@nexus-cortex/server 4.26.0

package/dist/routes/permissions.js

@@ -0,0 +1,253 @@
+/**
+ * Permissions Routes
+ * Exposes permission management for tools
+ *
+ * Updated to use orchestrator public methods (following direct-wired pattern)
+ */
+import { Router } from 'express';
+import { getServerOrchestrator } from './messages.js';
+import { WhitelistPolicy, BlacklistPolicy } from '@nexus-cortex/core';
+export const permissionsRouter = Router();
+/**
+ * GET /permissions/policies
+ * List permission policies
+ */
+permissionsRouter.get('/permissions/policies', async (req, res) => {
+    try {
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        // Use orchestrator public method
+        const policies = orchestrator.getPolicies();
+        res.json({
+            policies,
+            count: policies.length
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+/**
+ * POST /permissions/tool/:name
+ * Grant permission for a tool (creates WhitelistPolicy)
+ */
+permissionsRouter.post('/permissions/tool/:name', async (req, res) => {
+    try {
+        const { name } = req.params;
+        const { action } = req.body;
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        if (action === 'grant' || !action) {
+            // Create WhitelistPolicy for this tool
+            const policy = new WhitelistPolicy([name], 40);
+            orchestrator.registerPolicy(policy);
+            res.json({
+                success: true,
+                tool: name,
+                action: 'grant',
+                message: `Permission granted for tool: ${name}`
+            });
+        }
+        else if (action === 'revoke') {
+            // Create BlacklistPolicy for this tool
+            const policy = new BlacklistPolicy([name], 100);
+            orchestrator.registerPolicy(policy);
+            res.json({
+                success: true,
+                tool: name,
+                action: 'revoke',
+                message: `Permission revoked for tool: ${name}`
+            });
+        }
+        else {
+            return res.status(400).json({
+                error: {
+                    message: 'action must be "grant" or "revoke"',
+                    type: 'invalid_request'
+                }
+            });
+        }
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+/**
+ * DELETE /permissions/tool/:name
+ * Revoke permission for a tool (creates BlacklistPolicy)
+ */
+permissionsRouter.delete('/permissions/tool/:name', async (req, res) => {
+    try {
+        const { name } = req.params;
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        // Create BlacklistPolicy for this tool
+        const policy = new BlacklistPolicy([name], 100);
+        orchestrator.registerPolicy(policy);
+        res.json({
+            success: true,
+            tool: name,
+            message: `Permission revoked for tool: ${name}`
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+/**
+ * GET /permissions/audit/statistics
+ * Get audit statistics (must come before /:sessionId route)
+ */
+permissionsRouter.get('/permissions/audit/statistics', async (req, res) => {
+    try {
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        // Use orchestrator public method
+        const statistics = await orchestrator.getAuditStatistics();
+        res.json(statistics || { message: 'No statistics available' });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+/**
+ * GET /permissions/audit
+ * GET /permissions/audit/:sessionId
+ * Get audit log entries
+ */
+permissionsRouter.get('/permissions/audit/:sessionId?', async (req, res) => {
+    try {
+        const { sessionId } = req.params;
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        // Use orchestrator public method
+        const entries = orchestrator.getAuditLog(sessionId);
+        res.json({
+            entries,
+            count: entries.length,
+            sessionId: sessionId || orchestrator.getSessionId()
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+/**
+ * GET /permissions/denied
+ * Get all denied operations
+ */
+permissionsRouter.get('/permissions/denied', async (req, res) => {
+    try {
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        // Use orchestrator public method
+        const operations = await orchestrator.getAllDeniedOperations();
+        res.json({
+            operations,
+            count: operations.length
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+/**
+ * POST /permissions/policies
+ * Register a custom permission policy
+ */
+permissionsRouter.post('/permissions/policies', async (req, res) => {
+    try {
+        const { policy } = req.body;
+        if (!policy) {
+            return res.status(400).json({
+                error: {
+                    message: 'policy object required in request body',
+                    type: 'invalid_request'
+                }
+            });
+        }
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        // Use orchestrator public method
+        orchestrator.registerPolicy(policy);
+        res.json({
+            success: true,
+            message: `Policy registered: ${policy.name}`
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+/**
+ * DELETE /permissions/policies/:policyName
+ * Unregister a permission policy
+ */
+permissionsRouter.delete('/permissions/policies/:policyName', async (req, res) => {
+    try {
+        const { policyName } = req.params;
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' }
+            });
+        }
+        // Use orchestrator public method
+        const removed = orchestrator.unregisterPolicy(policyName);
+        res.json({
+            success: removed,
+            removed,
+            message: removed
+                ? `Policy unregistered: ${policyName}`
+                : `Policy not found: ${policyName}`
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' }
+        });
+    }
+});
+//# sourceMappingURL=permissions.js.map

package/dist/routes/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/routes/permissions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAEtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC;AAE1C;;;GAGG;AACH,iBAAiB,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACnF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,QAAQ,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC;QAE5C,GAAG,CAAC,IAAI,CAAC;YACP,QAAQ;YACR,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,iBAAiB,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACtF,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAE5B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,uCAAuC;YACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAEpC,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,gCAAgC,IAAI,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,uCAAuC;YACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YAChD,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAEpC,GAAG,CAAC,IAAI,CAAC;gBACP,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,gCAAgC,IAAI,EAAE;aAChD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE;oBACL,OAAO,EAAE,oCAAoC;oBAC7C,IAAI,EAAE,iBAAiB;iBACxB;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,iBAAiB,CAAC,MAAM,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACxF,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAE5B,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,uCAAuC;QACvC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;QAChD,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEpC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,gCAAgC,IAAI,EAAE;SAChD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,iBAAiB,CAAC,GAAG,CAAC,+BAA+B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC3F,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE,CAAC;QAE3D,GAAG,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,iBAAiB,CAAC,GAAG,CAAC,gCAAgC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAC5F,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAEjC,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEpD,GAAG,CAAC,IAAI,CAAC;YACP,OAAO;YACP,KAAK,EAAE,OAAO,CAAC,MAAM;YACrB,SAAS,EAAE,SAAS,IAAI,YAAY,CAAC,YAAY,EAAE;SACpD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,iBAAiB,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,sBAAsB,EAAE,CAAC;QAE/D,GAAG,CAAC,IAAI,CAAC;YACP,UAAU;YACV,KAAK,EAAE,UAAU,CAAC,MAAM;SACzB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,iBAAiB,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACpF,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAE5B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE;oBACL,OAAO,EAAE,wCAAwC;oBACjD,IAAI,EAAE,iBAAiB;iBACxB;aACF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAEpC,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,sBAAsB,MAAM,CAAC,IAAI,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,iBAAiB,CAAC,MAAM,CAAC,mCAAmC,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAClG,IAAI,CAAC;QACH,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC;QAElC,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,iCAAiC;QACjC,MAAM,OAAO,GAAG,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAE1D,GAAG,CAAC,IAAI,CAAC;YACP,OAAO,EAAE,OAAO;YAChB,OAAO;YACP,OAAO,EAAE,OAAO;gBACd,CAAC,CAAC,wBAAwB,UAAU,EAAE;gBACtC,CAAC,CAAC,qBAAqB,UAAU,EAAE;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/routes/pr.d.ts

@@ -0,0 +1,2 @@
+export declare const prRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=pr.d.ts.map

package/dist/routes/pr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr.d.ts","sourceRoot":"","sources":["../../src/routes/pr.ts"],"names":[],"mappings":"AAiBA,eAAO,MAAM,QAAQ,4CAAW,CAAC"}

package/dist/routes/pr.js

@@ -0,0 +1,222 @@
+/**
+ * PR Management Routes
+ * Exposes pull request review, creation, listing, and webhook endpoints.
+ * These routes use the orchestrator to send prompts that trigger PRAgent tool calls.
+ *
+ * Security:
+ *  - Every `repo` is validated through GitPolicy (format regex + allow-list) BEFORE it
+ *    is interpolated into an orchestrator prompt, so unauthenticated callers can't smuggle
+ *    shell metacharacters or out-of-policy repos into tool execution.
+ *  - The webhook verifies GitHub's X-Hub-Signature-256 HMAC against GITHUB_WEBHOOK_SECRET.
+ *    With no secret configured the webhook is disabled (401) rather than open.
+ */
+import { Router } from 'express';
+import { createHmac, timingSafeEqual } from 'crypto';
+import { GitPolicy } from '@nexus-cortex/executors';
+import { getServerOrchestrator } from './messages.js';
+export const prRouter = Router();
+const policy = GitPolicy.fromEnv();
+/** Validate a PR number from the request (positive integer). */
+function validPrNumber(n) {
+    const num = typeof n === 'string' && /^\d+$/.test(n) ? Number(n) : n;
+    return Number.isInteger(num) && num > 0 ? num : null;
+}
+/**
+ * POST /v1/pr/review
+ * Trigger a PR review pipeline
+ *
+ * Body: { repo: "owner/repo", prNumber: number, options?: { pathFilter, maxLines } }
+ */
+prRouter.post('/v1/pr/review', async (req, res) => {
+    try {
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' },
+            });
+        }
+        const { repo, prNumber, options } = req.body;
+        const repoErr = policy.validateRepo(repo);
+        if (repoErr) {
+            return res.status(400).json({ error: { message: repoErr, type: 'invalid_request' } });
+        }
+        const pr = validPrNumber(prNumber);
+        if (pr === null) {
+            return res.status(400).json({
+                error: { message: 'prNumber must be a positive integer', type: 'invalid_request' },
+            });
+        }
+        // Only forward a known-safe, structured subset of options into the prompt.
+        const safeOptions = {};
+        if (options && typeof options === 'object') {
+            if (typeof options.pathFilter === 'string')
+                safeOptions.pathFilter = options.pathFilter;
+            if (Number.isInteger(options.maxLines))
+                safeOptions.maxLines = options.maxLines;
+        }
+        const diffOptionsStr = Object.keys(safeOptions).length
+            ? `, diffOptions: ${JSON.stringify(safeOptions)}`
+            : '';
+        const prompt = `Review pull request #${pr} in ${repo}.
+
+Use PRAgent(mode=review, repo="${repo}", prNumber=${pr}${diffOptionsStr}) to get the PR diff and metadata.
+
+Then dispatch these review agents IN PARALLEL using the Task tool:
+1. pr-security-auditor: Scan for security vulnerabilities
+2. pr-code-quality: Review code quality and patterns
+3. pr-architecture-reviewer: Assess architectural impact
+
+After all agents complete, synthesize their findings into a final review recommendation.`;
+        const response = await orchestrator.sendMessage(prompt);
+        res.json({
+            review: {
+                repo,
+                prNumber: pr,
+                response: response.content,
+                toolUses: response.toolUses,
+                usage: response.usage,
+                metadata: response.metadata,
+            },
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' },
+        });
+    }
+});
+/**
+ * POST /v1/pr/create
+ * Trigger a PR creation pipeline
+ *
+ * Body: { repo: "owner/repo", branch: string, description?: string }
+ */
+prRouter.post('/v1/pr/create', async (req, res) => {
+    try {
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' },
+            });
+        }
+        const { repo, branch, description } = req.body;
+        const repoErr = policy.validateRepo(repo);
+        if (repoErr) {
+            return res.status(400).json({ error: { message: repoErr, type: 'invalid_request' } });
+        }
+        if (branch !== undefined) {
+            const branchErr = policy.validateBranch(branch);
+            if (branchErr) {
+                return res.status(400).json({ error: { message: branchErr, type: 'invalid_request' } });
+            }
+        }
+        // description is free-text but is delivered as data, not a command. Cap its length.
+        const desc = typeof description === 'string' ? description.slice(0, 4000) : undefined;
+        const prompt = `Create a pull request for ${repo}${branch ? ` on branch "${branch}"` : ''}.
+${desc ? `\nDescription: ${desc}` : ''}
+
+Use WorkspaceManager to set up an isolated worktree, then use PRAgent(mode=create) to prepare the PR context.
+Dispatch a pr-implementer agent to make the changes in the worktree.`;
+        const response = await orchestrator.sendMessage(prompt);
+        res.json({
+            create: {
+                repo,
+                branch,
+                response: response.content,
+                toolUses: response.toolUses,
+                metadata: response.metadata,
+            },
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' },
+        });
+    }
+});
+/**
+ * GET /v1/pr/list
+ * List open PRs for a repository
+ *
+ * Query: ?repo=owner/repo
+ */
+prRouter.get('/v1/pr/list', async (req, res) => {
+    try {
+        const orchestrator = getServerOrchestrator();
+        if (!orchestrator) {
+            return res.status(503).json({
+                error: { message: 'Server not initialized', type: 'server_error' },
+            });
+        }
+        const repo = req.query.repo;
+        const repoErr = policy.validateRepo(repo);
+        if (repoErr) {
+            return res.status(400).json({ error: { message: repoErr, type: 'invalid_request' } });
+        }
+        const prompt = `List open pull requests for ${repo}. Use PRAgent(mode=list, repo="${repo}") and return the results.`;
+        const response = await orchestrator.sendMessage(prompt);
+        res.json({
+            list: {
+                repo,
+                response: response.content,
+                toolUses: response.toolUses,
+            },
+        });
+    }
+    catch (error) {
+        res.status(500).json({
+            error: { message: error.message, type: 'server_error' },
+        });
+    }
+});
+/**
+ * Verify a GitHub webhook HMAC (X-Hub-Signature-256) against GITHUB_WEBHOOK_SECRET.
+ * Returns true only on a constant-time match. Missing secret/signature/body → false.
+ */
+function verifyWebhookSignature(req) {
+    const secret = process.env.GITHUB_WEBHOOK_SECRET;
+    if (!secret)
+        return false;
+    const signature = req.headers['x-hub-signature-256'];
+    const rawBody = req.rawBody;
+    if (typeof signature !== 'string' || !rawBody)
+        return false;
+    const expected = 'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
+    const a = Buffer.from(signature);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/**
+ * POST /v1/pr/webhook
+ * GitHub webhook endpoint for auto-review on PR open.
+ *
+ * Requires GITHUB_WEBHOOK_SECRET + a valid X-Hub-Signature-256. Disabled (401) otherwise.
+ */
+prRouter.post('/v1/pr/webhook', async (req, res) => {
+    if (!process.env.GITHUB_WEBHOOK_SECRET) {
+        return res.status(401).json({
+            status: 'disabled',
+            message: 'Webhook disabled: set GITHUB_WEBHOOK_SECRET to enable signature-verified delivery.',
+        });
+    }
+    if (!verifyWebhookSignature(req)) {
+        return res.status(401).json({ status: 'unauthorized', message: 'Invalid webhook signature' });
+    }
+    const event = req.headers['x-github-event'];
+    const payload = req.body;
+    if (event === 'pull_request' && payload.action === 'opened') {
+        const repo = payload.repository?.full_name;
+        const prNumber = payload.number;
+        // Enforce the same repo allow-list the manual routes use.
+        if (repo && validPrNumber(prNumber) !== null && policy.validateRepo(repo) === null) {
+            // Acknowledge immediately, process async
+            res.status(202).json({ status: 'accepted', message: 'Review will be processed asynchronously' });
+            // TODO: Trigger review pipeline in background
+            // const orchestrator = getServerOrchestrator();
+            // if (orchestrator) { ... }
+            return;
+        }
+    }
+    res.status(200).json({ status: 'ok', message: 'Event received but no action taken' });
+});
+//# sourceMappingURL=pr.js.map

package/dist/routes/pr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pr.js","sourceRoot":"","sources":["../../src/routes/pr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,QAAQ,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC;AAEjC,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC;AAEnC,gEAAgE;AAChE,SAAS,aAAa,CAAC,CAAU;IAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAK,GAAc,GAAG,CAAC,CAAC,CAAC,CAAE,GAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,iBAAiB,EAAE;aACnF,CAAC,CAAC;QACL,CAAC;QAED,2EAA2E;QAC3E,MAAM,WAAW,GAA4B,EAAE,CAAC;QAChD,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3C,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;gBAAE,WAAW,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACxF,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,WAAW,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClF,CAAC;QACD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM;YACpD,CAAC,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE;YACjD,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,MAAM,GAAG,wBAAwB,EAAE,OAAO,IAAI;;iCAEvB,IAAI,eAAe,EAAE,GAAG,cAAc;;;;;;;yFAOkB,CAAC;QAEtF,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAExD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE;gBACN,IAAI;gBACJ,QAAQ,EAAE,EAAE;gBACZ,QAAQ,EAAE,QAAQ,CAAC,OAAO;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACnE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;QACH,CAAC;QACD,oFAAoF;QACpF,MAAM,IAAI,GACR,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAE3E,MAAM,MAAM,GAAG,6BAA6B,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;EAC3F,IAAI,CAAC,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;;;qEAG+B,CAAC;QAElE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAExD,GAAG,CAAC,IAAI,CAAC;YACP,MAAM,EAAE;gBACN,IAAI;gBACJ,MAAM;gBACN,QAAQ,EAAE,QAAQ,CAAC,OAAO;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,QAAQ,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IAChE,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE;aACnE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAc,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,MAAM,GAAG,+BAA+B,IAAI,kCAAkC,IAAI,4BAA4B,CAAC;QACrH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAExD,GAAG,CAAC,IAAI,CAAC;YACP,IAAI,EAAE;gBACJ,IAAI;gBACJ,QAAQ,EAAE,QAAQ,CAAC,OAAO;gBAC1B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE;SACxD,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAS,sBAAsB,CAAC,GAAY;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;IACjD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACrD,MAAM,OAAO,GAAwB,GAAW,CAAC,OAAO,CAAC;IACzD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE5D,MAAM,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxF,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,QAAQ,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;IACpE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,CAAC;QACvC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,oFAAoF;SAC9F,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,2BAA2B,EAAE,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC;IAEzB,IAAI,KAAK,KAAK,cAAc,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;QAEhC,0DAA0D;QAC1D,IAAI,IAAI,IAAI,aAAa,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACnF,yCAAyC;YACzC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;YAEjG,8CAA8C;YAC9C,gDAAgD;YAChD,4BAA4B;YAC5B,OAAO;QACT,CAAC;IACH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC"}

package/dist/routes/sessions.d.ts

@@ -0,0 +1,2 @@
+export declare const sessionsRouter: import("express-serve-static-core").Router;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/routes/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/routes/sessions.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,cAAc,4CAAW,CAAC"}