@north-light/crouter 0.3.352 → 0.3.353

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,21 +1,21 @@
1
- var k=Object.defineProperty;var i=(e,r)=>k(e,"name",{value:r,configurable:!0});import{randomUUID as C}from"node:crypto";import{createServer as x}from"node:http";import{Router as H}from"./router.js";import{OPERATIONS as I}from"./operations.js";import{AppPrincipalResolver as J}from"./principal.js";import{handleRunOperation as $,integer as U}from"./handlers/runs.js";import{parseLlmRequest as X,runLlm as j}from"../../core/llm/run.js";import{RunError as u}from"../../core/runs/operations.js";import{requireRun as T}from"./router.js";import{readRunEvents as A,registerGrantStream as z,subscribeRunEvents as B}from"../../core/runs/events.js";import{activeGrant as D}from"../../core/grants/mirror.js";import{emitEvent as G}from"../../core/events/emit.js";import{handleVendorSignIn as L,isVendorSignInPath as F}from"./vendor-signin.js";import{listAppProfiles as M}from"./handlers/app-profiles.js";import{handleTransferDownload as Q,handleTransferOperation as V,TRANSFER_OPERATIONS as W}from"./handlers/transfer.js";import{handleQuestionOperation as Y,QUESTION_OPERATIONS as K}from"./handlers/questions.js";const Z={other_app_run:"permission_error",unauthorized:"authentication_error",grant_revoked:"authentication_error",scope_missing:"permission_error",owner_only:"permission_error",invalid_request:"invalid_request_error",not_found:"invalid_request_error",model_unavailable:"invalid_request_error",substitution_refused:"invalid_request_error",payer_not_app:"invalid_request_error",all_routes_exhausted:"rate_limit_error",idempotency_conflict:"invalid_request_error",run_settled:"invalid_request_error",stream_gap:"invalid_request_error",stream_dropped:"server_error",runtime_starting:"server_error",storage_unavailable:"server_error",server_error:"server_error"};function R(e,r,n){return{error:{code:e.code,message:e.message,...e.details===void 0?{}:{details:e.details},type:Z[e.code]??"api_error",...e.param?{param:e.param}:{},origin:"runtime",retryable:e.retryable||e.code==="stream_dropped",request_id:r,...n?{run_id:n}:{},...e.scope?{scope:e.scope}:{},...e.code==="unauthorized"?{user_action:"reconnect"}:{},...e.code==="all_routes_exhausted"?{retry_after_s:e.details.retry_after_s}:{}}}}i(R,"envelope");function ee(e,r,n,s){const l=r instanceof u?r:new u(500,"server_error","runtime request failed");if(r instanceof u||console.error("[app-listener]",r),e.headersSent&&!String(e.getHeader("Content-Type")??"").startsWith("text/event-stream")){e.destroy();return}if(e.headersSent){e.end(`event: error
2
- data: ${JSON.stringify(R(l,n,s))}
1
+ var k=Object.defineProperty;var i=(e,r)=>k(e,"name",{value:r,configurable:!0});import{randomUUID as C}from"node:crypto";import{createServer as x}from"node:http";import{Router as H}from"./router.js";import{OPERATIONS as I}from"./operations.js";import{AppPrincipalResolver as J}from"./principal.js";import{handleRunOperation as $,integer as z}from"./handlers/runs.js";import{parseLlmRequest as D,runLlm as U}from"../../core/llm/run.js";import{RunError as u}from"../../core/runs/operations.js";import{requireRun as T}from"./router.js";import{readRunEvents as A,registerGrantStream as X,subscribeRunEvents as j}from"../../core/runs/events.js";import{activeGrant as B}from"../../core/grants/mirror.js";import{emitEvent as G}from"../../core/events/emit.js";import{handleVendorSignIn as L,isVendorSignInPath as F}from"./vendor-signin.js";import{listAppProfiles as M}from"./handlers/app-profiles.js";import{handleTransferDownload as Q,handleTransferOperation as V,TRANSFER_OPERATIONS as W}from"./handlers/transfer.js";import{handleQuestionOperation as Y,QUESTION_OPERATIONS as K}from"./handlers/questions.js";import{vendorStatus as Z}from"./handlers/vendor-status.js";const ee={other_app_run:"permission_error",unauthorized:"authentication_error",grant_revoked:"authentication_error",scope_missing:"permission_error",owner_only:"permission_error",invalid_request:"invalid_request_error",not_found:"invalid_request_error",model_unavailable:"invalid_request_error",substitution_refused:"invalid_request_error",payer_not_app:"invalid_request_error",all_routes_exhausted:"rate_limit_error",idempotency_conflict:"invalid_request_error",run_settled:"invalid_request_error",stream_gap:"invalid_request_error",stream_dropped:"server_error",runtime_starting:"server_error",storage_unavailable:"server_error",server_error:"server_error"};function R(e,r,a){return{error:{code:e.code,message:e.message,...e.details===void 0?{}:{details:e.details},type:ee[e.code]??"api_error",...e.param?{param:e.param}:{},origin:"runtime",retryable:e.retryable||e.code==="stream_dropped",request_id:r,...a?{run_id:a}:{},...e.scope?{scope:e.scope}:{},...e.code==="unauthorized"?{user_action:"reconnect"}:{},...e.code==="all_routes_exhausted"?{retry_after_s:e.details.retry_after_s}:{}}}}i(R,"envelope");function te(e,r,a,s){const d=r instanceof u?r:new u(500,"server_error","runtime request failed");if(r instanceof u||console.error("[app-listener]",r),e.headersSent&&!String(e.getHeader("Content-Type")??"").startsWith("text/event-stream")){e.destroy();return}if(e.headersSent){e.end(`event: error
2
+ data: ${JSON.stringify(R(d,a,s))}
3
3
 
4
- `);return}e.writeHead(l.status,{"Content-Type":"application/json; charset=utf-8","Request-Id":n,"X-Content-Type-Options":"nosniff",...l.code==="all_routes_exhausted"?{"Retry-After":String(l.details.retry_after_s)}:{}}),e.end(JSON.stringify(R(l,n,s)))}i(ee,"fail");function g(e,r,n){e.writeHead(r,{"Content-Type":"application/json; charset=utf-8"}),e.end(JSON.stringify(n))}i(g,"json");async function q(e){const r=[];let n=0;for await(const s of e){if(n+=s.length,n>4*1024*1024)throw new u(400,"invalid_request","request body too large");r.push(s)}if(n)try{return JSON.parse(Buffer.concat(r).toString("utf8"))}catch{throw new u(400,"invalid_request","invalid JSON body")}}i(q,"bodyOf");function te(e,r){const n=e.headers["last-event-id"]??r.get("after");if(Array.isArray(n))throw new u(400,"invalid_request","invalid cursor","after");return U(n??null,"after",0,Number.MAX_SAFE_INTEGER,0)}i(te,"cursor");function re(e){return`id: ${e.sequence_number}
4
+ `);return}e.writeHead(d.status,{"Content-Type":"application/json; charset=utf-8","Request-Id":a,"X-Content-Type-Options":"nosniff",...d.code==="all_routes_exhausted"?{"Retry-After":String(d.details.retry_after_s)}:{}}),e.end(JSON.stringify(R(d,a,s)))}i(te,"fail");function y(e,r,a){e.writeHead(r,{"Content-Type":"application/json; charset=utf-8"}),e.end(JSON.stringify(a))}i(y,"json");async function N(e){const r=[];let a=0;for await(const s of e){if(a+=s.length,a>4*1024*1024)throw new u(400,"invalid_request","request body too large");r.push(s)}if(a)try{return JSON.parse(Buffer.concat(r).toString("utf8"))}catch{throw new u(400,"invalid_request","invalid JSON body")}}i(N,"bodyOf");function re(e,r){const a=e.headers["last-event-id"]??r.get("after");if(Array.isArray(a))throw new u(400,"invalid_request","invalid cursor","after");return z(a??null,"after",0,Number.MAX_SAFE_INTEGER,0)}i(re,"cursor");function ne(e){return`id: ${e.sequence_number}
5
5
  event: ${e.type}
6
6
  data: ${JSON.stringify(e)}
7
7
 
8
- `}i(re,"frame");function ne(e,r,n,s,l,b,m){T(s,n);let p=A(n,l);if(l>p.latest_sequence)throw new u(400,"invalid_request","cursor is beyond the run","after");if(l<p.latest_sequence&&(p.earliest_sequence===null||l<p.earliest_sequence-1))throw new u(409,"stream_gap","events have expired",void 0,{earliest_sequence:p.earliest_sequence,latest_sequence:p.latest_sequence});if(r.destroyed||e.destroyed)return r.destroy(),Promise.resolve();r.writeHead(200,{"Content-Type":m==="sse"?"text/event-stream":"application/x-ndjson","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),m==="sse"?r.write(`: connected
8
+ `}i(ne,"frame");function ae(e,r,a,s,d,b,m){T(s,a);let p=A(a,d);if(d>p.latest_sequence)throw new u(400,"invalid_request","cursor is beyond the run","after");if(d<p.latest_sequence&&(p.earliest_sequence===null||d<p.earliest_sequence-1))throw new u(409,"stream_gap","events have expired",void 0,{earliest_sequence:p.earliest_sequence,latest_sequence:p.latest_sequence});if(r.destroyed||e.destroyed)return r.destroy(),Promise.resolve();r.writeHead(200,{"Content-Type":m==="sse"?"text/event-stream":"application/x-ndjson","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),m==="sse"?r.write(`: connected
9
9
 
10
- `):r.flushHeaders();let a=l,t=!1,f=!1,_=!1,d;const v=new Promise(h=>{d=h}),o=i(()=>{t||(t=!0,clearInterval(P),N(),E(),r.off("close",o),r.off("drain",w),r.end(),d())},"end"),w=i(()=>{_=!1,c()},"onDrain"),y=i(h=>{t||r.write(m==="sse"?`event: error
11
- data: ${JSON.stringify(R(h,b,n))}
10
+ `):r.flushHeaders();let n=d,t=!1,f=!1,_=!1,l;const v=new Promise(h=>{l=h}),o=i(()=>{t||(t=!0,clearInterval(P),q(),E(),r.off("close",o),r.off("drain",w),r.end(),l())},"end"),w=i(()=>{_=!1,c()},"onDrain"),g=i(h=>{t||r.write(m==="sse"?`event: error
11
+ data: ${JSON.stringify(R(h,b,a))}
12
12
 
13
- `:`${JSON.stringify({type:"error",...R(h,b,n)})}
14
- `),o()},"error"),c=i(()=>{if(!(t||f)){f=!0;try{if(!O()){S();return}if(T(s,n),p=A(n,a),p.backlog_count>1e3||p.backlog_bytes>32*1024*1024){y(new u(503,"stream_dropped","stream reader fell behind",void 0,{last_sequence:a}));return}for(const h of p.events){if(_)break;_=!r.write(m==="sse"?re(h):`${JSON.stringify(h)}
15
- `),a=h.sequence_number}}catch(h){y(h instanceof u?h:new u(500,"server_error","stream failed"))}finally{f=!1}}},"flush"),S=i(()=>y(new u(401,"grant_revoked","grant is not active")),"revoked"),O=i(()=>"class"in s||D(s.grant)!==null,"grantActive"),N=B(n,c),E="class"in s?()=>{}:z(s.grant,S),P=setInterval(()=>{!t&&!_&&m==="sse"&&r.write(`: keepalive
13
+ `:`${JSON.stringify({type:"error",...R(h,b,a)})}
14
+ `),o()},"error"),c=i(()=>{if(!(t||f)){f=!0;try{if(!O()){S();return}if(T(s,a),p=A(a,n),p.backlog_count>1e3||p.backlog_bytes>32*1024*1024){g(new u(503,"stream_dropped","stream reader fell behind",void 0,{last_sequence:n}));return}for(const h of p.events){if(_)break;_=!r.write(m==="sse"?ne(h):`${JSON.stringify(h)}
15
+ `),n=h.sequence_number}}catch(h){g(h instanceof u?h:new u(500,"server_error","stream failed"))}finally{f=!1}}},"flush"),S=i(()=>g(new u(401,"grant_revoked","grant is not active")),"revoked"),O=i(()=>"class"in s||B(s.grant)!==null,"grantActive"),q=j(a,c),E="class"in s?()=>{}:X(s.grant,S),P=setInterval(()=>{!t&&!_&&m==="sse"&&r.write(`: keepalive
16
16
 
17
- `)},15e3);return r.on("drain",w),r.on("close",o),c(),v}i(ne,"streamRunEvents");function be(e,r,n){if(!e.issuer||!e.audience||!e.listener?.address||!Number.isInteger(e.listener.port)||e.listener.port<1||e.listener.port>65535)throw new Error("runtime issuer, audience and listener address/port are required");if(["0.0.0.0","::","[::]"].includes(e.listener.address))throw new Error("runtime listener must bind a specific address");const s=new J(e.issuer,e.audience,n,e.jwksUrl),l=new H,b=new Map;for(const a of I.filter(t=>t.stage!==void 0)){const t=i(()=>({status:500}),"handler");l.register({method:a.method,pattern:a.path,handler:t}),b.set(t,a)}const m=x((a,t)=>{(async()=>{const f=C();t.setHeader("Request-Id",f);let _;try{const d=new URL(a.url??"/","http://runtime.local");if(F(d.pathname)){await L(a,t,d,s);return}if((a.method!=="GET"||d.pathname!=="/v1/health")&&(!s.isReady()||!r()))throw new u(503,"runtime_starting","runtime_starting");const v=l.match(a.method??"GET",d.pathname);if(!v)throw new u(404,"not_found","unknown operation");const o=b.get(v.handler);if(!o)throw new u(404,"not_found","unknown operation");if(_=v.params.run_id,o.name==="health"){g(t,200,{status:"ok",api_version:"2026-09-23"});return}if(o.name==="runtime.sync-notice"){if(!await s.verifySyncNotice(a.headers.authorization)){t.writeHead(204),t.end();return}G({level:"info",event:"daemon.grants.sync_notice",fields:{request_id:f}});try{await n({fresh:!0})}catch{throw new u(503,"server_error","grant sync failed")}t.writeHead(204),t.end();return}const w=await s.resolve(a.headers.authorization,o.scope);if(t.setHeader("Request-Id",f),_&&T(w,_,["run.message","run.interrupt","run.cancel","run.rename","run.delete"].includes(o.name),o.name==="run.delete"),o.stream==="bytes"){await Q(a,t,w,d.searchParams);return}if(o.stream){ne(a,t,_,w,te(a,d.searchParams),f,"sse");return}if(o.name==="llm"){const c=X(await q(a)),S=new AbortController,O=i(()=>S.abort(),"abort");t.on("close",O);try{const N=await j(c,S.signal,c.stream?E=>{t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),t.write(`data: ${JSON.stringify(E)}
17
+ `)},15e3);return r.on("drain",w),r.on("close",o),c(),v}i(ae,"streamRunEvents");function Oe(e,r,a){if(!e.issuer||!e.audience||!e.listener?.address||!Number.isInteger(e.listener.port)||e.listener.port<1||e.listener.port>65535)throw new Error("runtime issuer, audience and listener address/port are required");if(["0.0.0.0","::","[::]"].includes(e.listener.address))throw new Error("runtime listener must bind a specific address");const s=new J(e.issuer,e.audience,a,e.jwksUrl),d=new H,b=new Map;for(const n of I.filter(t=>t.stage!==void 0)){const t=i(()=>({status:500}),"handler");d.register({method:n.method,pattern:n.path,handler:t}),b.set(t,n)}const m=x((n,t)=>{(async()=>{const f=C();t.setHeader("Request-Id",f);let _;try{const l=new URL(n.url??"/","http://runtime.local");if(F(l.pathname)){await L(n,t,l,s);return}if((n.method!=="GET"||l.pathname!=="/v1/health")&&(!s.isReady()||!r()))throw new u(503,"runtime_starting","runtime_starting");const v=d.match(n.method??"GET",l.pathname);if(!v)throw new u(404,"not_found","unknown operation");const o=b.get(v.handler);if(!o)throw new u(404,"not_found","unknown operation");if(_=v.params.run_id,o.name==="health"){y(t,200,{status:"ok",api_version:"2026-09-23"});return}if(o.name==="runtime.sync-notice"){if(!await s.verifySyncNotice(n.headers.authorization)){t.writeHead(204),t.end();return}G({level:"info",event:"daemon.grants.sync_notice",fields:{request_id:f}});try{await a({fresh:!0})}catch{throw new u(503,"server_error","grant sync failed")}t.writeHead(204),t.end();return}if(o.name==="runtime.vendor-status"){await s.verifyDirectoryRead(n.headers.authorization,"vendor_status"),y(t,200,Z());return}const w=await s.resolve(n.headers.authorization,o.scope);if(t.setHeader("Request-Id",f),_&&T(w,_,["run.message","run.interrupt","run.cancel","run.rename","run.delete"].includes(o.name),o.name==="run.delete"),o.stream==="bytes"){await Q(n,t,w,l.searchParams);return}if(o.stream){ae(n,t,_,w,re(n,l.searchParams),f,"sse");return}if(o.name==="llm"){const c=D(await N(n)),S=new AbortController,O=i(()=>S.abort(),"abort");t.on("close",O);try{const q=await U(c,S.signal,c.stream?E=>{t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),t.write(`data: ${JSON.stringify(E)}
18
18
 
19
19
  `)}:void 0);c.stream?(t.headersSent||t.writeHead(200,{"Content-Type":"text/event-stream","Cache-Control":"no-cache","X-Accel-Buffering":"no"}),t.end(`data: [DONE]
20
20
 
21
- `)):g(t,200,N.completion)}finally{t.off("close",O)}return}if(o.name==="profile.list"){g(t,200,M(w));return}if(K.has(o.name)){const c=await Y(o.name,w,v.params.question_id,o.method==="POST"?await q(a):void 0);g(t,c.status,c.body);return}if(W.has(o.name)){const c=await V(o,w,v.params,d.searchParams,await q(a));g(t,c.status,c.body);return}const y=await $(o,w,_,d.searchParams,await q(a),a.headers["idempotency-key"]);g(t,y.status,y.body)}catch(d){ee(t,d,f,_)}})()});return{ready:new Promise((a,t)=>{m.once("error",t),m.listen(e.listener.port,e.listener.address,()=>{m.off("error",t),a()})}),close:i(async()=>{s.close(),m.closeAllConnections(),await new Promise((a,t)=>m.close(f=>f?t(f):a()))},"close")}}i(be,"createAppListener");export{be as createAppListener,te as cursor,ne as streamRunEvents};
21
+ `)):y(t,200,q.completion)}finally{t.off("close",O)}return}if(o.name==="profile.list"){y(t,200,M(w));return}if(K.has(o.name)){const c=await Y(o.name,w,v.params.question_id,o.method==="POST"?await N(n):void 0);y(t,c.status,c.body);return}if(W.has(o.name)){const c=await V(o,w,v.params,l.searchParams,await N(n));y(t,c.status,c.body);return}const g=await $(o,w,_,l.searchParams,await N(n),n.headers["idempotency-key"]);y(t,g.status,g.body)}catch(l){te(t,l,f,_)}})()});return{ready:new Promise((n,t)=>{m.once("error",t),m.listen(e.listener.port,e.listener.address,()=>{m.off("error",t),n()})}),close:i(async()=>{s.close(),m.closeAllConnections(),await new Promise((n,t)=>m.close(f=>f?t(f):n()))},"close")}}i(Oe,"createAppListener");export{Oe as createAppListener,re as cursor,ae as streamRunEvents};
@@ -1,2 +1,5 @@
1
+ import type { ModelAuthProviderStatusDTO } from '../../../api/index.js';
2
+ import { type ManagedProviderId } from '../../../core/subscription-state.js';
1
3
  import type { RouteTable } from '../router.js';
4
+ export declare function managedStatus(provider: ManagedProviderId): ModelAuthProviderStatusDTO;
2
5
  export declare const modelAuthRoutes: RouteTable;
@@ -1 +1 @@
1
- var P=Object.defineProperty;var r=(n,e)=>P(n,"name",{value:e,configurable:!0});import{join as j}from"node:path";import{deleteAuthCredential as k,readAuthCredentials as M,setAuthCredential as A}from"../../../core/auth-file.js";import{PoolCredentialStore as $}from"../../../core/pool-credential-store.js";import{secretsDir as L}from"../../../core/layout.js";import{ApiError as d}from"../../../api/index.js";import{RunError as q}from"../../../core/runs/operations.js";import{usage as h}from"../../../core/errors.js";import{resolveLaunchTarget as N}from"../../../core/runtime/launch-target.js";import{ANTHROPIC_PROVIDER_ID as O,OPENAI_CODEX_PROVIDER_ID as S,commitManagedLogin as R,readSubscriptionPool as b,removeAllManagedAccounts as T}from"../../../core/subscription-state.js";import{cancelModelAuthFlow as C,completeModelAuthFlow as x,startModelAuthFlow as G,waitModelAuthFlow as U}from"../../../core/model-auth/flows.js";function c(){return j(L(),"auth.json")}r(c,"authPath");function p(n){return n===O||n===S}r(p,"isManagedProvider");function I(n,e){if(typeof e!="string"||e==="")throw new d(400,"invalid_request",`oauth credential requires \`${n}\``);const t=Date.parse(e);if(Number.isNaN(t))throw new d(400,"invalid_request",`\`${n}\` is not a valid ISO timestamp`);return t}r(I,"parseExpiry");function w(n,e,t){if(typeof t!="string"||t==="")throw new d(400,"invalid_request",`${n} credential requires \`${e}\``);return t}r(w,"requireField");function V(n){return{label:n.label,expires_at:new Date(n.expires).toISOString(),rate_limited_until:new Date(n.rateLimitedUntil).toISOString(),...n.authFailure?{auth_failure:n.authFailure}:{},...n.accountId?{account_id:n.accountId}:{}}}r(V,"toManagedAccountStatus");function D(n){const e=b(n).map(V);return{provider:n,managed:!0,configured:e.length>0,accounts:e}}r(D,"managedStatus");function _(n,e){const t=n.query.getAll(e);if(t.length>1)throw h(`${e} must appear at most once`);return t[0]}r(_,"singleQueryValue");function B(n){const e=n.indexOf("/"),t=e>0?n.slice(0,e):"";if(t==="")throw new d(422,"unresolved_model","the selected launch has no concrete model provider");return t}r(B,"providerFromModel");async function H(){const n=await M(c()),e=[D(O),D(S)];for(const[t,o]of Object.entries(n))p(t)||o.type!=="api_key"&&o.type!=="oauth"||e.push({provider:t,managed:!1,configured:!0,kind:o.type});return{status:200,body:{providers:e}}}r(H,"handleList");async function J(n){for(const[l]of n.query)if(l!=="profile"&&l!=="cwd"&&l!=="kind"&&l!=="model")throw h(`unknown model-auth readiness query parameter: ${l}`);const e=_(n,"profile"),t=_(n,"cwd"),o=_(n,"kind"),a=_(n,"model");if(o!==void 0&&o.trim()==="")throw h("kind must be a non-empty string when provided");if(a!==void 0&&a.trim()==="")throw h("model must be a non-empty string when provided");const u=await N({root:!0,...e!==void 0?{profile:e}:{},...t!==void 0?{cwd:t}:{},...o!==void 0?{kind:o}:{},...a!==void 0?{model:a}:{}},{readOnlyProfileSelection:!0});if(u.launch.model===void 0)throw new d(422,"unresolved_model","the selected launch has no concrete model");const i=B(u.launch.model);if(p(i)){const l=b(i);if(l.length>0){const m=l.filter(f=>f.authFailure===void 0);if(m.length===0)return{status:200,body:{provider:i,model:u.launch.model,credential:"unusable",reason:"invalid_grant"}};const g=Date.now(),F=m.some(f=>f.rateLimitedUntil<=g),v=Math.min(...m.map(f=>f.rateLimitedUntil));return{status:200,body:{provider:i,model:u.launch.model,credential:"ready",...!F&&v>g?{rate_limited_until:new Date(v).toISOString()}:{}}}}}const s=await new $(c()).read(i),y=s?.type==="oauth"||s?.type==="api_key"&&!!s.key;return{status:200,body:{provider:i,model:u.launch.model,credential:y?"ready":"missing"}}}r(J,"handleReadiness");async function K(n){const e=n.params.provider,t=n.body;if(t===void 0||typeof t!="object"||typeof t.kind!="string")throw new d(400,"invalid_request","a credential `kind` is required");switch(t.kind){case"api_key":{const o=w("api_key","api_key",t.api_key);return await A(e,{type:"api_key",key:o},c()),{status:200,body:{provider:e,installed:!0,managed:!1}}}case"oauth":{if(p(e))throw new d(422,"unprocessable",`provider ${e} stores oauth credentials as managed accounts \u2014 use kind \`managed_account\``);const o=w("oauth","access_token",t.access_token),a=w("oauth","refresh_token",t.refresh_token),u=I("expires_at",t.expires_at),i=t.extra??{};await A(e,{type:"oauth",...i,access:o,refresh:a,expires:u},c());const s={provider:e,installed:!0,managed:!1};return typeof t.account_id=="string"&&t.account_id!==""&&(s.account_id=t.account_id),{status:200,body:s}}case"managed_account":{if(!p(e))throw new d(422,"unprocessable",`provider ${e} does not support managed accounts`);const o=typeof t.label=="string"&&t.label.trim()?t.label.trim():void 0;if(!o&&t.auto_label!==!0)throw new d(400,"invalid_request","managed_account credential requires `label` or `auto_label`");const a=typeof t.account_id=="string"&&t.account_id!==""?t.account_id:void 0,u=w("managed_account","access_token",t.access_token),i=w("managed_account","refresh_token",t.refresh_token),s=I("expires_at",t.expires_at),y=typeof t.last_rate_limited_at=="number"?t.last_rate_limited_at:Math.max(0,...b(e).map(m=>m.lastRateLimitedAt));await R(e,o,{refresh:i,access:u,expires:s,...a?{accountId:a}:{},lastRateLimitedAt:y,autoLabel:t.auto_label===!0});const l={provider:e,installed:!0,managed:!0};return a&&(l.account_id=a),{status:200,body:l}}default:throw new d(400,"invalid_request",`unknown credential kind: ${String(t.kind)}`)}}r(K,"handleInstall");async function Q(n){const e=n.params.provider;if(p(e)){const o=await T(e),a=await k(e,c());return{status:200,body:{provider:e,removed_accounts:o+(a?1:0)}}}const t=await k(e,c())?1:0;return{status:200,body:{provider:e,removed_accounts:t}}}r(Q,"handleDelete");function E(n){const e=n.body;if(e===void 0)return{};if(typeof e!="object"||e===null||Array.isArray(e))throw new d(400,"invalid_request","request body must be a JSON object");return e}r(E,"bodyObject");async function X(n){const e=E(n);return{status:200,body:await G({provider:e.provider,...e.redirect!==void 0?{redirect:e.redirect}:{},...e.label!==void 0?{label:e.label}:{}})}}r(X,"handleFlowStart");async function z(n){const e=E(n);return{status:200,body:await x(n.params.flow_id,e.input)}}r(z,"handleFlowComplete");async function W(n){const e=C(n.params.flow_id);if(!e)throw new q(400,"invalid_request","no sign-in has this flow_id","flow_id");const{jti:t,...o}=e;return{status:200,body:o}}r(W,"handleFlowCancel");async function Y(n){for(const[s]of n.query)if(s!=="wait")throw h(`unknown model-auth flow query parameter: ${s}`);const e=_(n,"wait");let t=0;if(e!==void 0&&(t=/^\d+$/.test(e)?Number(e):NaN,!Number.isInteger(t)||t<1||t>25))throw new d(400,"invalid_request","wait must be an integer from 1 to 25");const o=new AbortController;n.res.once("close",()=>o.abort());const a=await U(n.params.flow_id,t*1e3,o.signal);if(!a)throw new q(404,"not_found","no sign-in has this flow_id","flow_id");const{jti:u,...i}=a;return{status:200,body:i}}r(Y,"handleFlowGet");const ue=[{method:"POST",pattern:"/v1/model-auth/flows",ownerOnly:!0,handler:X},{method:"POST",pattern:"/v1/model-auth/flows/:flow_id/complete",ownerOnly:!0,handler:z},{method:"POST",pattern:"/v1/model-auth/flows/:flow_id/cancel",ownerOnly:!0,handler:W},{method:"GET",pattern:"/v1/model-auth/flows/:flow_id",ownerOnly:!0,handler:Y},{method:"GET",pattern:"/v1/model-auth",handler:H},{method:"GET",pattern:"/v1/model-auth/readiness",handler:J},{method:"PUT",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:K},{method:"DELETE",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:Q}];export{ue as modelAuthRoutes};
1
+ var P=Object.defineProperty;var r=(n,e)=>P(n,"name",{value:e,configurable:!0});import{join as j}from"node:path";import{deleteAuthCredential as k,readAuthCredentials as M,setAuthCredential as A}from"../../../core/auth-file.js";import{PoolCredentialStore as $}from"../../../core/pool-credential-store.js";import{secretsDir as L}from"../../../core/layout.js";import{ApiError as d}from"../../../api/index.js";import{RunError as q}from"../../../core/runs/operations.js";import{usage as h}from"../../../core/errors.js";import{resolveLaunchTarget as N}from"../../../core/runtime/launch-target.js";import{ANTHROPIC_PROVIDER_ID as O,OPENAI_CODEX_PROVIDER_ID as S,commitManagedLogin as R,readSubscriptionPool as b,removeAllManagedAccounts as T}from"../../../core/subscription-state.js";import{cancelModelAuthFlow as C,completeModelAuthFlow as x,startModelAuthFlow as G,waitModelAuthFlow as U}from"../../../core/model-auth/flows.js";function c(){return j(L(),"auth.json")}r(c,"authPath");function p(n){return n===O||n===S}r(p,"isManagedProvider");function I(n,e){if(typeof e!="string"||e==="")throw new d(400,"invalid_request",`oauth credential requires \`${n}\``);const t=Date.parse(e);if(Number.isNaN(t))throw new d(400,"invalid_request",`\`${n}\` is not a valid ISO timestamp`);return t}r(I,"parseExpiry");function w(n,e,t){if(typeof t!="string"||t==="")throw new d(400,"invalid_request",`${n} credential requires \`${e}\``);return t}r(w,"requireField");function V(n){return{label:n.label,expires_at:new Date(n.expires).toISOString(),rate_limited_until:new Date(n.rateLimitedUntil).toISOString(),...n.authFailure?{auth_failure:n.authFailure}:{},...n.accountId?{account_id:n.accountId}:{}}}r(V,"toManagedAccountStatus");function D(n){const e=b(n).map(V);return{provider:n,managed:!0,configured:e.length>0,accounts:e}}r(D,"managedStatus");function _(n,e){const t=n.query.getAll(e);if(t.length>1)throw h(`${e} must appear at most once`);return t[0]}r(_,"singleQueryValue");function B(n){const e=n.indexOf("/"),t=e>0?n.slice(0,e):"";if(t==="")throw new d(422,"unresolved_model","the selected launch has no concrete model provider");return t}r(B,"providerFromModel");async function H(){const n=await M(c()),e=[D(O),D(S)];for(const[t,o]of Object.entries(n))p(t)||o.type!=="api_key"&&o.type!=="oauth"||e.push({provider:t,managed:!1,configured:!0,kind:o.type});return{status:200,body:{providers:e}}}r(H,"handleList");async function J(n){for(const[l]of n.query)if(l!=="profile"&&l!=="cwd"&&l!=="kind"&&l!=="model")throw h(`unknown model-auth readiness query parameter: ${l}`);const e=_(n,"profile"),t=_(n,"cwd"),o=_(n,"kind"),a=_(n,"model");if(o!==void 0&&o.trim()==="")throw h("kind must be a non-empty string when provided");if(a!==void 0&&a.trim()==="")throw h("model must be a non-empty string when provided");const u=await N({root:!0,...e!==void 0?{profile:e}:{},...t!==void 0?{cwd:t}:{},...o!==void 0?{kind:o}:{},...a!==void 0?{model:a}:{}},{readOnlyProfileSelection:!0});if(u.launch.model===void 0)throw new d(422,"unresolved_model","the selected launch has no concrete model");const i=B(u.launch.model);if(p(i)){const l=b(i);if(l.length>0){const m=l.filter(f=>f.authFailure===void 0);if(m.length===0)return{status:200,body:{provider:i,model:u.launch.model,credential:"unusable",reason:"invalid_grant"}};const g=Date.now(),F=m.some(f=>f.rateLimitedUntil<=g),v=Math.min(...m.map(f=>f.rateLimitedUntil));return{status:200,body:{provider:i,model:u.launch.model,credential:"ready",...!F&&v>g?{rate_limited_until:new Date(v).toISOString()}:{}}}}}const s=await new $(c()).read(i),y=s?.type==="oauth"||s?.type==="api_key"&&!!s.key;return{status:200,body:{provider:i,model:u.launch.model,credential:y?"ready":"missing"}}}r(J,"handleReadiness");async function K(n){const e=n.params.provider,t=n.body;if(t===void 0||typeof t!="object"||typeof t.kind!="string")throw new d(400,"invalid_request","a credential `kind` is required");switch(t.kind){case"api_key":{const o=w("api_key","api_key",t.api_key);return await A(e,{type:"api_key",key:o},c()),{status:200,body:{provider:e,installed:!0,managed:!1}}}case"oauth":{if(p(e))throw new d(422,"unprocessable",`provider ${e} stores oauth credentials as managed accounts \u2014 use kind \`managed_account\``);const o=w("oauth","access_token",t.access_token),a=w("oauth","refresh_token",t.refresh_token),u=I("expires_at",t.expires_at),i=t.extra??{};await A(e,{type:"oauth",...i,access:o,refresh:a,expires:u},c());const s={provider:e,installed:!0,managed:!1};return typeof t.account_id=="string"&&t.account_id!==""&&(s.account_id=t.account_id),{status:200,body:s}}case"managed_account":{if(!p(e))throw new d(422,"unprocessable",`provider ${e} does not support managed accounts`);const o=typeof t.label=="string"&&t.label.trim()?t.label.trim():void 0;if(!o&&t.auto_label!==!0)throw new d(400,"invalid_request","managed_account credential requires `label` or `auto_label`");const a=typeof t.account_id=="string"&&t.account_id!==""?t.account_id:void 0,u=w("managed_account","access_token",t.access_token),i=w("managed_account","refresh_token",t.refresh_token),s=I("expires_at",t.expires_at),y=typeof t.last_rate_limited_at=="number"?t.last_rate_limited_at:Math.max(0,...b(e).map(m=>m.lastRateLimitedAt));await R(e,o,{refresh:i,access:u,expires:s,...a?{accountId:a}:{},lastRateLimitedAt:y,autoLabel:t.auto_label===!0});const l={provider:e,installed:!0,managed:!0};return a&&(l.account_id=a),{status:200,body:l}}default:throw new d(400,"invalid_request",`unknown credential kind: ${String(t.kind)}`)}}r(K,"handleInstall");async function Q(n){const e=n.params.provider;if(p(e)){const o=await T(e),a=await k(e,c());return{status:200,body:{provider:e,removed_accounts:o+(a?1:0)}}}const t=await k(e,c())?1:0;return{status:200,body:{provider:e,removed_accounts:t}}}r(Q,"handleDelete");function E(n){const e=n.body;if(e===void 0)return{};if(typeof e!="object"||e===null||Array.isArray(e))throw new d(400,"invalid_request","request body must be a JSON object");return e}r(E,"bodyObject");async function X(n){const e=E(n);return{status:200,body:await G({provider:e.provider,...e.redirect!==void 0?{redirect:e.redirect}:{},...e.label!==void 0?{label:e.label}:{}})}}r(X,"handleFlowStart");async function z(n){const e=E(n);return{status:200,body:await x(n.params.flow_id,e.input)}}r(z,"handleFlowComplete");async function W(n){const e=C(n.params.flow_id);if(!e)throw new q(400,"invalid_request","no sign-in has this flow_id","flow_id");const{jti:t,...o}=e;return{status:200,body:o}}r(W,"handleFlowCancel");async function Y(n){for(const[s]of n.query)if(s!=="wait")throw h(`unknown model-auth flow query parameter: ${s}`);const e=_(n,"wait");let t=0;if(e!==void 0&&(t=/^\d+$/.test(e)?Number(e):NaN,!Number.isInteger(t)||t<1||t>25))throw new d(400,"invalid_request","wait must be an integer from 1 to 25");const o=new AbortController;n.res.once("close",()=>o.abort());const a=await U(n.params.flow_id,t*1e3,o.signal);if(!a)throw new q(404,"not_found","no sign-in has this flow_id","flow_id");const{jti:u,...i}=a;return{status:200,body:i}}r(Y,"handleFlowGet");const ue=[{method:"POST",pattern:"/v1/model-auth/flows",ownerOnly:!0,handler:X},{method:"POST",pattern:"/v1/model-auth/flows/:flow_id/complete",ownerOnly:!0,handler:z},{method:"POST",pattern:"/v1/model-auth/flows/:flow_id/cancel",ownerOnly:!0,handler:W},{method:"GET",pattern:"/v1/model-auth/flows/:flow_id",ownerOnly:!0,handler:Y},{method:"GET",pattern:"/v1/model-auth",handler:H},{method:"GET",pattern:"/v1/model-auth/readiness",handler:J},{method:"PUT",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:K},{method:"DELETE",pattern:"/v1/model-auth/:provider",ownerOnly:!0,handler:Q}];export{D as managedStatus,ue as modelAuthRoutes};
@@ -0,0 +1,8 @@
1
+ export type VendorState = 'connected' | 'needs_reconnecting' | 'not_set_up';
2
+ export interface VendorStatusAnswer {
3
+ vendors: {
4
+ anthropic: VendorState;
5
+ openai: VendorState;
6
+ };
7
+ }
8
+ export declare function vendorStatus(): VendorStatusAnswer;
@@ -0,0 +1 @@
1
+ var u=Object.defineProperty;var e=(t,n)=>u(t,"name",{value:n,configurable:!0});import{ANTHROPIC_PROVIDER_ID as c,OPENAI_CODEX_PROVIDER_ID as s}from"../../../core/subscription-state.js";import{managedStatus as i}from"./modelauth.js";function r(t){const n=i(t),o=n.managed?n.accounts:[];return o.length===0?"not_set_up":o.some(a=>a.auth_failure===void 0)?"connected":"needs_reconnecting"}e(r,"stateOf");function m(){return{vendors:{anthropic:r(c),openai:r(s)}}}e(m,"vendorStatus");export{m as vendorStatus};
@@ -1 +1 @@
1
- var a=Object.defineProperty;var r=(e,s)=>a(e,"name",{value:s,configurable:!0});const n=[{name:"health",method:"GET",path:"/v1/health",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"chat-inventory.get.1",method:"GET",path:"/v1/nodes/:id/chat-inventory",classes:["person","broker"],resource:"node-read"},{name:"model-config.put.2",method:"PUT",path:"/v1/model-config",classes:["person"],resource:"none"},{name:"files.get.3",method:"GET",path:"/v1/files/peek",classes:["person","broker"],resource:"none"},{name:"files.post.4",method:"POST",path:"/v1/files/write",classes:["person","broker"],resource:"none"},{name:"files.get.5",method:"GET",path:"/v1/files/list",classes:["person","broker"],resource:"none"},{name:"reviews.post.6",method:"POST",path:"/v1/human/reviews",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"reviews.get.7",method:"GET",path:"/v1/human/reviews",classes:["person","broker"],resource:"human"},{name:"reviews.get.8",method:"GET",path:"/v1/human/reviews/:review_id",classes:["person","broker"],resource:"human"},{name:"reviews.post.9",method:"POST",path:"/v1/human/reviews/:review_id/submit",classes:["person","broker"],resource:"human"},{name:"reviews.post.10",method:"POST",path:"/v1/human/reviews/:review_id/cancel",classes:["person","broker"],resource:"human"},{name:"reviews.get.11",method:"GET",path:"/v1/human/reviews/:review_id/document",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.12",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.13",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"node.log.append",method:"POST",path:"/v1/nodes/:id/records/log",classes:["person","broker"],resource:"node-own"},{name:"node.telemetry.put",method:"PUT",path:"/v1/nodes/:id/records/telemetry",classes:["person","broker"],resource:"node-own"},{name:"node.recap.put",method:"PUT",path:"/v1/nodes/:id/records/recap",classes:["person","broker"],resource:"node-own"},{name:"node.inbox.read",method:"GET",path:"/v1/nodes/:id/records/inbox",classes:["person","broker"],resource:"node-own"},{name:"node.passive.read",method:"GET",path:"/v1/nodes/:id/records/passive",classes:["person","broker"],resource:"node-own"},{name:"node.pushed-final",method:"POST",path:"/v1/nodes/:id/records/pushed-final",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.14",method:"POST",path:"/v1/nodes/:id/broker/session-bound",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.15",method:"POST",path:"/v1/nodes/:id/broker/settle",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.16",method:"POST",path:"/v1/nodes/:id/broker/park-complete",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.17",method:"POST",path:"/v1/nodes/:id/broker/park-activity",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.18",method:"POST",path:"/v1/nodes/:id/broker/telemetry",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.19",method:"POST",path:"/v1/nodes/:id/broker/model",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.get.20",method:"GET",path:"/v1/nodes/:id/broker/extension-state",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.context",method:"POST",path:"/v1/nodes/:id/broker/context",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.memory-refs",method:"POST",path:"/v1/nodes/:id/broker/memory-refs",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.context-commit",method:"POST",path:"/v1/nodes/:id/broker/context/commit",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.context-event",method:"POST",path:"/v1/nodes/:id/broker/context/event",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.21",method:"POST",path:"/v1/nodes/:id/broker/generated-name",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.22",method:"POST",path:"/v1/nodes/:id/broker/persona-ack",classes:["person","broker"],resource:"node-own"},{name:"memory.get.23",method:"GET",path:"/v1/memory/docs",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.24",method:"GET",path:"/v1/memory/docs/:name",classes:["person","app","broker"],resource:"memory"},{name:"memory.post.25",method:"POST",path:"/v1/memory/docs",classes:["person","app","broker"],resource:"memory"},{name:"memory.patch.26",method:"PATCH",path:"/v1/memory/docs/:name",classes:["person","app","broker"],resource:"memory"},{name:"memory.delete.27",method:"DELETE",path:"/v1/memory/docs/:name",classes:["person","app","broker"],resource:"memory"},{name:"memory.post.28",method:"POST",path:"/v1/memory/docs/:name/move",classes:["person","app","broker"],resource:"memory"},{name:"memory.post.29",method:"POST",path:"/v1/memory/search",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.30",method:"GET",path:"/v1/memory/docs/:name/history",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.31",method:"GET",path:"/v1/memory/resolve",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.32",method:"GET",path:"/v1/memory/origin",classes:["person","app","broker"],resource:"memory"},{name:"memory.lint",method:"POST",path:"/v1/memory/lint",classes:["person","app","broker"],resource:"memory"},{name:"memory.extensions",method:"GET",path:"/v1/memory/extensions",classes:["person","broker"],resource:"memory"},{name:"memory.slash.list",method:"GET",path:"/v1/memory/slash",classes:["person","broker"],resource:"memory"},{name:"memory.slash.attachments",method:"POST",path:"/v1/memory/slash/attachments",classes:["person","broker"],resource:"memory"},{name:"health.get.33",method:"GET",path:"/healthz",classes:["anonymous"],resource:"none"},{name:"health.get.34",method:"GET",path:"/v1/status",classes:["person"],resource:"none"},{name:"bash-jobs.start",method:"POST",path:"/v1/nodes/:id/jobs/start",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"hooks.plan",method:"GET",path:"/v1/nodes/:id/hooks/plan",classes:["broker"],resource:"node-own"},{name:"hooks.exec",method:"POST",path:"/v1/nodes/:id/hooks/exec",classes:["broker"],resource:"node-own"},{name:"hooks.exec.person",method:"POST",path:"/v1/hooks/exec",classes:["person"],resource:"none"},{name:"bash-jobs.get.35",method:"GET",path:"/v1/nodes/:id/jobs",classes:["person","broker"],resource:"node-read"},{name:"bash-jobs.delete.36",method:"DELETE",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"prospective-chat-inventory.get.37",method:"GET",path:"/v1/prospective-chat-inventory",classes:["person"],resource:"none"},{name:"node-events.get.38",method:"GET",path:"/v1/nodes/:id/events",classes:["person","broker"],resource:"node-read"},{name:"bash.post.39",method:"POST",path:"/v1/bash",classes:["person","broker"],resource:"daemon-bash",scope:"crtr:act"},{name:"subscriptions.post.40",method:"POST",path:"/v1/nodes/:id/subscriptions",classes:["person","broker"],resource:"node-write"},{name:"subscriptions.delete.41",method:"DELETE",path:"/v1/nodes/:id/subscriptions/:target",classes:["person","broker"],resource:"node-write"},{name:"attach.post.42",method:"POST",path:"/v1/nodes/:id/attach",classes:["person"],resource:"none"},{name:"review-comments.post.44",method:"POST",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.45",method:"GET",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.post.46",method:"POST",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.47",method:"GET",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.48",method:"GET",path:"/v1/human/reviews/:review_id/comment-events",classes:["person","broker"],resource:"human"},{name:"review-comments.post.49",method:"POST",path:"/v1/human/reviews/:review_id/comment-ranges",classes:["person","broker"],resource:"human"},{name:"review-comments.get.50",method:"GET",path:"/v1/human/comments/:comment_id",classes:["person","broker"],resource:"human"},{name:"review-comments.post.51",method:"POST",path:"/v1/human/comments/:comment_id/edit",classes:["person","broker"],resource:"human"},{name:"review-comments.post.52",method:"POST",path:"/v1/human/comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"review-comments.post.53",method:"POST",path:"/v1/human/comments/:comment_id/reopen",classes:["person","broker"],resource:"human"},{name:"review-comments.post.54",method:"POST",path:"/v1/human/comments/:comment_id/delete",classes:["person","broker"],resource:"human"},{name:"review-comments.post.55",method:"POST",path:"/v1/human/comments/:comment_id/fork",classes:["person","broker"],resource:"human"},{name:"messages.post.56",method:"POST",path:"/v1/nodes/:id/mail/claim",classes:["person","broker"],resource:"node-own"},{name:"messages.post.57",method:"POST",path:"/v1/nodes/:id/mail/acknowledge",classes:["person","broker"],resource:"node-own"},{name:"messages.post.58",method:"POST",path:"/v1/nodes/:id/messages",classes:["person","broker"],resource:"node-write"},{name:"messages.post.59",method:"POST",path:"/v1/nodes/:id/interrupt",classes:["person","broker"],resource:"node-write"},{name:"reports.post.60",method:"POST",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-own"},{name:"reports.get.61",method:"GET",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-read"},{name:"reports.post.62",method:"POST",path:"/v1/nodes/:id/result",classes:["person","broker"],resource:"node-own"},{name:"inbox.get.63",method:"GET",path:"/v1/human/inbox",classes:["person","broker"],resource:"human"},{name:"inbox.get.64",method:"GET",path:"/v1/human/inbox/history",classes:["person","broker"],resource:"human"},{name:"inbox.get.65",method:"GET",path:"/v1/human/inbox/:ticket_id",classes:["person","broker"],resource:"human"},{name:"inbox.get.66",method:"GET",path:"/v1/human/inbox/:ticket_id/response",classes:["person","broker"],resource:"human"},{name:"inbox.post.67",method:"POST",path:"/v1/human/inbox/:ticket_id/respond",classes:["person","broker"],resource:"human"},{name:"inbox.post.68",method:"POST",path:"/v1/human/inbox/:ticket_id/progress",classes:["person","broker"],resource:"human"},{name:"inbox.post.69",method:"POST",path:"/v1/human/inbox/:ticket_id/cancel",classes:["person","broker"],resource:"human"},{name:"worktree.post.70",method:"POST",path:"/v1/nodes/:id/worktree/close",classes:["person","broker"],resource:"node-write"},{name:"worktree.post.71",method:"POST",path:"/v1/nodes/:id/worktree/abandon",classes:["person","broker"],resource:"node-write"},{name:"worktree.get.72",method:"GET",path:"/v1/worktrees/quarantined",classes:["person"],resource:"none"},{name:"crons.post.73",method:"POST",path:"/v1/crons",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.get.74",method:"GET",path:"/v1/crons",classes:["person","app","broker"],resource:"cron"},{name:"crons.get.75",method:"GET",path:"/v1/crons/:cronId",classes:["person","app","broker"],resource:"cron"},{name:"crons.post.76",method:"POST",path:"/v1/crons/:cronId/pause",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.77",method:"POST",path:"/v1/crons/:cronId/resume",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.78",method:"POST",path:"/v1/crons/poke",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.79",method:"POST",path:"/v1/crons/:cronId/run",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.delete.80",method:"DELETE",path:"/v1/crons/:cronId",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"modelauth.get.81",method:"GET",path:"/v1/model-auth",classes:["person"],resource:"none"},{name:"modelauth.get.82",method:"GET",path:"/v1/model-auth/readiness",classes:["person"],resource:"none"},{name:"modelauth.put.83",method:"PUT",path:"/v1/model-auth/:provider",classes:["person"],resource:"none"},{name:"modelauth.delete.84",method:"DELETE",path:"/v1/model-auth/:provider",classes:["person"],resource:"none"},{name:"model_auth.start",method:"POST",path:"/v1/model-auth/flows",classes:["person"],resource:"none"},{name:"model_auth.complete",method:"POST",path:"/v1/model-auth/flows/:flow_id/complete",classes:["person"],resource:"none"},{name:"model_auth.cancel",method:"POST",path:"/v1/model-auth/flows/:flow_id/cancel",classes:["person"],resource:"none"},{name:"model_auth.get",method:"GET",path:"/v1/model-auth/flows/:flow_id",classes:["person"],resource:"none",wait:!0},{name:"nodes.post.85",method:"POST",path:"/v1/nodes",classes:["person","broker"],resource:"node-own",scope:"crtr:act"},{name:"nodes.get.86",method:"GET",path:"/v1/nodes",classes:["person","broker"],resource:"nodes-list"},{name:"nodes.post.87",method:"POST",path:"/v1/nodes/revive-all",classes:["person"],resource:"none"},{name:"nodes.get.88",method:"GET",path:"/v1/nodes/:id",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.89",method:"GET",path:"/v1/nodes/:id/snapshot",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.90",method:"GET",path:"/v1/nodes/:id/subject",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.91",method:"GET",path:"/v1/nodes/:id/messages",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.92",method:"GET",path:"/v1/nodes/:id/session",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.93",method:"GET",path:"/v1/nodes/:id/transcript",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.94",method:"GET",path:"/v1/nodes/:id/context",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.95",method:"GET",path:"/v1/nodes/:id/artifacts",classes:["person","broker"],resource:"node-read"},{name:"nodes.post.96",method:"POST",path:"/v1/nodes/:id/fork",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.97",method:"POST",path:"/v1/nodes/:id/revive",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.98",method:"POST",path:"/v1/nodes/:id/relaunch-root",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.99",method:"POST",path:"/v1/nodes/:id/close",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.100",method:"POST",path:"/v1/nodes/:id/recycle",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.101",method:"POST",path:"/v1/nodes/:id/demote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.102",method:"POST",path:"/v1/nodes/:id/promote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.103",method:"POST",path:"/v1/nodes/:id/yield",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.104",method:"POST",path:"/v1/nodes/:id/wait",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.patch.105",method:"PATCH",path:"/v1/nodes/:id/config",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"broker-recovery.post.106",method:"POST",path:"/v1/broker/:id/turn",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.107",method:"POST",path:"/v1/broker/:id/provider-retry",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.108",method:"POST",path:"/v1/broker/:id/fault",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.get.109",method:"GET",path:"/v1/broker/:id/recovery",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.110",method:"POST",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"broker-recovery.delete.111",method:"DELETE",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"profiles.put.112",method:"PUT",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profiles.post.113",method:"POST",path:"/v1/profiles/:name/pause",classes:["person"],resource:"profile"},{name:"profiles.post.114",method:"POST",path:"/v1/profiles/:name/resume",classes:["person"],resource:"profile"},{name:"profiles.patch.115",method:"PATCH",path:"/v1/profiles/:name/metadata",classes:["person","app","broker"],resource:"profile"},{name:"profile.create",method:"POST",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile"},{name:"profile.update",method:"PATCH",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.list",method:"GET",path:"/v1/profiles/:name/env",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.set",method:"PUT",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.remove",method:"DELETE",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profiles.delete.116",method:"DELETE",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.list",method:"GET",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile",stage:"chat"},{name:"profiles.get.118",method:"GET",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"node-outcomes.get.119",method:"GET",path:"/v1/nodes/:id/outcome",classes:["person","broker"],resource:"node-read"},{name:"node-outcomes.put.120",method:"PUT",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"node-outcomes.get.121",method:"GET",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-read"},{name:"node-outcomes.delete.122",method:"DELETE",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"canvas.get.123",method:"GET",path:"/v1/canvas/attention",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.124",method:"POST",path:"/v1/canvas/attention/counts",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.125",method:"POST",path:"/v1/canvas/history/search",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.126",method:"POST",path:"/v1/canvas/history/grep",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.127",method:"GET",path:"/v1/canvas/history/read",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.128",method:"POST",path:"/v1/canvas/history/stats",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.129",method:"GET",path:"/v1/canvas/snapshot",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.130",method:"GET",path:"/v1/canvas/roster",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.analytics",method:"GET",path:"/v1/canvas/analytics",classes:["person"],resource:"canvas-read"},{name:"memory-reads.post",method:"POST",path:"/v1/nodes/:id/memory-reads",classes:["person","broker"],resource:"node-own"},{name:"canvas.get.131",method:"GET",path:"/v1/canvas/graph",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.132",method:"POST",path:"/v1/canvas/prune",classes:["person"],resource:"none"},{name:"daemon.post.133",method:"POST",path:"/v1/daemon/restart",classes:["person"],resource:"none"},{name:"daemon.post.134",method:"POST",path:"/v1/daemon/migrate",classes:["person"],resource:"none"},{name:"daemon.post.135",method:"POST",path:"/v1/daemon/admit",classes:["person"],resource:"none"},{name:"human.components.list",method:"GET",path:"/v1/human/components",classes:["person","broker"],resource:"none"},{name:"human-requests.post.136",method:"POST",path:"/v1/human/requests",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"human-requests.get.137",method:"GET",path:"/v1/human/requests/:request_id",classes:["person","broker"],resource:"human"},{name:"human-requests.post.138",method:"POST",path:"/v1/human/requests/:request_id/replace",classes:["person","broker"],resource:"human"},{name:"human-requests.post.139",method:"POST",path:"/v1/human/requests/:request_id/respond",classes:["person","broker"],resource:"human"},{name:"human-requests.post.140",method:"POST",path:"/v1/human/requests/:request_id/dismiss",classes:["person","broker"],resource:"human"},{name:"human-requests.post.141",method:"POST",path:"/v1/human/requests/:request_id/cancel",classes:["person","broker"],resource:"human"},{name:"focus.get.142",method:"GET",path:"/v1/focuses",classes:["person"],resource:"none"},{name:"focus.post.143",method:"POST",path:"/v1/focuses",classes:["person"],resource:"none"},{name:"focus.get.144",method:"GET",path:"/v1/focuses/by-node",classes:["person"],resource:"none"},{name:"focus.get.145",method:"GET",path:"/v1/focuses/by-pane",classes:["person"],resource:"none"},{name:"focus.patch.146",method:"PATCH",path:"/v1/focuses/:focus_id",classes:["person"],resource:"none"},{name:"focus.delete.147",method:"DELETE",path:"/v1/focuses/:focus_id",classes:["person"],resource:"none"},{name:"space.list",method:"GET",path:"/v1/spaces",classes:["person"],resource:"none"},{name:"kinds.list",method:"GET",path:"/v1/kinds",classes:["person","app","broker"],resource:"none"},{name:"grant.get",method:"GET",path:"/v1/grant",classes:["app"],resource:"none",stage:"v0.5"},{name:"llm",method:"POST",path:"/v1/llm",classes:["app","person","broker"],scope:"crtr:llm",resource:"none",stage:"v1"},{name:"run.start",method:"POST",path:"/v1/runs",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5",idempotency:"24h"},{name:"run.list",method:"GET",path:"/v1/runs",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.get",method:"GET",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5",wait:!0},{name:"run.message",method:"POST",path:"/v1/runs/:run_id/messages",classes:["app","person","broker"],scope:"crtr:act",resource:"run",stage:"v0.5"},{name:"run.events",method:"GET",path:"/v1/runs/:run_id/events",classes:["app","person","broker"],resource:"run",stage:"v0.5",stream:!0},{name:"run.interrupt",method:"POST",path:"/v1/runs/:run_id/interrupt",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.cancel",method:"POST",path:"/v1/runs/:run_id/cancel",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.delete",method:"DELETE",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.rename",method:"POST",path:"/v1/runs/:run_id/rename",classes:["app"],resource:"run",stage:"chat"},{name:"question.get",method:"GET",path:"/v1/questions/:question_id",classes:["app"],resource:"none",stage:"chat"},{name:"question.answer",method:"POST",path:"/v1/questions/:question_id/answer",classes:["app"],resource:"none",stage:"chat"},{name:"trace.get",method:"GET",path:"/v1/runs/:run_id/trace",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"upload.create",method:"POST",path:"/v1/uploads",classes:["app"],scope:"crtr:act",resource:"none",stage:"file-transfer"},{name:"attachment.link",method:"GET",path:"/v1/attachments/link",classes:["app"],resource:"none",stage:"file-transfer"},{name:"file.download",method:"GET",path:"/v1/files/download",classes:["app"],resource:"none",stage:"file-transfer",stream:"bytes"},{name:"share.create",method:"POST",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.list",method:"GET",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.delete",method:"DELETE",path:"/v1/shares/:share_id",classes:["app"],resource:"none",stage:"file-transfer"},{name:"runtime.sync-notice",method:"POST",path:"/v1/runtime/sync-notice",classes:["directory"],resource:"none",stage:"v1"}];function m(e,s){return n.find(o=>o.method===e.toUpperCase()&&o.path===s)}r(m,"operationFor");export{n as OPERATIONS,m as operationFor};
1
+ var n=Object.defineProperty;var r=(e,s)=>n(e,"name",{value:s,configurable:!0});const a=[{name:"health",method:"GET",path:"/v1/health",classes:["anonymous"],resource:"none",stage:"v0.5"},{name:"chat-inventory.get.1",method:"GET",path:"/v1/nodes/:id/chat-inventory",classes:["person","broker"],resource:"node-read"},{name:"model-config.put.2",method:"PUT",path:"/v1/model-config",classes:["person"],resource:"none"},{name:"files.get.3",method:"GET",path:"/v1/files/peek",classes:["person","broker"],resource:"none"},{name:"files.post.4",method:"POST",path:"/v1/files/write",classes:["person","broker"],resource:"none"},{name:"files.get.5",method:"GET",path:"/v1/files/list",classes:["person","broker"],resource:"none"},{name:"reviews.post.6",method:"POST",path:"/v1/human/reviews",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"reviews.get.7",method:"GET",path:"/v1/human/reviews",classes:["person","broker"],resource:"human"},{name:"reviews.get.8",method:"GET",path:"/v1/human/reviews/:review_id",classes:["person","broker"],resource:"human"},{name:"reviews.post.9",method:"POST",path:"/v1/human/reviews/:review_id/submit",classes:["person","broker"],resource:"human"},{name:"reviews.post.10",method:"POST",path:"/v1/human/reviews/:review_id/cancel",classes:["person","broker"],resource:"human"},{name:"reviews.get.11",method:"GET",path:"/v1/human/reviews/:review_id/document",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.12",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments",classes:["person","broker"],resource:"human"},{name:"feedback-comments.post.13",method:"POST",path:"/v1/human/inbox/:ticket_id/feedback-comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"node.log.append",method:"POST",path:"/v1/nodes/:id/records/log",classes:["person","broker"],resource:"node-own"},{name:"node.telemetry.put",method:"PUT",path:"/v1/nodes/:id/records/telemetry",classes:["person","broker"],resource:"node-own"},{name:"node.recap.put",method:"PUT",path:"/v1/nodes/:id/records/recap",classes:["person","broker"],resource:"node-own"},{name:"node.inbox.read",method:"GET",path:"/v1/nodes/:id/records/inbox",classes:["person","broker"],resource:"node-own"},{name:"node.passive.read",method:"GET",path:"/v1/nodes/:id/records/passive",classes:["person","broker"],resource:"node-own"},{name:"node.pushed-final",method:"POST",path:"/v1/nodes/:id/records/pushed-final",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.14",method:"POST",path:"/v1/nodes/:id/broker/session-bound",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.15",method:"POST",path:"/v1/nodes/:id/broker/settle",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.16",method:"POST",path:"/v1/nodes/:id/broker/park-complete",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.17",method:"POST",path:"/v1/nodes/:id/broker/park-activity",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.18",method:"POST",path:"/v1/nodes/:id/broker/telemetry",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.19",method:"POST",path:"/v1/nodes/:id/broker/model",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.get.20",method:"GET",path:"/v1/nodes/:id/broker/extension-state",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.context",method:"POST",path:"/v1/nodes/:id/broker/context",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.memory-refs",method:"POST",path:"/v1/nodes/:id/broker/memory-refs",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.context-commit",method:"POST",path:"/v1/nodes/:id/broker/context/commit",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.context-event",method:"POST",path:"/v1/nodes/:id/broker/context/event",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.21",method:"POST",path:"/v1/nodes/:id/broker/generated-name",classes:["person","broker"],resource:"node-own"},{name:"broker-ops.post.22",method:"POST",path:"/v1/nodes/:id/broker/persona-ack",classes:["person","broker"],resource:"node-own"},{name:"memory.get.23",method:"GET",path:"/v1/memory/docs",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.24",method:"GET",path:"/v1/memory/docs/:name",classes:["person","app","broker"],resource:"memory"},{name:"memory.post.25",method:"POST",path:"/v1/memory/docs",classes:["person","app","broker"],resource:"memory"},{name:"memory.patch.26",method:"PATCH",path:"/v1/memory/docs/:name",classes:["person","app","broker"],resource:"memory"},{name:"memory.delete.27",method:"DELETE",path:"/v1/memory/docs/:name",classes:["person","app","broker"],resource:"memory"},{name:"memory.post.28",method:"POST",path:"/v1/memory/docs/:name/move",classes:["person","app","broker"],resource:"memory"},{name:"memory.post.29",method:"POST",path:"/v1/memory/search",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.30",method:"GET",path:"/v1/memory/docs/:name/history",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.31",method:"GET",path:"/v1/memory/resolve",classes:["person","app","broker"],resource:"memory"},{name:"memory.get.32",method:"GET",path:"/v1/memory/origin",classes:["person","app","broker"],resource:"memory"},{name:"memory.lint",method:"POST",path:"/v1/memory/lint",classes:["person","app","broker"],resource:"memory"},{name:"memory.extensions",method:"GET",path:"/v1/memory/extensions",classes:["person","broker"],resource:"memory"},{name:"memory.slash.list",method:"GET",path:"/v1/memory/slash",classes:["person","broker"],resource:"memory"},{name:"memory.slash.attachments",method:"POST",path:"/v1/memory/slash/attachments",classes:["person","broker"],resource:"memory"},{name:"health.get.33",method:"GET",path:"/healthz",classes:["anonymous"],resource:"none"},{name:"health.get.34",method:"GET",path:"/v1/status",classes:["person"],resource:"none"},{name:"bash-jobs.start",method:"POST",path:"/v1/nodes/:id/jobs/start",classes:["broker"],resource:"node-own",scope:"crtr:act"},{name:"hooks.plan",method:"GET",path:"/v1/nodes/:id/hooks/plan",classes:["broker"],resource:"node-own"},{name:"hooks.exec",method:"POST",path:"/v1/nodes/:id/hooks/exec",classes:["broker"],resource:"node-own"},{name:"hooks.exec.person",method:"POST",path:"/v1/hooks/exec",classes:["person"],resource:"none"},{name:"bash-jobs.get.35",method:"GET",path:"/v1/nodes/:id/jobs",classes:["person","broker"],resource:"node-read"},{name:"bash-jobs.delete.36",method:"DELETE",path:"/v1/nodes/:id/jobs/:jobId",classes:["person","broker"],resource:"node-write"},{name:"prospective-chat-inventory.get.37",method:"GET",path:"/v1/prospective-chat-inventory",classes:["person"],resource:"none"},{name:"node-events.get.38",method:"GET",path:"/v1/nodes/:id/events",classes:["person","broker"],resource:"node-read"},{name:"bash.post.39",method:"POST",path:"/v1/bash",classes:["person","broker"],resource:"daemon-bash",scope:"crtr:act"},{name:"subscriptions.post.40",method:"POST",path:"/v1/nodes/:id/subscriptions",classes:["person","broker"],resource:"node-write"},{name:"subscriptions.delete.41",method:"DELETE",path:"/v1/nodes/:id/subscriptions/:target",classes:["person","broker"],resource:"node-write"},{name:"attach.post.42",method:"POST",path:"/v1/nodes/:id/attach",classes:["person"],resource:"none"},{name:"review-comments.post.44",method:"POST",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.45",method:"GET",path:"/v1/human/reviews/self/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.post.46",method:"POST",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.47",method:"GET",path:"/v1/human/reviews/:review_id/comments",classes:["person","broker"],resource:"human"},{name:"review-comments.get.48",method:"GET",path:"/v1/human/reviews/:review_id/comment-events",classes:["person","broker"],resource:"human"},{name:"review-comments.post.49",method:"POST",path:"/v1/human/reviews/:review_id/comment-ranges",classes:["person","broker"],resource:"human"},{name:"review-comments.get.50",method:"GET",path:"/v1/human/comments/:comment_id",classes:["person","broker"],resource:"human"},{name:"review-comments.post.51",method:"POST",path:"/v1/human/comments/:comment_id/edit",classes:["person","broker"],resource:"human"},{name:"review-comments.post.52",method:"POST",path:"/v1/human/comments/:comment_id/resolve",classes:["person","broker"],resource:"human"},{name:"review-comments.post.53",method:"POST",path:"/v1/human/comments/:comment_id/reopen",classes:["person","broker"],resource:"human"},{name:"review-comments.post.54",method:"POST",path:"/v1/human/comments/:comment_id/delete",classes:["person","broker"],resource:"human"},{name:"review-comments.post.55",method:"POST",path:"/v1/human/comments/:comment_id/fork",classes:["person","broker"],resource:"human"},{name:"messages.post.56",method:"POST",path:"/v1/nodes/:id/mail/claim",classes:["person","broker"],resource:"node-own"},{name:"messages.post.57",method:"POST",path:"/v1/nodes/:id/mail/acknowledge",classes:["person","broker"],resource:"node-own"},{name:"messages.post.58",method:"POST",path:"/v1/nodes/:id/messages",classes:["person","broker"],resource:"node-write"},{name:"messages.post.59",method:"POST",path:"/v1/nodes/:id/interrupt",classes:["person","broker"],resource:"node-write"},{name:"reports.post.60",method:"POST",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-own"},{name:"reports.get.61",method:"GET",path:"/v1/nodes/:id/reports",classes:["person","broker"],resource:"node-read"},{name:"reports.post.62",method:"POST",path:"/v1/nodes/:id/result",classes:["person","broker"],resource:"node-own"},{name:"inbox.get.63",method:"GET",path:"/v1/human/inbox",classes:["person","broker"],resource:"human"},{name:"inbox.get.64",method:"GET",path:"/v1/human/inbox/history",classes:["person","broker"],resource:"human"},{name:"inbox.get.65",method:"GET",path:"/v1/human/inbox/:ticket_id",classes:["person","broker"],resource:"human"},{name:"inbox.get.66",method:"GET",path:"/v1/human/inbox/:ticket_id/response",classes:["person","broker"],resource:"human"},{name:"inbox.post.67",method:"POST",path:"/v1/human/inbox/:ticket_id/respond",classes:["person","broker"],resource:"human"},{name:"inbox.post.68",method:"POST",path:"/v1/human/inbox/:ticket_id/progress",classes:["person","broker"],resource:"human"},{name:"inbox.post.69",method:"POST",path:"/v1/human/inbox/:ticket_id/cancel",classes:["person","broker"],resource:"human"},{name:"worktree.post.70",method:"POST",path:"/v1/nodes/:id/worktree/close",classes:["person","broker"],resource:"node-write"},{name:"worktree.post.71",method:"POST",path:"/v1/nodes/:id/worktree/abandon",classes:["person","broker"],resource:"node-write"},{name:"worktree.get.72",method:"GET",path:"/v1/worktrees/quarantined",classes:["person"],resource:"none"},{name:"crons.post.73",method:"POST",path:"/v1/crons",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.get.74",method:"GET",path:"/v1/crons",classes:["person","app","broker"],resource:"cron"},{name:"crons.get.75",method:"GET",path:"/v1/crons/:cronId",classes:["person","app","broker"],resource:"cron"},{name:"crons.post.76",method:"POST",path:"/v1/crons/:cronId/pause",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.77",method:"POST",path:"/v1/crons/:cronId/resume",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.78",method:"POST",path:"/v1/crons/poke",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.post.79",method:"POST",path:"/v1/crons/:cronId/run",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"crons.delete.80",method:"DELETE",path:"/v1/crons/:cronId",classes:["person","app","broker"],resource:"cron",scope:"crtr:schedule"},{name:"modelauth.get.81",method:"GET",path:"/v1/model-auth",classes:["person"],resource:"none"},{name:"modelauth.get.82",method:"GET",path:"/v1/model-auth/readiness",classes:["person"],resource:"none"},{name:"modelauth.put.83",method:"PUT",path:"/v1/model-auth/:provider",classes:["person"],resource:"none"},{name:"modelauth.delete.84",method:"DELETE",path:"/v1/model-auth/:provider",classes:["person"],resource:"none"},{name:"model_auth.start",method:"POST",path:"/v1/model-auth/flows",classes:["person"],resource:"none"},{name:"model_auth.complete",method:"POST",path:"/v1/model-auth/flows/:flow_id/complete",classes:["person"],resource:"none"},{name:"model_auth.cancel",method:"POST",path:"/v1/model-auth/flows/:flow_id/cancel",classes:["person"],resource:"none"},{name:"model_auth.get",method:"GET",path:"/v1/model-auth/flows/:flow_id",classes:["person"],resource:"none",wait:!0},{name:"nodes.post.85",method:"POST",path:"/v1/nodes",classes:["person","broker"],resource:"node-own",scope:"crtr:act"},{name:"nodes.get.86",method:"GET",path:"/v1/nodes",classes:["person","broker"],resource:"nodes-list"},{name:"nodes.post.87",method:"POST",path:"/v1/nodes/revive-all",classes:["person"],resource:"none"},{name:"nodes.get.88",method:"GET",path:"/v1/nodes/:id",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.89",method:"GET",path:"/v1/nodes/:id/snapshot",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.90",method:"GET",path:"/v1/nodes/:id/subject",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.91",method:"GET",path:"/v1/nodes/:id/messages",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.92",method:"GET",path:"/v1/nodes/:id/session",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.93",method:"GET",path:"/v1/nodes/:id/transcript",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.94",method:"GET",path:"/v1/nodes/:id/context",classes:["person","broker"],resource:"node-read"},{name:"nodes.get.95",method:"GET",path:"/v1/nodes/:id/artifacts",classes:["person","broker"],resource:"node-read"},{name:"nodes.post.96",method:"POST",path:"/v1/nodes/:id/fork",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.97",method:"POST",path:"/v1/nodes/:id/revive",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.98",method:"POST",path:"/v1/nodes/:id/relaunch-root",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.99",method:"POST",path:"/v1/nodes/:id/close",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.100",method:"POST",path:"/v1/nodes/:id/recycle",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.101",method:"POST",path:"/v1/nodes/:id/demote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.102",method:"POST",path:"/v1/nodes/:id/promote",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.103",method:"POST",path:"/v1/nodes/:id/yield",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.post.104",method:"POST",path:"/v1/nodes/:id/wait",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"nodes.patch.105",method:"PATCH",path:"/v1/nodes/:id/config",classes:["person","broker"],resource:"node-write",scope:"crtr:act"},{name:"broker-recovery.post.106",method:"POST",path:"/v1/broker/:id/turn",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.107",method:"POST",path:"/v1/broker/:id/provider-retry",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.108",method:"POST",path:"/v1/broker/:id/fault",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.get.109",method:"GET",path:"/v1/broker/:id/recovery",classes:["person","broker"],resource:"node-own"},{name:"broker-recovery.post.110",method:"POST",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"broker-recovery.delete.111",method:"DELETE",path:"/v1/nodes/:id/fault",classes:["person","broker"],resource:"node-write"},{name:"profiles.put.112",method:"PUT",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profiles.post.113",method:"POST",path:"/v1/profiles/:name/pause",classes:["person"],resource:"profile"},{name:"profiles.post.114",method:"POST",path:"/v1/profiles/:name/resume",classes:["person"],resource:"profile"},{name:"profiles.patch.115",method:"PATCH",path:"/v1/profiles/:name/metadata",classes:["person","app","broker"],resource:"profile"},{name:"profile.create",method:"POST",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile"},{name:"profile.update",method:"PATCH",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.list",method:"GET",path:"/v1/profiles/:name/env",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.set",method:"PUT",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profile.env.remove",method:"DELETE",path:"/v1/profiles/:name/env/:var",classes:["person","app","broker"],resource:"profile"},{name:"profiles.delete.116",method:"DELETE",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"profile.list",method:"GET",path:"/v1/profiles",classes:["person","app","broker"],resource:"profile",stage:"chat"},{name:"profiles.get.118",method:"GET",path:"/v1/profiles/:name",classes:["person","app","broker"],resource:"profile"},{name:"node-outcomes.get.119",method:"GET",path:"/v1/nodes/:id/outcome",classes:["person","broker"],resource:"node-read"},{name:"node-outcomes.put.120",method:"PUT",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"node-outcomes.get.121",method:"GET",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-read"},{name:"node-outcomes.delete.122",method:"DELETE",path:"/v1/nodes/:id/outcome-delivery",classes:["person","broker"],resource:"node-write"},{name:"canvas.get.123",method:"GET",path:"/v1/canvas/attention",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.124",method:"POST",path:"/v1/canvas/attention/counts",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.125",method:"POST",path:"/v1/canvas/history/search",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.126",method:"POST",path:"/v1/canvas/history/grep",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.127",method:"GET",path:"/v1/canvas/history/read",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.128",method:"POST",path:"/v1/canvas/history/stats",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.129",method:"GET",path:"/v1/canvas/snapshot",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.130",method:"GET",path:"/v1/canvas/roster",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.get.analytics",method:"GET",path:"/v1/canvas/analytics",classes:["person"],resource:"canvas-read"},{name:"memory-reads.post",method:"POST",path:"/v1/nodes/:id/memory-reads",classes:["person","broker"],resource:"node-own"},{name:"canvas.get.131",method:"GET",path:"/v1/canvas/graph",classes:["person","broker"],resource:"canvas-read"},{name:"canvas.post.132",method:"POST",path:"/v1/canvas/prune",classes:["person"],resource:"none"},{name:"daemon.post.133",method:"POST",path:"/v1/daemon/restart",classes:["person"],resource:"none"},{name:"daemon.post.134",method:"POST",path:"/v1/daemon/migrate",classes:["person"],resource:"none"},{name:"daemon.post.135",method:"POST",path:"/v1/daemon/admit",classes:["person"],resource:"none"},{name:"human.components.list",method:"GET",path:"/v1/human/components",classes:["person","broker"],resource:"none"},{name:"human-requests.post.136",method:"POST",path:"/v1/human/requests",classes:["person","broker"],resource:"human",scope:"crtr:act"},{name:"human-requests.get.137",method:"GET",path:"/v1/human/requests/:request_id",classes:["person","broker"],resource:"human"},{name:"human-requests.post.138",method:"POST",path:"/v1/human/requests/:request_id/replace",classes:["person","broker"],resource:"human"},{name:"human-requests.post.139",method:"POST",path:"/v1/human/requests/:request_id/respond",classes:["person","broker"],resource:"human"},{name:"human-requests.post.140",method:"POST",path:"/v1/human/requests/:request_id/dismiss",classes:["person","broker"],resource:"human"},{name:"human-requests.post.141",method:"POST",path:"/v1/human/requests/:request_id/cancel",classes:["person","broker"],resource:"human"},{name:"focus.get.142",method:"GET",path:"/v1/focuses",classes:["person"],resource:"none"},{name:"focus.post.143",method:"POST",path:"/v1/focuses",classes:["person"],resource:"none"},{name:"focus.get.144",method:"GET",path:"/v1/focuses/by-node",classes:["person"],resource:"none"},{name:"focus.get.145",method:"GET",path:"/v1/focuses/by-pane",classes:["person"],resource:"none"},{name:"focus.patch.146",method:"PATCH",path:"/v1/focuses/:focus_id",classes:["person"],resource:"none"},{name:"focus.delete.147",method:"DELETE",path:"/v1/focuses/:focus_id",classes:["person"],resource:"none"},{name:"space.list",method:"GET",path:"/v1/spaces",classes:["person"],resource:"none"},{name:"kinds.list",method:"GET",path:"/v1/kinds",classes:["person","app","broker"],resource:"none"},{name:"grant.get",method:"GET",path:"/v1/grant",classes:["app"],resource:"none",stage:"v0.5"},{name:"llm",method:"POST",path:"/v1/llm",classes:["app","person","broker"],scope:"crtr:llm",resource:"none",stage:"v1"},{name:"run.start",method:"POST",path:"/v1/runs",classes:["app"],scope:"crtr:act",resource:"none",stage:"v0.5",idempotency:"24h"},{name:"run.list",method:"GET",path:"/v1/runs",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.get",method:"GET",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5",wait:!0},{name:"run.message",method:"POST",path:"/v1/runs/:run_id/messages",classes:["app","person","broker"],scope:"crtr:act",resource:"run",stage:"v0.5"},{name:"run.events",method:"GET",path:"/v1/runs/:run_id/events",classes:["app","person","broker"],resource:"run",stage:"v0.5",stream:!0},{name:"run.interrupt",method:"POST",path:"/v1/runs/:run_id/interrupt",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.cancel",method:"POST",path:"/v1/runs/:run_id/cancel",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.delete",method:"DELETE",path:"/v1/runs/:run_id",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"run.rename",method:"POST",path:"/v1/runs/:run_id/rename",classes:["app"],resource:"run",stage:"chat"},{name:"question.get",method:"GET",path:"/v1/questions/:question_id",classes:["app"],resource:"none",stage:"chat"},{name:"question.answer",method:"POST",path:"/v1/questions/:question_id/answer",classes:["app"],resource:"none",stage:"chat"},{name:"trace.get",method:"GET",path:"/v1/runs/:run_id/trace",classes:["app","person","broker"],resource:"run",stage:"v0.5"},{name:"upload.create",method:"POST",path:"/v1/uploads",classes:["app"],scope:"crtr:act",resource:"none",stage:"file-transfer"},{name:"attachment.link",method:"GET",path:"/v1/attachments/link",classes:["app"],resource:"none",stage:"file-transfer"},{name:"file.download",method:"GET",path:"/v1/files/download",classes:["app"],resource:"none",stage:"file-transfer",stream:"bytes"},{name:"share.create",method:"POST",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.list",method:"GET",path:"/v1/shares",classes:["app"],resource:"none",stage:"file-transfer"},{name:"share.delete",method:"DELETE",path:"/v1/shares/:share_id",classes:["app"],resource:"none",stage:"file-transfer"},{name:"runtime.sync-notice",method:"POST",path:"/v1/runtime/sync-notice",classes:["directory"],resource:"none",stage:"v1"},{name:"runtime.vendor-status",method:"GET",path:"/v1/runtime/vendor-status",classes:["directory"],resource:"none",stage:"v1"}];function m(e,s){return a.find(o=>o.method===e.toUpperCase()&&o.path===s)}r(m,"operationFor");export{a as OPERATIONS,m as operationFor};
@@ -38,5 +38,10 @@ export declare class AppPrincipalResolver {
38
38
  * present (runtime spec §7 "Vendor sign-in page", RT-LLM-52). The owner and
39
39
  * single-use `jti` checks are the caller's. Every failure is 401. */
40
40
  verifyHandoff(token: string | undefined): Promise<VendorHandoff>;
41
+ /** Verify a directory read token (`Authorization: Bearer <ES256 JWT>`): signature
42
+ * against the JWKS mirror, `iss`, `aud`, `exp`, and that `purpose` is exactly
43
+ * the one this route accepts. It names no owner and is not single-use, so
44
+ * there is no `sub` or `jti` requirement. Every failure is 401. */
45
+ verifyDirectoryRead(authorization: string | undefined, purpose: string): Promise<void>;
41
46
  resolve(authorization: string | undefined, scope?: string): Promise<AppPrincipal>;
42
47
  }
@@ -1 +1 @@
1
- var l=Object.defineProperty;var a=(c,i)=>l(c,"name",{value:i,configurable:!0});import{covers as w,JwksCache as y,verifyAccessToken as p,verifySyncNotice as g}from"@north-light/crouter-identity";import{createLocalJWKSet as m,decodeProtectedHeader as v,jwtVerify as _}from"jose";import{activeGrant as k,hasGrant as x}from"../../core/grants/mirror.js";import{RunError as s}from"../../core/runs/operations.js";class D{static{a(this,"AppPrincipalResolver")}issuer;audience;syncGrants;cache;ready=!1;timer;constructor(i,r,e,t){this.issuer=i,this.audience=r,this.syncGrants=e,this.cache=new y(i,fetch,t),this.load(),this.timer=setInterval(()=>{this.ready||this.load()},5e3),this.timer.unref()}async load(){try{await this.cache.load(),this.ready=!0}catch{}}isReady(){return this.ready}close(){this.timer&&clearInterval(this.timer)}notices=new Map;async verifySyncNotice(i){if(!this.ready)throw new s(503,"runtime_starting","runtime_starting");if(!i?.startsWith("Bearer ")||i.length<=7)throw new s(401,"unauthorized","a directory sync notice token is required");let r;try{r=await g({token:i.slice(7),jwks:this.cache,issuer:this.issuer,audience:this.audience})}catch{throw new s(401,"unauthorized","invalid directory sync notice token")}const e=Math.floor(Date.now()/1e3);for(const[t,n]of this.notices)n+30<e&&this.notices.delete(t);return this.notices.has(r.jti)?!1:(this.notices.set(r.jti,r.exp),!0)}async verifyHandoff(i){if(!this.ready)throw new s(503,"runtime_starting","runtime_starting");const r=a(()=>new s(401,"unauthorized","invalid vendor sign-in handoff"),"refuse");if(!i)throw r();let e;try{const h=v(i);if(h.alg!=="ES256")throw r();const f=await this.cache.forKid(h.kid);({payload:e}=await _(i,m(f),{issuer:this.issuer,audience:this.audience,algorithms:["ES256"],requiredClaims:["exp","jti","sub"]}))}catch{throw r()}const{sub:t,jti:n,exp:o,purpose:d,aud:u}=e;if(d!=="vendor_sign_in"||u!==this.audience||typeof t!="string"||typeof n!="string"||n===""||typeof o!="number")throw r();return{sub:t,jti:n,exp:o}}async resolve(i,r){if(!this.ready)throw new s(503,"runtime_starting","runtime_starting");if(!i?.startsWith("Bearer ")||i.length<=7)throw new s(401,"unauthorized","a directory access token is required");let e;try{e=await p({token:i.slice(7),jwks:this.cache,issuer:this.issuer,audience:this.audience})}catch{throw new s(401,"unauthorized","invalid directory access token")}x(e.grant)||await this.syncGrants();const t=k(e.grant);if(!t||t.sub!==e.sub||t.grantee!==e.grantee||t.expires_at!==null&&!(Date.parse(t.expires_at)>Date.now()))throw new s(401,"grant_revoked","grant is not active");if(r&&!t.resolved.some(n=>w(n,r)))throw new s(403,"scope_missing",`missing scope ${r}`,void 0,void 0,r);return{sub:e.sub,grantee:e.grantee,client_id:e.client_id,grant:e.grant,rev:t.rev,resolved:t.resolved,resolved_scopes:t.resolved_scopes,spend_cap:t.spend_cap,exp:e.exp}}}export{D as AppPrincipalResolver};
1
+ var p=Object.defineProperty;var c=(h,t)=>p(h,"name",{value:t,configurable:!0});import{covers as g,JwksCache as m,verifyAccessToken as v,verifySyncNotice as _}from"@north-light/crouter-identity";import{createLocalJWKSet as u,decodeProtectedHeader as l,jwtVerify as f}from"jose";import{activeGrant as k,hasGrant as x}from"../../core/grants/mirror.js";import{RunError as s}from"../../core/runs/operations.js";class q{static{c(this,"AppPrincipalResolver")}issuer;audience;syncGrants;cache;ready=!1;timer;constructor(t,r,e,i){this.issuer=t,this.audience=r,this.syncGrants=e,this.cache=new m(t,fetch,i),this.load(),this.timer=setInterval(()=>{this.ready||this.load()},5e3),this.timer.unref()}async load(){try{await this.cache.load(),this.ready=!0}catch{}}isReady(){return this.ready}close(){this.timer&&clearInterval(this.timer)}notices=new Map;async verifySyncNotice(t){if(!this.ready)throw new s(503,"runtime_starting","runtime_starting");if(!t?.startsWith("Bearer ")||t.length<=7)throw new s(401,"unauthorized","a directory sync notice token is required");let r;try{r=await _({token:t.slice(7),jwks:this.cache,issuer:this.issuer,audience:this.audience})}catch{throw new s(401,"unauthorized","invalid directory sync notice token")}const e=Math.floor(Date.now()/1e3);for(const[i,n]of this.notices)n+30<e&&this.notices.delete(i);return this.notices.has(r.jti)?!1:(this.notices.set(r.jti,r.exp),!0)}async verifyHandoff(t){if(!this.ready)throw new s(503,"runtime_starting","runtime_starting");const r=c(()=>new s(401,"unauthorized","invalid vendor sign-in handoff"),"refuse");if(!t)throw r();let e;try{const d=l(t);if(d.alg!=="ES256")throw r();const y=await this.cache.forKid(d.kid);({payload:e}=await f(t,u(y),{issuer:this.issuer,audience:this.audience,algorithms:["ES256"],requiredClaims:["exp","jti","sub"]}))}catch{throw r()}const{sub:i,jti:n,exp:a,purpose:o,aud:w}=e;if(o!=="vendor_sign_in"||w!==this.audience||typeof i!="string"||typeof n!="string"||n===""||typeof a!="number")throw r();return{sub:i,jti:n,exp:a}}async verifyDirectoryRead(t,r){if(!this.ready)throw new s(503,"runtime_starting","runtime_starting");const e=c(()=>new s(401,"unauthorized","invalid directory token"),"refuse");if(!t?.startsWith("Bearer ")||t.length<=7)throw e();const i=t.slice(7);let n;try{const a=l(i);if(a.alg!=="ES256")throw e();const o=await this.cache.forKid(a.kid);({payload:n}=await f(i,u(o),{issuer:this.issuer,audience:this.audience,algorithms:["ES256"],requiredClaims:["exp"]}))}catch{throw e()}if(n.purpose!==r||n.aud!==this.audience)throw e()}async resolve(t,r){if(!this.ready)throw new s(503,"runtime_starting","runtime_starting");if(!t?.startsWith("Bearer ")||t.length<=7)throw new s(401,"unauthorized","a directory access token is required");let e;try{e=await v({token:t.slice(7),jwks:this.cache,issuer:this.issuer,audience:this.audience})}catch{throw new s(401,"unauthorized","invalid directory access token")}x(e.grant)||await this.syncGrants();const i=k(e.grant);if(!i||i.sub!==e.sub||i.grantee!==e.grantee||i.expires_at!==null&&!(Date.parse(i.expires_at)>Date.now()))throw new s(401,"grant_revoked","grant is not active");if(r&&!i.resolved.some(n=>g(n,r)))throw new s(403,"scope_missing",`missing scope ${r}`,void 0,void 0,r);return{sub:e.sub,grantee:e.grantee,client_id:e.client_id,grant:e.grant,rev:i.rev,resolved:i.resolved,resolved_scopes:i.resolved_scopes,spend_cap:i.spend_cap,exp:e.exp}}}export{q as AppPrincipalResolver};
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@north-light/crouter",
3
- "version": "0.3.352",
3
+ "version": "0.3.353",
4
4
  "description": "crtr — agent runtime with memory, plugins, and marketplaces",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",
@@ -131,7 +131,7 @@
131
131
  "@earendil-works/pi-ai": "0.87.1",
132
132
  "@earendil-works/pi-coding-agent": "0.87.1",
133
133
  "@earendil-works/pi-tui": "0.87.1",
134
- "@north-light/crouter-identity": "^0.3.352",
134
+ "@north-light/crouter-identity": "^0.3.353",
135
135
  "cron-parser": "^5.6.0",
136
136
  "esbuild": "^0.27.7",
137
137
  "jose": "^6.2.12",
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@north-light/crouter-identity",
3
- "version": "0.3.352",
3
+ "version": "0.3.353",
4
4
  "description": "Northlight access-token verification and scope rules",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
package/runtime.lock.json CHANGED
@@ -1,12 +1,12 @@
1
1
  {
2
2
  "name": "@north-light/crouter",
3
- "version": "0.3.352",
3
+ "version": "0.3.353",
4
4
  "lockfileVersion": 3,
5
5
  "requires": true,
6
6
  "packages": {
7
7
  "": {
8
8
  "name": "@north-light/crouter",
9
- "version": "0.3.352",
9
+ "version": "0.3.353",
10
10
  "hasInstallScript": true,
11
11
  "license": "GPL-3.0-only",
12
12
  "workspaces": [
@@ -18,7 +18,7 @@
18
18
  "@earendil-works/pi-ai": "0.87.1",
19
19
  "@earendil-works/pi-coding-agent": "0.87.1",
20
20
  "@earendil-works/pi-tui": "0.87.1",
21
- "@north-light/crouter-identity": "^0.3.352",
21
+ "@north-light/crouter-identity": "^0.3.353",
22
22
  "cron-parser": "^5.6.0",
23
23
  "esbuild": "^0.27.7",
24
24
  "jose": "^6.2.12",
@@ -10885,17 +10885,17 @@
10885
10885
  },
10886
10886
  "packages/crouter-api": {
10887
10887
  "name": "@north-light/crouter-api",
10888
- "version": "0.3.352",
10888
+ "version": "0.3.353",
10889
10889
  "license": "GPL-3.0-only"
10890
10890
  },
10891
10891
  "packages/crouter-env-docker": {
10892
10892
  "name": "@north-light/crouter-env-docker",
10893
- "version": "0.3.352",
10893
+ "version": "0.3.353",
10894
10894
  "license": "GPL-3.0-only"
10895
10895
  },
10896
10896
  "packages/crouter-identity": {
10897
10897
  "name": "@north-light/crouter-identity",
10898
- "version": "0.3.352",
10898
+ "version": "0.3.353",
10899
10899
  "license": "GPL-3.0-only",
10900
10900
  "dependencies": {
10901
10901
  "jose": "^6.2.1"
@@ -10903,19 +10903,19 @@
10903
10903
  },
10904
10904
  "packages/crouter-plugin": {
10905
10905
  "name": "@north-light/crouter-plugin",
10906
- "version": "0.3.352",
10906
+ "version": "0.3.353",
10907
10907
  "license": "GPL-3.0-only",
10908
10908
  "dependencies": {
10909
- "@north-light/crouter-api": "^0.3.352"
10909
+ "@north-light/crouter-api": "^0.3.353"
10910
10910
  }
10911
10911
  },
10912
10912
  "packages/crouter-sdk": {
10913
10913
  "name": "@north-light/crouter-sdk",
10914
- "version": "0.3.352",
10914
+ "version": "0.3.353",
10915
10915
  "license": "GPL-3.0-only",
10916
10916
  "dependencies": {
10917
- "@north-light/crouter-api": "^0.3.352",
10918
- "@north-light/crouter-identity": "^0.3.352",
10917
+ "@north-light/crouter-api": "^0.3.353",
10918
+ "@north-light/crouter-identity": "^0.3.353",
10919
10919
  "jose": "^6.2.1"
10920
10920
  }
10921
10921
  }