@mean-weasel/lineage 0.1.3 → 0.1.4

package/dist/server.js

@@ -57,7 +57,7 @@ function walkLocalReviewFiles(dir, files = []) {
     throw error;
   }
   for (const entry of entries) {
-    if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "studio-uploads") continue;
+    if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "studio-uploads" || entry.name === "playwright-results" || entry.name === "lineage-demo") continue;
     if (process.env.NODE_ENV !== "test" && /^vitest-/.test(entry.name)) continue;
     const path = join(dir, entry.name);
     if (entry.isDirectory()) walkLocalReviewFiles(path, files);
@@ -595,6 +595,41 @@ function lineageDb() {
     );
     create index if not exists generation_job_receipts_job on generation_job_receipts(job_id, created_at);
     create table if not exists adapter_settings (project_id text not null references projects(id), adapter_type text not null check (adapter_type in ('cloud', 'scheduler', 'image_generator')), provider text not null, enabled integer not null check (enabled in (0, 1)), secret_ref text, safe_config_json text not null, created_at text not null, updated_at text not null, primary key(project_id, adapter_type, provider)); create index if not exists adapter_settings_project_type on adapter_settings(project_id, adapter_type);
+    create table if not exists agent_claims (
+      id text primary key,
+      token_hash text not null,
+      project_id text not null references projects(id),
+      channel text,
+      scope_type text not null check (scope_type in ('lineage_workspace', 'content_post', 'content_queue_lane', 'selection_set', 'project_channel')),
+      target_id text not null,
+      target_title text,
+      agent_id text,
+      agent_name text not null,
+      agent_kind text not null,
+      thread_id text,
+      status text not null check (status in ('active', 'expired', 'released', 'revoked', 'transferred')),
+      created_at text not null,
+      heartbeat_at text not null,
+      expires_at text not null,
+      released_at text,
+      revoked_at text,
+      revoked_by text,
+      override_reason text,
+      metadata_json text
+    );
+    create unique index if not exists agent_claims_token_hash on agent_claims(token_hash);
+    create index if not exists agent_claims_project_status on agent_claims(project_id, status, heartbeat_at);
+    create index if not exists agent_claims_target on agent_claims(project_id, channel, scope_type, target_id, status);
+    create table if not exists agent_claim_events (
+      id text primary key,
+      claim_id text not null references agent_claims(id) on delete cascade,
+      event_type text not null,
+      actor text,
+      message text,
+      created_at text not null,
+      metadata_json text
+    );
+    create index if not exists agent_claim_events_claim_created on agent_claim_events(claim_id, created_at);
   `);
   migrateAssetSelections(database);
   dropLegacyAssetSelectionRootUnique(database);
@@ -1930,6 +1965,379 @@ function updateAssetReview(project, fields) {
   return { ok: true, message: `Marked ${fields.assetId} ${fields.reviewState}`, asset_id: fields.assetId, review_state: fields.reviewState };
 }
 
+// src/server/agentClaims.ts
+import { createHash as createHash2, randomBytes, timingSafeEqual } from "node:crypto";
+var defaultTtlSeconds = 20 * 60;
+var idleAfterSeconds = 5 * 60;
+var staleAfterSeconds = 15 * 60;
+var scopes = /* @__PURE__ */ new Set(["lineage_workspace", "content_post", "content_queue_lane", "selection_set", "project_channel"]);
+var AgentClaimError = class extends Error {
+  constructor(message, status = 400, code = "agent_claim_error", conflicts = []) {
+    super(message);
+    this.status = status;
+    this.code = code;
+    this.conflicts = conflicts;
+  }
+  status;
+  code;
+  conflicts;
+};
+function isAgentClaimError(error) {
+  return error instanceof AgentClaimError;
+}
+function parseClaimTtl(value) {
+  if (!value) return defaultTtlSeconds;
+  const match = value.trim().match(/^(\d+)(s|m|h)?$/);
+  if (!match) throw new AgentClaimError(`Invalid claim ttl: ${value}`);
+  const amount = Number(match[1]);
+  const unit = match[2] || "s";
+  const multiplier = unit === "h" ? 3600 : unit === "m" ? 60 : 1;
+  const seconds = amount * multiplier;
+  if (!Number.isInteger(seconds) || seconds < 30 || seconds > 24 * 60 * 60) {
+    throw new AgentClaimError("Claim ttl must be between 30 seconds and 24 hours");
+  }
+  return seconds;
+}
+function randomId(prefix) {
+  return `${prefix}_${Date.now().toString(36)}_${randomBytes(6).toString("base64url").toLowerCase()}`;
+}
+function tokenHash(token) {
+  return createHash2("sha256").update(token).digest("hex");
+}
+function safeEqual(a, b) {
+  const left = Buffer.from(a);
+  const right = Buffer.from(b);
+  return left.length === right.length && timingSafeEqual(left, right);
+}
+function expiresAtFrom(timestamp, ttlSeconds) {
+  return new Date(new Date(timestamp).getTime() + ttlSeconds * 1e3).toISOString();
+}
+function metadataJson(metadata2) {
+  return metadata2 ? JSON.stringify(metadata2) : null;
+}
+function parseMetadata(value) {
+  if (typeof value !== "string" || !value) return void 0;
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function derivedState(row, now = /* @__PURE__ */ new Date()) {
+  if (row.status !== "active") return row.status === "expired" ? "expired" : "stale";
+  if (new Date(row.expires_at).getTime() <= now.getTime()) return "expired";
+  const ageSeconds = Math.max(0, Math.floor((now.getTime() - new Date(row.heartbeat_at).getTime()) / 1e3));
+  if (ageSeconds >= staleAfterSeconds) return "stale";
+  if (ageSeconds >= idleAfterSeconds) return "idle";
+  return "active";
+}
+function rowToClaim(row, now = /* @__PURE__ */ new Date()) {
+  const heartbeatAt = String(row.heartbeat_at);
+  return {
+    id: String(row.id),
+    project: String(row.project_id),
+    channel: typeof row.channel === "string" ? row.channel : void 0,
+    scope_type: String(row.scope_type),
+    target_id: String(row.target_id),
+    target_title: typeof row.target_title === "string" ? row.target_title : void 0,
+    agent_id: typeof row.agent_id === "string" ? row.agent_id : void 0,
+    agent_name: String(row.agent_name),
+    agent_kind: String(row.agent_kind),
+    thread_id: typeof row.thread_id === "string" ? row.thread_id : void 0,
+    status: String(row.status),
+    created_at: String(row.created_at),
+    heartbeat_at: heartbeatAt,
+    expires_at: String(row.expires_at),
+    released_at: typeof row.released_at === "string" ? row.released_at : void 0,
+    revoked_at: typeof row.revoked_at === "string" ? row.revoked_at : void 0,
+    revoked_by: typeof row.revoked_by === "string" ? row.revoked_by : void 0,
+    override_reason: typeof row.override_reason === "string" ? row.override_reason : void 0,
+    metadata: parseMetadata(row.metadata_json),
+    heartbeat_age_seconds: Math.max(0, Math.floor((now.getTime() - new Date(heartbeatAt).getTime()) / 1e3)),
+    derived_state: derivedState({
+      expires_at: String(row.expires_at),
+      heartbeat_at: heartbeatAt,
+      status: String(row.status)
+    }, now)
+  };
+}
+function eventToRow(row) {
+  return {
+    claim_id: String(row.claim_id),
+    event_type: String(row.event_type),
+    actor: typeof row.actor === "string" ? row.actor : void 0,
+    message: typeof row.message === "string" ? row.message : void 0,
+    created_at: String(row.created_at),
+    metadata: parseMetadata(row.metadata_json)
+  };
+}
+function ensureProject3(database, project) {
+  const timestamp = nowIso();
+  database.prepare(`
+    insert into projects (id, product, created_at, updated_at)
+    values (?, ?, ?, ?)
+    on conflict(id) do update set product = excluded.product, updated_at = excluded.updated_at
+  `).run(project, project, timestamp, timestamp);
+}
+function recordEvent(database, claimId, eventType, actor, message, metadata2) {
+  database.prepare(`
+    insert into agent_claim_events (id, claim_id, event_type, actor, message, created_at, metadata_json)
+    values (?, ?, ?, ?, ?, ?, ?)
+  `).run(randomId("claim_event"), claimId, eventType, actor || null, message || null, nowIso(), metadataJson(metadata2));
+}
+function expireActiveClaims(database) {
+  const timestamp = nowIso();
+  const expired = database.prepare(`
+    select id from agent_claims where status = 'active' and expires_at <= ?
+  `).all(timestamp);
+  if (expired.length === 0) return;
+  database.prepare(`
+    update agent_claims set status = 'expired' where status = 'active' and expires_at <= ?
+  `).run(timestamp);
+  for (const claim of expired) recordEvent(database, claim.id, "expired", "system", "Claim expired after missed heartbeat.");
+}
+function normalizeScope(scopeType) {
+  if (!scopes.has(scopeType)) throw new AgentClaimError(`Unsupported claim scope: ${scopeType}`);
+  return scopeType;
+}
+function channelOverlaps(left, right) {
+  return !left || !right || left === right;
+}
+function claimOverlaps(candidate, existing) {
+  if (candidate.project !== existing.project) return false;
+  if (!channelOverlaps(candidate.channel, existing.channel)) return false;
+  if (candidate.scope_type === existing.scope_type && candidate.target_id === existing.target_id) return true;
+  return candidate.scope_type === "project_channel" || existing.scope_type === "project_channel";
+}
+function activeClaims(database, project) {
+  const rows = project ? database.prepare("select * from agent_claims where project_id = ? and status = 'active' order by heartbeat_at desc").all(project) : database.prepare("select * from agent_claims where status = 'active' order by project_id, heartbeat_at desc").all();
+  return rows.map((row) => rowToClaim(row));
+}
+function findClaimById(database, claimId, project) {
+  const row = project ? database.prepare("select * from agent_claims where project_id = ? and id = ?").get(project, claimId) : database.prepare("select * from agent_claims where id = ?").get(claimId);
+  return row ? rowToClaim(row) : null;
+}
+function findClaimRowByToken(database, claimToken) {
+  const claimId = claimToken.split(".")[0];
+  const row = database.prepare("select * from agent_claims where id = ?").get(claimId);
+  if (!row) return null;
+  return safeEqual(String(row.token_hash), tokenHash(claimToken)) ? row : null;
+}
+function denied(code, message, conflicts = []) {
+  return { ok: false, code, message, conflicts };
+}
+function scopeAllowsWrite(claim, scopeType, targetId, writeKind) {
+  if (claim.scope_type === scopeType && claim.target_id === targetId) return true;
+  if (claim.scope_type === "project_channel") return true;
+  if (claim.scope_type === "lineage_workspace" && scopeType === "lineage_workspace") return claim.target_id === targetId;
+  if (claim.scope_type === "content_queue_lane" && writeKind === "content_queue_next") return true;
+  return false;
+}
+function createAgentClaim(fields) {
+  const project = fields.project.trim();
+  const targetId = fields.targetId.trim();
+  const agentName = fields.agentName.trim();
+  if (!project) throw new AgentClaimError("Agent claim requires project");
+  if (!targetId) throw new AgentClaimError("Agent claim requires target");
+  if (!agentName) throw new AgentClaimError("Agent claim requires agent name");
+  const scopeType = normalizeScope(fields.scopeType);
+  const ttlSeconds = fields.ttlSeconds || defaultTtlSeconds;
+  const database = lineageDb();
+  try {
+    ensureProject3(database, project);
+    expireActiveClaims(database);
+    const candidate = { project, channel: fields.channel?.trim() || void 0, scope_type: scopeType, target_id: targetId };
+    const conflicts = activeClaims(database, project).filter((claim2) => claimOverlaps(candidate, claim2));
+    if (conflicts.length > 0 && !fields.force) {
+      throw new AgentClaimError("Target already has an active overlapping agent claim.", 409, "target_already_claimed", conflicts);
+    }
+    if (conflicts.length > 0 && !fields.reason?.trim()) {
+      throw new AgentClaimError("Overriding an active claim requires --reason.", 400, "override_reason_required", conflicts);
+    }
+    const timestamp = nowIso();
+    for (const conflict of conflicts) {
+      database.prepare(`
+        update agent_claims
+        set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
+        where id = ? and status = 'active'
+      `).run(timestamp, agentName, fields.reason || null, conflict.id);
+      recordEvent(database, conflict.id, "revoked", agentName, fields.reason || "Revoked by forced claim takeover.");
+      recordEvent(database, conflict.id, "conflict", agentName, `Overridden by ${agentName}.`, { new_claim_target: targetId });
+    }
+    const id = randomId("claim");
+    const secret = randomBytes(24).toString("base64url");
+    const claimToken = `${id}.${secret}`;
+    const expiresAt = expiresAtFrom(timestamp, ttlSeconds);
+    database.prepare(`
+      insert into agent_claims (
+        id, token_hash, project_id, channel, scope_type, target_id, target_title, agent_id, agent_name,
+        agent_kind, thread_id, status, created_at, heartbeat_at, expires_at, metadata_json
+      ) values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?, ?)
+    `).run(
+      id,
+      tokenHash(claimToken),
+      project,
+      candidate.channel || null,
+      scopeType,
+      targetId,
+      fields.targetTitle?.trim() || null,
+      fields.agentId?.trim() || null,
+      agentName,
+      fields.agentKind?.trim() || "codex",
+      fields.threadId?.trim() || null,
+      timestamp,
+      timestamp,
+      expiresAt,
+      metadataJson(fields.metadata)
+    );
+    recordEvent(database, id, "created", agentName, `Claimed ${scopeType} ${targetId}.`, { ttl_seconds: ttlSeconds });
+    const claim = findClaimById(database, id);
+    return { ok: true, claim, claim_token: claimToken, conflicts_revoked: conflicts.map((conflict) => conflict.id) };
+  } finally {
+    database.close();
+  }
+}
+function listAgentClaims(project) {
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const rows = project ? database.prepare("select * from agent_claims where project_id = ? order by status, heartbeat_at desc").all(project) : database.prepare("select * from agent_claims order by project_id, status, heartbeat_at desc").all();
+    return { ok: true, claims: rows.map((row) => rowToClaim(row)), fetchedAt: nowIso() };
+  } finally {
+    database.close();
+  }
+}
+function inspectAgentClaim(claimId, project) {
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    const events = database.prepare("select * from agent_claim_events where claim_id = ? order by created_at").all(claim.id);
+    return { ok: true, claim, events: events.map(eventToRow) };
+  } finally {
+    database.close();
+  }
+}
+function heartbeatAgentClaim(claimToken, ttlSeconds = defaultTtlSeconds) {
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, claimToken);
+    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    const timestamp = nowIso();
+    database.prepare("update agent_claims set heartbeat_at = ?, expires_at = ? where id = ?").run(timestamp, expiresAtFrom(timestamp, ttlSeconds), claim.id);
+    recordEvent(database, claim.id, "heartbeat", claim.agent_name, "Claim heartbeat received.");
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function releaseAgentClaim(claimToken) {
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, claimToken);
+    if (!row) throw new AgentClaimError("Unknown or invalid agent claim token.", 401, "claim_token_invalid");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    const timestamp = nowIso();
+    database.prepare("update agent_claims set status = 'released', released_at = ? where id = ?").run(timestamp, claim.id);
+    recordEvent(database, claim.id, "released", claim.agent_name, "Claim released by token holder.");
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function releaseStaleAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Releasing a stale agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  if (!fields.reason?.trim()) throw new AgentClaimError("Releasing a stale agent claim requires a reason.", 400, "reason_required");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    if (claim.status !== "active" || claim.derived_state !== "stale") {
+      throw new AgentClaimError("Only stale active claims can be released without the claim token.", 409, "claim_not_stale", [claim]);
+    }
+    const timestamp = nowIso();
+    database.prepare("update agent_claims set status = 'released', released_at = ?, revoked_by = ?, override_reason = ? where id = ?").run(timestamp, fields.actor || "human", fields.reason, claim.id);
+    recordEvent(database, claim.id, "released", fields.actor || "human", fields.reason);
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function revokeAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Revoking an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  if (!fields.reason?.trim()) throw new AgentClaimError("Revoking an agent claim requires a reason.", 400, "reason_required");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    const timestamp = nowIso();
+    database.prepare(`
+      update agent_claims set status = 'revoked', revoked_at = ?, revoked_by = ?, override_reason = ?
+      where id = ?
+    `).run(timestamp, fields.actor || "human", fields.reason, claim.id);
+    recordEvent(database, claim.id, "revoked", fields.actor || "human", fields.reason);
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function transferAgentClaim(project, claimId, fields) {
+  if (!fields.confirmWrite) throw new AgentClaimError("Transferring an agent claim requires confirmWrite=true.", 400, "confirm_write_required");
+  const toAgentName = fields.toAgentName.trim();
+  if (!toAgentName) throw new AgentClaimError("Transfer requires toAgentName.", 400, "agent_name_required");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const claim = findClaimById(database, claimId, project);
+    if (!claim) throw new AgentClaimError(`Unknown agent claim: ${claimId}`, 404, "claim_not_found");
+    if (claim.status !== "active") throw new AgentClaimError(`Agent claim is ${claim.status}.`, 409, "claim_not_active");
+    database.prepare("update agent_claims set agent_name = ? where id = ?").run(toAgentName, claim.id);
+    recordEvent(database, claim.id, "transferred", fields.actor || "human", fields.reason || `Transferred claim to ${toAgentName}.`, { to_agent_name: toAgentName });
+    return { ok: true, claim: findClaimById(database, claim.id) };
+  } finally {
+    database.close();
+  }
+}
+function validateAgentClaimForWrite(fields) {
+  if (fields.dangerLevel === "danger" && !fields.confirmWrite) {
+    return denied("human_confirmation_required", "Dangerous write requires explicit human confirmation.");
+  }
+  if (!fields.claimToken) return denied("claim_required", "Mutating agent write requires a matching claim token.");
+  const database = lineageDb();
+  try {
+    expireActiveClaims(database);
+    const row = findClaimRowByToken(database, fields.claimToken);
+    if (!row) return denied("claim_token_invalid", "Unknown or invalid claim token.");
+    const claim = rowToClaim(row);
+    if (claim.status !== "active") return denied("claim_not_active", `Agent claim is ${claim.status}.`);
+    if (new Date(claim.expires_at).getTime() <= Date.now()) return denied("claim_expired", "Agent claim has expired.");
+    if (claim.project !== fields.project) return denied("claim_project_mismatch", `Claim project ${claim.project} does not match ${fields.project}.`, [claim]);
+    if (fields.channel && claim.channel && claim.channel !== fields.channel) {
+      return denied("claim_channel_mismatch", `Claim channel ${claim.channel} does not match ${fields.channel}.`, [claim]);
+    }
+    if (!scopeAllowsWrite(claim, fields.scopeType, fields.targetId, fields.writeKind)) {
+      return denied("claim_scope_mismatch", `Claim does not cover ${fields.scopeType} ${fields.targetId}.`, [claim]);
+    }
+    recordEvent(database, claim.id, "write_allowed", claim.agent_name, `${fields.writeKind} allowed.`, {
+      danger_level: fields.dangerLevel,
+      target_id: fields.targetId,
+      write_kind: fields.writeKind
+    });
+    return { ok: true, claim, warnings: [] };
+  } finally {
+    database.close();
+  }
+}
+
 // src/server/assetLineageHandoff.ts
 var publicPackageCommand = "npx @mean-weasel/lineage";
 function shellQuote(value) {
@@ -1987,9 +2395,23 @@ function getLineageBrief(project, rootAssetId) {
 function linkSelectedLineageChild(project, fields) {
   const next = getLineageNextAsset(project, fields.rootAssetId);
   if (!next.next_asset) throw new LineageError("Cannot link child until a next base is selected or unambiguous");
+  if (fields.confirmWrite) {
+    const validation = validateAgentClaimForWrite({
+      channel: next.next_asset.channel,
+      claimToken: fields.claimToken,
+      confirmWrite: fields.confirmWrite,
+      dangerLevel: "enforce",
+      project,
+      scopeType: "lineage_workspace",
+      targetId: lineageWorkspaceId(project, next.root_asset_id),
+      writeKind: "link_child"
+    });
+    if (!validation.ok) throw new AgentClaimError(validation.message, validation.code === "claim_required" ? 401 : 403, validation.code, validation.conflicts);
+  }
   const result = linkLineageAssets(project, {
     childAssetId: fields.childAssetId,
     confirmWrite: fields.confirmWrite,
+    claimToken: fields.claimToken,
     parentAssetId: next.next_asset.asset_id
   });
   return {
@@ -2867,7 +3289,7 @@ var AssetSelectionError = class extends Error {
 function isAssetSelectionError(error) {
   return error instanceof AssetSelectionError;
 }
-function ensureProject3(database, project) {
+function ensureProject4(database, project) {
   const timestamp = nowIso();
   database.prepare(`
     insert into projects (id, product, created_at, updated_at)
@@ -2953,7 +3375,7 @@ function getCurrentSet(database, project) {
   return found;
 }
 function ensureSelectionSet(database, project, fields) {
-  ensureProject3(database, project);
+  ensureProject4(database, project);
   const timestamp = nowIso();
   const id = setId(project, fields.kind, fields.key);
   database.prepare(`
@@ -3183,6 +3605,78 @@ function assetSelectionRouter(projectFrom2) {
   return router;
 }
 
+// src/server/agentClaimRoutes.ts
+function claimTokenFromRequest(req) {
+  const header = req.header("X-Lineage-Claim-Token");
+  if (header) return header;
+  return typeof req.body?.claimToken === "string" ? req.body.claimToken : void 0;
+}
+function stringBody(req, key) {
+  const value = req.body[key];
+  return typeof value === "string" ? value : void 0;
+}
+function boolBody(req, key) {
+  return req.body[key] === true;
+}
+function registerAgentClaimRoutes(app2, projectFrom2, asyncRoute2) {
+  app2.get("/api/agent-claims", asyncRoute2((req, res) => {
+    const project = typeof req.query.project === "string" ? req.query.project : void 0;
+    res.json(listAgentClaims(project));
+  }));
+  app2.post("/api/agent-claims", asyncRoute2((req, res) => {
+    res.json(createAgentClaim({
+      agentId: stringBody(req, "agentId"),
+      agentKind: stringBody(req, "agentKind"),
+      agentName: stringBody(req, "agentName") || stringBody(req, "agent_name") || "",
+      channel: stringBody(req, "channel"),
+      force: boolBody(req, "force"),
+      metadata: typeof req.body.metadata === "object" && req.body.metadata !== null ? req.body.metadata : void 0,
+      project: projectFrom2({ body: req.body, query: req.query }),
+      reason: stringBody(req, "reason"),
+      scopeType: stringBody(req, "scopeType") || stringBody(req, "scope_type") || "",
+      targetId: stringBody(req, "targetId") || stringBody(req, "target_id") || "",
+      targetTitle: stringBody(req, "targetTitle") || stringBody(req, "target_title"),
+      threadId: stringBody(req, "threadId") || stringBody(req, "thread_id"),
+      ttlSeconds: parseClaimTtl(stringBody(req, "ttl"))
+    }));
+  }));
+  app2.get("/api/agent-claims/:claimId", asyncRoute2((req, res) => {
+    res.json(inspectAgentClaim(req.params.claimId, typeof req.query.project === "string" ? req.query.project : void 0));
+  }));
+  app2.post("/api/agent-claims/:claimId/heartbeat", asyncRoute2((req, res) => {
+    const claimToken = claimTokenFromRequest(req);
+    if (!claimToken) throw new AgentClaimError("Heartbeat requires claimToken", 400, "claim_token_required");
+    res.json(heartbeatAgentClaim(claimToken, parseClaimTtl(stringBody(req, "ttl"))));
+  }));
+  app2.post("/api/agent-claims/:claimId/release", asyncRoute2((req, res) => {
+    const claimToken = claimTokenFromRequest(req);
+    if (!claimToken) throw new AgentClaimError("Release requires claimToken", 400, "claim_token_required");
+    res.json(releaseAgentClaim(claimToken));
+  }));
+  app2.post("/api/agent-claims/:claimId/release-stale", asyncRoute2((req, res) => {
+    res.json(releaseStaleAgentClaim(projectFrom2({ body: req.body, query: req.query }), req.params.claimId, {
+      actor: stringBody(req, "actor") || "human",
+      confirmWrite: boolBody(req, "confirmWrite"),
+      reason: stringBody(req, "reason")
+    }));
+  }));
+  app2.post("/api/agent-claims/:claimId/revoke", asyncRoute2((req, res) => {
+    res.json(revokeAgentClaim(projectFrom2({ body: req.body, query: req.query }), req.params.claimId, {
+      actor: stringBody(req, "actor") || "human",
+      confirmWrite: boolBody(req, "confirmWrite"),
+      reason: stringBody(req, "reason")
+    }));
+  }));
+  app2.post("/api/agent-claims/:claimId/transfer", asyncRoute2((req, res) => {
+    res.json(transferAgentClaim(projectFrom2({ body: req.body, query: req.query }), req.params.claimId, {
+      actor: stringBody(req, "actor") || "human",
+      confirmWrite: boolBody(req, "confirmWrite"),
+      reason: stringBody(req, "reason"),
+      toAgentName: stringBody(req, "toAgentName") || stringBody(req, "to_agent_name") || ""
+    }));
+  }));
+}
+
 // src/server/adapters/adapterSettings.ts
 var AdapterSettingsError = class extends Error {
   constructor(message, status = 400) {
@@ -3227,7 +3721,7 @@ var definitions = [
     secret_ref: null
   }
 ];
-function ensureProject4(database, project) {
+function ensureProject5(database, project) {
   const timestamp = nowIso();
   database.prepare(`
     insert into projects (id, product, created_at, updated_at)
@@ -3241,7 +3735,7 @@ function definitionFor(adapterType, provider) {
   return definition;
 }
 function seedDefaults(database, project) {
-  ensureProject4(database, project);
+  ensureProject5(database, project);
   const timestamp = nowIso();
   for (const definition of definitions) {
     database.prepare(`
@@ -3500,7 +3994,7 @@ var ContentBatchError = class extends Error {
 function isContentBatchError(error) {
   return error instanceof ContentBatchError;
 }
-function ensureProject5(database, project) {
+function ensureProject6(database, project) {
   const timestamp = nowIso();
   database.prepare(`
     insert into projects (id, product, created_at, updated_at)
@@ -3628,7 +4122,7 @@ function createContentBatch(project, fields) {
   const database = lineageDb();
   const timestamp = nowIso();
   try {
-    ensureProject5(database, project);
+    ensureProject6(database, project);
     database.prepare(`
       insert into content_batches (id, project_id, title, campaign, channel, status, notes, created_at, updated_at)
       values (?, ?, ?, ?, ?, 'active', ?, ?, ?)
@@ -3650,7 +4144,7 @@ function createContentPost(project, fields) {
   const database = lineageDb();
   const timestamp = nowIso();
   try {
-    ensureProject5(database, project);
+    ensureProject6(database, project);
     const batch = database.prepare("select id from content_batches where project_id = ? and id = ?").get(project, batchId);
     if (!batch) throw new ContentBatchError(`Unknown content batch: ${batchId}`, 404);
     database.prepare(`
@@ -3675,6 +4169,30 @@ function findContentPost(database, project, postId) {
   if (!row) throw new ContentBatchError(`Unknown content post: ${postId}`, 404);
   return postFromRow(row, assetsForPost(database, project, postId));
 }
+function requireContentPostClaim(project, post, claimToken, writeKind) {
+  if (!claimToken && !hasActiveContentPostClaim(project, post)) return;
+  const validation = validateAgentClaimForWrite({
+    channel: post.channel,
+    claimToken,
+    confirmWrite: true,
+    dangerLevel: "enforce",
+    project,
+    scopeType: "content_post",
+    targetId: post.id,
+    writeKind
+  });
+  if (!validation.ok) {
+    const status = validation.code === "claim_required" || validation.code === "claim_token_invalid" ? 401 : 409;
+    throw new AgentClaimError(validation.message, status, validation.code, validation.conflicts);
+  }
+}
+function hasActiveContentPostClaim(project, post) {
+  return listAgentClaims(project).claims.some((claim) => {
+    if (claim.project !== project || claim.status !== "active" || claim.derived_state === "expired") return false;
+    if (claim.scope_type === "content_post") return claim.target_id === post.id;
+    return claim.scope_type === "project_channel" && (!claim.channel || claim.channel === post.channel);
+  });
+}
 function listContentPosts(project, filters = {}) {
   const database = lineageDb();
   try {
@@ -3697,6 +4215,7 @@ function updateContentPost(project, fields) {
   const timestamp = nowIso();
   try {
     const current = findContentPost(database, project, postId);
+    if (fields.phase) requireContentPostClaim(project, current, fields.claimToken, "content_post_phase");
     if (fields.batchId) {
       const batch = database.prepare("select id from content_batches where project_id = ? and id = ?").get(project, fields.batchId);
       if (!batch) throw new ContentBatchError(`Unknown content batch: ${fields.batchId}`, 404);
@@ -3734,7 +4253,8 @@ function attachContentPostAsset(project, fields) {
   const database = lineageDb();
   const timestamp = nowIso();
   try {
-    findContentPost(database, project, postId);
+    const current = findContentPost(database, project, postId);
+    requireContentPostClaim(project, current, fields.claimToken, "content_post_attach_asset");
     database.prepare(`
       insert into content_post_assets (id, project_id, post_id, asset_id, role, notes, attached_at)
       values (?, ?, ?, ?, ?, ?, ?)
@@ -3752,6 +4272,8 @@ function detachContentPostAsset(project, fields) {
   if (!fields.confirmWrite) return { ok: true, dryRun: true, message: `Would detach ${assetId} from ${postId}`, preview: { postId, assetId, role } };
   const database = lineageDb();
   try {
+    const current = findContentPost(database, project, postId);
+    requireContentPostClaim(project, current, fields.claimToken, "content_post_detach_asset");
     database.prepare("delete from content_post_assets where project_id = ? and post_id = ? and asset_id = ? and role = ?").run(project, postId, assetId, role);
     return { ok: true, message: `Detached ${assetId} from ${postId}`, post: findContentPost(database, project, postId) };
   } finally {
@@ -4302,13 +4824,19 @@ function getContentOpsQueue(project) {
 }
 
 // src/server/contentBatchRoutes.ts
-function stringBody(req, key) {
+function stringBody2(req, key) {
   const value = req.body[key];
   return typeof value === "string" ? value : void 0;
 }
-function boolBody(req, key) {
+function boolBody2(req, key) {
   return req.body[key] === true;
 }
+function claimTokenFromRequest2(req) {
+  const header = req.header("X-Lineage-Claim-Token");
+  if (header) return header;
+  const value = req.body.claimToken;
+  return typeof value === "string" ? value : void 0;
+}
 function bodyProjectShape(req) {
   return { body: req.body, query: req.query };
 }
@@ -4319,22 +4847,22 @@ function contentBatchRouter(projectFrom2) {
   });
   router.post("/batches", (req, res) => {
     res.json(createContentBatch(projectFrom2(bodyProjectShape(req)), {
-      batchId: stringBody(req, "batchId") || stringBody(req, "id") || "",
-      campaign: stringBody(req, "campaign"),
-      channel: stringBody(req, "channel"),
-      confirmWrite: boolBody(req, "confirmWrite"),
-      notes: stringBody(req, "notes"),
-      title: stringBody(req, "title") || ""
+      batchId: stringBody2(req, "batchId") || stringBody2(req, "id") || "",
+      campaign: stringBody2(req, "campaign"),
+      channel: stringBody2(req, "channel"),
+      confirmWrite: boolBody2(req, "confirmWrite"),
+      notes: stringBody2(req, "notes"),
+      title: stringBody2(req, "title") || ""
     }));
   });
   router.post("/import/demo", (req, res) => {
-    const kind = stringBody(req, "kind");
+    const kind = stringBody2(req, "kind");
     res.json(importDemoContentBatch(projectFrom2(bodyProjectShape(req)), {
-      batchId: stringBody(req, "batchId") || "",
-      campaign: stringBody(req, "campaign"),
-      confirmWrite: boolBody(req, "confirmWrite"),
+      batchId: stringBody2(req, "batchId") || "",
+      campaign: stringBody2(req, "campaign"),
+      confirmWrite: boolBody2(req, "confirmWrite"),
       kind: kind === "concepts" || kind === "drafts" || kind === "all" ? kind : "all",
-      title: stringBody(req, "title")
+      title: stringBody2(req, "title")
     }));
   });
   router.get("/target", (req, res) => {
@@ -4345,13 +4873,13 @@ function contentBatchRouter(projectFrom2) {
   });
   router.post("/target", (req, res) => {
     res.json(setContentTarget(projectFrom2(bodyProjectShape(req)), {
-      confirmWrite: boolBody(req, "confirmWrite"),
-      notes: stringBody(req, "notes"),
-      postId: stringBody(req, "postId") || ""
+      confirmWrite: boolBody2(req, "confirmWrite"),
+      notes: stringBody2(req, "notes"),
+      postId: stringBody2(req, "postId") || ""
     }));
   });
   router.post("/target/clear", (req, res) => {
-    res.json(clearContentTarget(projectFrom2(bodyProjectShape(req)), boolBody(req, "confirmWrite")));
+    res.json(clearContentTarget(projectFrom2(bodyProjectShape(req)), boolBody2(req, "confirmWrite")));
   });
   router.get("/batches/:batchId", (req, res) => {
     res.json(getContentBatch(projectFrom2(req), req.params.batchId));
@@ -4365,52 +4893,55 @@ function contentBatchRouter(projectFrom2) {
   });
   router.post("/posts", (req, res) => {
     res.json(createContentPost(projectFrom2(bodyProjectShape(req)), {
-      batchId: stringBody(req, "batchId") || "",
-      body: stringBody(req, "body"),
-      campaign: stringBody(req, "campaign"),
-      channel: stringBody(req, "channel") || "",
-      confirmWrite: boolBody(req, "confirmWrite"),
-      cta: stringBody(req, "cta"),
-      notes: stringBody(req, "notes"),
-      phase: stringBody(req, "phase"),
-      postId: stringBody(req, "postId") || stringBody(req, "id") || "",
-      sourcePath: stringBody(req, "sourcePath"),
-      title: stringBody(req, "title") || ""
+      batchId: stringBody2(req, "batchId") || "",
+      body: stringBody2(req, "body"),
+      campaign: stringBody2(req, "campaign"),
+      channel: stringBody2(req, "channel") || "",
+      confirmWrite: boolBody2(req, "confirmWrite"),
+      cta: stringBody2(req, "cta"),
+      notes: stringBody2(req, "notes"),
+      phase: stringBody2(req, "phase"),
+      postId: stringBody2(req, "postId") || stringBody2(req, "id") || "",
+      sourcePath: stringBody2(req, "sourcePath"),
+      title: stringBody2(req, "title") || ""
     }));
   });
   router.post("/posts/:postId", (req, res) => {
     res.json(updateContentPost(projectFrom2(bodyProjectShape(req)), {
-      batchId: stringBody(req, "batchId"),
-      body: stringBody(req, "body"),
-      campaign: stringBody(req, "campaign"),
-      channel: stringBody(req, "channel"),
-      confirmWrite: boolBody(req, "confirmWrite"),
-      cta: stringBody(req, "cta"),
-      notes: stringBody(req, "notes"),
-      phase: stringBody(req, "phase"),
-      postedAt: stringBody(req, "postedAt"),
+      batchId: stringBody2(req, "batchId"),
+      body: stringBody2(req, "body"),
+      campaign: stringBody2(req, "campaign"),
+      channel: stringBody2(req, "channel"),
+      confirmWrite: boolBody2(req, "confirmWrite"),
+      claimToken: claimTokenFromRequest2(req),
+      cta: stringBody2(req, "cta"),
+      notes: stringBody2(req, "notes"),
+      phase: stringBody2(req, "phase"),
+      postedAt: stringBody2(req, "postedAt"),
       postId: req.params.postId,
-      scheduledAt: stringBody(req, "scheduledAt"),
-      sourcePath: stringBody(req, "sourcePath"),
-      title: stringBody(req, "title"),
-      url: stringBody(req, "url")
+      scheduledAt: stringBody2(req, "scheduledAt"),
+      sourcePath: stringBody2(req, "sourcePath"),
+      title: stringBody2(req, "title"),
+      url: stringBody2(req, "url")
     }));
   });
   router.post("/posts/:postId/assets", (req, res) => {
     res.json(attachContentPostAsset(projectFrom2(bodyProjectShape(req)), {
-      assetId: stringBody(req, "assetId") || "",
-      confirmWrite: boolBody(req, "confirmWrite"),
-      notes: stringBody(req, "notes"),
+      assetId: stringBody2(req, "assetId") || "",
+      confirmWrite: boolBody2(req, "confirmWrite"),
+      claimToken: claimTokenFromRequest2(req),
+      notes: stringBody2(req, "notes"),
       postId: req.params.postId,
-      role: stringBody(req, "role")
+      role: stringBody2(req, "role")
     }));
   });
   router.post("/posts/:postId/assets/detach", (req, res) => {
     res.json(detachContentPostAsset(projectFrom2(bodyProjectShape(req)), {
-      assetId: stringBody(req, "assetId") || "",
-      confirmWrite: boolBody(req, "confirmWrite"),
+      assetId: stringBody2(req, "assetId") || "",
+      confirmWrite: boolBody2(req, "confirmWrite"),
+      claimToken: claimTokenFromRequest2(req),
       postId: req.params.postId,
-      role: stringBody(req, "role")
+      role: stringBody2(req, "role")
     }));
   });
   return router;
@@ -4526,7 +5057,7 @@ function listImageGenerationJobs(project = defaultProject, fields = {}) {
 }
 
 // src/server/assetLineageDemo.ts
-import { createHash as createHash2 } from "node:crypto";
+import { createHash as createHash3 } from "node:crypto";
 import { copyFileSync as copyFileSync2, existsSync as existsSync5, mkdirSync as mkdirSync5, mkdtempSync, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname as dirname3, join as join8, posix } from "node:path";
@@ -4609,7 +5140,7 @@ function swissifierMediaState(manifest) {
   return { invalid, missing };
 }
 function sha256Hex(input) {
-  return createHash2("sha256").update(input).digest("hex");
+  return createHash3("sha256").update(input).digest("hex");
 }
 function safeTarEntryName(rawName) {
   const stripped = rawName.replace(/\0.*$/, "").replace(/^\.\//, "");
@@ -4870,7 +5401,7 @@ function svg(label, fill, stroke) {
 `;
 }
 function assetIdFor(asset) {
-  return `local-${createHash2("sha256").update(svg(asset.label, asset.fill, asset.stroke)).digest("hex").slice(0, 12)}`;
+  return `local-${createHash3("sha256").update(svg(asset.label, asset.fill, asset.stroke)).digest("hex").slice(0, 12)}`;
 }
 function demoAssetIds() {
   return Object.fromEntries(demoAssets.map((asset) => [asset.key, assetIdFor(asset)]));
@@ -4916,7 +5447,7 @@ function upsertDemoAssets(project, ids) {
         ids[asset.key],
         project,
         demoRelativePath(project, asset),
-        createHash2("sha256").update(body).digest("hex"),
+        createHash3("sha256").update(body).digest("hex"),
         asset.label,
         asset.channel,
         Buffer.byteLength(body),
@@ -5222,6 +5753,7 @@ app.post("/api/assets/lookup", asyncRoute((req, res) => {
   res.json(lookupAssets(projectFrom(req), Array.isArray(req.body.assetIds) ? req.body.assetIds.map(String) : []));
 }));
 registerAdapterRoutes(app, projectFrom, asyncRoute);
+registerAgentClaimRoutes(app, projectFrom, asyncRoute);
 app.use("/api/content", contentBatchRouter(projectFrom));
 app.use("/api/selections", assetSelectionRouter(projectFrom));
 app.get("/api/generation/jobs", asyncRoute((req, res) => {
@@ -5315,7 +5847,8 @@ app.post(
       linkSelectedLineageChild(projectFrom(req), {
         rootAssetId: typeof req.body.rootAssetId === "string" ? req.body.rootAssetId : void 0,
         childAssetId: String(req.body.childAssetId || ""),
-        confirmWrite: req.body.confirmWrite === true
+        confirmWrite: req.body.confirmWrite === true,
+        claimToken: claimTokenFromRequest(req)
       })
     );
   })
@@ -5539,6 +6072,10 @@ app.use((error, _req, res, _next) => {
     res.status(error.status).json({ error: error.message });
     return;
   }
+  if (isAgentClaimError(error)) {
+    res.status(error.status).json({ error: error.code, message: error.message, conflicts: error.conflicts });
+    return;
+  }
   if (isLineageWorkspaceError(error)) {
     res.status(error.status).json({ error: error.message });
     return;