@north-light/cli 0.3.580 → 0.3.582

package/dist/daemon/api/import-auth.d.ts

@@ -0,0 +1,6 @@
+import type { ImportPrincipal } from './router.js';
+export declare const IMPORT_TOKEN_PREFIX = "crtr_imp_";
+/** The import token for `run`: `crtr_imp_<run>.<hex hmac-sha256(run) under the service token>`; null when the service token is unset. */
+export declare function importTokenFor(run: string): string | null;
+/** The principal a bearer is, when it is the service credential or a valid import token; null otherwise (including when the service token is unset). */
+export declare function importPrincipalFor(token: string): ImportPrincipal | null;

package/dist/daemon/api/import-auth.js

@@ -0,0 +1 @@
+var u=Object.defineProperty;var e=(t,n)=>u(t,"name",{value:n,configurable:!0});import{createHash as a,createHmac as p,timingSafeEqual as m}from"node:crypto";const s="crtr_imp_",i=e(()=>{const t=process.env.CRTR_IMPORT_SERVICE_TOKEN;return t===void 0||t===""?null:t},"serviceToken"),c=e(t=>a("sha256").update(t).digest(),"digest"),o=e((t,n)=>m(c(t),c(n)),"sameString");function d(t){const n=i();return n===null?null:`${s}${t}.${p("sha256",n).update(t).digest("hex")}`}e(d,"importTokenFor");function _(t){const n=i();if(n===null)return null;if(t.startsWith(s)){const r=t.slice(s.length).split(".")[0]??"",l=d(r);return r!==""&&l!==null&&o(t,l)?{class:"import",run:r}:null}return o(t,n)?{class:"import",run:null}:null}e(_,"importPrincipalFor");export{s as IMPORT_TOKEN_PREFIX,_ as importPrincipalFor,d as importTokenFor};

package/dist/daemon/api/operations.d.ts

@@ -1,6 +1,6 @@
 import type { Scope } from '@north-light/identity';
-export type CallerClass = 'anonymous' | 'person' | 'app' | 'broker' | 'cron' | 'directory' | 'forwarded' | 'machine';
-export type ResourceRule = 'none' | 'node-read' | 'node-write' | 'node-own' | 'nodes-list' | 'canvas-read' | 'cron' | 'profile' | 'human' | 'run' | 'daemon-bash' | 'objects';
+export type CallerClass = 'anonymous' | 'person' | 'app' | 'broker' | 'cron' | 'directory' | 'forwarded' | 'machine' | 'import';
+export type ResourceRule = 'none' | 'node-read' | 'node-write' | 'node-own' | 'nodes-list' | 'canvas-read' | 'cron' | 'profile' | 'human' | 'run' | 'daemon-bash' | 'daemon-control' | 'objects';
 export interface Operation {
     name: string;
     method: string;

package/dist/daemon/api/operations.js

@@ -1 +1 @@
-var a=Object.defineProperty;var r=(e,s)=>a(e,"name",{value:s,configurable:!0});const n=[{name:"conversation.create",method:"POST",path:"/v1/conversations",classes:["broker"],resource:"none"},{name:"conversation.list",method:"GET",path:"/v1/conversations",classes:["broker","person"],resource:"none"},{name:"conversation.append",method:"POST",path:"/v1/conversations/:id/entries",classes:["broker"],resource:"none"},{name:"conversation.commit",method:"POST",path:"/v1/conversations/:id/commit",classes:["broker"],resource:"none"},{name:"conversation.read",method:"GET",path:"/v1/conversations/:id",classes:["broker","person"],resource:"none"},{name:"conversation.header",method:"GET",path:"/v1/conversations/:id/header",classes:["broker","person"],resource:"none"},{name:"conversation.replace",method:"PUT",path:"/v1/conversations/:id",classes:["broker"],resource:"none"},{name:"conversation.fork",method:"POST",path:"/v1/conversations/:id/fork",classes:["broker"],resource:"none"},{name:"conversation.delete",method:"DELETE",path:"/v1/conversations/:id",classes:["broker"],resource:"none"},{name:"health",method:"GET",path:"/v1/health",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"ready",method:"GET",path:"/v1/ready",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"chat-inventory.get.1",method:"GET",path:"/v1/nodes/:id/chat-inventory",classes:["person","broker","cron"],resource:"node-read"},{name:"settings.get",method:"GET",path:"/v1/settings",classes:["person","broker"],resource:"none"},{name:"settings.put",method:"PUT",path:"/v1/settings",classes:["person","broker"],resource:"none"},{name:"model-config.put.2",method:"PUT",path:"/v1/model-config",classes:["person","broker"],resource:"none"},{name:"files.get.3",method:"GET",path:"/v1/files/peek",classes:["person","broker"],resource:"none"},{name:"files.post.4",method:"POST",path:"/v1/files/write",classes:["person","broker"],resource:"none"},{name:"files.get.5",method:"GET",path:"/v1/files/list",classes:["person","broker"],resource:"none"},{name:"reviews.post.6",method:"POST",path:"/v1/human/reviews",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"reviews.get.7",method:"GET",path:"/v1/human/reviews",classes:["person","broker"],resource:"human"},{name:"reviews.get.8",method:"GET",path:"/v1/human/reviews/:review_id",classes:["person","broker"],resource:"human"},{name:"reviews.post.9",method:"POST",path:"/v1/human/reviews/:review_id/submit",classes:["person","broker"],resource:"human"},{name:"reviews.post.10",method:"POST",path:"/v1/human/reviews/:review_id/cancel",classes:["person","broker"],resource:"human"},{name:"reviews.get.11",method:"GET",path:"/v1/human/reviews/:review_id/document",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.12",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.13",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"node.log.append",method:"POST",path:"/v1/nodes/:id/records/log",classes:["person","broker"],resource:"node-own"},{name:"node.summaries.put",method:"PUT",path:"/v1/nodes/:id/records/summaries",classes:["person","broker"],resource:"node-own"},{name:"node.attachments.list",method:"GET",path:"/v1/nodes/:id/attachments",classes:["person","broker"],resource:"node-own"},{name:"node.attachments.read",method:"GET",path:"/v1/nodes/:id/attachments/:sha256",classes:["person","broker"],resource:"node-own"},{name:"node.telemetry.put",method:"PUT",path:"/v1/nodes/:id/records/telemetry",classes:["person","broker"],resource:"node-own"},{name:"node.recap.put",method:"PUT",path:"/v1/nodes/:id/records/recap",classes:["person","broker"],resource:"node-own"},{name:"node.inbox.read",method:"GET",path:"/v1/nodes/:id/records/inbox",classes:["person","broker"],resource:"node-own"},{name:"node.passive.read",method:"GET",path:"/v1/nodes/:id/records/passive",classes:["person","broker"],resource:"node-own"},{name:"node.pushed-final",method:"POST",path:"/v1/nodes/:id/records/pushed-final",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.14",method:"POST",path:"/v1/nodes/:id/broker/session-bound",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.15",method:"POST",path:"/v1/nodes/:id/broker/settle",classes:["person","broker"],resource:"node-own"},{name:"broker.idle",method:"POST",path:"/v1/nodes/:id/broker/idle",classes:["broker"],resource:"node-own"},{name:"broker-ops.post.16",method:"POST",path:"/v1/nodes/:id/broker/park-complete",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.17",method:"POST",path:"/v1/nodes/:id/broker/park-activity",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.18",method:"POST",path:"/v1/nodes/:id/broker/telemetry",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.19",method:"POST",path:"/v1/nodes/:id/broker/model",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.get.20",method:"GET",path:"/v1/nodes/:id/broker/extension-state",classes:["person","broker"],resource:"node-own"},{name:"broker.signals",method:"GET",path:"/v1/nodes/:id/broker/signals",classes:["broker"],resource:"node-own",stream:!0},{name:"nodes.broker-structured-request",method:"GET",path:"/v1/nodes/:id/broker/structured-request",classes:["person","broker"],resource:"node-own"},{name:"nodes.broker-goal",method:"POST",path:"/v1/nodes/:id/broker/goal",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.21",method:"POST",path:"/v1/nodes/:id/broker/generated-name",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.22",method:"POST",path:"/v1/nodes/:id/broker/persona-ack",classes:["person","broker"],resource:"node-own"},{name:"objects.read",method:"GET",path:"/v1/objects/:ref",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.list",method:"GET",path:"/v1/objects",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.search",method:"POST",path:"/v1/objects/search",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.watch",method:"POST",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.unwatch",method:"DELETE",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.shares",method:"GET",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.share",method:"POST",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.unshare",method:"DELETE",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"custom-objects.register",method:"POST",path:"/v1/custom-objects",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.publish",method:"POST",path:"/v1/custom-objects/:ref/events",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.unregister",method:"DELETE",path:"/v1/custom-objects/:ref",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.receive",method:"GET",path:"/v1/custom-objects/:ref/deliveries",classes:["anonymous","person","app","broker","cron"],resource:"objects",stream:!0,stage:"objects"},{name:"custom-objects.ack",method:"POST",path:"/v1/custom-objects/:ref/deliveries/ack",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.edges",method:"GET",path:"/v1/objects/:ref/edges",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.write",method:"POST",path:"/v1/docs",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.edit",method:"PATCH",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.move",method:"POST",path:"/v1/docs/:ref/move",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.delete",method:"DELETE",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.history",method:"GET",path:"/v1/docs/:ref/history",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"schemas.register",method:"POST",path:"/v1/schemas",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.write",method:"POST",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.replace",method:"PUT",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.list",method:"GET",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"check",method:"POST",path:"/v1/check",classes:["app"],resource:"objects",stage:"objects"},{name:"docs.lint",method:"POST",path:"/v1/docs/lint",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"plugins.app-token",method:"GET",path:"/v1/plugins/:name/app-token",classes:["person","broker"],resource:"none"},{name:"plugins.call-headers",method:"POST",path:"/v1/plugins/:name/call-headers",classes:["person","broker"],resource:"none"},{name:"documents.browser-access",method:"GET",path:"/v1/documents/browser-access",classes:["person"],resource:"none"},{name:"documents.reconcile-packages",method:"POST",path:"/v1/documents/reconcile-packages",classes:["person","broker"],resource:"none"},{name:"nodes.delivery",method:"POST",path:"/v1/nodes/:id/delivery",classes:["person","broker"],resource:"node-own"},{name:"delivery.dry-run",method:"POST",path:"/v1/delivery/dry-run",classes:["person","broker"],resource:"none"},{name:"bash-jobs.background",method:"POST",path:"/v1/nodes/:id/jobs/:jobId/background",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"health.get.33",method:"GET",path:"/healthz",classes:["anonymous"],resource:"none"},{name:"health.get.34",method:"GET",path:"/v1/status",classes:["person","broker"],resource:"none"},{name:"daemon.due",method:"GET",path:"/v1/due",classes:["person","broker"],resource:"none"},{name:"bash-jobs.report",method:"POST",path:"/v1/nodes/:id/jobs/:jobId/report",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"bash-jobs.patch",method:"PATCH",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"bash-jobs.start",method:"POST",path:"/v1/nodes/:id/jobs/start",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"hooks.plan",method:"GET",path:"/v1/nodes/:id/hooks/plan",classes:["broker"],resource:"node-own"},{name:"hooks.exec",method:"POST",path:"/v1/nodes/:id/hooks/exec",classes:["broker"],resource:"node-own"},{name:"hooks.exec.person",method:"POST",path:"/v1/hooks/exec",classes:["person","broker"],resource:"none"},{name:"bash-jobs.get.35",method:"GET",path:"/v1/nodes/:id/jobs",classes:["person","broker","cron"],resource:"node-read"},{name:"bash-jobs.delete.36",method:"DELETE",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"prospective-chat-inventory.get.37",method:"GET",path:"/v1/prospective-chat-inventory",classes:["person","broker"],resource:"none"},{name:"node-events.get.38",method:"GET",path:"/v1/nodes/:id/events",classes:["person","broker","cron"],resource:"node-read"},{name:"bash.post.39",method:"POST",path:"/v1/bash",classes:["person","broker"],resource:"daemon-bash",scope:"crtr:act"},{name:"subscriptions.post.40",method:"POST",path:"/v1/nodes/:id/subscriptions",classes:["person","broker"],resource:"node-write"},{name:"subscriptions.delete.41",method:"DELETE",path:"/v1/nodes/:id/subscriptions/:target",classes:["person","broker"],resource:"node-write"},{name:"attach.post.42",method:"POST",path:"/v1/nodes/:id/attach",classes:["person","broker"],resource:"node-write"},{name:"review-comments.post.44",method:"POST",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.45",method:"GET",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.post.46",method:"POST",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.47",method:"GET",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.48",method:"GET",path:"/v1/human/reviews/:review_id/comment-events",classes:["person","broker"],resource:"human"},{name:"review-comments.post.49",method:"POST",path:"/v1/human/reviews/:review_id/comment-ranges",classes:["person","broker"],resource:"human"},{name:"review-comments.get.50",method:"GET",path:"/v1/human/comments/:comment_id",classes:["person","broker"],resource:"human"},{name:"review-comments.post.51",method:"POST",path:"/v1/human/comments/:comment_id/edit",classes:["person","broker"],resource:"human"},{name:"review-comments.post.52",method:"POST",path:"/v1/human/comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"review-comments.post.53",method:"POST",path:"/v1/human/comments/:comment_id/reopen",classes:["person","broker"],resource:"human"},{name:"review-comments.post.54",method:"POST",path:"/v1/human/comments/:comment_id/delete",classes:["person","broker"],resource:"human"},{name:"review-comments.post.55",method:"POST",path:"/v1/human/comments/:comment_id/fork",classes:["person","broker"],resource:"human"},{name:"messages.post.56",method:"POST",path:"/v1/nodes/:id/mail/claim",classes:["person","broker"],resource:"node-own"},{name:"messages.post.57",method:"POST",path:"/v1/nodes/:id/mail/acknowledge",classes:["person","broker"],resource:"node-own"},{name:"messages.post.58",method:"POST",path:"/v1/nodes/:id/messages",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"messages.post.59",method:"POST",path:"/v1/nodes/:id/interrupt",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"reports.post.60",method:"POST",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-own"},{name:"reports.get.61",method:"GET",path:"/v1/nodes/:id/reports",classes:["person","broker","cron"],resource:"node-read"},{name:"reports.post.62",method:"POST",path:"/v1/nodes/:id/result",classes:["person","broker"],resource:"node-own"},{name:"inbox.get.63",method:"GET",path:"/v1/human/inbox",classes:["person","broker"],resource:"human"},{name:"inbox.get.64",method:"GET",path:"/v1/human/inbox/history",classes:["person","broker"],resource:"human"},{name:"inbox.get.65",method:"GET",path:"/v1/human/inbox/:ticket_id",classes:["person","broker"],resource:"human"},{name:"inbox.get.66",method:"GET",path:"/v1/human/inbox/:ticket_id/response",classes:["person","broker"],resource:"human"},{name:"inbox.post.67",method:"POST",path:"/v1/human/inbox/:ticket_id/respond",classes:["person","broker"],resource:"human"},{name:"inbox.post.68",method:"POST",path:"/v1/human/inbox/:ticket_id/progress",classes:["person","broker"],resource:"human"},{name:"inbox.post.69",method:"POST",path:"/v1/human/inbox/:ticket_id/cancel",classes:["person","broker"],resource:"human"},{name:"worktree.post.70",method:"POST",path:"/v1/nodes/:id/worktree/close",classes:["person","broker"],resource:"node-write"},{name:"worktree.post.71",method:"POST",path:"/v1/nodes/:id/worktree/abandon",classes:["person","broker"],resource:"node-write"},{name:"worktree.get.72",method:"GET",path:"/v1/worktrees/quarantined",classes:["person","broker"],resource:"none"},{name:"crons.post.73",method:"POST",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.get.74",method:"GET",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.get.75",method:"GET",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.post.76",method:"POST",path:"/v1/crons/:cronId/pause",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.77",method:"POST",path:"/v1/crons/:cronId/resume",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.78",method:"POST",path:"/v1/crons/poke",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.79",method:"POST",path:"/v1/crons/:cronId/run",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.delete.80",method:"DELETE",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"modelauth.get.81",method:"GET",path:"/v1/model-auth",classes:["person","broker"],resource:"none"},{name:"modelauth.get.82",method:"GET",path:"/v1/model-auth/readiness",classes:["person","broker"],resource:"none"},{name:"modelauth.put.83",method:"PUT",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"modelauth.delete.84",method:"DELETE",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"modelauth.delete.account",method:"DELETE",path:"/v1/model-auth/:provider/accounts/:label",classes:["person","broker"],resource:"none"},{name:"modelauth.patch.account",method:"PATCH",path:"/v1/model-auth/:provider/accounts/:label",classes:["person","broker"],resource:"none"},{name:"model_auth.start",method:"POST",path:"/v1/model-auth/flows",classes:["person","broker"],resource:"none"},{name:"model_auth.complete",method:"POST",path:"/v1/model-auth/flows/:flow_id/complete",classes:["person","broker"],resource:"none"},{name:"model_auth.cancel",method:"POST",path:"/v1/model-auth/flows/:flow_id/cancel",classes:["person","broker"],resource:"none"},{name:"model_auth.get",method:"GET",path:"/v1/model-auth/flows/:flow_id",classes:["person","broker"],resource:"none"},{name:"nodes.post.85",method:"POST",path:"/v1/nodes",classes:["person","broker","cron"],resource:"node-own",scope:"crtr:act"},{name:"nodes.get.86",method:"GET",path:"/v1/nodes",classes:["person","broker"],resource:"nodes-list"},{name:"nodes.post.87",method:"POST",path:"/v1/nodes/revive-all",classes:["person","broker"],resource:"none"},{name:"nodes.get.88",method:"GET",path:"/v1/nodes/:id",classes:["person","broker","cron","forwarded"],resource:"node-read"},{name:"nodes.get.89",method:"GET",path:"/v1/nodes/:id/snapshot",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.90",method:"GET",path:"/v1/nodes/:id/subject",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.91",method:"GET",path:"/v1/nodes/:id/messages",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.92",method:"GET",path:"/v1/nodes/:id/session",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.93",method:"GET",path:"/v1/nodes/:id/transcript",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.94",method:"GET",path:"/v1/nodes/:id/context",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.post.96",method:"POST",path:"/v1/nodes/:id/fork",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.97",method:"POST",path:"/v1/nodes/:id/revive",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.98",method:"POST",path:"/v1/nodes/:id/relaunch-root",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.99",method:"POST",path:"/v1/nodes/:id/close",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.read",method:"POST",path:"/v1/nodes/:id/read",classes:["person"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.100",method:"POST",path:"/v1/nodes/:id/recycle",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.101",method:"POST",path:"/v1/nodes/:id/demote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.102",method:"POST",path:"/v1/nodes/:id/promote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.103",method:"POST",path:"/v1/nodes/:id/yield",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.104",method:"POST",path:"/v1/nodes/:id/wait",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.patch.105",method:"PATCH",path:"/v1/nodes/:id/config",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"broker-recovery.post.106",method:"POST",path:"/v1/broker/:id/turn",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.107",method:"POST",path:"/v1/broker/:id/provider-retry",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.108",method:"POST",path:"/v1/broker/:id/fault",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.get.109",method:"GET",path:"/v1/broker/:id/recovery",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.110",method:"POST",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"broker-recovery.delete.111",method:"DELETE",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"profiles.put.112",method:"PUT",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profiles.post.113",method:"POST",path:"/v1/profiles/:name/pause",classes:["person","broker"],resource:"profile"},{name:"profiles.post.114",method:"POST",path:"/v1/profiles/:name/resume",classes:["person","broker"],resource:"profile"},{name:"profiles.patch.115",method:"PATCH",path:"/v1/profiles/:name/metadata",classes:["person","app","broker"],resource:"profile"},{name:"profile.create",method:"POST",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile"},{name:"profile.update",method:"PATCH",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"app.env.list",method:"GET",path:"/v1/apps/self/env",classes:["person","app","broker"],resource:"profile"},{name:"app.env.set",method:"PUT",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"app.env.remove",method:"DELETE",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.list",method:"GET",path:"/v1/profiles/:name/env",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.set",method:"PUT",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.remove",method:"DELETE",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profiles.delete.116",method:"DELETE",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.list",method:"GET",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile",stage:"chat"},{name:"profiles.get.118",method:"GET",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"execution.start",method:"GET",path:"/v1/executions/:execution_id/start",classes:["broker"],resource:"none"},{name:"environment.git-credential",method:"POST",path:"/v1/environments/:environment_id/git-credential",classes:["broker"],resource:"none"},{name:"node-outcomes.get.119",method:"GET",path:"/v1/nodes/:id/outcome",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.put.120",method:"PUT",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"node-outcomes.get.121",method:"GET",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.delete.122",method:"DELETE",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"canvas.get.123",method:"GET",path:"/v1/canvas/attention",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.124",method:"POST",path:"/v1/canvas/attention/counts",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.125",method:"POST",path:"/v1/canvas/history/search",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.126",method:"POST",path:"/v1/canvas/history/grep",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.127",method:"GET",path:"/v1/canvas/history/read",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.128",method:"POST",path:"/v1/canvas/history/stats",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.129",method:"GET",path:"/v1/canvas/snapshot",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.130",method:"GET",path:"/v1/canvas/roster",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.live-roots",method:"GET",path:"/v1/canvas/live-roots",classes:["person"],resource:"canvas-read"},{name:"canvas.get.browse",method:"GET",path:"/v1/canvas/browse",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.analytics",method:"GET",path:"/v1/canvas/analytics",classes:["person","broker"],resource:"canvas-read"},{name:"memory-reads.post",method:"POST",path:"/v1/nodes/:id/memory-reads",classes:["person","broker"],resource:"node-own"},{name:"canvas.get.131",method:"GET",path:"/v1/canvas/graph",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.132",method:"POST",path:"/v1/canvas/prune",classes:["person","broker"],resource:"none"},{name:"daemon.post.133",method:"POST",path:"/v1/daemon/restart",classes:["person","broker"],resource:"none"},{name:"daemon.post.134",method:"POST",path:"/v1/daemon/migrate",classes:["person","broker"],resource:"none"},{name:"daemon.post.135",method:"POST",path:"/v1/daemon/admit",classes:["person","broker"],resource:"none"},{name:"human.components.list",method:"GET",path:"/v1/human/components",classes:["person","broker"],resource:"none"},{name:"human-requests.post.136",method:"POST",path:"/v1/human/requests",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"human-requests.get.137",method:"GET",path:"/v1/human/requests/:request_id",classes:["person","broker"],resource:"human"},{name:"human-requests.post.138",method:"POST",path:"/v1/human/requests/:request_id/replace",classes:["person","broker"],resource:"human"},{name:"human-requests.post.139",method:"POST",path:"/v1/human/requests/:request_id/respond",classes:["person","broker"],resource:"human"},{name:"human-requests.post.140",method:"POST",path:"/v1/human/requests/:request_id/dismiss",classes:["person","broker"],resource:"human"},{name:"human-requests.post.141",method:"POST",path:"/v1/human/requests/:request_id/cancel",classes:["person","broker"],resource:"human"},{name:"focus.get.142",method:"GET",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.post.143",method:"POST",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.get.144",method:"GET",path:"/v1/focuses/by-node",classes:["person","broker"],resource:"none"},{name:"focus.get.145",method:"GET",path:"/v1/focuses/by-pane",classes:["person","broker"],resource:"none"},{name:"focus.patch.146",method:"PATCH",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"focus.delete.147",method:"DELETE",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"delivery.retry",method:"POST",path:"/v1/deliveries/:delivery_id/retry",classes:["person","broker"],resource:"none"},{name:"limits.show",method:"GET",path:"/v1/limits",classes:["person"],resource:"none"},{name:"limits.set",method:"PUT",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"limits.remove",method:"DELETE",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"charges.list",method:"GET",path:"/v1/charges",classes:["person","app","broker"],resource:"none",stage:"objects"},{name:"spend_limits.list",method:"GET",path:"/v1/spend-limits",classes:["person"],resource:"none"},{name:"spend_limits.set",method:"PUT",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"spend_limits.remove",method:"DELETE",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"space.list",method:"GET",path:"/v1/spaces",classes:["person","broker"],resource:"none"},{name:"kinds.list",method:"GET",path:"/v1/kinds",classes:["person","app","broker"],resource:"none"},{name:"grant.get",method:"GET",path:"/v1/grant",classes:["app"],resource:"none",stage:"v0.5"},{name:"exec",method:"POST",path:"/v1/exec",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5"},{name:"usage.get",method:"GET",path:"/v1/usage",classes:["person","app","broker"],resource:"none",stage:"v1"},{name:"llm",method:"POST",path:"/v1/llm",classes:["app","person","broker"],scope:"crtr:llm",resource:"none",stage:"v1"},{name:"structured-request.create",method:"POST",path:"/v1/structured-requests",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"structured-request.get",method:"GET",path:"/v1/structured-requests/:request_id",classes:["person","app","broker"],resource:"none"},{name:"structured-request.cancel",method:"POST",path:"/v1/structured-requests/:request_id/cancel",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"run.start",method:"POST",path:"/v1/runs",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5",idempotency:"24h"},{name:"run.list",method:"GET",path:"/v1/runs",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.get",method:"GET",path:"/v1/runs/:run_id",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.message",method:"POST",path:"/v1/runs/:run_id/messages",classes:["app","person","broker","cron"],scope:"crtr:act",resource:"run",stage:"v0.5",idempotency:"24h"},{name:"run.events",method:"GET",path:"/v1/runs/:run_id/events",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5",stream:!0},{name:"run.interrupt",method:"POST",path:"/v1/runs/:run_id/interrupt",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.cancel",method:"POST",path:"/v1/runs/:run_id/cancel",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.delete",method:"DELETE",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.rename",method:"POST",path:"/v1/runs/:run_id/rename",classes:["app"],resource:"run",stage:"chat"},{name:"question.get",method:"GET",path:"/v1/questions/:question_id",classes:["app"],resource:"none",stage:"chat"},{name:"question.answer",method:"POST",path:"/v1/questions/:question_id/answer",classes:["app"],resource:"none",stage:"chat"},{name:"question.cancel",method:"POST",path:"/v1/questions/:question_id/cancel",classes:["app"],resource:"none",stage:"chat"},{name:"trace.get",method:"GET",path:"/v1/runs/:run_id/trace",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"upload.create",method:"POST",path:"/v1/uploads",classes:["app"],scope:"crtr:act",resource:"none",stage:"file-transfer"},{name:"attachment.link",method:"GET",path:"/v1/attachments/link",classes:["app"],resource:"none",stage:"file-transfer"},{name:"file.download",method:"GET",path:"/v1/files/download",classes:["app"],resource:"none",stage:"file-transfer",stream:"bytes"},{name:"share.create",method:"POST",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.list",method:"GET",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.delete",method:"DELETE",path:"/v1/shares/:share_id",classes:["app"],resource:"none",stage:"file-transfer"},{name:"memory.list",method:"GET",path:"/v1/memory",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"memory.get",method:"GET",path:"/v1/memory/document",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"audit.list",method:"GET",path:"/v1/audit",classes:["person","app"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/:provider/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.call",method:"POST",path:"/v1/provider/call",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"peer.events",method:"POST",path:"/v1/peer/events",classes:["machine"],resource:"none"},{name:"peer.outbox.claim",method:"POST",path:"/v1/peer/outbox/claim",classes:["machine"],resource:"none"},{name:"peer.outbox.ack",method:"POST",path:"/v1/peer/outbox/ack",classes:["machine"],resource:"none"},{name:"peer.locate",method:"POST",path:"/v1/peer/locate",classes:["machine"],resource:"none"},{name:"runtime.sync-notice",method:"POST",path:"/v1/runtime/sync-notice",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-status",method:"GET",path:"/v1/runtime/vendor-status",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-account-remove",method:"POST",path:"/v1/runtime/vendor-account-remove",classes:["directory"],resource:"none",stage:"v1"}];function c(e,s){return n.find(o=>o.method===e.toUpperCase()&&o.path===s)}r(c,"operationFor");export{n as OPERATIONS,c as operationFor};
+var a=Object.defineProperty;var r=(e,s)=>a(e,"name",{value:s,configurable:!0});const n=[{name:"conversation.create",method:"POST",path:"/v1/conversations",classes:["broker"],resource:"none"},{name:"conversation.list",method:"GET",path:"/v1/conversations",classes:["broker","person"],resource:"none"},{name:"conversation.append",method:"POST",path:"/v1/conversations/:id/entries",classes:["broker"],resource:"none"},{name:"conversation.commit",method:"POST",path:"/v1/conversations/:id/commit",classes:["broker"],resource:"none"},{name:"conversation.read",method:"GET",path:"/v1/conversations/:id",classes:["broker","person"],resource:"none"},{name:"conversation.header",method:"GET",path:"/v1/conversations/:id/header",classes:["broker","person"],resource:"none"},{name:"conversation.replace",method:"PUT",path:"/v1/conversations/:id",classes:["broker"],resource:"none"},{name:"conversation.fork",method:"POST",path:"/v1/conversations/:id/fork",classes:["broker"],resource:"none"},{name:"conversation.delete",method:"DELETE",path:"/v1/conversations/:id",classes:["broker"],resource:"none"},{name:"health",method:"GET",path:"/v1/health",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"ready",method:"GET",path:"/v1/ready",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"chat-inventory.get.1",method:"GET",path:"/v1/nodes/:id/chat-inventory",classes:["person","broker","cron"],resource:"node-read"},{name:"settings.get",method:"GET",path:"/v1/settings",classes:["person","broker"],resource:"none"},{name:"settings.put",method:"PUT",path:"/v1/settings",classes:["person","broker"],resource:"none"},{name:"model-config.put.2",method:"PUT",path:"/v1/model-config",classes:["person","broker"],resource:"none"},{name:"files.get.3",method:"GET",path:"/v1/files/peek",classes:["person","broker"],resource:"none"},{name:"files.post.4",method:"POST",path:"/v1/files/write",classes:["person","broker"],resource:"none"},{name:"files.get.5",method:"GET",path:"/v1/files/list",classes:["person","broker"],resource:"none"},{name:"reviews.post.6",method:"POST",path:"/v1/human/reviews",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"reviews.get.7",method:"GET",path:"/v1/human/reviews",classes:["person","broker"],resource:"human"},{name:"reviews.get.8",method:"GET",path:"/v1/human/reviews/:review_id",classes:["person","broker"],resource:"human"},{name:"reviews.post.9",method:"POST",path:"/v1/human/reviews/:review_id/submit",classes:["person","broker"],resource:"human"},{name:"reviews.post.10",method:"POST",path:"/v1/human/reviews/:review_id/cancel",classes:["person","broker"],resource:"human"},{name:"reviews.get.11",method:"GET",path:"/v1/human/reviews/:review_id/document",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.12",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.13",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"node.log.append",method:"POST",path:"/v1/nodes/:id/records/log",classes:["person","broker"],resource:"node-own"},{name:"node.summaries.put",method:"PUT",path:"/v1/nodes/:id/records/summaries",classes:["person","broker"],resource:"node-own"},{name:"node.attachments.list",method:"GET",path:"/v1/nodes/:id/attachments",classes:["person","broker"],resource:"node-own"},{name:"node.attachments.read",method:"GET",path:"/v1/nodes/:id/attachments/:sha256",classes:["person","broker"],resource:"node-own"},{name:"node.telemetry.put",method:"PUT",path:"/v1/nodes/:id/records/telemetry",classes:["person","broker"],resource:"node-own"},{name:"node.recap.put",method:"PUT",path:"/v1/nodes/:id/records/recap",classes:["person","broker"],resource:"node-own"},{name:"node.inbox.read",method:"GET",path:"/v1/nodes/:id/records/inbox",classes:["person","broker"],resource:"node-own"},{name:"node.passive.read",method:"GET",path:"/v1/nodes/:id/records/passive",classes:["person","broker"],resource:"node-own"},{name:"node.pushed-final",method:"POST",path:"/v1/nodes/:id/records/pushed-final",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.14",method:"POST",path:"/v1/nodes/:id/broker/session-bound",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.15",method:"POST",path:"/v1/nodes/:id/broker/settle",classes:["person","broker"],resource:"node-own"},{name:"broker.idle",method:"POST",path:"/v1/nodes/:id/broker/idle",classes:["broker"],resource:"node-own"},{name:"broker-ops.post.16",method:"POST",path:"/v1/nodes/:id/broker/park-complete",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.17",method:"POST",path:"/v1/nodes/:id/broker/park-activity",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.18",method:"POST",path:"/v1/nodes/:id/broker/telemetry",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.19",method:"POST",path:"/v1/nodes/:id/broker/model",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.get.20",method:"GET",path:"/v1/nodes/:id/broker/extension-state",classes:["person","broker"],resource:"node-own"},{name:"broker.signals",method:"GET",path:"/v1/nodes/:id/broker/signals",classes:["broker"],resource:"node-own",stream:!0},{name:"nodes.broker-structured-request",method:"GET",path:"/v1/nodes/:id/broker/structured-request",classes:["person","broker"],resource:"node-own"},{name:"nodes.broker-goal",method:"POST",path:"/v1/nodes/:id/broker/goal",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.21",method:"POST",path:"/v1/nodes/:id/broker/generated-name",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.22",method:"POST",path:"/v1/nodes/:id/broker/persona-ack",classes:["person","broker"],resource:"node-own"},{name:"objects.read",method:"GET",path:"/v1/objects/:ref",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.list",method:"GET",path:"/v1/objects",classes:["person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.search",method:"POST",path:"/v1/objects/search",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.watch",method:"POST",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.unwatch",method:"DELETE",path:"/v1/objects/:ref/watch",classes:["anonymous","person","app","broker","cron","forwarded"],resource:"objects",stage:"objects"},{name:"objects.shares",method:"GET",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.share",method:"POST",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"objects.unshare",method:"DELETE",path:"/v1/objects/:ref/shares",classes:["person","broker"],resource:"objects",stage:"objects"},{name:"custom-objects.register",method:"POST",path:"/v1/custom-objects",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.publish",method:"POST",path:"/v1/custom-objects/:ref/events",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.unregister",method:"DELETE",path:"/v1/custom-objects/:ref",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"custom-objects.receive",method:"GET",path:"/v1/custom-objects/:ref/deliveries",classes:["anonymous","person","app","broker","cron"],resource:"objects",stream:!0,stage:"objects"},{name:"custom-objects.ack",method:"POST",path:"/v1/custom-objects/:ref/deliveries/ack",classes:["anonymous","person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"objects.edges",method:"GET",path:"/v1/objects/:ref/edges",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.write",method:"POST",path:"/v1/docs",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.edit",method:"PATCH",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.move",method:"POST",path:"/v1/docs/:ref/move",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.delete",method:"DELETE",path:"/v1/docs/:ref",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"docs.history",method:"GET",path:"/v1/docs/:ref/history",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"schemas.register",method:"POST",path:"/v1/schemas",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.write",method:"POST",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.replace",method:"PUT",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"relations.list",method:"GET",path:"/v1/relations",classes:["app"],resource:"objects",stage:"objects"},{name:"check",method:"POST",path:"/v1/check",classes:["app"],resource:"objects",stage:"objects"},{name:"docs.lint",method:"POST",path:"/v1/docs/lint",classes:["person","app","broker","cron"],resource:"objects",stage:"objects"},{name:"plugins.app-token",method:"GET",path:"/v1/plugins/:name/app-token",classes:["person","broker"],resource:"none"},{name:"plugins.call-headers",method:"POST",path:"/v1/plugins/:name/call-headers",classes:["person","broker"],resource:"none"},{name:"documents.browser-access",method:"GET",path:"/v1/documents/browser-access",classes:["person"],resource:"none"},{name:"documents.reconcile-packages",method:"POST",path:"/v1/documents/reconcile-packages",classes:["person","broker"],resource:"none"},{name:"nodes.delivery",method:"POST",path:"/v1/nodes/:id/delivery",classes:["person","broker"],resource:"node-own"},{name:"delivery.dry-run",method:"POST",path:"/v1/delivery/dry-run",classes:["person","broker"],resource:"none"},{name:"bash-jobs.background",method:"POST",path:"/v1/nodes/:id/jobs/:jobId/background",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"health.get.33",method:"GET",path:"/healthz",classes:["anonymous"],resource:"none"},{name:"health.get.34",method:"GET",path:"/v1/status",classes:["person","broker"],resource:"none"},{name:"daemon.due",method:"GET",path:"/v1/due",classes:["person","broker"],resource:"none"},{name:"bash-jobs.report",method:"POST",path:"/v1/nodes/:id/jobs/:jobId/report",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"bash-jobs.patch",method:"PATCH",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"bash-jobs.start",method:"POST",path:"/v1/nodes/:id/jobs/start",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"hooks.plan",method:"GET",path:"/v1/nodes/:id/hooks/plan",classes:["broker"],resource:"node-own"},{name:"hooks.exec",method:"POST",path:"/v1/nodes/:id/hooks/exec",classes:["broker"],resource:"node-own"},{name:"hooks.exec.person",method:"POST",path:"/v1/hooks/exec",classes:["person","broker"],resource:"none"},{name:"bash-jobs.get.35",method:"GET",path:"/v1/nodes/:id/jobs",classes:["person","broker","cron"],resource:"node-read"},{name:"bash-jobs.delete.36",method:"DELETE",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"prospective-chat-inventory.get.37",method:"GET",path:"/v1/prospective-chat-inventory",classes:["person","broker"],resource:"none"},{name:"node-events.get.38",method:"GET",path:"/v1/nodes/:id/events",classes:["person","broker","cron"],resource:"node-read"},{name:"bash.post.39",method:"POST",path:"/v1/bash",classes:["person","broker"],resource:"daemon-bash",scope:"crtr:act"},{name:"subscriptions.post.40",method:"POST",path:"/v1/nodes/:id/subscriptions",classes:["person","broker"],resource:"node-write"},{name:"subscriptions.delete.41",method:"DELETE",path:"/v1/nodes/:id/subscriptions/:target",classes:["person","broker"],resource:"node-write"},{name:"attach.post.42",method:"POST",path:"/v1/nodes/:id/attach",classes:["person","broker"],resource:"node-write"},{name:"review-comments.post.44",method:"POST",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.45",method:"GET",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.post.46",method:"POST",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.47",method:"GET",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.48",method:"GET",path:"/v1/human/reviews/:review_id/comment-events",classes:["person","broker"],resource:"human"},{name:"review-comments.post.49",method:"POST",path:"/v1/human/reviews/:review_id/comment-ranges",classes:["person","broker"],resource:"human"},{name:"review-comments.get.50",method:"GET",path:"/v1/human/comments/:comment_id",classes:["person","broker"],resource:"human"},{name:"review-comments.post.51",method:"POST",path:"/v1/human/comments/:comment_id/edit",classes:["person","broker"],resource:"human"},{name:"review-comments.post.52",method:"POST",path:"/v1/human/comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"review-comments.post.53",method:"POST",path:"/v1/human/comments/:comment_id/reopen",classes:["person","broker"],resource:"human"},{name:"review-comments.post.54",method:"POST",path:"/v1/human/comments/:comment_id/delete",classes:["person","broker"],resource:"human"},{name:"review-comments.post.55",method:"POST",path:"/v1/human/comments/:comment_id/fork",classes:["person","broker"],resource:"human"},{name:"messages.post.56",method:"POST",path:"/v1/nodes/:id/mail/claim",classes:["person","broker"],resource:"node-own"},{name:"messages.post.57",method:"POST",path:"/v1/nodes/:id/mail/acknowledge",classes:["person","broker"],resource:"node-own"},{name:"messages.post.58",method:"POST",path:"/v1/nodes/:id/messages",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"messages.post.59",method:"POST",path:"/v1/nodes/:id/interrupt",classes:["person","broker","cron","forwarded"],resource:"node-write"},{name:"reports.post.60",method:"POST",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-own"},{name:"reports.get.61",method:"GET",path:"/v1/nodes/:id/reports",classes:["person","broker","cron"],resource:"node-read"},{name:"reports.post.62",method:"POST",path:"/v1/nodes/:id/result",classes:["person","broker"],resource:"node-own"},{name:"inbox.get.63",method:"GET",path:"/v1/human/inbox",classes:["person","broker"],resource:"human"},{name:"inbox.get.64",method:"GET",path:"/v1/human/inbox/history",classes:["person","broker"],resource:"human"},{name:"inbox.get.65",method:"GET",path:"/v1/human/inbox/:ticket_id",classes:["person","broker"],resource:"human"},{name:"inbox.get.66",method:"GET",path:"/v1/human/inbox/:ticket_id/response",classes:["person","broker"],resource:"human"},{name:"inbox.post.67",method:"POST",path:"/v1/human/inbox/:ticket_id/respond",classes:["person","broker"],resource:"human"},{name:"inbox.post.68",method:"POST",path:"/v1/human/inbox/:ticket_id/progress",classes:["person","broker"],resource:"human"},{name:"inbox.post.69",method:"POST",path:"/v1/human/inbox/:ticket_id/cancel",classes:["person","broker"],resource:"human"},{name:"worktree.post.70",method:"POST",path:"/v1/nodes/:id/worktree/close",classes:["person","broker"],resource:"node-write"},{name:"worktree.post.71",method:"POST",path:"/v1/nodes/:id/worktree/abandon",classes:["person","broker"],resource:"node-write"},{name:"worktree.get.72",method:"GET",path:"/v1/worktrees/quarantined",classes:["person","broker"],resource:"none"},{name:"crons.post.73",method:"POST",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.get.74",method:"GET",path:"/v1/crons",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.get.75",method:"GET",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron"},{name:"crons.post.76",method:"POST",path:"/v1/crons/:cronId/pause",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.77",method:"POST",path:"/v1/crons/:cronId/resume",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.78",method:"POST",path:"/v1/crons/poke",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.79",method:"POST",path:"/v1/crons/:cronId/run",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"crons.delete.80",method:"DELETE",path:"/v1/crons/:cronId",classes:["person","app","broker","cron"],resource:"cron",scope:"crtr:schedule"},{name:"modelauth.get.81",method:"GET",path:"/v1/model-auth",classes:["person","broker"],resource:"none"},{name:"modelauth.get.82",method:"GET",path:"/v1/model-auth/readiness",classes:["person","broker"],resource:"none"},{name:"modelauth.put.83",method:"PUT",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"modelauth.delete.84",method:"DELETE",path:"/v1/model-auth/:provider",classes:["person","broker"],resource:"none"},{name:"modelauth.delete.account",method:"DELETE",path:"/v1/model-auth/:provider/accounts/:label",classes:["person","broker"],resource:"none"},{name:"modelauth.patch.account",method:"PATCH",path:"/v1/model-auth/:provider/accounts/:label",classes:["person","broker"],resource:"none"},{name:"model_auth.start",method:"POST",path:"/v1/model-auth/flows",classes:["person","broker"],resource:"none"},{name:"model_auth.complete",method:"POST",path:"/v1/model-auth/flows/:flow_id/complete",classes:["person","broker"],resource:"none"},{name:"model_auth.cancel",method:"POST",path:"/v1/model-auth/flows/:flow_id/cancel",classes:["person","broker"],resource:"none"},{name:"model_auth.get",method:"GET",path:"/v1/model-auth/flows/:flow_id",classes:["person","broker"],resource:"none"},{name:"nodes.post.85",method:"POST",path:"/v1/nodes",classes:["person","broker","cron"],resource:"node-own",scope:"crtr:act"},{name:"nodes.get.86",method:"GET",path:"/v1/nodes",classes:["person","broker"],resource:"nodes-list"},{name:"nodes.post.87",method:"POST",path:"/v1/nodes/revive-all",classes:["person","broker"],resource:"none"},{name:"nodes.get.88",method:"GET",path:"/v1/nodes/:id",classes:["person","broker","cron","forwarded"],resource:"node-read"},{name:"nodes.get.89",method:"GET",path:"/v1/nodes/:id/snapshot",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.90",method:"GET",path:"/v1/nodes/:id/subject",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.91",method:"GET",path:"/v1/nodes/:id/messages",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.92",method:"GET",path:"/v1/nodes/:id/session",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.93",method:"GET",path:"/v1/nodes/:id/transcript",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.get.94",method:"GET",path:"/v1/nodes/:id/context",classes:["person","broker","cron"],resource:"node-read"},{name:"nodes.post.96",method:"POST",path:"/v1/nodes/:id/fork",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.97",method:"POST",path:"/v1/nodes/:id/revive",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.98",method:"POST",path:"/v1/nodes/:id/relaunch-root",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.99",method:"POST",path:"/v1/nodes/:id/close",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.read",method:"POST",path:"/v1/nodes/:id/read",classes:["person"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.100",method:"POST",path:"/v1/nodes/:id/recycle",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.101",method:"POST",path:"/v1/nodes/:id/demote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.102",method:"POST",path:"/v1/nodes/:id/promote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.103",method:"POST",path:"/v1/nodes/:id/yield",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.104",method:"POST",path:"/v1/nodes/:id/wait",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.patch.105",method:"PATCH",path:"/v1/nodes/:id/config",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"broker-recovery.post.106",method:"POST",path:"/v1/broker/:id/turn",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.107",method:"POST",path:"/v1/broker/:id/provider-retry",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.108",method:"POST",path:"/v1/broker/:id/fault",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.get.109",method:"GET",path:"/v1/broker/:id/recovery",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.110",method:"POST",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"broker-recovery.delete.111",method:"DELETE",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"profiles.put.112",method:"PUT",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profiles.post.113",method:"POST",path:"/v1/profiles/:name/pause",classes:["person","broker"],resource:"profile"},{name:"profiles.post.114",method:"POST",path:"/v1/profiles/:name/resume",classes:["person","broker"],resource:"profile"},{name:"profiles.patch.115",method:"PATCH",path:"/v1/profiles/:name/metadata",classes:["person","app","broker"],resource:"profile"},{name:"profile.create",method:"POST",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile"},{name:"profile.update",method:"PATCH",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"app.env.list",method:"GET",path:"/v1/apps/self/env",classes:["person","app","broker"],resource:"profile"},{name:"app.env.set",method:"PUT",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"app.env.remove",method:"DELETE",path:"/v1/apps/self/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.list",method:"GET",path:"/v1/profiles/:name/env",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.set",method:"PUT",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.remove",method:"DELETE",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profiles.delete.116",method:"DELETE",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.list",method:"GET",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile",stage:"chat"},{name:"profiles.get.118",method:"GET",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"import.start",method:"POST",path:"/v1/imports",classes:["person","import"],resource:"none"},{name:"import.upload-urls",method:"POST",path:"/v1/imports/:run_id/upload-urls",classes:["person","import"],resource:"none"},{name:"import.store",method:"PUT",path:"/v1/imports/:run_id/stores/:name",classes:["person","import"],resource:"none"},{name:"import.load",method:"POST",path:"/v1/imports/:run_id/load",classes:["person","import"],resource:"none"},{name:"import.get",method:"GET",path:"/v1/imports/:run_id",classes:["person","import"],resource:"none"},{name:"import.rollback",method:"POST",path:"/v1/imports/:run_id/rollback",classes:["person"],resource:"none"},{name:"import.machine-credential",method:"POST",path:"/v1/imports/:run_id/machine-credential",classes:["person"],resource:"none"},{name:"execution.import-unpacked",method:"POST",path:"/v1/executions/:execution_id/import-unpacked",classes:["broker"],resource:"none"},{name:"execution.start",method:"GET",path:"/v1/executions/:execution_id/start",classes:["broker"],resource:"none"},{name:"environment.git-credential",method:"POST",path:"/v1/environments/:environment_id/git-credential",classes:["broker"],resource:"none"},{name:"node-outcomes.get.119",method:"GET",path:"/v1/nodes/:id/outcome",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.put.120",method:"PUT",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"node-outcomes.get.121",method:"GET",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker","cron"],resource:"node-read"},{name:"node-outcomes.delete.122",method:"DELETE",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"canvas.get.123",method:"GET",path:"/v1/canvas/attention",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.124",method:"POST",path:"/v1/canvas/attention/counts",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.125",method:"POST",path:"/v1/canvas/history/search",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.126",method:"POST",path:"/v1/canvas/history/grep",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.127",method:"GET",path:"/v1/canvas/history/read",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.post.128",method:"POST",path:"/v1/canvas/history/stats",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.129",method:"GET",path:"/v1/canvas/snapshot",classes:["person","broker","forwarded"],resource:"canvas-read"},{name:"canvas.get.130",method:"GET",path:"/v1/canvas/roster",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.live-roots",method:"GET",path:"/v1/canvas/live-roots",classes:["person"],resource:"canvas-read"},{name:"canvas.get.browse",method:"GET",path:"/v1/canvas/browse",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.analytics",method:"GET",path:"/v1/canvas/analytics",classes:["person","broker"],resource:"canvas-read"},{name:"memory-reads.post",method:"POST",path:"/v1/nodes/:id/memory-reads",classes:["person","broker"],resource:"node-own"},{name:"canvas.get.131",method:"GET",path:"/v1/canvas/graph",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.132",method:"POST",path:"/v1/canvas/prune",classes:["person","broker"],resource:"none"},{name:"daemon.post.133",method:"POST",path:"/v1/daemon/restart",classes:["person","broker"],resource:"daemon-control"},{name:"daemon.post.134",method:"POST",path:"/v1/daemon/migrate",classes:["person","broker"],resource:"daemon-control"},{name:"daemon.drain.start",method:"POST",path:"/v1/daemon/drain",classes:["person"],resource:"daemon-control"},{name:"daemon.drain.end",method:"DELETE",path:"/v1/daemon/drain",classes:["person"],resource:"daemon-control"},{name:"daemon.post.135",method:"POST",path:"/v1/daemon/admit",classes:["person","broker"],resource:"daemon-control"},{name:"human.components.list",method:"GET",path:"/v1/human/components",classes:["person","broker"],resource:"none"},{name:"human-requests.post.136",method:"POST",path:"/v1/human/requests",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"human-requests.get.137",method:"GET",path:"/v1/human/requests/:request_id",classes:["person","broker"],resource:"human"},{name:"human-requests.post.138",method:"POST",path:"/v1/human/requests/:request_id/replace",classes:["person","broker"],resource:"human"},{name:"human-requests.post.139",method:"POST",path:"/v1/human/requests/:request_id/respond",classes:["person","broker"],resource:"human"},{name:"human-requests.post.140",method:"POST",path:"/v1/human/requests/:request_id/dismiss",classes:["person","broker"],resource:"human"},{name:"human-requests.post.141",method:"POST",path:"/v1/human/requests/:request_id/cancel",classes:["person","broker"],resource:"human"},{name:"focus.get.142",method:"GET",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.post.143",method:"POST",path:"/v1/focuses",classes:["person","broker"],resource:"none"},{name:"focus.get.144",method:"GET",path:"/v1/focuses/by-node",classes:["person","broker"],resource:"none"},{name:"focus.get.145",method:"GET",path:"/v1/focuses/by-pane",classes:["person","broker"],resource:"none"},{name:"focus.patch.146",method:"PATCH",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"focus.delete.147",method:"DELETE",path:"/v1/focuses/:focus_id",classes:["person","broker"],resource:"none"},{name:"delivery.retry",method:"POST",path:"/v1/deliveries/:delivery_id/retry",classes:["person","broker"],resource:"none"},{name:"limits.show",method:"GET",path:"/v1/limits",classes:["person"],resource:"none"},{name:"limits.set",method:"PUT",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"limits.remove",method:"DELETE",path:"/v1/limits/apps/:app",classes:["person"],resource:"none"},{name:"charges.list",method:"GET",path:"/v1/charges",classes:["person","app","broker"],resource:"none",stage:"objects"},{name:"spend_limits.list",method:"GET",path:"/v1/spend-limits",classes:["person"],resource:"none"},{name:"spend_limits.set",method:"PUT",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"spend_limits.remove",method:"DELETE",path:"/v1/spend-limits/:id",classes:["person"],resource:"none"},{name:"space.list",method:"GET",path:"/v1/spaces",classes:["person","broker"],resource:"none"},{name:"kinds.list",method:"GET",path:"/v1/kinds",classes:["person","app","broker"],resource:"none"},{name:"grant.get",method:"GET",path:"/v1/grant",classes:["app"],resource:"none",stage:"v0.5"},{name:"exec",method:"POST",path:"/v1/exec",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5"},{name:"usage.get",method:"GET",path:"/v1/usage",classes:["person","app","broker"],resource:"none",stage:"v1"},{name:"llm",method:"POST",path:"/v1/llm",classes:["app","person","broker"],scope:"crtr:llm",resource:"none",stage:"v1"},{name:"structured-request.create",method:"POST",path:"/v1/structured-requests",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"structured-request.get",method:"GET",path:"/v1/structured-requests/:request_id",classes:["person","app","broker"],resource:"none"},{name:"structured-request.cancel",method:"POST",path:"/v1/structured-requests/:request_id/cancel",classes:["person","app","broker"],scope:"crtr:act",resource:"none"},{name:"run.start",method:"POST",path:"/v1/runs",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5",idempotency:"24h"},{name:"run.list",method:"GET",path:"/v1/runs",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.get",method:"GET",path:"/v1/runs/:run_id",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5"},{name:"run.message",method:"POST",path:"/v1/runs/:run_id/messages",classes:["app","person","broker","cron"],scope:"crtr:act",resource:"run",stage:"v0.5",idempotency:"24h"},{name:"run.events",method:"GET",path:"/v1/runs/:run_id/events",classes:["app","person","broker","cron"],resource:"run",stage:"v0.5",stream:!0},{name:"run.interrupt",method:"POST",path:"/v1/runs/:run_id/interrupt",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.cancel",method:"POST",path:"/v1/runs/:run_id/cancel",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.delete",method:"DELETE",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.rename",method:"POST",path:"/v1/runs/:run_id/rename",classes:["app"],resource:"run",stage:"chat"},{name:"question.get",method:"GET",path:"/v1/questions/:question_id",classes:["app"],resource:"none",stage:"chat"},{name:"question.answer",method:"POST",path:"/v1/questions/:question_id/answer",classes:["app"],resource:"none",stage:"chat"},{name:"question.cancel",method:"POST",path:"/v1/questions/:question_id/cancel",classes:["app"],resource:"none",stage:"chat"},{name:"trace.get",method:"GET",path:"/v1/runs/:run_id/trace",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"upload.create",method:"POST",path:"/v1/uploads",classes:["app"],scope:"crtr:act",resource:"none",stage:"file-transfer"},{name:"attachment.link",method:"GET",path:"/v1/attachments/link",classes:["app"],resource:"none",stage:"file-transfer"},{name:"file.download",method:"GET",path:"/v1/files/download",classes:["app"],resource:"none",stage:"file-transfer",stream:"bytes"},{name:"share.create",method:"POST",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.list",method:"GET",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.delete",method:"DELETE",path:"/v1/shares/:share_id",classes:["app"],resource:"none",stage:"file-transfer"},{name:"memory.list",method:"GET",path:"/v1/memory",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"memory.get",method:"GET",path:"/v1/memory/document",classes:["person","app","broker"],resource:"none",stage:"m13"},{name:"audit.list",method:"GET",path:"/v1/audit",classes:["person","app"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.tools",method:"GET",path:"/v1/providers/:provider/tools",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"provider.call",method:"POST",path:"/v1/provider/call",classes:["person","app","broker","cron"],resource:"none",stage:"v1"},{name:"peer.events",method:"POST",path:"/v1/peer/events",classes:["machine"],resource:"none"},{name:"peer.outbox.claim",method:"POST",path:"/v1/peer/outbox/claim",classes:["machine"],resource:"none"},{name:"peer.outbox.ack",method:"POST",path:"/v1/peer/outbox/ack",classes:["machine"],resource:"none"},{name:"peer.locate",method:"POST",path:"/v1/peer/locate",classes:["machine"],resource:"none"},{name:"runtime.sync-notice",method:"POST",path:"/v1/runtime/sync-notice",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-status",method:"GET",path:"/v1/runtime/vendor-status",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-account-remove",method:"POST",path:"/v1/runtime/vendor-account-remove",classes:["directory"],resource:"none",stage:"v1"}];function c(e,s){return n.find(o=>o.method===e.toUpperCase()&&o.path===s)}r(c,"operationFor");export{n as OPERATIONS,c as operationFor};

package/dist/daemon/api/router.d.ts

@@ -33,7 +33,13 @@ export type RequestPrincipal = {
     grant: string | null;
     client_id: string | null;
     scopes: string[] | null;
-} | CronPrincipalClass | ForwardedPrincipal | MachinePrincipal;
+} | CronPrincipalClass | ForwardedPrincipal | MachinePrincipal | ImportPrincipal;
+/** A hosted import's caller, on the `import.*` rows that list `import` only: hosting's service credential (`CRTR_IMPORT_SERVICE_TOKEN`, `run` null:
+ *  starts and reads runs for a named person) or one run's import token (`run` set: that run's `upload-urls`, `stores`, `load` and `get`). It is never a person or an app. */
+export type ImportPrincipal = {
+    class: 'import';
+    run: string | null;
+};
 /** A call another of the account's machines makes on behalf of a person or an app node (the `Crtr-Envelope` names which). `via` is the calling
  *  machine (`runtime:<id>`), `sub` the account owner. An app actor reads and writes as its app, bounded by its mirrored grant and the node's
  *  `node_scopes`, confined to `place`; a person actor is treated as the person. Only the rows that list `forwarded` admit it. */

package/dist/daemon/api/router.js

@@ -1 +1 @@
-var P=Object.defineProperty;var d=(e,t)=>P(e,"name",{value:t,configurable:!0});import{toErrorBody as H}from"./map.js";import{emitEvent as D}from"../../core/events/emit.js";import{scopeAllowed as _,ScopeDeniedError as I}from"../../core/scopes.js";import{coveredByAny as L}from"../../shared/env.js";import{ApiError as u}from"../../api/errors.js";import{activeGrant as F,grantFor as S}from"../../core/grants/mirror.js";import{getNode as w}from"../../core/canvas/canvas.js";import{ownedRun as J,RunError as b}from"../../core/runs/operations.js";import{openDb as x}from"../../core/canvas/db.js";import{check as Y,permits as M}from"../../core/permissions/evaluator.js";import{readerFor as R}from"./reader.js";import{checkCronFire as Z}from"../cron/authority.js";import{operationFor as V}from"./operations.js";import{CONTROL_BODY_MAX_BYTES as X}from"../../core/llm/body-limits.js";import{getRequest as p,getRequestByInboxTicket as A}from"../../core/human/requests.js";import{requireVisibleReview as y}from"../../core/review/store.js";import{getComment as v}from"../../core/review/comments.js";import{getStructuredRequest as K}from"../../core/canvas/structured-requests.js";async function Q(e,t,n,o,s){const r=e.path,a=s&&typeof s=="object"&&!Array.isArray(s)?s:{};if(r==="/v1/human/requests"||r==="/v1/human/reviews"){const i=r.endsWith("/reviews")?a.origin_node_id:a.requester_node_id,c=r==="/v1/human/requests"&&i==null;if(i!==t.node&&!c)throw new u(403,"other_app_run","a broker may create a human request only for its own node");const h=a.source;if(h&&typeof h=="object"&&"nodeId"in h&&h.nodeId!==t.node)throw new u(403,"other_app_run","request source must name the calling node")}if(r==="/v1/human/reviews/self/comments"&&e.method==="GET"&&o.get("actor_node_id")!==t.node)throw new u(403,"other_app_run","self review requires the calling node");if(r.includes("/comments")&&e.method!=="GET"&&a.actor_node_id!==t.node)throw new u(403,"other_app_run","comment author must be the calling node");if(n.comment_id&&!await v(n.comment_id))throw new u(404,"not_found","comment not found")}d(Q,"authorizeHumanBody");function O(e){return e.class==="broker"||e.class==="cron"}d(O,"boundedByStoredScopes");function k(e){return e.class==="person"||e.class==="anonymous"||e.class==="machine"?null:e.class==="forwarded"?e.actor.kind==="app"?e.actor.app:null:e.app}d(k,"appOf");function g(e){return e.class==="person"&&e.sub===void 0||e.class==="forwarded"&&e.actor.kind==="person"}d(g,"actsAsPerson");async function C(e){const t=await S(e.actor.app,e.sub);if(!t)throw new u(403,"app_not_granted",`${e.actor.app} holds no active grant for ${e.sub} on this machine`);return t}d(C,"forwardedGrant");async function $(e){if(e.class==="person"||e.class==="anonymous"||e.class==="machine")return[];if(e.class==="forwarded"){if(e.actor.kind==="person")return[];const{resolved:n}=await C(e),o=e.actor.node_scopes;return o===null?n:o.filter(s=>L(n,s))}if(e.class==="app")return e.scopes;if(e.class==="cron"){const n=await Z({grantee:e.app,sub:e.sub,grant_id:e.grant,scopes:e.scopes});if(n.allowed)return n.effectiveScopes;throw n.reason==="grant_missing"||n.reason==="grant_revoked"?new u(401,"grant_revoked",n.message):new u(403,"scope_missing",n.message)}const t=e.grant?await F(e.grant):await S(e.app,e.sub);if(t&&t.grantee===e.app&&t.sub===e.sub)return t.resolved;throw new u(401,"grant_revoked","the node grant is not active")}d($,"resolvedScopes");function N(e){return"class"in e?k(e):e.grantee}d(N,"runCallerApp");function T(e){return"class"in e?e:{class:"app",app:e.grantee,scopes:e.resolved,sub:e.sub}}d(T,"asRequestPrincipal");async function f(e,t,n){const o=T(e);if(g(o))return!0;if(o.class==="anonymous"||o.class==="machine")return!1;const s=await x();return await Y(s,await R(s,{principal:o}),t,n)}d(f,"mayOnNode");async function Te(e){if(g(e))return null;if(e.class==="anonymous"||e.class==="machine")return new Set;const t=await x(),n=await M(t,await R(t,{principal:e}),"read"),o=await t.prepareUncached(`SELECT o.id FROM objects o WHERE o.type = 'node' AND o.deleted_at IS NULL AND ${n.sql}`).all(...n.params);return new Set(o.map(s=>s.id))}d(Te,"readableNodeIds");async function W(e,t,n){const o=T(e);return g(o)?!0:o.class==="anonymous"||o.class==="machine"?!1:k(o)===t?!0:_(await $(o),n)&&(!O(o)||_(o.scopes,n))}d(W,"mayReadApp");async function We(e,t,n){return n===void 0?await W(e,t,`crtr:conversations:read:${t}`):await f(e,"read",n)}d(We,"canReadRun");async function ze(e,t,n=!1,o=!1){const s=await w(t);if(!s||s.parent!==null||s.run_id!==t||!s.grantee||s.deleting_at&&!o)throw new b(404,"not_found","run not found");if(!await f(e,"read",t))throw new b(404,"not_found","run not found");if(n&&N(e)!==null&&N(e)!==s.grantee)throw new b(403,"other_app_run","cannot change another app's run");return await J(t,s.grantee,o)}d(ze,"requireRun");async function ee(e,t,n){return n===void 0?await W(e,t,`crtr:objects:read:${t}`):await f(e,"read",n)}d(ee,"canReadNode");const z=new Set(["messages.post.58","messages.post.59"]);async function te(e,t,n){if(!e.classes.includes(t.class)&&!(t.class!=="anonymous"&&t.class!=="machine"&&t.class!=="forwarded"&&e.classes.includes("anonymous")))throw new u(403,"permission_error","this operation is not available to the caller");if(t.class==="forwarded"&&t.actor.kind==="app"&&await C(t),t.class==="anonymous"||t.class==="machine"||g(t))return;if(t.class==="person")return await ne(e,t,n);const o=await $(t);if(e.scope&&(!_(o,e.scope)||O(t)&&!_(t.scopes,e.scope)))throw new u(403,"scope_missing",`missing scope ${e.scope}`);if(t.class==="app")return;const s=k(t);t.class==="broker"&&await ae(e,t,n,o);const r=n.id;if((e.resource==="node-read"||e.resource==="node-write")&&r!==void 0){const a=await w(r);if(!a)return;if(e.resource==="node-write"){const i=z.has(e.name);if(a.grantee!==s&&!i)throw new u(403,"other_app_run","cannot change another app's node");if(!await f(t,i&&a.grantee!==s?"message":"read",r))throw a.grantee!==s?new u(403,"other_app_run","cannot change another app's node"):new u(404,"not_found","node not found")}if(e.resource==="node-read"&&!await f(t,"read",r))throw new u(404,"not_found","node not found")}}d(te,"authorizeOperation");async function ne(e,t,n){if(e.resource==="daemon-bash")throw new u(403,"permission_error","a shell on the daemon host is not available to a person bearer");if(e.resource==="human")return await oe(e,t,n);if(n.request_id!==void 0&&e.path.startsWith("/v1/structured-requests/"))return await re(e,t,n.request_id);const o=n.id;if(!(e.resource!=="node-read"&&e.resource!=="node-write"||o===void 0||!await w(o))&&!await f(t,z.has(e.name)?"message":"read",o))throw new u(404,"not_found","node not found")}d(ne,"authorizePersonNode");async function oe(e,t,n){const o=n.ticket_id!==void 0?new u(404,"ticket_not_found","no matching ticket"):new u(404,"not_found","no request with that id"),s=n.request_id?await p(n.request_id):n.ticket_id?await A(n.ticket_id):null,r=n.comment_id?await v(n.comment_id):null,a=n.review_id?await y(n.review_id).catch(()=>null):r?await y(r.review_id).catch(()=>null):null;if((n.request_id??n.ticket_id??n.review_id??n.comment_id)===void 0)return;const c=s?.requester_node_id??a?.origin_node_id;if(!c||!await w(c)||!await f(t,e.method==="GET"?"read":"edit",c))throw o}d(oe,"authorizePersonHuman");async function re(e,t,n){const o=await K(n);if(o!==null&&(o.node_id===null||!await w(o.node_id)||!await f(t,e.method==="GET"?"read":"edit",o.node_id)))throw new u(404,"structured_request_not_found",`unknown structured request: ${n}`)}d(re,"authorizePersonStructuredRequest");async function se(e,t,n){const o=n&&typeof n=="object"&&!Array.isArray(n)?n:{},s=e.path;if(s==="/v1/human/requests"||s==="/v1/human/reviews"){const r=o.source,a=s.endsWith("/reviews")?o.origin_node_id:o.requester_node_id;if(typeof a!="string")throw new u(403,"permission_error","a request must name a node the person acts on");const i=s.endsWith("/requests")&&r&&typeof r=="object"&&"nodeId"in r?r.nodeId:void 0;for(const c of[a,i])if(c!==void 0&&(typeof c!="string"||!await w(c)||!await f(t,"edit",c)))throw new u(404,"not_found","node not found")}if(s==="/v1/structured-requests"){const r=o.target,a=r&&typeof r=="object"&&"kind"in r&&r.kind==="node"&&"node_id"in r?r.node_id:void 0;if(typeof a=="string"&&await w(a)&&!await f(t,"message",a))throw new u(404,"node_not_found",`unknown node: ${a}`)}}d(se,"authorizePersonBody");async function ae(e,t,n,o){if(e.resource==="daemon-bash"&&(!_(o,"crtr:files:rw:user:.")||!_(t.scopes,"crtr:files:rw:user:.")))throw new u(403,"scope_missing","missing scope crtr:files:rw:user:.");if(e.resource==="human"){const r=e.path,a=e.method==="GET";if(!a&&(r.endsWith("/respond")||r.endsWith("/submit")||r.endsWith("/dismiss")||r.endsWith("/progress")||r.endsWith("/comment-ranges")||r.includes("/feedback-comments")))throw new u(403,"permission_error","only the person may answer or edit the human inbox");const i=n.request_id?await p(n.request_id):n.ticket_id?await A(n.ticket_id):null,c=n.comment_id?await v(n.comment_id):null,h=n.review_id?await y(n.review_id):c?await y(c.review_id):null,m=i?.requester_node_id??h?.origin_node_id;if(m!=null){const l=await w(m);if(l&&(a?!await ee(t,l.grantee??"app:terminal",m):l.grantee!==t.app))throw new u(a?404:403,a?"not_found":"other_app_run","human request belongs to another app");if(l&&!a&&!await f(t,"read",m))throw new u(404,"not_found","human request not found")}else if(i||h)throw new u(403,"permission_error","only the person may access a request without a node")}const s=n.id;if(e.resource==="node-own"&&s!==void 0&&s!==t.node)throw new u(403,"other_app_run","the operation requires the calling node")}d(ae,"authorizeBrokerOnly");function de(e,t){if(!_(e,t))throw new I("the bearer token",t)}d(de,"assertCeiling");function ue(){return new u(403,"owner_only","this operation is owner-only; a scoped token does not reach it")}d(ue,"ownerOnlyError");const ie="Crtr-Caused-By",ce=/^(?:message|request|cron_run):[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function fe(e){const t=e[ie.toLowerCase()];return typeof t=="string"&&ce.test(t)?t:void 0}d(fe,"causedByOf");function Ue(e){return e.map(t=>({...t,ownerOnly:!0}))}d(Ue,"ownerOnly");class Ge{static{d(this,"Router")}routes=[];register(t){const n=V(t.method,t.pattern);if(!n)throw new Error(`route has no operation row: ${t.method} ${t.pattern}`);if(this.routes.some(o=>o.method===t.method.toUpperCase()&&o.operation.path===t.pattern))throw new Error(`duplicate route: ${t.method} ${t.pattern}`);return this.routes.push({operation:n,method:t.method.toUpperCase(),segments:U(t.pattern),handler:t.handler,maxBodyBytes:t.maxBodyBytes??X}),this}registerAll(t){for(const n of t)this.register(n);return this}match(t,n){const o=t.toUpperCase(),s=U(n);for(const r of this.routes){if(r.method!==o)continue;const a=he(r.segments,s);if(a!==null)return{handler:r.handler,params:a,operation:r.operation,maxBodyBytes:r.maxBodyBytes}}return null}async handle(t,n,o,s={class:"person"}){try{const r=new URL(t.url??"/","http://127.0.0.1"),a=(t.method??"GET").toUpperCase(),i=this.match(a,r.pathname);if(i===null){j(n,404,"not_found",`no route for ${a} ${r.pathname}`);return}if(await te(i.operation,s,i.params),o!==null){if(i.operation.classes.length===1&&i.operation.classes[0]==="person")throw ue();i.operation.scope&&de(o,i.operation.scope)}let c;try{c=await we(t,i.maxBodyBytes)}catch(E){const B=E instanceof G?"payload_too_large":"invalid_request";j(n,B==="payload_too_large"?413:400,B,E.message);return}s.class==="person"&&s.sub!==void 0&&await se(i.operation,s,c),s.class==="broker"&&i.operation.resource==="human"&&await Q(i.operation,s,i.params,r.searchParams,c);const h=fe(t.headers),m={...h===void 0?{}:{causedBy:h},method:a,path:r.pathname,params:i.params,query:r.searchParams,body:c,ceiling:o,principal:s,...s.class==="anonymous"&&typeof t.headers.authorization=="string"?{publishToken:t.headers.authorization.slice(7)}:{},req:t,res:n},l=await i.handler(m);n.writableEnded||me(n,l)}catch(r){if(r instanceof Error&&r.code==="person_unresolved"){q(n,503,{error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}});return}const{status:a,body:i}=H(r);a>=500&&D({event:"api.request.failed",level:"error",error:r instanceof Error?r:new Error(String(r)),...s.class==="broker"?{node_id:s.node}:{},fields:{method:(t.method??"GET").toUpperCase(),path:t.url??""}}),q(n,a,i)}}}function U(e){return e.split("/").filter(t=>t.length>0)}d(U,"splitPath");function he(e,t){if(e.length!==t.length)return null;const n={};for(let o=0;o<e.length;o++){const s=e[o],r=t[o];if(s.startsWith(":"))n[s.slice(1)]=decodeURIComponent(r);else if(s!==r)return null}return n}d(he,"matchSegments");class G extends Error{static{d(this,"BodyTooLargeError")}}async function we(e,t){const n=[];let o=0;for await(const r of e){const a=r;if(o+=a.length,o>t)throw new G(`request body exceeds ${t} bytes`);n.push(a)}if(o===0)return;const s=Buffer.concat(n).toString("utf8").trim();if(s!=="")try{return JSON.parse(s)}catch{throw new Error("request body is not valid JSON")}}d(we,"readJsonBody");function me(e,t){if(e.headersSent)return;const n={...t.headers??{}};if(t.rawBody!==void 0){e.writeHead(t.status,n),e.end(t.rawBody);return}if(t.status===204||t.body===void 0){e.writeHead(t.status,n),e.end();return}n["content-type"]===void 0&&(n["content-type"]="application/json; charset=utf-8"),e.writeHead(t.status,n),e.end(JSON.stringify(t.body))}d(me,"writeResult");function q(e,t,n){if(e.headersSent){e.end();return}e.writeHead(t,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify(n))}d(q,"writeJson");function j(e,t,n,o){q(e,t,{error:{code:n,message:o,origin:"runtime"}})}d(j,"writeError");export{ie as CAUSED_BY_HEADER,Ge as Router,g as actsAsPerson,k as appOf,de as assertCeiling,ee as canReadNode,We as canReadRun,fe as causedByOf,f as mayOnNode,Ue as ownerOnly,ue as ownerOnlyError,Te as readableNodeIds,ze as requireRun,$ as resolvedScopes,N as runCallerApp};
+var j=Object.defineProperty;var d=(e,t)=>j(e,"name",{value:t,configurable:!0});import{toErrorBody as H}from"./map.js";import{emitEvent as D}from"../../core/events/emit.js";import{scopeAllowed as _,ScopeDeniedError as I}from"../../core/scopes.js";import{coveredByAny as L}from"../../shared/env.js";import{ApiError as u}from"../../api/errors.js";import{activeGrant as F,activeGrantsOfPerson as J,grantFor as S}from"../../core/grants/mirror.js";import{getNode as w}from"../../core/canvas/canvas.js";import{ownedRun as M,RunError as b}from"../../core/runs/operations.js";import{openDb as x}from"../../core/canvas/db.js";import{check as Y,permits as Z}from"../../core/permissions/evaluator.js";import{readerFor as R}from"./reader.js";import{checkCronFire as V}from"../cron/authority.js";import{operationFor as X}from"./operations.js";import{CONTROL_BODY_MAX_BYTES as K}from"../../core/llm/body-limits.js";import{getRequest as A,getRequestByInboxTicket as O}from"../../core/human/requests.js";import{requireVisibleReview as g}from"../../core/review/store.js";import{getComment as v}from"../../core/review/comments.js";import{getStructuredRequest as Q}from"../../core/canvas/structured-requests.js";async function ee(e,t,o,n,s){const r=e.path,a=s&&typeof s=="object"&&!Array.isArray(s)?s:{};if(r==="/v1/human/requests"||r==="/v1/human/reviews"){const i=r.endsWith("/reviews")?a.origin_node_id:a.requester_node_id,c=r==="/v1/human/requests"&&i==null;if(i!==t.node&&!c)throw new u(403,"other_app_run","a broker may create a human request only for its own node");const h=a.source;if(h&&typeof h=="object"&&"nodeId"in h&&h.nodeId!==t.node)throw new u(403,"other_app_run","request source must name the calling node")}if(r==="/v1/human/reviews/self/comments"&&e.method==="GET"&&n.get("actor_node_id")!==t.node)throw new u(403,"other_app_run","self review requires the calling node");if(r.includes("/comments")&&e.method!=="GET"&&a.actor_node_id!==t.node)throw new u(403,"other_app_run","comment author must be the calling node");if(o.comment_id&&!await v(o.comment_id))throw new u(404,"not_found","comment not found")}d(ee,"authorizeHumanBody");function C(e){return e.class==="broker"||e.class==="cron"}d(C,"boundedByStoredScopes");function k(e){return e.class==="person"||e.class==="anonymous"||e.class==="machine"||e.class==="import"?null:e.class==="forwarded"?e.actor.kind==="app"?e.actor.app:null:e.app}d(k,"appOf");function y(e){return e.class==="person"&&e.sub===void 0||e.class==="forwarded"&&e.actor.kind==="person"}d(y,"actsAsPerson");async function $(e){const t=await S(e.actor.app,e.sub);if(!t)throw new u(403,"app_not_granted",`${e.actor.app} holds no active grant for ${e.sub} on this machine`);return t}d($,"forwardedGrant");async function p(e){if(e.class==="person"&&e.sub!==void 0)return(await J(e.sub)).flatMap(o=>o.resolved);if(e.class==="person"||e.class==="anonymous"||e.class==="machine"||e.class==="import")return[];if(e.class==="forwarded"){if(e.actor.kind==="person")return[];const{resolved:o}=await $(e),n=e.actor.node_scopes;return n===null?o:n.filter(s=>L(o,s))}if(e.class==="app")return e.scopes;if(e.class==="cron"){const o=await V({grantee:e.app,sub:e.sub,grant_id:e.grant,scopes:e.scopes});if(o.allowed)return o.effectiveScopes;throw o.reason==="grant_missing"||o.reason==="grant_revoked"?new u(401,"grant_revoked",o.message):new u(403,"scope_missing",o.message)}const t=e.grant?await F(e.grant):await S(e.app,e.sub);if(t&&t.grantee===e.app&&t.sub===e.sub)return t.resolved;throw new u(401,"grant_revoked","the node grant is not active")}d(p,"resolvedScopes");function N(e){return"class"in e?k(e):e.grantee}d(N,"runCallerApp");function T(e){return"class"in e?e:{class:"app",app:e.grantee,scopes:e.resolved,sub:e.sub}}d(T,"asRequestPrincipal");async function f(e,t,o){const n=T(e);if(y(n))return!0;if(n.class==="anonymous"||n.class==="machine"||n.class==="import")return!1;const s=await x();return await Y(s,await R(s,{principal:n}),t,o)}d(f,"mayOnNode");async function We(e){if(y(e))return null;if(e.class==="anonymous"||e.class==="machine"||e.class==="import")return new Set;const t=await x(),o=await Z(t,await R(t,{principal:e}),"read"),n=await t.prepareUncached(`SELECT o.id FROM objects o WHERE o.type = 'node' AND o.deleted_at IS NULL AND ${o.sql}`).all(...o.params);return new Set(n.map(s=>s.id))}d(We,"readableNodeIds");async function W(e,t,o){const n=T(e);return y(n)?!0:n.class==="anonymous"||n.class==="machine"||n.class==="import"?!1:k(n)===t?!0:_(await p(n),o)&&(!C(n)||_(n.scopes,o))}d(W,"mayReadApp");async function ze(e,t,o){return o===void 0?await W(e,t,`crtr:conversations:read:${t}`):await f(e,"read",o)}d(ze,"canReadRun");async function Ge(e,t,o=!1,n=!1){const s=await w(t);if(!s||s.parent!==null||s.run_id!==t||!s.grantee||s.deleting_at&&!n)throw new b(404,"not_found","run not found");if(!await f(e,"read",t))throw new b(404,"not_found","run not found");if(o&&N(e)!==null&&N(e)!==s.grantee)throw new b(403,"other_app_run","cannot change another app's run");return await M(t,s.grantee,n)}d(Ge,"requireRun");async function te(e,t,o){return o===void 0?await W(e,t,`crtr:objects:read:${t}`):await f(e,"read",o)}d(te,"canReadNode");const z=new Set(["messages.post.58","messages.post.59"]);async function oe(e,t,o){if(!e.classes.includes(t.class)&&!(t.class!=="anonymous"&&t.class!=="machine"&&t.class!=="import"&&t.class!=="forwarded"&&e.classes.includes("anonymous")))throw new u(403,"permission_error","this operation is not available to the caller");if(t.class==="forwarded"&&t.actor.kind==="app"&&await $(t),t.class==="anonymous"||t.class==="machine"||t.class==="import"||y(t))return;if(t.class==="person")return await ne(e,t,o);const n=await p(t);if(e.scope&&(!_(n,e.scope)||C(t)&&!_(t.scopes,e.scope)))throw new u(403,"scope_missing",`missing scope ${e.scope}`);if(t.class==="app")return;const s=k(t);t.class==="broker"&&await de(e,t,o,n);const r=o.id;if((e.resource==="node-read"||e.resource==="node-write")&&r!==void 0){const a=await w(r);if(!a)return;if(e.resource==="node-write"){const i=z.has(e.name);if(a.grantee!==s&&!i)throw new u(403,"other_app_run","cannot change another app's node");if(!await f(t,i&&a.grantee!==s?"message":"read",r))throw a.grantee!==s?new u(403,"other_app_run","cannot change another app's node"):new u(404,"not_found","node not found")}if(e.resource==="node-read"&&!await f(t,"read",r))throw new u(404,"not_found","node not found")}}d(oe,"authorizeOperation");async function ne(e,t,o){if(e.resource==="daemon-bash")throw new u(403,"permission_error","a shell on the daemon host is not available to a person bearer");if(e.resource==="daemon-control")throw new u(403,"permission_error","restarting, migrating, admitting or draining the daemon is not available to a person bearer");if(e.resource==="human")return await re(e,t,o);if(o.request_id!==void 0&&e.path.startsWith("/v1/structured-requests/"))return await se(e,t,o.request_id);const n=o.id;if(!(e.resource!=="node-read"&&e.resource!=="node-write"||n===void 0||!await w(n))&&!await f(t,z.has(e.name)?"message":"read",n))throw new u(404,"not_found","node not found")}d(ne,"authorizePersonNode");async function re(e,t,o){const n=o.ticket_id!==void 0?new u(404,"ticket_not_found","no matching ticket"):new u(404,"not_found","no request with that id"),s=o.request_id?await A(o.request_id):o.ticket_id?await O(o.ticket_id):null,r=o.comment_id?await v(o.comment_id):null,a=o.review_id?await g(o.review_id).catch(()=>null):r?await g(r.review_id).catch(()=>null):null;if((o.request_id??o.ticket_id??o.review_id??o.comment_id)===void 0)return;const c=s?.requester_node_id??a?.origin_node_id;if(!c||!await w(c)||!await f(t,e.method==="GET"?"read":"edit",c))throw n}d(re,"authorizePersonHuman");async function se(e,t,o){const n=await Q(o);if(n!==null&&(n.node_id===null||!await w(n.node_id)||!await f(t,e.method==="GET"?"read":"edit",n.node_id)))throw new u(404,"structured_request_not_found",`unknown structured request: ${o}`)}d(se,"authorizePersonStructuredRequest");async function ae(e,t,o){const n=o&&typeof o=="object"&&!Array.isArray(o)?o:{},s=e.path;if(s==="/v1/human/requests"||s==="/v1/human/reviews"){const r=n.source,a=s.endsWith("/reviews")?n.origin_node_id:n.requester_node_id;if(typeof a!="string")throw new u(403,"permission_error","a request must name a node the person acts on");const i=s.endsWith("/requests")&&r&&typeof r=="object"&&"nodeId"in r?r.nodeId:void 0;for(const c of[a,i])if(c!==void 0&&(typeof c!="string"||!await w(c)||!await f(t,"edit",c)))throw new u(404,"not_found","node not found")}if(s==="/v1/structured-requests"){const r=n.target,a=r&&typeof r=="object"&&"kind"in r&&r.kind==="node"&&"node_id"in r?r.node_id:void 0;if(typeof a=="string"&&await w(a)&&!await f(t,"message",a))throw new u(404,"node_not_found",`unknown node: ${a}`)}}d(ae,"authorizePersonBody");async function de(e,t,o,n){if(e.resource==="daemon-bash"&&(!_(n,"crtr:files:rw:user:.")||!_(t.scopes,"crtr:files:rw:user:.")))throw new u(403,"scope_missing","missing scope crtr:files:rw:user:.");if(e.resource==="human"){const r=e.path,a=e.method==="GET";if(!a&&(r.endsWith("/respond")||r.endsWith("/submit")||r.endsWith("/dismiss")||r.endsWith("/progress")||r.endsWith("/comment-ranges")||r.includes("/feedback-comments")))throw new u(403,"permission_error","only the person may answer or edit the human inbox");const i=o.request_id?await A(o.request_id):o.ticket_id?await O(o.ticket_id):null,c=o.comment_id?await v(o.comment_id):null,h=o.review_id?await g(o.review_id):c?await g(c.review_id):null,m=i?.requester_node_id??h?.origin_node_id;if(m!=null){const l=await w(m);if(l&&(a?!await te(t,l.grantee??"app:terminal",m):l.grantee!==t.app))throw new u(a?404:403,a?"not_found":"other_app_run","human request belongs to another app");if(l&&!a&&!await f(t,"read",m))throw new u(404,"not_found","human request not found")}else if(i||h)throw new u(403,"permission_error","only the person may access a request without a node")}const s=o.id;if(e.resource==="node-own"&&s!==void 0&&s!==t.node)throw new u(403,"other_app_run","the operation requires the calling node")}d(de,"authorizeBrokerOnly");function ue(e,t){if(!_(e,t))throw new I("the bearer token",t)}d(ue,"assertCeiling");function ie(){return new u(403,"owner_only","this operation is owner-only; a scoped token does not reach it")}d(ie,"ownerOnlyError");const ce="Crtr-Caused-By",fe=/^(?:message|request|cron_run):[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;function he(e){const t=e[ce.toLowerCase()];return typeof t=="string"&&fe.test(t)?t:void 0}d(he,"causedByOf");function Ue(e){return e.map(t=>({...t,ownerOnly:!0}))}d(Ue,"ownerOnly");class Pe{static{d(this,"Router")}routes=[];register(t){const o=X(t.method,t.pattern);if(!o)throw new Error(`route has no operation row: ${t.method} ${t.pattern}`);if(this.routes.some(n=>n.method===t.method.toUpperCase()&&n.operation.path===t.pattern))throw new Error(`duplicate route: ${t.method} ${t.pattern}`);return this.routes.push({operation:o,method:t.method.toUpperCase(),segments:G(t.pattern),handler:t.handler,maxBodyBytes:t.maxBodyBytes??K}),this}registerAll(t){for(const o of t)this.register(o);return this}match(t,o){const n=t.toUpperCase(),s=G(o);for(const r of this.routes){if(r.method!==n)continue;const a=we(r.segments,s);if(a!==null)return{handler:r.handler,params:a,operation:r.operation,maxBodyBytes:r.maxBodyBytes}}return null}async handle(t,o,n,s={class:"person"}){try{const r=new URL(t.url??"/","http://127.0.0.1"),a=(t.method??"GET").toUpperCase(),i=this.match(a,r.pathname);if(i===null){P(o,404,"not_found",`no route for ${a} ${r.pathname}`);return}if(await oe(i.operation,s,i.params),n!==null){if(i.operation.classes.length===1&&i.operation.classes[0]==="person")throw ie();i.operation.scope&&ue(n,i.operation.scope)}let c;try{c=await me(t,i.maxBodyBytes)}catch(E){const B=E instanceof U?"payload_too_large":"invalid_request";P(o,B==="payload_too_large"?413:400,B,E.message);return}s.class==="person"&&s.sub!==void 0&&await ae(i.operation,s,c),s.class==="broker"&&i.operation.resource==="human"&&await ee(i.operation,s,i.params,r.searchParams,c);const h=he(t.headers),m={...h===void 0?{}:{causedBy:h},method:a,path:r.pathname,params:i.params,query:r.searchParams,body:c,ceiling:n,principal:s,...s.class==="anonymous"&&typeof t.headers.authorization=="string"?{publishToken:t.headers.authorization.slice(7)}:{},req:t,res:o},l=await i.handler(m);o.writableEnded||_e(o,l)}catch(r){if(r instanceof Error&&r.code==="person_unresolved"){q(o,503,{error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}});return}const{status:a,body:i}=H(r);a>=500&&D({event:"api.request.failed",level:"error",error:r instanceof Error?r:new Error(String(r)),...s.class==="broker"?{node_id:s.node}:{},fields:{method:(t.method??"GET").toUpperCase(),path:t.url??""}}),q(o,a,i)}}}function G(e){return e.split("/").filter(t=>t.length>0)}d(G,"splitPath");function we(e,t){if(e.length!==t.length)return null;const o={};for(let n=0;n<e.length;n++){const s=e[n],r=t[n];if(s.startsWith(":"))o[s.slice(1)]=decodeURIComponent(r);else if(s!==r)return null}return o}d(we,"matchSegments");class U extends Error{static{d(this,"BodyTooLargeError")}}async function me(e,t){const o=[];let n=0;for await(const r of e){const a=r;if(n+=a.length,n>t)throw new U(`request body exceeds ${t} bytes`);o.push(a)}if(n===0)return;const s=Buffer.concat(o).toString("utf8").trim();if(s!=="")try{return JSON.parse(s)}catch{throw new Error("request body is not valid JSON")}}d(me,"readJsonBody");function _e(e,t){if(e.headersSent)return;const o={...t.headers??{}};if(t.rawBody!==void 0){e.writeHead(t.status,o),e.end(t.rawBody);return}if(t.status===204||t.body===void 0){e.writeHead(t.status,o),e.end();return}o["content-type"]===void 0&&(o["content-type"]="application/json; charset=utf-8"),e.writeHead(t.status,o),e.end(JSON.stringify(t.body))}d(_e,"writeResult");function q(e,t,o){if(e.headersSent){e.end();return}e.writeHead(t,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify(o))}d(q,"writeJson");function P(e,t,o,n){q(e,t,{error:{code:o,message:n,origin:"runtime"}})}d(P,"writeError");export{ce as CAUSED_BY_HEADER,Pe as Router,y as actsAsPerson,k as appOf,ue as assertCeiling,te as canReadNode,ze as canReadRun,he as causedByOf,f as mayOnNode,Ue as ownerOnly,ie as ownerOnlyError,We as readableNodeIds,Ge as requireRun,p as resolvedScopes,N as runCallerApp};

package/dist/daemon/api/server.js

@@ -1 +1 @@
-var Pe=Object.defineProperty;var o=(e,r)=>Pe(e,"name",{value:r,configurable:!0});import{createServer as te}from"node:http";import{createServer as Ne}from"node:https";import{chmodSync as ze,existsSync as V,readFileSync as ne,unlinkSync as oe}from"node:fs";import{MINIMUM_RUNTIME_VERSION_HEADER as ie,RUNTIME_VERSION_HEADER as W,minimumRuntimeRefusal as He}from"../../api/runtime-version.js";import{CONTRACT_HEADER as F,CONTRACT_LEVEL as se,REQUIRED_CONTRACT_HEADER as ae,contractRefusal as Ie}from"../../api/contract.js";import{crtrVersion as G}from"../../shared/crtr-version.js";import{apiSocketPath as Le}from"../../core/canvas/paths.js";import{resolveNodeToken as Be}from"../../core/canvas/node-tokens.js";import{isCloudRole as P,runAsPerson as x}from"../../core/canvas/person.js";import{personBearerVerifier as le}from"./auth/person-bearer.js";import{personHasSnapshot as Y}from"../../core/scoped-state/person-store.js";import{loadPersonSettings as Z}from"../../core/scoped-state/person-rows.js";import{AppPrincipalResolver as De}from"./principal.js";import{createAppRequestHandler as xe}from"./app-listener.js";import{decodeJwt as $e}from"jose";import{handleVendorSignIn as Je,isVendorSignInPath as je}from"./vendor-signin.js";import{RunError as _}from"../../core/runs/operations.js";import{removeVendorAccount as Me,vendorStatus as Ve}from"./handlers/vendor-status.js";import{toErrorBody as We}from"./map.js";import{CONTROL_BODY_MAX_BYTES as Fe}from"../../core/llm/body-limits.js";import{grantFor as Ge,hasSyncedGrants as Ye}from"../../core/grants/mirror.js";import{readConfig as ce}from"../../core/config.js";import{directoryIssuer as Ze}from"../../core/directory/issuer.js";import{peerUid as Ke}from"../../native/linux.js";import{findScopedApiToken as Xe,getApiToken as Qe,listScopedApiTokens as qe}from"../../core/secrets.js";import{emitEvent as A}from"../../core/events/emit.js";import{envCrtrdTcp as er,envCrtrdToken as rr}from"../../shared/env.js";import{Router as ue,actsAsPerson as de}from"./router.js";import{handleAttachUpgrade as tr,refuseUpgrade as y}from"./bridge.js";import{boundDaemonControl as nr}from"../control.js";import{attachRoutes as or,mayAttachNode as pe}from"./handlers/attach.js";import{peerRoutes as ir}from"../peer/handlers.js";import{bashJobRoutes as sr}from"./handlers/bash-jobs.js";import{bashRoutes as ar}from"./handlers/bash.js";import{hookExecRoutes as lr}from"./handlers/hook-exec.js";import{brokerOperationRoutes as fe}from"./handlers/broker-ops.js";import{brokerSignalRoutes as cr,brokerSignalStreams as ur}from"./handlers/broker-signals.js";import{brokerRecoveryRoutes as me,nodeFaultRoutes as dr}from"./handlers/broker-recovery.js";import{canvasRoutes as pr}from"./handlers/canvas.js";import{conversationRoutes as fr}from"./handlers/conversations.js";import{chatInventoryRoutes as mr}from"./handlers/chat-inventory.js";import{daemonRoutes as gr}from"./handlers/daemon.js";import{fileRoutes as hr}from"./handlers/files.js";import{focusRoutes as Rr}from"./handlers/focus.js";import{analyticsRoutes as Ar}from"./handlers/analytics.js";import{memoryReadsRoutes as yr}from"./handlers/memory-reads.js";import{memoryRoutes as vr}from"./handlers/memory.js";import{healthRoutes as wr}from"./handlers/health.js";import{humanRequestRoutes as _r}from"./handlers/human-requests.js";import{inboxRoutes as Sr}from"./handlers/inbox.js";import{feedbackCommentRoutes as Er}from"./handlers/feedback-comments.js";import{objectRoutes as br}from"./handlers/objects.js";import{shareRoutes as Tr}from"./handlers/shares.js";import{customObjectRoutes as Cr}from"./handlers/custom-objects.js";import{docRoutes as kr}from"./handlers/docs.js";import{deliveryRoutes as ge}from"./handlers/delivery.js";import{deliveryRetryRoutes as Ur}from"./handlers/delivery-retry.js";import{packageDocRoutes as Or}from"./handlers/package-docs.js";import{documentAccessRoutes as Pr}from"./handlers/document-access.js";import{pluginAppRoutes as Nr}from"./handlers/plugin-app-token.js";import{brokerMailRoutes as he,messageRoutes as zr}from"./handlers/messages.js";import{modelAuthRoutes as Hr}from"./handlers/modelauth.js";import{llmRoutes as Ir}from"./handlers/llm.js";import{providerRoutes as Lr}from"./handlers/providers.js";import{modelConfigRoutes as Br}from"./handlers/model-config.js";import{settingsRoutes as Dr}from"./handlers/settings.js";import{nodeRoutes as xr}from"./handlers/nodes.js";import{nodeRecordRoutes as $r}from"./handlers/node-records.js";import{nodeOutcomeRoutes as Jr}from"./handlers/node-outcomes.js";import{nodeEventRoutes as jr}from"./handlers/node-events.js";import{profileRoutes as Mr}from"./handlers/profiles.js";import{prospectiveChatInventoryRoutes as Vr}from"./handlers/prospective-chat-inventory.js";import{reportRoutes as Wr}from"./handlers/reports.js";import{runRoutes as Fr}from"./handlers/run-routes.js";import{reviewCommentRoutes as Gr}from"./handlers/review-comments.js";import{reviewRoutes as Yr}from"./handlers/reviews.js";import{subscriptionRoutes as Zr}from"./handlers/subscriptions.js";import{structuredRequestRoutes as Kr}from"./handlers/structured-requests.js";import{cronRoutes as Xr}from"./handlers/crons.js";import{setCronRequestHandler as Re}from"../cron/run-socket.js";import{worktreeRoutes as Qr}from"./handlers/worktree.js";import{limitsRoutes as qr}from"./handlers/limits.js";import{chargeRoutes as et,spendLimitRoutes as rt}from"./handlers/charges.js";import{executionStartRoutes as tt}from"./handlers/execution-start.js";import{gitCredentialRoutes as nt}from"./handlers/git-credential.js";function ot(e){return new ue().registerAll(wr(e)).registerAll(gr).registerAll(Tr).registerAll(xr).registerAll($r).registerAll(Jr).registerAll(Ur).registerAll(jr).registerAll(sr).registerAll(ar).registerAll(lr).registerAll(fe).registerAll(cr).registerAll(ge).registerAll(me).registerAll(dr).registerAll(Qr).registerAll(qr).registerAll(et).registerAll(tt).registerAll(nt).registerAll(rt).registerAll(he).registerAll(zr).registerAll(Wr).registerAll(Fr).registerAll(Kr).registerAll(or).registerAll(pr).registerAll(fr).registerAll(Ar).registerAll(yr).registerAll(vr).registerAll(hr).registerAll(br).registerAll(Cr).registerAll(kr).registerAll(Or).registerAll(Pr).registerAll(Nr).registerAll(Rr).registerAll(Zr).registerAll(Xr).registerAll(Mr).registerAll(Hr).registerAll(Ir).registerAll(Lr).registerAll(Br).registerAll(Dr).registerAll(Yr).registerAll(Gr).registerAll(Sr).registerAll(_r).registerAll(mr).registerAll(Vr).registerAll(Er).registerAll(ir)}o(ot,"buildRouter");function it(e,r){if(e.toUpperCase()!=="GET")return null;const i=r.split("/").filter(d=>d.length>0);if(i.length!==4||i[0]!=="v1"||i[1]!=="nodes"||i[3]!=="attach")return null;const s=i[2];return s===void 0||s===""?null:decodeURIComponent(s)}o(it,"attachNodeId");function st(e){const r=e.trim();if(r==="")return null;const i=r.lastIndexOf(":");if(i<0)return null;const s=r.slice(0,i),d=r.slice(i+1),p=Number(d);return!Number.isInteger(p)||p<0||p>65535?null:{host:s===""?"0.0.0.0":s,port:p}}o(st,"parseTcp");function at(e,r){return`${e.includes(":")?`[${e}]`:e}:${r}`}o(at,"formatTcpAddress");const C={code:"unauthorized",message:"missing or invalid bearer token"},N={code:"owner_only",message:"attach is owner-only; a scoped token does not reach it"},L={code:"person_bearer_not_supported",message:"this listener accepts a person bearer only on a cloud role with CRTR_DIRECTORY_URL and CRTR_PUBLIC_API_URL set; call with a node, app or public token"},K={class:"anonymous",app:"",node:"",run:null,uid:-1,sub:"",grant:null,client_id:null,scopes:[]},z=new WeakMap;function B(e){return z.get(e)}o(B,"socketPrincipal");async function Ae(e,r){const i=process.platform==="linux"?Ke(e.socket):null,s=e.headers.authorization;if(s===void 0)return i===null||r.has(i)?{class:"person"}:"unauthorized";if(typeof s!="string"||!s.startsWith("Bearer "))return"unauthorized";if(s.slice(7).startsWith("crtr_pub_"))return K;if(s.slice(7).startsWith(X)){const d=_e(s.slice(7));return d!==void 0&&(i===null||r.has(i))?d.principal:"unauthorized"}return ye(s.slice(7),i)}o(Ae,"resolveSocketPrincipal");async function ye(e,r){const i=await Be(e);if(!i||r!==null&&r!==i.uid)return"unauthorized";const s=Ze();if(s&&!P()&&!await Ye(s))return"runtime_starting";const d=i.grant??(await Ge("app:terminal",i.sub))?.id??null;return{class:"broker",...i,grant:d}}o(ye,"brokerPrincipal");function ve(e){if(e.class!=="anonymous")return e.sub!==void 0&&e.sub!==""?e.sub:void 0}o(ve,"requestPerson");function we(e,r){r.class==="broker"&&A({event:"api.request.principal",level:r.app==="app:terminal"?"debug":"info",node_id:r.node,fields:{principal:`${r.app} node:${r.node}`,method:e.method,path:e.url}})}o(we,"noteBrokerRequest");const X="crtr_app_";function _e(e){const r=e.startsWith(X)?Xe(e):void 0;return r===void 0?void 0:{principal:{class:"app",app:r.grantee,scopes:r.scopes},ceiling:r.scopes}}o(_e,"appBearer");function lt(e){const r=new Map;for(const i of qe("user"))r.set(i.token,{principal:{class:"app",app:i.grantee,scopes:i.scopes},ceiling:i.scopes});return e!==void 0&&r.set(e,{principal:{class:"person"},ceiling:null}),r}o(lt,"resolveBearers");function ct(e){try{return $e(e).act!==void 0}catch{return!1}}o(ct,"carriesAct");const ut=/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;function H(e,r){return e!==void 0&&(e.reason=r),"unauthorized"}o(H,"deny");async function Se(e,r,i){const s=e.headers.authorization;if(s===void 0&&(e.method??"GET").toUpperCase()==="GET"&&(e.url??"").split("?")[0]==="/healthz")return{principal:K,ceiling:null};if(typeof s!="string"||!s.startsWith("Bearer "))return H(i,s===void 0?"no_authorization_header":"not_a_bearer");const d=s.slice(7);if(d.startsWith("crtr_pub_"))return{principal:K,ceiling:null};if(d.startsWith(X))return _e(d)??H(i,"app_token_unknown");const p=r.get(d);if(p!==void 0)return p;if(ut.test(d)){if(P()&&ct(d)){const b=J();if(b===null)return"person_bearer";try{const v=await b.verifyCall(s);return v.chain[0]?.sub.startsWith("app:")?{call:v}:H(i,"call_token_presenter_not_an_app")}catch(v){return v instanceof _&&v.status===503?"runtime_starting":H(i,`call_token_${v instanceof _?v.code:"invalid"}`)}}const h=P()?le():null;if(h===null)return"person_bearer";const O=await h.verify(d);return O===null?H(i,"person_bearer_not_verified"):{principal:{class:"person",sub:O},ceiling:null}}const g=await ye(d,null);return g==="unauthorized"?H(i,"node_token_unknown"):typeof g=="string"?g:{principal:g,ceiling:null}}o(Se,"authorizeTcp");let $;function J(){if($!==void 0)return $;const e=process.env.CRTR_DIRECTORY_URL||void 0,r=process.env.CRTR_PUBLIC_API_URL||void 0;return $=e===void 0||r===void 0?null:new De(e,r,async()=>{}),$}o(J,"cloudCallResolver");let Ee;function dt(){const e=J();if(e===null)throw new _(503,"runtime_starting","app calls are not configured on this listener");return Ee??=xe(e,async()=>!0,async()=>{}),Ee}o(dt,"cloudAppCalls");async function pt(e,r){k(r),U(r);const i=J();try{if(i===null)throw new _(503,"runtime_starting","vendor sign-in is not configured on this listener");await Je(e,r,new URL(e.url??"/","http://runtime.local"),i)}catch(s){if(!(s instanceof _))throw s;if(r.headersSent){r.destroy();return}r.writeHead(s.status,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),r.end(JSON.stringify({error:{code:s.code,message:s.message,...s.param?{param:s.param}:{},origin:"runtime"}}))}}o(pt,"serveVendorSignIn");function ft(){const e=process.env.CRTRD_TLS_CERT||void 0,r=process.env.CRTRD_TLS_KEY||void 0;if(e===void 0&&r===void 0)return null;if(e===void 0||r===void 0)throw new Error("CRTRD_TLS_CERT and CRTRD_TLS_KEY must be set together");return{cert:ne(e),key:ne(r)}}o(ft,"tcpTls");function k(e){e.setHeader(W,G()),e.setHeader(F,se)}o(k,"advertiseRuntime");function U(e){e.setHeader("Access-Control-Allow-Origin","*"),e.setHeader("Access-Control-Expose-Headers",`${W}, ${F}`)}o(U,"exposeRuntimeHeaders");function mt(e,r){return(e.method??"GET").toUpperCase()!=="OPTIONS"?!1:(k(r),r.writeHead(204,{"Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":`${W}, ${F}`,"Access-Control-Allow-Headers":`authorization, content-type, ${ie.toLowerCase()}, ${ae.toLowerCase()}`,"Access-Control-Allow-Methods":"GET, POST, PATCH, PUT, DELETE, OPTIONS","Access-Control-Max-Age":"600"}),r.end(),!0)}o(mt,"answerPreflight");function j(e,r=!1){k(e),r&&U(e),e.writeHead(401,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{...C,origin:"runtime"}}))}o(j,"writeUnauthorized");function gt(e){k(e),U(e),e.writeHead(401,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{...L,origin:"runtime"}}))}o(gt,"writePersonBearerRefused");const ht={"/v1/runtime/vendor-status":{method:"GET",purpose:"vendor_status"},"/v1/runtime/vendor-account-remove":{method:"POST",purpose:"vendor_account_remove"}};async function Rt(e,r){if(!P())return!1;const i=new URL(e.url??"/","http://runtime.local").pathname,s=ht[i];if(s===void 0||e.method!==s.method)return!1;const d=o((p,g)=>{k(r),U(r),r.writeHead(p,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify(g))},"answer");try{const p=le();if(p===null)throw new _(401,L.code,L.message);const g=e.headers.authorization,h=g?.startsWith("Bearer ")?await p.verifyPurpose(g.slice(7),s.purpose):null;if(h===null)throw new _(401,"unauthorized","invalid directory token");const O=s.purpose==="vendor_status"?void 0:await At(e);d(200,await x(h,async()=>s.purpose==="vendor_status"?Ve():await Me(O)))}catch(p){const{status:g,body:h}=We(p);d(g,h)}return!0}o(Rt,"serveCloudVendorRoute");async function At(e){const r=[];let i=0;for await(const s of e){if(i+=s.length,i>Fe)throw new _(400,"invalid_request","request body too large");r.push(s)}if(i!==0)try{return JSON.parse(Buffer.concat(r).toString("utf8"))}catch{throw new _(400,"invalid_request","invalid JSON body")}}o(At,"readVendorBody");function be(e){k(e),e.writeHead(503,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}}))}o(be,"writeRuntimeStarting");function yt(e,r){e.writeHead(503,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"startup_blocked",message:r,origin:"runtime"}}))}o(yt,"writeStartupBlocked");function Te(e,r,i){return new Promise(s=>{if(i===void 0){try{e.closeAllConnections()}catch{}e.close(()=>s());return}const d=[];e.close(()=>{for(const h of d)clearTimeout(h);s()});for(const h of r)h.destroy();const p=setInterval(()=>e.closeIdleConnections(),250),g=setTimeout(()=>e.closeAllConnections(),i);d.push(p,g),e.closeIdleConnections()})}o(Te,"closeServer");function eo(e={}){let r=null;const i=ot(()=>r),s=new ue().registerAll(fe).registerAll(ge).registerAll(me).registerAll(he),d=o((t,n)=>{const c=nr()?.startupBlock()??null;return c===null||t==="GET"&&(n==="/healthz"||n==="/v1/status"||n==="/v1/ready")||t==="POST"&&(n==="/v1/daemon/migrate"||n==="/v1/daemon/admit")||c.phase==="recovering"&&s.match(t,n)!==null?null:c},"startupBlockFor"),p=e.socketPath??Le(),g=new Set([process.getuid?.()??0,...ce("user").runtime?.person_uids??[]]),h=o((t,n,c)=>{k(n);const u=o(a=>Array.isArray(a)?a[0]:a,"first"),T=u(t.headers[ie.toLowerCase()]),R=He(T,G())??Ie(u(t.headers[ae.toLowerCase()]),se,{legacyMinimum:T,runtimeVersion:G()});if(R!==null){n.writeHead(R.status,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:R.code,message:R.message,type:"invalid_request_error",origin:"runtime",retryable:!1,..."param"in R?{param:R.param}:{details:R.details}}}));return}const w=o(a=>{const l=B(t);A({event:"api.request.failed",level:"error",...l?.class==="broker"?{node_id:l.node}:{},error:a instanceof Error?a:new Error(String(a))});try{n.headersSent||n.writeHead(500,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:"internal",message:"internal error",origin:"runtime"}}))}catch{}},"internalFailure");let E;try{E=new URL(t.url??"/","http://127.0.0.1")}catch{try{n.writeHead(400,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:"invalid_request",message:"request URL is invalid",origin:"runtime"}}))}catch{}return}try{const a=d((t.method??"GET").toUpperCase(),E.pathname);if(a!==null){yt(n,a.message);return}const l=B(t)??{class:"person"},m=ve(l),f=o(()=>i.handle(t,n,c,l),"handled");(m===void 0?f():x(m,o(async()=>{Y()||await Z(m),await f()},"handledAsPerson"))).catch(w)}catch(a){w(a)}},"onRequest"),O=o(async(t,n,c)=>{const u=B(t);return u===void 0||de(u)||await pe(u,"either",c)?!0:(y(n,404,"Not Found","node_not_found",`no node ${c}`),!1)},"authorizeAttachUpgrade"),b=new Set,v=o((t,n,c)=>{b.add(n),n.once("close",()=>b.delete(n)),n.on("error",()=>{});try{const u=new URL(t.url??"/","http://127.0.0.1"),T=d((t.method??"GET").toUpperCase(),u.pathname);if(T!==null){y(n,503,"Service Unavailable","startup_blocked",T.message);return}const R=it(t.method??"GET",u.pathname);if(R===null){n.destroy();return}const w=(()=>{const a=B(t);return a===void 0?void 0:ve(a)})(),E=o(()=>O(t,n,R).then(a=>a?tr(t,n,c,R,async l=>{const m=B(t);return m===void 0||de(m)||await pe(m,l,R)}):void 0),"attach");(w===void 0?E():x(w,async()=>{Y()||await Z(w),await E()})).catch(()=>{try{n.destroy()}catch{}})}catch{try{n.destroy()}catch{}}},"onUpgrade"),Ce=o(t=>{t.on("error",n=>{A({event:"api.server.failed",level:"error",error:n})})},"bindErrorHandler"),ke=o(async(t,n)=>{try{const c=await Ae(t,g);if(c==="unauthorized"){A({event:"api.principal.denied",level:"warn",fields:{method:t.method}}),j(n);return}if(c==="runtime_starting"){be(n);return}z.set(t,c),we(t,c),h(t,n,c.class==="app"?c.scopes:null)}catch(c){A({event:"api.principal.failed",level:"error",error:c instanceof Error?c:new Error(String(c))}),j(n)}},"onSocketRequest"),I=te((t,n)=>{ke(t,n).catch(c=>A({event:"api.principal.failed",level:"error",error:c instanceof Error?c:new Error(String(c))}))}),Ue=o(async(t,n,c)=>{try{const u=await Ae(t,g);if(u==="unauthorized"||u==="runtime_starting"){u==="unauthorized"&&A({event:"api.principal.denied",level:"warn",fields:{method:t.method}}),y(n,u==="unauthorized"?401:503,"Unauthorized",u,"socket principal unavailable");return}if(u.class!=="person"&&u.class!=="broker"){y(n,403,"Forbidden",N.code,N.message);return}z.set(t,u),v(t,n,c)}catch(u){A({event:"api.principal.failed",level:"error",error:u instanceof Error?u:new Error(String(u))}),y(n,401,"Unauthorized",C.code,C.message)}},"onSocketUpgrade");I.on("upgrade",(t,n,c)=>{Ue(t,n,c).catch(u=>A({event:"api.principal.failed",level:"error",error:u instanceof Error?u:new Error(String(u))}))}),Re((t,n,c)=>{z.set(t,c),h(t,n,null)});let Q=!1,q,ee;const Oe=new Promise((t,n)=>{q=t,ee=n});I.once("listening",()=>{Q=!0,q()}),I.on("error",t=>{A({event:"api.server.failed",level:"error",error:t}),Q||ee(t)});try{V(p)&&oe(p)}catch{}I.listen(p,()=>{try{ze(p,process.platform==="linux"&&V("/run/crtr/launcher.sock")?438:384)}catch(t){A({event:"api.socket.chmod_failed",level:"error",error:t instanceof Error?t:new Error(String(t))})}});let S;const D=e.tcp??er()??ce("user").api.tcp;if(D!==void 0&&D!==""){const t=st(D);if(t===null)A({event:"api.tcp.invalid",level:"error",error:new Error(`invalid CRTRD_TCP/--tcp spec: ${D}`)});else{P()&&J();const n=e.token??rr()??Qe("user"),c=lt(n),u=o(async(a,l)=>{if(mt(a,l))return;if(P()&&je(new URL(a.url??"/","http://runtime.local").pathname)){await pt(a,l);return}if(await Rt(a,l))return;const m={},f=await Se(a,c,m);if(f==="runtime_starting"){U(l),be(l);return}if(f==="person_bearer"){gt(l);return}if(f==="unauthorized"){A({event:"api.principal.denied",level:"warn",fields:{method:a.method,listener:"tcp",path:new URL(a.url??"/","http://runtime.local").pathname,reason:m.reason??"unknown"}}),j(l,!0);return}if("call"in f){U(l);const M=f.call.sub;await x(M,async()=>{Y()||await Z(M),await dt()(a,l,f.call)});return}z.set(a,f.principal),we(a,f.principal),U(l),h(a,l,f.ceiling)},"tcpOnRequest"),T=o(async(a,l,m)=>{const f=await Se(a,c);if(f==="runtime_starting"){y(l,503,"Service Unavailable","runtime_starting","grant sync is not ready");return}if(f==="person_bearer"){y(l,401,"Unauthorized",L.code,L.message);return}if(f==="unauthorized"){y(l,401,"Unauthorized",C.code,C.message);return}if("call"in f){y(l,403,"Forbidden",N.code,N.message);return}if(f.ceiling!==null||f.principal.class==="anonymous"){y(l,403,"Forbidden",N.code,N.message);return}z.set(a,f.principal),v(a,l,m)},"tcpOnUpgrade"),R=o(a=>{A({event:"api.principal.failed",level:"error",error:a instanceof Error?a:new Error(String(a))})},"failed"),w=o((a,l)=>{u(a,l).catch(m=>{R(m),l.headersSent?l.destroy():j(l,!0)})},"listener"),E=ft();S=E===null?te(w):Ne(E,w),S.on("upgrade",(a,l,m)=>{l.on("error",()=>{}),T(a,l,m).catch(f=>{R(f),y(l,401,"Unauthorized",C.code,C.message)})}),Ce(S),S.once("listening",()=>{const a=S?.address();if(a!==null&&typeof a=="object"){const{address:l,port:m}=a;r=at(l,m)}}),S.listen(t.port,t.host)}}let re=!1;return{ready:Oe,tcpAddress:o(()=>r,"tcpAddress"),close:o(async(t={})=>{if(!re){re=!0,Re(null),ur.close(),await Promise.all([Te(I,b,t.graceMs),S!==void 0?Te(S,b,t.graceMs):Promise.resolve()]);try{V(p)&&oe(p)}catch{}}},"close")}}o(eo,"createApiServer");export{ot as buildRouter,Te as closeServer,eo as createApiServer,B as socketPrincipal};
+var Ie=Object.defineProperty;var s=(e,r)=>Ie(e,"name",{value:r,configurable:!0});import{IMPORT_TOKEN_PREFIX as ze,importPrincipalFor as He}from"./import-auth.js";import{createServer as ie}from"node:http";import{createServer as Le}from"node:https";import{chmodSync as Be,existsSync as G,readFileSync as se,unlinkSync as ae}from"node:fs";import{MINIMUM_RUNTIME_VERSION_HEADER as le,RUNTIME_VERSION_HEADER as Y,minimumRuntimeRefusal as xe}from"../../api/runtime-version.js";import{CONTRACT_HEADER as K,CONTRACT_LEVEL as ce,REQUIRED_CONTRACT_HEADER as ue,contractRefusal as De}from"../../api/contract.js";import{crtrVersion as X}from"../../shared/crtr-version.js";import{apiSocketPath as Me}from"../../core/canvas/paths.js";import{resolveNodeToken as Fe}from"../../core/canvas/node-tokens.js";import{isCloudRole as H,runAsPerson as $}from"../../core/canvas/person.js";import{personBearerVerifier as pe}from"./auth/person-bearer.js";import{personHasSnapshot as Z}from"../../core/scoped-state/person-store.js";import{loadPersonSettings as Q}from"../../core/scoped-state/person-rows.js";import{AppPrincipalResolver as Ve}from"./principal.js";import{createAppRequestHandler as $e}from"./app-listener.js";import{decodeJwt as Je}from"jose";import{handleVendorSignIn as We,isVendorSignInPath as je}from"./vendor-signin.js";import{RunError as S}from"../../core/runs/operations.js";import{removeVendorAccount as Ge,vendorStatus as Ye}from"./handlers/vendor-status.js";import{toErrorBody as Ke}from"./map.js";import{CONTROL_BODY_MAX_BYTES as Xe}from"../../core/llm/body-limits.js";import{grantFor as Ze,hasSyncedGrants as Qe}from"../../core/grants/mirror.js";import{readConfig as de}from"../../core/config.js";import{directoryIssuer as qe}from"../../core/directory/issuer.js";import{peerUid as er}from"../../native/linux.js";import{findScopedApiToken as rr,getApiToken as tr,listScopedApiTokens as nr}from"../../core/secrets.js";import{emitEvent as A}from"../../core/events/emit.js";import{envCrtrdTcp as or,envCrtrdToken as ir}from"../../shared/env.js";import{Router as fe,actsAsPerson as me}from"./router.js";import{handleAttachUpgrade as sr,refuseUpgrade as y}from"./bridge.js";import{handleMachineLinkUpgrade as ar,machineLinkEnvironment as lr,setApiAddress as cr}from"../machine-link/holder.js";import{handleMachineViewUpgrade as ur,machineViewEnvironment as pr}from"../machine-link/forward.js";import{boundDaemonControl as dr}from"../control.js";import{attachRoutes as fr,mayAttachNode as ge}from"./handlers/attach.js";import{peerRoutes as mr}from"../peer/handlers.js";import{bashJobRoutes as gr}from"./handlers/bash-jobs.js";import{bashRoutes as hr}from"./handlers/bash.js";import{hookExecRoutes as Rr}from"./handlers/hook-exec.js";import{brokerOperationRoutes as he}from"./handlers/broker-ops.js";import{brokerSignalRoutes as Ar,brokerSignalStreams as yr}from"./handlers/broker-signals.js";import{brokerRecoveryRoutes as Re,nodeFaultRoutes as vr}from"./handlers/broker-recovery.js";import{canvasRoutes as _r}from"./handlers/canvas.js";import{conversationRoutes as wr}from"./handlers/conversations.js";import{chatInventoryRoutes as Er}from"./handlers/chat-inventory.js";import{daemonRoutes as Sr}from"./handlers/daemon.js";import{fileRoutes as br}from"./handlers/files.js";import{focusRoutes as Tr}from"./handlers/focus.js";import{analyticsRoutes as Cr}from"./handlers/analytics.js";import{memoryReadsRoutes as kr}from"./handlers/memory-reads.js";import{memoryRoutes as Ur}from"./handlers/memory.js";import{healthRoutes as Or}from"./handlers/health.js";import{humanRequestRoutes as Pr}from"./handlers/human-requests.js";import{inboxRoutes as Nr}from"./handlers/inbox.js";import{feedbackCommentRoutes as Ir}from"./handlers/feedback-comments.js";import{objectRoutes as zr}from"./handlers/objects.js";import{shareRoutes as Hr}from"./handlers/shares.js";import{customObjectRoutes as Lr}from"./handlers/custom-objects.js";import{docRoutes as Br}from"./handlers/docs.js";import{deliveryRoutes as Ae}from"./handlers/delivery.js";import{deliveryRetryRoutes as xr}from"./handlers/delivery-retry.js";import{packageDocRoutes as Dr}from"./handlers/package-docs.js";import{documentAccessRoutes as Mr}from"./handlers/document-access.js";import{pluginAppRoutes as Fr}from"./handlers/plugin-app-token.js";import{brokerMailRoutes as ye,messageRoutes as Vr}from"./handlers/messages.js";import{modelAuthRoutes as $r}from"./handlers/modelauth.js";import{llmRoutes as Jr}from"./handlers/llm.js";import{providerRoutes as Wr}from"./handlers/providers.js";import{modelConfigRoutes as jr}from"./handlers/model-config.js";import{settingsRoutes as Gr}from"./handlers/settings.js";import{nodeRoutes as Yr}from"./handlers/nodes.js";import{nodeRecordRoutes as Kr}from"./handlers/node-records.js";import{nodeOutcomeRoutes as Xr}from"./handlers/node-outcomes.js";import{nodeEventRoutes as Zr}from"./handlers/node-events.js";import{profileRoutes as Qr}from"./handlers/profiles.js";import{prospectiveChatInventoryRoutes as qr}from"./handlers/prospective-chat-inventory.js";import{reportRoutes as et}from"./handlers/reports.js";import{runRoutes as rt}from"./handlers/run-routes.js";import{reviewCommentRoutes as tt}from"./handlers/review-comments.js";import{reviewRoutes as nt}from"./handlers/reviews.js";import{subscriptionRoutes as ot}from"./handlers/subscriptions.js";import{structuredRequestRoutes as it}from"./handlers/structured-requests.js";import{cronRoutes as st}from"./handlers/crons.js";import{setCronRequestHandler as ve}from"../cron/run-socket.js";import{RUN_TOKEN_PREFIX as at,cronPrincipalForRunToken as lt}from"../cron/run-token.js";import{worktreeRoutes as ct}from"./handlers/worktree.js";import{limitsRoutes as ut}from"./handlers/limits.js";import{chargeRoutes as pt,spendLimitRoutes as dt}from"./handlers/charges.js";import{executionStartRoutes as ft}from"./handlers/execution-start.js";import{machineCredentialRoutes as mt}from"./handlers/machine-credential.js";import{importRoutes as gt}from"./handlers/imports.js";import{gitCredentialRoutes as ht}from"./handlers/git-credential.js";function Rt(e){return new fe().registerAll(Or(e)).registerAll(Sr).registerAll(Hr).registerAll(Yr).registerAll(Kr).registerAll(Xr).registerAll(xr).registerAll(Zr).registerAll(gr).registerAll(hr).registerAll(Rr).registerAll(he).registerAll(Ar).registerAll(Ae).registerAll(Re).registerAll(vr).registerAll(ct).registerAll(ut).registerAll(pt).registerAll(ft).registerAll(mt).registerAll(gt).registerAll(ht).registerAll(dt).registerAll(ye).registerAll(Vr).registerAll(et).registerAll(rt).registerAll(it).registerAll(fr).registerAll(_r).registerAll(wr).registerAll(Cr).registerAll(kr).registerAll(Ur).registerAll(br).registerAll(zr).registerAll(Lr).registerAll(Br).registerAll(Dr).registerAll(Mr).registerAll(Fr).registerAll(Tr).registerAll(ot).registerAll(st).registerAll(Qr).registerAll($r).registerAll(Jr).registerAll(Wr).registerAll(jr).registerAll(Gr).registerAll(nt).registerAll(tt).registerAll(Nr).registerAll(Pr).registerAll(Er).registerAll(qr).registerAll(Ir).registerAll(mr)}s(Rt,"buildRouter");function At(e,r){if(e.toUpperCase()!=="GET")return null;const o=r.split("/").filter(u=>u.length>0);if(o.length!==4||o[0]!=="v1"||o[1]!=="nodes"||o[3]!=="attach")return null;const a=o[2];return a===void 0||a===""?null:decodeURIComponent(a)}s(At,"attachNodeId");function yt(e){const r=e.trim();if(r==="")return null;const o=r.lastIndexOf(":");if(o<0)return null;const a=r.slice(0,o),u=r.slice(o+1),d=Number(u);return!Number.isInteger(d)||d<0||d>65535?null:{host:a===""?"0.0.0.0":a,port:d}}s(yt,"parseTcp");function vt(e,r){return`${e.includes(":")?`[${e}]`:e}:${r}`}s(vt,"formatTcpAddress");const P={code:"unauthorized",message:"missing or invalid bearer token"},L={code:"owner_only",message:"attach is owner-only; a scoped token does not reach it"},M={code:"person_bearer_not_supported",message:"this listener accepts a person bearer only on a cloud role with CRTR_DIRECTORY_URL and CRTR_PUBLIC_API_URL set; call with a node, app or public token"},q={class:"anonymous",app:"",node:"",run:null,uid:-1,sub:"",grant:null,client_id:null,scopes:[]},B=new WeakMap;function F(e){return B.get(e)}s(F,"socketPrincipal");async function _e(e,r){const o=process.platform==="linux"?er(e.socket):null,a=e.headers.authorization;if(a===void 0)return o===null||r.has(o)?{class:"person"}:"unauthorized";if(typeof a!="string"||!a.startsWith("Bearer "))return"unauthorized";if(a.slice(7).startsWith("crtr_pub_"))return q;if(a.slice(7).startsWith(ee)){const u=be(a.slice(7));return u!==void 0&&(o===null||r.has(o))?u.principal:"unauthorized"}return we(a.slice(7),o)}s(_e,"resolveSocketPrincipal");async function we(e,r){const o=await Fe(e);if(!o||r!==null&&r!==o.uid)return"unauthorized";const a=qe();if(a&&!H()&&!await Qe(a))return"runtime_starting";const u=o.grant??(await Ze("app:terminal",o.sub))?.id??null;return{class:"broker",...o,grant:u}}s(we,"brokerPrincipal");function Ee(e){if(!(e.class==="anonymous"||e.class==="import"))return e.sub!==void 0&&e.sub!==""?e.sub:void 0}s(Ee,"requestPerson");function Se(e,r){r.class==="broker"&&A({event:"api.request.principal",level:r.app==="app:terminal"?"debug":"info",node_id:r.node,fields:{principal:`${r.app} node:${r.node}`,method:e.method,path:e.url}})}s(Se,"noteBrokerRequest");const ee="crtr_app_";function be(e){const r=e.startsWith(ee)?rr(e):void 0;return r===void 0?void 0:{principal:{class:"app",app:r.grantee,scopes:r.scopes},ceiling:r.scopes}}s(be,"appBearer");function _t(e){const r=new Map;for(const o of nr("user"))r.set(o.token,{principal:{class:"app",app:o.grantee,scopes:o.scopes},ceiling:o.scopes});return e!==void 0&&r.set(e,{principal:{class:"person"},ceiling:null}),r}s(_t,"resolveBearers");function wt(e){try{return Je(e).act!==void 0}catch{return!1}}s(wt,"carriesAct");const Et=/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/;function k(e,r){return e!==void 0&&(e.reason=r),"unauthorized"}s(k,"deny");async function Te(e,r,o){const a=e.headers.authorization;if(a===void 0&&(e.method??"GET").toUpperCase()==="GET"&&(e.url??"").split("?")[0]==="/healthz")return{principal:q,ceiling:null};if(typeof a!="string"||!a.startsWith("Bearer "))return k(o,a===void 0?"no_authorization_header":"not_a_bearer");const u=a.slice(7);if(u.startsWith("crtr_pub_"))return{principal:q,ceiling:null};if(u.startsWith(ee))return be(u)??k(o,"app_token_unknown");if(u.startsWith(at)){const _=await lt(u);return _===null?k(o,"run_token_invalid_or_settled"):{principal:_,ceiling:null}}const d=r.get(u);if(d!==void 0)return d;const R=He(u);if(R!==null)return{principal:R,ceiling:null};if(u.startsWith(ze))return k(o,"import_token_invalid");if(Et.test(u)){if(H()&&wt(u)){const x=W();if(x===null)return"person_bearer";try{const w=await x.verifyCall(a);return w.chain[0]?.sub.startsWith("app:")?{call:w}:k(o,"call_token_presenter_not_an_app")}catch(w){return w instanceof S&&w.status===503?"runtime_starting":k(o,`call_token_${w instanceof S?w.code:"invalid"}`)}}const _=H()?pe():null;if(_===null)return"person_bearer";const U=await _.verify(u);return U===null?k(o,"person_bearer_not_verified"):{principal:{class:"person",sub:U},ceiling:null}}const m=await we(u,null);return m==="unauthorized"?k(o,"node_token_unknown"):typeof m=="string"?m:{principal:m,ceiling:null}}s(Te,"authorizeTcp");let J;function W(){if(J!==void 0)return J;const e=process.env.CRTR_DIRECTORY_URL||void 0,r=process.env.CRTR_PUBLIC_API_URL||void 0;return J=e===void 0||r===void 0?null:new Ve(e,r,async()=>{}),J}s(W,"cloudCallResolver");let Ce;function St(){const e=W();if(e===null)throw new S(503,"runtime_starting","app calls are not configured on this listener");return Ce??=$e(e,async()=>!0,async()=>{}),Ce}s(St,"cloudAppCalls");async function bt(e,r){N(r),I(r);const o=W();try{if(o===null)throw new S(503,"runtime_starting","vendor sign-in is not configured on this listener");await We(e,r,new URL(e.url??"/","http://runtime.local"),o)}catch(a){if(!(a instanceof S))throw a;if(r.headersSent){r.destroy();return}r.writeHead(a.status,{"content-type":"application/json; charset=utf-8","cache-control":"no-store"}),r.end(JSON.stringify({error:{code:a.code,message:a.message,...a.param?{param:a.param}:{},origin:"runtime"}}))}}s(bt,"serveVendorSignIn");function Tt(){const e=process.env.CRTRD_TLS_CERT||void 0,r=process.env.CRTRD_TLS_KEY||void 0;if(e===void 0&&r===void 0)return null;if(e===void 0||r===void 0)throw new Error("CRTRD_TLS_CERT and CRTRD_TLS_KEY must be set together");return{cert:se(e),key:se(r)}}s(Tt,"tcpTls");function N(e){e.setHeader(Y,X()),e.setHeader(K,ce)}s(N,"advertiseRuntime");function I(e){e.setHeader("Access-Control-Allow-Origin","*"),e.setHeader("Access-Control-Expose-Headers",`${Y}, ${K}`)}s(I,"exposeRuntimeHeaders");function Ct(e,r){return(e.method??"GET").toUpperCase()!=="OPTIONS"?!1:(N(r),r.writeHead(204,{"Access-Control-Allow-Origin":"*","Access-Control-Expose-Headers":`${Y}, ${K}`,"Access-Control-Allow-Headers":`authorization, content-type, ${le.toLowerCase()}, ${ue.toLowerCase()}`,"Access-Control-Allow-Methods":"GET, POST, PATCH, PUT, DELETE, OPTIONS","Access-Control-Max-Age":"600"}),r.end(),!0)}s(Ct,"answerPreflight");function j(e,r=!1){N(e),r&&I(e),e.writeHead(401,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{...P,origin:"runtime"}}))}s(j,"writeUnauthorized");function kt(e){N(e),I(e),e.writeHead(401,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{...M,origin:"runtime"}}))}s(kt,"writePersonBearerRefused");const Ut={"/v1/runtime/vendor-status":{method:"GET",purpose:"vendor_status"},"/v1/runtime/vendor-account-remove":{method:"POST",purpose:"vendor_account_remove"}};async function Ot(e,r){if(!H())return!1;const o=new URL(e.url??"/","http://runtime.local").pathname,a=Ut[o];if(a===void 0||e.method!==a.method)return!1;const u=s((d,R)=>{N(r),I(r),r.writeHead(d,{"content-type":"application/json; charset=utf-8"}),r.end(JSON.stringify(R))},"answer");try{const d=pe();if(d===null)throw new S(401,M.code,M.message);const R=e.headers.authorization,m=R?.startsWith("Bearer ")?await d.verifyPurpose(R.slice(7),a.purpose):null;if(m===null)throw new S(401,"unauthorized","invalid directory token");const _=a.purpose==="vendor_status"?void 0:await Pt(e);u(200,await $(m,async()=>a.purpose==="vendor_status"?Ye():await Ge(_)))}catch(d){const{status:R,body:m}=Ke(d);u(R,m)}return!0}s(Ot,"serveCloudVendorRoute");async function Pt(e){const r=[];let o=0;for await(const a of e){if(o+=a.length,o>Xe)throw new S(400,"invalid_request","request body too large");r.push(a)}if(o!==0)try{return JSON.parse(Buffer.concat(r).toString("utf8"))}catch{throw new S(400,"invalid_request","invalid JSON body")}}s(Pt,"readVendorBody");function ke(e){N(e),e.writeHead(503,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"runtime_starting",message:"grant sync is not ready",type:"server_error",origin:"runtime",retryable:!0}}))}s(ke,"writeRuntimeStarting");function Nt(e,r){e.writeHead(503,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"startup_blocked",message:r,origin:"runtime"}}))}s(Nt,"writeStartupBlocked");function Ue(e,r,o){return new Promise(a=>{if(o===void 0){try{e.closeAllConnections()}catch{}e.close(()=>a());return}const u=[];e.close(()=>{for(const m of u)clearTimeout(m);a()});for(const m of r)m.destroy();const d=setInterval(()=>e.closeIdleConnections(),250),R=setTimeout(()=>e.closeAllConnections(),o);u.push(d,R),e.closeIdleConnections()})}s(Ue,"closeServer");function vo(e={}){let r=null;const o=Rt(()=>r),a=new fe().registerAll(he).registerAll(Ae).registerAll(Re).registerAll(ye),u=s((t,n)=>{const c=dr()?.startupBlock()??null;return c===null||t==="GET"&&(n==="/healthz"||n==="/v1/status"||n==="/v1/ready")||t==="POST"&&(n==="/v1/daemon/migrate"||n==="/v1/daemon/admit")||c.phase==="recovering"&&a.match(t,n)!==null?null:c},"startupBlockFor"),d=e.socketPath??Me(),R=new Set([process.getuid?.()??0,...de("user").runtime?.person_uids??[]]),m=s((t,n,c)=>{N(n);const p=s(i=>Array.isArray(i)?i[0]:i,"first"),O=p(t.headers[le.toLowerCase()]),h=xe(O,X())??De(p(t.headers[ue.toLowerCase()]),ce,{legacyMinimum:O,runtimeVersion:X()});if(h!==null){n.writeHead(h.status,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:h.code,message:h.message,type:"invalid_request_error",origin:"runtime",retryable:!1,..."param"in h?{param:h.param}:{details:h.details}}}));return}const E=s(i=>{const l=F(t);A({event:"api.request.failed",level:"error",...l?.class==="broker"?{node_id:l.node}:{},error:i instanceof Error?i:new Error(String(i))});try{n.headersSent||n.writeHead(500,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:"internal",message:"internal error",origin:"runtime"}}))}catch{}},"internalFailure");let T;try{T=new URL(t.url??"/","http://127.0.0.1")}catch{try{n.writeHead(400,{"content-type":"application/json; charset=utf-8"}),n.end(JSON.stringify({error:{code:"invalid_request",message:"request URL is invalid",origin:"runtime"}}))}catch{}return}try{const i=u((t.method??"GET").toUpperCase(),T.pathname);if(i!==null){Nt(n,i.message);return}const l=F(t)??{class:"person"},f=Ee(l),g=s(()=>o.handle(t,n,c,l),"handled");(f===void 0?g():$(f,s(async()=>{Z()||await Q(f),await g()},"handledAsPerson"))).catch(E)}catch(i){E(i)}},"onRequest"),_=s(async(t,n,c)=>{const p=F(t);return p===void 0||me(p)||await ge(p,"either",c)?!0:(y(n,404,"Not Found","node_not_found",`no node ${c}`),!1)},"authorizeAttachUpgrade"),U=new Set,x=s((t,n,c)=>{U.add(n),n.once("close",()=>U.delete(n)),n.on("error",()=>{});try{const p=new URL(t.url??"/","http://127.0.0.1"),O=u((t.method??"GET").toUpperCase(),p.pathname);if(O!==null){y(n,503,"Service Unavailable","startup_blocked",O.message);return}const h=At(t.method??"GET",p.pathname);if(h===null){n.destroy();return}const E=(()=>{const i=F(t);return i===void 0?void 0:Ee(i)})(),T=s(()=>_(t,n,h).then(i=>i?sr(t,n,c,h,async l=>{const f=F(t);return f===void 0||me(f)||await ge(f,l,h)}):void 0),"attach");(E===void 0?T():$(E,async()=>{Z()||await Q(E),await T()})).catch(()=>{try{n.destroy()}catch{}})}catch{try{n.destroy()}catch{}}},"onUpgrade"),w=s(t=>{t.on("error",n=>{A({event:"api.server.failed",level:"error",error:n})})},"bindErrorHandler"),Oe=s(async(t,n)=>{try{const c=await _e(t,R);if(c==="unauthorized"){A({event:"api.principal.denied",level:"warn",fields:{method:t.method}}),j(n);return}if(c==="runtime_starting"){ke(n);return}B.set(t,c),Se(t,c),m(t,n,c.class==="app"?c.scopes:null)}catch(c){A({event:"api.principal.failed",level:"error",error:c instanceof Error?c:new Error(String(c))}),j(n)}},"onSocketRequest"),D=ie((t,n)=>{Oe(t,n).catch(c=>A({event:"api.principal.failed",level:"error",error:c instanceof Error?c:new Error(String(c))}))}),Pe=s(async(t,n,c)=>{try{const p=await _e(t,R);if(p==="unauthorized"||p==="runtime_starting"){p==="unauthorized"&&A({event:"api.principal.denied",level:"warn",fields:{method:t.method}}),y(n,p==="unauthorized"?401:503,"Unauthorized",p,"socket principal unavailable");return}if(p.class!=="person"&&p.class!=="broker"){y(n,403,"Forbidden",L.code,L.message);return}B.set(t,p),x(t,n,c)}catch(p){A({event:"api.principal.failed",level:"error",error:p instanceof Error?p:new Error(String(p))}),y(n,401,"Unauthorized",P.code,P.message)}},"onSocketUpgrade");D.on("upgrade",(t,n,c)=>{Pe(t,n,c).catch(p=>A({event:"api.principal.failed",level:"error",error:p instanceof Error?p:new Error(String(p))}))}),ve((t,n,c)=>{B.set(t,c),m(t,n,null)});let re=!1,te,ne;const Ne=new Promise((t,n)=>{te=t,ne=n});D.once("listening",()=>{re=!0,te()}),D.on("error",t=>{A({event:"api.server.failed",level:"error",error:t}),re||ne(t)});try{G(d)&&ae(d)}catch{}D.listen(d,()=>{try{Be(d,process.platform==="linux"&&G("/run/crtr/launcher.sock")?438:384)}catch(t){A({event:"api.socket.chmod_failed",level:"error",error:t instanceof Error?t:new Error(String(t))})}});let b;const V=e.tcp??or()??de("user").api.tcp;if(V!==void 0&&V!==""){const t=yt(V);if(t===null)A({event:"api.tcp.invalid",level:"error",error:new Error(`invalid CRTRD_TCP/--tcp spec: ${V}`)});else{H()&&W();const n=e.token??ir()??tr("user"),c=_t(n),p=s(async(i,l)=>{if(Ct(i,l))return;if(H()&&je(new URL(i.url??"/","http://runtime.local").pathname)){await bt(i,l);return}if(await Ot(i,l))return;const f={},g=await Te(i,c,f);if(g==="runtime_starting"){I(l),ke(l);return}if(g==="person_bearer"){kt(l);return}if(g==="unauthorized"){A({event:"api.principal.denied",level:"warn",fields:{method:i.method,listener:"tcp",path:new URL(i.url??"/","http://runtime.local").pathname,reason:f.reason??"unknown"}}),j(l,!0);return}if("call"in g){I(l);const z=g.call.sub;await $(z,async()=>{Z()||await Q(z),await St()(i,l,g.call)});return}B.set(i,g.principal),Se(i,g.principal),I(l),m(i,l,g.ceiling)},"tcpOnRequest"),O=s(async(i,l,f)=>{const g=lr(i);if(g!==null){const v=await ar(i,l,f,g);v!==null&&y(l,v.status,v.text,v.code,v.message);return}const z=pr(i);if(z!==null){const v=ur(i,l,f,z);v!==null&&y(l,v.status,v.text,v.code,v.message);return}const C=await Te(i,c);if(C==="runtime_starting"){y(l,503,"Service Unavailable","runtime_starting","grant sync is not ready");return}if(C==="person_bearer"){y(l,401,"Unauthorized",M.code,M.message);return}if(C==="unauthorized"){y(l,401,"Unauthorized",P.code,P.message);return}if("call"in C){y(l,403,"Forbidden",L.code,L.message);return}if(C.ceiling!==null||C.principal.class==="anonymous"||C.principal.class==="import"){y(l,403,"Forbidden",L.code,L.message);return}B.set(i,C.principal),x(i,l,f)},"tcpOnUpgrade"),h=s(i=>{A({event:"api.principal.failed",level:"error",error:i instanceof Error?i:new Error(String(i))})},"failed"),E=s((i,l)=>{p(i,l).catch(f=>{h(f),l.headersSent?l.destroy():j(l,!0)})},"listener"),T=Tt();b=T===null?ie(E):Le(T,E),b.on("upgrade",(i,l,f)=>{l.on("error",()=>{}),O(i,l,f).catch(g=>{h(g),y(l,401,"Unauthorized",P.code,P.message)})}),w(b),b.once("listening",()=>{const i=b?.address();if(i!==null&&typeof i=="object"){const{address:l,port:f}=i;r=vt(l,f),l!=="0.0.0.0"&&l!=="::"&&cr(r)}}),b.listen(t.port,t.host)}}let oe=!1;return{ready:Ne,tcpAddress:s(()=>r,"tcpAddress"),close:s(async(t={})=>{if(!oe){oe=!0,ve(null),yr.close(),await Promise.all([Ue(D,U,t.graceMs),b!==void 0?Ue(b,U,t.graceMs):Promise.resolve()]);try{G(d)&&ae(d)}catch{}}},"close")}}s(vo,"createApiServer");export{Rt as buildRouter,Ue as closeServer,vo as createApiServer,F as socketPrincipal};

package/dist/daemon/boot-migrations.js

@@ -1 +1 @@
-var i=Object.defineProperty;var r=(e,t)=>i(e,"name",{value:t,configurable:!0});import{migrateLegacyInboxIdentities as a}from"../core/feed/inbox-migrate.js";import{backfillComputedRev as s}from"../core/grants/mirror.js";import{copyBodyFilesToTable as n}from"../core/graph/bodies-boot-copy.js";import{isCloudRole as o}from"../core/canvas/person-state.js";import{emitEvent as c}from"../core/events/emit.js";const h=[{id:"legacy-inbox-identities",description:"normalize pre-cutover inbox entry/operation ids (UUID-spelled or missing) and cursors (ISO-timestamp boundaries) into canonical 32-lowercase-hex identities the strict inbox reader requires.",apply:r(()=>{const e=a();return{changed:e.nodes>0||e.failures>0,summary:{...e}}},"apply")},{id:"grant-computed-rev",description:"mark grant rows a pre-C-D2 build wrote (scopes computed, computed_rev NULL) as computed for their revision, so the terminal grant reads as active before the first directory sync after an upgrade or rollback (NL-550). A cloud role skips it: the directory owns its shared rows.",apply:r(async()=>{if(o())return{changed:!1,summary:{}};try{const e=await s();return{changed:e>0,summary:{rows:e}}}catch(e){return c({level:"warn",event:"daemon.boot_migration.failed",error:e,fields:{migration:"grant-computed-rev"}}),{changed:!1,summary:{}}}},"apply")},{id:"bodies-to-table",description:"copy document text from the old <home>/bodies files into the bodies table (D106). Verifies each file by sha256, skips and reports mismatches, leaves the files for rollback. A cloud role copies nothing.",apply:r(async()=>{if(o())return{changed:!1,summary:{}};const e=await n();return{changed:e.copied>0||e.mismatched.length>0,summary:{...e}}},"apply")}];export{h as BOOT_MIGRATIONS};
+var i=Object.defineProperty;var r=(e,t)=>i(e,"name",{value:t,configurable:!0});import{migrateLegacyInboxIdentities as a}from"../core/feed/inbox-migrate.js";import{backfillComputedRev as s}from"../core/grants/mirror.js";import{copyBodyFilesToTable as n,repairBodyHashes as d}from"../core/graph/bodies-boot-copy.js";import{isCloudRole as o}from"../core/canvas/person-state.js";import{emitEvent as m}from"../core/events/emit.js";const f=[{id:"legacy-inbox-identities",description:"normalize pre-cutover inbox entry/operation ids (UUID-spelled or missing) and cursors (ISO-timestamp boundaries) into canonical 32-lowercase-hex identities the strict inbox reader requires.",apply:r(()=>{const e=a();return{changed:e.nodes>0||e.failures>0,summary:{...e}}},"apply")},{id:"grant-computed-rev",description:"mark grant rows a pre-C-D2 build wrote (scopes computed, computed_rev NULL) as computed for their revision, so the terminal grant reads as active before the first directory sync after an upgrade or rollback (NL-550). A cloud role skips it: the directory owns its shared rows.",apply:r(async()=>{if(o())return{changed:!1,summary:{}};try{const e=await s();return{changed:e>0,summary:{rows:e}}}catch(e){return m({level:"warn",event:"daemon.boot_migration.failed",error:e,fields:{migration:"grant-computed-rev"}}),{changed:!1,summary:{}}}},"apply")},{id:"bodies-to-table",description:"copy document text from the old <home>/bodies files into the bodies table (D106). Verifies each file by sha256, skips and reports mismatches, leaves the files for rollback. A cloud role copies nothing.",apply:r(async()=>{if(o())return{changed:!1,summary:{}};const e=await n();return{changed:e.copied>0||e.mismatched.length>0,summary:{...e}}},"apply")},{id:"body-hash-repair",description:"rekey bodies rows PR #822 stored under the hash of the text before NUL became U+FFFD (D106): every revision naming such a hash names the hash of the stored text, and the invalid old-key row is removed. Runs in every role and after bodies-to-table, before readers serve. A mismatch with no intact original (a retained <home>/bodies file or a repo ref body) that becomes exactly the stored text stops the boot and is reported, never rehashed.",apply:r(async()=>{const e=await d();if(e.unresolved.length>0)throw new Error(`body-hash-repair: ${e.unresolved.length} bodies row(s) do not hash to their key and no intact original explains them: ${e.unresolved.join(", ")}`);return{changed:e.rekeyed>0||e.removed>0,summary:{...e}}},"apply")}];export{f as BOOT_MIGRATIONS};

package/dist/daemon/broker-signals/bus.d.ts

@@ -10,9 +10,10 @@ export declare function cachedBrokerNodeFields(node: BrokerExtensionNodeDTO): Br
 /** What a `crtr_signal` notification names. `mail` and `node` carry a node id; the others name the row that changed
  *  (D39): a grant id, run or node id, structured request, queue, limit, or environment object. `fault_retry` carries a node id: the
  *  fault-retry backstop publishes it in the commit that claims the nudge, and the API process holding that node's stream turns it
- *  into a `fault-retry` line. The writers fire them (the
+ *  into a `fault-retry` line. `machine` carries a machine environment object id (a call is pending for the API process holding its link);
+ *  `machine_call` carries a call id (the caller waiting on it re-reads the row). The writers fire them (the
  *  schema's triggers, or the unit that owns the writer); the bus only delivers. */
-export declare const BROKER_SIGNAL_KINDS: readonly ["mail", "node", "grant", "run_event", "report", "structured_request", "queue", "spend_limits", "environment_image", "fault_retry", "settings"];
+export declare const BROKER_SIGNAL_KINDS: readonly ["mail", "node", "grant", "run_event", "report", "structured_request", "queue", "spend_limits", "environment_image", "fault_retry", "settings", "machine", "machine_call"];
 export type BrokerSignalKind = (typeof BROKER_SIGNAL_KINDS)[number];
 export type BrokerSignalSubscriber = (id: string, kind: BrokerSignalKind) => void;
 export interface BrokerSignalSubscription {

package/dist/daemon/broker-signals/bus.js

@@ -1 +1 @@
-var h=Object.defineProperty;var r=(i,e)=>h(i,"name",{value:e,configurable:!0});import d from"pg";const l=["description","title","icon","mode","lifecycle","status","cwd","parent","fork_from","profile_id","review_binding_json","persona_ack_json","intent","situational_card"],a=r(i=>i==="review_binding_json"?"review_binding":i==="persona_ack_json"?"persona_ack":i,"nodeField");function p(i){const e={};for(const n of l){if(n==="situational_card")continue;const t=a(n);e[t]=i[t]}return e}r(p,"cachedBrokerNodeFields");const u=["mail","node","grant","run_event","report","structured_request","queue","spend_limits","environment_image","fault_retry","settings"],f=new Set(u);class k{static{r(this,"BrokerSignalBus")}dirty=new Map;subscribers=new Set;scheduled;checkIntervalMs;checkTimeoutMs;reconnectMs;constructor(e={}){this.checkIntervalMs=e.checkIntervalMs??3e4,this.checkTimeoutMs=e.checkTimeoutMs??1e4,this.reconnectMs=e.reconnectMs??1e3}async subscribe(e,n={}){const t={listener:e,kinds:new Set(n.kinds??["mail","node"]),onListenStart:n.onListenStart};return this.subscribers.add(t),this.listener!==void 0&&t.onListenStart!==void 0&&queueMicrotask(()=>{this.subscribers.has(t)&&this.callListenStart(t)}),()=>{this.subscribers.delete(t)}}markMail(e){this.mark("mail",e)}markNode(e){this.mark("node",e)}markSignal(e,n){this.mark(e,n)}mark(e,n){const t=`${e}:${n}`;this.dirty.has(t)||this.dirty.set(t,{id:n,kind:e}),this.scheduled??=setImmediate(()=>this.flush())}flush(){this.scheduled=void 0;const e=[...this.dirty.values()];this.dirty.clear();for(const{id:n,kind:t}of e)for(const s of this.subscribers)if(s.kinds.has(t))try{s.listener(n,t)}catch{}}callListenStart(e){try{e.onListenStart?.()}catch{}}async listen(e){this.listener!==void 0||this.listening!==void 0||(this.url=e,this.listening=this.connectListener().finally(()=>{this.listening=void 0}),await this.listening)}listener;listening;url;reconnect;check;async connectListener(){const e=new d.Client({connectionString:this.url,application_name:`crtr-signal-${process.pid}`,keepAlive:!0});e.on("notification",t=>{const s=t.payload??"",c=s.indexOf(":");if(c<0)return;const o=s.slice(0,c);f.has(o)&&this.mark(o,s.slice(c+1))});const n=r(()=>{this.listener===e&&(this.dropListener(e),this.scheduleReconnect())},"lost");e.on("error",n),e.on("end",n);try{await e.connect(),await e.query("LISTEN crtr_signal")}catch(t){throw e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{}),t}if(this.url===void 0){e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{});return}this.listener=e,this.startChecks(e,n);for(const t of[...this.subscribers])this.callListenStart(t)}startChecks(e,n){this.stopChecks(),this.check=setInterval(()=>{if(this.listener!==e)return;let t;const s=new Promise((c,o)=>{t=setTimeout(()=>o(new Error("listen connection check timed out")),this.checkTimeoutMs)});Promise.race([e.query("SELECT 1"),s]).catch(()=>n()).finally(()=>clearTimeout(t))},this.checkIntervalMs),this.check.unref()}stopChecks(){this.check!==void 0&&clearInterval(this.check),this.check=void 0}dropListener(e){this.listener=void 0,this.stopChecks(),e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{})}scheduleReconnect(){this.url===void 0||this.reconnect!==void 0||(this.reconnect=setTimeout(()=>{this.reconnect=void 0,this.url!==void 0&&(this.listening=this.connectListener().catch(()=>this.scheduleReconnect()).finally(()=>{this.listening=void 0}))},this.reconnectMs))}close(){this.url=void 0,this.reconnect!==void 0&&clearTimeout(this.reconnect),this.reconnect=void 0,this.stopChecks();const e=this.listener;return this.listener=void 0,this.scheduled!==void 0&&clearImmediate(this.scheduled),this.scheduled=void 0,this.dirty.clear(),this.subscribers.clear(),e===void 0?Promise.resolve():(e.removeAllListeners("notification"),e.removeAllListeners("error"),e.on("error",()=>{}),e.end().catch(()=>{}))}}const b=new k;export{u as BROKER_SIGNAL_KINDS,l as BROKER_SIGNAL_NODE_COLUMNS,k as BrokerSignalBus,b as brokerSignalBus,p as cachedBrokerNodeFields};
+var h=Object.defineProperty;var r=(i,e)=>h(i,"name",{value:e,configurable:!0});import d from"pg";const a=["description","title","icon","mode","lifecycle","status","cwd","parent","fork_from","profile_id","review_binding_json","persona_ack_json","intent","situational_card"],l=r(i=>i==="review_binding_json"?"review_binding":i==="persona_ack_json"?"persona_ack":i,"nodeField");function p(i){const e={};for(const n of a){if(n==="situational_card")continue;const t=l(n);e[t]=i[t]}return e}r(p,"cachedBrokerNodeFields");const u=["mail","node","grant","run_event","report","structured_request","queue","spend_limits","environment_image","fault_retry","settings","machine","machine_call"],f=new Set(u);class k{static{r(this,"BrokerSignalBus")}dirty=new Map;subscribers=new Set;scheduled;checkIntervalMs;checkTimeoutMs;reconnectMs;constructor(e={}){this.checkIntervalMs=e.checkIntervalMs??3e4,this.checkTimeoutMs=e.checkTimeoutMs??1e4,this.reconnectMs=e.reconnectMs??1e3}async subscribe(e,n={}){const t={listener:e,kinds:new Set(n.kinds??["mail","node"]),onListenStart:n.onListenStart};return this.subscribers.add(t),this.listener!==void 0&&t.onListenStart!==void 0&&queueMicrotask(()=>{this.subscribers.has(t)&&this.callListenStart(t)}),()=>{this.subscribers.delete(t)}}markMail(e){this.mark("mail",e)}markNode(e){this.mark("node",e)}markSignal(e,n){this.mark(e,n)}mark(e,n){const t=`${e}:${n}`;this.dirty.has(t)||this.dirty.set(t,{id:n,kind:e}),this.scheduled??=setImmediate(()=>this.flush())}flush(){this.scheduled=void 0;const e=[...this.dirty.values()];this.dirty.clear();for(const{id:n,kind:t}of e)for(const s of this.subscribers)if(s.kinds.has(t))try{s.listener(n,t)}catch{}}callListenStart(e){try{e.onListenStart?.()}catch{}}async listen(e){this.listener!==void 0||this.listening!==void 0||(this.url=e,this.listening=this.connectListener().finally(()=>{this.listening=void 0}),await this.listening)}listener;listening;url;reconnect;check;async connectListener(){const e=new d.Client({connectionString:this.url,application_name:`crtr-signal-${process.pid}`,keepAlive:!0});e.on("notification",t=>{const s=t.payload??"",c=s.indexOf(":");if(c<0)return;const o=s.slice(0,c);f.has(o)&&this.mark(o,s.slice(c+1))});const n=r(()=>{this.listener===e&&(this.dropListener(e),this.scheduleReconnect())},"lost");e.on("error",n),e.on("end",n);try{await e.connect(),await e.query("LISTEN crtr_signal")}catch(t){throw e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{}),t}if(this.url===void 0){e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{});return}this.listener=e,this.startChecks(e,n);for(const t of[...this.subscribers])this.callListenStart(t)}startChecks(e,n){this.stopChecks(),this.check=setInterval(()=>{if(this.listener!==e)return;let t;const s=new Promise((c,o)=>{t=setTimeout(()=>o(new Error("listen connection check timed out")),this.checkTimeoutMs)});Promise.race([e.query("SELECT 1"),s]).catch(()=>n()).finally(()=>clearTimeout(t))},this.checkIntervalMs),this.check.unref()}stopChecks(){this.check!==void 0&&clearInterval(this.check),this.check=void 0}dropListener(e){this.listener=void 0,this.stopChecks(),e.removeAllListeners(),e.on("error",()=>{}),e.end().catch(()=>{})}scheduleReconnect(){this.url===void 0||this.reconnect!==void 0||(this.reconnect=setTimeout(()=>{this.reconnect=void 0,this.url!==void 0&&(this.listening=this.connectListener().catch(()=>this.scheduleReconnect()).finally(()=>{this.listening=void 0}))},this.reconnectMs))}close(){this.url=void 0,this.reconnect!==void 0&&clearTimeout(this.reconnect),this.reconnect=void 0,this.stopChecks();const e=this.listener;return this.listener=void 0,this.scheduled!==void 0&&clearImmediate(this.scheduled),this.scheduled=void 0,this.dirty.clear(),this.subscribers.clear(),e===void 0?Promise.resolve():(e.removeAllListeners("notification"),e.removeAllListeners("error"),e.on("error",()=>{}),e.end().catch(()=>{}))}}const b=new k;export{u as BROKER_SIGNAL_KINDS,a as BROKER_SIGNAL_NODE_COLUMNS,k as BrokerSignalBus,b as brokerSignalBus,p as cachedBrokerNodeFields};

package/dist/daemon/cron/armed-context.d.ts

@@ -35,6 +35,7 @@ export declare function resolveLiveProfileName(c: Cron): string | undefined;
 export declare class ArmedContextError extends Error {
     constructor(message: string);
 }
+export declare function parseArmedEnv(envJson: string | null): Record<string, string>;
 export interface ArmedRunContext {
     profileId: string | null;
     env: NodeJS.ProcessEnv;