@nanobpm/nano-workforce 0.35.0 → 0.35.1

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [0.35.1](https://github.com/nanobpm/nano-workforce/compare/v0.35.0...v0.35.1) (2026-08-10)
+
+
+### Bug Fixes
+
+* **api:** move OpenAPI base off the reserved /app page-runtime namespace ([#103](https://github.com/nanobpm/nano-workforce/issues/103)) ([6dfb77f](https://github.com/nanobpm/nano-workforce/commit/6dfb77ff82b532965c4a9823d771d46d4ffa920e)), closes [#102](https://github.com/nanobpm/nano-workforce/issues/102)
+
 # [0.35.0](https://github.com/nanobpm/nano-workforce/compare/v0.34.0...v0.35.0) (2026-08-10)
 
 

package/SPEC.md

@@ -261,13 +261,21 @@ child grids, a lazily-loaded transcript, and a conditional **answer** form shown
 when the PR has an open escalation (`open_escalation_id`, denormalised onto the
 row by migration `003`).
 
-`main.ts` delegates to the runtime and intercepts only the three actions that
-carry app-specific business logic:
+The app-specific business-logic endpoints are **OpenAPI operations** mounted
+under `api.base` (`/app/api`), each implemented by a delegate module in
+`operations/`, plus a `/hooks/*` webhook. The runtime serves them all; `main.ts`
+only starts the runtime and the review-ready poller. The full, authoritative
+contract is `openapi.json` (Swagger UI at `/app/api-docs`); the OpenAPI rows
+below are the complete set of operations, `/hooks/submit` is one of the `/hooks/*`
+webhooks:
 
 | method | route | purpose |
 |---|---|---|
-| `POST` | `/app/actions/start/convergence-loop` | parse the PR ref → create the aggregate + start the process |
-| `POST` | `/app/actions/message` (`escalation-answered`) | answer an open escalation → publish `escalation-answered` |
+| `GET` | `/app/api/status` | list tracked PRs + count |
+| `GET` | `/app/api/version` | app + engine version |
+| `POST` | `/app/api/actions/start/convergence-loop` | parse the PR ref → create the aggregate + start the process |
+| `POST` | `/app/api/actions/start/plan-fanout` | start a plan fan-out run |
+| `POST` | `/app/api/actions/message` (`escalation-answered`) | answer an open escalation → publish `escalation-answered` |
 | `POST` | `/hooks/submit` | webhook submit (shared-secret auth) → start the process |
 
 Everything else (`GET /`, `GET /app/pages/*`, `GET /app/data/*`, the renderer) is

package/app/version.ts

@@ -9,7 +9,7 @@
 // debugging a stuck instance can confirm the process is on the code they think it is.
 //
 // Every probe is best-effort: a missing file or unavailable `.git` yields `null` for that field
-// rather than throwing, so `/app/version` never fails just because one source is absent.
+// rather than throwing, so `/app/api/version` never fails just because one source is absent.
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { dirname, join, resolve, isAbsolute } from "node:path";

package/deno.json

@@ -6,7 +6,7 @@
     ]
   },
   "imports": {
-    "@nanobpm/urban": "npm:@nanobpm/urban@^0.31.1"
+    "@nanobpm/urban": "npm:@nanobpm/urban@^0.32.0"
   },
   "tasks": {
     "start": "deno run --allow-net --allow-read --allow-write --allow-run=gh --allow-env main.ts",

package/deno.lock

@@ -1756,11 +1756,11 @@
   },
   "workspace": {
     "dependencies": [
-      "npm:@nanobpm/urban@~0.31.1"
+      "npm:@nanobpm/urban@0.32"
     ],
     "packageJson": {
       "dependencies": [
-        "npm:@nanobpm/urban@~0.31.1",
+        "npm:@nanobpm/urban@0.32",
         "npm:@semantic-release/changelog@^6.0.3",
         "npm:@semantic-release/git@^10.0.1",
         "npm:@semantic-release/npm@^13.1.5",

package/nano.app.json

@@ -141,7 +141,7 @@
   },
   "api": {
     "spec": "openapi.json",
-    "base": "/app",
+    "base": "/app/api",
     "dir": "operations",
     "validateResponses": "dev"
   },

package/openapi.json

@@ -3,7 +3,7 @@
   "info": {
     "title": "Nano Workforce control API",
     "version": "1.0.0",
-    "description": "The externally-facing control surface an operator, an automation harness, or an LLM uses to observe and steer PR-convergence and planning runs. Contract-first (ADR 0058): the toolkit derives typed request/response contracts + runtime validators from this document and each `operationId` is implemented by a delegate module in `operations/`. Mounted under base `/app` so the existing endpoint paths are preserved. The `/hooks/*` webhook endpoints stay on `actions[]` because they live outside the `/app` namespace."
+    "description": "The externally-facing control surface an operator, an automation harness, or an LLM uses to observe and steer PR-convergence and planning runs. Contract-first (ADR 0058): the toolkit derives typed request/response contracts + runtime validators from this document and each `operationId` is implemented by a delegate module in `operations/`. Mounted under base `/app/api`, kept off the framework-reserved `/app` page-runtime namespace (which owns `/app/runtime.js`, `/app/pages/*`, `/app/data/*`). The `/hooks/*` webhook endpoints stay on `actions[]` because they live outside the `/app` namespace."
   },
   "components": {
     "securitySchemes": {

package/operations/getVersion.test.ts

@@ -1,4 +1,4 @@
-// Tests for GET /app/version → operation `getVersion` (ADR 0058 OpenAPI surface).
+// Tests for GET /app/api/version → operation `getVersion` (ADR 0058 OpenAPI surface).
 // Ported from the previous actions/version.test.ts. Method handling now belongs to the router
 // (only GET is routed here), so there is no 405 case to test at the delegate level.
 import { assert, assertEquals } from "jsr:@std/assert@1";
@@ -12,7 +12,7 @@ function input(headers: Record<string, string> = {}) {
   return {
     req: {
       method: "GET",
-      path: "/app/version",
+      path: "/app/api/version",
       query: new URLSearchParams(),
       headers: new Headers(headers),
       text: async () => "",

package/operations/getVersion.ts

@@ -1,4 +1,4 @@
-// GET /app/version → operationId `getVersion` (ADR 0058 OpenAPI surface, mounted under base /app).
+// GET /app/api/version → operationId `getVersion` (ADR 0058 OpenAPI surface, mounted under base /app/api).
 // The running app's identity (app + resolved @nanobpm/urban versions, git commit/branch, JS runtime,
 // pid, uptime). Because the app runs its `.ts` sources directly from a checkout with no build step,
 // restarts alone don't tell you whether a fix is live; this endpoint does.

package/operations/listActivePrs.test.ts

@@ -1,4 +1,4 @@
-// Tests for GET /app/status → operation `listActivePrs` (ADR 0058 OpenAPI surface).
+// Tests for GET /app/api/status → operation `listActivePrs` (ADR 0058 OpenAPI surface).
 // Covers the happy path (count/prs projection) and the optional shared-secret guard. A minimal
 // in-memory DataLayer backs `activePrs` (it reads the `pull_requests` table via `.all()`).
 import { assert, assertEquals } from "jsr:@std/assert@1";
@@ -21,7 +21,7 @@ function input(headers: Record<string, string> = {}) {
   return {
     req: {
       method: "GET",
-      path: "/app/status",
+      path: "/app/api/status",
       query: new URLSearchParams(),
       headers: new Headers(headers),
       text: async () => "",

package/operations/listActivePrs.ts

@@ -1,4 +1,4 @@
-// GET /app/status → operationId `listActivePrs` (ADR 0058 OpenAPI surface, mounted under base /app).
+// GET /app/api/status → operationId `listActivePrs` (ADR 0058 OpenAPI surface, mounted under base /app/api).
 // List the PRs currently in flight (every tracked PR not converged/abandoned) so an operator or an
 // external automation harness can see active work — and grab a `processKey` to cancel — without
 // opening the DB or the UI. Read-only projection over the datasource.

package/operations/postMessage.ts

@@ -1,4 +1,4 @@
-// POST /app/actions/message → operationId `postMessage` (ADR 0058, base /app).
+// POST /app/api/actions/message → operationId `postMessage` (ADR 0058, base /app/api).
 // Replaces the hand-rolled action that overrode the generic publishMessage action. For the
 // `escalation-answered` message we run the review answer flow, and for `feature-escalation-answered`
 // (issue #25) the implementation-phase (per-task) answer flow: record the answer, resume the parked

package/operations/startConvergenceLoop.ts

@@ -1,4 +1,4 @@
-// POST /app/actions/start/convergence-loop → operationId `startConvergenceLoop` (ADR 0058, base /app).
+// POST /app/api/actions/start/convergence-loop → operationId `startConvergenceLoop` (ADR 0058, base /app/api).
 // Replaces the hand-rolled action that overrode the generic "start process" palette action: parse the
 // PR reference and register/refresh the PR aggregate (idempotent on prKey) before starting the loop.
 //

package/operations/startPlanFanout.ts

@@ -1,4 +1,4 @@
-// POST /app/actions/start/plan-fanout → operationId `startPlanFanout` (ADR 0058, base /app).
+// POST /app/api/actions/start/plan-fanout → operationId `startPlanFanout` (ADR 0058, base /app/api).
 // Replaces the hand-rolled action that overrode the generic "start process" palette action: parse the
 // issue reference and register/refresh the plan aggregate (idempotent on planKey) before starting the
 // planning fan-out. An unparseable reference is a 400; an already-running plan short-circuits.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nanobpm/nano-workforce",
-  "version": "0.35.0",
+  "version": "0.35.1",
   "description": "Nano Workforce — an Agent Graph Orchestration application for Agentic SDLC: durable BPMN processes that coordinate a graph of AI agents across the software delivery lifecycle.",
   "type": "module",
   "main": "main.ts",
@@ -40,7 +40,7 @@
     "test": "deno test -A"
   },
   "dependencies": {
-    "@nanobpm/urban": "^0.31.1"
+    "@nanobpm/urban": "^0.32.0"
   },
   "devDependencies": {
     "@semantic-release/changelog": "^6.0.3",