@relaycast/engine 12.2.0 → 12.3.0

package/dist/routes/credential.js

@@ -0,0 +1,97 @@
+import { Hono } from 'hono';
+import { parseCredential } from '@relaycast/types';
+import { eq } from 'drizzle-orm';
+import { WORKSPACE_EXPIRED_CODE, WORKSPACE_EXPIRED_MESSAGE, authenticateUnexpired, isWorkspaceExpired, } from '../auth/workspaceExpiry.js';
+import { workspaces } from '../db/schema.js';
+import { DEFAULT_LEGACY_CREDENTIAL_GRACE_SECONDS, upgradeLegacyCredential, webhookForToken, } from '../engine/credentialUpgrade.js';
+import { jsonError, jsonOk } from '../lib/httpResponse.js';
+import { errorResponse } from '../lib/httpError.js';
+import { noteAuthenticatedCredential } from '../lib/credentialNotice.js';
+import { rateLimitWindow, rateLimitWindowResetAt, setRetryContract } from '../lib/throttle.js';
+export const credentialRoutes = new Hono();
+/** Upgrades per principal per minute. */
+const UPGRADES_PER_MINUTE = 10;
+const RATE_LIMIT_WINDOW_MS = 60_000;
+const REQUIRE = {
+    workspace: 'workspace',
+    agent: 'agent',
+    node: 'node',
+    observer: 'observer',
+};
+// POST /v1/credentials/upgrade - exchange a legacy credential for an ar_ one
+// standing for the same principal. The legacy credential keeps working for
+// EngineConfig.legacyCredentialGraceSeconds (default 30 days). Workspace keys
+// upgrade only where the engine owns them (EngineConfig.allowWorkspaceKeyRotation).
+credentialRoutes.post('/credentials/upgrade', async (c) => {
+    try {
+        const header = c.req.header('Authorization');
+        const token = header?.startsWith('Bearer ') ? header.slice(7) : undefined;
+        if (!token)
+            return jsonError(c, 'unauthorized', 'Missing or invalid Authorization header', 401);
+        const parsed = parseCredential(token);
+        if (!parsed)
+            return jsonError(c, 'unauthorized', 'Invalid token format', 401);
+        if (parsed.family === 'ar') {
+            return jsonError(c, 'credential_not_legacy', 'This credential is already an ar_ credential', 409);
+        }
+        const db = c.get('db');
+        let principal;
+        if (parsed.kind === 'webhook') {
+            const webhook = await webhookForToken(db, token);
+            if (!webhook)
+                return jsonError(c, 'webhook_token_invalid', 'Invalid webhook token', 401);
+            // The same expiry gate every other kind passes through authenticateUnexpired.
+            const [workspace] = await db.select({ expiresAt: workspaces.expiresAt }).from(workspaces)
+                .where(eq(workspaces.id, webhook.workspaceId));
+            if (!workspace || isWorkspaceExpired(workspace)) {
+                return jsonError(c, WORKSPACE_EXPIRED_CODE, WORKSPACE_EXPIRED_MESSAGE, 401);
+            }
+            principal = { id: webhook.id, workspaceId: webhook.workspaceId, currentHash: webhook.tokenHash };
+        }
+        else {
+            const result = await authenticateUnexpired(c.get('engine').auth, { token, require: REQUIRE[parsed.kind], db });
+            if (!result.ok)
+                return jsonError(c, result.code, result.message, result.status);
+            const row = parsed.kind === 'workspace' ? { id: result.workspace.id, tokenHash: result.workspace.apiKeyHash }
+                : parsed.kind === 'agent' ? result.agent
+                    : parsed.kind === 'node' ? result.node
+                        : result.observerToken;
+            if (!row)
+                return jsonError(c, 'unauthorized', 'Invalid token format', 401);
+            principal = { id: row.id, workspaceId: result.workspace.id, currentHash: 'tokenHash' in row ? row.tokenHash : null };
+        }
+        noteAuthenticatedCredential(c, token, principal.workspaceId);
+        // A workspace key owned by an external control plane is replaced there and
+        // pushed here; one minted here would be unknown to that plane, and its next
+        // push would invalidate it.
+        if (parsed.kind === 'workspace' && !c.get('engine').config.allowWorkspaceKeyRotation) {
+            return jsonError(c, 'workspace_key_rotation_disabled', 'Workspace key upgrade is disabled on this deployment; upgrade through the managing control plane', 403);
+        }
+        const now = Date.now();
+        const bucketKey = `credential-upgrade:${parsed.kind}:${principal.id}:${rateLimitWindow(now)}`;
+        const limit = await c.get('engine').rateLimiter
+            .check({ bucketKey, limit: UPGRADES_PER_MINUTE, windowMs: RATE_LIMIT_WINDOW_MS })
+            .catch(() => ({ allowed: true }));
+        if (!limit.allowed) {
+            setRetryContract(c, rateLimitWindowResetAt(now), now);
+            return jsonError(c, 'rate_limit_exceeded', `Rate limit exceeded. ${UPGRADES_PER_MINUTE} upgrades per minute allowed.`, 429);
+        }
+        const upgraded = await upgradeLegacyCredential(db, {
+            legacyToken: token,
+            kind: parsed.kind,
+            principalId: principal.id,
+            workspaceId: principal.workspaceId,
+            currentHash: principal.currentHash,
+            graceSeconds: c.get('engine').config.legacyCredentialGraceSeconds ?? DEFAULT_LEGACY_CREDENTIAL_GRACE_SECONDS,
+        });
+        return jsonOk(c, {
+            credential: upgraded.credential,
+            kind: upgraded.kind,
+            legacy_expires_at: upgraded.legacyExpiresAt.toISOString(),
+        });
+    }
+    catch (err) {
+        return errorResponse(c, err);
+    }
+});
+//# sourceMappingURL=credential.js.map

package/dist/routes/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../src/routes/credential.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAuB,MAAM,kBAAkB,CAAC;AAGxE,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EACL,uCAAuC,EACvC,uBAAuB,EACvB,eAAe,GAChB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE/F,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,IAAI,EAAU,CAAC;AAEnD,yCAAyC;AACzC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAC/B,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAEpC,MAAM,OAAO,GAA4D;IACvE,SAAS,EAAE,WAAW;IACtB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;CACrB,CAAC;AAQF,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,oFAAoF;AACpF,gBAAgB,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;QAC9E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC,CAAC,EAAE,uBAAuB,EAAE,8CAA8C,EAAE,GAAG,CAAC,CAAC;QACpG,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,SAAoB,CAAC;QACzB,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,GAAG,CAAC,CAAC;YACzF,8EAA8E;YAC9E,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;iBACtF,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;gBAChD,OAAO,SAAS,CAAC,CAAC,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAC9E,CAAC;YACD,SAAS,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACnG,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/G,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAA8B,CAAC,CAAC;YACxG,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE;gBAC3G,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK;oBACtC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI;wBACpC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;YAC7B,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;YAC3E,SAAS,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvH,CAAC;QAED,2BAA2B,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;QAE7D,2EAA2E;QAC3E,4EAA4E;QAC5E,4BAA4B;QAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,CAAC;YACrF,OAAO,SAAS,CACd,CAAC,EACD,iCAAiC,EACjC,kGAAkG,EAClG,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,sBAAsB,MAAM,CAAC,IAAI,IAAI,SAAS,CAAC,EAAE,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,WAAW;aAC5C,KAAK,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,mBAAmB,EAAE,QAAQ,EAAE,oBAAoB,EAAE,CAAC;aAChF,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,gBAAgB,CAAC,CAAC,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;YACtD,OAAO,SAAS,CAAC,CAAC,EAAE,qBAAqB,EAAE,wBAAwB,mBAAmB,+BAA+B,EAAE,GAAG,CAAC,CAAC;QAC9H,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE;YACjD,WAAW,EAAE,KAAK;YAClB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,4BAA4B,IAAI,uCAAuC;SAC7G,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,CAAC,EAAE;YACf,UAAU,EAAE,QAAQ,CAAC,UAAU;YAC/B,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,iBAAiB,EAAE,QAAQ,CAAC,eAAe,CAAC,WAAW,EAAE;SAC1D,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/routes/file.js

@@ -15,7 +15,7 @@ export const fileRoutes = new Hono();
 const fileUploadSchema = z.object({
     filename: z.string().min(1),
     content_type: z.string().min(1),
-    size_bytes: z.number().finite().refine((value) => value !== 0),
+    size_bytes: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
 });
 const listFilesQuerySchema = LimitQuerySchema.extend({
     uploaded_by: z.string().optional(),
@@ -23,13 +23,15 @@ const listFilesQuerySchema = LimitQuerySchema.extend({
 function uploadInvalidMessage(failure) {
     const hasFilenameIssue = failure.error.issues.some((issue) => issue.path[0] === 'filename');
     const hasContentTypeIssue = failure.error.issues.some((issue) => issue.path[0] === 'content_type');
-    const hasSizeBytesIssue = failure.error.issues.some((issue) => issue.path[0] === 'size_bytes');
+    const sizeBytesIssue = failure.error.issues.find((issue) => issue.path[0] === 'size_bytes');
     return hasFilenameIssue
         ? 'filename is required'
         : hasContentTypeIssue
             ? 'content_type is required'
-            : hasSizeBytesIssue
-                ? 'size_bytes is required'
+            : sizeBytesIssue
+                ? (sizeBytesIssue.code === 'invalid_type' && sizeBytesIssue.expected !== 'int'
+                    ? 'size_bytes is required'
+                    : 'size_bytes must be a positive integer')
                 : 'invalid upload body';
 }
 // POST /v1/files/upload — Returns presigned PUT URL
@@ -44,6 +46,10 @@ fileRoutes.post('/files/upload', requireAgentToken, rateLimit, async (c) => {
             return parsed.response;
         }
         const { filename, content_type, size_bytes } = parsed.data;
+        const maxUploadBytes = c.get('engine').config.maxUploadBytes;
+        if (maxUploadBytes !== undefined && size_bytes > maxUploadBytes) {
+            return jsonError(c, 'file_too_large', `size_bytes exceeds the ${maxUploadBytes}-byte upload limit`, 413);
+        }
         const result = await fileEngine.createUpload(db, storage, workspace.id, agent.id, { filename, content_type, size_bytes });
         emitServerEvent(c, workspace.id, 'file.upload.requested', {
             file_id: result.id,

package/dist/routes/file.js.map

@@ -1 +1 @@
-{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/routes/file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,EACb,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU,CAAC;AAE7C,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;CAC/D,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,SAAS,oBAAoB,CAAC,OAA0B;IACtD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAC5F,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IACnG,MAAM,iBAAiB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;IAC/F,OAAO,gBAAgB;QACrB,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,mBAAmB;YACnB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,iBAAiB;gBACjB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,qBAAqB,CAAC;AAChC,CAAC;AAED,oDAAoD;AACpD,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE3D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAC1C,EAAE,EACF,OAAO,EACP,SAAS,CAAC,EAAE,EACZ,KAAK,CAAC,EAAE,EACR,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,CACvC,CAAC;QAEF,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,uBAAuB,EAAE;YACxD,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gDAAgD;AAChD,UAAU,CAAC,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAC5C,EAAE,EACF,OAAO,EACP,SAAS,CAAC,EAAE,EACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACjB,KAAK,CAAC,EAAE,CACT,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACpD,eAAe,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC7F,MAAM,gBAAgB,CAAC,CAAC,EAAE;YACxB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,uBAAuB,EAAE;YACxD,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,wCAAwC;AACxC,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACtF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzD,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CACrC,EAAE,EACF,OAAO,EACP,SAAS,CAAC,EAAE,EACZ,MAAM,CACP,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,qCAAqC;AACrC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CACxC,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACjB,KAAK,CAAC,EAAE,CACT,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6BAA6B;AAC7B,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE;YAC1D,WAAW;YACX,KAAK;SACN,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAC7C,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,2BAA2B,CAAC,CAAC,CAAC,EAC9B,MAAM,CACP,CAAC;QAEF,OAAO,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"file.js","sourceRoot":"","sources":["../../src/routes/file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,EACb,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,yBAAyB,EACzB,uBAAuB,EACvB,2BAA2B,EAC3B,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,EAAU,CAAC;AAE7C,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;CACrE,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC,MAAM,CAAC;IACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAIH,SAAS,oBAAoB,CAAC,OAA0B;IACtD,MAAM,gBAAgB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC;IAC5F,MAAM,mBAAmB,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,cAAc,CAAC,CAAC;IACnG,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;IAC5F,OAAO,gBAAgB;QACrB,CAAC,CAAC,sBAAsB;QACxB,CAAC,CAAC,mBAAmB;YACnB,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,cAAc;gBACd,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,KAAK,cAAc,IAAI,cAAc,CAAC,QAAQ,KAAK,KAAK;oBAC5E,CAAC,CAAC,wBAAwB;oBAC1B,CAAC,CAAC,uCAAuC,CAAC;gBAC5C,CAAC,CAAC,qBAAqB,CAAC;AAChC,CAAC;AAED,oDAAoD;AACpD,UAAU,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;QAC9E,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3D,MAAM,cAAc,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7D,IAAI,cAAc,KAAK,SAAS,IAAI,UAAU,GAAG,cAAc,EAAE,CAAC;YAChE,OAAO,SAAS,CAAC,CAAC,EAAE,gBAAgB,EAAE,0BAA0B,cAAc,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC3G,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAC1C,EAAE,EACF,OAAO,EACP,SAAS,CAAC,EAAE,EACZ,KAAK,CAAC,EAAE,EACR,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,CACvC,CAAC;QAEF,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,uBAAuB,EAAE;YACxD,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,UAAU;YACV,YAAY;SACb,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,gDAAgD;AAChD,UAAU,CAAC,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC/E,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,cAAc,CAC5C,EAAE,EACF,OAAO,EACP,SAAS,CAAC,EAAE,EACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACjB,KAAK,CAAC,EAAE,CACT,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,oCAAoC,CAAC,CAAC;QACjF,CAAC;QAED,MAAM,SAAS,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QACpD,eAAe,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC7F,MAAM,gBAAgB,CAAC,CAAC,EAAE;YACxB,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,SAAS,CAAC,EAAE;YACzB,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE;SAClD,CAAC,CAAC;QACH,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,uBAAuB,EAAE;YACxD,OAAO,EAAE,MAAM,CAAC,EAAE;YAClB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,wCAAwC;AACxC,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,oBAAoB,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACtF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACzD,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CACrC,EAAE,EACF,OAAO,EACP,SAAS,CAAC,EAAE,EACZ,MAAM,CACP,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,qCAAqC;AACrC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACxE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC;QAE9B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CACxC,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EACjB,KAAK,CAAC,EAAE,CACT,CAAC;QACF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,YAAY,CAAC,CAAC,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAED,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6BAA6B;AAC7B,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAClF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC,EAAE,oBAAoB,EAAE,yBAAyB,CAAC,CAAC;QACpF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE;YAC1D,WAAW;YACX,KAAK;SACN,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAC7C,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,2BAA2B,CAAC,CAAC,CAAC,EAC9B,MAAM,CACP,CAAC;QAEF,OAAO,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/routes/inboundWebhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inboundWebhook.d.ts","sourceRoot":"","sources":["../../src/routes/inboundWebhook.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAsBxC,eAAO,MAAM,oBAAoB,qDAAqB,CAAC"}
+{"version":3,"file":"inboundWebhook.d.ts","sourceRoot":"","sources":["../../src/routes/inboundWebhook.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AA0BxC,eAAO,MAAM,oBAAoB,qDAAqB,CAAC"}

package/dist/routes/inboundWebhook.js

@@ -14,7 +14,10 @@ import { routeDeliveryOutcomes } from './deliveryRouting.js';
 import { runInBackground } from './background.js';
 import { sendWebhookEvent } from './webhookOutbox.js';
 import { emitServerEvent } from '../lib/serverTelemetry.js';
-import { jsonCreated, jsonNoContent, jsonNotFound, jsonOk, parseJsonBody, } from '../lib/httpResponse.js';
+import { noteAuthenticatedCredential } from '../lib/credentialNotice.js';
+import { acceptsOnlyAr } from '../auth/credentials.js';
+import { parseCredential } from '@relaycast/types';
+import { jsonCreated, jsonError, jsonNoContent, jsonNotFound, jsonOk, parseJsonBody, } from '../lib/httpResponse.js';
 export const inboundWebhookRoutes = new Hono();
 const createInboundWebhookSchema = z.object({
     name: z.string().min(1).optional(),
@@ -99,6 +102,9 @@ inboundWebhookRoutes.post('/hooks/:webhookId', async (c) => {
     try {
         const db = c.get('db');
         const token = extractBearerToken(c.req.header('Authorization'));
+        if (token && acceptsOnlyAr(db) && parseCredential(token)?.family !== 'ar') {
+            return jsonError(c, 'webhook_token_invalid', 'Invalid webhook bearer token', 401);
+        }
         const parsed = await parseJsonBody(c, triggerInboundWebhookSchema, 'invalid webhook payload');
         if (!parsed.ok) {
             return parsed.response;
@@ -124,7 +130,10 @@ inboundWebhookRoutes.post('/hooks/:webhookId', async (c) => {
         if (!result) {
             return jsonNotFound(c, 'webhook_not_found', 'Webhook not found or inactive');
         }
-        const { workspace_id, channel_id, agent_id, _deliveries, _delivery_rejections, ...responseData } = result;
+        // Only a token the webhook required and verified authenticated this call.
+        if (token && result._token_verified)
+            noteAuthenticatedCredential(c, token, result.workspace_id);
+        const { workspace_id, channel_id, agent_id, _deliveries, _delivery_rejections, _token_verified, ...responseData } = result;
         const eventData = { ...responseData, id: responseData.message_id, channel_id, agent_id };
         const messageEventData = buildMessageCreatedEventData(eventData, { channelName: result.channel, fromName: result.author });
         runInBackground(c, routeDeliveryOutcomes(c, _deliveries, 'message.created', messageEventData, { workspaceId: workspace_id }), 'route webhook deliveries');

package/dist/routes/inboundWebhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"inboundWebhook.js","sourceRoot":"","sources":["../../src/routes/inboundWebhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,KAAK,oBAAoB,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EACL,WAAW,EACX,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,wBAAwB,CAAC;AAEhC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,IAAI,EAAU,CAAC;AAEvD,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,SAAS,kBAAkB,CAAC,UAA8B;IACxD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB,EAAE,SAAiB;IACpD,OAAO,IAAI,GAAG,CAAC,aAAa,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,gDAAgD;AAChD,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE;YAC5E,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YAC1F,OAAO,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAEtC,6BAA6B;QAC7B,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,YAAY,OAAO,aAAa,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,aAAa,CACrD,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,EAAE,CAAC,EAAE,EACL,EAAE,IAAI,EAAE,CACT,CAAC;QACF,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,yBAAyB,EAAE;YAC1D,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,mCAAmC;AACnC,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6CAA6C;AAC7C,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,aAAa,CACtD,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAClB,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QACnE,CAAC;QACD,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,yBAAyB,EAAE;YAC1D,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,mEAAmE;AACnE,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,2BAA2B,EAAE,yBAAyB,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/D,uEAAuE;QACvE,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;eAC/E,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAChD,CAAC,CAAC,MAAM,CAAC,IAA+B;YACxC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,cAAc,CACtD,EAAE,EACF,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EACxB,KAAK,EACL;YACE,IAAI,EAAE,IAAI,IAAI,OAAO;YACrB,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,MAAM;YACxB,OAAO,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS;YAClG,QAAQ;SACT,EACD;YACE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC;YACnF,uBAAuB,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC;SAC/H,CACF,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;QAE1G,MAAM,SAAS,GAAG,EAAE,GAAG,YAAY,EAAE,EAAE,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACzF,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3H,eAAe,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC1J,IAAI,UAAU,EAAE,CAAC;YACf,eAAe,CACb,CAAC,EACD,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,YAAY,CAAC,EAC3E,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,eAAe,CACb,CAAC,EACD,CAAC,KAAK,IAAI,EAAE;YACV,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,aAAa,CAAC,mBAAmB,CAAC;gBACtC,EAAE;gBACF,eAAe;gBACf,WAAW,EAAE,YAAY;gBACzB,OAAO,EAAE;oBACP,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC7B,UAAU;oBACV,YAAY,EAAE,MAAM,CAAC,OAAO;oBAC5B,QAAQ;oBACR,UAAU,EAAE,MAAM,CAAC,MAAM;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,EACJ,uBAAuB,CACxB,CAAC;QACF,MAAM,gBAAgB,CAAC,CAAC,EAAE;YACxB,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,YAAY;YACzB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,gBAAgB,CAAC,CAAC,EAAE;gBACxB,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,YAAY;gBACzB,IAAI,EAAE;oBACJ,EAAE,EAAE,MAAM,CAAC,UAAU;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,YAAY,EAAE,MAAM,CAAC,OAAO;oBAC5B,UAAU;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,SAAS,EAAE,MAAM,CAAC,MAAM;oBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CACb,CAAC,EACD,CAAC,KAAK,IAAI,EAAE;YACV,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,2BAA2B,EAAE;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU;gBACV,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;aAC9B,EAAE,EAAE,CAAC,CAAC;QACT,CAAC,CAAC,EAAE,EACJ,gCAAgC,CACjC,CAAC;QAEF,OAAO,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7E,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"inboundWebhook.js","sourceRoot":"","sources":["../../src/routes/inboundWebhook.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,KAAK,oBAAoB,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,aAAa,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,WAAW,EACX,SAAS,EACT,aAAa,EACb,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,wBAAwB,CAAC;AAEhC,MAAM,CAAC,MAAM,oBAAoB,GAAG,IAAI,IAAI,EAAU,CAAC;AAEvD,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC,WAAW,EAAE,CAAC;AAEjB,SAAS,kBAAkB,CAAC,UAA8B;IACxD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,OAAO,CAAC,UAAkB,EAAE,SAAiB;IACpD,OAAO,IAAI,GAAG,CAAC,aAAa,SAAS,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClE,CAAC;AAED,gDAAgD;AAChD,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACjF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,0BAA0B,EAAE,CAAC,OAAO,EAAE,EAAE;YAC5E,MAAM,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;YAC1F,OAAO,eAAe,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,sBAAsB,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAEtC,6BAA6B;QAC7B,MAAM,EAAE,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACrE,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,OAAO,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,YAAY,OAAO,aAAa,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,aAAa,CACrD,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,EAAE,CAAC,EAAE,EACL,EAAE,IAAI,EAAE,CACT,CAAC;QACF,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,yBAAyB,EAAE;YAC1D,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,mCAAmC;AACnC,oBAAoB,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAChF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACzE,OAAO,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnG,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6CAA6C;AAC7C,oBAAoB,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACvF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,aAAa,CACtD,EAAE,EACF,SAAS,CAAC,EAAE,EACZ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAClB,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QACnE,CAAC;QACD,eAAe,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,yBAAyB,EAAE;YAC1D,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;SAC9B,CAAC,CAAC;QACH,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,mEAAmE;AACnE,oBAAoB,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAChE,IAAI,KAAK,IAAI,aAAa,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC,CAAC,EAAE,uBAAuB,EAAE,8BAA8B,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,2BAA2B,EAAE,yBAAyB,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QAC/D,uEAAuE;QACvE,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;eAC/E,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAChD,CAAC,CAAC,MAAM,CAAC,IAA+B;YACxC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,cAAc,CACtD,EAAE,EACF,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,EACxB,KAAK,EACL;YACE,IAAI,EAAE,IAAI,IAAI,OAAO;YACrB,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,MAAM;YACxB,OAAO,EAAE,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS;YAClG,QAAQ;SACT,EACD;YACE,OAAO,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC;YACnF,uBAAuB,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,kCAAkC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC;SAC/H,CACF,CAAC;QACF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,YAAY,CAAC,CAAC,EAAE,mBAAmB,EAAE,+BAA+B,CAAC,CAAC;QAC/E,CAAC;QACD,0EAA0E;QAC1E,IAAI,KAAK,IAAI,MAAM,CAAC,eAAe;YAAE,2BAA2B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC;QAChG,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;QAE3H,MAAM,SAAS,GAAG,EAAE,GAAG,YAAY,EAAE,EAAE,EAAE,YAAY,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;QACzF,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,SAAS,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3H,eAAe,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,0BAA0B,CAAC,CAAC;QAC1J,IAAI,UAAU,EAAE,CAAC;YACf,eAAe,CACb,CAAC,EACD,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,kBAAkB,EAAE,SAAS,EAAE,YAAY,CAAC,EAC3E,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,eAAe,CACb,CAAC,EACD,CAAC,KAAK,IAAI,EAAE;YACV,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,MAAM,aAAa,CAAC,mBAAmB,CAAC;gBACtC,EAAE;gBACF,eAAe;gBACf,WAAW,EAAE,YAAY;gBACzB,OAAO,EAAE;oBACP,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC7B,UAAU;oBACV,YAAY,EAAE,MAAM,CAAC,OAAO;oBAC5B,QAAQ;oBACR,UAAU,EAAE,MAAM,CAAC,MAAM;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,QAAQ,EAAE,EAAE;oBACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,EACJ,uBAAuB,CACxB,CAAC;QACF,MAAM,gBAAgB,CAAC,CAAC,EAAE;YACxB,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,YAAY;YACzB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,gBAAgB,CAAC,CAAC,EAAE;gBACxB,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,YAAY;gBACzB,IAAI,EAAE;oBACJ,EAAE,EAAE,MAAM,CAAC,UAAU;oBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,YAAY,EAAE,MAAM,CAAC,OAAO;oBAC5B,UAAU;oBACV,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,SAAS,EAAE,MAAM,CAAC,MAAM;oBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;iBAC1B;aACF,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CACb,CAAC,EACD,CAAC,KAAK,IAAI,EAAE;YACV,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,2BAA2B,EAAE;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,UAAU;gBACV,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;aAC9B,EAAE,EAAE,CAAC,CAAC;QACT,CAAC,CAAC,EAAE,EACJ,gCAAgC,CACjC,CAAC;QAEF,OAAO,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;QAC7E,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/routes/internal.d.ts

@@ -0,0 +1,14 @@
+import { Hono } from 'hono';
+import type { AppEnv } from '../env.js';
+/**
+ * Internal admin API for a trusted control plane (self-host).
+ *
+ * Mounted at `/internal`. Enabled only when `config.internalSecret` is set
+ * (RELAYCAST_INTERNAL_SECRET); otherwise every route answers the generic 404
+ * so the surface is indistinguishable from an engine that has none. Callers
+ * authenticate with `Authorization: Bearer <secret>`, compared in constant
+ * time. Request and response shapes match the hosted gateway's
+ * `/internal/capabilities` and `/internal/workspaces/:id/api-key`.
+ */
+export declare const internalRoutes: Hono<AppEnv, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=internal.d.ts.map

package/dist/routes/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/routes/internal.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAoBxC;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,qDAAqB,CAAC"}

package/dist/routes/internal.js

@@ -0,0 +1,157 @@
+import { isArWorkspaceId, parseCredential } from '@relaycast/types';
+import { AR_WORKSPACE_ID_REQUIRED, acceptsOnlyAr, credentialFormat } from '../auth/credentials.js';
+import { Hono } from 'hono';
+import { createMiddleware } from 'hono/factory';
+import { z } from 'zod';
+import { WorkspaceMetadataSchema } from '@relaycast/types';
+import { constantTimeEqual } from '../lib/crypto.js';
+import { errorResponse } from '../lib/httpError.js';
+import { jsonCreated, jsonError, jsonNotFound, jsonOk, parseJsonBody, parseOptionalJsonBody, } from '../lib/httpResponse.js';
+import { emitServerEvent } from '../lib/serverTelemetry.js';
+import * as workspaceEngine from '../engine/workspace.js';
+import { beginInternalWorkspaceDeletion, INTERNAL_CAPABILITIES, pushWorkspaceKey, } from '../engine/internalAdmin.js';
+import { WORKSPACE_KEY_MAX_GRACE_MS } from '../engine/tokenRotate.js';
+/**
+ * Internal admin API for a trusted control plane (self-host).
+ *
+ * Mounted at `/internal`. Enabled only when `config.internalSecret` is set
+ * (RELAYCAST_INTERNAL_SECRET); otherwise every route answers the generic 404
+ * so the surface is indistinguishable from an engine that has none. Callers
+ * authenticate with `Authorization: Bearer <secret>`, compared in constant
+ * time. Request and response shapes match the hosted gateway's
+ * `/internal/capabilities` and `/internal/workspaces/:id/api-key`.
+ */
+export const internalRoutes = new Hono();
+const WORKSPACE_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+const WORKSPACE_KEY_PATTERN = /^rk_live_[A-Za-z0-9_-]{32,256}$/;
+const requireInternalSecret = createMiddleware(async (c, next) => {
+    const expected = c.get('engine').config.internalSecret;
+    if (!expected) {
+        return jsonNotFound(c, 'not_found', 'Route not found');
+    }
+    const header = c.req.header('Authorization') ?? '';
+    const presented = header.startsWith('Bearer ') ? header.slice('Bearer '.length).trim() : '';
+    if (!(await constantTimeEqual(presented, expected))) {
+        return jsonError(c, 'unauthorized', 'Invalid internal token', 401);
+    }
+    await next();
+});
+internalRoutes.use('*', requireInternalSecret);
+// GET /internal/capabilities — non-mutating capability advertisement.
+internalRoutes.get('/capabilities', (c) => jsonOk(c, INTERNAL_CAPABILITIES));
+const createWorkspaceSchema = z.object({
+    name: z.string().trim().min(1).max(128),
+    metadata: WorkspaceMetadataSchema.optional(),
+}).strict();
+// POST /internal/workspaces — create a workspace and reveal its key once.
+// Self-host extension; the hosted control plane creates workspaces implicitly
+// through the upsert on /internal/workspaces/:id/api-key.
+internalRoutes.post('/workspaces', async (c) => {
+    try {
+        const parsed = await parseJsonBody(c, createWorkspaceSchema, 'name is required (1-128 characters)');
+        if (!parsed.ok)
+            return parsed.response;
+        const result = await workspaceEngine.createWorkspace(c.get('db'), parsed.data.name, {
+            ...(parsed.data.metadata === undefined ? {} : { metadata: parsed.data.metadata }),
+        });
+        emitServerEvent(c, result.workspace.workspace_id, 'workspace.created', {});
+        return jsonCreated(c, {
+            ...result.workspace,
+            name: parsed.data.name,
+            api_key_generation: 0,
+        });
+    }
+    catch (err) {
+        return errorResponse(c, err);
+    }
+});
+// DELETE /internal/workspaces/:id — authoritative, idempotent deletion for a
+// trusted control plane. Unlike the public route this authenticates with the
+// internal secret, so a retry remains distinguishable from a wrong workspace
+// key after the workspace row (and its key hash) is already gone.
+internalRoutes.delete('/workspaces/:id', async (c) => {
+    const workspaceId = c.req.param('id');
+    if (!WORKSPACE_ID_PATTERN.test(workspaceId)) {
+        return jsonError(c, 'invalid_request', 'Invalid workspace id', 400);
+    }
+    const fence = beginInternalWorkspaceDeletion(c.get('db'), workspaceId);
+    try {
+        await workspaceEngine.deleteWorkspace(c.get('db'), c.get('engine').files, workspaceId);
+        fence.commit();
+        return c.body(null, 204);
+    }
+    catch (err) {
+        fence.release();
+        return errorResponse(c, err);
+    }
+});
+const pushKeySchema = z.object({
+    // `rk_live_` + 32..256 URL-safe characters: the engine mints 32 hex chars and
+    // the cloud control plane mints base64url(32 bytes), so `-`/`_` are allowed.
+    // Not trimmed: the stored hash must match the exact bearer callers send,
+    // so surrounding whitespace is refused by the pattern instead.
+    // Or an `ar_ws_` workspace key naming this workspace (checked below).
+    api_key: z.string().refine((key) => WORKSPACE_KEY_PATTERN.test(key) || parseCredential(key)?.kind === 'workspace' && parseCredential(key)?.family === 'ar', 'api_key must be an rk_live_ workspace key (rk_live_ followed by 32-256 characters of [A-Za-z0-9_-]) or an ar_ws_ workspace key').optional(),
+    // Accepted for wire compatibility with the hosted gateway; the self-host
+    // engine has no plan entitlements, so the value is validated and ignored.
+    plan: z.string().min(1).optional(),
+    key_generation: z.number().int()
+        .min(1, 'key_generation must be a positive integer')
+        .max(Number.MAX_SAFE_INTEGER, 'key_generation must be a safe integer')
+        .optional(),
+    grace_ms: z.number().int().min(0).max(WORKSPACE_KEY_MAX_GRACE_MS).optional(),
+}).refine((body) => body.grace_ms === undefined || body.key_generation !== undefined || body.api_key === undefined, {
+    message: 'grace_ms requires key_generation',
+});
+// POST /internal/workspaces/:id/api-key — register (upsert) or rotate a
+// workspace key. Hosted shape: body `{ api_key, key_generation?, grace_ms?,
+// plan? }` → `{ workspace_id, api_key_generation }` (201 when the push created
+// the workspace). Self-host extension: omit `api_key` and the engine mints the
+// replacement, returned once as `api_key`.
+internalRoutes.post('/workspaces/:id/api-key', async (c) => {
+    try {
+        const workspaceId = c.req.param('id');
+        if (!WORKSPACE_ID_PATTERN.test(workspaceId)) {
+            return jsonError(c, 'invalid_request', 'Invalid workspace id', 400);
+        }
+        // A deployment that mints ar_ credentials carries the workspace in each
+        // one as a 64-bit snowflake, so it registers no other ids.
+        if (credentialFormat(c.get('db')) === 'ar' && !isArWorkspaceId(workspaceId)) {
+            return jsonError(c, 'invalid_request', AR_WORKSPACE_ID_REQUIRED, 400);
+        }
+        const parsed = await parseOptionalJsonBody(c, pushKeySchema, (result) => result.error.issues[0]?.message ?? 'Invalid key push body');
+        if (!parsed.ok)
+            return parsed.response;
+        const body = parsed.data;
+        if (body.api_key !== undefined) {
+            const key = parseCredential(body.api_key);
+            if (key?.family === 'ar' && key.workspaceId !== workspaceId) {
+                return jsonError(c, 'invalid_request', 'api_key names another workspace', 400);
+            }
+            // A deployment that accepts only ar_ credentials never holds a legacy key.
+            if (key?.family !== 'ar' && acceptsOnlyAr(c.get('db'))) {
+                return jsonError(c, 'invalid_request', 'api_key must be an ar_ws_ workspace key on this deployment', 400);
+            }
+        }
+        const result = await pushWorkspaceKey(c.get('db'), workspaceId, {
+            ...(body.api_key === undefined ? {} : { apiKey: body.api_key }),
+            ...(body.key_generation === undefined ? {} : { keyGeneration: body.key_generation }),
+            ...(body.grace_ms === undefined ? {} : { graceMs: body.grace_ms }),
+        });
+        if (result.mintedApiKey) {
+            emitServerEvent(c, workspaceId, 'workspace.key.rotated', {
+                grace_seconds: Math.floor((body.grace_ms ?? 0) / 1000),
+            });
+        }
+        const data = {
+            workspace_id: result.workspaceId,
+            api_key_generation: result.apiKeyGeneration,
+            ...(result.mintedApiKey ? { api_key: result.mintedApiKey } : {}),
+        };
+        return result.created ? jsonCreated(c, data) : jsonOk(c, data);
+    }
+    catch (err) {
+        return errorResponse(c, err);
+    }
+});
+//# sourceMappingURL=internal.js.map

package/dist/routes/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../../src/routes/internal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACpE,OAAO,EAAE,wBAAwB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACnG,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAE3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EACL,WAAW,EACX,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,EACb,qBAAqB,GACtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,eAAe,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AAEtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,IAAI,EAAU,CAAC;AAEjD,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AACtD,MAAM,qBAAqB,GAAG,iCAAiC,CAAC;AAEhE,MAAM,qBAAqB,GAAG,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IACvE,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IACvD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;QACpD,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,EAAE,CAAC;AACf,CAAC,CAAC,CAAC;AAEH,cAAc,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAE/C,sEAAsE;AACtE,cAAc,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAE7E,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,EAAE;CAC7C,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,0EAA0E;AAC1E,8EAA8E;AAC9E,0DAA0D;AAC1D,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;QACpG,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACvC,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;YAClF,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;SAClF,CAAC,CAAC;QACH,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,YAAY,EAAE,mBAAmB,EAAE,EAAE,CAAC,CAAC;QAC3E,OAAO,WAAW,CAAC,CAAC,EAAE;YACpB,GAAG,MAAM,CAAC,SAAS;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI;YACtB,kBAAkB,EAAE,CAAC;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,kEAAkE;AAClE,cAAc,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACnD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,CAAC,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,KAAK,GAAG,8BAA8B,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACvF,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,+DAA+D;IAC/D,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACxB,CAAC,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,WAAW,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,IAAI,EAC/H,gIAAgI,CACjI,CAAC,QAAQ,EAAE;IACZ,yEAAyE;IACzE,0EAA0E;IAC1E,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;SAC7B,GAAG,CAAC,CAAC,EAAE,2CAA2C,CAAC;SACnD,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,uCAAuC,CAAC;SACrE,QAAQ,EAAE;IACb,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,QAAQ,EAAE;CAC7E,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE;IAClH,OAAO,EAAE,kCAAkC;CAC5C,CAAC,CAAC;AAEH,wEAAwE;AACxE,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,2CAA2C;AAC3C,cAAc,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;IACzD,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5C,OAAO,SAAS,CAAC,CAAC,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;QACtE,CAAC;QACD,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;YAC5E,OAAO,SAAS,CAAC,CAAC,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,MAAM,EAAE,EAAE,CACtE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC;QAC9D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;gBAC5D,OAAO,SAAS,CAAC,CAAC,EAAE,iBAAiB,EAAE,iCAAiC,EAAE,GAAG,CAAC,CAAC;YACjF,CAAC;YACD,2EAA2E;YAC3E,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,IAAI,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBACvD,OAAO,SAAS,CAAC,CAAC,EAAE,iBAAiB,EAAE,4DAA4D,EAAE,GAAG,CAAC,CAAC;YAC5G,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE;YAC9D,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/D,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpF,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACxB,eAAe,CAAC,CAAC,EAAE,WAAW,EAAE,uBAAuB,EAAE;gBACvD,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;YAC3C,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACjE,CAAC;QACF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO,aAAa,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/routes/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/routes/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAiCxC,eAAO,MAAM,UAAU,qDAAqB,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/routes/node.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAgB,MAAM,MAAM,CAAC;AAG1C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAmCxC,eAAO,MAAM,UAAU,qDAAqB,CAAC"}

package/dist/routes/node.js

@@ -20,6 +20,8 @@ import { sendWebhookEvent } from './webhookOutbox.js';
 import { emitServerEvent } from '../lib/serverTelemetry.js';
 import { canonicalJson } from '../engine/messageMetadata.js';
 import { getObserverTokenFromContext, normalizeObserverFilters, observerAllowsAgent, } from '../engine/observerToken.js';
+import { derivationFamilies, credentialFromHex } from '../auth/credentials.js';
+import { ephemeralEventFetch } from '../ports/index.js';
 export const nodeRoutes = new Hono();
 const nodeKindSchema = z.enum(['ws', 'http_push', 'poll']);
 const nodeRoleSchema = z.enum(['direct', 'broker']);
@@ -182,8 +184,14 @@ async function enrollNode(c, data) {
                     idempotencyKey,
                     requestDigest,
                 ]));
+                // The replacement is derived in every family the first attempt may
+                // have committed it in, so a retry after a family switch or a
+                // keyring rotation still recovers it.
+                const db = c.get('db');
+                const workspaceId = c.get('workspace').id;
+                const families = await derivationFamilies(db, workspaceId);
                 return {
-                    replacementToken: `nt_live_${replacementDigest.slice(0, 48)}`,
+                    replacementTokens: await Promise.all(families.map((family) => credentialFromHex(db, family.format, 'node', workspaceId, replacementDigest, family.format === 'ar' ? family.tag : undefined))),
                     idempotencyKeyHash: await sha256Hex(idempotencyKey),
                     requestDigest,
                 };
@@ -354,7 +362,7 @@ nodeRoutes.post('/nodes/:node/actions/:name/invoke', requireAuth, rateLimit, asy
                 nodeConnections: c.get('engine').nodeConnections,
                 environment: c.get('engine').config?.environment,
                 httpPushProxy: c.get('engine').config?.httpPushProxy,
-                outboundWebhookFetch: c.get('engine').config?.outboundWebhookFetch,
+                ephemeralEventFetch: ephemeralEventFetch(c.get('engine').config),
                 workspaceId: workspace.id,
             }, {
                 agentIds: [agent.id],
@@ -388,6 +396,40 @@ nodeRoutes.delete('/nodes/:node/providers/:name', requireWorkspaceKey, rateLimit
         return errorResponse(c, err);
     }
 });
+const NODE_DELETE_CONFLICTS = {
+    node_online: 'Node is online; pass force=true to delete it anyway',
+    node_has_actions: 'Node hosts registered actions; pass force=true to delete them with it',
+    node_delete_conflict: 'Node changed during deletion; retry',
+};
+// DELETE /v1/nodes/:name?force= - delete a node by id or name
+nodeRoutes.delete('/nodes/:name', requireWorkspaceKey, rateLimit, async (c) => {
+    try {
+        const db = c.get('db');
+        const workspace = c.get('workspace');
+        const idOrName = c.req.param('name');
+        const node = await nodeEngine.getNodeById(db, workspace.id, idOrName)
+            ?? await nodeEngine.getNodeByName(db, workspace.id, idOrName);
+        if (!node) {
+            return jsonNotFound(c, 'node_not_found', 'Node not found');
+        }
+        // Serialize with node-control operations so a register/heartbeat in this
+        // isolate cannot interleave; the engine's guarded DELETE covers the rest.
+        // Only the resolved id crosses the lock: re-resolving the path inside it
+        // could pick a different node after a concurrent delete.
+        const result = await serializeNodeOp(workspace.id, node.id, () => nodeEngine.deleteNode(db, c.get('engine'), workspace.id, node.id, {
+            force: c.req.query('force') === 'true',
+        }));
+        if (!result.ok) {
+            return result.code === 'node_not_found'
+                ? jsonNotFound(c, 'node_not_found', 'Node not found')
+                : jsonError(c, result.code, NODE_DELETE_CONFLICTS[result.code], 409);
+        }
+        return jsonOk(c, { id: result.id, name: result.name, deleted: true, cascaded_actions: result.cascadedActions });
+    }
+    catch (err) {
+        return errorResponse(c, err);
+    }
+});
 // GET /v1/nodes/:name - single node roster entry
 // GET /v1/node/me - the node a node token belongs to. A service handed the
 // token (Cloud, recording who owns a node) proves which node it is without