function runtimeMeta(dependencies, projectId) {
@@ -694,6 +865,7 @@ function runtimeMeta(dependencies, projectId) {
         config_digest: dependencies.config.current.digest,
         pair_digest: dependencies.pair.pairDigest,
         runtime_contract_digest: dependencies.runtime(projectId).contractDigest(),
+        project_capabilities_digest: dependencies.runtime(projectId).capabilitiesDigest(),
         access_contract: accessContract(dependencies)
     };
 }
@@ -736,14 +908,6 @@ function requireLoopback(request) {
         fail('SHUTDOWN_FORBIDDEN', 403, 'Shutdown may only be requested from the local machine.');
     }
 }
-function loopbackAddress(address) {
-    // Absent for a non-IP socket. Refusing is the safe answer: the caller cannot be shown to be local.
-    if (address === undefined)
-        return false;
-    // A dual-stack listener reports an IPv4 peer as `::ffff:127.0.0.1`.
-    const normalized = address.startsWith('::ffff:') ? address.slice('::ffff:'.length) : address;
-    return normalized === '::1' || /^127\./.test(normalized);
-}
 /**
  * CORE-15. 02A defines this as the catalog a client needs to offer model, reasoning-effort,
  * Runtime Role and Policy choices: `models`, `model_profiles`, `roles`, `policy_presets` and
@@ -758,7 +922,6 @@ function loopbackAddress(address) {
  * truth. Reasoning efforts follow the same rule the config validator applies: a Model Harness
  * Profile constrains them when one is attached, otherwise the full ladder is allowed.
  */
-const EFFORT_LADDER = ['none', 'minimal', 'low', 'medium', 'high'];
 const EFFECT_SCOPE_DESCRIPTIONS = {
     read_only: 'Reads Workspace state without changing it.',
     workspace_write: 'Creates or modifies files inside the Workspace.',
@@ -776,22 +939,18 @@ const POLICY_VALUE_DESCRIPTIONS = {
 function configOptions(dependencies, projectId) {
     const config = dependencies.config.current.config;
     const profiles = config.modelHarnessProfiles ?? {};
-    const efforts = (harnessProfile) => harnessProfile === undefined
-        ? EFFORT_LADDER
-        : profiles[harnessProfile]?.effort.allowed ?? [];
     const models = Object.entries(config.providers).flatMap(([providerId, provider]) => Object.entries(provider.models).map(([modelId, model]) => {
-        const allowed = efforts(model.harnessProfile);
+        const allowed = modelReasoningEfforts(config, `${providerId}/${modelId}`);
         return {
             model_reference: `${providerId}/${modelId}`,
             allowed_reasoning_efforts: allowed,
-            default_reasoning_effort: model.harnessProfile === undefined
-                ? 'medium'
-                : profiles[model.harnessProfile]?.effort.default ?? allowed[0] ?? 'medium',
+            default_reasoning_effort: allowed[0] ?? '',
             harness_profile_id: model.harnessProfile ?? '',
             harness_profile_version: model.harnessProfile === undefined ? 0 : profiles[model.harnessProfile]?.version ?? 0,
             context_window_tokens: model.contextWindowTokens,
             usage_reliable: model.usageReliable ?? null,
-            cache_supported: model.cacheSupported ?? null
+            cache_supported: (model.promptCache ?? provider.promptCache)?.mode !== undefined ? (model.promptCache ?? provider.promptCache)?.mode !== 'off' : model.cacheSupported ?? null,
+            prompt_cache: model.promptCache ?? provider.promptCache ?? null
         };
     }));
     return {
@@ -801,8 +960,6 @@ function configOptions(dependencies, projectId) {
         model_profiles: Object.entries(profiles).map(([id, profile]) => ({
             id,
             version: profile.version,
-            allowed_reasoning_efforts: profile.effort.allowed,
-            default_reasoning_effort: profile.effort.default,
             reasoning_state_round_trip: profile.semantics.reasoningStateRoundTrip,
             thinking_continuation: profile.semantics.thinkingContinuation,
             structured_output: profile.semantics.structuredOutput,
@@ -856,11 +1013,20 @@ function schemaDetails(error) {
  * failure to answer is the Executor's (`EXECUTOR_UNAVAILABLE`, 503, retryable). Collapsing both
  * into the latter told the user to retry a path that would always be rejected, and hid the reason.
  */
+function executorId(value) {
+    if (value === undefined || value === 'remote')
+        return 'remote';
+    if (typeof value === 'string' && /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$/u.test(value))
+        return value;
+    fail('EXECUTOR_INVALID', 400, 'executor_id must be a configured Executor identifier.');
+}
 async function validateWorkspacePaths(dependencies, workspacePaths, createIfMissing) {
     try {
         return await dependencies.executor.validatePaths(workspacePaths, undefined, createIfMissing);
     }
     catch (error) {
+        if (error instanceof LensError && error.code === 'SHARED_WORKSPACE_REQUIRED')
+            throw error;
         if (error instanceof ExecutorCallError && error.refused) {
             fail('WORKSPACE_PATH_INVALID', 422, error.message, { workspace_paths: [...workspacePaths] });
         }
@@ -957,6 +1123,7 @@ function openapi(specs) {
             [spec.method]: {
                 operationId: operationId(spec.method, spec.path),
                 parameters: parameters(spec.method, spec.path),
+                ...(spec.path.startsWith('/api/v1/') ? { security: [{ PairBearer: [] }] } : {}),
                 ...(body === null ? {} : { requestBody: { required: true, content: { 'application/json': { schema: body } } } }),
                 responses: responses(spec.method, spec.path)
             }
@@ -967,24 +1134,31 @@ function openapi(specs) {
         info: { title: 'Lens Core API', version: '1.0.0' },
         paths,
         components: {
+            securitySchemes: {
+                PairBearer: {
+                    type: 'http',
+                    scheme: 'bearer',
+                    description: 'Pair credential issued by the local administrator. Send the client identity headers alongside Authorization: Bearer <credential>.'
+                }
+            },
             schemas: {
                 Success: {
                     type: 'object',
-                    required: ['data'],
-                    properties: { data: {}, meta: { type: 'object', additionalProperties: true } },
+                    required: ['data', 'correlation_id'],
+                    properties: { data: {}, correlation_id: { type: 'string' }, meta: { type: 'object', additionalProperties: true } },
                     additionalProperties: false
                 },
                 Error: {
                     type: 'object',
-                    required: ['error'],
+                    required: ['error', 'correlation_id'],
                     properties: {
                         error: {
                             type: 'object',
-                            required: ['code', 'message', 'details'],
-                            properties: { code: { type: 'string' }, message: { type: 'string' }, details: {} },
+                            required: ['code', 'message', 'details', 'retryable'],
+                            properties: { code: { type: 'string' }, message: { type: 'string' }, retryable: { type: 'boolean' }, details: {} },
                             additionalProperties: false
                         },
-                        request_id: { type: 'string' }
+                        correlation_id: { type: 'string' }
                     },
                     additionalProperties: false
                 }
@@ -1005,20 +1179,20 @@ function requestBody(method, path) {
         return null;
     if (path === '/api/v1/config/validate')
         return objectSchema({ content: { type: 'string', minLength: 1 } }, ['content']);
-    if (path === '/api/v1/config')
+    if (path === '/api/v1/config' || path === '/api/v1/config/files/:file_id')
         return objectSchema({ content: { type: 'string', minLength: 1 }, expected_file_digest: stringSchema }, ['content', 'expected_file_digest']);
     if (path === '/api/v1/projects')
-        return objectSchema({ name: stringSchema, workspace_paths: stringArraySchema, create_if_missing: booleanSchema }, ['name', 'workspace_paths']);
+        return objectSchema({ name: stringSchema, workspace_paths: stringArraySchema, executor_id: stringSchema, create_if_missing: booleanSchema }, ['name', 'workspace_paths']);
     if (path === '/api/v1/projects/:project_id')
         return objectSchema({ name: stringSchema, expected_revision: revisionSchema }, ['name', 'expected_revision']);
     if (path === '/api/v1/projects/browse/open')
-        return objectSchema({ workspace_paths: stringArraySchema, path: stringSchema }, ['workspace_paths', 'path']);
+        return objectSchema({ workspace_paths: stringArraySchema, path: stringSchema, executor_id: stringSchema }, ['workspace_paths', 'path']);
     if (path === '/api/v1/projects/choose-folder')
-        return objectSchema({ initial_path: stringSchema });
+        return objectSchema({ initial_path: stringSchema, executor_id: stringSchema });
     if (path === '/api/v1/calls/revert-preview')
         return objectSchema({ call_ids: stringArraySchema }, ['call_ids']);
     if (/\/projects\/:project_id\/workspaces(?:\/:workspace_id)?$/.test(path))
-        return objectSchema({ name: stringSchema, paths: stringArraySchema, is_default: booleanSchema, create_if_missing: booleanSchema, expected_revision: revisionSchema }, method === 'patch' ? ['name', 'paths', 'expected_revision'] : ['name', 'paths']);
+        return objectSchema({ name: stringSchema, paths: stringArraySchema, executor_id: stringSchema, is_default: booleanSchema, create_if_missing: booleanSchema, expected_revision: revisionSchema }, method === 'patch' ? ['name', 'paths', 'expected_revision'] : ['name', 'paths']);
     if (path.endsWith('/archive') || path.endsWith('/restore'))
         return objectSchema({ expected_revision: revisionSchema }, ['expected_revision']);
     if (path === '/api/v1/tasks' || path === '/api/v1/projects/:project_id/tasks')
@@ -1065,12 +1239,12 @@ function requestBody(method, path) {
     if (path.endsWith('/context/projection/reset'))
         return objectSchema({
             expected_context_revision: revisionSchema,
-            stages: { type: 'array', minItems: 1, uniqueItems: true, items: { type: 'string', enum: ['tool_result_budget', 'snip', 'microcompact', 'context_collapse'] } }
+            stages: { type: 'array', minItems: 1, uniqueItems: true, items: { type: 'string', enum: ['snip'] } }
         }, ['expected_context_revision']);
     if (path.endsWith('/context/preview'))
         return objectSchema({ expected_context_revision: revisionSchema }, ['expected_context_revision']);
     if (path.endsWith('/context/compact'))
-        return objectSchema({ expected_context_revision: revisionSchema, pivot_turn_group_id: stringSchema }, ['expected_context_revision']);
+        return objectSchema({ expected_context_revision: revisionSchema, focus: stringSchema }, ['expected_context_revision']);
     if (path.endsWith('/context/fork'))
         return objectSchema({
             through_turn_group_id: stringSchema,
@@ -1095,6 +1269,7 @@ function requestBody(method, path) {
         return objectSchema({
             name: stringSchema,
             fork_context: { type: 'string', enum: ['full', 'compact', 'none'] },
+            focus: stringSchema,
             model_reference: stringSchema,
             model_reasoning_effort: stringSchema,
             initial_prompt: { type: 'string' },
@@ -1124,13 +1299,19 @@ function objectSchema(properties, required = []) {
 }
 function parameters(method, path) {
     const result = [];
+    if (method === 'get' && path === '/api/v1/tasks/:task_id/audit') {
+        result.push({ name: 'source', in: 'query', required: false, schema: { type: 'string', enum: ['core', 'executor'], default: 'core' } });
+    }
+    if (method === 'get' && (path === '/api/v1/projects/browse' || path === '/api/v1/tasks/:task_id/audit')) {
+        result.push({ name: 'executor_id', in: 'query', required: false, schema: stringSchema });
+    }
     for (const match of path.matchAll(/:([a-zA-Z0-9_]+)/g)) {
         result.push({ name: match[1] ?? '', in: 'path', required: true, schema: stringSchema });
     }
     if (path.startsWith('/api/v1/')) {
         result.push({ name: 'X-Lens-Client-Kind', in: 'header', required: true, schema: { type: 'string', enum: ['native', 'browser'] } }, { name: 'X-Lens-Client-Mac', in: 'header', required: false, schema: stringSchema }, { name: 'X-Lens-Hardware-Id', in: 'header', required: false, schema: stringSchema }, { name: 'X-Lens-Browser-Fingerprint', in: 'header', required: false, schema: stringSchema }, { name: 'X-Lens-Project-Id', in: 'header', required: false, schema: stringSchema });
     }
-    if (method === 'get' && (/\/tasks$|\/sessions$|\/runs$|\/steps$|\/calls$|\/artifacts$|\/context$|\/timeline$|\/model-attempts$|\/partitions$|\/turn-groups$|\/decisions$|\/logs$|\/traces$|\/agent-ops$/.test(path))) {
+    if (method === 'get' && (/\/audit$|\/tasks$|\/sessions$|\/runs$|\/steps$|\/calls$|\/artifacts$|\/context$|\/timeline$|\/model-attempts$|\/partitions$|\/turn-groups$|\/decisions$|\/logs$|\/traces$|\/agent-ops$/.test(path))) {
         result.push({ name: 'cursor', in: 'query', required: false, schema: stringSchema }, { name: 'limit', in: 'query', required: false, schema: { type: 'integer', minimum: 1, maximum: 500 } });
     }
     if (method === 'delete')
@@ -1148,26 +1329,27 @@ function idempotentRoute(method, path) {
         || path.endsWith('/subagent-broadcasts'));
 }
 function responses(method, path) {
+    const errors = errorResponses(path.startsWith('/api/v1/'));
     if (path === '/api/v1/events')
-        return { '200': { description: 'Server-sent RuntimeEvent stream', content: { 'text/event-stream': { schema: { type: 'string' } } } }, ...errorResponses() };
+        return { '200': { description: 'Server-sent RuntimeEvent stream', content: { 'text/event-stream': { schema: { type: 'string' } } } }, ...errors };
     if (path.endsWith('/runtime/metrics'))
-        return { '200': { description: 'Prometheus metrics', content: { 'text/plain': { schema: { type: 'string' } } } }, ...errorResponses() };
+        return { '200': { description: 'Prometheus metrics', content: { 'text/plain': { schema: { type: 'string' } } } }, ...errors };
     if (path === '/api/v1/artifacts/:artifact_id') {
         const content = { 'application/octet-stream': { schema: { type: 'string', contentEncoding: 'binary' } } };
         return {
             '200': { description: 'Artifact bytes', content },
             '206': { description: 'Artifact byte range', content },
-            ...errorResponses()
+            ...errors
         };
     }
     const status = method === 'post' && (/\/projects$|\/workspaces$|\/tasks$|\/sessions$|\/agents$|\/subagents$|\/context-overrides$|\/context\/fork$|\/results\/:result_id\/include$/.test(path)) ? '201'
         : method === 'post' && (path === '/health/shutdown' || path.endsWith('/messages') || path === '/api/v1/calls' || path.endsWith('/subagent-messages') || path.endsWith('/subagent-broadcasts')) ? '202'
             : '200';
-    return { [status]: { description: 'Success', content: { 'application/json': { schema: { '$ref': '#/components/schemas/Success' } } } }, ...errorResponses() };
+    return { [status]: { description: 'Success', content: { 'application/json': { schema: { '$ref': '#/components/schemas/Success' } } } }, ...errors };
 }
-function errorResponses() {
+function errorResponses(protectedRoute) {
     const response = { description: 'Error', content: { 'application/json': { schema: { '$ref': '#/components/schemas/Error' } } } };
-    return Object.fromEntries(['400', '403', '404', '409', '413', '416', '422', '428', '500', '502', '503'].map((status) => [status, response]));
+    return Object.fromEntries(['400', ...(protectedRoute ? ['401'] : []), '403', '404', '409', '413', '416', '422', '428', '500', '502', '503'].map((status) => [status, response]));
 }
 function operationId(method, path) {
     return `${method}_${path.replace(/^\/api\/v1\//, '').replace(/^\//, '').replace(/[:/.-]+/g, '_') || 'root'}`;
@@ -1241,7 +1423,7 @@ function resolveProjectId(request, fallback) {
 const OPAQUE_KEYS = new Set([
     'inputSchema', 'outputSchema', 'input_schema', 'output_schema',
     'input', 'content', 'details', 'payload', 'preparation', 'usage', 'metadata',
-    'answer', 'prompt', 'arguments', 'structured', 'document', 'config'
+    'answer', 'prompt', 'arguments', 'structured', 'document', 'config', 'request', 'observation'
 ]);
 // Core mints identifiers as `<entity>_<uuid>`, so the documented field name is derivable from
 // the value itself rather than from a per-Route table.
@@ -1270,7 +1452,7 @@ function retryableFailure(status) {
     return status === 408 || status === 429 || status >= 500;
 }
 function routePath(request) {
-    return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';
+    return request.routeOptions.url ?? 'unmatched';
 }
 function idempotencyKey(request, missingCode) {
     const value = request.headers['idempotency-key'];
@@ -1294,11 +1476,11 @@ function queryRevision(request) {
 function param(request, name) {
     return text(request.params[name], name, 256);
 }
-function page(request) {
+function pageOptions(request, limits) {
     const values = query(request);
     const cursor = optionalText(values.cursor, 'cursor', 4096);
-    const rawLimit = values.limit === undefined ? 100 : typeof values.limit === 'string' ? Number(values.limit) : values.limit;
-    const limit = Math.min(integer(rawLimit, 'limit', 1), 500);
+    const rawLimit = values.limit === undefined ? limits.pageSizeDefault : typeof values.limit === 'string' ? Number(values.limit) : values.limit;
+    const limit = Math.min(integer(rawLimit, 'limit', 1), limits.pageSizeMax);
     return { ...(cursor === undefined ? {} : { cursor }), limit };
 }
 function paths(value) {