@north-light/cli 0.3.561 → 0.3.563

package/dist/daemon/api/operations.js

@@ -1 +1 @@
-var a=Object.defineProperty;var r=(e,s)=>a(e,"name",{value:s,configurable:!0});const n=[{name:"health",method:"GET",path:"/v1/health",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"ready",method:"GET",path:"/v1/ready",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"chat-inventory.get.1",method:"GET",path:"/v1/nodes/:id/chat-inventory",classes:["person","broker","cron"],resource:"node-read"},{name:"model-config.put.2",method:"PUT",path:"/v1/model-config",classes:["person","broker"],resource:"none"},{name:"files.get.3",method:"GET",path:"/v1/files/peek",classes:["person","broker"],resource:"none"},{name:"files.post.4",method:"POST",path:"/v1/files/write",classes:["person","broker"],resource:"none"},{name:"files.get.5",method:"GET",path:"/v1/files/list",classes:["person","broker"],resource:"none"},{name:"reviews.post.6",method:"POST",path:"/v1/human/reviews",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"reviews.get.7",method:"GET",path:"/v1/human/reviews",classes:["person","broker"],resource:"human"},{name:"reviews.get.8",method:"GET",path:"/v1/human/reviews/:review_id",classes:["person","broker"],resource:"human"},{name:"reviews.post.9",method:"POST",path:"/v1/human/reviews/:review_id/submit",classes:["person","broker"],resource:"human"},{name:"reviews.post.10",method:"POST",path:"/v1/human/reviews/:review_id/cancel",classes:["person","broker"],resource:"human"},{name:"reviews.get.11",method:"GET",path:"/v1/human/reviews/:review_id/document",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.12",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.13",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"node.log.append",method:"POST",path:"/v1/nodes/:id/records/log",classes:["person","broker"],resource:"node-own"},{name:"node.telemetry.put",method:"PUT",path:"/v1/nodes/:id/records/telemetry",classes:["person","broker"],resource:"node-own"},{name:"node.recap.put",method:"PUT",path:"/v1/nodes/:id/records/recap",classes:["person","broker"],resource:"node-own"},{name:"node.inbox.read",method:"GET",path:"/v1/nodes/:id/records/inbox",classes:["person","broker"],resource:"node-own"},{name:"node.passive.read",method:"GET",path:"/v1/nodes/:id/records/passive",classes:["person","broker"],resource:"node-own"},{name:"node.pushed-final",method:"POST",path:"/v1/nodes/:id/records/pushed-final",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.14",method:"POST",path:"/v1/nodes/:id/broker/session-bound",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.15",method:"POST",path:"/v1/nodes/:id/broker/settle",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.16",method:"POST",path:"/v1/nodes/:id/broker/park-complete",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.17",method:"POST",path:"/v1/nodes/:id/broker/park-activity",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.18",method:"POST",path:"/v1/nodes/:id/broker/telemetry",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.19",method:"POST",path:"/v1/nodes/:id/broker/model",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.get.20",method:"GET",path:"/v1/nodes/:id/broker/extension-state",classes:["person","broker"],resource:"node-own"},{name:"broker.signals",method:"GET",path:"/v1/nodes/:id/broker/signals",classes:["broker"],resource:"node-own",stream:!0},{name:"broker-ops.post.21",method:"POST",path:"/v1/nodes/:id/broker/generated-name",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.22",method:"POST",path:"/v1/nodes/:id/broker/persona-ack",classes:["person","broker"],resource:"node-own"},{name:"objects.read",method:"GET",path:"/v1/objects/:ref",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.list",method:"GET",path:"/v1/objects",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.search",method:"POST",path:"/v1/objects/search",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.watch",method:"POST",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.unwatch",method:"DELETE",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.shares",method:"GET",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.share",method:"POST",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.unshare",method:"DELETE",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"custom-objects.register",method:"POST",path:"/v1/custom-objects",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.publish",method:"POST",path:"/v1/custom-objects/:ref/events",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.unregister",method:"DELETE",path:"/v1/custom-objects/:ref",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.receive",method:"GET",path:"/v1/custom-objects/:ref/deliveries",classes:["anonymous","person","app","broker","cron"],resource:"objects",stream:!0,stage:"objects"},{name:"custom-objects.ack",method:"POST",path:"/v1/custom-objects/:ref/deliveries/ack",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.edges",method:"GET",path:"/v1/objects/:ref/edges",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.write",method:"POST",path:"/v1/docs",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.edit",method:"PATCH",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.move",method:"POST",path:"/v1/docs/:ref/move",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.delete",method:"DELETE",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.history",method:"GET",path:"/v1/docs/:ref/history",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"schemas.register",method:"POST",path:"/v1/schemas",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.write",method:"POST",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.replace",method:"PUT",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.list",method:"GET",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"check",method:"POST",path:"/v1/check",classes:["app"],resource:"objects",stage:"objects"},{name:"docs.lint",method:"POST",path:"/v1/docs/lint",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"plugins.app-token",method:"GET",path:"/v1/plugins/:name/app-token",classes:["person","broker"],resource:"none"},{name:"plugins.call-headers",method:"POST",path:"/v1/plugins/:name/call-headers",classes:["person","broker"],resource:"none"},{name:"documents.browser-access",method:"GET",path:"/v1/documents/browser-access",classes:["person"],resource:"none"},{name:"documents.reconcile-packages",method:"POST",path:"/v1/documents/reconcile-packages",classes:["person","broker"],resource:"none"},{name:"nodes.delivery",method:"POST",path:"/v1/nodes/:id/delivery",classes:["person","broker"],resource:"node-own"},{name:"delivery.dry-run",method:"POST",path:"/v1/delivery/dry-run",classes:["person","broker"],resource:"none"},{name:"bash-jobs.background",method:"POST",path:"/v1/nodes/:id/jobs/:jobId/background",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"health.get.33",method:"GET",path:"/healthz",classes:["anonymous"],resource:"none"},{name:"health.get.34",method:"GET",path:"/v1/status",classes:["person","broker"],resource:"none"},{name:"daemon.due",method:"GET",path:"/v1/due",classes:["person","broker"],resource:"none"},{name:"bash-jobs.start",method:"POST",path:"/v1/nodes/:id/jobs/start",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"hooks.plan",method:"GET",path:"/v1/nodes/:id/hooks/plan",classes:["broker"],resource:"node-own"},{name:"hooks.exec",method:"POST",path:"/v1/nodes/:id/hooks/exec",classes:["broker"],resource:"node-own"},{name:"hooks.exec.person",method:"POST",path:"/v1/hooks/exec",classes:["person","broker"],resource:"none"},{name:"bash-jobs.get.35",method:"GET",path:"/v1/nodes/:id/jobs",classes:["person","broker","cron"],resource:"node-read"},{name:"bash-jobs.delete.36",method:"DELETE",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"prospective-chat-inventory.get.37",method:"GET",path:"/v1/prospective-chat-inventory",classes:["person","broker"],resource:"none"},{name:"node-events.get.38",method:"GET",path:"/v1/nodes/:id/events",classes:["person","broker","cron"],resource:"node-read"},{name:"bash.post.39",method:"POST",path:"/v1/bash",classes:["person","broker"],resource:"daemon-bash",scope:"crtr:act"},{name:"subscriptions.post.40",method:"POST",path:"/v1/nodes/:id/subscriptions",classes:["person","broker"],resource:"node-write"},{name:"subscriptions.delete.41",method:"DELETE",path:"/v1/nodes/:id/subscriptions/:target",classes:["person","broker"],resource:"node-write"},{name:"attach.post.42",method:"POST",path:"/v1/nodes/:id/attach",classes:["person","broker"],resource:"node-write"},{name:"review-comments.post.44",method:"POST",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.45",method:"GET",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.post.46",method:"POST",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.47",method:"GET",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.48",method:"GET",path:"/v1/human/reviews/:review_id/comment-events",classes:["person","broker"],resource:"human"},{name:"review-comments.post.49",method:"POST",path:"/v1/human/reviews/:review_id/comment-ranges",classes:["person","broker"],resource:"human"},{name:"review-comments.get.50",method:"GET",path:"/v1/human/comments/:comment_id",classes:["person","broker"],resource:"human"},{name:"review-comments.post.51",method:"POST",path:"/v1/human/comments/:comment_id/edit",classes:["person","broker"],resource:"human"},{name:"review-comments.post.52",method:"POST",path:"/v1/human/comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"review-comments.post.53",method:"POST",path:"/v1/human/comments/:comment_id/reopen",classes:["person","broker"],resource:"human"},{name:"review-comments.post.54",method:"POST",path:"/v1/human/comments/:comment_id/delete",classes:["person","broker"],resource:"human"},{name:"review-comments.post.55",method:"POST",path:"/v1/human/comments/:comment_id/fork",classes:["person","broker"],resource:"human"},{name:"messages.post.56",method:"POST",path:"/v1/nodes/:id/mail/claim",classes:["person","broker"],resource:"node-own"},{name:"messages.post.57",method:"POST",path:"/v1/nodes/:id/mail/acknowledge",classes:["person","broker"],resource:"node-own"},{name:"messages.post.58",method:"POST",path:"/v1/nodes/:id/messages",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"messages.post.59",method:"POST",path:"/v1/nodes/:id/interrupt",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"reports.post.60",method:"POST",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-own"},{name:"reports.get.61",method:"GET",path:"/v1/nodes/:id/reports",classes:["person","broker","cron"],resource:"node-read"},{name:"reports.post.62",method:"POST",path:"/v1/nodes/:id/result",classes:["person","broker"],resource:"node-own"},{name:"inbox.get.63",method:"GET",path:"/v1/human/inbox",classes:["person","broker"],resource:"human"},{name:"inbox.get.64",method:"GET",path:"/v1/human/inbox/history",classes:["person","broker"],resource:"human"},{name:"inbox.get.65",method:"GET",path:"/v1/human/inbox/:ticket_id",classes:["person","broker"],resource:"human"},{name:"inbox.get.66",method:"GET",path:"/v1/human/inbox/:ticket_id/response",classes:["person","broker"],resource:"human"},{name:"inbox.post.67",method:"POST",path:"/v1/human/inbox/:ticket_id/respond",classes:["person","broker"],resource:"human"},{name:"inbox.post.68",method:"POST",path:"/v1/human/inbox/:ticket_id/progress",classes:["person","broker"],resource:"human"},{name:"inbox.post.69",method:"POST",path:"/v1/human/inbox/:ticket_id/cancel",classes:["person","broker"],resource:"human"},{name:"worktree.post.70",method:"POST",path:"/v1/nodes/:id/worktree/close",classes:["person","broker"],resource:"node-write"},{name:"worktree.post.71",method:"POST",path:"/v1/nodes/:id/worktree/abandon",classes:["person","broker"],resource:"node-write"},{name:"worktree.get.72",method:"GET",path:"/v1/worktrees/quarantined",classes:["person","broker"],resource:"none"},{name:"crons.post.73",method:"POST",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.get.74",method:"GET",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.get.75",method:"GET",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.post.76",method:"POST",path:"/v1/crons/:cronId/pause",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.77",method:"POST",path:"/v1/crons/:cronId/resume",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.78",method:"POST",path:"/v1/crons/poke",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.79",method:"POST",path:"/v1/crons/:cronId/run",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.delete.80",method:"DELETE",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"modelauth.get.81",method:"GET",path:"/v1/model-auth",classes:["person","broker"],resource:"none"},{name:"modelauth.get.82",method:"GET",path:"/v1/model-auth/readiness",classes:["person","broker"],resource:"none"},{name:"modelauth.put.83",method:"PUT",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"modelauth.delete.84",method:"DELETE",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"model_auth.start",method:"POST",path:"/v1/model-auth/flows",classes:["person","broker"],resource:"none"},{name:"model_auth.complete",method:"POST",path:"/v1/model-auth/flows/:flow_id/complete",classes:["person","broker"],resource:"none"},{name:"model_auth.cancel",method:"POST",path:"/v1/model-auth/flows/:flow_id/cancel",classes:["person","broker"],resource:"none"},{name:"model_auth.get",method:"GET",path:"/v1/model-auth/flows/:flow_id",classes:["person","broker"],resource:"none"},{name:"nodes.post.85",method:"POST",path:"/v1/nodes",classes:["person","broker","cron"],resource:"node-own",scope:"crtr:act"},{name:"nodes.get.86",method:"GET",path:"/v1/nodes",classes:["person","broker"],resource:"nodes-list"},{name:"nodes.post.87",method:"POST",path:"/v1/nodes/revive-all",classes:["person","broker"],resource:"none"},{name:"nodes.get.88",method:"GET",path:"/v1/nodes/:id",classes:["person","broker","cron","forwarded"],resource:"node-read"},{name:"nodes.get.89",method:"GET",path:"/v1/nodes/:id/snapshot",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.90",method:"GET",path:"/v1/nodes/:id/subject",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.91",method:"GET",path:"/v1/nodes/:id/messages",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.92",method:"GET",path:"/v1/nodes/:id/session",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.93",method:"GET",path:"/v1/nodes/:id/transcript",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.94",method:"GET",path:"/v1/nodes/:id/context",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.post.96",method:"POST",path:"/v1/nodes/:id/fork",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.97",method:"POST",path:"/v1/nodes/:id/revive",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.98",method:"POST",path:"/v1/nodes/:id/relaunch-root",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.99",method:"POST",path:"/v1/nodes/:id/close",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.read",method:"POST",path:"/v1/nodes/:id/read",classes:["person"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.100",method:"POST",path:"/v1/nodes/:id/recycle",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.101",method:"POST",path:"/v1/nodes/:id/demote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.102",method:"POST",path:"/v1/nodes/:id/promote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.103",method:"POST",path:"/v1/nodes/:id/yield",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.104",method:"POST",path:"/v1/nodes/:id/wait",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.patch.105",method:"PATCH",path:"/v1/nodes/:id/config",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"broker-recovery.post.106",method:"POST",path:"/v1/broker/:id/turn",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.107",method:"POST",path:"/v1/broker/:id/provider-retry",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.108",method:"POST",path:"/v1/broker/:id/fault",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.get.109",method:"GET",path:"/v1/broker/:id/recovery",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.110",method:"POST",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"broker-recovery.delete.111",method:"DELETE",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"profiles.put.112",method:"PUT",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profiles.post.113",method:"POST",path:"/v1/profiles/:name/pause",classes:["person","broker"],resource:"profile"},{name:"profiles.post.114",method:"POST",path:"/v1/profiles/:name/resume",classes:["person","broker"],resource:"profile"},{name:"profiles.patch.115",method:"PATCH",path:"/v1/profiles/:name/metadata",classes:["person","app","broker"],resource:"profile"},{name:"profile.create",method:"POST",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile"},{name:"profile.update",method:"PATCH",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"app.env.list",method:"GET",path:"/v1/apps/self/env",classes:["person","app","broker"],resource:"profile"},{name:"app.env.set",method:"PUT",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"app.env.remove",method:"DELETE",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.list",method:"GET",path:"/v1/profiles/:name/env",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.set",method:"PUT",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.remove",method:"DELETE",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profiles.delete.116",method:"DELETE",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.list",method:"GET",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile",stage:"chat"},{name:"profiles.get.118",method:"GET",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"node-outcomes.get.119",method:"GET",path:"/v1/nodes/:id/outcome",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.put.120",method:"PUT",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"node-outcomes.get.121",method:"GET",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.delete.122",method:"DELETE",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"canvas.get.123",method:"GET",path:"/v1/canvas/attention",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.124",method:"POST",path:"/v1/canvas/attention/counts",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.125",method:"POST",path:"/v1/canvas/history/search",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.126",method:"POST",path:"/v1/canvas/history/grep",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.127",method:"GET",path:"/v1/canvas/history/read",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.128",method:"POST",path:"/v1/canvas/history/stats",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.129",method:"GET",path:"/v1/canvas/snapshot",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.130",method:"GET",path:"/v1/canvas/roster",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.live-roots",method:"GET",path:"/v1/canvas/live-roots",classes:["person"],resource:"canvas-read"},{name:"canvas.get.browse",method:"GET",path:"/v1/canvas/browse",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.analytics",method:"GET",path:"/v1/canvas/analytics",classes:["person","broker"],resource:"canvas-read"},{name:"memory-reads.post",method:"POST",path:"/v1/nodes/:id/memory-reads",classes:["person","broker"],resource:"node-own"},{name:"canvas.get.131",method:"GET",path:"/v1/canvas/graph",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.132",method:"POST",path:"/v1/canvas/prune",classes:["person","broker"],resource:"none"},{name:"daemon.post.133",method:"POST",path:"/v1/daemon/restart",classes:["person","broker"],resource:"none"},{name:"daemon.post.134",method:"POST",path:"/v1/daemon/migrate",classes:["person","broker"],resource:"none"},{name:"daemon.post.135",method:"POST",path:"/v1/daemon/admit",classes:["person","broker"],resource:"none"},{name:"human.components.list",method:"GET",path:"/v1/human/components",classes:["person","broker"],resource:"none"},{name:"human-requests.post.136",method:"POST",path:"/v1/human/requests",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"human-requests.get.137",method:"GET",path:"/v1/human/requests/:request_id",classes:["person","broker"],resource:"human"},{name:"human-requests.post.138",method:"POST",path:"/v1/human/requests/:request_id/replace",classes:["person","broker"],resource:"human"},{name:"human-requests.post.139",method:"POST",path:"/v1/human/requests/:request_id/respond",classes:["person","broker"],resource:"human"},{name:"human-requests.post.140",method:"POST",path:"/v1/human/requests/:request_id/dismiss",classes:["person","broker"],resource:"human"},{name:"human-requests.post.141",method:"POST",path:"/v1/human/requests/:request_id/cancel",classes:["person","broker"],resource:"human"},{name:"focus.get.142",method:"GET",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.post.143",method:"POST",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.get.144",method:"GET",path:"/v1/focuses/by-node",classes:["person","broker"],resource:"none"},{name:"focus.get.145",method:"GET",path:"/v1/focuses/by-pane",classes:["person","broker"],resource:"none"},{name:"focus.patch.146",method:"PATCH",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"focus.delete.147",method:"DELETE",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"delivery.retry",method:"POST",path:"/v1/deliveries/:delivery_id/retry",classes:["person","broker"],resource:"none"},{name:"limits.show",method:"GET",path:"/v1/limits",classes:["person"],resource:"none"},{name:"limits.set",method:"PUT",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"limits.remove",method:"DELETE",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"charges.list",method:"GET",path:"/v1/charges",classes:["person","app","broker"],resource:"none",stage:"objects"},{name:"spend_limits.list",method:"GET",path:"/v1/spend-limits",classes:["person"],resource:"none"},{name:"spend_limits.set",method:"PUT",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"spend_limits.remove",method:"DELETE",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"space.list",method:"GET",path:"/v1/spaces",classes:["person","broker"],resource:"none"},{name:"kinds.list",method:"GET",path:"/v1/kinds",classes:["person","app","broker"],resource:"none"},{name:"grant.get",method:"GET",path:"/v1/grant",classes:["app"],resource:"none",stage:"v0.5"},{name:"exec",method:"POST",path:"/v1/exec",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5"},{name:"usage.get",method:"GET",path:"/v1/usage",classes:["person","app","broker"],resource:"none",stage:"v1"},{name:"llm",method:"POST",path:"/v1/llm",classes:["app","person","broker"],scope:"crtr:llm",resource:"none",stage:"v1"},{name:"structured-request.create",method:"POST",path:"/v1/structured-requests",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"structured-request.get",method:"GET",path:"/v1/structured-requests/:request_id",classes:["person","app","broker"],resource:"none"},{name:"structured-request.cancel",method:"POST",path:"/v1/structured-requests/:request_id/cancel",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"run.start",method:"POST",path:"/v1/runs",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5",idempotency:"24h"},{name:"run.list",method:"GET",path:"/v1/runs",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.get",method:"GET",path:"/v1/runs/:run_id",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.message",method:"POST",path:"/v1/runs/:run_id/messages",classes:["app","person","broker","cron"],scope:"crtr:act",resource:"run",stage:"v0.5",idempotency:"24h"},{name:"run.events",method:"GET",path:"/v1/runs/:run_id/events",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5",stream:!0},{name:"run.interrupt",method:"POST",path:"/v1/runs/:run_id/interrupt",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.cancel",method:"POST",path:"/v1/runs/:run_id/cancel",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.delete",method:"DELETE",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.rename",method:"POST",path:"/v1/runs/:run_id/rename",classes:["app"],resource:"run",stage:"chat"},{name:"question.get",method:"GET",path:"/v1/questions/:question_id",classes:["app"],resource:"none",stage:"chat"},{name:"question.answer",method:"POST",path:"/v1/questions/:question_id/answer",classes:["app"],resource:"none",stage:"chat"},{name:"question.cancel",method:"POST",path:"/v1/questions/:question_id/cancel",classes:["app"],resource:"none",stage:"chat"},{name:"trace.get",method:"GET",path:"/v1/runs/:run_id/trace",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"upload.create",method:"POST",path:"/v1/uploads",classes:["app"],scope:"crtr:act",resource:"none",stage:"file-transfer"},{name:"attachment.link",method:"GET",path:"/v1/attachments/link",classes:["app"],resource:"none",stage:"file-transfer"},{name:"file.download",method:"GET",path:"/v1/files/download",classes:["app"],resource:"none",stage:"file-transfer",stream:"bytes"},{name:"share.create",method:"POST",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.list",method:"GET",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.delete",method:"DELETE",path:"/v1/shares/:share_id",classes:["app"],resource:"none",stage:"file-transfer"},{name:"memory.list",method:"GET",path:"/v1/memory",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"memory.get",method:"GET",path:"/v1/memory/document",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"audit.list",method:"GET",path:"/v1/audit",classes:["person","app"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/:provider/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.call",method:"POST",path:"/v1/provider/call",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"peer.events",method:"POST",path:"/v1/peer/events",classes:["machine"],resource:"none"},{name:"peer.outbox.claim",method:"POST",path:"/v1/peer/outbox/claim",classes:["machine"],resource:"none"},{name:"peer.outbox.ack",method:"POST",path:"/v1/peer/outbox/ack",classes:["machine"],resource:"none"},{name:"peer.locate",method:"POST",path:"/v1/peer/locate",classes:["machine"],resource:"none"},{name:"runtime.sync-notice",method:"POST",path:"/v1/runtime/sync-notice",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-status",method:"GET",path:"/v1/runtime/vendor-status",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-account-remove",method:"POST",path:"/v1/runtime/vendor-account-remove",classes:["directory"],resource:"none",stage:"v1"}];function c(e,s){return n.find(o=>o.method===e.toUpperCase()&&o.path===s)}r(c,"operationFor");export{n as OPERATIONS,c as operationFor};
+var a=Object.defineProperty;var r=(e,s)=>a(e,"name",{value:s,configurable:!0});const n=[{name:"conversation.create",method:"POST",path:"/v1/conversations",classes:["broker"],resource:"none"},{name:"conversation.list",method:"GET",path:"/v1/conversations",classes:["broker","person"],resource:"none"},{name:"conversation.append",method:"POST",path:"/v1/conversations/:id/entries",classes:["broker"],resource:"none"},{name:"conversation.commit",method:"POST",path:"/v1/conversations/:id/commit",classes:["broker"],resource:"none"},{name:"conversation.read",method:"GET",path:"/v1/conversations/:id",classes:["broker","person"],resource:"none"},{name:"conversation.header",method:"GET",path:"/v1/conversations/:id/header",classes:["broker","person"],resource:"none"},{name:"conversation.replace",method:"PUT",path:"/v1/conversations/:id",classes:["broker"],resource:"none"},{name:"conversation.fork",method:"POST",path:"/v1/conversations/:id/fork",classes:["broker"],resource:"none"},{name:"conversation.delete",method:"DELETE",path:"/v1/conversations/:id",classes:["broker"],resource:"none"},{name:"health",method:"GET",path:"/v1/health",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"ready",method:"GET",path:"/v1/ready",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"chat-inventory.get.1",method:"GET",path:"/v1/nodes/:id/chat-inventory",classes:["person","broker","cron"],resource:"node-read"},{name:"settings.get",method:"GET",path:"/v1/settings",classes:["person","broker"],resource:"none"},{name:"settings.put",method:"PUT",path:"/v1/settings",classes:["person","broker"],resource:"none"},{name:"model-config.put.2",method:"PUT",path:"/v1/model-config",classes:["person","broker"],resource:"none"},{name:"files.get.3",method:"GET",path:"/v1/files/peek",classes:["person","broker"],resource:"none"},{name:"files.post.4",method:"POST",path:"/v1/files/write",classes:["person","broker"],resource:"none"},{name:"files.get.5",method:"GET",path:"/v1/files/list",classes:["person","broker"],resource:"none"},{name:"reviews.post.6",method:"POST",path:"/v1/human/reviews",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"reviews.get.7",method:"GET",path:"/v1/human/reviews",classes:["person","broker"],resource:"human"},{name:"reviews.get.8",method:"GET",path:"/v1/human/reviews/:review_id",classes:["person","broker"],resource:"human"},{name:"reviews.post.9",method:"POST",path:"/v1/human/reviews/:review_id/submit",classes:["person","broker"],resource:"human"},{name:"reviews.post.10",method:"POST",path:"/v1/human/reviews/:review_id/cancel",classes:["person","broker"],resource:"human"},{name:"reviews.get.11",method:"GET",path:"/v1/human/reviews/:review_id/document",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.12",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.13",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"node.log.append",method:"POST",path:"/v1/nodes/:id/records/log",classes:["person","broker"],resource:"node-own"},{name:"node.summaries.put",method:"PUT",path:"/v1/nodes/:id/records/summaries",classes:["person","broker"],resource:"node-own"},{name:"node.attachments.list",method:"GET",path:"/v1/nodes/:id/attachments",classes:["person","broker"],resource:"node-own"},{name:"node.attachments.read",method:"GET",path:"/v1/nodes/:id/attachments/:sha256",classes:["person","broker"],resource:"node-own"},{name:"node.telemetry.put",method:"PUT",path:"/v1/nodes/:id/records/telemetry",classes:["person","broker"],resource:"node-own"},{name:"node.recap.put",method:"PUT",path:"/v1/nodes/:id/records/recap",classes:["person","broker"],resource:"node-own"},{name:"node.inbox.read",method:"GET",path:"/v1/nodes/:id/records/inbox",classes:["person","broker"],resource:"node-own"},{name:"node.passive.read",method:"GET",path:"/v1/nodes/:id/records/passive",classes:["person","broker"],resource:"node-own"},{name:"node.pushed-final",method:"POST",path:"/v1/nodes/:id/records/pushed-final",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.14",method:"POST",path:"/v1/nodes/:id/broker/session-bound",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.15",method:"POST",path:"/v1/nodes/:id/broker/settle",classes:["person","broker"],resource:"node-own"},{name:"broker.idle",method:"POST",path:"/v1/nodes/:id/broker/idle",classes:["broker"],resource:"node-own"},{name:"broker-ops.post.16",method:"POST",path:"/v1/nodes/:id/broker/park-complete",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.17",method:"POST",path:"/v1/nodes/:id/broker/park-activity",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.18",method:"POST",path:"/v1/nodes/:id/broker/telemetry",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.19",method:"POST",path:"/v1/nodes/:id/broker/model",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.get.20",method:"GET",path:"/v1/nodes/:id/broker/extension-state",classes:["person","broker"],resource:"node-own"},{name:"broker.signals",method:"GET",path:"/v1/nodes/:id/broker/signals",classes:["broker"],resource:"node-own",stream:!0},{name:"nodes.broker-structured-request",method:"GET",path:"/v1/nodes/:id/broker/structured-request",classes:["person","broker"],resource:"node-own"},{name:"nodes.broker-goal",method:"POST",path:"/v1/nodes/:id/broker/goal",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.21",method:"POST",path:"/v1/nodes/:id/broker/generated-name",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.22",method:"POST",path:"/v1/nodes/:id/broker/persona-ack",classes:["person","broker"],resource:"node-own"},{name:"objects.read",method:"GET",path:"/v1/objects/:ref",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.list",method:"GET",path:"/v1/objects",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.search",method:"POST",path:"/v1/objects/search",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.watch",method:"POST",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.unwatch",method:"DELETE",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.shares",method:"GET",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.share",method:"POST",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.unshare",method:"DELETE",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"custom-objects.register",method:"POST",path:"/v1/custom-objects",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.publish",method:"POST",path:"/v1/custom-objects/:ref/events",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.unregister",method:"DELETE",path:"/v1/custom-objects/:ref",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.receive",method:"GET",path:"/v1/custom-objects/:ref/deliveries",classes:["anonymous","person","app","broker","cron"],resource:"objects",stream:!0,stage:"objects"},{name:"custom-objects.ack",method:"POST",path:"/v1/custom-objects/:ref/deliveries/ack",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.edges",method:"GET",path:"/v1/objects/:ref/edges",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.write",method:"POST",path:"/v1/docs",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.edit",method:"PATCH",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.move",method:"POST",path:"/v1/docs/:ref/move",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.delete",method:"DELETE",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.history",method:"GET",path:"/v1/docs/:ref/history",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"schemas.register",method:"POST",path:"/v1/schemas",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.write",method:"POST",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.replace",method:"PUT",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.list",method:"GET",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"check",method:"POST",path:"/v1/check",classes:["app"],resource:"objects",stage:"objects"},{name:"docs.lint",method:"POST",path:"/v1/docs/lint",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"plugins.app-token",method:"GET",path:"/v1/plugins/:name/app-token",classes:["person","broker"],resource:"none"},{name:"plugins.call-headers",method:"POST",path:"/v1/plugins/:name/call-headers",classes:["person","broker"],resource:"none"},{name:"documents.browser-access",method:"GET",path:"/v1/documents/browser-access",classes:["person"],resource:"none"},{name:"documents.reconcile-packages",method:"POST",path:"/v1/documents/reconcile-packages",classes:["person","broker"],resource:"none"},{name:"nodes.delivery",method:"POST",path:"/v1/nodes/:id/delivery",classes:["person","broker"],resource:"node-own"},{name:"delivery.dry-run",method:"POST",path:"/v1/delivery/dry-run",classes:["person","broker"],resource:"none"},{name:"bash-jobs.background",method:"POST",path:"/v1/nodes/:id/jobs/:jobId/background",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"health.get.33",method:"GET",path:"/healthz",classes:["anonymous"],resource:"none"},{name:"health.get.34",method:"GET",path:"/v1/status",classes:["person","broker"],resource:"none"},{name:"daemon.due",method:"GET",path:"/v1/due",classes:["person","broker"],resource:"none"},{name:"bash-jobs.report",method:"POST",path:"/v1/nodes/:id/jobs/:jobId/report",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"bash-jobs.patch",method:"PATCH",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"bash-jobs.start",method:"POST",path:"/v1/nodes/:id/jobs/start",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"hooks.plan",method:"GET",path:"/v1/nodes/:id/hooks/plan",classes:["broker"],resource:"node-own"},{name:"hooks.exec",method:"POST",path:"/v1/nodes/:id/hooks/exec",classes:["broker"],resource:"node-own"},{name:"hooks.exec.person",method:"POST",path:"/v1/hooks/exec",classes:["person","broker"],resource:"none"},{name:"bash-jobs.get.35",method:"GET",path:"/v1/nodes/:id/jobs",classes:["person","broker","cron"],resource:"node-read"},{name:"bash-jobs.delete.36",method:"DELETE",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"prospective-chat-inventory.get.37",method:"GET",path:"/v1/prospective-chat-inventory",classes:["person","broker"],resource:"none"},{name:"node-events.get.38",method:"GET",path:"/v1/nodes/:id/events",classes:["person","broker","cron"],resource:"node-read"},{name:"bash.post.39",method:"POST",path:"/v1/bash",classes:["person","broker"],resource:"daemon-bash",scope:"crtr:act"},{name:"subscriptions.post.40",method:"POST",path:"/v1/nodes/:id/subscriptions",classes:["person","broker"],resource:"node-write"},{name:"subscriptions.delete.41",method:"DELETE",path:"/v1/nodes/:id/subscriptions/:target",classes:["person","broker"],resource:"node-write"},{name:"attach.post.42",method:"POST",path:"/v1/nodes/:id/attach",classes:["person","broker"],resource:"node-write"},{name:"review-comments.post.44",method:"POST",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.45",method:"GET",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.post.46",method:"POST",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.47",method:"GET",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.48",method:"GET",path:"/v1/human/reviews/:review_id/comment-events",classes:["person","broker"],resource:"human"},{name:"review-comments.post.49",method:"POST",path:"/v1/human/reviews/:review_id/comment-ranges",classes:["person","broker"],resource:"human"},{name:"review-comments.get.50",method:"GET",path:"/v1/human/comments/:comment_id",classes:["person","broker"],resource:"human"},{name:"review-comments.post.51",method:"POST",path:"/v1/human/comments/:comment_id/edit",classes:["person","broker"],resource:"human"},{name:"review-comments.post.52",method:"POST",path:"/v1/human/comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"review-comments.post.53",method:"POST",path:"/v1/human/comments/:comment_id/reopen",classes:["person","broker"],resource:"human"},{name:"review-comments.post.54",method:"POST",path:"/v1/human/comments/:comment_id/delete",classes:["person","broker"],resource:"human"},{name:"review-comments.post.55",method:"POST",path:"/v1/human/comments/:comment_id/fork",classes:["person","broker"],resource:"human"},{name:"messages.post.56",method:"POST",path:"/v1/nodes/:id/mail/claim",classes:["person","broker"],resource:"node-own"},{name:"messages.post.57",method:"POST",path:"/v1/nodes/:id/mail/acknowledge",classes:["person","broker"],resource:"node-own"},{name:"messages.post.58",method:"POST",path:"/v1/nodes/:id/messages",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"messages.post.59",method:"POST",path:"/v1/nodes/:id/interrupt",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"reports.post.60",method:"POST",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-own"},{name:"reports.get.61",method:"GET",path:"/v1/nodes/:id/reports",classes:["person","broker","cron"],resource:"node-read"},{name:"reports.post.62",method:"POST",path:"/v1/nodes/:id/result",classes:["person","broker"],resource:"node-own"},{name:"inbox.get.63",method:"GET",path:"/v1/human/inbox",classes:["person","broker"],resource:"human"},{name:"inbox.get.64",method:"GET",path:"/v1/human/inbox/history",classes:["person","broker"],resource:"human"},{name:"inbox.get.65",method:"GET",path:"/v1/human/inbox/:ticket_id",classes:["person","broker"],resource:"human"},{name:"inbox.get.66",method:"GET",path:"/v1/human/inbox/:ticket_id/response",classes:["person","broker"],resource:"human"},{name:"inbox.post.67",method:"POST",path:"/v1/human/inbox/:ticket_id/respond",classes:["person","broker"],resource:"human"},{name:"inbox.post.68",method:"POST",path:"/v1/human/inbox/:ticket_id/progress",classes:["person","broker"],resource:"human"},{name:"inbox.post.69",method:"POST",path:"/v1/human/inbox/:ticket_id/cancel",classes:["person","broker"],resource:"human"},{name:"worktree.post.70",method:"POST",path:"/v1/nodes/:id/worktree/close",classes:["person","broker"],resource:"node-write"},{name:"worktree.post.71",method:"POST",path:"/v1/nodes/:id/worktree/abandon",classes:["person","broker"],resource:"node-write"},{name:"worktree.get.72",method:"GET",path:"/v1/worktrees/quarantined",classes:["person","broker"],resource:"none"},{name:"crons.post.73",method:"POST",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.get.74",method:"GET",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.get.75",method:"GET",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.post.76",method:"POST",path:"/v1/crons/:cronId/pause",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.77",method:"POST",path:"/v1/crons/:cronId/resume",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.78",method:"POST",path:"/v1/crons/poke",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.79",method:"POST",path:"/v1/crons/:cronId/run",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.delete.80",method:"DELETE",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"modelauth.get.81",method:"GET",path:"/v1/model-auth",classes:["person","broker"],resource:"none"},{name:"modelauth.get.82",method:"GET",path:"/v1/model-auth/readiness",classes:["person","broker"],resource:"none"},{name:"modelauth.put.83",method:"PUT",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"modelauth.delete.84",method:"DELETE",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"modelauth.delete.account",method:"DELETE",path:"/v1/model-auth/:provider/accounts/:label",classes:["person","broker"],resource:"none"},{name:"modelauth.patch.account",method:"PATCH",path:"/v1/model-auth/:provider/accounts/:label",classes:["person","broker"],resource:"none"},{name:"model_auth.start",method:"POST",path:"/v1/model-auth/flows",classes:["person","broker"],resource:"none"},{name:"model_auth.complete",method:"POST",path:"/v1/model-auth/flows/:flow_id/complete",classes:["person","broker"],resource:"none"},{name:"model_auth.cancel",method:"POST",path:"/v1/model-auth/flows/:flow_id/cancel",classes:["person","broker"],resource:"none"},{name:"model_auth.get",method:"GET",path:"/v1/model-auth/flows/:flow_id",classes:["person","broker"],resource:"none"},{name:"nodes.post.85",method:"POST",path:"/v1/nodes",classes:["person","broker","cron"],resource:"node-own",scope:"crtr:act"},{name:"nodes.get.86",method:"GET",path:"/v1/nodes",classes:["person","broker"],resource:"nodes-list"},{name:"nodes.post.87",method:"POST",path:"/v1/nodes/revive-all",classes:["person","broker"],resource:"none"},{name:"nodes.get.88",method:"GET",path:"/v1/nodes/:id",classes:["person","broker","cron","forwarded"],resource:"node-read"},{name:"nodes.get.89",method:"GET",path:"/v1/nodes/:id/snapshot",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.90",method:"GET",path:"/v1/nodes/:id/subject",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.91",method:"GET",path:"/v1/nodes/:id/messages",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.92",method:"GET",path:"/v1/nodes/:id/session",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.93",method:"GET",path:"/v1/nodes/:id/transcript",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.94",method:"GET",path:"/v1/nodes/:id/context",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.post.96",method:"POST",path:"/v1/nodes/:id/fork",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.97",method:"POST",path:"/v1/nodes/:id/revive",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.98",method:"POST",path:"/v1/nodes/:id/relaunch-root",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.99",method:"POST",path:"/v1/nodes/:id/close",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.read",method:"POST",path:"/v1/nodes/:id/read",classes:["person"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.100",method:"POST",path:"/v1/nodes/:id/recycle",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.101",method:"POST",path:"/v1/nodes/:id/demote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.102",method:"POST",path:"/v1/nodes/:id/promote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.103",method:"POST",path:"/v1/nodes/:id/yield",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.104",method:"POST",path:"/v1/nodes/:id/wait",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.patch.105",method:"PATCH",path:"/v1/nodes/:id/config",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"broker-recovery.post.106",method:"POST",path:"/v1/broker/:id/turn",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.107",method:"POST",path:"/v1/broker/:id/provider-retry",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.108",method:"POST",path:"/v1/broker/:id/fault",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.get.109",method:"GET",path:"/v1/broker/:id/recovery",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.110",method:"POST",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"broker-recovery.delete.111",method:"DELETE",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"profiles.put.112",method:"PUT",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profiles.post.113",method:"POST",path:"/v1/profiles/:name/pause",classes:["person","broker"],resource:"profile"},{name:"profiles.post.114",method:"POST",path:"/v1/profiles/:name/resume",classes:["person","broker"],resource:"profile"},{name:"profiles.patch.115",method:"PATCH",path:"/v1/profiles/:name/metadata",classes:["person","app","broker"],resource:"profile"},{name:"profile.create",method:"POST",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile"},{name:"profile.update",method:"PATCH",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"app.env.list",method:"GET",path:"/v1/apps/self/env",classes:["person","app","broker"],resource:"profile"},{name:"app.env.set",method:"PUT",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"app.env.remove",method:"DELETE",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.list",method:"GET",path:"/v1/profiles/:name/env",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.set",method:"PUT",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.remove",method:"DELETE",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profiles.delete.116",method:"DELETE",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.list",method:"GET",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile",stage:"chat"},{name:"profiles.get.118",method:"GET",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"execution.start",method:"GET",path:"/v1/executions/:execution_id/start",classes:["broker"],resource:"none"},{name:"environment.git-credential",method:"POST",path:"/v1/environments/:environment_id/git-credential",classes:["broker"],resource:"none"},{name:"node-outcomes.get.119",method:"GET",path:"/v1/nodes/:id/outcome",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.put.120",method:"PUT",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"node-outcomes.get.121",method:"GET",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.delete.122",method:"DELETE",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"canvas.get.123",method:"GET",path:"/v1/canvas/attention",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.124",method:"POST",path:"/v1/canvas/attention/counts",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.125",method:"POST",path:"/v1/canvas/history/search",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.126",method:"POST",path:"/v1/canvas/history/grep",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.127",method:"GET",path:"/v1/canvas/history/read",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.128",method:"POST",path:"/v1/canvas/history/stats",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.129",method:"GET",path:"/v1/canvas/snapshot",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.130",method:"GET",path:"/v1/canvas/roster",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.live-roots",method:"GET",path:"/v1/canvas/live-roots",classes:["person"],resource:"canvas-read"},{name:"canvas.get.browse",method:"GET",path:"/v1/canvas/browse",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.analytics",method:"GET",path:"/v1/canvas/analytics",classes:["person","broker"],resource:"canvas-read"},{name:"memory-reads.post",method:"POST",path:"/v1/nodes/:id/memory-reads",classes:["person","broker"],resource:"node-own"},{name:"canvas.get.131",method:"GET",path:"/v1/canvas/graph",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.132",method:"POST",path:"/v1/canvas/prune",classes:["person","broker"],resource:"none"},{name:"daemon.post.133",method:"POST",path:"/v1/daemon/restart",classes:["person","broker"],resource:"none"},{name:"daemon.post.134",method:"POST",path:"/v1/daemon/migrate",classes:["person","broker"],resource:"none"},{name:"daemon.post.135",method:"POST",path:"/v1/daemon/admit",classes:["person","broker"],resource:"none"},{name:"human.components.list",method:"GET",path:"/v1/human/components",classes:["person","broker"],resource:"none"},{name:"human-requests.post.136",method:"POST",path:"/v1/human/requests",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"human-requests.get.137",method:"GET",path:"/v1/human/requests/:request_id",classes:["person","broker"],resource:"human"},{name:"human-requests.post.138",method:"POST",path:"/v1/human/requests/:request_id/replace",classes:["person","broker"],resource:"human"},{name:"human-requests.post.139",method:"POST",path:"/v1/human/requests/:request_id/respond",classes:["person","broker"],resource:"human"},{name:"human-requests.post.140",method:"POST",path:"/v1/human/requests/:request_id/dismiss",classes:["person","broker"],resource:"human"},{name:"human-requests.post.141",method:"POST",path:"/v1/human/requests/:request_id/cancel",classes:["person","broker"],resource:"human"},{name:"focus.get.142",method:"GET",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.post.143",method:"POST",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.get.144",method:"GET",path:"/v1/focuses/by-node",classes:["person","broker"],resource:"none"},{name:"focus.get.145",method:"GET",path:"/v1/focuses/by-pane",classes:["person","broker"],resource:"none"},{name:"focus.patch.146",method:"PATCH",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"focus.delete.147",method:"DELETE",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"delivery.retry",method:"POST",path:"/v1/deliveries/:delivery_id/retry",classes:["person","broker"],resource:"none"},{name:"limits.show",method:"GET",path:"/v1/limits",classes:["person"],resource:"none"},{name:"limits.set",method:"PUT",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"limits.remove",method:"DELETE",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"charges.list",method:"GET",path:"/v1/charges",classes:["person","app","broker"],resource:"none",stage:"objects"},{name:"spend_limits.list",method:"GET",path:"/v1/spend-limits",classes:["person"],resource:"none"},{name:"spend_limits.set",method:"PUT",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"spend_limits.remove",method:"DELETE",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"space.list",method:"GET",path:"/v1/spaces",classes:["person","broker"],resource:"none"},{name:"kinds.list",method:"GET",path:"/v1/kinds",classes:["person","app","broker"],resource:"none"},{name:"grant.get",method:"GET",path:"/v1/grant",classes:["app"],resource:"none",stage:"v0.5"},{name:"exec",method:"POST",path:"/v1/exec",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5"},{name:"usage.get",method:"GET",path:"/v1/usage",classes:["person","app","broker"],resource:"none",stage:"v1"},{name:"llm",method:"POST",path:"/v1/llm",classes:["app","person","broker"],scope:"crtr:llm",resource:"none",stage:"v1"},{name:"structured-request.create",method:"POST",path:"/v1/structured-requests",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"structured-request.get",method:"GET",path:"/v1/structured-requests/:request_id",classes:["person","app","broker"],resource:"none"},{name:"structured-request.cancel",method:"POST",path:"/v1/structured-requests/:request_id/cancel",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"run.start",method:"POST",path:"/v1/runs",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5",idempotency:"24h"},{name:"run.list",method:"GET",path:"/v1/runs",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.get",method:"GET",path:"/v1/runs/:run_id",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.message",method:"POST",path:"/v1/runs/:run_id/messages",classes:["app","person","broker","cron"],scope:"crtr:act",resource:"run",stage:"v0.5",idempotency:"24h"},{name:"run.events",method:"GET",path:"/v1/runs/:run_id/events",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5",stream:!0},{name:"run.interrupt",method:"POST",path:"/v1/runs/:run_id/interrupt",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.cancel",method:"POST",path:"/v1/runs/:run_id/cancel",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.delete",method:"DELETE",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.rename",method:"POST",path:"/v1/runs/:run_id/rename",classes:["app"],resource:"run",stage:"chat"},{name:"question.get",method:"GET",path:"/v1/questions/:question_id",classes:["app"],resource:"none",stage:"chat"},{name:"question.answer",method:"POST",path:"/v1/questions/:question_id/answer",classes:["app"],resource:"none",stage:"chat"},{name:"question.cancel",method:"POST",path:"/v1/questions/:question_id/cancel",classes:["app"],resource:"none",stage:"chat"},{name:"trace.get",method:"GET",path:"/v1/runs/:run_id/trace",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"upload.create",method:"POST",path:"/v1/uploads",classes:["app"],scope:"crtr:act",resource:"none",stage:"file-transfer"},{name:"attachment.link",method:"GET",path:"/v1/attachments/link",classes:["app"],resource:"none",stage:"file-transfer"},{name:"file.download",method:"GET",path:"/v1/files/download",classes:["app"],resource:"none",stage:"file-transfer",stream:"bytes"},{name:"share.create",method:"POST",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.list",method:"GET",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.delete",method:"DELETE",path:"/v1/shares/:share_id",classes:["app"],resource:"none",stage:"file-transfer"},{name:"memory.list",method:"GET",path:"/v1/memory",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"memory.get",method:"GET",path:"/v1/memory/document",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"audit.list",method:"GET",path:"/v1/audit",classes:["person","app"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/:provider/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.call",method:"POST",path:"/v1/provider/call",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"peer.events",method:"POST",path:"/v1/peer/events",classes:["machine"],resource:"none"},{name:"peer.outbox.claim",method:"POST",path:"/v1/peer/outbox/claim",classes:["machine"],resource:"none"},{name:"peer.outbox.ack",method:"POST",path:"/v1/peer/outbox/ack",classes:["machine"],resource:"none"},{name:"peer.locate",method:"POST",path:"/v1/peer/locate",classes:["machine"],resource:"none"},{name:"runtime.sync-notice",method:"POST",path:"/v1/runtime/sync-notice",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-status",method:"GET",path:"/v1/runtime/vendor-status",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-account-remove",method:"POST",path:"/v1/runtime/vendor-account-remove",classes:["directory"],resource:"none",stage:"v1"}];function c(e,s){return n.find(o=>o.method===e.toUpperCase()&&o.path===s)}r(c,"operationFor");export{n as OPERATIONS,c as operationFor};

package/dist/daemon/api/reader.d.ts

@@ -1,9 +1,16 @@
 import type { DocOwnerFlag } from '../../api/dto/docs.js';
 import type { ObjectRow, Reader } from '../../core/graph/types.js';
 import type { RequestContext } from './router.js';
-import type { CanvasDb } from '../../core/canvas/db.js';
+import { type CanvasDb } from '../../core/canvas/db.js';
 /** The graph reader for a request's principal; repos come from the node's cwd. */
 export declare function readerFor(db: CanvasDb, ctx: Pick<RequestContext, 'principal'>): Promise<Reader>;
+/** Run the git lookups a node caller's reader needs (its cwd and its profile's project paths, and the `cwd` a request names for `--owner repo`) before a canvas write opens, so
+ *  `readerFor` inside the write hits the identity cache instead of spawning git while the write holds a pooled connection. */
+export declare function warmReaderRepos(principal: RequestContext['principal'], requestCwd?: string): Promise<void>;
+/** Run the git lookups an edit of document `docId` will need inside its write: publishing the edit builds a reader for every
+ *  watching node, from that node's cwd and project paths. Called before the write opens, so none of it spawns git while the
+ *  write holds a pooled connection. */
+export declare function warmDocumentWatchers(docId: string): Promise<void>;
 /** A ref (`[[ ]]`-wrapped or not, raw id, name, `<owner>/<name>`, or an old
  *  `<node-id>:reports/<basename>[.md]`) → the object, or a deleted/remote answer.
  *  Anything unreadable is `not_found`. */

package/dist/daemon/api/reader.js

@@ -1 +1 @@
-var $=Object.defineProperty;var c=(n,e)=>$(n,"name",{value:e,configurable:!0});import{ApiError as d}from"../../api/index.js";import{readerFor as g}from"../../core/graph/reader.js";import{canRead as E}from"../../core/graph/access.js";import{ownersByHandle as y,resolveName as F,viewOf as R}from"../../core/graph/names.js";import{ensureOwner as v,ownerForGrantee as x}from"../../core/graph/objects.js";import{checkoutsForCwd as N,reposForCwd as j}from"../../core/graph/repo-sync/repos.js";import{lookupProfile as L}from"../../core/profiles/manifest.js";import{filterAsync as _,mapAsync as A}from"../../core/async-array.js";import{personId as I}from"../../core/canvas/person.js";async function G(n,e){return await g(n,e.principal,async o=>await N(n,o))}c(G,"readerFor");async function P(n,e,o){const r=await F(n,e,o);if("object"in r)return r.object;if("deleted"in r||"remote"in r)return r;if("ambiguous"in r){const s=await A(r.ambiguous,async m=>`${await O(n,m)}/${m.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one object: ${s.join(", ")}`,{candidates:s,next:"Read one of them by its full `<type>:<owner>/<name>`."})}const t=o.replace(/^\s*\[\[(.*)\]\]\s*$/,"$1").trim(),a=/^(person|app|repo|profile):([^/]+)$/.exec(t),i=await _(a?await y(n,a[2],a[1]):(await y(n,t)).filter(s=>s.type!=="node"),async s=>await E(n,e,s));if(i.length>0){const s=await R(n,e),m=c(w=>{const f=s.findIndex(h=>h.id===w.id);return f<0?1/0:f},"rank"),l=[...i].sort((w,f)=>m(w)-m(f))[0];if(m(l)===1/0&&i.length>1){const w=i.map(f=>`${f.type}:${f.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one owner: ${w.join(", ")}`,{candidates:w,next:"Name one as `<type>:<handle>`."})}return l.deleted_at?{deleted:l}:l}const p=`'${o}' not found: no object by that name in your view`,u=`Search for it with \`crtr canvas search ${t}\`.`;throw new d(404,"not_found",p,{error:"not_found",message:p,next:u})}c(P,"resolveRef");async function O(n,e){if(e.owner===null)return"";const o=await n.prepare("SELECT type, id, name FROM objects WHERE id = ?").get(e.owner);return o.type==="node"?o.id:`${o.type}:${o.name}`}c(O,"typedOwnerHandle");async function q(n,e,o,r){const t=o??(e.class==="node"?"node":e.class==="person"?"user":"app"),a=c(i=>new d(400,"invalid_owner",i,{next:"Run `crtr doc write --owner -h`."}),"refuse");if(t==="node"){if(e.class!=="node")throw a("`--owner node` needs a node; you are not running as one");return e.node}if(t==="user")return await x(n,I());if(t==="app"){if(e.class==="person")throw a("`--owner app` needs an app; a person has none \u2014 use `--owner user`");return e.app}if(t==="profile"){if(e.class!=="node"||!e.profile)throw a("`--owner profile` needs a profile; you have none");return e.profile}if(t==="repo"){const i=r?await j(n,r):[],p=i[0]?i:e.class==="node"?e.repos:[];if(!p[0])throw a(`\`--owner repo\` needs a repo; ${r??(e.class==="node"?e.cwd:"your directory")} is not inside one`);return p[0]}if(t.startsWith("repo:"))return await S(n,"repo",t.slice(5),a);if(t.startsWith("profile:")){const i=t.slice(8),p=await n.prepare("SELECT * FROM objects WHERE type = 'profile' AND name = ? AND home_machine IS NULL").get(i);if(p)return p;const u=L(i);if(u.kind!=="resolved")throw a(`no profile named '${i}'`);const s=e.class==="person"?e.person:e.app;return await v(n,"profile","profile",u.entry.profileId,u.entry.manifest.name,s)}throw a(`unknown --owner value '${t}'`)}c(q,"ownerFromFlag");async function S(n,e,o,r){const t=await n.prepare("SELECT * FROM objects WHERE type = ? AND name = ? AND deleted_at IS NULL AND home_machine IS NULL").get(e,o);if(!t)throw r(`no ${e} named '${o}'`);return t}c(S,"namedOwner");export{q as ownerFromFlag,G as readerFor,P as resolveRef};
+var R=Object.defineProperty;var c=(n,e)=>R(n,"name",{value:e,configurable:!0});import{ApiError as d}from"../../api/index.js";import{readerFor as N,warmNodeRepos as h}from"../../core/graph/reader.js";import{canRead as g}from"../../core/graph/access.js";import{ownersByHandle as y,resolveName as x,viewOf as F}from"../../core/graph/names.js";import{ensureOwner as I,ownerForGrantee as j}from"../../core/graph/objects.js";import{checkoutsForCwd as v,reposForCwd as L,warmCheckoutIdentities as O}from"../../core/graph/repo-sync/repos.js";import{lookupProfile as A}from"../../core/profiles/manifest.js";import{openDb as $}from"../../core/canvas/db.js";import{filterAsync as D,mapAsync as S}from"../../core/async-array.js";import{personId as _}from"../../core/canvas/person.js";async function K(n,e){return await N(n,e.principal,async o=>await v(n,o))}c(K,"readerFor");async function Q(n,e){e!==void 0&&await O(e),n.class==="broker"&&await h(await $(),n.node)}c(Q,"warmReaderRepos");async function V(n){const e=await $(),o=await e.prepareUncached("SELECT DISTINCT w.watcher FROM watches w JOIN objects o ON o.id = w.watcher AND o.type = 'node' WHERE w.object = ?").all(n);for(const{watcher:r}of o)await h(e,r)}c(V,"warmDocumentWatchers");async function X(n,e,o){const r=await x(n,e,o);if("object"in r)return r.object;if("deleted"in r||"remote"in r)return r;if("ambiguous"in r){const s=await S(r.ambiguous,async f=>`${await b(n,f)}/${f.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one object: ${s.join(", ")}`,{candidates:s,next:"Read one of them by its full `<type>:<owner>/<name>`."})}const t=o.replace(/^\s*\[\[(.*)\]\]\s*$/,"$1").trim(),i=/^(person|app|repo|profile):([^/]+)$/.exec(t),a=await D(i?await y(n,i[2],i[1]):(await y(n,t)).filter(s=>s.type!=="node"),async s=>await g(n,e,s));if(a.length>0){const s=await F(n,e),f=c(m=>{const w=s.findIndex(E=>E.id===m.id);return w<0?1/0:w},"rank"),l=[...a].sort((m,w)=>f(m)-f(w))[0];if(f(l)===1/0&&a.length>1){const m=a.map(w=>`${w.type}:${w.name}`);throw new d(409,"ambiguous_name",`'${o}' names more than one owner: ${m.join(", ")}`,{candidates:m,next:"Name one as `<type>:<handle>`."})}return l.deleted_at?{deleted:l}:l}const p=`'${o}' not found: no object by that name in your view`,u=`Search for it with \`crtr canvas search ${t}\`.`;throw new d(404,"not_found",p,{error:"not_found",message:p,next:u})}c(X,"resolveRef");async function b(n,e){if(e.owner===null)return"";const o=await n.prepare("SELECT type, id, name FROM objects WHERE id = ?").get(e.owner);return o.type==="node"?o.id:`${o.type}:${o.name}`}c(b,"typedOwnerHandle");async function Y(n,e,o,r){const t=o??(e.class==="node"?"node":e.class==="person"?"user":"app"),i=c(a=>new d(400,"invalid_owner",a,{next:"Run `crtr doc write --owner -h`."}),"refuse");if(t==="node"){if(e.class!=="node")throw i("`--owner node` needs a node; you are not running as one");return e.node}if(t==="user")return await j(n,_());if(t==="app"){if(e.class==="person")throw i("`--owner app` needs an app; a person has none \u2014 use `--owner user`");return e.app}if(t==="profile"){if(e.class!=="node"||!e.profile)throw i("`--owner profile` needs a profile; you have none");return e.profile}if(t==="repo"){const a=r?await L(n,r):[],p=a[0]?a:e.class==="node"?e.repos:[];if(!p[0])throw i(`\`--owner repo\` needs a repo; ${r??(e.class==="node"?e.cwd:"your directory")} is not inside one`);return p[0]}if(t.startsWith("repo:"))return await k(n,"repo",t.slice(5),i);if(t.startsWith("profile:")){const a=t.slice(8),p=await n.prepare("SELECT * FROM objects WHERE type = 'profile' AND name = ? AND home_machine IS NULL").get(a);if(p)return p;const u=A(a);if(u.kind!=="resolved")throw i(`no profile named '${a}'`);const s=e.class==="person"?e.person:e.app;return await I(n,"profile","profile",u.entry.profileId,u.entry.manifest.name,s)}throw i(`unknown --owner value '${t}'`)}c(Y,"ownerFromFlag");async function k(n,e,o,r){const t=await n.prepare("SELECT * FROM objects WHERE type = ? AND name = ? AND deleted_at IS NULL AND home_machine IS NULL").get(e,o);if(!t)throw r(`no ${e} named '${o}'`);return t}c(k,"namedOwner");export{Y as ownerFromFlag,K as readerFor,X as resolveRef,V as warmDocumentWatchers,Q as warmReaderRepos};

package/dist/daemon/api/router.d.ts

@@ -17,6 +17,7 @@ export type RequestPrincipal = {
     scopes: [];
 } | {
     class: 'person';
+    sub?: string;
 } | {
     class: 'app';
     app: string;
@@ -83,13 +84,14 @@ export type CronPrincipalClass = ({
 };
 /** The app a non-person caller acts as: a forwarded app actor's app, a forwarded person's terminal, null for the anonymous, a machine and the person. */
 export declare function appOf(principal: RequestPrincipal): string | null;
-/** Whether the caller is the person (a local person, or a forwarded call the envelope makes for the person). */
+/** Whether the caller is the install's person, who passes the schema alone: the local person (no `sub`), or a forwarded call the envelope
+ *  makes for the person. A person with a `sub` (a cloud role's directory person bearer) is one of many people and is confined by the evaluator. */
 export declare function actsAsPerson(principal: RequestPrincipal): boolean;
 export declare function resolvedScopes(principal: RequestPrincipal): Promise<readonly string[]>;
 export declare function runCallerApp(principal: RequestPrincipal | AppPrincipal): string | null;
 /** Whether the caller holds `permission` on a node: the evaluator, with the caller's ceiling (own-app run confinement, `objects` and
  *  `conversations` scopes, `objects:message`). A person caller passes the schema alone. */
-export declare function mayOnNode(principal: RequestPrincipal | AppPrincipal, permission: 'read' | 'message', nodeId: string): Promise<boolean>;
+export declare function mayOnNode(principal: RequestPrincipal | AppPrincipal, permission: 'read' | 'edit' | 'message', nodeId: string): Promise<boolean>;
 /** The ids of the nodes the caller may read, in one query that embeds the evaluator's condition; null when the caller reads every node (the person). */
 export declare function readableNodeIds(principal: RequestPrincipal): Promise<Set<string> | null>;
 export declare function canReadRun(principal: RequestPrincipal | AppPrincipal, grantee: string, target?: string): Promise<boolean>;

package/dist/daemon/api/router.js

@@ -1 +1 @@
-var G=Object.defineProperty;var a=(e,t)=>G(e,"name",{value:t,configurable:!0});import{toErrorBody as z}from"./map.js";import{emitEvent as D}from"../../core/events/emit.js";import{scopeAllowed as m,ScopeDeniedError as H}from"../../core/scopes.js";import{coveredByAny as L}from"../../shared/env.js";import{ApiError as c}from"../../api/errors.js";import{activeGrant as j,grantFor as B}from"../../core/grants/mirror.js";import{getNode as _}from"../../core/canvas/canvas.js";import{ownedRun as I,RunError as g}from"../../core/runs/operations.js";import{openDb as k}from"../../core/canvas/db.js";import{check as J,permits as F}from"../../core/permissions/evaluator.js";import{readerFor as x}from"./reader.js";import{checkCronFire as P}from"../cron/authority.js";import{operationFor as Y}from"./operations.js";import{CONTROL_BODY_MAX_BYTES as M}from"../../core/llm/body-limits.js";import{getRequest as Z,getRequestByInboxTicket as V}from"../../core/human/requests.js";import{requireVisibleReview as S}from"../../core/review/store.js";import{getComment as R}from"../../core/review/comments.js";async function X(e,t,o,n,r){const s=e.path,u=r&&typeof r=="object"&&!Array.isArray(r)?r:{};if(s==="/v1/human/requests"||s==="/v1/human/reviews"){const d=s.endsWith("/reviews")?u.origin_node_id:u.requester_node_id,f=s==="/v1/human/requests"&&d==null;if(d!==t.node&&!f)throw new c(403,"other_app_run","a broker may create a human request only for its own node");const i=u.source;if(i&&typeof i=="object"&&"nodeId"in i&&i.nodeId!==t.node)throw new c(403,"other_app_run","request source must name the calling node")}if(s==="/v1/human/reviews/self/comments"&&e.method==="GET"&&n.get("actor_node_id")!==t.node)throw new c(403,"other_app_run","self review requires the calling node");if(s.includes("/comments")&&e.method!=="GET"&&u.actor_node_id!==t.node)throw new c(403,"other_app_run","comment author must be the calling node");if(o.comment_id&&!await R(o.comment_id))throw new c(404,"not_found","comment not found")}a(X,"authorizeHumanBody");function A(e){return e.class==="broker"||e.class==="cron"}a(A,"boundedByStoredScopes");function p(e){return e.class==="person"||e.class==="anonymous"||e.class==="machine"?null:e.class==="forwarded"?e.actor.kind==="app"?e.actor.app:null:e.app}a(p,"appOf");function y(e){return e.class==="person"||e.class==="forwarded"&&e.actor.kind==="person"}a(y,"actsAsPerson");async function q(e){const t=await B(e.actor.app,e.sub);if(!t)throw new c(403,"app_not_granted",`${e.actor.app} holds no active grant for ${e.sub} on this machine`);return t}a(q,"forwardedGrant");async function O(e){if(e.class==="person"||e.class==="anonymous"||e.class==="machine")return[];if(e.class==="forwarded"){if(e.actor.kind==="person")return[];const{resolved:o}=await q(e),n=e.actor.node_scopes;return n===null?o:n.filter(r=>L(o,r))}if(e.class==="app")return e.scopes;if(e.class==="cron"){const o=await P({grantee:e.app,sub:e.sub,grant_id:e.grant,scopes:e.scopes});if(o.allowed)return o.effectiveScopes;throw o.reason==="grant_missing"||o.reason==="grant_revoked"?new c(401,"grant_revoked",o.message):new c(403,"scope_missing",o.message)}const t=e.grant?await j(e.grant):await B(e.app,e.sub);if(t&&t.grantee===e.app&&t.sub===e.sub)return t.resolved;throw new c(401,"grant_revoked","the node grant is not active")}a(O,"resolvedScopes");function C(e){return"class"in e?p(e):e.grantee}a(C,"runCallerApp");function $(e){return"class"in e?e:{class:"app",app:e.grantee,scopes:e.resolved,sub:e.sub}}a($,"asRequestPrincipal");async function l(e,t,o){const n=$(e);if(y(n))return!0;if(n.class==="anonymous"||n.class==="machine")return!1;const r=await k();return await J(r,await x(r,{principal:n}),t,o)}a(l,"mayOnNode");async function Ae(e){if(y(e))return null;if(e.class==="anonymous"||e.class==="machine")return new Set;const t=await k(),o=await F(t,await x(t,{principal:e}),"read"),n=await t.prepareUncached(`SELECT o.id FROM objects o WHERE o.type = 'node' AND o.deleted_at IS NULL AND ${o.sql}`).all(...o.params);return new Set(n.map(r=>r.id))}a(Ae,"readableNodeIds");async function N(e,t,o){const n=$(e);return y(n)?!0:n.class==="anonymous"||n.class==="machine"?!1:p(n)===t?!0:m(await O(n),o)&&(!A(n)||m(n.scopes,o))}a(N,"mayReadApp");async function qe(e,t,o){return o===void 0?await N(e,t,`crtr:conversations:read:${t}`):await l(e,"read",o)}a(qe,"canReadRun");async function Oe(e,t,o=!1,n=!1){const r=await _(t);if(!r||r.parent!==null||r.run_id!==t||!r.grantee||r.deleting_at&&!n)throw new g(404,"not_found","run not found");if(!await l(e,"read",t))throw new g(404,"not_found","run not found");if(o&&C(e)!==null&&C(e)!==r.grantee)throw new g(403,"other_app_run","cannot change another app's run");return await I(t,r.grantee,n)}a(Oe,"requireRun");async function K(e,t,o){return o===void 0?await N(e,t,`crtr:objects:read:${t}`):await l(e,"read",o)}a(K,"canReadNode");const Q=new Set(["messages.post.58","messages.post.59"]);async function ee(e,t,o){if(!e.classes.includes(t.class)&&!(t.class!=="anonymous"&&t.class!=="machine"&&t.class!=="forwarded"&&e.classes.includes("anonymous")))throw new c(403,"permission_error","this operation is not available to the caller");if(t.class==="forwarded"&&t.actor.kind==="app"&&await q(t),t.class==="person"||t.class==="anonymous"||t.class==="machine"||y(t))return;const n=await O(t);if(e.scope&&(!m(n,e.scope)||A(t)&&!m(t.scopes,e.scope)))throw new c(403,"scope_missing",`missing scope ${e.scope}`);if(t.class==="app")return;const r=p(t);t.class==="broker"&&await te(e,t,o,n);const s=o.id;if((e.resource==="node-read"||e.resource==="node-write")&&s!==void 0){const u=await _(s);if(!u)return;if(e.resource==="node-write"){const d=Q.has(e.name);if(u.grantee!==r&&!d)throw new c(403,"other_app_run","cannot change another app's node");if(!await l(t,d&&u.grantee!==r?"message":"read",s))throw u.grantee!==r?new c(403,"other_app_run","cannot change another app's node"):new c(404,"not_found","node not found")}if(e.resource==="node-read"&&!await l(t,"read",s))throw new c(404,"not_found","node not found")}}a(ee,"authorizeOperation");async function te(e,t,o,n){if(e.resource==="daemon-bash"&&(!m(n,"crtr:files:rw:user:.")||!m(t.scopes,"crtr:files:rw:user:.")))throw new c(403,"scope_missing","missing scope crtr:files:rw:user:.");if(e.resource==="human"){const s=e.path,u=e.method==="GET";if(!u&&(s.endsWith("/respond")||s.endsWith("/submit")||s.endsWith("/dismiss")||s.endsWith("/progress")||s.endsWith("/comment-ranges")||s.includes("/feedback-comments")))throw new c(403,"permission_error","only the person may answer or edit the human inbox");const d=o.request_id?await Z(o.request_id):o.ticket_id?await V(o.ticket_id):null,f=o.comment_id?await R(o.comment_id):null,i=o.review_id?await S(o.review_id):f?await S(f.review_id):null,h=d?.requester_node_id??i?.origin_node_id;if(h!=null){const w=await _(h);if(w&&(u?!await K(t,w.grantee??"app:terminal",h):w.grantee!==t.app))throw new c(u?404:403,u?"not_found":"other_app_run","human request belongs to another app");if(w&&!u&&!await l(t,"read",h))throw new c(404,"not_found","human request not found")}else if(d||i)throw new c(403,"permission_error","only the person may access a request without a node")}const r=o.id;if(e.resource==="node-own"&&r!==void 0&&r!==t.node)throw new c(403,"other_app_run","the operation requires the calling node")}a(te,"authorizeBrokerOnly");function oe(e,t){if(!m(e,t))throw new H("the bearer token",t)}a(oe,"assertCeiling");function ne(){return new c(403,"owner_only","this operation is owner-only; a scoped token does not reach it")}a(ne,"ownerOnlyError");const re="Crtr-Caused-By",se=/^(?:message|request|cron_run):[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function ae(e){const t=e[re.toLowerCase()];return typeof t=="string"&&se.test(t)?t:void 0}a(ae,"causedByOf");function Ce(e){return e.map(t=>({...t,ownerOnly:!0}))}a(Ce,"ownerOnly");class $e{static{a(this,"Router")}routes=[];register(t){const o=Y(t.method,t.pattern);if(!o)throw new Error(`route has no operation row: ${t.method} ${t.pattern}`);if(this.routes.some(n=>n.method===t.method.toUpperCase()&&n.operation.path===t.pattern))throw new Error(`duplicate route: ${t.method} ${t.pattern}`);return this.routes.push({operation:o,method:t.method.toUpperCase(),segments:T(t.pattern),handler:t.handler,maxBodyBytes:t.maxBodyBytes??M}),this}registerAll(t){for(const o of t)this.register(o);return this}match(t,o){const n=t.toUpperCase(),r=T(o);for(const s of this.routes){if(s.method!==n)continue;const u=ue(s.segments,r);if(u!==null)return{handler:s.handler,params:u,operation:s.operation,maxBodyBytes:s.maxBodyBytes}}return null}async handle(t,o,n,r={class:"person"}){try{const s=new URL(t.url??"/","http://127.0.0.1"),u=(t.method??"GET").toUpperCase(),d=this.match(u,s.pathname);if(d===null){W(o,404,"not_found",`no route for ${u} ${s.pathname}`);return}if(await ee(d.operation,r,d.params),n!==null){if(d.operation.classes.length===1&&d.operation.classes[0]==="person")throw ne();d.operation.scope&&oe(n,d.operation.scope)}let f;try{f=await de(t,d.maxBodyBytes)}catch(v){const E=v instanceof U?"payload_too_large":"invalid_request";W(o,E==="payload_too_large"?413:400,E,v.message);return}r.class==="broker"&&d.operation.resource==="human"&&await X(d.operation,r,d.params,s.searchParams,f);const i=ae(t.headers),h={...i===void 0?{}:{causedBy:i},method:u,path:s.pathname,params:d.params,query:s.searchParams,body:f,ceiling:n,principal:r,...r.class==="anonymous"&&typeof t.headers.authorization=="string"?{publishToken:t.headers.authorization.slice(7)}:{},req:t,res:o},w=await d.handler(h);o.writableEnded||ce(o,w)}catch(s){if(s instanceof Error&&s.code==="person_unresolved"){b(o,503,{error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}});return}const{status:u,body:d}=z(s);u>=500&&D({event:"api.request.failed",level:"error",error:s instanceof Error?s:new Error(String(s)),...r.class==="broker"?{node_id:r.node}:{},fields:{method:(t.method??"GET").toUpperCase(),path:t.url??""}}),b(o,u,d)}}}function T(e){return e.split("/").filter(t=>t.length>0)}a(T,"splitPath");function ue(e,t){if(e.length!==t.length)return null;const o={};for(let n=0;n<e.length;n++){const r=e[n],s=t[n];if(r.startsWith(":"))o[r.slice(1)]=decodeURIComponent(s);else if(r!==s)return null}return o}a(ue,"matchSegments");class U extends Error{static{a(this,"BodyTooLargeError")}}async function de(e,t){const o=[];let n=0;for await(const s of e){const u=s;if(n+=u.length,n>t)throw new U(`request body exceeds ${t} bytes`);o.push(u)}if(n===0)return;const r=Buffer.concat(o).toString("utf8").trim();if(r!=="")try{return JSON.parse(r)}catch{throw new Error("request body is not valid JSON")}}a(de,"readJsonBody");function ce(e,t){if(e.headersSent)return;const o={...t.headers??{}};if(t.rawBody!==void 0){e.writeHead(t.status,o),e.end(t.rawBody);return}if(t.status===204||t.body===void 0){e.writeHead(t.status,o),e.end();return}o["content-type"]===void 0&&(o["content-type"]="application/json; charset=utf-8"),e.writeHead(t.status,o),e.end(JSON.stringify(t.body))}a(ce,"writeResult");function b(e,t,o){if(e.headersSent){e.end();return}e.writeHead(t,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify(o))}a(b,"writeJson");function W(e,t,o,n){b(e,t,{error:{code:o,message:n,origin:"runtime"}})}a(W,"writeError");export{re as CAUSED_BY_HEADER,$e as Router,y as actsAsPerson,p as appOf,oe as assertCeiling,K as canReadNode,qe as canReadRun,ae as causedByOf,l as mayOnNode,Ce as ownerOnly,ne as ownerOnlyError,Ae as readableNodeIds,Oe as requireRun,O as resolvedScopes,C as runCallerApp};
+var P=Object.defineProperty;var d=(e,t)=>P(e,"name",{value:t,configurable:!0});import{toErrorBody as H}from"./map.js";import{emitEvent as D}from"../../core/events/emit.js";import{scopeAllowed as _,ScopeDeniedError as I}from"../../core/scopes.js";import{coveredByAny as L}from"../../shared/env.js";import{ApiError as u}from"../../api/errors.js";import{activeGrant as F,grantFor as S}from"../../core/grants/mirror.js";import{getNode as w}from"../../core/canvas/canvas.js";import{ownedRun as J,RunError as b}from"../../core/runs/operations.js";import{openDb as x}from"../../core/canvas/db.js";import{check as Y,permits as M}from"../../core/permissions/evaluator.js";import{readerFor as R}from"./reader.js";import{checkCronFire as Z}from"../cron/authority.js";import{operationFor as V}from"./operations.js";import{CONTROL_BODY_MAX_BYTES as X}from"../../core/llm/body-limits.js";import{getRequest as p,getRequestByInboxTicket as A}from"../../core/human/requests.js";import{requireVisibleReview as y}from"../../core/review/store.js";import{getComment as v}from"../../core/review/comments.js";import{getStructuredRequest as K}from"../../core/canvas/structured-requests.js";async function Q(e,t,n,o,s){const r=e.path,a=s&&typeof s=="object"&&!Array.isArray(s)?s:{};if(r==="/v1/human/requests"||r==="/v1/human/reviews"){const i=r.endsWith("/reviews")?a.origin_node_id:a.requester_node_id,c=r==="/v1/human/requests"&&i==null;if(i!==t.node&&!c)throw new u(403,"other_app_run","a broker may create a human request only for its own node");const h=a.source;if(h&&typeof h=="object"&&"nodeId"in h&&h.nodeId!==t.node)throw new u(403,"other_app_run","request source must name the calling node")}if(r==="/v1/human/reviews/self/comments"&&e.method==="GET"&&o.get("actor_node_id")!==t.node)throw new u(403,"other_app_run","self review requires the calling node");if(r.includes("/comments")&&e.method!=="GET"&&a.actor_node_id!==t.node)throw new u(403,"other_app_run","comment author must be the calling node");if(n.comment_id&&!await v(n.comment_id))throw new u(404,"not_found","comment not found")}d(Q,"authorizeHumanBody");function O(e){return e.class==="broker"||e.class==="cron"}d(O,"boundedByStoredScopes");function k(e){return e.class==="person"||e.class==="anonymous"||e.class==="machine"?null:e.class==="forwarded"?e.actor.kind==="app"?e.actor.app:null:e.app}d(k,"appOf");function g(e){return e.class==="person"&&e.sub===void 0||e.class==="forwarded"&&e.actor.kind==="person"}d(g,"actsAsPerson");async function C(e){const t=await S(e.actor.app,e.sub);if(!t)throw new u(403,"app_not_granted",`${e.actor.app} holds no active grant for ${e.sub} on this machine`);return t}d(C,"forwardedGrant");async function $(e){if(e.class==="person"||e.class==="anonymous"||e.class==="machine")return[];if(e.class==="forwarded"){if(e.actor.kind==="person")return[];const{resolved:n}=await C(e),o=e.actor.node_scopes;return o===null?n:o.filter(s=>L(n,s))}if(e.class==="app")return e.scopes;if(e.class==="cron"){const n=await Z({grantee:e.app,sub:e.sub,grant_id:e.grant,scopes:e.scopes});if(n.allowed)return n.effectiveScopes;throw n.reason==="grant_missing"||n.reason==="grant_revoked"?new u(401,"grant_revoked",n.message):new u(403,"scope_missing",n.message)}const t=e.grant?await F(e.grant):await S(e.app,e.sub);if(t&&t.grantee===e.app&&t.sub===e.sub)return t.resolved;throw new u(401,"grant_revoked","the node grant is not active")}d($,"resolvedScopes");function N(e){return"class"in e?k(e):e.grantee}d(N,"runCallerApp");function T(e){return"class"in e?e:{class:"app",app:e.grantee,scopes:e.resolved,sub:e.sub}}d(T,"asRequestPrincipal");async function f(e,t,n){const o=T(e);if(g(o))return!0;if(o.class==="anonymous"||o.class==="machine")return!1;const s=await x();return await Y(s,await R(s,{principal:o}),t,n)}d(f,"mayOnNode");async function Te(e){if(g(e))return null;if(e.class==="anonymous"||e.class==="machine")return new Set;const t=await x(),n=await M(t,await R(t,{principal:e}),"read"),o=await t.prepareUncached(`SELECT o.id FROM objects o WHERE o.type = 'node' AND o.deleted_at IS NULL AND ${n.sql}`).all(...n.params);return new Set(o.map(s=>s.id))}d(Te,"readableNodeIds");async function W(e,t,n){const o=T(e);return g(o)?!0:o.class==="anonymous"||o.class==="machine"?!1:k(o)===t?!0:_(await $(o),n)&&(!O(o)||_(o.scopes,n))}d(W,"mayReadApp");async function We(e,t,n){return n===void 0?await W(e,t,`crtr:conversations:read:${t}`):await f(e,"read",n)}d(We,"canReadRun");async function ze(e,t,n=!1,o=!1){const s=await w(t);if(!s||s.parent!==null||s.run_id!==t||!s.grantee||s.deleting_at&&!o)throw new b(404,"not_found","run not found");if(!await f(e,"read",t))throw new b(404,"not_found","run not found");if(n&&N(e)!==null&&N(e)!==s.grantee)throw new b(403,"other_app_run","cannot change another app's run");return await J(t,s.grantee,o)}d(ze,"requireRun");async function ee(e,t,n){return n===void 0?await W(e,t,`crtr:objects:read:${t}`):await f(e,"read",n)}d(ee,"canReadNode");const z=new Set(["messages.post.58","messages.post.59"]);async function te(e,t,n){if(!e.classes.includes(t.class)&&!(t.class!=="anonymous"&&t.class!=="machine"&&t.class!=="forwarded"&&e.classes.includes("anonymous")))throw new u(403,"permission_error","this operation is not available to the caller");if(t.class==="forwarded"&&t.actor.kind==="app"&&await C(t),t.class==="anonymous"||t.class==="machine"||g(t))return;if(t.class==="person")return await ne(e,t,n);const o=await $(t);if(e.scope&&(!_(o,e.scope)||O(t)&&!_(t.scopes,e.scope)))throw new u(403,"scope_missing",`missing scope ${e.scope}`);if(t.class==="app")return;const s=k(t);t.class==="broker"&&await ae(e,t,n,o);const r=n.id;if((e.resource==="node-read"||e.resource==="node-write")&&r!==void 0){const a=await w(r);if(!a)return;if(e.resource==="node-write"){const i=z.has(e.name);if(a.grantee!==s&&!i)throw new u(403,"other_app_run","cannot change another app's node");if(!await f(t,i&&a.grantee!==s?"message":"read",r))throw a.grantee!==s?new u(403,"other_app_run","cannot change another app's node"):new u(404,"not_found","node not found")}if(e.resource==="node-read"&&!await f(t,"read",r))throw new u(404,"not_found","node not found")}}d(te,"authorizeOperation");async function ne(e,t,n){if(e.resource==="daemon-bash")throw new u(403,"permission_error","a shell on the daemon host is not available to a person bearer");if(e.resource==="human")return await oe(e,t,n);if(n.request_id!==void 0&&e.path.startsWith("/v1/structured-requests/"))return await re(e,t,n.request_id);const o=n.id;if(!(e.resource!=="node-read"&&e.resource!=="node-write"||o===void 0||!await w(o))&&!await f(t,z.has(e.name)?"message":"read",o))throw new u(404,"not_found","node not found")}d(ne,"authorizePersonNode");async function oe(e,t,n){const o=n.ticket_id!==void 0?new u(404,"ticket_not_found","no matching ticket"):new u(404,"not_found","no request with that id"),s=n.request_id?await p(n.request_id):n.ticket_id?await A(n.ticket_id):null,r=n.comment_id?await v(n.comment_id):null,a=n.review_id?await y(n.review_id).catch(()=>null):r?await y(r.review_id).catch(()=>null):null;if((n.request_id??n.ticket_id??n.review_id??n.comment_id)===void 0)return;const c=s?.requester_node_id??a?.origin_node_id;if(!c||!await w(c)||!await f(t,e.method==="GET"?"read":"edit",c))throw o}d(oe,"authorizePersonHuman");async function re(e,t,n){const o=await K(n);if(o!==null&&(o.node_id===null||!await w(o.node_id)||!await f(t,e.method==="GET"?"read":"edit",o.node_id)))throw new u(404,"structured_request_not_found",`unknown structured request: ${n}`)}d(re,"authorizePersonStructuredRequest");async function se(e,t,n){const o=n&&typeof n=="object"&&!Array.isArray(n)?n:{},s=e.path;if(s==="/v1/human/requests"||s==="/v1/human/reviews"){const r=o.source,a=s.endsWith("/reviews")?o.origin_node_id:o.requester_node_id;if(typeof a!="string")throw new u(403,"permission_error","a request must name a node the person acts on");const i=s.endsWith("/requests")&&r&&typeof r=="object"&&"nodeId"in r?r.nodeId:void 0;for(const c of[a,i])if(c!==void 0&&(typeof c!="string"||!await w(c)||!await f(t,"edit",c)))throw new u(404,"not_found","node not found")}if(s==="/v1/structured-requests"){const r=o.target,a=r&&typeof r=="object"&&"kind"in r&&r.kind==="node"&&"node_id"in r?r.node_id:void 0;if(typeof a=="string"&&await w(a)&&!await f(t,"message",a))throw new u(404,"node_not_found",`unknown node: ${a}`)}}d(se,"authorizePersonBody");async function ae(e,t,n,o){if(e.resource==="daemon-bash"&&(!_(o,"crtr:files:rw:user:.")||!_(t.scopes,"crtr:files:rw:user:.")))throw new u(403,"scope_missing","missing scope crtr:files:rw:user:.");if(e.resource==="human"){const r=e.path,a=e.method==="GET";if(!a&&(r.endsWith("/respond")||r.endsWith("/submit")||r.endsWith("/dismiss")||r.endsWith("/progress")||r.endsWith("/comment-ranges")||r.includes("/feedback-comments")))throw new u(403,"permission_error","only the person may answer or edit the human inbox");const i=n.request_id?await p(n.request_id):n.ticket_id?await A(n.ticket_id):null,c=n.comment_id?await v(n.comment_id):null,h=n.review_id?await y(n.review_id):c?await y(c.review_id):null,m=i?.requester_node_id??h?.origin_node_id;if(m!=null){const l=await w(m);if(l&&(a?!await ee(t,l.grantee??"app:terminal",m):l.grantee!==t.app))throw new u(a?404:403,a?"not_found":"other_app_run","human request belongs to another app");if(l&&!a&&!await f(t,"read",m))throw new u(404,"not_found","human request not found")}else if(i||h)throw new u(403,"permission_error","only the person may access a request without a node")}const s=n.id;if(e.resource==="node-own"&&s!==void 0&&s!==t.node)throw new u(403,"other_app_run","the operation requires the calling node")}d(ae,"authorizeBrokerOnly");function de(e,t){if(!_(e,t))throw new I("the bearer token",t)}d(de,"assertCeiling");function ue(){return new u(403,"owner_only","this operation is owner-only; a scoped token does not reach it")}d(ue,"ownerOnlyError");const ie="Crtr-Caused-By",ce=/^(?:message|request|cron_run):[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function fe(e){const t=e[ie.toLowerCase()];return typeof t=="string"&&ce.test(t)?t:void 0}d(fe,"causedByOf");function Ue(e){return e.map(t=>({...t,ownerOnly:!0}))}d(Ue,"ownerOnly");class Ge{static{d(this,"Router")}routes=[];register(t){const n=V(t.method,t.pattern);if(!n)throw new Error(`route has no operation row: ${t.method} ${t.pattern}`);if(this.routes.some(o=>o.method===t.method.toUpperCase()&&o.operation.path===t.pattern))throw new Error(`duplicate route: ${t.method} ${t.pattern}`);return this.routes.push({operation:n,method:t.method.toUpperCase(),segments:U(t.pattern),handler:t.handler,maxBodyBytes:t.maxBodyBytes??X}),this}registerAll(t){for(const n of t)this.register(n);return this}match(t,n){const o=t.toUpperCase(),s=U(n);for(const r of this.routes){if(r.method!==o)continue;const a=he(r.segments,s);if(a!==null)return{handler:r.handler,params:a,operation:r.operation,maxBodyBytes:r.maxBodyBytes}}return null}async handle(t,n,o,s={class:"person"}){try{const r=new URL(t.url??"/","http://127.0.0.1"),a=(t.method??"GET").toUpperCase(),i=this.match(a,r.pathname);if(i===null){j(n,404,"not_found",`no route for ${a} ${r.pathname}`);return}if(await te(i.operation,s,i.params),o!==null){if(i.operation.classes.length===1&&i.operation.classes[0]==="person")throw ue();i.operation.scope&&de(o,i.operation.scope)}let c;try{c=await we(t,i.maxBodyBytes)}catch(E){const B=E instanceof G?"payload_too_large":"invalid_request";j(n,B==="payload_too_large"?413:400,B,E.message);return}s.class==="person"&&s.sub!==void 0&&await se(i.operation,s,c),s.class==="broker"&&i.operation.resource==="human"&&await Q(i.operation,s,i.params,r.searchParams,c);const h=fe(t.headers),m={...h===void 0?{}:{causedBy:h},method:a,path:r.pathname,params:i.params,query:r.searchParams,body:c,ceiling:o,principal:s,...s.class==="anonymous"&&typeof t.headers.authorization=="string"?{publishToken:t.headers.authorization.slice(7)}:{},req:t,res:n},l=await i.handler(m);n.writableEnded||me(n,l)}catch(r){if(r instanceof Error&&r.code==="person_unresolved"){q(n,503,{error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}});return}const{status:a,body:i}=H(r);a>=500&&D({event:"api.request.failed",level:"error",error:r instanceof Error?r:new Error(String(r)),...s.class==="broker"?{node_id:s.node}:{},fields:{method:(t.method??"GET").toUpperCase(),path:t.url??""}}),q(n,a,i)}}}function U(e){return e.split("/").filter(t=>t.length>0)}d(U,"splitPath");function he(e,t){if(e.length!==t.length)return null;const n={};for(let o=0;o<e.length;o++){const s=e[o],r=t[o];if(s.startsWith(":"))n[s.slice(1)]=decodeURIComponent(r);else if(s!==r)return null}return n}d(he,"matchSegments");class G extends Error{static{d(this,"BodyTooLargeError")}}async function we(e,t){const n=[];let o=0;for await(const r of e){const a=r;if(o+=a.length,o>t)throw new G(`request body exceeds ${t} bytes`);n.push(a)}if(o===0)return;const s=Buffer.concat(n).toString("utf8").trim();if(s!=="")try{return JSON.parse(s)}catch{throw new Error("request body is not valid JSON")}}d(we,"readJsonBody");function me(e,t){if(e.headersSent)return;const n={...t.headers??{}};if(t.rawBody!==void 0){e.writeHead(t.status,n),e.end(t.rawBody);return}if(t.status===204||t.body===void 0){e.writeHead(t.status,n),e.end();return}n["content-type"]===void 0&&(n["content-type"]="application/json; charset=utf-8"),e.writeHead(t.status,n),e.end(JSON.stringify(t.body))}d(me,"writeResult");function q(e,t,n){if(e.headersSent){e.end();return}e.writeHead(t,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify(n))}d(q,"writeJson");function j(e,t,n,o){q(e,t,{error:{code:n,message:o,origin:"runtime"}})}d(j,"writeError");export{ie as CAUSED_BY_HEADER,Ge as Router,g as actsAsPerson,k as appOf,de as assertCeiling,ee as canReadNode,We as canReadRun,fe as causedByOf,f as mayOnNode,Ue as ownerOnly,ue as ownerOnlyError,Te as readableNodeIds,ze as requireRun,$ as resolvedScopes,N as runCallerApp};

package/dist/daemon/api/server.d.ts

@@ -1,6 +1,10 @@
-import { type IncomingMessage } from 'node:http';
+import { type IncomingMessage, type Server as HttpServer } from 'node:http';
+import { type Server as HttpsServer } from 'node:https';
+import type { Duplex } from 'node:stream';
 import { Router, type RequestPrincipal } from './router.js';
 export interface CreateApiServerOptions {
+    /** Where the unix socket binds. Defaults to `apiSocketPath()`; a test host binds elsewhere behind a forwarding proxy. */
+    socketPath?: string;
     /** Opt-in TCP listener as `host:port` (or `:port` for all interfaces).
      *  Falls back to `CRTRD_TCP`, then the user setting. Absent → unix socket only. */
     tcp?: string;
@@ -12,8 +16,12 @@ export interface ApiServer {
     ready: Promise<void>;
     /** The actual bound TCP address, including a kernel-selected port; null when TCP is off or not yet bound. */
     tcpAddress(): string | null;
-    /** Tear down both listeners and unlink the socket file. Double-close safe. */
-    close(): Promise<void>;
+    /** Tear down both listeners and unlink the socket file. Double-close safe. Without `graceMs` every connection is dropped at
+     *  once. With it the listeners stop accepting, attach sockets close, and in-flight requests run until they end or
+     *  `graceMs` passes; then the remaining connections are dropped. */
+    close(opts?: {
+        graceMs?: number;
+    }): Promise<void>;
 }
 /** Build the Router loaded with every handler route table (A-7). The order is
  *  irrelevant — the matcher is exact method+path — but `healthRoutes` (which
@@ -21,6 +29,10 @@ export interface ApiServer {
 export declare function buildRouter(tcpAddress: () => string | null): Router;
 export type SocketPrincipal = RequestPrincipal;
 export declare function socketPrincipal(req: IncomingMessage): SocketPrincipal | undefined;
+/** Close one http.Server. Without `graceMs` every connection drops at once. With it, new connections are refused, upgraded
+ *  (attach) sockets close with 1001 at once, idle keep-alives are dropped as they appear, and in-flight requests run until
+ *  they end or `graceMs` passes; then every remaining connection is dropped. */
+export declare function closeServer(server: HttpServer | HttpsServer, upgraded: ReadonlySet<Duplex>, graceMs?: number): Promise<void>;
 /** Create and start the crtrd API server. Returns immediately with a `close()`
  *  handle and a `ready` promise for the mandatory Unix socket bind. TCP remains
  *  opt-in, and its bind or post-listen accept errors are emitted but non-fatal.

package/dist/daemon/api/server.js

@@ -1 +1 @@
-var pe=Object.defineProperty;var a=(t,i)=>pe(t,"name",{value:i,configurable:!0});import{createServer as F}from"node:http";import{chmodSync as de,existsSync as H,unlinkSync as G}from"node:fs";import{MINIMUM_RUNTIME_VERSION_HEADER as J,RUNTIME_VERSION_HEADER as P,minimumRuntimeRefusal as me}from"../../api/runtime-version.js";import{CONTRACT_HEADER as I,CONTRACT_LEVEL as V,REQUIRED_CONTRACT_HEADER as K,contractRefusal as fe}from"../../api/contract.js";import{crtrVersion as x}from"../../shared/crtr-version.js";import{apiSocketPath as ge}from"../../core/canvas/paths.js";import{resolveNodeToken as he}from"../../core/canvas/node-tokens.js";import{grantFor as Ae,hasSyncedGrants as Re}from"../../core/grants/mirror.js";import{readConfig as B}from"../../core/config.js";import{peerUid as ye}from"../../native/linux.js";import{findScopedApiToken as ve,getApiToken as be,listScopedApiTokens as we}from"../../core/secrets.js";import{emitEvent as g}from"../../core/events/emit.js";import{envCrtrdTcp as Ee,envCrtrdToken as _e}from"../../shared/env.js";import{Router as Q}from"./router.js";import{handleAttachUpgrade as Se,refuseUpgrade as h}from"./bridge.js";import{boundDaemonControl as Te}from"../control.js";import{attachRoutes as Ce,mayAttachNode as X}from"./handlers/attach.js";import{peerRoutes as ke}from"../peer/handlers.js";import{bashJobRoutes as Oe}from"./handlers/bash-jobs.js";import{bashRoutes as Ue}from"./handlers/bash.js";import{hookExecRoutes as Ne}from"./handlers/hook-exec.js";import{brokerOperationRoutes as Y}from"./handlers/broker-ops.js";import{brokerSignalRoutes as ze,brokerSignalStreams as He}from"./handlers/broker-signals.js";import{brokerRecoveryRoutes as Z,nodeFaultRoutes as Pe}from"./handlers/broker-recovery.js";import{canvasRoutes as Ie}from"./handlers/canvas.js";import{chatInventoryRoutes as xe}from"./handlers/chat-inventory.js";import{daemonRoutes as Be}from"./handlers/daemon.js";import{fileRoutes as $e}from"./handlers/files.js";import{focusRoutes as Le}from"./handlers/focus.js";import{analyticsRoutes as We}from"./handlers/analytics.js";import{memoryReadsRoutes as Me}from"./handlers/memory-reads.js";import{memoryRoutes as je}from"./handlers/memory.js";import{healthRoutes as De}from"./handlers/health.js";import{humanRequestRoutes as Fe}from"./handlers/human-requests.js";import{inboxRoutes as Ge}from"./handlers/inbox.js";import{feedbackCommentRoutes as Je}from"./handlers/feedback-comments.js";import{objectRoutes as Ve}from"./handlers/objects.js";import{shareRoutes as Ke}from"./handlers/shares.js";import{customObjectRoutes as Qe}from"./handlers/custom-objects.js";import{docRoutes as Xe}from"./handlers/docs.js";import{deliveryRoutes as q}from"./handlers/delivery.js";import{deliveryRetryRoutes as Ye}from"./handlers/delivery-retry.js";import{packageDocRoutes as Ze}from"./handlers/package-docs.js";import{documentAccessRoutes as qe}from"./handlers/document-access.js";import{pluginAppRoutes as er}from"./handlers/plugin-app-token.js";import{brokerMailRoutes as ee,messageRoutes as rr}from"./handlers/messages.js";import{modelAuthRoutes as tr}from"./handlers/modelauth.js";import{llmRoutes as or}from"./handlers/llm.js";import{providerRoutes as nr}from"./handlers/providers.js";import{modelConfigRoutes as ir}from"./handlers/model-config.js";import{nodeRoutes as sr}from"./handlers/nodes.js";import{nodeRecordRoutes as lr}from"./handlers/node-records.js";import{nodeOutcomeRoutes as ar}from"./handlers/node-outcomes.js";import{nodeEventRoutes as cr}from"./handlers/node-events.js";import{profileRoutes as ur}from"./handlers/profiles.js";import{prospectiveChatInventoryRoutes as pr}from"./handlers/prospective-chat-inventory.js";import{reportRoutes as dr}from"./handlers/reports.js";import{runRoutes as mr}from"./handlers/run-routes.js";import{reviewCommentRoutes as fr}from"./handlers/review-comments.js";import{reviewRoutes as gr}from"./handlers/reviews.js";import{subscriptionRoutes as hr}from"./handlers/subscriptions.js";import{structuredRequestRoutes as Ar}from"./handlers/structured-requests.js";import{cronRoutes as Rr}from"./handlers/crons.js";import{setCronRequestHandler as re}from"../cron/run-socket.js";import{worktreeRoutes as yr}from"./handlers/worktree.js";import{limitsRoutes as vr}from"./handlers/limits.js";import{chargeRoutes as br,spendLimitRoutes as wr}from"./handlers/charges.js";function Er(t){return new Q().registerAll(De(t)).registerAll(Be).registerAll(Ke).registerAll(sr).registerAll(lr).registerAll(ar).registerAll(Ye).registerAll(cr).registerAll(Oe).registerAll(Ue).registerAll(Ne).registerAll(Y).registerAll(ze).registerAll(q).registerAll(Z).registerAll(Pe).registerAll(yr).registerAll(vr).registerAll(br).registerAll(wr).registerAll(ee).registerAll(rr).registerAll(dr).registerAll(mr).registerAll(Ar).registerAll(Ce).registerAll(Ie).registerAll(We).registerAll(Me).registerAll(je).registerAll($e).registerAll(Ve).registerAll(Qe).registerAll(Xe).registerAll(Ze).registerAll(qe).registerAll(er).registerAll(Le).registerAll(hr).registerAll(Rr).registerAll(ur).registerAll(tr).registerAll(or).registerAll(nr).registerAll(ir).registerAll(gr).registerAll(fr).registerAll(Ge).registerAll(Fe).registerAll(xe).registerAll(pr).registerAll(Je).registerAll(ke)}a(Er,"buildRouter");function _r(t,i){if(t.toUpperCase()!=="GET")return null;const c=i.split("/").filter(f=>f.length>0);if(c.length!==4||c[0]!=="v1"||c[1]!=="nodes"||c[3]!=="attach")return null;const d=c[2];return d===void 0||d===""?null:decodeURIComponent(d)}a(_r,"attachNodeId");function Sr(t){const i=t.trim();if(i==="")return null;const c=i.lastIndexOf(":");if(c<0)return null;const d=i.slice(0,c),f=i.slice(c+1),m=Number(f);return!Number.isInteger(m)||m<0||m>65535?null:{host:d===""?"0.0.0.0":d,port:m}}a(Sr,"parseTcp");function Tr(t,i){return`${t.includes(":")?`[${t}]`:t}:${i}`}a(Tr,"formatTcpAddress");const R={code:"unauthorized",message:"missing or invalid bearer token"},v={code:"owner_only",message:"attach is owner-only; a scoped token does not reach it"},$={class:"anonymous",app:"",node:"",run:null,uid:-1,sub:"",grant:null,client_id:null,scopes:[]},b=new WeakMap;function O(t){return b.get(t)}a(O,"socketPrincipal");async function te(t,i){const c=process.platform==="linux"?ye(t.socket):null,d=t.headers.authorization;if(d===void 0)return c===null||i.has(c)?{class:"person"}:"unauthorized";if(typeof d!="string"||!d.startsWith("Bearer "))return"unauthorized";if(d.slice(7).startsWith("crtr_pub_"))return $;if(d.slice(7).startsWith(L)){const A=U(d.slice(7));return A!==void 0&&(c===null||i.has(c))?A.principal:"unauthorized"}const f=await he(d.slice(7));if(!f||c!==null&&c!==f.uid)return"unauthorized";const m=B("user").runtime?.issuer;if(m&&!await Re(m.replace(/\/$/,"")))return"runtime_starting";const C=f.grant??(await Ae("app:terminal",f.sub))?.id??null;return{class:"broker",...f,grant:C}}a(te,"resolveSocketPrincipal");const L="crtr_app_";function U(t){const i=t.startsWith(L)?ve(t):void 0;return i===void 0?void 0:{principal:{class:"app",app:i.grantee,scopes:i.scopes},ceiling:i.scopes}}a(U,"appBearer");function Cr(t){const i=new Map;for(const c of we("user"))i.set(c.token,{principal:{class:"app",app:c.grantee,scopes:c.scopes},ceiling:c.scopes});return i.set(t,{principal:{class:"person"},ceiling:null}),i}a(Cr,"resolveBearers");function oe(t,i){const c=t.headers.authorization;if(typeof c!="string"||!c.startsWith("Bearer "))return;const d=c.slice(7);return d.startsWith(L)?U(d):i.get(d)}a(oe,"authorize");function N(t){t.setHeader(P,x()),t.setHeader(I,V)}a(N,"advertiseRuntime");function S(t){t.setHeader("Access-Control-Allow-Origin","*"),t.setHeader("Access-Control-Expose-Headers",`${P}, ${I}`)}a(S,"exposeRuntimeHeaders");function ne(t,i){return(t.method??"GET").toUpperCase()!=="OPTIONS"?!1:(N(i),i.writeHead(204,{"Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":`${P}, ${I}`,"Access-Control-Allow-Headers":`authorization, content-type, ${J.toLowerCase()}, ${K.toLowerCase()}`,"Access-Control-Allow-Methods":"GET, POST, PATCH, PUT, DELETE, OPTIONS","Access-Control-Max-Age":"600"}),i.end(),!0)}a(ne,"answerPreflight");function T(t,i=!1){N(t),i&&S(t),t.writeHead(401,{"content-type":"application/json; charset=utf-8"}),t.end(JSON.stringify({error:{...R,origin:"runtime"}}))}a(T,"writeUnauthorized");function kr(t,i){t.writeHead(503,{"content-type":"application/json; charset=utf-8"}),t.end(JSON.stringify({error:{code:"startup_blocked",message:i,origin:"runtime"}}))}a(kr,"writeStartupBlocked");function ie(t){return new Promise(i=>{try{t.closeAllConnections()}catch{}t.close(()=>i())})}a(ie,"closeServer");function Ft(t={}){let i=null;const c=Er(()=>i),d=new Q().registerAll(Y).registerAll(q).registerAll(Z).registerAll(ee),f=a((e,r)=>{const o=Te()?.startupBlock()??null;return o===null||e==="GET"&&(r==="/healthz"||r==="/v1/status"||r==="/v1/ready")||e==="POST"&&(r==="/v1/daemon/migrate"||r==="/v1/daemon/admit")||o.phase==="recovering"&&d.match(e,r)!==null?null:o},"startupBlockFor"),m=ge(),C=new Set([process.getuid?.()??0,...B("user").runtime?.person_uids??[]]),A=a((e,r,o)=>{N(r);const l=a(u=>Array.isArray(u)?u[0]:u,"first"),w=l(e.headers[J.toLowerCase()]),n=me(w,x())??fe(l(e.headers[K.toLowerCase()]),V,{legacyMinimum:w,runtimeVersion:x()});if(n!==null){r.writeHead(n.status,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:n.code,message:n.message,type:"invalid_request_error",origin:"runtime",retryable:!1,..."param"in n?{param:n.param}:{details:n.details}}}));return}const s=a(u=>{const E=O(e);g({event:"api.request.failed",level:"error",...E?.class==="broker"?{node_id:E.node}:{},error:u instanceof Error?u:new Error(String(u))});try{r.headersSent||r.writeHead(500,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"internal",message:"internal error",origin:"runtime"}}))}catch{}},"internalFailure");let p;try{p=new URL(e.url??"/","http://127.0.0.1")}catch{try{r.writeHead(400,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"invalid_request",message:"request URL is invalid",origin:"runtime"}}))}catch{}return}try{const u=f((e.method??"GET").toUpperCase(),p.pathname);if(u!==null){kr(r,u.message);return}c.handle(e,r,o,O(e)??{class:"person"}).catch(s)}catch(u){s(u)}},"onRequest"),se=a(async(e,r,o)=>{const l=O(e);return l===void 0||l.class==="person"||await X(l,"either",o)?!0:(h(r,404,"Not Found","node_not_found",`no node ${o}`),!1)},"authorizeAttachUpgrade"),z=a((e,r,o)=>{r.on("error",()=>{});try{const l=new URL(e.url??"/","http://127.0.0.1"),w=f((e.method??"GET").toUpperCase(),l.pathname);if(w!==null){h(r,503,"Service Unavailable","startup_blocked",w.message);return}const n=_r(e.method??"GET",l.pathname);if(n===null){r.destroy();return}se(e,r,n).then(s=>s?Se(e,r,o,n,async p=>{const u=O(e);return u===void 0||u.class==="person"||await X(u,p,n)}):void 0).catch(()=>{try{r.destroy()}catch{}})}catch{try{r.destroy()}catch{}}},"onUpgrade"),le=a(e=>{e.on("error",r=>{g({event:"api.server.failed",level:"error",error:r})})},"bindErrorHandler"),ae=a(async(e,r)=>{try{const o=await te(e,C);if(o==="unauthorized"){g({event:"api.principal.denied",level:"warn",fields:{method:e.method}}),T(r);return}if(o==="runtime_starting"){N(r),r.writeHead(503,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify({error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}}));return}b.set(e,o),o.class==="broker"&&g({event:"api.request.principal",level:o.app==="app:terminal"?"debug":"info",node_id:o.node,fields:{principal:`${o.app} node:${o.node}`,method:e.method,path:e.url}}),A(e,r,o.class==="app"?o.scopes:null)}catch(o){g({event:"api.principal.failed",level:"error",error:o instanceof Error?o:new Error(String(o))}),T(r)}},"onSocketRequest"),_=F((e,r)=>{ae(e,r).catch(o=>g({event:"api.principal.failed",level:"error",error:o instanceof Error?o:new Error(String(o))}))}),ce=a(async(e,r,o)=>{try{const l=await te(e,C);if(l==="unauthorized"||l==="runtime_starting"){l==="unauthorized"&&g({event:"api.principal.denied",level:"warn",fields:{method:e.method}}),h(r,l==="unauthorized"?401:503,"Unauthorized",l,"socket principal unavailable");return}if(l.class!=="person"&&l.class!=="broker"){h(r,403,"Forbidden",v.code,v.message);return}b.set(e,l),z(e,r,o)}catch(l){g({event:"api.principal.failed",level:"error",error:l instanceof Error?l:new Error(String(l))}),h(r,401,"Unauthorized",R.code,R.message)}},"onSocketUpgrade");_.on("upgrade",(e,r,o)=>{ce(e,r,o).catch(l=>g({event:"api.principal.failed",level:"error",error:l instanceof Error?l:new Error(String(l))}))}),re((e,r,o)=>{b.set(e,o),A(e,r,null)});let W=!1,M,j;const ue=new Promise((e,r)=>{M=e,j=r});_.once("listening",()=>{W=!0,M()}),_.on("error",e=>{g({event:"api.server.failed",level:"error",error:e}),W||j(e)});try{H(m)&&G(m)}catch{}_.listen(m,()=>{try{de(m,process.platform==="linux"&&H("/run/crtr/launcher.sock")?438:384)}catch(e){g({event:"api.socket.chmod_failed",level:"error",error:e instanceof Error?e:new Error(String(e))})}});let y;const k=t.tcp??Ee()??B("user").api.tcp;if(k!==void 0&&k!==""){const e=Sr(k);if(e===null)g({event:"api.tcp.invalid",level:"error",error:new Error(`invalid CRTRD_TCP/--tcp spec: ${k}`)});else{const r=t.token??_e()??be("user"),o=r===void 0?void 0:Cr(r),l=o===void 0?(n,s)=>{if(ne(n,s))return;const p=n.headers.authorization;if(typeof p=="string"&&p.startsWith("Bearer crtr_pub_"))b.set(n,$),S(s);else if(n.headers.origin!==void 0){T(s,!0);return}else if(p!==void 0){const E=typeof p=="string"&&p.startsWith("Bearer ")?U(p.slice(7)):void 0;if(E===void 0){T(s,!0);return}b.set(n,E.principal),S(s),A(n,s,E.ceiling);return}A(n,s,null)}:(n,s)=>{if(ne(n,s))return;const p=oe(n,o);if(p===void 0&&n.headers.authorization?.startsWith("Bearer crtr_pub_")){b.set(n,$),S(s),A(n,s,null);return}if(p===void 0){T(s,!0);return}b.set(n,p.principal),S(s),A(n,s,p.ceiling)},w=o===void 0?(n,s,p)=>{if(n.headers.origin!==void 0){h(s,401,"Unauthorized",R.code,R.message);return}const u=n.headers.authorization;if(u!==void 0){if(typeof u=="string"&&u.startsWith("Bearer crtr_pub_")){h(s,403,"Forbidden",v.code,v.message);return}(typeof u=="string"&&u.startsWith("Bearer ")?U(u.slice(7)):void 0)===void 0?h(s,401,"Unauthorized",R.code,R.message):h(s,403,"Forbidden",v.code,v.message);return}z(n,s,p)}:(n,s,p)=>{const u=oe(n,o);if(u===void 0){h(s,401,"Unauthorized",R.code,R.message);return}if(u.ceiling!==null){h(s,403,"Forbidden",v.code,v.message);return}z(n,s,p)};y=F(l),y.on("upgrade",w),le(y),y.once("listening",()=>{const n=y?.address();if(n!==null&&typeof n=="object"){const{address:s,port:p}=n;i=Tr(s,p)}}),y.listen(e.port,e.host)}}let D=!1;return{ready:ue,tcpAddress:a(()=>i,"tcpAddress"),close:a(async()=>{if(!D){D=!0,re(null),He.close(),await Promise.all([ie(_),y!==void 0?ie(y):Promise.resolve()]);try{H(m)&&G(m)}catch{}}},"close")}}a(Ft,"createApiServer");export{Er as buildRouter,Ft as createApiServer,O as socketPrincipal};
+var Ce=Object.defineProperty;var i=(e,r)=>Ce(e,"name",{value:r,configurable:!0});import{createServer as Q}from"node:http";import{createServer as Oe}from"node:https";import{chmodSync as Ue,existsSync as D,readFileSync as q,unlinkSync as ee}from"node:fs";import{MINIMUM_RUNTIME_VERSION_HEADER as re,RUNTIME_VERSION_HEADER as x,minimumRuntimeRefusal as ke}from"../../api/runtime-version.js";import{CONTRACT_HEADER as $,CONTRACT_LEVEL as te,REQUIRED_CONTRACT_HEADER as ne,contractRefusal as Pe}from"../../api/contract.js";import{crtrVersion as j}from"../../shared/crtr-version.js";import{apiSocketPath as Ne}from"../../core/canvas/paths.js";import{resolveNodeToken as ze}from"../../core/canvas/node-tokens.js";import{isCloudRole as J,runAsPerson as M}from"../../core/canvas/person.js";import{personBearerVerifier as oe}from"./auth/person-bearer.js";import{personHasSnapshot as ie}from"../../core/scoped-state/person-store.js";import{loadPersonSettings as se}from"../../core/scoped-state/person-rows.js";import{AppPrincipalResolver as He}from"./principal.js";import{handleVendorSignIn as Ie,isVendorSignInPath as Le}from"./vendor-signin.js";import{RunError as b}from"../../core/runs/operations.js";import{removeVendorAccount as Be,vendorStatus as De}from"./handlers/vendor-status.js";import{toErrorBody as xe}from"./map.js";import{CONTROL_BODY_MAX_BYTES as $e}from"../../core/llm/body-limits.js";import{grantFor as je,hasSyncedGrants as Je}from"../../core/grants/mirror.js";import{readConfig as V}from"../../core/config.js";import{peerUid as Me}from"../../native/linux.js";import{findScopedApiToken as Ve,getApiToken as Ge,listScopedApiTokens as We}from"../../core/secrets.js";import{emitEvent as R}from"../../core/events/emit.js";import{envCrtrdTcp as Fe,envCrtrdToken as Ye}from"../../shared/env.js";import{Router as ae,actsAsPerson as le}from"./router.js";import{handleAttachUpgrade as Ze,refuseUpgrade as y}from"./bridge.js";import{boundDaemonControl as Ke}from"../control.js";import{attachRoutes as Xe,mayAttachNode as ce}from"./handlers/attach.js";import{peerRoutes as Qe}from"../peer/handlers.js";import{bashJobRoutes as qe}from"./handlers/bash-jobs.js";import{bashRoutes as er}from"./handlers/bash.js";import{hookExecRoutes as rr}from"./handlers/hook-exec.js";import{brokerOperationRoutes as ue}from"./handlers/broker-ops.js";import{brokerSignalRoutes as tr,brokerSignalStreams as nr}from"./handlers/broker-signals.js";import{brokerRecoveryRoutes as de,nodeFaultRoutes as or}from"./handlers/broker-recovery.js";import{canvasRoutes as ir}from"./handlers/canvas.js";import{conversationRoutes as sr}from"./handlers/conversations.js";import{chatInventoryRoutes as ar}from"./handlers/chat-inventory.js";import{daemonRoutes as lr}from"./handlers/daemon.js";import{fileRoutes as cr}from"./handlers/files.js";import{focusRoutes as ur}from"./handlers/focus.js";import{analyticsRoutes as dr}from"./handlers/analytics.js";import{memoryReadsRoutes as pr}from"./handlers/memory-reads.js";import{memoryRoutes as fr}from"./handlers/memory.js";import{healthRoutes as mr}from"./handlers/health.js";import{humanRequestRoutes as gr}from"./handlers/human-requests.js";import{inboxRoutes as hr}from"./handlers/inbox.js";import{feedbackCommentRoutes as Rr}from"./handlers/feedback-comments.js";import{objectRoutes as Ar}from"./handlers/objects.js";import{shareRoutes as yr}from"./handlers/shares.js";import{customObjectRoutes as vr}from"./handlers/custom-objects.js";import{docRoutes as wr}from"./handlers/docs.js";import{deliveryRoutes as pe}from"./handlers/delivery.js";import{deliveryRetryRoutes as _r}from"./handlers/delivery-retry.js";import{packageDocRoutes as Sr}from"./handlers/package-docs.js";import{documentAccessRoutes as Er}from"./handlers/document-access.js";import{pluginAppRoutes as Tr}from"./handlers/plugin-app-token.js";import{brokerMailRoutes as fe,messageRoutes as br}from"./handlers/messages.js";import{modelAuthRoutes as Cr}from"./handlers/modelauth.js";import{llmRoutes as Or}from"./handlers/llm.js";import{providerRoutes as Ur}from"./handlers/providers.js";import{modelConfigRoutes as kr}from"./handlers/model-config.js";import{settingsRoutes as Pr}from"./handlers/settings.js";import{nodeRoutes as Nr}from"./handlers/nodes.js";import{nodeRecordRoutes as zr}from"./handlers/node-records.js";import{nodeOutcomeRoutes as Hr}from"./handlers/node-outcomes.js";import{nodeEventRoutes as Ir}from"./handlers/node-events.js";import{profileRoutes as Lr}from"./handlers/profiles.js";import{prospectiveChatInventoryRoutes as Br}from"./handlers/prospective-chat-inventory.js";import{reportRoutes as Dr}from"./handlers/reports.js";import{runRoutes as xr}from"./handlers/run-routes.js";import{reviewCommentRoutes as $r}from"./handlers/review-comments.js";import{reviewRoutes as jr}from"./handlers/reviews.js";import{subscriptionRoutes as Jr}from"./handlers/subscriptions.js";import{structuredRequestRoutes as Mr}from"./handlers/structured-requests.js";import{cronRoutes as Vr}from"./handlers/crons.js";import{setCronRequestHandler as me}from"../cron/run-socket.js";import{worktreeRoutes as Gr}from"./handlers/worktree.js";import{limitsRoutes as Wr}from"./handlers/limits.js";import{chargeRoutes as Fr,spendLimitRoutes as Yr}from"./handlers/charges.js";import{executionStartRoutes as Zr}from"./handlers/execution-start.js";import{gitCredentialRoutes as Kr}from"./handlers/git-credential.js";function Xr(e){return new ae().registerAll(mr(e)).registerAll(lr).registerAll(yr).registerAll(Nr).registerAll(zr).registerAll(Hr).registerAll(_r).registerAll(Ir).registerAll(qe).registerAll(er).registerAll(rr).registerAll(ue).registerAll(tr).registerAll(pe).registerAll(de).registerAll(or).registerAll(Gr).registerAll(Wr).registerAll(Fr).registerAll(Zr).registerAll(Kr).registerAll(Yr).registerAll(fe).registerAll(br).registerAll(Dr).registerAll(xr).registerAll(Mr).registerAll(Xe).registerAll(ir).registerAll(sr).registerAll(dr).registerAll(pr).registerAll(fr).registerAll(cr).registerAll(Ar).registerAll(vr).registerAll(wr).registerAll(Sr).registerAll(Er).registerAll(Tr).registerAll(ur).registerAll(Jr).registerAll(Vr).registerAll(Lr).registerAll(Cr).registerAll(Or).registerAll(Ur).registerAll(kr).registerAll(Pr).registerAll(jr).registerAll($r).registerAll(hr).registerAll(gr).registerAll(ar).registerAll(Br).registerAll(Rr).registerAll(Qe)}i(Xr,"buildRouter");function Qr(e,r){if(e.toUpperCase()!=="GET")return null;const s=r.split("/").filter(f=>f.length>0);if(s.length!==4||s[0]!=="v1"||s[1]!=="nodes"||s[3]!=="attach")return null;const o=s[2];return o===void 0||o===""?null:decodeURIComponent(o)}i(Qr,"attachNodeId");function qr(e){const r=e.trim();if(r==="")return null;const s=r.lastIndexOf(":");if(s<0)return null;const o=r.slice(0,s),f=r.slice(s+1),d=Number(f);return!Number.isInteger(d)||d<0||d>65535?null:{host:o===""?"0.0.0.0":o,port:d}}i(qr,"parseTcp");function et(e,r){return`${e.includes(":")?`[${e}]`:e}:${r}`}i(et,"formatTcpAddress");const E={code:"unauthorized",message:"missing or invalid bearer token"},H={code:"owner_only",message:"attach is owner-only; a scoped token does not reach it"},k={code:"person_bearer_not_supported",message:"this listener accepts a person bearer only on a cloud role with CRTR_DIRECTORY_URL and CRTR_PUBLIC_API_URL set; call with a node, app or public token"},G={class:"anonymous",app:"",node:"",run:null,uid:-1,sub:"",grant:null,client_id:null,scopes:[]},C=new WeakMap;function P(e){return C.get(e)}i(P,"socketPrincipal");async function ge(e,r){const s=process.platform==="linux"?Me(e.socket):null,o=e.headers.authorization;if(o===void 0)return s===null||r.has(s)?{class:"person"}:"unauthorized";if(typeof o!="string"||!o.startsWith("Bearer "))return"unauthorized";if(o.slice(7).startsWith("crtr_pub_"))return G;if(o.slice(7).startsWith(W)){const f=ye(o.slice(7));return f!==void 0&&(s===null||r.has(s))?f.principal:"unauthorized"}return he(o.slice(7),s)}i(ge,"resolveSocketPrincipal");async function he(e,r){const s=await ze(e);if(!s||r!==null&&r!==s.uid)return"unauthorized";const o=V("user").runtime?.issuer;if(o&&!await Je(o.replace(/\/$/,"")))return"runtime_starting";const f=s.grant??(await je("app:terminal",s.sub))?.id??null;return{class:"broker",...s,grant:f}}i(he,"brokerPrincipal");function Re(e){if(e.class!=="anonymous")return e.sub!==void 0&&e.sub!==""?e.sub:void 0}i(Re,"requestPerson");function Ae(e,r){r.class==="broker"&&R({event:"api.request.principal",level:r.app==="app:terminal"?"debug":"info",node_id:r.node,fields:{principal:`${r.app} node:${r.node}`,method:e.method,path:e.url}})}i(Ae,"noteBrokerRequest");const W="crtr_app_";function ye(e){const r=e.startsWith(W)?Ve(e):void 0;return r===void 0?void 0:{principal:{class:"app",app:r.grantee,scopes:r.scopes},ceiling:r.scopes}}i(ye,"appBearer");function rt(e){const r=new Map;for(const s of We("user"))r.set(s.token,{principal:{class:"app",app:s.grantee,scopes:s.scopes},ceiling:s.scopes});return e!==void 0&&r.set(e,{principal:{class:"person"},ceiling:null}),r}i(rt,"resolveBearers");const tt=/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;async function ve(e,r){const s=e.headers.authorization;if(s===void 0&&(e.method??"GET").toUpperCase()==="GET"&&(e.url??"").split("?")[0]==="/healthz")return{principal:G,ceiling:null};if(typeof s!="string"||!s.startsWith("Bearer "))return"unauthorized";const o=s.slice(7);if(o.startsWith("crtr_pub_"))return{principal:G,ceiling:null};if(o.startsWith(W))return ye(o)??"unauthorized";const f=r.get(o);if(f!==void 0)return f;if(tt.test(o)){const h=J()?oe():null;if(h===null)return"person_bearer";const m=await h.verify(o);return m===null?"unauthorized":{principal:{class:"person",sub:m},ceiling:null}}const d=await he(o,null);return typeof d=="string"?d:{principal:d,ceiling:null}}i(ve,"authorizeTcp");let I;function nt(){if(I!==void 0)return I;const e=process.env.CRTR_DIRECTORY_URL||void 0,r=process.env.CRTR_PUBLIC_API_URL||void 0;return I=e===void 0||r===void 0?null:new He(e,r,async()=>{}),I}i(nt,"vendorHandoffResolver");async function ot(e,r){T(r),O(r);const s=nt();try{if(s===null)throw new b(503,"runtime_starting","vendor sign-in is not configured on this listener");await Ie(e,r,new URL(e.url??"/","http://runtime.local"),s)}catch(o){if(!(o instanceof b))throw o;if(r.headersSent){r.destroy();return}r.writeHead(o.status,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),r.end(JSON.stringify({error:{code:o.code,message:o.message,...o.param?{param:o.param}:{},origin:"runtime"}}))}}i(ot,"serveVendorSignIn");function it(){const e=process.env.CRTRD_TLS_CERT||void 0,r=process.env.CRTRD_TLS_KEY||void 0;if(e===void 0&&r===void 0)return null;if(e===void 0||r===void 0)throw new Error("CRTRD_TLS_CERT and CRTRD_TLS_KEY must be set together");return{cert:q(e),key:q(r)}}i(it,"tcpTls");function T(e){e.setHeader(x,j()),e.setHeader($,te)}i(T,"advertiseRuntime");function O(e){e.setHeader("Access-Control-Allow-Origin","*"),e.setHeader("Access-Control-Expose-Headers",`${x}, ${$}`)}i(O,"exposeRuntimeHeaders");function st(e,r){return(e.method??"GET").toUpperCase()!=="OPTIONS"?!1:(T(r),r.writeHead(204,{"Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":`${x}, ${$}`,"Access-Control-Allow-Headers":`authorization, content-type, ${re.toLowerCase()}, ${ne.toLowerCase()}`,"Access-Control-Allow-Methods":"GET, POST, PATCH, PUT, DELETE, OPTIONS","Access-Control-Max-Age":"600"}),r.end(),!0)}i(st,"answerPreflight");function L(e,r=!1){T(e),r&&O(e),e.writeHead(401,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{...E,origin:"runtime"}}))}i(L,"writeUnauthorized");function at(e){T(e),O(e),e.writeHead(401,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{...k,origin:"runtime"}}))}i(at,"writePersonBearerRefused");const lt={"/v1/runtime/vendor-status":{method:"GET",purpose:"vendor_status"},"/v1/runtime/vendor-account-remove":{method:"POST",purpose:"vendor_account_remove"}};async function ct(e,r){if(!J())return!1;const s=new URL(e.url??"/","http://runtime.local").pathname,o=lt[s];if(o===void 0||e.method!==o.method)return!1;const f=i((d,h)=>{T(r),O(r),r.writeHead(d,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify(h))},"answer");try{const d=oe();if(d===null)throw new b(401,k.code,k.message);const h=e.headers.authorization,m=h?.startsWith("Bearer ")?await d.verifyPurpose(h.slice(7),o.purpose):null;if(m===null)throw new b(401,"unauthorized","invalid directory token");const B=o.purpose==="vendor_status"?void 0:await ut(e);f(200,await M(m,async()=>o.purpose==="vendor_status"?De():await Be(B)))}catch(d){const{status:h,body:m}=xe(d);f(h,m)}return!0}i(ct,"serveCloudVendorRoute");async function ut(e){const r=[];let s=0;for await(const o of e){if(s+=o.length,s>$e)throw new b(400,"invalid_request","request body too large");r.push(o)}if(s!==0)try{return JSON.parse(Buffer.concat(r).toString("utf8"))}catch{throw new b(400,"invalid_request","invalid JSON body")}}i(ut,"readVendorBody");function we(e){T(e),e.writeHead(503,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}}))}i(we,"writeRuntimeStarting");function dt(e,r){e.writeHead(503,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"startup_blocked",message:r,origin:"runtime"}}))}i(dt,"writeStartupBlocked");function _e(e,r,s){return new Promise(o=>{if(s===void 0){try{e.closeAllConnections()}catch{}e.close(()=>o());return}const f=[];e.close(()=>{for(const m of f)clearTimeout(m);o()});for(const m of r)m.destroy();const d=setInterval(()=>e.closeIdleConnections(),250),h=setTimeout(()=>e.closeAllConnections(),s);f.push(d,h),e.closeIdleConnections()})}i(_e,"closeServer");function Vn(e={}){let r=null;const s=Xr(()=>r),o=new ae().registerAll(ue).registerAll(pe).registerAll(de).registerAll(fe),f=i((t,n)=>{const l=Ke()?.startupBlock()??null;return l===null||t==="GET"&&(n==="/healthz"||n==="/v1/status"||n==="/v1/ready")||t==="POST"&&(n==="/v1/daemon/migrate"||n==="/v1/daemon/admit")||l.phase==="recovering"&&o.match(t,n)!==null?null:l},"startupBlockFor"),d=e.socketPath??Ne(),h=new Set([process.getuid?.()??0,...V("user").runtime?.person_uids??[]]),m=i((t,n,l)=>{T(n);const u=i(a=>Array.isArray(a)?a[0]:a,"first"),S=u(t.headers[re.toLowerCase()]),g=ke(S,j())??Pe(u(t.headers[ne.toLowerCase()]),te,{legacyMinimum:S,runtimeVersion:j()});if(g!==null){n.writeHead(g.status,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:g.code,message:g.message,type:"invalid_request_error",origin:"runtime",retryable:!1,..."param"in g?{param:g.param}:{details:g.details}}}));return}const v=i(a=>{const c=P(t);R({event:"api.request.failed",level:"error",...c?.class==="broker"?{node_id:c.node}:{},error:a instanceof Error?a:new Error(String(a))});try{n.headersSent||n.writeHead(500,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:"internal",message:"internal error",origin:"runtime"}}))}catch{}},"internalFailure");let _;try{_=new URL(t.url??"/","http://127.0.0.1")}catch{try{n.writeHead(400,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:"invalid_request",message:"request URL is invalid",origin:"runtime"}}))}catch{}return}try{const a=f((t.method??"GET").toUpperCase(),_.pathname);if(a!==null){dt(n,a.message);return}const c=P(t)??{class:"person"},p=Re(c),A=i(()=>s.handle(t,n,l,c),"handled");(p===void 0?A():M(p,i(async()=>{ie()||await se(p),await A()},"handledAsPerson"))).catch(v)}catch(a){v(a)}},"onRequest"),B=i(async(t,n,l)=>{const u=P(t);return u===void 0||le(u)||await ce(u,"either",l)?!0:(y(n,404,"Not Found","node_not_found",`no node ${l}`),!1)},"authorizeAttachUpgrade"),N=new Set,F=i((t,n,l)=>{N.add(n),n.once("close",()=>N.delete(n)),n.on("error",()=>{});try{const u=new URL(t.url??"/","http://127.0.0.1"),S=f((t.method??"GET").toUpperCase(),u.pathname);if(S!==null){y(n,503,"Service Unavailable","startup_blocked",S.message);return}const g=Qr(t.method??"GET",u.pathname);if(g===null){n.destroy();return}const v=(()=>{const a=P(t);return a===void 0?void 0:Re(a)})(),_=i(()=>B(t,n,g).then(a=>a?Ze(t,n,l,g,async c=>{const p=P(t);return p===void 0||le(p)||await ce(p,c,g)}):void 0),"attach");(v===void 0?_():M(v,async()=>{ie()||await se(v),await _()})).catch(()=>{try{n.destroy()}catch{}})}catch{try{n.destroy()}catch{}}},"onUpgrade"),Se=i(t=>{t.on("error",n=>{R({event:"api.server.failed",level:"error",error:n})})},"bindErrorHandler"),Ee=i(async(t,n)=>{try{const l=await ge(t,h);if(l==="unauthorized"){R({event:"api.principal.denied",level:"warn",fields:{method:t.method}}),L(n);return}if(l==="runtime_starting"){we(n);return}C.set(t,l),Ae(t,l),m(t,n,l.class==="app"?l.scopes:null)}catch(l){R({event:"api.principal.failed",level:"error",error:l instanceof Error?l:new Error(String(l))}),L(n)}},"onSocketRequest"),U=Q((t,n)=>{Ee(t,n).catch(l=>R({event:"api.principal.failed",level:"error",error:l instanceof Error?l:new Error(String(l))}))}),Te=i(async(t,n,l)=>{try{const u=await ge(t,h);if(u==="unauthorized"||u==="runtime_starting"){u==="unauthorized"&&R({event:"api.principal.denied",level:"warn",fields:{method:t.method}}),y(n,u==="unauthorized"?401:503,"Unauthorized",u,"socket principal unavailable");return}if(u.class!=="person"&&u.class!=="broker"){y(n,403,"Forbidden",H.code,H.message);return}C.set(t,u),F(t,n,l)}catch(u){R({event:"api.principal.failed",level:"error",error:u instanceof Error?u:new Error(String(u))}),y(n,401,"Unauthorized",E.code,E.message)}},"onSocketUpgrade");U.on("upgrade",(t,n,l)=>{Te(t,n,l).catch(u=>R({event:"api.principal.failed",level:"error",error:u instanceof Error?u:new Error(String(u))}))}),me((t,n,l)=>{C.set(t,l),m(t,n,null)});let Y=!1,Z,K;const be=new Promise((t,n)=>{Z=t,K=n});U.once("listening",()=>{Y=!0,Z()}),U.on("error",t=>{R({event:"api.server.failed",level:"error",error:t}),Y||K(t)});try{D(d)&&ee(d)}catch{}U.listen(d,()=>{try{Ue(d,process.platform==="linux"&&D("/run/crtr/launcher.sock")?438:384)}catch(t){R({event:"api.socket.chmod_failed",level:"error",error:t instanceof Error?t:new Error(String(t))})}});let w;const z=e.tcp??Fe()??V("user").api.tcp;if(z!==void 0&&z!==""){const t=qr(z);if(t===null)R({event:"api.tcp.invalid",level:"error",error:new Error(`invalid CRTRD_TCP/--tcp spec: ${z}`)});else{const n=e.token??Ye()??Ge("user"),l=rt(n),u=i(async(a,c)=>{if(st(a,c))return;if(J()&&Le(new URL(a.url??"/","http://runtime.local").pathname)){await ot(a,c);return}if(await ct(a,c))return;const p=await ve(a,l);if(p==="runtime_starting"){O(c),we(c);return}if(p==="person_bearer"){at(c);return}if(p==="unauthorized"){R({event:"api.principal.denied",level:"warn",fields:{method:a.method,listener:"tcp"}}),L(c,!0);return}C.set(a,p.principal),Ae(a,p.principal),O(c),m(a,c,p.ceiling)},"tcpOnRequest"),S=i(async(a,c,p)=>{const A=await ve(a,l);if(A==="runtime_starting"){y(c,503,"Service Unavailable","runtime_starting","grant sync is not ready");return}if(A==="person_bearer"){y(c,401,"Unauthorized",k.code,k.message);return}if(A==="unauthorized"){y(c,401,"Unauthorized",E.code,E.message);return}if(A.ceiling!==null||A.principal.class==="anonymous"){y(c,403,"Forbidden",H.code,H.message);return}C.set(a,A.principal),F(a,c,p)},"tcpOnUpgrade"),g=i(a=>{R({event:"api.principal.failed",level:"error",error:a instanceof Error?a:new Error(String(a))})},"failed"),v=i((a,c)=>{u(a,c).catch(p=>{g(p),c.headersSent?c.destroy():L(c,!0)})},"listener"),_=it();w=_===null?Q(v):Oe(_,v),w.on("upgrade",(a,c,p)=>{c.on("error",()=>{}),S(a,c,p).catch(A=>{g(A),y(c,401,"Unauthorized",E.code,E.message)})}),Se(w),w.once("listening",()=>{const a=w?.address();if(a!==null&&typeof a=="object"){const{address:c,port:p}=a;r=et(c,p)}}),w.listen(t.port,t.host)}}let X=!1;return{ready:be,tcpAddress:i(()=>r,"tcpAddress"),close:i(async(t={})=>{if(!X){X=!0,me(null),nr.close(),await Promise.all([_e(U,N,t.graceMs),w!==void 0?_e(w,N,t.graceMs):Promise.resolve()]);try{D(d)&&ee(d)}catch{}}},"close")}}i(Vn,"createApiServer");export{Xr as buildRouter,_e as closeServer,Vn as createApiServer,P as socketPrincipal};

package/dist/daemon/api/vendor-signin.d.ts

@@ -7,5 +7,6 @@ export declare function escapeHtml(value: string): string;
 export declare function anthropicPage(flow: StartedFlow, nonce: string, returnTo: string, handoff: string): string;
 export declare function openaiPage(flow: StartedFlow, nonce: string, returnTo: string, handoff: string, now?: number): string;
 /** Serve one `/signin/vendor*` request; errors propagate as RunErrors so the
- *  listener answers them with contract 2's envelope (RT-LLM-53). */
+ *  listener answers them with contract 2's envelope (RT-LLM-53). On a cloud role
+ *  the request runs as the person the handoff's `sub` names. */
 export declare function handleVendorSignIn(req: IncomingMessage, res: ServerResponse, url: URL, principal: AppPrincipalResolver): Promise<void>;