@north-light/crouter 0.3.318 → 0.3.320

package/dist/daemon/api/router.js

@@ -1,190 +1 @@
-// The crtrd API router (spec §4.2). A tiny hand-rolled method+path matcher — no
-// framework, matching the CLI's no-dependency ethos (`core/command.ts` is a
-// hand-rolled path walker for the same reason).
-//
-// Routes are a flat table of `{ method, pattern, handler }`. A `pattern` like
-// `/v1/nodes/:id/messages` is matched by splitting both it and the request path
-// on '/'; a `:name` segment captures into `params`. `handle(req, res)` resolves
-// the JSON body, dispatches to the matched handler, and wraps EVERY handler so a
-// thrown error becomes a JSON `ErrorBody` with the mapped status (map.ts §8) —
-// a handler throw NEVER crashes the daemon.
-//
-// The WS attach upgrade (`GET /v1/nodes/:id/attach` with `Upgrade: websocket`) is
-// NOT routed here — the server (A-9) owns the upgrade handshake and hands it to
-// `bridge.ts` (A-8). This router serves only non-upgrade HTTP requests.
-import { toErrorBody } from './map.js';
-import { emitEvent } from '../../core/events/emit.js';
-const MAX_BODY_BYTES = 4 * 1024 * 1024; // 4 MiB — generous for JSON control bodies.
-export class Router {
-    routes = [];
-    /** Register one route. Returns `this` for chaining. */
-    register(def) {
-        this.routes.push({
-            method: def.method.toUpperCase(),
-            segments: splitPath(def.pattern),
-            handler: def.handler,
-        });
-        return this;
-    }
-    /** Register a whole table at once. */
-    registerAll(table) {
-        for (const def of table)
-            this.register(def);
-        return this;
-    }
-    /** Match a method + pathname against the table, extracting `:name` params.
-     *  Returns null when nothing matches (the caller responds 404). */
-    match(method, path) {
-        const wanted = method.toUpperCase();
-        const parts = splitPath(path);
-        for (const route of this.routes) {
-            if (route.method !== wanted)
-                continue;
-            const params = matchSegments(route.segments, parts);
-            if (params !== null)
-                return { handler: route.handler, params };
-        }
-        return null;
-    }
-    /** Resolve the JSON body, dispatch to the matched handler, and write the
-     *  response. Every failure path — no route, bad JSON, a handler throw — is
-     *  turned into a JSON `ErrorBody` (map.ts §8); this method never throws and
-     *  never leaves the daemon crashed. */
-    async handle(req, res) {
-        try {
-            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
-            const method = (req.method ?? 'GET').toUpperCase();
-            const matched = this.match(method, url.pathname);
-            if (matched === null) {
-                writeError(res, 404, 'not_found', `no route for ${method} ${url.pathname}`);
-                return;
-            }
-            let body;
-            try {
-                body = await readJsonBody(req);
-            }
-            catch (err) {
-                const code = err instanceof BodyTooLargeError ? 'payload_too_large' : 'invalid_request';
-                writeError(res, code === 'payload_too_large' ? 413 : 400, code, err.message);
-                return;
-            }
-            const ctx = {
-                method,
-                path: url.pathname,
-                params: matched.params,
-                query: url.searchParams,
-                body,
-                req,
-                res,
-            };
-            const result = await matched.handler(ctx);
-            writeResult(res, result);
-        }
-        catch (err) {
-            // The handler (or something in dispatch) threw — map it and respond. A
-            // request-listener that throws would crash the whole daemon; never allow
-            // it (mirrors server.ts's belt-and-suspenders 500).
-            const { status, body } = toErrorBody(err);
-            // A 500 body carries only a bounded cause (map.ts:boundedCause); the FULL
-            // error — stack included — lives ONLY here, so it must be logged or the
-            // real cause is lost. (map.ts long claimed "logged server-side"; nothing
-            // actually did until this.) <500 named errors already carry their cause
-            // in the response, so they need no extra log line.
-            if (status >= 500) {
-                emitEvent({
-                    event: 'api.request.failed',
-                    level: 'error',
-                    error: err instanceof Error ? err : new Error(String(err)),
-                    fields: { method: (req.method ?? 'GET').toUpperCase(), path: req.url ?? '' },
-                });
-            }
-            writeJson(res, status, body);
-        }
-    }
-}
-// Matching
-/** Split a path/pattern into non-empty segments (leading/trailing '/' ignored). */
-function splitPath(p) {
-    return p.split('/').filter((s) => s.length > 0);
-}
-/** Match a compiled pattern's segments against a request path's segments,
- *  returning captured `:name` params, or null when the shapes differ. */
-function matchSegments(pattern, actual) {
-    if (pattern.length !== actual.length)
-        return null;
-    const params = {};
-    for (let i = 0; i < pattern.length; i++) {
-        const seg = pattern[i];
-        const got = actual[i];
-        if (seg.startsWith(':')) {
-            params[seg.slice(1)] = decodeURIComponent(got);
-        }
-        else if (seg !== got) {
-            return null;
-        }
-    }
-    return params;
-}
-// Body + response I/O
-class BodyTooLargeError extends Error {
-}
-/** Read and JSON-parse the request body. Returns `undefined` for an empty body.
- *  Throws `BodyTooLargeError` past the cap and a plain `Error` on malformed
- *  JSON (both mapped to 4xx by the caller). */
-async function readJsonBody(req) {
-    const chunks = [];
-    let total = 0;
-    for await (const chunk of req) {
-        const buf = chunk;
-        total += buf.length;
-        if (total > MAX_BODY_BYTES) {
-            throw new BodyTooLargeError(`request body exceeds ${MAX_BODY_BYTES} bytes`);
-        }
-        chunks.push(buf);
-    }
-    if (total === 0)
-        return undefined;
-    const text = Buffer.concat(chunks).toString('utf8').trim();
-    if (text === '')
-        return undefined;
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        throw new Error('request body is not valid JSON');
-    }
-}
-/** Write a handler result: JSON body (if any) at its status, merging headers.
- *  A 204 or an absent body writes no payload. */
-function writeResult(res, result) {
-    if (res.headersSent)
-        return;
-    const headers = { ...(result.headers ?? {}) };
-    if (result.rawBody !== undefined) {
-        res.writeHead(result.status, headers);
-        res.end(result.rawBody);
-        return;
-    }
-    if (result.status === 204 || result.body === undefined) {
-        res.writeHead(result.status, headers);
-        res.end();
-        return;
-    }
-    if (headers['content-type'] === undefined) {
-        headers['content-type'] = 'application/json; charset=utf-8';
-    }
-    res.writeHead(result.status, headers);
-    res.end(JSON.stringify(result.body));
-}
-function writeJson(res, status, body) {
-    if (res.headersSent) {
-        res.end();
-        return;
-    }
-    res.writeHead(status, { 'content-type': 'application/json; charset=utf-8' });
-    res.end(JSON.stringify(body));
-}
-function writeError(res, status, code, message) {
-    const body = { error: { code, message } };
-    writeJson(res, status, body);
-}
+var g=Object.defineProperty;var s=(e,t)=>g(e,"name",{value:t,configurable:!0});import{toErrorBody as w}from"./map.js";import{emitEvent as E}from"../../core/events/emit.js";const u=4*1024*1024;class v{static{s(this,"Router")}routes=[];register(t){return this.routes.push({method:t.method.toUpperCase(),segments:h(t.pattern),handler:t.handler}),this}registerAll(t){for(const n of t)this.register(n);return this}match(t,n){const r=t.toUpperCase(),o=h(n);for(const a of this.routes){if(a.method!==r)continue;const i=b(a.segments,o);if(i!==null)return{handler:a.handler,params:i}}return null}async handle(t,n){try{const r=new URL(t.url??"/","http://127.0.0.1"),o=(t.method??"GET").toUpperCase(),a=this.match(o,r.pathname);if(a===null){p(n,404,"not_found",`no route for ${o} ${r.pathname}`);return}let i;try{i=await S(t)}catch(d){const c=d instanceof f?"payload_too_large":"invalid_request";p(n,c==="payload_too_large"?413:400,c,d.message);return}const m={method:o,path:r.pathname,params:a.params,query:r.searchParams,body:i,req:t,res:n},y=await a.handler(m);B(n,y)}catch(r){const{status:o,body:a}=w(r);o>=500&&E({event:"api.request.failed",level:"error",error:r instanceof Error?r:new Error(String(r)),fields:{method:(t.method??"GET").toUpperCase(),path:t.url??""}}),l(n,o,a)}}}function h(e){return e.split("/").filter(t=>t.length>0)}s(h,"splitPath");function b(e,t){if(e.length!==t.length)return null;const n={};for(let r=0;r<e.length;r++){const o=e[r],a=t[r];if(o.startsWith(":"))n[o.slice(1)]=decodeURIComponent(a);else if(o!==a)return null}return n}s(b,"matchSegments");class f extends Error{static{s(this,"BodyTooLargeError")}}async function S(e){const t=[];let n=0;for await(const o of e){const a=o;if(n+=a.length,n>u)throw new f(`request body exceeds ${u} bytes`);t.push(a)}if(n===0)return;const r=Buffer.concat(t).toString("utf8").trim();if(r!=="")try{return JSON.parse(r)}catch{throw new Error("request body is not valid JSON")}}s(S,"readJsonBody");function B(e,t){if(e.headersSent)return;const n={...t.headers??{}};if(t.rawBody!==void 0){e.writeHead(t.status,n),e.end(t.rawBody);return}if(t.status===204||t.body===void 0){e.writeHead(t.status,n),e.end();return}n["content-type"]===void 0&&(n["content-type"]="application/json; charset=utf-8"),e.writeHead(t.status,n),e.end(JSON.stringify(t.body))}s(B,"writeResult");function l(e,t,n){if(e.headersSent){e.end();return}e.writeHead(t,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify(n))}s(l,"writeJson");function p(e,t,n,r){l(e,t,{error:{code:n,message:r}})}s(p,"writeError");export{v as Router};

package/dist/daemon/api/server.js

@@ -1,408 +1,11 @@
-// server.ts — the crtrd HTTP+WS API server (spec §4, esp. §4.1/§5). A-9.
-//
-// Two `http.Server` listeners share one logical API (a Node server can bind one
-// handle only):
-//   - the unix socket at `apiSocketPath()` — ALWAYS bound, owner-only (mode
-//     0600 = the fs-perms-are-auth model); NEVER token-checked, token set or
-//     not;
-//   - an opt-in TCP listener, bound only when `--tcp <host:port>` / `CRTRD_TCP`
-//     is set. When `CRTRD_TOKEN` is ALSO set, every TCP request and WS upgrade
-//     must carry `Authorization: Bearer <token>` or the daemon answers 401
-//     with the standard `ErrorBody` (errors.ts) — otherwise (the default) TCP
-//     gets no auth check at all, unchanged from before this guard existed (a
-//     fronting edge owns auth there instead).
-//
-// Non-upgrade requests flow through the hand-rolled `Router` (A-6) loaded with
-// every handler route table (A-7). `GET /v1/nodes/:id/attach` upgrades are
-// handed to `handleAttachUpgrade` (A-8, the WS attach bridge with
-// attach-implies-revive); every other upgrade path destroys the socket, and an
-// unhandled upgrade error destroys the socket without throwing.
-import { createServer } from 'node:http';
-import { chmodSync, existsSync, unlinkSync } from 'node:fs';
-import { apiSocketPath } from '../../core/canvas/paths.js';
-import { emitEvent } from '../../core/events/emit.js';
-import { envCrtrdTcp, envCrtrdToken } from '../../shared/env.js';
-import { Router } from './router.js';
-import { handleAttachUpgrade } from './bridge.js';
-import { boundDaemonControl } from '../control.js';
-import { attachRoutes } from './handlers/attach.js';
-import { bashJobRoutes } from './handlers/bash-jobs.js';
-import { brokerOperationRoutes } from './handlers/broker-ops.js';
-import { brokerRecoveryRoutes, nodeFaultRoutes } from './handlers/broker-recovery.js';
-import { canvasRoutes } from './handlers/canvas.js';
-import { chatInventoryRoutes } from './handlers/chat-inventory.js';
-import { daemonRoutes } from './handlers/daemon.js';
-import { fileRoutes } from './handlers/files.js';
-import { focusRoutes } from './handlers/focus.js';
-import { healthRoutes } from './handlers/health.js';
-import { humanRequestRoutes } from './handlers/human-requests.js';
-import { inboxRoutes } from './handlers/inbox.js';
-import { feedbackCommentRoutes } from './handlers/feedback-comments.js';
-import { memoryRoutes } from './handlers/memory.js';
-import { brokerMailRoutes, messageRoutes } from './handlers/messages.js';
-import { modelAuthRoutes } from './handlers/modelauth.js';
-import { modelConfigRoutes } from './handlers/model-config.js';
-import { nodeRoutes } from './handlers/nodes.js';
-import { nodeOutcomeRoutes } from './handlers/node-outcomes.js';
-import { profileRoutes } from './handlers/profiles.js';
-import { prospectiveChatInventoryRoutes } from './handlers/prospective-chat-inventory.js';
-import { reportRoutes } from './handlers/reports.js';
-import { reviewCommentRoutes } from './handlers/review-comments.js';
-import { reviewRoutes } from './handlers/reviews.js';
-import { subscriptionRoutes } from './handlers/subscriptions.js';
-import { cronRoutes } from './handlers/crons.js';
-import { worktreeRoutes } from './handlers/worktree.js';
-/** Build the Router loaded with every handler route table (A-7). The order is
- *  irrelevant — the matcher is exact method+path — but `healthRoutes` (which
- *  owns the unversioned `/healthz`) is registered first for clarity. */
-function buildRouter() {
-    return new Router()
-        .registerAll(healthRoutes)
-        .registerAll(daemonRoutes)
-        .registerAll(nodeRoutes)
-        .registerAll(nodeOutcomeRoutes)
-        .registerAll(bashJobRoutes)
-        .registerAll(brokerOperationRoutes)
-        .registerAll(brokerRecoveryRoutes)
-        .registerAll(nodeFaultRoutes)
-        .registerAll(worktreeRoutes)
-        .registerAll(brokerMailRoutes)
-        .registerAll(messageRoutes)
-        .registerAll(reportRoutes)
-        .registerAll(attachRoutes)
-        .registerAll(canvasRoutes)
-        .registerAll(fileRoutes)
-        .registerAll(memoryRoutes)
-        .registerAll(focusRoutes)
-        .registerAll(subscriptionRoutes)
-        .registerAll(cronRoutes)
-        .registerAll(profileRoutes)
-        .registerAll(modelAuthRoutes)
-        .registerAll(modelConfigRoutes)
-        .registerAll(reviewRoutes)
-        .registerAll(reviewCommentRoutes)
-        .registerAll(inboxRoutes)
-        .registerAll(humanRequestRoutes)
-        .registerAll(chatInventoryRoutes)
-        .registerAll(prospectiveChatInventoryRoutes)
-        .registerAll(feedbackCommentRoutes);
-}
-/** Is this request an attach upgrade — `GET /v1/nodes/{id}/attach` — and if so,
- *  what is `{id}`? Returns null for any non-attach path (the caller destroys the
- *  socket). The id is captured raw; `handleAttachUpgrade` does the
- *  `isSafeNodeId` + existence guards (§5.1). */
-function attachNodeId(method, pathname) {
-    if (method.toUpperCase() !== 'GET')
-        return null;
-    const segs = pathname.split('/').filter((s) => s.length > 0);
-    // /v1/nodes/:id/attach
-    if (segs.length !== 4)
-        return null;
-    if (segs[0] !== 'v1' || segs[1] !== 'nodes' || segs[3] !== 'attach')
-        return null;
-    const id = segs[2];
-    if (id === undefined || id === '')
-        return null;
-    return decodeURIComponent(id);
-}
-/** Parse a `host:port` (or `:port`) TCP spec. Returns null on a malformed spec
- *  so a bad `CRTRD_TCP` degrades to socket-only rather than crashing boot. */
-function parseTcp(spec) {
-    const trimmed = spec.trim();
-    if (trimmed === '')
-        return null;
-    const idx = trimmed.lastIndexOf(':');
-    if (idx < 0)
-        return null;
-    const host = trimmed.slice(0, idx);
-    const portText = trimmed.slice(idx + 1);
-    const port = Number(portText);
-    if (!Number.isInteger(port) || port < 0 || port > 65535)
-        return null;
-    return { host: host === '' ? '0.0.0.0' : host, port };
-}
-/** The standard `ErrorBody` (errors.ts) for a TCP request/upgrade missing or
- *  carrying a wrong `Authorization: Bearer <token>` header. Only ever written
- *  when `CRTRD_TOKEN` is set — an unset token never reaches this path. */
-const UNAUTHORIZED_BODY = {
-    error: { code: 'unauthorized', message: 'missing or invalid bearer token' },
-};
-/** Does `req` carry the exact `Authorization: Bearer <token>` this TCP
- *  listener requires? */
-function isAuthorized(req, token) {
-    return req.headers['authorization'] === `Bearer ${token}`;
-}
-/** Reject an unauthorized non-upgrade TCP request with the standard 401 body. */
-function writeUnauthorized(res) {
-    const payload = JSON.stringify(UNAUTHORIZED_BODY);
-    res.writeHead(401, { 'content-type': 'application/json; charset=utf-8' });
-    res.end(payload);
-}
-function writeStartupBlocked(res, message) {
-    res.writeHead(503, { 'content-type': 'application/json; charset=utf-8' });
-    res.end(JSON.stringify({ error: { code: 'startup_blocked', message } }));
-}
-function destroyUpgradeStartupBlocked(socket, message) {
-    const payload = JSON.stringify({ error: { code: 'startup_blocked', message } });
-    const response = `HTTP/1.1 503 Service Unavailable\r\ncontent-type: application/json; charset=utf-8\r\ncontent-length: ${Buffer.byteLength(payload)}\r\nconnection: close\r\n\r\n${payload}`;
-    try {
-        socket.end(response);
-    }
-    catch {
-        socket.destroy();
-    }
-}
-/** Reject an unauthorized TCP WS-upgrade attempt: this is a raw pre-upgrade
- *  socket (no `ServerResponse`), so the 401 is written as a literal HTTP
- *  response — mirroring `bridge.ts`'s `refuseUpgrade` (`end()`, not
- *  `write()`+`destroy()`, so a slow peer can't truncate the body) — before the
- *  socket closes. */
-function destroyUpgradeUnauthorized(socket) {
-    const payload = JSON.stringify(UNAUTHORIZED_BODY);
-    const response = `HTTP/1.1 401 Unauthorized\r\n` +
-        `content-type: application/json; charset=utf-8\r\n` +
-        `content-length: ${Buffer.byteLength(payload)}\r\n` +
-        `connection: close\r\n\r\n${payload}`;
-    try {
-        socket.end(response);
-    }
-    catch {
-        try {
-            socket.destroy();
-        }
-        catch {
-            /* already gone */
-        }
-    }
-}
-/** Close one http.Server, dropping idle keep-alives so the callback fires. */
-function closeServer(server) {
-    return new Promise((resolve) => {
-        try {
-            server.closeAllConnections();
-        }
-        catch {
-            /* older runtimes lack this — best-effort */
-        }
-        server.close(() => resolve());
-    });
-}
-/** Create and start the crtrd API server. Returns immediately with a `close()`
- *  handle and a `ready` promise for the mandatory Unix socket bind. TCP remains
- *  opt-in, and its bind or post-listen accept errors are emitted but non-fatal.
- *
- *  A Node `net.Server`/`http.Server` binds exactly ONE handle, so the two
- *  listeners are separate `http.Server` instances sharing request and upgrade
- *  handlers. The Router and attach bridge are process-wide singletons, so both
- *  servers route into identical state. */
-export function createApiServer(opts = {}) {
-    const router = buildRouter();
-    const brokerLaunchRoutes = new Router()
-        .registerAll(brokerOperationRoutes)
-        .registerAll(brokerRecoveryRoutes)
-        .registerAll(brokerMailRoutes);
-    const startupBlockFor = (method, pathname) => {
-        const block = boundDaemonControl()?.startupBlock() ?? null;
-        if (block === null)
-            return null;
-        const admitted = (method === 'GET' && (pathname === '/healthz' || pathname === '/v1/status'))
-            || (method === 'POST' && (pathname === '/v1/daemon/migrate' || pathname === '/v1/daemon/admit'))
-            || (block.phase === 'recovering' && brokerLaunchRoutes.match(method, pathname) !== null);
-        return admitted ? null : block;
-    };
-    const sockPath = apiSocketPath();
-    // Shared request handler. It owns the request boundary, including URL
-    // parsing before the router can take over, so malformed wire input cannot
-    // escape Node's request listener and terminate the daemon.
-    const onRequest = (req, res) => {
-        const internalFailure = (err) => {
-            emitEvent({
-                event: 'api.request.failed',
-                level: 'error',
-                error: err instanceof Error ? err : new Error(String(err)),
-            });
-            try {
-                if (!res.headersSent) {
-                    res.writeHead(500, { 'content-type': 'application/json; charset=utf-8' });
-                }
-                res.end(JSON.stringify({ error: { code: 'internal', message: 'internal error' } }));
-            }
-            catch {
-                /* response already gone */
-            }
-        };
-        let url;
-        try {
-            url = new URL(req.url ?? '/', 'http://127.0.0.1');
-        }
-        catch {
-            try {
-                res.writeHead(400, { 'content-type': 'application/json; charset=utf-8' });
-                res.end(JSON.stringify({ error: { code: 'invalid_request', message: 'request URL is invalid' } }));
-            }
-            catch {
-                /* response already gone */
-            }
-            return;
-        }
-        try {
-            const block = startupBlockFor((req.method ?? 'GET').toUpperCase(), url.pathname);
-            if (block !== null) {
-                writeStartupBlocked(res, block.message);
-                return;
-            }
-            void router.handle(req, res).catch(internalFailure);
-        }
-        catch (err) {
-            internalFailure(err);
-        }
-    };
-    // Shared upgrade handler: only `GET /v1/nodes/:id/attach` is served; every
-    // other upgrade path destroys the socket, and an unhandled error destroys the
-    // socket — it never throws.
-    const onUpgrade = (req, socket, head) => {
-        // A raw upgrade socket with no 'error' listener throws on a write to a reset
-        // peer — attach one before we ever write/destroy it.
-        socket.on('error', () => {
-            /* peer reset mid-handshake — destroyed below or already destroyed */
-        });
-        try {
-            const url = new URL(req.url ?? '/', 'http://127.0.0.1');
-            const block = startupBlockFor((req.method ?? 'GET').toUpperCase(), url.pathname);
-            if (block !== null) {
-                destroyUpgradeStartupBlocked(socket, block.message);
-                return;
-            }
-            const nodeId = attachNodeId(req.method ?? 'GET', url.pathname);
-            if (nodeId === null) {
-                // Not an attach upgrade — no other upgrade path is served.
-                socket.destroy();
-                return;
-            }
-            // handleAttachUpgrade owns the handshake AND never throws (it refuses with
-            // a plain HTTP error or closes the WS post-handshake). The `.catch` is a
-            // final safety net.
-            void handleAttachUpgrade(req, socket, head, nodeId).catch(() => {
-                try {
-                    socket.destroy();
-                }
-                catch {
-                    /* already gone */
-                }
-            });
-        }
-        catch {
-            // Never let an upgrade-handler throw escape and crash the daemon.
-            try {
-                socket.destroy();
-            }
-            catch {
-                /* ignore */
-            }
-        }
-    };
-    const bindErrorHandler = (server) => {
-        // TCP is opt-in, so neither its bind failure nor a later accept error can
-        // make the mandatory Unix API unavailable.
-        server.on('error', (err) => {
-            emitEvent({ event: 'api.server.failed', level: 'error', error: err });
-        });
-    };
-    // Unix socket — ALWAYS bound. Its bind result is startup readiness; after
-    // that point, accept errors remain observable but do not tear the daemon down.
-    const socketServer = createServer(onRequest);
-    socketServer.on('upgrade', onUpgrade);
-    let socketBound = false;
-    let resolveReady;
-    let rejectReady;
-    const ready = new Promise((resolve, reject) => {
-        resolveReady = resolve;
-        rejectReady = reject;
-    });
-    socketServer.once('listening', () => {
-        socketBound = true;
-        resolveReady();
-    });
-    socketServer.on('error', (err) => {
-        emitEvent({ event: 'api.server.failed', level: 'error', error: err });
-        if (!socketBound)
-            rejectReady(err);
-    });
-    try {
-        if (existsSync(sockPath))
-            unlinkSync(sockPath);
-    }
-    catch {
-        /* a fresh listen below will surface a real problem */
-    }
-    socketServer.listen(sockPath, () => {
-        try {
-            chmodSync(sockPath, 0o600);
-        }
-        catch (err) {
-            emitEvent({
-                event: 'api.socket.chmod_failed',
-                level: 'error',
-                error: err instanceof Error ? err : new Error(String(err)),
-            });
-        }
-    });
-    // TCP — opt-in only. A SECOND http.Server sharing the same handlers, gated
-    // by CRTRD_TOKEN when set (never the unix socket, which shares onRequest/
-    // onUpgrade directly above with no wrapping at all).
-    let tcpServer;
-    const tcpSpec = opts.tcp ?? envCrtrdTcp();
-    if (tcpSpec !== undefined && tcpSpec !== '') {
-        const parsed = parseTcp(tcpSpec);
-        if (parsed === null) {
-            emitEvent({
-                event: 'api.tcp.invalid',
-                level: 'error',
-                error: new Error(`invalid CRTRD_TCP/--tcp spec: ${tcpSpec}`),
-            });
-        }
-        else {
-            const token = envCrtrdToken();
-            const tcpOnRequest = token === undefined
-                ? onRequest
-                : (req, res) => {
-                    if (!isAuthorized(req, token)) {
-                        writeUnauthorized(res);
-                        return;
-                    }
-                    onRequest(req, res);
-                };
-            const tcpOnUpgrade = token === undefined
-                ? onUpgrade
-                : (req, socket, head) => {
-                    if (!isAuthorized(req, token)) {
-                        destroyUpgradeUnauthorized(socket);
-                        return;
-                    }
-                    onUpgrade(req, socket, head);
-                };
-            tcpServer = createServer(tcpOnRequest);
-            tcpServer.on('upgrade', tcpOnUpgrade);
-            bindErrorHandler(tcpServer);
-            tcpServer.listen(parsed.port, parsed.host);
-        }
-    }
-    let closed = false;
-    const close = async () => {
-        if (closed)
-            return;
-        closed = true;
-        await Promise.all([
-            closeServer(socketServer),
-            tcpServer !== undefined ? closeServer(tcpServer) : Promise.resolve(),
-        ]);
-        try {
-            if (existsSync(sockPath))
-                unlinkSync(sockPath);
-        }
-        catch {
-            /* best-effort cleanup */
-        }
-    };
-    return { ready, close };
-}
+var j=Object.defineProperty;var i=(t,o)=>j(t,"name",{value:o,configurable:!0});import{createServer as S}from"node:http";import{chmodSync as z,existsSync as w,unlinkSync as U}from"node:fs";import{apiSocketPath as J}from"../../core/canvas/paths.js";import{emitEvent as g}from"../../core/events/emit.js";import{envCrtrdTcp as x,envCrtrdToken as L}from"../../shared/env.js";import{Router as T}from"./router.js";import{handleAttachUpgrade as _}from"./bridge.js";import{boundDaemonControl as $}from"../control.js";import{attachRoutes as G}from"./handlers/attach.js";import{bashJobRoutes as D}from"./handlers/bash-jobs.js";import{brokerOperationRoutes as k}from"./handlers/broker-ops.js";import{brokerRecoveryRoutes as C,nodeFaultRoutes as F}from"./handlers/broker-recovery.js";import{canvasRoutes as M}from"./handlers/canvas.js";import{chatInventoryRoutes as Y}from"./handlers/chat-inventory.js";import{daemonRoutes as Z}from"./handlers/daemon.js";import{fileRoutes as K}from"./handlers/files.js";import{focusRoutes as Q}from"./handlers/focus.js";import{healthRoutes as V}from"./handlers/health.js";import{humanRequestRoutes as W}from"./handlers/human-requests.js";import{inboxRoutes as X}from"./handlers/inbox.js";import{feedbackCommentRoutes as q}from"./handlers/feedback-comments.js";import{memoryRoutes as ee}from"./handlers/memory.js";import{brokerMailRoutes as O,messageRoutes as re}from"./handlers/messages.js";import{modelAuthRoutes as te}from"./handlers/modelauth.js";import{modelConfigRoutes as oe}from"./handlers/model-config.js";import{nodeRoutes as ne}from"./handlers/nodes.js";import{nodeOutcomeRoutes as ie}from"./handlers/node-outcomes.js";import{profileRoutes as se}from"./handlers/profiles.js";import{prospectiveChatInventoryRoutes as le}from"./handlers/prospective-chat-inventory.js";import{reportRoutes as ce}from"./handlers/reports.js";import{reviewCommentRoutes as ae}from"./handlers/review-comments.js";import{reviewRoutes as ue}from"./handlers/reviews.js";import{subscriptionRoutes as pe}from"./handlers/subscriptions.js";import{cronRoutes as me}from"./handlers/crons.js";import{worktreeRoutes as de}from"./handlers/worktree.js";function fe(){return new T().registerAll(V).registerAll(Z).registerAll(ne).registerAll(ie).registerAll(D).registerAll(k).registerAll(C).registerAll(F).registerAll(de).registerAll(O).registerAll(re).registerAll(ce).registerAll(G).registerAll(M).registerAll(K).registerAll(ee).registerAll(Q).registerAll(pe).registerAll(me).registerAll(se).registerAll(te).registerAll(oe).registerAll(ue).registerAll(ae).registerAll(X).registerAll(W).registerAll(Y).registerAll(le).registerAll(q)}i(fe,"buildRouter");function ge(t,o){if(t.toUpperCase()!=="GET")return null;const s=o.split("/").filter(c=>c.length>0);if(s.length!==4||s[0]!=="v1"||s[1]!=="nodes"||s[3]!=="attach")return null;const l=s[2];return l===void 0||l===""?null:decodeURIComponent(l)}i(ge,"attachNodeId");function he(t){const o=t.trim();if(o==="")return null;const s=o.lastIndexOf(":");if(s<0)return null;const l=o.slice(0,s),c=o.slice(s+1),u=Number(c);return!Number.isInteger(u)||u<0||u>65535?null:{host:l===""?"0.0.0.0":l,port:u}}i(he,"parseTcp");const E={error:{code:"unauthorized",message:"missing or invalid bearer token"}};function N(t,o){return t.headers.authorization===`Bearer ${o}`}i(N,"isAuthorized");function ye(t){const o=JSON.stringify(E);t.writeHead(401,{"content-type":"application/json; charset=utf-8"}),t.end(o)}i(ye,"writeUnauthorized");function Re(t,o){t.writeHead(503,{"content-type":"application/json; charset=utf-8"}),t.end(JSON.stringify({error:{code:"startup_blocked",message:o}}))}i(Re,"writeStartupBlocked");function ve(t,o){const s=JSON.stringify({error:{code:"startup_blocked",message:o}}),l=`HTTP/1.1 503 Service Unavailable\r
+content-type: application/json; charset=utf-8\r
+content-length: ${Buffer.byteLength(s)}\r
+connection: close\r
+\r
+${s}`;try{t.end(l)}catch{t.destroy()}}i(ve,"destroyUpgradeStartupBlocked");function Ae(t){const o=JSON.stringify(E),s=`HTTP/1.1 401 Unauthorized\r
+content-type: application/json; charset=utf-8\r
+content-length: ${Buffer.byteLength(o)}\r
+connection: close\r
+\r
+${o}`;try{t.end(s)}catch{try{t.destroy()}catch{}}}i(Ae,"destroyUpgradeUnauthorized");function P(t){return new Promise(o=>{try{t.closeAllConnections()}catch{}t.close(()=>o())})}i(P,"closeServer");function nr(t={}){const o=fe(),s=new T().registerAll(k).registerAll(C).registerAll(O),l=i((r,e)=>{const a=$()?.startupBlock()??null;return a===null||r==="GET"&&(e==="/healthz"||e==="/v1/status")||r==="POST"&&(e==="/v1/daemon/migrate"||e==="/v1/daemon/admit")||a.phase==="recovering"&&s.match(r,e)!==null?null:a},"startupBlockFor"),c=J(),u=i((r,e)=>{const a=i(n=>{g({event:"api.request.failed",level:"error",error:n instanceof Error?n:new Error(String(n))});try{e.headersSent||e.writeHead(500,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"internal",message:"internal error"}}))}catch{}},"internalFailure");let p;try{p=new URL(r.url??"/","http://127.0.0.1")}catch{try{e.writeHead(400,{"content-type":"application/json; charset=utf-8"}),e.end(JSON.stringify({error:{code:"invalid_request",message:"request URL is invalid"}}))}catch{}return}try{const n=l((r.method??"GET").toUpperCase(),p.pathname);if(n!==null){Re(e,n.message);return}o.handle(r,e).catch(a)}catch(n){a(n)}},"onRequest"),y=i((r,e,a)=>{e.on("error",()=>{});try{const p=new URL(r.url??"/","http://127.0.0.1"),n=l((r.method??"GET").toUpperCase(),p.pathname);if(n!==null){ve(e,n.message);return}const m=ge(r.method??"GET",p.pathname);if(m===null){e.destroy();return}_(r,e,a,m).catch(()=>{try{e.destroy()}catch{}})}catch{try{e.destroy()}catch{}}},"onUpgrade"),B=i(r=>{r.on("error",e=>{g({event:"api.server.failed",level:"error",error:e})})},"bindErrorHandler"),f=S(u);f.on("upgrade",y);let R=!1,v,A;const H=new Promise((r,e)=>{v=r,A=e});f.once("listening",()=>{R=!0,v()}),f.on("error",r=>{g({event:"api.server.failed",level:"error",error:r}),R||A(r)});try{w(c)&&U(c)}catch{}f.listen(c,()=>{try{z(c,384)}catch(r){g({event:"api.socket.chmod_failed",level:"error",error:r instanceof Error?r:new Error(String(r))})}});let d;const h=t.tcp??x();if(h!==void 0&&h!==""){const r=he(h);if(r===null)g({event:"api.tcp.invalid",level:"error",error:new Error(`invalid CRTRD_TCP/--tcp spec: ${h}`)});else{const e=L(),a=e===void 0?u:(n,m)=>{if(!N(n,e)){ye(m);return}u(n,m)},p=e===void 0?y:(n,m,I)=>{if(!N(n,e)){Ae(m);return}y(n,m,I)};d=S(a),d.on("upgrade",p),B(d),d.listen(r.port,r.host)}}let b=!1;return{ready:H,close:i(async()=>{if(!b){b=!0,await Promise.all([P(f),d!==void 0?P(d):Promise.resolve()]);try{w(c)&&U(c)}catch{}}},"close")}}i(nr,"createApiServer");export{nr as createApiServer};

package/dist/daemon/boot-migrations.js

@@ -1,31 +1 @@
-// The ordered boot-migration list — the THIRD of this repo's three migration
-// homes, and the one for filesystem repairs that must run unconditionally at
-// every daemon boot, before supervision can revive anything. No version gate
-// (there is no single database to hold a `user_version`, and no `crtr sys
-// migrate` invocation to drive it): each entry converges on its own, the same
-// way `migrateLegacyInboxIdentities` already does — a re-run over
-// already-migrated state rewrites nothing.
-//
-// The other two homes:
-//   - `../core/canvas/migrations.ts` — canvas.db's versioned schema chain,
-//     gated by `PRAGMA user_version`, applied once per database inside
-//     `migrate()`.
-//   - `../migrations/registry.ts` — the `STATE_MIGRATIONS` registry for
-//     on-disk memory documents, profile manifests, and the corpus lane,
-//     driven by `crtr sys migrate`.
-//
-// Authoring contract: one entry per boot-time filesystem repair, appended
-// here in order. `crtrd.ts` iterates this list once at boot and emits one
-// `daemon.boot_migration.applied` event per entry that reports a change —
-// add a step here instead of a bespoke call in the boot sequence.
-import { migrateLegacyInboxIdentities } from '../core/feed/inbox-migrate.js';
-export const BOOT_MIGRATIONS = [
-    {
-        id: 'legacy-inbox-identities',
-        description: 'normalize pre-cutover inbox entry/operation ids (UUID-spelled or missing) and cursors (ISO-timestamp boundaries) into canonical 32-lowercase-hex identities the strict inbox reader requires.',
-        apply: () => {
-            const summary = migrateLegacyInboxIdentities();
-            return { changed: summary.nodes > 0 || summary.failures > 0, summary: { ...summary } };
-        },
-    },
-];
+var n=Object.defineProperty;var i=(e,r)=>n(e,"name",{value:r,configurable:!0});import{migrateLegacyInboxIdentities as t}from"../core/feed/inbox-migrate.js";const a=[{id:"legacy-inbox-identities",description:"normalize pre-cutover inbox entry/operation ids (UUID-spelled or missing) and cursors (ISO-timestamp boundaries) into canonical 32-lowercase-hex identities the strict inbox reader requires.",apply:i(()=>{const e=t();return{changed:e.nodes>0||e.failures>0,summary:{...e}}},"apply")}];export{a as BOOT_MIGRATIONS};