@nodetool-ai/websocket 0.7.0-rc.23 → 0.8.1

package/dist/trpc/routers/triggers.js

@@ -0,0 +1,117 @@
+import { z } from "zod";
+import { TriggerRegistration, createTimeOrderedUuid } from "@nodetool-ai/models";
+import { ApiErrorCode } from "../../error-codes.js";
+import { router } from "../index.js";
+import { protectedProcedure } from "../middleware.js";
+import { throwApiError } from "../error-formatter.js";
+import { getTriggerWakeupService, dispatchInput } from "../../triggers/dispatcher.js";
+import { nextFireAtIso, scheduleIntervalSeconds } from "../../triggers/schedule-timing.js";
+const fireInput = z.object({
+    registrationId: z.string(),
+    payload: z.unknown().optional(),
+    idempotencyKey: z.string().optional()
+});
+const listByWorkflowInput = z.object({ workflowId: z.string() });
+const editorRegistrationOutput = z.object({
+    id: z.string(),
+    workflow_id: z.string(),
+    node_id: z.string(),
+    kind: z.string(),
+    enabled: z.boolean(),
+    last_fired_at: z.string().nullable(),
+    last_error: z.string().nullable(),
+    disabled_reason: z.string().nullable(),
+    consecutive_failures: z.number(),
+    run_count: z.number(),
+    expires_at: z.string().nullable(),
+    max_runs: z.number().nullable(),
+    next_fire_at: z.string().nullable(),
+    interval_seconds: z.number().nullable(),
+    webhook_token: z.string().nullable(),
+    webhook_secret: z.string().nullable()
+});
+const listByWorkflowOutput = z.object({
+    triggers: z.array(editorRegistrationOutput)
+});
+const fireOutput = z.object({ job_id: z.string() });
+/**
+ * A registration as the editor needs it. Unlike `jobs.triggersRunning`, this
+ * includes disabled rows — a trigger that has never been armed still needs a
+ * discoverable id, or the Activate toggle has nothing to turn on — and the
+ * webhook delivery details, without which a user cannot configure a sender.
+ *
+ * `config_json` is not returned wholesale: only the webhook token and secret
+ * are surfaced, and the stored digest is never sent.
+ *
+ * `next_fire_at` and `interval_seconds` are derived, not stored: both come
+ * from `schedule-timing.ts`, the same helper the scheduler sweep schedules
+ * from. They are non-null only for a `schedule` registration, and
+ * `next_fire_at` additionally only while it is enabled — a disabled schedule
+ * has no next fire.
+ */
+function toEditorRegistration(reg) {
+    const config = reg.config_json ?? {};
+    const isWebhook = reg.kind === "webhook";
+    return {
+        id: reg.id,
+        workflow_id: reg.workflow_id,
+        node_id: reg.node_id,
+        kind: reg.kind,
+        enabled: reg.enabled === 1,
+        last_fired_at: reg.last_fired_at ?? null,
+        last_error: reg.last_error ?? null,
+        disabled_reason: reg.disabled_reason ?? null,
+        consecutive_failures: reg.consecutive_failures,
+        run_count: reg.run_count,
+        expires_at: reg.expires_at ?? null,
+        max_runs: reg.max_runs ?? null,
+        next_fire_at: nextFireAtIso(reg),
+        interval_seconds: scheduleIntervalSeconds(reg),
+        webhook_token: isWebhook
+            ? (config.webhook_token ?? null)
+            : null,
+        webhook_secret: isWebhook
+            ? (config.webhook_secret ?? null)
+            : null
+    };
+}
+export const triggersRouter = router({
+    /** Every registration for one workflow the caller owns, enabled or not. */
+    listByWorkflow: protectedProcedure
+        .input(listByWorkflowInput)
+        .output(listByWorkflowOutput)
+        .query(async ({ ctx, input }) => {
+        const registrations = await TriggerRegistration.findByWorkflow(input.workflowId);
+        return {
+            triggers: registrations
+                .filter((reg) => reg.user_id === ctx.userId)
+                .map((reg) => toEditorRegistration(reg))
+        };
+    }),
+    fire: protectedProcedure
+        .input(fireInput)
+        .output(fireOutput)
+        .mutation(async ({ ctx, input }) => {
+        const reg = await TriggerRegistration.get(input.registrationId);
+        if (!reg || reg.user_id !== ctx.userId) {
+            throwApiError(ApiErrorCode.NOT_FOUND, "Trigger registration not found");
+        }
+        // Refuse before delivering, not after. The dispatcher rejects a disabled
+        // registration too, but by then the input is durably stored — and since
+        // a pass only scans *enabled* registrations, it would sit unprocessed
+        // until someone re-armed the trigger and then fire as a surprise.
+        if (reg.enabled !== 1) {
+            throwApiError(ApiErrorCode.INVALID_INPUT, "Trigger is not active — activate it before firing");
+        }
+        const inputId = input.idempotencyKey ?? createTimeOrderedUuid();
+        await getTriggerWakeupService().deliverTriggerInput({
+            runId: reg.workflow_id,
+            nodeId: reg.node_id,
+            inputId,
+            payload: input.payload ?? {}
+        });
+        const { jobId } = await dispatchInput(inputId);
+        return { job_id: jobId };
+    })
+});
+//# sourceMappingURL=triggers.js.map

package/dist/trpc/routers/triggers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"triggers.js","sourceRoot":"","sources":["../../../src/trpc/routers/triggers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,uBAAuB,EACvB,aAAa,EACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,aAAa,EACb,uBAAuB,EACxB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEjE,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,GAAwB;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;IACrC,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC;IACzC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,CAAC;QAC1B,aAAa,EAAE,GAAG,CAAC,aAAa,IAAI,IAAI;QACxC,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QAClC,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC5C,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;QAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,IAAI;QAClC,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;QAC9B,YAAY,EAAE,aAAa,CAAC,GAAG,CAAC;QAChC,gBAAgB,EAAE,uBAAuB,CAAC,GAAG,CAAC;QAC9C,aAAa,EAAE,SAAS;YACtB,CAAC,CAAC,CAAE,MAAM,CAAC,aAAoC,IAAI,IAAI,CAAC;YACxD,CAAC,CAAC,IAAI;QACR,cAAc,EAAE,SAAS;YACvB,CAAC,CAAC,CAAE,MAAM,CAAC,cAAqC,IAAI,IAAI,CAAC;YACzD,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;IACnC,2EAA2E;IAC3E,cAAc,EAAE,kBAAkB;SAC/B,KAAK,CAAC,mBAAmB,CAAC;SAC1B,MAAM,CAAC,oBAAoB,CAAC;SAC5B,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9B,MAAM,aAAa,GAAG,MAAM,mBAAmB,CAAC,cAAc,CAC5D,KAAK,CAAC,UAAU,CACjB,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,aAAa;iBACpB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,CAAC;iBAC3C,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;SAC3C,CAAC;IACJ,CAAC,CAAC;IAEJ,IAAI,EAAE,kBAAkB;SACrB,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,UAAU,CAAC;SAClB,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,MAAM,GAAG,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAChE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YACvC,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAC1E,CAAC;QACD,yEAAyE;QACzE,wEAAwE;QACxE,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,GAAG,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACtB,aAAa,CACX,YAAY,CAAC,aAAa,EAC1B,mDAAmD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,KAAK,CAAC,cAAc,IAAI,qBAAqB,EAAE,CAAC;QAChE,MAAM,uBAAuB,EAAE,CAAC,mBAAmB,CAAC;YAClD,KAAK,EAAE,GAAG,CAAC,WAAW;YACtB,MAAM,EAAE,GAAG,CAAC,OAAO;YACnB,OAAO;YACP,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3B,CAAC,CAAC;CACL,CAAC,CAAC"}

package/dist/trpc/routers/users.d.ts

@@ -11,7 +11,7 @@ export declare const usersRouter: import("@trpc/server").TRPCBuiltRouter<{
     ctx: import("../context.js").Context;
     meta: object;
     errorShape: import("../error-formatter.js").ApiErrorShape;
-    transformer: true;
+    transformer: false;
 }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
     list: import("@trpc/server").TRPCQueryProcedure<{
         input: void;
@@ -26,19 +26,6 @@ export declare const usersRouter: import("@trpc/server").TRPCBuiltRouter<{
         };
         meta: object;
     }>;
-    get: import("@trpc/server").TRPCQueryProcedure<{
-        input: {
-            username: string;
-        };
-        output: {
-            username: string;
-            user_id: string;
-            role: string;
-            token_hash: string;
-            created_at: string;
-        };
-        meta: object;
-    }>;
     create: import("@trpc/server").TRPCMutationProcedure<{
         input: {
             username: string;

package/dist/trpc/routers/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/trpc/routers/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4DH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+EtB,CAAC"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/trpc/routers/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0DH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEtB,CAAC"}

package/dist/trpc/routers/users.js

@@ -12,7 +12,7 @@ import { ApiErrorCode } from "../../error-codes.js";
 import { router } from "../index.js";
 import { protectedProcedure } from "../middleware.js";
 import { throwApiError } from "../error-formatter.js";
-import { listOutput, getInput, userListItem, createInput, userCreateResponse, removeInput, removeOutput, resetTokenInput } from "@nodetool-ai/protocol/api-schemas/users.js";
+import { listOutput, createInput, userCreateResponse, removeInput, removeOutput, resetTokenInput } from "@nodetool-ai/protocol/api-schemas/users.js";
 /**
  * Check if a user ID has admin privileges. Mirrors `isAdmin` from the
  * legacy users-api.ts: user "1" is always admin in dev, and
@@ -56,17 +56,6 @@ export const usersRouter = router({
             users: Object.entries(users).map(([username, rec]) => toUserListItem(username, rec))
         };
     }),
-    get: protectedProcedure
-        .input(getInput)
-        .output(userListItem)
-        .query(async ({ ctx, input }) => {
-        requireAdmin(ctx.userId);
-        const user = await manager.getUser(input.username);
-        if (!user) {
-            throwApiError(ApiErrorCode.NOT_FOUND, `User '${input.username}' not found`);
-        }
-        return toUserListItem(input.username, user);
-    }),
     create: protectedProcedure
         .input(createInput)
         .output(userCreateResponse)

package/dist/trpc/routers/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/trpc/routers/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,eAAe,EAEhB,MAAM,4CAA4C,CAAC;AAEpD;;;;GAIG;AACH,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;AAEtC,oEAAoE;AACpE,SAAS,cAAc,CACrB,QAAgB,EAChB,MAA0E;IAE1E,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;QACjD,UAAU,EAAE,MAAM,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAClE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CACnD,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAC9B;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,GAAG,EAAE,kBAAkB;SACpB,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,YAAY,CAAC;SACpB,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QAC9B,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,aAAa,CACX,YAAY,CAAC,SAAS,EACtB,SAAS,KAAK,CAAC,QAAQ,aAAa,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,cAAc,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC9C,CAAC,CAAC;IAEJ,MAAM,EAAE,kBAAkB;SACvB,KAAK,CAAC,WAAW,CAAC;SAClB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjE,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;YAC/D,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;IAEJ,MAAM,EAAE,kBAAkB;SACvB,KAAK,CAAC,WAAW,CAAC;SAClB,MAAM,CAAC,YAAY,CAAC;SACpB,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,wBAAwB,EAAE,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAC7D,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IAEJ,UAAU,EAAE,kBAAkB;SAC3B,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAC7D,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;CACL,CAAC,CAAC"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/trpc/routers/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EACL,UAAU,EACV,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,YAAY,EACZ,eAAe,EAEhB,MAAM,4CAA4C,CAAC;AAEpD;;;;GAIG;AACH,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC5C,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ;aACZ,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yDAAyD;AACzD,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACrB,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;AAEtC,oEAAoE;AACpE,SAAS,cAAc,CACrB,QAAgB,EAChB,MAA0E;IAE1E,OAAO;QACL,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,EAAE;QAClB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK;QACjD,UAAU,EAAE,MAAM,CAAC,SAAS;KAC7B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC;IAChC,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE;QAClE,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;QACxC,OAAO;YACL,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,CACnD,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,CAC9B;SACF,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,EAAE,kBAAkB;SACvB,KAAK,CAAC,WAAW,CAAC;SAClB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACjE,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;YAC/D,aAAa,CAAC,YAAY,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC;IAEJ,MAAM,EAAE,kBAAkB;SACvB,KAAK,CAAC,WAAW,CAAC;SAClB,MAAM,CAAC,YAAY,CAAC;SACpB,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACzC,OAAO,EAAE,OAAO,EAAE,SAAS,KAAK,CAAC,QAAQ,wBAAwB,EAAE,CAAC;QACtE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAC7D,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;IAEJ,UAAU,EAAE,kBAAkB;SAC3B,KAAK,CAAC,eAAe,CAAC;SACtB,MAAM,CAAC,kBAAkB,CAAC;SAC1B,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE;QACjC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,OAAO;gBACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,SAAS;aAC7B,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;YAC7D,aAAa,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC;CACL,CAAC,CAAC"}

package/dist/trpc/routers/worker.d.ts

@@ -0,0 +1,242 @@
+/**
+ * Worker router — the tRPC surface over `WorkerManager` (`@nodetool-ai/compute`).
+ *
+ * Exposes the profiles→instances worker-provisioning model to the UI and any
+ * tRPC caller:
+ *   - `worker.profiles.list|create|delete` — declarative presets.
+ *   - `worker.instances.list` — the live instance registry.
+ *   - `worker.provision|stop|stopAll|reconcile` — instance lifecycle.
+ *   - `worker.attach|detach` — adopt/release the active worker, re-pointing the
+ *     live Python bridge at the worker's `{wsUrl, token}` (attach) or back at
+ *     the env/stdio default (detach).
+ *
+ * The manager and the bridge re-point function are injected through the tRPC
+ * context so the server bootstrap owns the single `WorkerManager` instance and
+ * the live bridge handle; this router stays free of any runtime dependency.
+ */
+export declare const workerRouter: import("@trpc/server").TRPCBuiltRouter<{
+    ctx: import("../context.js").Context;
+    meta: object;
+    errorShape: import("../error-formatter.js").ApiErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    profiles: import("@trpc/server").TRPCBuiltRouter<{
+        ctx: import("../context.js").Context;
+        meta: object;
+        errorShape: import("../error-formatter.js").ApiErrorShape;
+        transformer: false;
+    }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+        list: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                id: string;
+                name: string;
+                target: "runpod" | "vast";
+                image: string;
+                spec: Record<string, unknown>;
+                token_policy: "fixed" | "generate";
+                idle_timeout_minutes: number | null;
+                max_lifetime_minutes: number | null;
+                created_at: string;
+                updated_at: string;
+            }[];
+            meta: object;
+        }>;
+        create: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                name: string;
+                target: "runpod" | "vast";
+                image: string;
+                spec?: Record<string, unknown> | undefined;
+                token_policy: "fixed" | "generate";
+                idle_timeout_minutes?: number | null | undefined;
+                max_lifetime_minutes?: number | null | undefined;
+            };
+            output: {
+                id: string;
+                name: string;
+                target: "runpod" | "vast";
+                image: string;
+                spec: Record<string, unknown>;
+                token_policy: "fixed" | "generate";
+                idle_timeout_minutes: number | null;
+                max_lifetime_minutes: number | null;
+                created_at: string;
+                updated_at: string;
+            };
+            meta: object;
+        }>;
+        delete: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                name: string;
+            };
+            output: {
+                ok: true;
+            };
+            meta: object;
+        }>;
+    }>>;
+    instances: import("@trpc/server").TRPCBuiltRouter<{
+        ctx: import("../context.js").Context;
+        meta: object;
+        errorShape: import("../error-formatter.js").ApiErrorShape;
+        transformer: false;
+    }, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+        list: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                id: string;
+                profile_name: string;
+                target: "runpod" | "vast";
+                provider_ref: string;
+                ws_url: string;
+                token: string | null;
+                status: "attached" | "error" | "provisioning" | "running" | "stopped" | "stopping" | "terminated";
+                attached_to: string | null;
+                created_at: string;
+                last_activity_at: string;
+                estimated_cost_usd: number | null;
+            }[];
+            meta: object;
+        }>;
+    }>>;
+    apiKeyStatus: import("@trpc/server").TRPCQueryProcedure<{
+        input: void;
+        output: {
+            runpod: boolean;
+            vast: boolean;
+        };
+        meta: object;
+    }>;
+    provision: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            profileName: string;
+        };
+        output: {
+            id: string;
+            profile_name: string;
+            target: "runpod" | "vast";
+            provider_ref: string;
+            ws_url: string;
+            token: string | null;
+            status: "attached" | "error" | "provisioning" | "running" | "stopped" | "stopping" | "terminated";
+            attached_to: string | null;
+            created_at: string;
+            last_activity_at: string;
+            estimated_cost_usd: number | null;
+        };
+        meta: object;
+    }>;
+    stop: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            id: string;
+        };
+        output: {
+            id: string;
+            profile_name: string;
+            target: "runpod" | "vast";
+            provider_ref: string;
+            ws_url: string;
+            token: string | null;
+            status: "attached" | "error" | "provisioning" | "running" | "stopped" | "stopping" | "terminated";
+            attached_to: string | null;
+            created_at: string;
+            last_activity_at: string;
+            estimated_cost_usd: number | null;
+        };
+        meta: object;
+    }>;
+    resume: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            id: string;
+        };
+        output: {
+            id: string;
+            profile_name: string;
+            target: "runpod" | "vast";
+            provider_ref: string;
+            ws_url: string;
+            token: string | null;
+            status: "attached" | "error" | "provisioning" | "running" | "stopped" | "stopping" | "terminated";
+            attached_to: string | null;
+            created_at: string;
+            last_activity_at: string;
+            estimated_cost_usd: number | null;
+        };
+        meta: object;
+    }>;
+    terminate: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            id: string;
+        };
+        output: {
+            id: string;
+            profile_name: string;
+            target: "runpod" | "vast";
+            provider_ref: string;
+            ws_url: string;
+            token: string | null;
+            status: "attached" | "error" | "provisioning" | "running" | "stopped" | "stopping" | "terminated";
+            attached_to: string | null;
+            created_at: string;
+            last_activity_at: string;
+            estimated_cost_usd: number | null;
+        };
+        meta: object;
+    }>;
+    stopAll: import("@trpc/server").TRPCMutationProcedure<{
+        input: void;
+        output: {
+            ok: true;
+        };
+        meta: object;
+    }>;
+    reconcile: import("@trpc/server").TRPCMutationProcedure<{
+        input: void;
+        output: {
+            orphans: {
+                target: "runpod" | "vast";
+                providerRef: string;
+                status: "attached" | "error" | "provisioning" | "running" | "stopped" | "stopping" | "terminated";
+            }[];
+            liveCount: number;
+            estimatedCostUsd: number;
+        };
+        meta: object;
+    }>;
+    /**
+     * Health-probe a worker that is `running` but not yet attached: open a
+     * transient bridge to its `{wsUrl, token}` (the same handshake attach uses)
+     * and report whether it answered. Lets the panel show true readiness
+     * ("Booting…" → "Ready") before the user attaches.
+     */
+    health: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            id: string;
+        };
+        output: {
+            healthy: boolean;
+            protocolVersion?: number | undefined;
+            error?: string | undefined;
+        };
+        meta: object;
+    }>;
+    attach: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            id: string;
+        };
+        output: {
+            wsUrl: string;
+            token: string | null;
+        };
+        meta: object;
+    }>;
+    detach: import("@trpc/server").TRPCMutationProcedure<{
+        input: void;
+        output: {
+            ok: true;
+        };
+        meta: object;
+    }>;
+}>>;
+//# sourceMappingURL=worker.d.ts.map

package/dist/trpc/routers/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../../src/trpc/routers/worker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA8JH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAmDvB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCH,CAAC"}

package/dist/trpc/routers/worker.js

@@ -0,0 +1,220 @@
+/**
+ * Worker router — the tRPC surface over `WorkerManager` (`@nodetool-ai/compute`).
+ *
+ * Exposes the profiles→instances worker-provisioning model to the UI and any
+ * tRPC caller:
+ *   - `worker.profiles.list|create|delete` — declarative presets.
+ *   - `worker.instances.list` — the live instance registry.
+ *   - `worker.provision|stop|stopAll|reconcile` — instance lifecycle.
+ *   - `worker.attach|detach` — adopt/release the active worker, re-pointing the
+ *     live Python bridge at the worker's `{wsUrl, token}` (attach) or back at
+ *     the env/stdio default (detach).
+ *
+ * The manager and the bridge re-point function are injected through the tRPC
+ * context so the server bootstrap owns the single `WorkerManager` instance and
+ * the live bridge handle; this router stays free of any runtime dependency.
+ */
+import { z } from "zod";
+import { TRPCError } from "@trpc/server";
+import { router } from "../index.js";
+import { protectedProcedure } from "../middleware.js";
+const targetSchema = z.enum(["runpod", "vast"]);
+const profileCreateInput = z.object({
+    name: z.string().min(1),
+    target: targetSchema,
+    image: z.string().min(1),
+    spec: z.record(z.string(), z.unknown()).optional(),
+    token_policy: z.enum(["generate", "fixed"]),
+    idle_timeout_minutes: z.number().int().positive().nullable().optional(),
+    max_lifetime_minutes: z.number().int().positive().nullable().optional()
+});
+const idInput = z.object({ id: z.string().min(1) });
+const profileNameInput = z.object({ name: z.string().min(1) });
+const provisionInput = z.object({ profileName: z.string().min(1) });
+const workerStatusSchema = z.enum([
+    "provisioning",
+    "running",
+    "attached",
+    "stopping",
+    "stopped",
+    "terminated",
+    "error"
+]);
+const workerProfileOutput = z.object({
+    id: z.string(),
+    name: z.string(),
+    target: targetSchema,
+    image: z.string(),
+    spec: z.record(z.string(), z.unknown()),
+    token_policy: z.enum(["generate", "fixed"]),
+    idle_timeout_minutes: z.number().nullable(),
+    max_lifetime_minutes: z.number().nullable(),
+    created_at: z.string(),
+    updated_at: z.string()
+});
+const workerInstanceOutput = z.object({
+    id: z.string(),
+    profile_name: z.string(),
+    target: targetSchema,
+    provider_ref: z.string(),
+    ws_url: z.string(),
+    token: z.string().nullable(),
+    status: workerStatusSchema,
+    attached_to: z.string().nullable(),
+    created_at: z.string(),
+    last_activity_at: z.string(),
+    estimated_cost_usd: z.number().nullable()
+});
+const okOutput = z.object({ ok: z.literal(true) });
+const apiKeyStatusOutput = z.object({
+    runpod: z.boolean(),
+    vast: z.boolean()
+});
+const connectionOutput = z.object({
+    wsUrl: z.string(),
+    token: z.string().nullable()
+});
+const reconcileOutput = z.object({
+    orphans: z.array(z.object({
+        target: targetSchema,
+        providerRef: z.string(),
+        status: workerStatusSchema
+    })),
+    liveCount: z.number(),
+    estimatedCostUsd: z.number()
+});
+const healthOutput = z.object({
+    healthy: z.boolean(),
+    protocolVersion: z.number().optional(),
+    error: z.string().optional()
+});
+/** Pull the wired `WorkerManager` from context or fail loudly. */
+function requireManager(manager) {
+    if (!manager) {
+        throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: "Worker manager is not configured on this server"
+        });
+    }
+    return manager;
+}
+/** Pull the wired bridge re-point function from context or fail loudly. */
+function requireRepoint(repoint) {
+    if (!repoint) {
+        throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: "Python bridge re-point is not configured on this server"
+        });
+    }
+    return repoint;
+}
+/** Pull the wired worker health-probe function from context or fail loudly. */
+function requireProbe(probe) {
+    if (!probe) {
+        throw new TRPCError({
+            code: "INTERNAL_SERVER_ERROR",
+            message: "Worker health probe is not configured on this server"
+        });
+    }
+    return probe;
+}
+const profilesRouter = router({
+    list: protectedProcedure
+        .output(z.array(workerProfileOutput))
+        .query(({ ctx }) => requireManager(ctx.workerManager).listProfiles()),
+    create: protectedProcedure
+        .input(profileCreateInput)
+        .output(workerProfileOutput)
+        .mutation(({ ctx, input }) => requireManager(ctx.workerManager).createProfile({
+        name: input.name,
+        target: input.target,
+        image: input.image,
+        spec: input.spec,
+        token_policy: input.token_policy,
+        idle_timeout_minutes: input.idle_timeout_minutes ?? undefined,
+        max_lifetime_minutes: input.max_lifetime_minutes ?? undefined
+    })),
+    delete: protectedProcedure
+        .input(profileNameInput)
+        .output(okOutput)
+        .mutation(async ({ ctx, input }) => {
+        await requireManager(ctx.workerManager).deleteProfile(input.name);
+        return { ok: true };
+    })
+});
+const instancesRouter = router({
+    list: protectedProcedure
+        .output(z.array(workerInstanceOutput))
+        .query(({ ctx }) => requireManager(ctx.workerManager).list())
+});
+export const workerRouter = router({
+    profiles: profilesRouter,
+    instances: instancesRouter,
+    // Whether each provider's API key is available (secret store OR env) — the
+    // same resolution provisioning uses, so the UI doesn't false-warn on an
+    // env-provided key.
+    apiKeyStatus: protectedProcedure
+        .output(apiKeyStatusOutput)
+        .query(({ ctx }) => requireManager(ctx.workerManager).apiKeyStatus()),
+    provision: protectedProcedure
+        .input(provisionInput)
+        .output(workerInstanceOutput)
+        .mutation(({ ctx, input }) => requireManager(ctx.workerManager).provision(input.profileName)),
+    stop: protectedProcedure
+        .input(idInput)
+        .output(workerInstanceOutput)
+        .mutation(({ ctx, input }) => requireManager(ctx.workerManager).stop(input.id)),
+    // Resume a paused worker (re-allocates the GPU, keeps the volume). May fail
+    // if the provider cannot re-allocate a GPU.
+    resume: protectedProcedure
+        .input(idInput)
+        .output(workerInstanceOutput)
+        .mutation(({ ctx, input }) => requireManager(ctx.workerManager).resume(input.id)),
+    // Destroy a worker and its volume — the real teardown that stops all billing.
+    terminate: protectedProcedure
+        .input(idInput)
+        .output(workerInstanceOutput)
+        .mutation(({ ctx, input }) => requireManager(ctx.workerManager).terminate(input.id)),
+    stopAll: protectedProcedure.output(okOutput).mutation(async ({ ctx }) => {
+        await requireManager(ctx.workerManager).stopAll();
+        return { ok: true };
+    }),
+    reconcile: protectedProcedure
+        .output(reconcileOutput)
+        .mutation(({ ctx }) => requireManager(ctx.workerManager).reconcile()),
+    /**
+     * Health-probe a worker that is `running` but not yet attached: open a
+     * transient bridge to its `{wsUrl, token}` (the same handshake attach uses)
+     * and report whether it answered. Lets the panel show true readiness
+     * ("Booting…" → "Ready") before the user attaches.
+     */
+    health: protectedProcedure
+        .input(idInput)
+        .output(healthOutput)
+        .query(async ({ ctx, input }) => {
+        const connection = await requireManager(ctx.workerManager).connectionInfo(input.id);
+        return requireProbe(ctx.probeWorkerHealth)(connection);
+    }),
+    attach: protectedProcedure
+        .input(idInput)
+        .output(connectionOutput)
+        .mutation(async ({ ctx, input }) => {
+        const connection = await requireManager(ctx.workerManager).attach(input.id);
+        try {
+            // Connect the bridge to the worker. If it can't be reached, roll the
+            // attach back so the manager doesn't report a worker we can't talk to.
+            await requireRepoint(ctx.repointPythonBridge)(connection);
+        }
+        catch (err) {
+            await requireManager(ctx.workerManager).detach();
+            throw err;
+        }
+        return connection;
+    }),
+    detach: protectedProcedure.output(okOutput).mutation(async ({ ctx }) => {
+        await requireManager(ctx.workerManager).detach();
+        await requireRepoint(ctx.repointPythonBridge)(null);
+        return { ok: true };
+    })
+});
+//# sourceMappingURL=worker.js.map