@openrig/cli 0.5.16 → 0.6.0

package/node_modules/@openrig/daemon/dist/routes/queue.js

@@ -1,959 +0,0 @@
-import { Hono } from "hono";
-import { streamSSE } from "hono/streaming";
-import { QueueRepositoryError, newQitemId, deriveCrossHostSuccessorId, stampSelfHostSuffix, classifyNudgeFailure } from "../domain/queue-repository.js";
-import { parseSessionName, isHumanSeatSessionRef } from "../domain/session-name.js";
-import { requireSenderIdentity, resolveRecordedProvenance, ORIGIN_UNKNOWN_HEADER } from "./require-sender-identity.js";
-import { hostname as osHostname } from "node:os";
-import { InboxHandlerError } from "../domain/inbox-handler.js";
-import { aggregateAttention } from "../domain/feed/attention-aggregator.js";
-import { loadHostRegistry, resolveHost } from "../domain/hosts/hosts-registry-reader.js";
-import { LOCAL_HOST_ID } from "../domain/hosts/fanout-contract.js";
-import { remoteJsonRequest } from "../domain/hosts/remote-daemon-http.js";
-import { deriveCurrentWork } from "../domain/current-work.js";
-/**
- * Coordination L3 — Queue HTTP routes (PL-004 Phase A).
- *
- * Host-scoped. Backs `rig queue create|claim|update|handoff|show|list|inbox-*`.
- * Hot-potato strict-rejection happens in the domain layer; routes surface
- * structured errors with the validReasons enum so CLIs can render help.
- */
-// OPR.0.4.6.MH3 D-5: the cross-host FORWARD write-class deadline, named at
-// the call site (the S15 rule). The 5s READ budget is not the write budget;
-// a forwarded coordination WRITE gets its own generous-but-bounded window
-// (same class as mission-control's REMOTE_ACTION_TIMEOUT_MS). remoteJsonRequest
-// never hangs — a timeout surfaces as a structured host-named failure.
-const QUEUE_FORWARD_TIMEOUT_MS = 10_000;
-// OPR.0.4.6.MH3 D-4 (FR-2/R2a): the cross-host provenance shape appended to a
-// FORWARDED body's tags — a marker (`cross-host`) + the forwarding daemon's
-// self-declared name (`from-host:<name>`). Honest best-effort provenance, not
-// authenticated identity (host ids are per-registry local aliases). Without it
-// the successor's source_session (recorded as given) is indistinguishable from
-// a local one. The self-declared name is the daemon's own OS hostname — the
-// shipped registry has no canonical own-alias reader, and D-4 frames this name
-// as free-text best-effort by design.
-export const CROSS_HOST_TAG = "cross-host";
-export function crossHostProvenanceTags(existing) {
-    const base = existing ?? [];
-    const fromHost = `from-host:${osHostname()}`;
-    const additions = [CROSS_HOST_TAG, fromHost].filter((t) => !base.includes(t));
-    return [...base, ...additions];
-}
-/** Human requests: canonical human destination or human blocker, excluding
- * explicit updates. Tier labels alone never create a human obligation. The same
- * predicate runs in SQL before LIMIT in QueueRepository.listAttention. */
-export function isAttentionItem(q) {
-    if (q.humanIntent === "update")
-        return false;
-    if (isHumanSeatSessionRef(q.destinationSession))
-        return true;
-    return q.state === "blocked" && isHumanSeatSessionRef(q.blockedOn ?? "");
-}
-export function queueRoutes() {
-    const app = new Hono();
-    function getRepo(c) {
-        return c.get("queueRepo");
-    }
-    function getInbox(c) {
-        return c.get("inboxHandler");
-    }
-    function getOutbox(c) {
-        return c.get("outboxHandler");
-    }
-    function getEventBus(c) {
-        return c.get("eventBus");
-    }
-    /** PL-007: validate `target_repo` against the source rig's typed
-     *  workspace block. Returns 3-part structured error when the repo name
-     *  does not match the source rig's RigSpec.workspace.repos[]. Sessions
-     *  not associated with a workspace-bearing rig pass-through (target_repo
-     *  is honored as a free-form tag for back-compat). */
-    function validateTargetRepo(c, sourceSession, targetRepo) {
-        const rigRepo = c.get("rigRepo");
-        if (!rigRepo)
-            return { ok: true };
-        // OPR.0.4.6.MH1 FR-8: the shared parse contract (this regex WAS the
-        // contract's canonical shape — behavior-identical for every input).
-        const parsedSource = parseSessionName(sourceSession);
-        if (parsedSource.kind !== "canonical")
-            return { ok: true };
-        const rigName = parsedSource.rig;
-        const rigs = rigRepo.findRigsByName(rigName);
-        if (rigs.length === 0)
-            return { ok: true };
-        const rigId = rigs[0].id;
-        const ws = rigRepo.getRigWorkspace(rigId);
-        if (!ws)
-            return { ok: true };
-        const known = ws.repos.map((r) => r.name);
-        if (!known.includes(targetRepo)) {
-            return {
-                ok: false,
-                error: "unknown_target_repo",
-                message: `target_repo "${targetRepo}" does not match any repo in rig ${rigName}'s workspace; check rig whoami --json | jq .workspace.repos to see declared repos`,
-                meta: { rigName, knownRepos: known },
-            };
-        }
-        return { ok: true };
-    }
-    function errorResponse(c, err) {
-        if (err instanceof QueueRepositoryError) {
-            const status = err.code === "qitem_not_found" ? 404
-                : err.code === "missing_closure_reason" ? 400
-                    : err.code === "invalid_closure_reason" ? 400
-                        : err.code === "missing_closure_target" ? 400
-                            : err.code === "invalid_state" ? 400
-                                : err.code === "state_or_note_required" ? 400
-                                    : err.code === "note_append_fields_not_admitted" ? 400
-                                        : err.code === "terminal_reopen_requires_ack" ? 409
-                                            : err.code === "terminal_reopen_target_invalid" ? 400
-                                                : err.code === "reopen_note_required" ? 400
-                                                    : err.code === "reopen_not_applicable" ? 400
-                                                        : err.code === "claim_destination_mismatch" ? 403
-                                                            : err.code === "qitem_not_claimable" ? 409
-                                                                : err.code === "qitem_not_in_progress" ? 409
-                                                                    : err.code === "qitem_already_terminal" ? 409
-                                                                        // OPR.0.4.6.MH3 Q-a: same minted id, different destination/source =
-                                                                        // caller id-reuse (a bug, not an idempotent retry) — surface as a
-                                                                        // conflict, never overwrite.
-                                                                        : err.code === "qitem_id_reuse" ? 409
-                                                                            // OPR.0.4.6.MH3 FR-4 (C2): a cross-host source-close re-drive naming a
-                                                                            // DIFFERENT closure_target than the recorded one — someone else closed
-                                                                            // the source meanwhile; surfaced, never overwritten.
-                                                                            : err.code === "cross_host_close_conflict" ? 409
-                                                                                : err.code === "unknown_destination_rig" ? 400
-                                                                                    : err.code === "human_registry_unavailable" ? 400
-                                                                                        : err.code === "human_route_fields_required" ? 400
-                                                                                            : err.code === "invalid_human_notification" ? 400
-                                                                                                // OPR.0.5.1 slice-51-06 D2: summary/evidence_ref on a non-park transition — a client
-                                                                                                // input error surfaced as a structured 400 (the daemon rejects before any mutation).
-                                                                                                : err.code === "summary_evidence_not_persistable" ? 400
-                                                                                                    // OPR.0.4.6.WF3 FR-6: the frontier close-path guard — operator
-                                                                                                    // misuse of a queue verb on a live workflow packet; structured
-                                                                                                    // 400 with the what/why/fix message, never a 500.
-                                                                                                    : err.code === "workflow_frontier_packet" ? 400
-                                                                                                        : 500;
-            return c.json({ error: err.code, message: err.message, ...(err.meta ?? {}) }, status);
-        }
-        if (err instanceof InboxHandlerError) {
-            const status = err.code === "inbox_not_found" ? 404
-                : err.code === "auth_failed" ? 401
-                    : err.code === "absorb_destination_mismatch" ? 403
-                        : err.code === "deny_destination_mismatch" ? 403
-                            : err.code === "inbox_already_denied" ? 409
-                                : err.code === "inbox_not_pending" ? 409
-                                    : 500;
-            return c.json({ error: err.code, message: err.message }, status);
-        }
-        const message = err instanceof Error ? err.message : "internal error";
-        return c.json({ error: "internal_error", message }, 500);
-    }
-    // OPR.0.4.6.MH3 (FR-2, C1; return shape generalized in C2): the ONE shared
-    // forward-then-strip helper for the queue's cross-host coordination WRITES
-    // (create + handoff both route through it — one mechanism, not two).
-    // Generalizes the shipped mission-control write template
-    // (routes/mission-control.ts:340-388): resolve the registry daemon-side,
-    // reject ssh/unsupported-transport, forward the WHOLE body (already minted +
-    // provenance-tagged + hostId-stripped by the caller) to the origin daemon
-    // over the bearer, and map transport failures to the structured host-named
-    // taxonomy. Bearers resolve server-side and never reach the caller (the
-    // shipped posture).
-    //
-    // Returns a discriminated union rather than a Response so the HANDOFF
-    // choreography (C2) can compose: on success it needs the origin's verbatim
-    // payload to pair with the local source-close result; /create just unwraps.
-    // Either way the origin's row is THE record — no local write in here, ever.
-    async function forwardQueueWrite(c, hostId, path, forwardBody) {
-        const registryLoader = c.get("hostRegistryLoader") ??
-            loadHostRegistry;
-        const fetchImpl = c.get("remoteFetchImpl");
-        const fail = (detail, failureClass, remoteStatus) => ({
-            ok: false,
-            response: c.json({ error: "remote_queue_write_failed", hostId, failureClass, ...(remoteStatus !== undefined ? { remoteStatus } : {}), detail }, 502),
-        });
-        const reg = registryLoader();
-        if (!reg.ok)
-            return fail(reg.error, "registry");
-        const resolved = resolveHost(reg.registry, hostId);
-        if (!resolved.ok)
-            return fail(resolved.error, "unknown-host");
-        if (resolved.host.transport !== "http") {
-            return fail(`host '${hostId}' is SSH-declared; cross-host queue writes require an http-transport registry entry (url; bearer optional)`, "unsupported-transport");
-        }
-        const res = await remoteJsonRequest(resolved.host, path, {
-            method: "POST",
-            body: forwardBody,
-            timeoutMs: QUEUE_FORWARD_TIMEOUT_MS,
-            fetchImpl,
-            headers: c.req.header(ORIGIN_UNKNOWN_HEADER) === "true" ? { [ORIGIN_UNKNOWN_HEADER]: "true" } : undefined,
-        });
-        if (res.ok) {
-            // The origin daemon's structured response, verbatim — its row is the
-            // record; no optimistic local re-shaping, no local write.
-            return { ok: true, payload: res.payload, status: res.status ?? 200 };
-        }
-        switch (res.kind) {
-            case "bearer":
-                return fail(res.detail, "auth-failed");
-            case "timeout":
-                return fail(res.phase === "body"
-                    ? `remote queue write timed out: response headers arrived (HTTP ${res.status}) but the body never completed`
-                    : `remote queue write timed out after ${QUEUE_FORWARD_TIMEOUT_MS}ms`, "unreachable", res.status);
-            case "network":
-                return fail(res.detail, "unreachable");
-            case "http":
-                // The origin refused (its own validation/auth/conflict) — its
-                // structured error rides through; NO fake success.
-                return fail(res.detail || `HTTP ${res.status}`, res.status === 401 || res.status === 403 ? "auth-failed" : "remote-error", res.status);
-        }
-    }
-    /**
-     * OPR.0.4.6.MH3 FR-4 (C2): the cross-host HANDOFF choreography — shared by
-     * /handoff (source closes `handed-off`) and /handoff-and-complete (source
-     * closes `done`); the ONLY difference is the terminal state.
-     *
-     * The local atomic close+create cannot span two DBs, so the boundary is
-     * bridged by message-passing in the arch-ruled Q-c order:
-     *
-     *   (1) read the LOCAL source row + pre-flight the re-drive state — a
-     *       source already closed toward a DIFFERENT closure_target conflicts
-     *       BEFORE any forward (never manufacture an orphan on the target host
-     *       for a re-drive that cannot complete);
-     *   (2) derive the successor id (D-1 — same source+destination+host →
-     *       same id, stateless) and build the successor-create body: the
-     *       local handoff's inheritance rules (body/priority/tier/tags from
-     *       input ?? source), `chainOfRecord = [...source.chain, source.id]`
-     *       (opaque lineage ids on the target — arch R2b), D-4 provenance
-     *       tags, the forwarded `nudge` flag;
-     *   (3) forward the successor-create FIRST via the ONE forwardQueueWrite
-     *       helper — a failed forward returns the structured host-named error
-     *       with the source UNTOUCHED (never-drop: the potato stays live);
-     *       a re-driven forward absorbs on the target's PK (Q-a + D-1);
-     *   (4) close the LOCAL source SECOND via the bounded repo method —
-     *       `closure_target` = the host-qualified successor `<qitem-id>@<host>`,
-     *       `handed_off_to` = the 2-part session (BR-1); an already-closed
-     *       source with the MATCHING target absorbs idempotently.
-     *
-     * NOTE (disclosed): the target-side successor carries lineage via
-     * `chain_of_record` + the provenance tags; the local-only
-     * `handed_off_from` column is not part of the create body and stays NULL
-     * on the target — R2b's opaque-lineage contract, not a gap.
-     */
-    async function crossHostHandoff(c, qitemId, hostId, terminalState, body) {
-        const repo = getRepo(c);
-        const source = repo.getById(qitemId);
-        if (!source)
-            return c.json({ error: "qitem_not_found", message: `qitem ${qitemId} not found` }, 404);
-        // The deterministic successor identity is also the local custody key.
-        // It must be derived before the re-drive preflight so the comparator and
-        // the eventual close use the same host-qualified target. Already-terminal
-        // pre-convention rows retain their stored member@rig@host key on re-drive;
-        // the new key is prospective and historical custody is never rewritten.
-        const successorId = deriveCrossHostSuccessorId(source.qitemId, body.toSession, hostId);
-        const closureTarget = `${successorId}@${hostId}`;
-        const legacyClosureTarget = `${body.toSession}@${hostId}`;
-        const sourceTerminal = source.state === "done" || source.state === "handed-off";
-        const closeTarget = sourceTerminal && source.closureTarget === legacyClosureTarget
-            ? legacyClosureTarget
-            : closureTarget;
-        // (1) Pre-flight the re-drive state BEFORE any forward.
-        if (sourceTerminal && source.closureTarget !== closeTarget) {
-            return c.json({
-                error: "cross_host_close_conflict",
-                message: `qitem ${qitemId} is already closed toward ${source.closureTarget ?? "<no closure_target>"} — this re-drive names ${closureTarget}; surfacing the conflict, never overwriting`,
-                existingClosureTarget: source.closureTarget,
-                attemptedClosureTarget: closureTarget,
-            }, 409);
-        }
-        // (2) The deterministic successor identity + forwarded body.
-        const effectiveTags = body.tags ?? source.tags ?? undefined;
-        const forwardBody = {
-            qitemId: successorId,
-            // 51-09 incr 4a — stamp-at-FORWARD: this forwarding daemon IS the origin,
-            // so stamp its own self-id onto the sender identity before forwarding (the
-            // remote create()'s not-bare guard then leaves it — origin never forged).
-            sourceSession: c.req.header(ORIGIN_UNKNOWN_HEADER) === "true" ? body.fromSession : stampSelfHostSuffix(body.fromSession),
-            destinationSession: body.toSession,
-            body: body.body ?? source.body,
-            priority: body.priority ?? source.priority,
-            ...(body.tier ?? source.tier ? { tier: body.tier ?? source.tier } : {}),
-            tags: crossHostProvenanceTags(effectiveTags),
-            chainOfRecord: [...(source.chainOfRecord ?? []), source.qitemId],
-            ...(body.targetRepo !== undefined
-                ? { targetRepo: body.targetRepo }
-                : source.targetRepo
-                    ? { targetRepo: source.targetRepo }
-                    : {}),
-            ...(body.summary !== undefined ? { summary: body.summary } : {}),
-            ...(body.evidenceRef !== undefined ? { evidenceRef: body.evidenceRef } : {}),
-            ...(body.nudge !== undefined ? { nudge: body.nudge } : {}),
-        };
-        // (3) Successor-create FIRST — origin-owns-the-record; failure leaves the
-        // source untouched (never-drop).
-        const fwd = await forwardQueueWrite(c, hostId, "/api/queue/create", forwardBody);
-        if (!fwd.ok)
-            return fwd.response;
-        // (4) Source-close SECOND (idempotent absorb / structured conflict).
-        let closed;
-        try {
-            closed = repo.closeCrossHostHandoffSource({
-                qitemId: source.qitemId,
-                fromSession: body.fromSession,
-                toSession: body.toSession,
-                closureTarget: closeTarget,
-                terminalState,
-                transitionNote: body.transitionNote,
-            });
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-        // Same {closed, created} shape as the local transactional handoff;
-        // `created` is the origin daemon's row, verbatim.
-        return c.json({ closed: closed.item, created: fwd.payload }, 201);
-    }
-    // POST /create
-    app.post("/create", async (c) => {
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3 — the source is the transport-derived sender (X-OpenRig-Session), NEVER the body claim.
-        // P18 deliver-and-label: absent header + a body sourceSession → recorded as the claimed-era stamp
-        // claimed:v1; absent header + no body → 400 actor_required; a body sourceSession that DIFFERS from the
-        // header → the wire SUPERSEDES it (transport:v1), not a 409. `sourceSession` below is authoritative.
-        const identity = requireSenderIdentity(c, { verb: "queue create", bodyClaim: body.sourceSession });
-        if (!identity.ok)
-            return identity.response;
-        const sourceSession = identity.session;
-        if (!body.destinationSession)
-            return c.json({ error: "destinationSession is required" }, 400);
-        if (!body.body)
-            return c.json({ error: "body is required" }, 400);
-        // OPR.0.4.6.MH3 FR-2 (C1): cross-host CREATE. A registered remote host id
-        // forwards the write to that host's daemon; the qitem lives in the origin
-        // host's DB (origin-owns-the-record) and its OWN maybeNudge fires on its
-        // local tmux (FR-3 — forward the WHOLE body incl. nudge). Delivery is
-        // at-least-once + idempotent: the FORWARDING daemon MINTS the qitemId
-        // before the first forward (Q-a) so every retry carries the same id. No
-        // local row is ever written on the cross-host path.
-        // PL-007: validate target_repo against source rig's workspace.repos[].
-        // GUARD FIXBACK (OPR.0.4.6.MH3 review of 86ba8b42, Finding 1): this runs
-        // BEFORE the cross-host branch — the validation authority is the SOURCE
-        // rig's typed workspace, which lives on THIS host; the target daemon
-        // passes-through when it doesn't know the source rig, so a post-forward
-        // check cannot recover it. Local ordering is unchanged (the cross-host
-        // branch is a no-op without hostId).
-        if (body.targetRepo) {
-            const validation = validateTargetRepo(c, sourceSession, body.targetRepo);
-            if (!validation.ok)
-                return c.json({ error: validation.error, message: validation.message, ...(validation.meta ?? {}) }, 400);
-        }
-        if (typeof body.hostId === "string" && body.hostId !== "" && body.hostId !== LOCAL_HOST_ID) {
-            const mintedId = body.qitemId ?? newQitemId();
-            const { hostId: _dropped, ...rest } = body;
-            const forwardBody = {
-                ...rest,
-                qitemId: mintedId,
-                // 51-09 incr 4a — stamp-at-FORWARD: this forwarding daemon is the origin,
-                // so it stamps its OWN self-id (overriding the bare spread) before the
-                // remote create() runs — else the remote would forge member@rig@RECEIVER.
-                sourceSession: c.req.header(ORIGIN_UNKNOWN_HEADER) === "true" ? sourceSession : stampSelfHostSuffix(sourceSession),
-                tags: crossHostProvenanceTags(body.tags),
-            };
-            const fwd = await forwardQueueWrite(c, body.hostId, "/api/queue/create", forwardBody);
-            return fwd.ok ? c.json(fwd.payload, fwd.status) : fwd.response;
-        }
-        try {
-            const item = await getRepo(c).create({
-                qitemId: body.qitemId,
-                sourceSession,
-                destinationSession: body.destinationSession,
-                body: body.body,
-                priority: body.priority,
-                tier: body.tier,
-                tags: body.tags,
-                expiresAt: body.expiresAt,
-                chainOfRecord: body.chainOfRecord,
-                targetRepo: body.targetRepo,
-                humanIntent: body.humanIntent,
-                humanDetail: body.humanDetail,
-                summary: body.summary,
-                evidenceRef: body.evidenceRef,
-                nudge: body.nudge,
-                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
-            });
-            return c.json(item, 201);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    // POST /:qitemId/claim
-    app.post("/:qitemId/claim", async (c) => {
-        const qitemId = c.req.param("qitemId");
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3: the claimant is the transport-derived sender, never body.destinationSession.
-        const identity = requireSenderIdentity(c, { verb: "queue claim", bodyClaim: body.destinationSession });
-        if (!identity.ok)
-            return identity.response;
-        const destinationSession = identity.session;
-        try {
-            const item = getRepo(c).claim({ qitemId, destinationSession, identityProvenance: resolveRecordedProvenance(c, identity) });
-            return c.json(item);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    // POST /:qitemId/unclaim
-    app.post("/:qitemId/unclaim", async (c) => {
-        const qitemId = c.req.param("qitemId");
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3: the claimant is the transport-derived sender, never body.destinationSession.
-        const identity = requireSenderIdentity(c, { verb: "queue unclaim", bodyClaim: body.destinationSession });
-        if (!identity.ok)
-            return identity.response;
-        const destinationSession = identity.session;
-        try {
-            const item = getRepo(c).unclaim(qitemId, destinationSession, body.reason ?? "manual", resolveRecordedProvenance(c, identity));
-            return c.json(item);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    // POST /:qitemId/update — general state mutator (incl. done).
-    //
-    // OPR.0.3.2.21.FR-4(d-docs) — closure ≠ acceptance.
-    //
-    // `state=done` with `closure_reason=handed_off_to` records that the
-    // source seat has DELIVERED the work to the next stage. It does NOT
-    // record that the next stage has ACCEPTED the work — that's the next
-    // stage's verdict on its own qitem (typically a separate close with
-    // its own closure_reason).
-    //
-    // Closure vocabulary:
-    //   - handed_off_to    delivered to next stage; acceptance pending
-    //                      that stage's verdict on its own qitem
-    //   - blocked_on       waiting on a named blocker (closureTarget)
-    //   - denied           the source seat refuses the work
-    //   - canceled         work no longer needed (no follow-on)
-    //   - no-follow-on     completed in place; no further routing
-    //   - escalation       routed to a higher-authority seat
-    //
-    // The "accepted" state IS NOT a queue state in v0.3.x — the qitem
-    // model captures delivery + the receiving stage owns acceptance as
-    // a separate transaction. (FR-4d-state schema change adding a
-    // distinct "accepted" state is deferred to release-0.3.3.)
-    app.post("/:qitemId/update", async (c) => {
-        const qitemId = c.req.param("qitemId");
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3 — the actor is the transport-derived sender (X-OpenRig-Session), NEVER a body claim.
-        // P18 deliver-and-label: absent header + a body actor → claimed:v1; absent + no body → 400
-        // actor_required; a differing body actorSession → the wire SUPERSEDES it (transport:v1), not a 409;
-        // an equal body claim is a no-op.
-        const identity = requireSenderIdentity(c, { verb: "queue update", bodyClaim: body.actorSession });
-        if (!identity.ok)
-            return identity.response;
-        const actorSession = identity.session;
-        try {
-            const item = getRepo(c).update({
-                qitemId,
-                actorSession,
-                state: body.state,
-                reopen: body.reopen,
-                transitionNote: body.transitionNote,
-                closureReason: body.closureReason,
-                closureTarget: body.closureTarget,
-                // OPR.0.4.4.19 FR-6 — the leg-1 park surface: blockedOn plus the
-                // park-time summary/evidence_ref persist inputs.
-                blockedOn: body.blockedOn,
-                wakeWatchdogId: body.wakeWatchdogId,
-                wakeAfterSeconds: body.wakeAfterSeconds,
-                summary: body.summary,
-                evidenceRef: body.evidenceRef,
-                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
-            });
-            return c.json(item);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    // POST /:qitemId/handoff — transactional close+create (local); cross-host
-    // message-passing choreography when a registered hostId is enveloped
-    // (OPR.0.4.6.MH3 FR-4, C2).
-    app.post("/:qitemId/handoff", async (c) => {
-        const qitemId = c.req.param("qitemId");
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3: the handoff actor is the transport header, never body.fromSession.
-        const identity = requireSenderIdentity(c, { verb: "queue handoff", bodyClaim: body.fromSession });
-        if (!identity.ok)
-            return identity.response;
-        const fromSession = identity.session;
-        if (!body.toSession)
-            return c.json({ error: "toSession is required" }, 400);
-        // PL-007 — GUARD FIXBACK (Finding 1): an EXPLICIT targetRepo validates
-        // against the SOURCE host's authority BEFORE the cross-host branch (see
-        // the create-route note). An inherited source.targetRepo (no override)
-        // is NOT re-validated — it was already accepted on the source row.
-        if (body.targetRepo) {
-            const validation = validateTargetRepo(c, fromSession, body.targetRepo);
-            if (!validation.ok)
-                return c.json({ error: validation.error, message: validation.message, ...(validation.meta ?? {}) }, 400);
-        }
-        if (typeof body.hostId === "string" && body.hostId !== "" && body.hostId !== LOCAL_HOST_ID) {
-            return crossHostHandoff(c, qitemId, body.hostId, "handed-off", {
-                fromSession,
-                toSession: body.toSession,
-                body: body.body,
-                transitionNote: body.transitionNote,
-                priority: body.priority,
-                tier: body.tier,
-                tags: body.tags,
-                targetRepo: body.targetRepo,
-                summary: body.summary,
-                evidenceRef: body.evidenceRef,
-                nudge: body.nudge,
-            });
-        }
-        try {
-            const result = await getRepo(c).handoff({
-                qitemId,
-                fromSession,
-                toSession: body.toSession,
-                body: body.body,
-                transitionNote: body.transitionNote,
-                priority: body.priority,
-                tier: body.tier,
-                tags: body.tags,
-                targetRepo: body.targetRepo,
-                summary: body.summary,
-                evidenceRef: body.evidenceRef,
-                nudge: body.nudge,
-                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
-            });
-            return c.json(result, 201);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    // POST /:qitemId/handoff-and-complete — variant of handoff that closes
-    // source as `done` (terminal) instead of `handed-off` (intermediate).
-    // Same atomic close+create + chain_of_record + default-nudge contract.
-    // Cross-host: same C2 choreography with the `done` terminal state.
-    app.post("/:qitemId/handoff-and-complete", async (c) => {
-        const qitemId = c.req.param("qitemId");
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3: the handoff-and-complete actor is the transport header, never body.fromSession.
-        const identity = requireSenderIdentity(c, { verb: "queue handoff-and-complete", bodyClaim: body.fromSession });
-        if (!identity.ok)
-            return identity.response;
-        const fromSession = identity.session;
-        if (!body.toSession)
-            return c.json({ error: "toSession is required" }, 400);
-        // PL-007 — GUARD FIXBACK (Finding 1): same source-host-authority ordering
-        // as handoff — explicit targetRepo validates BEFORE the cross-host branch.
-        if (body.targetRepo) {
-            const validation = validateTargetRepo(c, fromSession, body.targetRepo);
-            if (!validation.ok)
-                return c.json({ error: validation.error, message: validation.message, ...(validation.meta ?? {}) }, 400);
-        }
-        if (typeof body.hostId === "string" && body.hostId !== "" && body.hostId !== LOCAL_HOST_ID) {
-            return crossHostHandoff(c, qitemId, body.hostId, "done", {
-                fromSession,
-                toSession: body.toSession,
-                body: body.body,
-                transitionNote: body.transitionNote,
-                priority: body.priority,
-                tier: body.tier,
-                tags: body.tags,
-                targetRepo: body.targetRepo,
-                summary: body.summary,
-                evidenceRef: body.evidenceRef,
-                nudge: body.nudge,
-            });
-        }
-        try {
-            const result = await getRepo(c).handoffAndComplete({
-                qitemId,
-                fromSession,
-                toSession: body.toSession,
-                body: body.body,
-                transitionNote: body.transitionNote,
-                priority: body.priority,
-                tier: body.tier,
-                tags: body.tags,
-                targetRepo: body.targetRepo,
-                summary: body.summary,
-                evidenceRef: body.evidenceRef,
-                nudge: body.nudge,
-                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
-            });
-            return c.json(result, 201);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    // POST /:qitemId/fallback
-    app.post("/:qitemId/fallback", async (c) => {
-        const qitemId = c.req.param("qitemId");
-        const body = await c.req.json().catch(() => ({}));
-        if (!body.fallbackDestination)
-            return c.json({ error: "fallbackDestination is required" }, 400);
-        try {
-            const item = getRepo(c).routeToFallback(qitemId, body.fallbackDestination, body.reason ?? "manual");
-            return c.json(item);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    // GET /whoami — caller's queue position from the daemon's perspective.
-    // MUST precede /:qitemId so the literal path wins.
-    app.get("/whoami", (c) => {
-        const session = c.req.query("session");
-        if (!session)
-            return c.json({ error: "session is required" }, 400);
-        const recentLimit = c.req.query("recentLimit")
-            ? Number.parseInt(c.req.query("recentLimit"), 10)
-            : undefined;
-        const repo = getRepo(c);
-        const position = repo.whoami(session, { recentLimit });
-        // OPR.0.5.8.14: the derived work node rides the verb that already answers "what does
-        // the daemon think I hold". Same DI style as the sibling routes; a missing store means
-        // no configured root, which the derivation reports as a refusal rather than a guess.
-        const store = c.get("settingsStore");
-        let missionsRoot = null;
-        try {
-            const value = store?.resolveOne("workspace.slices_root").value;
-            missionsRoot = value ? String(value) : null;
-        }
-        catch {
-            missionsRoot = null;
-        }
-        // Deliberately NOT position.asDestination.recent: that is a capped, mixed-state display
-        // projection, so a second in-progress baton past the cap would be invisible and the
-        // ambiguity refusal would degrade into a confident wrong answer. The derivation reads
-        // the unbounded in-progress set, which makes it independent of recentLimit.
-        const derived = deriveCurrentWork(repo.listInProgressForDestination(session), missionsRoot);
-        return c.json({ ...position, ...derived });
-    });
-    // GET /list — list with filters. MUST precede /:qitemId so the literal path wins.
-    //
-    // OPR.0.3.2.20 — `?attention=1` filter for the For You priority
-    // windowing slice. Returns OPEN attention-class qitems (the durable
-    // source of truth for the UI Action-required + Approval lenses) so
-    // those surfaces don't depend on the lossy ephemeral client event
-    // FIFO. Class membership matches the mission-control read layer
-    // semantics: tier='human-gate' OR the ONE contract predicate
-    // isHumanSeatSessionRef (human-seat /^human…@(kernel|host)$/ OR the A2
-    // virtual-domain leg <local>@external). Open state defaults
-    // to pending|in-progress|blocked (callers can still override via
-    // `state=...`). Composable with destinationSession/sourceSession/
-    // targetRepo/limit.
-    // OPR.0.4.4.15 FR-1 — the aggregated attention read: ONE payload in the
-    // shared P4 fanout contract ({items, hosts}), local always included,
-    // subscribed remote hosts fanned out DAEMON-SIDE (bearer never in the
-    // browser). A NEW sibling endpoint by arch ruling 3 — the existing
-    // /list?attention=1 wire below stays byte-preserved (the strongest form
-    // of the zero-config negative AC).
-    app.get("/attention-aggregate", async (c) => {
-        const repo = getRepo(c);
-        const store = c.get("settingsStore");
-        // Same DI style as every other context dep — tests/QA inject a loader;
-        // production falls back to the shared S11 reader over the operator's
-        // real hosts.yaml.
-        const registryLoader = c.get("hostRegistryLoader") ?? loadHostRegistry;
-        const payload = await aggregateAttention({
-            // The SAME repo query the /list attention path runs, same open-state
-            // default — invoked, not duplicated.
-            listLocalAttention: () => repo.listAttention({ state: ["pending", "in-progress", "blocked"] }),
-            listSubscriptions: () => (store ? store.listFeedHostSubscriptions() : []),
-            loadRegistry: registryLoader,
-        });
-        return c.json(payload);
-    });
-    app.get("/human-updates", (c) => {
-        const raw = Number(c.req.query("limit") ?? 20);
-        if (!Number.isInteger(raw) || raw < 1 || raw > 100)
-            return c.json({ error: "limit must be an integer from 1 to 100" }, 400);
-        const rows = getRepo(c).listDeliveredHumanUpdates({ limit: raw + 1 });
-        return c.json({ items: rows.slice(0, raw), limit: raw, truncated: rows.length > raw });
-    });
-    app.get("/list", (c) => {
-        const destinationSession = c.req.query("destinationSession") || undefined;
-        const sourceSession = c.req.query("sourceSession") || undefined;
-        const stateRaw = c.req.query("state") || undefined;
-        const targetRepo = c.req.query("targetRepo") || undefined;
-        const userLimit = c.req.query("limit") ? Number.parseInt(c.req.query("limit"), 10) : undefined;
-        const asSession = c.req.query("as") || undefined;
-        const compact = c.req.query("compact") === "1";
-        const rig = c.req.query("rig") || undefined;
-        const activeOnly = c.req.query("activeOnly") === "1";
-        const attention = c.req.query("attention") === "1";
-        const state = stateRaw
-            ? stateRaw.split(",")
-            : attention
-                ? ["pending", "in-progress", "blocked"]
-                : undefined;
-        if (!attention) {
-            const items = getRepo(c).list({
-                destinationSession,
-                sourceSession,
-                state,
-                targetRepo,
-                limit: userLimit,
-                asSession,
-                compact,
-                rig,
-                activeOnly,
-            });
-            return c.json(items);
-        }
-        // OPR.0.3.2.20 — attention path goes through
-        // QueueRepository.listAttention, which pushes the attention
-        // predicate INTO the SQL WHERE clause so the LIMIT applies AFTER
-        // attention filtering. Window-independent by construction: an
-        // old human-gate item is never evicted by routine open qitems,
-        // however many of them land after it (guard re-verify
-        // qitem-20260518190827 BLOCKER 1). The earlier fetch-then-filter
-        // shape (ATTENTION_FETCH_BOUND) is gone — the LIMIT bound is the
-        // user-facing one only, applied at the SQL layer post-predicate.
-        //
-        // destinationSession/sourceSession/targetRepo are composable with
-        // the attention predicate at the SQL layer (guard re-verify
-        // qitem-20260518192210 BLOCKER 1 — the previous forward-fix
-        // dropped composition). Scoped attention queries (e.g.,
-        // attention=1&destinationSession=...) return ONLY the matching
-        // attention items.
-        const items = getRepo(c).listAttention({
-            limit: userLimit,
-            state,
-            destinationSession,
-            sourceSession,
-            targetRepo,
-        });
-        // Defense-in-depth: refine with the JS predicate so the SQL
-        // LIKE superset cannot leak a malformed destination through.
-        const filtered = items.filter(isAttentionItem);
-        return c.json(filtered);
-    });
-    // GET /overdue — surfaces in-progress qitems past closure_required_at.
-    // MUST precede /:qitemId.
-    app.get("/overdue", (c) => {
-        // Slice 15 (finding 2): rig-scoped + bounded + compact-by-default, mirroring
-        // /list — so `rig queue overdue` no longer dumps every rig's full bodies.
-        const q = c.req.query();
-        const rig = q.rig || undefined;
-        const limitRaw = q.limit !== undefined ? Number.parseInt(q.limit, 10) : undefined;
-        const limit = limitRaw !== undefined && Number.isInteger(limitRaw) && limitRaw > 0 ? limitRaw : undefined;
-        const compact = q.compact === "1" || q.compact === "true";
-        const items = getRepo(c).findOverdue({ rig, limit, compact });
-        return c.json(items);
-    });
-    // GET /undelivered — surfaces pending create-path nudge failures plus active
-    // human-notification episodes whose gateway delivery ledger failed or never posted.
-    // Rig-scoped + bounded + compact-by-default, mirroring /overdue.
-    // MUST precede /:qitemId. READ-only (no retry — DR-2 is PM-gated on this surface's measurement).
-    app.get("/undelivered", (c) => {
-        const q = c.req.query();
-        const rig = q.rig || undefined;
-        const limitRaw = q.limit !== undefined ? Number.parseInt(q.limit, 10) : undefined;
-        const limit = limitRaw !== undefined && Number.isInteger(limitRaw) && limitRaw > 0 ? limitRaw : undefined;
-        const compact = q.compact === "1" || q.compact === "true";
-        const items = getRepo(c).findUndelivered({ rig, limit, compact });
-        // 0.5.1-54 classifier fold (PM ruling): LABEL each strand transient vs permanent-topology so the
-        // count is actionable — permanent-topology (destination unresolvable on this daemon) routes to the
-        // addressing family, not retry; transient is the only class a future DR-2 (held n=1) would touch.
-        // OPR.0.5.6.14 — the LEDGER class wins when the repo derived one
-        // (transport-failed / never-posted); the nudge-literal regex classifies
-        // only the legacy pane-bound strands.
-        const classified = items.map((it) => ({ ...it, deliveryFailureClass: it.deliveryFailureClass ?? classifyNudgeFailure(it.lastNudgeResult) }));
-        return c.json(classified);
-    });
-    // GET /recent-transitions — one bounded, read-only topology chronology over
-    // typed queue state/closure facts. `scope=instance` spans local rigs in ONE
-    // read; a rig query stays backward-compatible. MUST precede /:qitemId.
-    app.get("/recent-transitions", (c) => {
-        const scopeKind = c.req.query("scope")?.trim();
-        const rig = c.req.query("rig")?.trim();
-        if (scopeKind && scopeKind !== "instance" && scopeKind !== "rig") {
-            return c.json({ error: "invalid_scope", message: "scope must be instance or rig" }, 400);
-        }
-        if (scopeKind !== "instance" && !rig) {
-            return c.json({ error: "rig_required", message: "rig is required for a rig RECENT read" }, 400);
-        }
-        const raw = c.req.query("limit");
-        const parsed = raw == null ? 20 : Number.parseInt(raw, 10);
-        const limit = Number.isInteger(parsed) && parsed > 0 ? parsed : 20;
-        const scope = scopeKind === "instance"
-            ? { kind: "instance" }
-            : { kind: "rig", rig: rig };
-        return c.json(getRepo(c).listRecentTransitions(scope, limit));
-    });
-    // ---- SSE watch over coordination events ----
-    // MUST precede /:qitemId so the literal `watch` and `sse` paths win
-    // over the bare-param route (otherwise GET /api/queue/sse resolves as
-    // /:qitemId with qitemId="sse" and returns 404 qitem_not_found).
-    // Mounted at both /watch (legacy alias) and /sse (Phase A contract per IMPL).
-    // Same handler; either path emits the identical event stream.
-    const sseHandler = (c) => {
-        const eventBus = getEventBus(c);
-        return streamSSE(c, async (stream) => {
-            const unsubscribe = eventBus.subscribe((event) => {
-                if (event.type !== "queue.created" &&
-                    event.type !== "queue.handed_off" &&
-                    event.type !== "queue.claimed" &&
-                    event.type !== "queue.unclaimed" &&
-                    event.type !== "qitem.fallback_routed" &&
-                    event.type !== "qitem.closure_overdue" &&
-                    event.type !== "inbox.absorbed" &&
-                    event.type !== "inbox.denied")
-                    return;
-                const sse = { id: String(event.seq), data: JSON.stringify(event) };
-                stream.writeSSE(sse).catch(() => { });
-            });
-            try {
-                await new Promise((resolve) => {
-                    stream.onAbort(() => resolve());
-                });
-            }
-            finally {
-                unsubscribe();
-            }
-        });
-    };
-    app.get("/watch", sseHandler);
-    app.get("/sse", sseHandler);
-    // GET /:qitemId/transitions — registered before /:qitemId so the literal
-    // suffix wins over the bare param route.
-    app.get("/:qitemId/transitions", (c) => {
-        const qitemId = c.req.param("qitemId");
-        const repo = getRepo(c);
-        if (!repo.getById(qitemId))
-            return c.json({ error: "qitem_not_found" }, 404);
-        return c.json(repo.listTransitions(qitemId));
-    });
-    // GET /:qitemId — show one
-    app.get("/:qitemId", (c) => {
-        const qitemId = c.req.param("qitemId");
-        const item = getRepo(c).getById(qitemId);
-        if (!item)
-            return c.json({ error: "qitem_not_found" }, 404);
-        return c.json(item);
-    });
-    // ---- Inbox routes (mailbox) ----
-    app.post("/inbox/drop", async (c) => {
-        // P18 sender-provenance: the sender is DERIVED from the authenticated transport header (stamped
-        // once by the CLI from the seat env), NEVER from the request body. senderSession/authenticatedSender
-        // are intentionally NOT read from the body — a body-supplied identity is forgeable false history in
-        // the channel of record (inbox_entries.sender_session → absorb → the receiver's queue).
-        const body = await c.req.json().catch(() => ({}));
-        // P18 SWEEP (actor-to-label test): the sender is DERIVED from the transport header, NEVER the body
-        // — a body-supplied identity is forgeable false history. No body claim is read, so with no header
-        // there is no actor at all to LABEL → 400 actor_required (parameter completeness, the queue.ts:215
-        // class), NOT the retired 401 refusal-of-an-uncertifiable-sender. Converges on the shape
-        // resolveActorWithDeferral already uses for nothing-to-record.
-        const identity = requireSenderIdentity(c, { verb: "inbox drop" });
-        if (!identity.ok)
-            return identity.response;
-        const senderSession = identity.session; // transport-derived, authoritative
-        if (!body.destinationSession)
-            return c.json({ error: "destinationSession is required" }, 400);
-        if (!body.body)
-            return c.json({ error: "body is required" }, 400);
-        try {
-            const entry = getInbox(c).drop({
-                inboxId: body.inboxId,
-                destinationSession: body.destinationSession,
-                senderSession, // transport-derived, authoritative
-                body: body.body,
-                tags: body.tags,
-                urgency: body.urgency,
-                auditPointer: body.auditPointer,
-                identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 (or relay:v1 on a relayed hop) — no body sender is read, so claimed:v1 cannot arise here
-            });
-            return c.json(entry, 201);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    app.post("/inbox/:inboxId/absorb", async (c) => {
-        const inboxId = c.req.param("inboxId");
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3: the receiver is the transport-derived sender, never body.receiverSession.
-        const identity = requireSenderIdentity(c, { verb: "inbox absorb", bodyClaim: body.receiverSession });
-        if (!identity.ok)
-            return identity.response;
-        try {
-            const result = await getInbox(c).absorb(inboxId, identity.session, resolveRecordedProvenance(c, identity));
-            return c.json(result);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    app.post("/inbox/:inboxId/deny", async (c) => {
-        const inboxId = c.req.param("inboxId");
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3: the receiver is the transport-derived sender, never body.receiverSession.
-        const identity = requireSenderIdentity(c, { verb: "inbox deny", bodyClaim: body.receiverSession });
-        if (!identity.ok)
-            return identity.response;
-        if (!body.reason)
-            return c.json({ error: "reason is required" }, 400);
-        try {
-            const entry = getInbox(c).deny(inboxId, identity.session, body.reason);
-            return c.json(entry);
-        }
-        catch (err) {
-            return errorResponse(c, err);
-        }
-    });
-    app.get("/inbox/pending", (c) => {
-        const destinationSession = c.req.query("destinationSession");
-        if (!destinationSession)
-            return c.json({ error: "destinationSession is required" }, 400);
-        return c.json(getInbox(c).listPending(destinationSession));
-    });
-    app.get("/inbox/list", (c) => {
-        const destinationSession = c.req.query("destinationSession");
-        if (!destinationSession)
-            return c.json({ error: "destinationSession is required" }, 400);
-        const limit = c.req.query("limit") ? Number.parseInt(c.req.query("limit"), 10) : undefined;
-        return c.json(getInbox(c).listForDestination(destinationSession, limit));
-    });
-    // ---- Outbox routes ----
-    app.post("/outbox/record", async (c) => {
-        const body = await c.req.json().catch(() => ({}));
-        // P21 I3: the outbox sender is the transport-derived identity, never body.senderSession.
-        const identity = requireSenderIdentity(c, { verb: "outbox record", bodyClaim: body.senderSession });
-        if (!identity.ok)
-            return identity.response;
-        if (!body.destinationSession)
-            return c.json({ error: "destinationSession is required" }, 400);
-        if (!body.body)
-            return c.json({ error: "body is required" }, 400);
-        const entry = getOutbox(c).record({
-            outboxId: body.outboxId,
-            senderSession: identity.session,
-            destinationSession: body.destinationSession,
-            body: body.body,
-            tags: body.tags,
-            urgency: body.urgency,
-            auditPointer: body.auditPointer,
-            identityProvenance: resolveRecordedProvenance(c, identity), // P21 §4 era-stamp: transport:v1 if the header proved it here, else claimed:v1 (resolveRecordedProvenance degrades)
-        });
-        return c.json(entry, 201);
-    });
-    app.get("/outbox/list", (c) => {
-        const senderSession = c.req.query("senderSession");
-        if (!senderSession)
-            return c.json({ error: "senderSession is required" }, 400);
-        const limit = c.req.query("limit") ? Number.parseInt(c.req.query("limit"), 10) : undefined;
-        return c.json(getOutbox(c).listForSender(senderSession, limit));
-    });
-    return app;
-}
-//# sourceMappingURL=queue.js.map