@profullstack/agenticjobs 0.1.0

package/dist/schema/query.js

@@ -0,0 +1,103 @@
+/**
+ * One query shape, used by the page, the API, MCP, the CLI and the federated
+ * search across instances.
+ *
+ * Federation is the reason this is a declared type rather than whatever
+ * querystring each surface felt like parsing: a search fanned out to twelve
+ * instances has to mean the same thing on all of them, and an instance running
+ * an older release has to be able to ignore a field it does not know without
+ * silently returning the wrong set.
+ */
+import { isAgentPolicy, isEmploymentType, isSeniority, isWorkplace, } from "./job.js";
+export const SORTS = ['recent', 'relevant', 'salary'];
+export const MAX_LIMIT = 100;
+export const EMPTY_QUERY = {
+    q: null,
+    employmentType: null,
+    workplace: null,
+    seniority: null,
+    agentPolicy: null,
+    tags: [],
+    salaryMin: null,
+    org: null,
+    sort: 'recent',
+    limit: 25,
+    offset: 0,
+};
+function one(params, key) {
+    const value = params.get(key);
+    if (value === null)
+        return null;
+    const trimmed = value.trim();
+    return trimmed === '' ? null : trimmed;
+}
+function integer(value, fallback, min, max) {
+    if (value === null)
+        return fallback;
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isFinite(parsed))
+        return fallback;
+    return Math.min(max, Math.max(min, parsed));
+}
+/**
+ * Parse a querystring into a query.
+ *
+ * Unknown values are dropped rather than rejected. A filter this instance does
+ * not understand must not turn a federated search into an error on one node
+ * and a result set on the rest — the user would see a shorter list and no
+ * explanation.
+ */
+export function parseQuery(params) {
+    const employmentType = one(params, 'employmentType');
+    const workplace = one(params, 'workplace');
+    const seniority = one(params, 'seniority');
+    const agentPolicy = one(params, 'agentPolicy');
+    const sort = one(params, 'sort');
+    const salaryMin = one(params, 'salaryMin');
+    return {
+        q: one(params, 'q'),
+        employmentType: isEmploymentType(employmentType) ? employmentType : null,
+        workplace: isWorkplace(workplace) ? workplace : null,
+        seniority: isSeniority(seniority) ? seniority : null,
+        agentPolicy: isAgentPolicy(agentPolicy) ? agentPolicy : null,
+        tags: params
+            .getAll('tag')
+            .flatMap((value) => value.split(','))
+            .map((value) => value.trim().toLowerCase())
+            .filter((value) => value !== '')
+            .slice(0, 10),
+        salaryMin: salaryMin === null ? null : integer(salaryMin, 0, 0, 100_000_000) || null,
+        org: one(params, 'org'),
+        sort: sort !== null && SORTS.includes(sort) ? sort : 'recent',
+        limit: integer(one(params, 'limit'), 25, 1, MAX_LIMIT),
+        offset: integer(one(params, 'offset'), 0, 0, 100_000),
+    };
+}
+/** The inverse, so a client can rebuild a link to the search it just ran. */
+export function queryToParams(query) {
+    const params = new URLSearchParams();
+    if (query.q)
+        params.set('q', query.q);
+    if (query.employmentType)
+        params.set('employmentType', query.employmentType);
+    if (query.workplace)
+        params.set('workplace', query.workplace);
+    if (query.seniority)
+        params.set('seniority', query.seniority);
+    if (query.agentPolicy)
+        params.set('agentPolicy', query.agentPolicy);
+    for (const tag of query.tags)
+        params.append('tag', tag);
+    if (query.salaryMin !== null)
+        params.set('salaryMin', String(query.salaryMin));
+    if (query.org)
+        params.set('org', query.org);
+    if (query.sort !== 'recent')
+        params.set('sort', query.sort);
+    if (query.limit !== 25)
+        params.set('limit', String(query.limit));
+    if (query.offset !== 0)
+        params.set('offset', String(query.offset));
+    return params;
+}
+//# sourceMappingURL=query.js.map

package/dist/schema/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/schema/query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,WAAW,EACX,WAAW,GAKZ,MAAM,UAAU,CAAC;AAElB,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAU,CAAC;AAmB/D,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAE7B,MAAM,CAAC,MAAM,WAAW,GAAa;IACnC,CAAC,EAAE,IAAI;IACP,cAAc,EAAE,IAAI;IACpB,SAAS,EAAE,IAAI;IACf,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,EAAE;IACR,SAAS,EAAE,IAAI;IACf,GAAG,EAAE,IAAI;IACT,IAAI,EAAE,QAAQ;IACd,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,CAAC;CACV,CAAC;AAEF,SAAS,GAAG,CAAC,MAAuB,EAAE,GAAW;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACzC,CAAC;AAED,SAAS,OAAO,CAAC,KAAoB,EAAE,QAAgB,EAAE,GAAW,EAAE,GAAW;IAC/E,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,QAAQ,CAAC;IACpC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,MAAuB;IAChD,MAAM,cAAc,GAAG,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACrD,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAE3C,OAAO;QACL,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC;QACnB,cAAc,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;QACxE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACpD,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACpD,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI;QAC5D,IAAI,EAAE,MAAM;aACT,MAAM,CAAC,KAAK,CAAC;aACb,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aACpC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,EAAE,CAAC;aAC/B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACf,SAAS,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,EAAE,WAAW,CAAC,IAAI,IAAI;QACpF,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,IAAI,KAAK,IAAI,IAAK,KAA2B,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAa,CAAC,CAAC,CAAC,QAAQ;QAC9F,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC;QACtD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,KAAe;IAC3C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,IAAI,KAAK,CAAC,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,cAAc;QAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,SAAS;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,WAAW;QAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;IACpE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI;QAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,GAAG;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACjE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/schema/text.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Small text helpers shared by the database layer, the views and the clients.
+ * They live here because a slug computed one way on the server and another way
+ * in the CLI produces two URLs for one job.
+ */
+/**
+ * Trim, flatten control characters, cap.
+ *
+ * Written as a scan rather than a regex character class because this text is
+ * printed into a terminal by the TUI and the CLI as well as escaped into HTML
+ * by the views, and the escape that starts an ANSI sequence is exactly the
+ * kind of character a source-level class is easy to get subtly wrong.
+ */
+export declare function clean(value: unknown, max: number): string;
+export declare function slugify(value: string): string;
+/** A short, unambiguous suffix for slug collisions. No l/1/0/O. */
+export declare function suffix(length?: number): string;
+export declare function parseList(value: unknown, max: number, each?: number): string[];
+/** "$120k - $160k a year", or null when the employer did not say. */
+export declare function formatSalary(salary: {
+    min: number | null;
+    max: number | null;
+    currency: string;
+    period: string;
+}): string | null;
+/** "3 days ago". Used identically in HTML and in the TUI. */
+export declare function ago(iso: string | null, now?: number): string;

package/dist/schema/text.js

@@ -0,0 +1,117 @@
+/**
+ * Small text helpers shared by the database layer, the views and the clients.
+ * They live here because a slug computed one way on the server and another way
+ * in the CLI produces two URLs for one job.
+ */
+/**
+ * Trim, flatten control characters, cap.
+ *
+ * Written as a scan rather than a regex character class because this text is
+ * printed into a terminal by the TUI and the CLI as well as escaped into HTML
+ * by the views, and the escape that starts an ANSI sequence is exactly the
+ * kind of character a source-level class is easy to get subtly wrong.
+ */
+export function clean(value, max) {
+    if (typeof value !== 'string')
+        return '';
+    let out = '';
+    for (const char of value) {
+        const code = char.codePointAt(0) ?? 0;
+        out += code < 0x20 || code === 0x7f ? ' ' : char;
+    }
+    return out.trim().slice(0, max);
+}
+export function slugify(value) {
+    const base = value
+        .normalize('NFKD')
+        .replace(/\p{Diacritic}/gu, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 70)
+        .replace(/-+$/g, '');
+    // A title made entirely of punctuation or of a non-Latin script leaves
+    // nothing behind, and an empty slug collides with every other empty slug.
+    return base === '' ? 'job' : base;
+}
+/** A short, unambiguous suffix for slug collisions. No l/1/0/O. */
+export function suffix(length = 5) {
+    const alphabet = 'abcdefghjkmnpqrstuvwxyz23456789';
+    const bytes = new Uint8Array(length);
+    crypto.getRandomValues(bytes);
+    let out = '';
+    for (const byte of bytes)
+        out += alphabet[byte % alphabet.length];
+    return out;
+}
+export function parseList(value, max, each = 40) {
+    const raw = Array.isArray(value) ? value : typeof value === 'string' ? value.split(',') : [];
+    const seen = new Set();
+    const out = [];
+    for (const item of raw) {
+        const cleaned = clean(item, each).toLowerCase();
+        if (cleaned === '' || seen.has(cleaned))
+            continue;
+        seen.add(cleaned);
+        out.push(cleaned);
+        if (out.length >= max)
+            break;
+    }
+    return out;
+}
+const SYMBOLS = {
+    USD: '$',
+    EUR: '\u20AC',
+    GBP: '\u00A3',
+    CAD: 'CA$',
+    AUD: 'A$',
+    JPY: '\u00A5',
+};
+/** "$120k - $160k a year", or null when the employer did not say. */
+export function formatSalary(salary) {
+    if (salary.min === null && salary.max === null)
+        return null;
+    const money = (amount) => {
+        const symbol = SYMBOLS[salary.currency.toUpperCase()] ?? `${salary.currency.toUpperCase()} `;
+        if (amount >= 1000 && amount % 1000 === 0)
+            return `${symbol}${amount / 1000}k`;
+        return `${symbol}${amount.toLocaleString('en-US')}`;
+    };
+    const min = salary.min;
+    const max = salary.max;
+    const range = min !== null && max !== null && min !== max
+        ? `${money(min)} - ${money(max)}`
+        : money((min ?? max));
+    return `${range} a ${salary.period}`;
+}
+/** Each entry: below this many seconds, report in the unit named. */
+const UNITS = [
+    [3600, 60, 'minute'],
+    [86_400, 3600, 'hour'],
+    [604_800, 86_400, 'day'],
+    [2_629_800, 604_800, 'week'],
+    [31_557_600, 2_629_800, 'month'],
+];
+/** "3 days ago". Used identically in HTML and in the TUI. */
+export function ago(iso, now = Date.now()) {
+    if (iso === null)
+        return 'not published';
+    const then = Date.parse(iso);
+    if (!Number.isFinite(then))
+        return 'unknown';
+    const seconds = Math.max(0, Math.round((now - then) / 1000));
+    if (seconds < 45)
+        return 'just now';
+    let divisor = 31_557_600;
+    let unit = 'year';
+    for (const entry of UNITS) {
+        if (seconds < entry[0]) {
+            divisor = entry[1];
+            unit = entry[2];
+            break;
+        }
+    }
+    const value = Math.max(1, Math.floor(seconds / divisor));
+    return `${value} ${unit}${value === 1 ? '' : 's'} ago`;
+}
+//# sourceMappingURL=text.js.map

package/dist/schema/text.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"text.js","sourceRoot":"","sources":["../../src/schema/text.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,KAAK,CAAC,KAAc,EAAE,GAAW;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtC,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,KAAa;IACnC,MAAM,IAAI,GAAG,KAAK;SACf,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;SAC9B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,uEAAuE;IACvE,0EAA0E;IAC1E,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACpC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,MAAM,CAAC,MAAM,GAAG,CAAC;IAC/B,MAAM,QAAQ,GAAG,iCAAiC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAClE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,GAAW,EAAE,IAAI,GAAG,EAAE;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAChD,IAAI,OAAO,KAAK,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAClD,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;YAAE,MAAM;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,OAAO,GAA2B;IACtC,GAAG,EAAE,GAAG;IACR,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,QAAQ;IACb,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,IAAI;IACT,GAAG,EAAE,QAAQ;CACd,CAAC;AAEF,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAC,MAK5B;IACC,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,CAAC,MAAc,EAAU,EAAE;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC;QAC7F,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,IAAI,KAAK,CAAC;YAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,CAAC;QAC/E,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;IACvB,MAAM,KAAK,GACT,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,GAAG;QACzC,CAAC,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,EAAE;QACjC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,GAAG,CAAW,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;AACvC,CAAC;AAED,qEAAqE;AACrE,MAAM,KAAK,GAA6E;IACtF,CAAC,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC;IACpB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC;IACtB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC;IACxB,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC;IAC5B,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC;CACjC,CAAC;AAEF,6DAA6D;AAC7D,MAAM,UAAU,GAAG,CAAC,GAAkB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACtD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,UAAU,CAAC;IAEpC,IAAI,OAAO,GAAG,UAAU,CAAC;IACzB,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACvB,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM;QACR,CAAC;IACH,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IACzD,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;AACzD,CAAC"}

package/dist/server/app.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The application, assembled.
+ *
+ * One Hono app carries every surface a browser or a machine can reach. The MCP
+ * endpoint dispatches through this app's own fetch rather than reaching into
+ * the database, so a tool call takes the same code path and the same
+ * permission checks a browser request does.
+ */
+import { Hono } from 'hono';
+import type pg from 'pg';
+import type { Config } from '../config.ts';
+import type { AppEnv } from './deps.ts';
+export declare function createApp(pool: pg.Pool, config: Config): Hono<AppEnv>;

package/dist/server/app.js

@@ -0,0 +1,57 @@
+import { jsx as _jsx, jsxs as _jsxs } from "hono/jsx/jsx-runtime";
+/**
+ * The application, assembled.
+ *
+ * One Hono app carries every surface a browser or a machine can reach. The MCP
+ * endpoint dispatches through this app's own fetch rather than reaching into
+ * the database, so a tool call takes the same code path and the same
+ * permission checks a browser request does.
+ */
+import { Hono } from 'hono';
+import { apiRoutes } from "./routes/api.js";
+import { pageRoutes } from "./routes/pages.js";
+import { discoveryRoutes } from "./routes/discovery.js";
+import { mcpRoutes } from "./routes/mcp.js";
+import { passkeyRoutes } from "./routes/passkey.js";
+import { apiCors, securityHeaders, withViewer } from "./middleware.js";
+import { Layout } from "../views/layout.js";
+export function createApp(pool, config) {
+    const deps = { pool, config };
+    const app = new Hono();
+    app.use('*', withViewer(deps));
+    app.use('*', securityHeaders());
+    app.use('/api/*', apiCors());
+    app.route('/api/v1', apiRoutes());
+    // The MCP tools call this same app, so the getter is resolved lazily: the
+    // app does not exist yet at the point the routes are mounted on it.
+    app.route('/api/mcp', mcpRoutes(() => app));
+    app.route('/auth/passkey', passkeyRoutes());
+    app.route('/', discoveryRoutes());
+    app.route('/', pageRoutes());
+    app.notFound((c) => {
+        // A machine asking for JSON gets JSON. Handing an HTML 404 to a client
+        // that asked for JSON is how a parse error ends up masking a typo in a URL.
+        if (wantsJson(c.req.header('accept'), c.req.path)) {
+            return c.json({ error: { message: `Nothing at ${c.req.path}.`, code: 'not_found' } }, 404);
+        }
+        return c.html(_jsx(Layout, { viewer: c.get('viewer'), boardName: config.boardName, publicUrl: config.publicUrl, path: c.req.path, isDirectory: config.isDirectory, title: "Not found", noindex: true, children: _jsxs("div", { class: "empty", children: [_jsx("h1", { children: "Not found" }), _jsxs("p", { children: ["Nothing lives at ", _jsx("code", { children: c.req.path }), "."] }), _jsx("p", { children: _jsx("a", { class: "btn", href: "/", children: "Back to the jobs" }) })] }) }), 404);
+    });
+    app.onError((error, c) => {
+        // The message is logged, never returned: it can carry a query, a column
+        // name or a connection string.
+        console.error(`error on ${c.req.method} ${c.req.path}:`, error);
+        if (wantsJson(c.req.header('accept'), c.req.path)) {
+            return c.json({ error: { message: 'Something went wrong on this board.', code: 'internal' } }, 500);
+        }
+        return c.html(_jsx(Layout, { viewer: null, boardName: config.boardName, publicUrl: config.publicUrl, path: c.req.path, title: "Something went wrong", noindex: true, children: _jsxs("div", { class: "empty", children: [_jsx("h1", { children: "Something went wrong" }), _jsx("p", { children: "That is this board's fault, not yours. It has been logged." })] }) }), 500);
+    });
+    return app;
+}
+function wantsJson(accept, path) {
+    if (path.startsWith('/api/'))
+        return true;
+    if (accept === undefined)
+        return false;
+    return accept.includes('application/json') && !accept.includes('text/html');
+}
+//# sourceMappingURL=app.js.map

package/dist/server/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.tsx"],"names":[],"mappings":";AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAoB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAqB,CAAC;AAG7C,MAAM,UAAU,SAAS,CAAC,IAAa,EAAE,MAAc;IACrD,MAAM,IAAI,GAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7B,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAClC,0EAA0E;IAC1E,oEAAoE;IACpE,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,eAAe,EAAE,aAAa,EAAE,CAAC,CAAC;IAC5C,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC;IAClC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;IAE7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,uEAAuE;QACvE,4EAA4E;QAC5E,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CACX,KAAC,MAAM,IACL,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EACvB,SAAS,EAAE,MAAM,CAAC,SAAS,EAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,EAC3B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAChB,WAAW,EAAE,MAAM,CAAC,WAAW,EAC/B,KAAK,EAAC,WAAW,EACjB,OAAO,kBAEP,eAAK,KAAK,EAAC,OAAO,aAChB,qCAAkB,EAClB,6CACmB,yBAAO,CAAC,CAAC,GAAG,CAAC,IAAI,GAAQ,SACxC,EACJ,sBACE,YAAG,KAAK,EAAC,KAAK,EAAC,IAAI,EAAC,GAAG,iCAEnB,GACF,IACA,GACC,EACT,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,wEAAwE;QACxE,+BAA+B;QAC/B,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,KAAK,CAAC,CAAC;QAChE,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,qCAAqC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAC/E,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CACX,KAAC,MAAM,IACL,MAAM,EAAE,IAAI,EACZ,SAAS,EAAE,MAAM,CAAC,SAAS,EAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,EAC3B,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,EAChB,KAAK,EAAC,sBAAsB,EAC5B,OAAO,kBAEP,eAAK,KAAK,EAAC,OAAO,aAChB,gDAA6B,EAC7B,qFAAiE,IAC7D,GACC,EACT,GAAG,CACJ,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,MAA0B,EAAE,IAAY;IACzD,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACvC,OAAO,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9E,CAAC"}

package/dist/server/deps.d.ts

@@ -0,0 +1,20 @@
+import type pg from 'pg';
+import type { Config } from '../config.ts';
+import type { Viewer } from '../core/auth.ts';
+export interface Deps {
+    pool: pg.Pool;
+    config: Config;
+}
+/**
+ * Hono's per-request bag.
+ *
+ * `viewer` is resolved once by middleware and read everywhere else. Resolving
+ * it per handler is how a page ends up doing four session lookups, and how one
+ * handler forgets to and renders a signed-in person as a stranger.
+ */
+export interface AppEnv {
+    Variables: {
+        viewer: Viewer | null;
+        deps: Deps;
+    };
+}

package/dist/server/deps.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=deps.js.map

package/dist/server/deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deps.js","sourceRoot":"","sources":["../../src/server/deps.ts"],"names":[],"mappings":""}

package/dist/server/middleware.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Cross-cutting request handling: who is asking, and what the browser is
+ * allowed to do with the answer.
+ */
+import type { MiddlewareHandler } from 'hono';
+import type { AppEnv, Deps } from './deps.ts';
+/**
+ * Resolve the caller.
+ *
+ * Two sources, and the order matters. A bearer token wins over a cookie so
+ * that a person signed in to the board in one tab can still drive the API as
+ * a different identity from a script in another.
+ *
+ * A bad token is not an error here: it is simply nobody. Handlers that need
+ * an identity say so themselves, and the ones that do not - the job list, a
+ * job page - must keep working for a stranger with a stale token in their
+ * config file.
+ */
+export declare function withViewer(deps: Deps): MiddlewareHandler<AppEnv>;
+/**
+ * Security headers.
+ *
+ * The board ships no inline script and no third-party script, so the policy
+ * can be the strict one: `script-src 'self'` covers the single progressive
+ * enhancement file and nothing else. Styles need 'unsafe-inline' only because
+ * a few components carry an inline `style` attribute for a computed width -
+ * note that in CSP a style ATTRIBUTE is covered by style-src, not by
+ * style-src-attr alone, which is a distinction that has cost time before.
+ */
+export declare function securityHeaders(): MiddlewareHandler<AppEnv>;
+/**
+ * CORS for the API only.
+ *
+ * Wide open for reads, because a federated search from another instance's
+ * browser is the point. Credentials are never reflected: a cross-origin caller
+ * authenticates with a bearer token it holds deliberately, never with a cookie
+ * the browser attached on its behalf.
+ */
+export declare function apiCors(): MiddlewareHandler<AppEnv>;

package/dist/server/middleware.js

@@ -0,0 +1,100 @@
+/**
+ * Cross-cutting request handling: who is asking, and what the browser is
+ * allowed to do with the answer.
+ */
+import { getCookie } from 'hono/cookie';
+import { SESSION_COOKIE, viewerFromToken } from "../core/auth.js";
+/**
+ * Resolve the caller.
+ *
+ * Two sources, and the order matters. A bearer token wins over a cookie so
+ * that a person signed in to the board in one tab can still drive the API as
+ * a different identity from a script in another.
+ *
+ * A bad token is not an error here: it is simply nobody. Handlers that need
+ * an identity say so themselves, and the ones that do not - the job list, a
+ * job page - must keep working for a stranger with a stale token in their
+ * config file.
+ */
+export function withViewer(deps) {
+    return async (c, next) => {
+        c.set('deps', deps);
+        c.set('viewer', null);
+        const header = c.req.header('authorization') ?? '';
+        const bearer = /^Bearer\s+(.+)$/i.exec(header)?.[1]?.trim();
+        if (bearer !== undefined && bearer !== '') {
+            c.set('viewer', await viewerFromToken(deps.pool, bearer));
+            await next();
+            return;
+        }
+        const cookie = getCookie(c, SESSION_COOKIE);
+        if (cookie !== undefined && cookie !== '') {
+            c.set('viewer', await viewerFromToken(deps.pool, cookie));
+        }
+        await next();
+    };
+}
+/**
+ * Security headers.
+ *
+ * The board ships no inline script and no third-party script, so the policy
+ * can be the strict one: `script-src 'self'` covers the single progressive
+ * enhancement file and nothing else. Styles need 'unsafe-inline' only because
+ * a few components carry an inline `style` attribute for a computed width -
+ * note that in CSP a style ATTRIBUTE is covered by style-src, not by
+ * style-src-attr alone, which is a distinction that has cost time before.
+ */
+export function securityHeaders() {
+    const policy = [
+        `default-src 'self'`,
+        `base-uri 'self'`,
+        `form-action 'self'`,
+        `frame-ancestors 'none'`,
+        `object-src 'none'`,
+        `script-src 'self'`,
+        `style-src 'self' 'unsafe-inline'`,
+        // Employer logos and avatars come from wherever the employer hosts them.
+        // 'self' has to be listed explicitly: omitting it works in production and
+        // breaks every local asset, which is a fun afternoon.
+        `img-src 'self' https: data:`,
+        `font-src 'self'`,
+        // The board itself is same-origin, but a federated search in the browser
+        // talks to other instances over https.
+        `connect-src 'self' https:`,
+    ].join('; ');
+    return async (c, next) => {
+        await next();
+        const headers = c.res.headers;
+        if (!headers.has('content-security-policy')) {
+            headers.set('content-security-policy', policy);
+        }
+        headers.set('x-content-type-options', 'nosniff');
+        headers.set('referrer-policy', 'strict-origin-when-cross-origin');
+        headers.set('x-frame-options', 'DENY');
+        headers.set('permissions-policy', 'geolocation=(), microphone=(), camera=()');
+    };
+}
+/**
+ * CORS for the API only.
+ *
+ * Wide open for reads, because a federated search from another instance's
+ * browser is the point. Credentials are never reflected: a cross-origin caller
+ * authenticates with a bearer token it holds deliberately, never with a cookie
+ * the browser attached on its behalf.
+ */
+export function apiCors() {
+    return async (c, next) => {
+        if (c.req.method === 'OPTIONS') {
+            return c.body(null, 204, {
+                'access-control-allow-origin': '*',
+                'access-control-allow-methods': 'GET, POST, PATCH, DELETE, OPTIONS',
+                'access-control-allow-headers': 'authorization, content-type',
+                'access-control-max-age': '86400',
+            });
+        }
+        await next();
+        c.res.headers.set('access-control-allow-origin', '*');
+        c.res.headers.set('vary', 'origin');
+    };
+}
+//# sourceMappingURL=middleware.js.map

package/dist/server/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/server/middleware.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACpB,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAEtB,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1D,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,MAAM,GAAG;QACb,oBAAoB;QACpB,iBAAiB;QACjB,oBAAoB;QACpB,wBAAwB;QACxB,mBAAmB;QACnB,mBAAmB;QACnB,kCAAkC;QAClC,yEAAyE;QACzE,0EAA0E;QAC1E,sDAAsD;QACtD,6BAA6B;QAC7B,iBAAiB;QACjB,yEAAyE;QACzE,uCAAuC;QACvC,2BAA2B;KAC5B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,IAAI,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;QAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,0CAA0C,CAAC,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO;IACrB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE;gBACvB,6BAA6B,EAAE,GAAG;gBAClC,8BAA8B,EAAE,mCAAmC;gBACnE,8BAA8B,EAAE,6BAA6B;gBAC7D,wBAAwB,EAAE,OAAO;aAClC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;QACb,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}

package/dist/server/routes/api.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The REST API.
+ *
+ * Every other surface is a client of this: the CLI, the TUI, the desktop app,
+ * the MCP tools and one instance searching another. The HTML pages are the one
+ * exception, and only because they render server-side from the same core
+ * functions rather than from a second set of queries.
+ *
+ * Two rules hold throughout:
+ *
+ *  1. An error is an object with a message a person could act on, not a status
+ *     code and an empty body. Half the callers here are models.
+ *  2. Reads are public unless the data belongs to someone. A job board whose
+ *     listings need a key is a job board nobody's agent will ever read.
+ */
+import { Hono } from 'hono';
+import { requireAdmin } from '../../core/auth.ts';
+import type { AppEnv } from '../deps.ts';
+export declare function apiRoutes(): Hono<AppEnv>;
+export { requireAdmin };