@oscharko-dev/keiko-server 0.2.7 → 0.2.8

package/dist/store/schema.js

@@ -1,7 +1,7 @@
 // ADR-0013 D5 — Schema v1 + migration runner via PRAGMA user_version. Forward-only, idempotent,
 // transactional. Each migration is a `.sql` string of one or more CREATE/ALTER statements; the
 // runner applies migrations whose 1-based index > current user_version.
-export const SCHEMA_VERSION = 5;
+export const SCHEMA_VERSION = 6;
 const V1_SQL = `
 CREATE TABLE projects (
   path TEXT NOT NULL PRIMARY KEY,
@@ -184,12 +184,18 @@ CREATE INDEX idx_relationship_audit_relationship
   ON relationship_audit_entries(workspace_id, relationship_id, occurred_at)
   WHERE relationship_id IS NOT NULL;
 `;
+// V6 — persist the redacted, browser-safe grounded answer projection on assistant messages.
+// This stores citation metadata and context summaries only, not retrieved excerpt contents.
+const V6_SQL = `
+ALTER TABLE chat_messages ADD COLUMN grounded_answer_json TEXT;
+`;
 const MIGRATIONS = [
     { version: 1, sql: V1_SQL },
     { version: 2, sql: V2_SQL },
     { version: 3, sql: V3_SQL },
     { version: 4, sql: V4_SQL },
     { version: 5, sql: V5_SQL },
+    { version: 6, sql: V6_SQL },
 ];
 function currentUserVersion(db) {
     const row = db.prepare("PRAGMA user_version").get();

package/dist/store/types.d.ts

@@ -1,5 +1,5 @@
-import type { Project, Chat, ChatConnectedScope, ChatLocalKnowledgeScope, ChatRole, WorkflowStatus, ChatMessage, CreateChatOptions, UpdateProjectPatch, UpdateChatPatch, NewChatMessage, UpdateChatMessagePatch } from "@oscharko-dev/keiko-contracts/bff-wire";
-export type { Project, Chat, ChatConnectedScope, ChatLocalKnowledgeScope, ChatRole, WorkflowStatus, ChatMessage, CreateChatOptions, UpdateProjectPatch, UpdateChatPatch, NewChatMessage, UpdateChatMessagePatch, };
+import type { Project, Chat, ChatConnectedScope, ChatLocalKnowledgeScope, ChatRole, WorkflowStatus, ChatMessage, CreateChatOptions, GroundedAnswer, UpdateProjectPatch, UpdateChatPatch, NewChatMessage, UpdateChatMessagePatch } from "@oscharko-dev/keiko-contracts/bff-wire";
+export type { Project, Chat, ChatConnectedScope, ChatLocalKnowledgeScope, ChatRole, WorkflowStatus, ChatMessage, CreateChatOptions, GroundedAnswer, UpdateProjectPatch, UpdateChatPatch, NewChatMessage, UpdateChatMessagePatch, };
 export interface UiStore {
     readonly listProjects: () => readonly Project[];
     readonly createProject: (path: string, name?: string) => Project;
@@ -15,6 +15,7 @@ export interface UiStore {
     readonly createMessage: (msg: NewChatMessage) => ChatMessage;
     readonly createMessages: (messages: readonly NewChatMessage[]) => readonly ChatMessage[];
     readonly updateMessage: (id: string, patch: UpdateChatMessagePatch) => ChatMessage;
+    readonly attachGroundedAnswer: (id: string, answer: GroundedAnswer) => ChatMessage;
     readonly close: () => void;
 }
 export interface UpdateChatOptions {

package/dist/store/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACvB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;IAC7E,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C,QAAQ,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC;IAC7E,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,iBAAiB,KACrB,IAAI,CAAC;IACV,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE1C,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,WAAW,EAAE,CAAC;IAClF,QAAQ,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,WAAW,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,KAAK,SAAS,WAAW,EAAE,CAAC;IACzF,QAAQ,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,KAAK,WAAW,CAAC;IAEnF,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/store/types.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,EACvB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EACV,OAAO,EACP,IAAI,EACJ,kBAAkB,EAClB,uBAAuB,EACvB,QAAQ,EACR,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,sBAAsB,GACvB,CAAC;AAEF,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,SAAS,OAAO,EAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC;IACjE,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,KAAK,OAAO,CAAC;IAC7E,QAAQ,CAAC,aAAa,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/C,QAAQ,CAAC,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,IAAI,EAAE,CAAC;IAC7E,QAAQ,CAAC,YAAY,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,CACnB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,IAAI,CAAC,EAAE,iBAAiB,KACrB,IAAI,CAAC;IACV,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC/F,QAAQ,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAE1C,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK,SAAS,WAAW,EAAE,CAAC;IAClF,QAAQ,CAAC,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,WAAW,GAAG,SAAS,CAAC;IAClE,QAAQ,CAAC,aAAa,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,WAAW,CAAC;IAC7D,QAAQ,CAAC,cAAc,EAAE,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,KAAK,SAAS,WAAW,EAAE,CAAC;IACzF,QAAQ,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,KAAK,WAAW,CAAC;IACnF,QAAQ,CAAC,oBAAoB,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,KAAK,WAAW,CAAC;IAEnF,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;CAC5C;AAID,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC;CACnD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oscharko-dev/keiko-server",
-  "version": "0.2.7",
+  "version": "0.2.8",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Internal server package: local loopback BFF runtime (HTTP/SSE/WebSocket router, CSP, host check, CSRF gate, terminal, browser, files, run engine, SQLite-backed UI store) that mediates the browser presentation tier and the Node-side domain packages (ADR-0019). Not published independently.",
@@ -29,24 +29,24 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@oscharko-dev/keiko-contracts": "0.2.7",
-    "@oscharko-dev/keiko-security": "0.2.7",
-    "@oscharko-dev/keiko-model-gateway": "0.2.7",
-    "@oscharko-dev/keiko-quality-intelligence": "0.2.7",
-    "@oscharko-dev/keiko-local-knowledge": "0.2.7",
-    "@oscharko-dev/keiko-workspace": "0.2.7",
-    "@oscharko-dev/keiko-sandbox": "0.2.7",
-    "@oscharko-dev/keiko-tools": "0.2.7",
-    "@oscharko-dev/keiko-evidence": "0.2.7",
-    "@oscharko-dev/keiko-verification": "0.2.7",
-    "@oscharko-dev/keiko-harness": "0.2.7",
-    "@oscharko-dev/keiko-sdk": "0.2.7",
-    "@oscharko-dev/keiko-workflows": "0.2.7",
-    "@oscharko-dev/keiko-memory-vault": "0.2.7",
-    "@oscharko-dev/keiko-memory-governance": "0.2.7",
-    "@oscharko-dev/keiko-memory-retrieval": "0.2.7",
-    "@oscharko-dev/keiko-memory-capture": "0.2.7",
-    "@oscharko-dev/keiko-memory-consolidation": "0.2.7",
+    "@oscharko-dev/keiko-contracts": "0.2.8",
+    "@oscharko-dev/keiko-security": "0.2.8",
+    "@oscharko-dev/keiko-model-gateway": "0.2.8",
+    "@oscharko-dev/keiko-quality-intelligence": "0.2.8",
+    "@oscharko-dev/keiko-local-knowledge": "0.2.8",
+    "@oscharko-dev/keiko-workspace": "0.2.8",
+    "@oscharko-dev/keiko-sandbox": "0.2.8",
+    "@oscharko-dev/keiko-tools": "0.2.8",
+    "@oscharko-dev/keiko-evidence": "0.2.8",
+    "@oscharko-dev/keiko-verification": "0.2.8",
+    "@oscharko-dev/keiko-harness": "0.2.8",
+    "@oscharko-dev/keiko-sdk": "0.2.8",
+    "@oscharko-dev/keiko-workflows": "0.2.8",
+    "@oscharko-dev/keiko-memory-vault": "0.2.8",
+    "@oscharko-dev/keiko-memory-governance": "0.2.8",
+    "@oscharko-dev/keiko-memory-retrieval": "0.2.8",
+    "@oscharko-dev/keiko-memory-capture": "0.2.8",
+    "@oscharko-dev/keiko-memory-consolidation": "0.2.8",
     "typescript": "^6.0.3"
   }
 }

package/dist/grounded-handoff.d.ts

@@ -1,4 +0,0 @@
-import { type UiHandlerDeps } from "./deps.js";
-import type { RouteContext, RouteResult } from "./routes.js";
-export declare function handleGroundedWorkflowHandoff(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
-//# sourceMappingURL=grounded-handoff.d.ts.map

package/dist/grounded-handoff.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"grounded-handoff.d.ts","sourceRoot":"","sources":["../src/grounded-handoff.ts"],"names":[],"mappings":"AAmBA,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAYxE,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA8hB7D,wBAAsB,6BAA6B,CACjD,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAOtB"}

package/dist/grounded-handoff.js

@@ -1,445 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { DEFAULT_PATCH_SCOPE_LIMITS, EXPECTED_CHECKS, WORKFLOW_HANDOFF_SCHEMA_VERSION, WORKFLOW_KINDS, validateWorkflowHandoffRequest, } from "@oscharko-dev/keiko-contracts/workflow-handoff";
-import { createAuditRedactor } from "@oscharko-dev/keiko-evidence";
-import { WorkspaceError } from "@oscharko-dev/keiko-workspace";
-import { currentRedactionSecrets } from "./deps.js";
-import { approvalTokenInputFor, contextPackStableIdForPacks, createApprovalToken, evidenceAtomIdsForPacks, readOnlyPathsForPacks, } from "./governed-workflow.js";
-import { lookupGroundedTurn } from "./grounded-turn-registry.js";
-import { startRun } from "./run-engine.js";
-import { parseRunRequest } from "./run-request.js";
-import { ActiveRunLimitError } from "./runs.js";
-import { errorBody } from "./routes.js";
-import { memoryCaptureCustomerMatchers } from "./memory-capture-policy.js";
-const MAX_BODY_BYTES = 256 * 1024;
-const RESERVED_WORKFLOW_INPUT_FIELDS = new Set([
-    "apply",
-    "governedHandoff",
-    "limits",
-    "modelId",
-    "workflowHandoff",
-    "workspaceRoot",
-]);
-const VERIFY_NOOP_MODEL = {
-    call: () => Promise.reject(new Error("verify runs must not call the model")),
-};
-class BodyTooLargeError extends Error {
-    constructor() {
-        super("request body too large");
-        this.name = "BodyTooLargeError";
-    }
-}
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        const chunks = [];
-        let total = 0;
-        let capped = false;
-        req.on("data", (chunk) => {
-            total += chunk.length;
-            if (total > MAX_BODY_BYTES) {
-                if (!capped) {
-                    capped = true;
-                    chunks.length = 0;
-                    reject(new BodyTooLargeError());
-                    req.resume();
-                }
-                return;
-            }
-            chunks.push(chunk);
-        });
-        req.on("end", () => {
-            if (!capped) {
-                resolve(Buffer.concat(chunks).toString("utf8"));
-            }
-        });
-        req.on("error", reject);
-    });
-}
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isExpectedCheck(value) {
-    return typeof value === "string" && EXPECTED_CHECKS.includes(value);
-}
-function isWorkflowKind(value) {
-    return typeof value === "string" && WORKFLOW_KINDS.includes(value);
-}
-function parseJsonRecord(raw) {
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        return { status: 400, body: errorBody("BAD_REQUEST", "Request body is not valid JSON.") };
-    }
-    if (!isRecord(parsed)) {
-        return { status: 400, body: errorBody("BAD_REQUEST", "Request body must be a JSON object.") };
-    }
-    return parsed;
-}
-function isRouteResult(value) {
-    return isRecord(value) && typeof value.status === "number" && "body" in value;
-}
-function badField(field, message) {
-    return {
-        status: 400,
-        body: errorBody("BAD_REQUEST", `Field "${field}" ${message}.`),
-    };
-}
-function requireString(body, field) {
-    const value = body[field];
-    if (typeof value !== "string" || value.length === 0) {
-        return badField(field, "is required");
-    }
-    return value;
-}
-function requireNumber(body, field) {
-    const value = body[field];
-    if (typeof value !== "number" || !Number.isFinite(value)) {
-        return badField(field, "must be a finite number");
-    }
-    return value;
-}
-function requireRecord(body, field) {
-    const value = body[field];
-    if (!isRecord(value)) {
-        return badField(field, "must be an object");
-    }
-    return value;
-}
-function validateWorkflowInput(input) {
-    for (const field of RESERVED_WORKFLOW_INPUT_FIELDS) {
-        if (Object.prototype.hasOwnProperty.call(input, field)) {
-            return badField("input", `must not include reserved workflow field "${field}"`);
-        }
-    }
-    return null;
-}
-function stringArrayField(body, field) {
-    const value = body[field];
-    if (!Array.isArray(value)) {
-        return badField(field, "must be an array");
-    }
-    const parsed = [];
-    for (const entry of value) {
-        if (typeof entry !== "string" || entry.trim().length === 0) {
-            return badField(field, "must contain non-empty strings");
-        }
-        parsed.push(entry);
-    }
-    return parsed;
-}
-function defaultExpectedChecks(workflowKind) {
-    if (workflowKind === "unit-test-generation") {
-        return ["tests"];
-    }
-    return ["verify"];
-}
-function parseExpectedChecks(body, workflowKind) {
-    if (body.expectedChecks === undefined) {
-        return defaultExpectedChecks(workflowKind);
-    }
-    const parsed = stringArrayField(body, "expectedChecks");
-    if (isRouteResult(parsed)) {
-        return parsed;
-    }
-    if (!parsed.every(isExpectedCheck)) {
-        return {
-            status: 400,
-            body: errorBody("BAD_REQUEST", 'Field "expectedChecks" contains an unknown check.'),
-        };
-    }
-    return parsed;
-}
-function parseWorkflowKindField(body) {
-    const workflowKind = requireString(body, "workflowKind");
-    if (isRouteResult(workflowKind)) {
-        return workflowKind;
-    }
-    return isWorkflowKind(workflowKind)
-        ? workflowKind
-        : { status: 400, body: errorBody("BAD_REQUEST", 'Field "workflowKind" is invalid.') };
-}
-function parseUnknowns(body) {
-    return body.unknowns === undefined ? [] : stringArrayField(body, "unknowns");
-}
-function parseRequiredFields(body) {
-    const workflowKind = parseWorkflowKindField(body);
-    if (isRouteResult(workflowKind)) {
-        return workflowKind;
-    }
-    const assistantMessageId = requireString(body, "assistantMessageId");
-    if (isRouteResult(assistantMessageId)) {
-        return assistantMessageId;
-    }
-    const chatId = requireString(body, "chatId");
-    if (isRouteResult(chatId)) {
-        return chatId;
-    }
-    const modelId = requireString(body, "modelId");
-    if (isRouteResult(modelId)) {
-        return modelId;
-    }
-    const input = requireRecord(body, "input");
-    if (isRouteResult(input)) {
-        return input;
-    }
-    const inputError = validateWorkflowInput(input);
-    if (inputError !== null) {
-        return inputError;
-    }
-    return { assistantMessageId, chatId, modelId, workflowKind, input };
-}
-function parseBody(raw) {
-    const body = parseJsonRecord(raw);
-    if (isRouteResult(body)) {
-        return body;
-    }
-    const required = parseRequiredFields(body);
-    if (isRouteResult(required)) {
-        return required;
-    }
-    const editablePaths = stringArrayField(body, "editablePaths");
-    if (isRouteResult(editablePaths)) {
-        return editablePaths;
-    }
-    const unknowns = parseUnknowns(body);
-    if (isRouteResult(unknowns)) {
-        return unknowns;
-    }
-    const requestedAtMs = requireNumber(body, "requestedAtMs");
-    if (isRouteResult(requestedAtMs)) {
-        return requestedAtMs;
-    }
-    const expectedChecks = parseExpectedChecks(body, required.workflowKind);
-    if (isRouteResult(expectedChecks)) {
-        return expectedChecks;
-    }
-    return {
-        ...required,
-        editablePaths,
-        expectedChecks,
-        unknowns,
-        requestedAtMs,
-    };
-}
-function workspaceRootForTurn(record) {
-    const roots = new Set(record?.packs.map((pack) => pack.scope.workspaceRoot) ?? []);
-    if (roots.size !== 1) {
-        return {
-            status: 409,
-            body: errorBody("BAD_REQUEST", "Grounded handoff requires evidence from a single connected workspace root."),
-        };
-    }
-    const root = [...roots][0];
-    if (typeof root !== "string" || root.length === 0) {
-        return {
-            status: 404,
-            body: errorBody("NOT_FOUND", "Grounded handoff context is no longer available."),
-        };
-    }
-    return root;
-}
-function runRequestFor(workflowKind, modelId, workspaceRoot, input) {
-    const parsed = parseRunRequest(JSON.stringify({
-        ...(workflowKind === "verification" ? { taskType: "verify" } : { workflowId: workflowKind }),
-        modelId,
-        input: { ...input, workspaceRoot },
-    }));
-    if ("code" in parsed) {
-        return { status: 400, body: errorBody(parsed.code, parsed.message) };
-    }
-    return parsed;
-}
-function summaryDiscriminator(workflowKind) {
-    if (workflowKind === "verification") {
-        return { workflowId: undefined, taskType: "verify" };
-    }
-    return { workflowId: workflowKind, taskType: undefined };
-}
-function workflowLabel(workflowKind) {
-    if (workflowKind === "unit-test-generation") {
-        return "grounded unit-test generation";
-    }
-    if (workflowKind === "bug-investigation") {
-        return "grounded bug investigation";
-    }
-    return "grounded verification";
-}
-function persistGroundedHandoffMessages(deps, chatId, workflowKind, runId) {
-    const now = Date.now();
-    const discriminator = summaryDiscriminator(workflowKind);
-    const label = workflowLabel(workflowKind);
-    const [user, summary] = deps.store.createMessages([
-        {
-            chatId,
-            role: "user",
-            content: `Requested ${label}.`,
-            timestamp: now,
-            runId: undefined,
-            workflowId: undefined,
-            workflowStatus: undefined,
-            shortResult: undefined,
-            taskType: undefined,
-        },
-        {
-            chatId,
-            role: "system",
-            content: `Launched ${label}.`,
-            timestamp: now + 1,
-            runId,
-            workflowId: discriminator.workflowId,
-            workflowStatus: "running",
-            shortResult: undefined,
-            taskType: discriminator.taskType,
-        },
-    ]);
-    if (user === undefined || summary === undefined) {
-        throw new Error("createMessages returned fewer rows than expected");
-    }
-    return [user, summary];
-}
-function resolveRunModel(request, deps) {
-    return request.kind === "verify" ? VERIFY_NOOP_MODEL : deps.modelPortFactory(request.modelId);
-}
-function engineContextFor(deps, request, model) {
-    return {
-        request,
-        model,
-        registry: deps.registry,
-        evidence: {
-            store: deps.evidenceStore,
-            env: deps.env,
-            additionalSecrets: currentRedactionSecrets(deps),
-        },
-        memoryVault: deps.memoryVault,
-        memoryAuditRedactString: createAuditRedactor({ additionalSecrets: currentRedactionSecrets(deps) }, deps.env),
-        memoryCustomerIdentifierMatchers: memoryCaptureCustomerMatchers(deps),
-    };
-}
-function markSummaryFailed(deps, message, shortResult) {
-    try {
-        deps.store.updateMessage(message.id, { workflowStatus: "failed", shortResult });
-    }
-    catch {
-        // best-effort compensation only
-    }
-}
-function mapRunStartError(error) {
-    if (error instanceof ActiveRunLimitError) {
-        return { status: 429, body: errorBody("TOO_MANY_RUNS", "The active run limit is reached.") };
-    }
-    if (error instanceof WorkspaceError) {
-        return {
-            status: 400,
-            body: errorBody("WORKSPACE_UNAVAILABLE", "The selected workspace could not be prepared: no recognized project workspace marker was found, or the target file could not be read."),
-        };
-    }
-    throw error;
-}
-function buildGovernedHandoffRequest(body, record) {
-    const patchScope = {
-        schemaVersion: WORKFLOW_HANDOFF_SCHEMA_VERSION,
-        editablePaths: body.editablePaths,
-        readOnlyPaths: readOnlyPathsForPacks(record.packs, body.editablePaths),
-        evidenceAtomIds: evidenceAtomIdsForPacks(record.packs),
-        limits: DEFAULT_PATCH_SCOPE_LIMITS,
-        expectedChecks: body.expectedChecks,
-        unknowns: body.unknowns,
-    };
-    const draft = {
-        schemaVersion: WORKFLOW_HANDOFF_SCHEMA_VERSION,
-        contextPackStableId: contextPackStableIdForPacks(record.packs),
-        workflowKind: body.workflowKind,
-        patchScope,
-        requestedAtMs: body.requestedAtMs,
-        userApprovalToken: "0".repeat(64),
-    };
-    const request = {
-        ...draft,
-        userApprovalToken: createApprovalToken(approvalTokenInputFor(draft)),
-    };
-    const validation = validateWorkflowHandoffRequest(request);
-    if (!validation.ok) {
-        return {
-            status: 400,
-            body: errorBody("BAD_REQUEST", validation.reasons.join("; ")),
-        };
-    }
-    return request;
-}
-async function parseGroundedHandoffBody(req) {
-    try {
-        return parseBody(await readBody(req));
-    }
-    catch (error) {
-        if (error instanceof BodyTooLargeError) {
-            return {
-                status: 413,
-                body: errorBody("PAYLOAD_TOO_LARGE", "Request body exceeds the size limit."),
-            };
-        }
-        throw error;
-    }
-}
-function resolveGroundedHandoffLaunch(body, deps) {
-    const record = lookupGroundedTurn(body.assistantMessageId);
-    if (record === undefined) {
-        return {
-            status: 404,
-            body: errorBody("NOT_FOUND", "Grounded handoff context is no longer available."),
-        };
-    }
-    if (record.chatId !== body.chatId) {
-        return {
-            status: 404,
-            body: errorBody("NOT_FOUND", "Grounded handoff context is no longer available."),
-        };
-    }
-    const workspaceRoot = workspaceRootForTurn(record);
-    if (isRouteResult(workspaceRoot)) {
-        return workspaceRoot;
-    }
-    const governedHandoff = buildGovernedHandoffRequest(body, record);
-    if (isRouteResult(governedHandoff)) {
-        return governedHandoff;
-    }
-    const baseRequest = runRequestFor(body.workflowKind, body.modelId, workspaceRoot, body.input);
-    if (isRouteResult(baseRequest)) {
-        return baseRequest;
-    }
-    const request = {
-        ...baseRequest,
-        governedHandoff,
-        governedHandoffSourceGroundedRunId: record.evidenceRunId,
-    };
-    const model = resolveRunModel(request, deps);
-    if (model === undefined) {
-        return { status: 400, body: errorBody("NO_MODEL", "No model provider is configured.") };
-    }
-    return { chatId: record.chatId, workflowKind: body.workflowKind, request, model };
-}
-function startGroundedWorkflowRun(deps, launch) {
-    const runId = randomUUID();
-    const messages = persistGroundedHandoffMessages(deps, launch.chatId, launch.workflowKind, runId);
-    try {
-        const run = startRun(engineContextFor(deps, launch.request, launch.model), deps.redactor, {
-            runId,
-        });
-        return {
-            status: 202,
-            body: { run, messages },
-        };
-    }
-    catch (error) {
-        markSummaryFailed(deps, messages[1], "Run could not be started.");
-        return mapRunStartError(error);
-    }
-}
-export async function handleGroundedWorkflowHandoff(ctx, deps) {
-    const body = await parseGroundedHandoffBody(ctx.req);
-    if (isRouteResult(body)) {
-        return body;
-    }
-    const launch = resolveGroundedHandoffLaunch(body, deps);
-    return isRouteResult(launch) ? launch : startGroundedWorkflowRun(deps, launch);
-}