@sema-agent/server 1.314.0 → 1.316.0

package/dist/http/server.js

@@ -33,8 +33,28 @@ import { projectArtifacts } from "../trace/artifacts.js";
 import { composeSupervisorCost, infraCost, infraUsageFromEvents, hasInfraPricing } from "../observability/cost-taxonomy.js";
 import { redactSecrets, redactDeep, redactedPreview } from "../trace/redact.js";
 import { usageSummary, usageSeries, usageBreakdown } from "../usage-analytics.js";
-import { IdempotencyCache } from "./idempotency.js";
+import { IdempotencyCache, scopedIdempotencyKey } from "./idempotency.js";
+export { scopedIdempotencyKey };
+import { streamSseLog, sleep } from "./sse-log.js";
+import { handleCapabilities } from "./routes/capabilities.js";
+import { handleObservability } from "./routes/observability.js";
+import { handleMemoryPolicy } from "./routes/memory-policy.js";
+import { handleSessionsList } from "./routes/sessions-list.js";
+import { handleSessions, createSessionsLocal } from "./routes/sessions.js";
+import { handleSessionSync, createSessionSyncLocal } from "./routes/session-sync.js";
+import { handleAttachments } from "./routes/attachments.js";
+import { handleImages, createImagesLocal, coarseStatusForState, errorCodeForExit, IMAGE_DIGEST_RE, IMAGE_PROFILE_RE, BAKE_ID_RE, BAKE_EVENTS_RE, BAKE_CANCEL_RE, BAKE_CLAIM_RE, BAKE_INGEST_RE } from "./routes/images.js";
+export { coarseStatusForState, errorCodeForExit };
+import { sendJson, sendError, msg, sseHeaders } from "./send.js";
+import { headerStr, safeEqual, authorized, systemFor, bearerPresentedButUnverified, gatedPrincipal, explicitOperatorOk, isOperator, explicitOperator } from "./principal-gate.js";
+export { explicitOperatorOk, isOperator, explicitOperator };
 import { pgHasUnstorable } from "../plugins/pg-safe-json.js";
+export function flattenServiceDeps(deps) {
+    const { stores, coordinators, seams, observability, governance, deployment, knobs, ...flat } = deps;
+    if (!(stores || coordinators || seams || observability || governance || deployment || knobs))
+        return deps;
+    return { ...stores, ...coordinators, ...seams, ...observability, ...governance, ...deployment, ...knobs, ...flat };
+}
 export const MAX_USER_SKILLS = 10;
 export const MAX_SKILL_CONTENT_CHARS = 1_048_576;
 export const MAX_SYSTEM_PROMPT_CHARS = 16_384;
@@ -66,42 +86,6 @@ export function validateUserSkills(skills) {
     }
     return null;
 }
-export function explicitOperatorOk(principal, operatorPrincipals) {
-    return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
-}
-export function coarseStatusForState(state) {
-    if (state === "COMPLETE")
-        return "done";
-    if (state === "FAILED" || state === "CANCELLED")
-        return "failed";
-    return "running";
-}
-export function errorCodeForExit(exitCode, cancelled) {
-    if (cancelled)
-        return "cancelled";
-    switch (exitCode) {
-        case 9:
-            return "band-conflict";
-        case 10:
-            return "duplicate";
-        case 124:
-            return "timeout";
-        case 507:
-            return "disk";
-        default:
-            return null;
-    }
-}
-const RUNNER_ERROR_CODES = new Set(["band-conflict", "duplicate", "disk", "timeout", "cancelled"]);
-const SANDBOX_BASE_PROFILE = "sandbox-base";
-export function isOperator(principal, operatorPrincipals) {
-    if (operatorPrincipals.length === 0)
-        return true;
-    return principal !== undefined && operatorPrincipals.includes(principal);
-}
-export function explicitOperator(principal, operatorPrincipals) {
-    return operatorPrincipals.length > 0 && principal !== undefined && operatorPrincipals.includes(principal);
-}
 export function cascadeConfig(ladder, maxCostUsd) {
     return {
         ladder: ladder.map((model) => ({ model })),
@@ -112,9 +96,6 @@ export function clampVerifyRounds(v) {
     const n = typeof v === "number" && Number.isFinite(v) ? Math.floor(v) : 2;
     return Math.min(5, Math.max(1, n));
 }
-export function scopedIdempotencyKey(raw, source, principal) {
-    return raw ? `${source ?? ""}\x1f${principal ?? ""}\x1f${raw}` : undefined;
-}
 export function isQuestionAnswer(v) {
     if (!v || typeof v !== "object" || Array.isArray(v))
         return false;
@@ -135,10 +116,6 @@ export function isQuestionAnswer(v) {
 const MAX_BODY = 8 * 1024 * 1024;
 const MAX_IMAGES_PER_REQUEST = 20;
 const MAX_IMAGE_BASE64_BYTES = 6 * 1024 * 1024;
-const SYNC_BLOB_MAX_BYTES = 64 * 1024 * 1024;
-const SYNC_NDJSON_LINE_MAX_BYTES = 8 * 1024 * 1024;
-const SYNC_IMPORT_BATCH = 500;
-const SHA256_HEX_RE = /^[0-9a-f]{64}$/;
 const RUN_ID_RE = /^\/v1\/runs\/([^/]+)(\/events)?$/;
 const RUN_CANCEL_RE = /^\/v1\/runs\/([^/]+)\/cancel$/;
 const RUN_STEER_RE = /^\/v1\/runs\/([^/]+)\/steer$/;
@@ -158,13 +135,6 @@ const TOOL_APPROVAL_RESPOND_RE = /^\/v1\/tool-approvals\/([^/]+)\/respond$/;
 const ASSISTANT_PREEMPT_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/preempt$/;
 const ASSISTANT_RESUME_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/resume$/;
 const ASSISTANT_PLAN_REVIEW_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/plan_review$/;
-const IMAGE_DIGEST_RE = /^\/v1\/images\/digests\/([^/]+)$/;
-const IMAGE_PROFILE_RE = /^\/v1\/images\/([^/]+)$/;
-const BAKE_ID_RE = /^\/v1\/images\/bakes\/([^/]+)$/;
-const BAKE_EVENTS_RE = /^\/v1\/images\/bakes\/([^/]+)\/events$/;
-const BAKE_CANCEL_RE = /^\/v1\/images\/bakes\/([^/]+)\/cancel$/;
-const BAKE_CLAIM_RE = /^\/v1\/images\/bakes\/([^/]+)\/claim$/;
-const BAKE_INGEST_RE = /^\/v1\/images\/bakes\/([^/]+)\/ingest$/;
 const TRACE_RE = /^\/v1\/tasks(?:\/([^/]+)(\/turns|\/stream|\/artifacts))?$/;
 const WORKFLOWS_RE = /^\/v1\/workflows(?:\/([^/]+)(\/stream|\/journal)?)?$/;
 const WORKFLOW_AGENT_STEER_RE = /^\/v1\/workflows\/([^/]+)\/agents\/([^/]+)\/steer$/;
@@ -178,37 +148,28 @@ const HAND_TOOL_NAMES = Object.keys(HAND_TOOL_EFFECTS);
 function isCheckpointReopenedFailure(r) {
     return r.status === "failed" && (r.errorCode === "resume.env_failed" || r.errorCode === "resume.tool_unavailable");
 }
-function gatedPrincipal(req, config) {
-    if (bearerPresentedButUnverified(req, config))
-        return undefined;
-    return verifiedPrincipal(req, config);
-}
-function bearerPresentedButUnverified(req, config) {
-    const h = req.headers.authorization;
-    if (typeof h !== "string" || !/^(Bearer|token) /i.test(h))
-        return false;
-    if (ssoVerifiedPrincipal(req))
-        return false;
-    if (systemFor(req, config) !== undefined)
-        return false;
-    if (config.traceToken && authorized(req, config.traceToken))
-        return false;
-    return true;
-}
-export function createHttpServer(deps) {
+const ROUTE_DOMAINS = [
+    handleCapabilities,
+    handleImages,
+    handleObservability,
+    handleMemoryPolicy,
+    handleSessionsList,
+    handleSessions,
+    handleSessionSync,
+    handleAttachments,
+];
+void ROUTE_DOMAINS;
+export function createHttpServer(rawDeps) {
+    const deps = flattenServiceDeps(rawDeps);
     const idemCache = new IdempotencyCache();
-    let sseConnections = 0;
-    let sseOwnerLookups = 0;
-    const bakeSubmitLimiter = new RateLimiter(deps.config.imageBakes?.submitRateMax ?? 0, (deps.config.imageBakes?.submitRateWindowSec ?? 60) * 1000);
     const inflightRuns = new Map();
     const cancelledViaVerb = new Set();
     const preemptableRuns = new Map();
     const steerableRuns = new Map();
     const wakeParkMints = new Map();
-    let uncountedBillableInflight = 0;
-    let admittedInflight = 0;
+    const counters = { uncountedBillableInflight: 0, admittedInflight: 0 };
     if (deps.drainState)
-        deps.drainState.inflight = () => new Set([...inflightRuns.keys(), ...steerableRuns.keys()]).size + uncountedBillableInflight + admittedInflight + (deps.leaderEndpoint?.inflight?.() ?? 0);
+        deps.drainState.inflight = () => new Set([...inflightRuns.keys(), ...steerableRuns.keys()]).size + counters.uncountedBillableInflight + counters.admittedInflight + (deps.leaderEndpoint?.inflight?.() ?? 0);
     let lastBillableActivityAt = performance.now();
     const noteActivity = (url) => {
         if (url === "/health" || url.startsWith("/metrics"))
@@ -254,22 +215,6 @@ export function createHttpServer(deps) {
             }
         };
     }
-    const mcpStatusCache = new Map();
-    const MCP_STATUS_TTL_MS = 5_000;
-    const MCP_MATERIALIZE_TIMEOUT_MS = 10_000;
-    const pendingStagings = new Map();
-    const importLeases = new Map();
-    const touchImportLease = (sessionId) => {
-        const cur = importLeases.get(sessionId);
-        if (cur)
-            importLeases.set(sessionId, { ...cur, at: Date.now() });
-    };
-    const cleanupStaging = (stagingId) => {
-        const p = pendingStagings.get(stagingId);
-        if (p)
-            importLeases.delete(p.realSessionId);
-        pendingStagings.delete(stagingId);
-    };
     const server = http.createServer((req, res) => {
         void handle(req, res).catch((err) => {
             if (err instanceof HttpError) {
@@ -286,6 +231,12 @@ export function createHttpServer(deps) {
                 res.end();
         });
     });
+    const routeCtxBase = {
+        deps,
+        registry: { idemCache, inflightRuns, preemptableRuns, cancelledViaVerb, steerableRuns, wakeParkMints, counters },
+        helpers: { readJson, readRawBody, rateLimited, quotaExceeded, leaseDenied, safeDecode, isFleetWide, runOwnerOk, sessionOwnerScope, sessionOwnerScopeForWrite, runSessionAcceptOk },
+        local: { images: createImagesLocal(deps), sessions: createSessionsLocal(), sessionSync: createSessionSyncLocal() },
+    };
     async function handle(req, res) {
         const startedAt = Date.now();
         const method = req.method ?? "GET";
@@ -293,16 +244,16 @@ export function createHttpServer(deps) {
         noteActivity(url);
         const admitted = method !== "OPTIONS" && url !== "/health" && !url.startsWith("/metrics");
         if (admitted)
-            admittedInflight++;
+            counters.admittedInflight++;
         let logged = false;
-        let streamTaskId;
-        let streamDetached = false;
+        const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
+        const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, req: reqState };
         const record = (viaClose) => {
             if (logged)
                 return;
             logged = true;
             if (admitted)
-                admittedInflight--;
+                counters.admittedInflight--;
             const route = routeLabel(method, url);
             const seconds = (Date.now() - startedAt) / 1000;
             const aborted = viaClose && !res.writableEnded;
@@ -310,7 +261,7 @@ export function createHttpServer(deps) {
             deps.metrics?.inc("http_requests_total", { route, method, status });
             deps.metrics?.observe("http_request_duration_seconds", seconds, { route });
             const log = route === "/health" || route === "/metrics" ? deps.logger?.debug : deps.logger?.info;
-            log?.call(deps.logger, "request", { method, route, status, ms: Date.now() - startedAt, ...(aborted ? { aborted: true, ...(streamTaskId ? { taskId: streamTaskId } : {}), ...(streamDetached ? { detached: true } : {}) } : {}) });
+            log?.call(deps.logger, "request", { method, route, status, ms: Date.now() - startedAt, ...(aborted ? { aborted: true, ...(reqState.streamTaskId ? { taskId: reqState.streamTaskId } : {}), ...(reqState.streamDetached ? { detached: true } : {}) } : {}) });
         };
         res.on("finish", () => record(false));
         res.on("close", () => record(true));
@@ -623,6 +574,7 @@ export function createHttpServer(deps) {
                 source = sys;
             }
         }
+        reqState.source = source;
         if (req.method === "POST" &&
             !anyServiceAuth &&
             !deps.config.allowUnauthedWrites &&
@@ -651,103 +603,8 @@ export function createHttpServer(deps) {
             });
             return;
         }
-        if (req.method === "GET" && url.startsWith("/v1/capabilities/scenarios/")) {
-            const name = url.slice("/v1/capabilities/scenarios/".length).split("?")[0];
-            const detail = deps.scenarioDetails?.[name];
-            if (!detail) {
-                sendError(res, 404, "scenario_not_found", "scenario not found");
-                return;
-            }
-            sendJson(res, 200, detail);
-            return;
-        }
-        if (req.method === "GET" && url === "/v1/capabilities") {
-            sendJson(res, 200, {
-                ...deps.capabilities,
-                asyncRuns: Boolean(deps.runStore),
-                artifacts: Boolean(deps.runStore),
-                approvals: Boolean(deps.checkpointStore),
-                sessions: Boolean(deps.sessionAudit),
-                sessionEvents: Boolean(deps.sessionWatch && deps.sessionStorage?.getLeafId && deps.sessionStorage?.ownerOf),
-                fleet: deps.fleetBus
-                    ? { stream: true, sessionScope: true, observe: true, resume: "snapshot", bgNotifyFailClosed: true, steerPriority: "advisory" }
-                    : false,
-                workspace: (() => {
-                    const wfs = deps.fileSnapshotStore;
-                    return wfs && typeof wfs.listKeys === "function" && typeof wfs.exportManifest === "function" && typeof wfs.getBlob === "function" && Boolean(deps.sessionStorage?.ownerOf)
-                        ? { browse: true, archive: true, maxFileBytes: deps.config.workspaceFileMaxBytes ?? 8 * 1024 * 1024 }
-                        : false;
-                })(),
-                leader: Boolean(deps.leaderEndpoint),
-                memory: false,
-                memoryWrite: false,
-                policy: true,
-                usage: Boolean(deps.costQuota),
-                permissionModeWrite: false,
-                modelSelection: true,
-                effortSelection: true,
-                toolOutput: true,
-                messageIdentity: true,
-                forwardSubagentEvents: true,
-                scratchpadDir: true,
-                subagentSteer: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
-                subagentResume: Boolean(deps.subagentSteerRegistry) && Boolean(deps.runStore),
-                taskSettings: { permissions: true, permissionMode: true, model: true, outputStyle: true, env: false, hooks: deps.config.requirePrincipal !== true },
-                appendSystemPrompt: true,
-                compactionModel: true,
-                subagentOutput: Boolean(deps.subagentTaskOutput) && Boolean(deps.runStore),
-                subagentStream: Boolean(deps.subagentTaskOutput) && Boolean(deps.runStore),
-                taskHandles: Boolean(deps.taskHandleOutput) && Boolean(deps.taskHandleStop) && Boolean(deps.runStore),
-                taskAgents: deps.config.requirePrincipal !== true,
-                retainBackgroundProcesses: deps.config.requirePrincipal !== true,
-                interactiveTools: true,
-                projectContext: cwdHonored(deps.config),
-                mcpInjection: mcpInjectionHonored(deps.config),
-                modelUsage: Boolean(deps.runStore && deps.modelUsage),
-                sessionInit: true,
-                mcp: true,
-                mcpElicitation: Boolean(deps.elicitation),
-                askUserQuestion: Boolean(deps.question),
-                toolApproval: Boolean(deps.toolApproval),
-                sideQuery: true,
-                sessionList: Boolean(deps.sessionStorage?.listSessions ?? deps.runStore?.listSessions),
-                sessionSearch: Boolean(deps.sessionStorage?.listSessions ?? deps.runStore?.listSessions),
-                sessionFork: Boolean(deps.sessionStorage?.fork),
-                sessionDelete: Boolean(deps.purgeSession),
-                resumeAt: Boolean(deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
-                promptSuggestions: true,
-                sessionPolicy: Boolean(deps.sessionPolicyStore),
-                rewindFiles: Boolean(deps.fileSnapshotStore),
-                rewindFilesTo: Boolean(deps.fileSnapshotStore && deps.resumeAnchorStore && deps.sessionStorage?.getLeafId),
-                scheduler: Boolean(deps.config.schedulerEnabled && deps.config.requirePrincipal !== true && deps.config.remoteExec?.provider === "host"),
-                sessionSync: Boolean(deps.backend && deps.sessionStorage?.exportEntries && deps.fileSnapshotStore),
-                sendUserFile: Boolean(deps.sendUserFile && deps.config.sendUserFile?.publicEndpoint),
-                s3PublicEndpoint: deps.config.sendUserFile?.publicEndpoint ?? null,
-                sendUserFileLedger: Boolean(deps.sendFileLedger),
-                workflows: deps.workflowsCapable ?? Boolean(deps.workflowRunStore),
-                workflowsList: Boolean(deps.workflowRunStore),
-                manualCompact: Boolean(deps.runStore),
-            });
-            return;
-        }
-        if (req.method === "GET" && url === "/v1/models") {
-            const models = Object.entries(deps.config.models)
-                .filter(([name]) => name !== "default")
-                .map(([name, m]) => ({
-                name,
-                id: m.id,
-                provider: m.provider,
-                reasoning: m.reasoning,
-                vision: Array.isArray(m.input) ? m.input.includes("image") : false,
-                ...(m.contextWindow ? { contextWindow: m.contextWindow } : {}),
-                ...(m.maxTokens ? { maxOutputTokens: m.maxTokens } : {}),
-                ...(m.reasoning ? { supportedEffortLevels: [...DEFAULT_EFFORT_LEVELS] } : {}),
-            }));
-            const nonAlias = Object.entries(deps.config.models).filter(([n]) => n !== "default");
-            const defaultName = (nonAlias.find(([, m]) => m === deps.config.model) ?? nonAlias.find(([, m]) => m.id === deps.config.model.id))?.[0];
-            sendJson(res, 200, { models, default: deps.config.model.id, defaultModel: { id: deps.config.model.id, ...(defaultName ? { name: defaultName } : {}) } });
+        if (await handleCapabilities(req, res, url, ctx))
             return;
-        }
         if (req.method === "POST" && url === "/v1/side-query") {
             const ac = new AbortController();
             const onClose = () => ac.abort();
@@ -863,9 +720,9 @@ export function createHttpServer(deps) {
                     sendJson(res, 400, { error: "x-detach-on-disconnect requires a durable run (a run store + sessionId) — without one the detached result would be unqueryable" });
                     return;
                 }
-                streamTaskId = earlyDurableTid;
+                reqState.streamTaskId = earlyDurableTid;
                 let usageKey;
-                streamDetached = detachOnDisconnect;
+                reqState.streamDetached = detachOnDisconnect;
                 sseHeaders(res, earlyDurableTid ? { "x-task-id": earlyDurableTid } : undefined);
                 if (earlyDurableTid) {
                     res.write(`event: meta\ndata: ${JSON.stringify({ type: "meta", taskId: earlyDurableTid, ...(prepared.spec.sessionId ? { sessionId: prepared.spec.sessionId } : {}) })}\n\n`);
@@ -900,7 +757,7 @@ export function createHttpServer(deps) {
                 }, 15_000);
                 let ranLive = false;
                 let resp;
-                uncountedBillableInflight++;
+                counters.uncountedBillableInflight++;
                 try {
                     resp = await idemCache.run(idemKey, async () => {
                         ranLive = true;
@@ -1322,7 +1179,7 @@ export function createHttpServer(deps) {
                         throw e;
                 }
                 finally {
-                    uncountedBillableInflight--;
+                    counters.uncountedBillableInflight--;
                     clearInterval(hb);
                     if (usageKey)
                         deps.modelUsage?.clear(usageKey);
@@ -1376,7 +1233,7 @@ export function createHttpServer(deps) {
                     const specWithSignal = { ...prepared.spec, signal: syncCancelCtrl.signal };
                     let result;
                     let cancelVerbLabel = false;
-                    uncountedBillableInflight++;
+                    counters.uncountedBillableInflight++;
                     try {
                         result = await withPrincipal(principal, () => prepared.verify
                             ? runWithVerification(deps.runner, specWithSignal, prepared.verify)
@@ -1385,7 +1242,7 @@ export function createHttpServer(deps) {
                                 : deps.runner.runTask(specWithSignal));
                     }
                     finally {
-                        uncountedBillableInflight--;
+                        counters.uncountedBillableInflight--;
                         if (durableHeartbeat)
                             clearInterval(durableHeartbeat);
                         if (durableTaskId && inflightRuns.get(durableTaskId) === syncCancelCtrl) {
@@ -2426,323 +2283,8 @@ export function createHttpServer(deps) {
                 }
             }
         }
-        if (deps.imageBakes && url.startsWith("/v1/images/bakes")) {
-            const bakes = deps.imageBakes;
-            const idx = deps.imageIndex;
-            const principal = gatedPrincipal(req, deps.config);
-            const operators = deps.config.operatorPrincipals;
-            const explicitOperator = explicitOperatorOk(principal, operators);
-            const cfg = deps.config.imageBakes;
-            const isRunner = source !== undefined && source !== null && source === cfg.runnerPrincipal;
-            if (req.method === "POST" && url === "/v1/images/bakes") {
-                if (!explicitOperator) {
-                    sendJson(res, 403, { error: "operator only" });
-                    return;
-                }
-                const rl = bakeSubmitLimiter.check(`bake:${principal}`);
-                if (!rl.allowed) {
-                    res.setHeader("retry-after", String(rl.retryAfterSec));
-                    sendJson(res, 429, { error: "bake submission rate exceeded", retryAfterSec: rl.retryAfterSec });
-                    return;
-                }
-                const body = (await readJson(req));
-                const v = validateBake(body);
-                if (!v.ok) {
-                    sendJson(res, v.status, { error: v.error, ...(v.conflictBands ? { errorCode: "band-conflict", conflictBands: v.conflictBands } : {}) });
-                    return;
-                }
-                let effectiveBaseRef;
-                if (v.baseRef) {
-                    const baseEntry = idx ? await idx.getByDigest(v.baseRef) : null;
-                    if (!baseEntry || baseEntry.status !== "published" || baseEntry.profile !== SANDBOX_BASE_PROFILE) {
-                        sendJson(res, 400, { error: "baseRef is not a known published sandbox-base digest" });
-                        return;
-                    }
-                    effectiveBaseRef = v.baseRef;
-                }
-                else {
-                    effectiveBaseRef = cfg.defaultBaseRef ?? (idx ? (await idx.latestPublished(SANDBOX_BASE_PROFILE, { operator: true }))?.digest ?? null : null);
-                }
-                if (!v.dryRun && !effectiveBaseRef) {
-                    sendJson(res, 503, { error: "no sandbox-base available to build from (set SANDBOX_BASE_REF or publish a sandbox-base image)" });
-                    return;
-                }
-                const argv = buildBakeArgv(v, { baseRef: effectiveBaseRef, cacheBase: cfg.cacheBase });
-                const rawIdem = headerStr(req.headers["idempotency-key"]) ?? (typeof body.idempotencyKey === "string" ? body.idempotencyKey : undefined);
-                const idemKey = rawIdem ? scopedIdempotencyKey(rawIdem, source, principal) ?? null : null;
-                const createInput = {
-                    profile: v.profile,
-                    bands: v.bands,
-                    baseRef: effectiveBaseRef,
-                    push: v.push,
-                    dryRun: v.dryRun,
-                    logs: v.logs,
-                    argv,
-                    idemKey,
-                    requestedBy: principal ?? null,
-                };
-                if (!v.dryRun) {
-                    const sameArgv = await bakes.findActiveByArgv(argv);
-                    if (sameArgv) {
-                        sendJson(res, 202, { bakeId: sameArgv.bakeId, eventsUrl: `/v1/images/bakes/${sameArgv.bakeId}/events`, status: sameArgv.status, state: sameArgv.state });
-                        return;
-                    }
-                    const r = await bakes.createBakeIfIdle(createInput);
-                    if (!r.created) {
-                        const sameNow = await bakes.findActiveByArgv(argv);
-                        if (sameNow) {
-                            sendJson(res, 202, { bakeId: sameNow.bakeId, eventsUrl: `/v1/images/bakes/${sameNow.bakeId}/events`, status: sameNow.status, state: sameNow.state });
-                            return;
-                        }
-                        const busy = await bakes.findActiveAny();
-                        sendJson(res, 409, { error: "a bake is already in progress", ...(busy ? { activeBakeId: busy.bakeId, eventsUrl: `/v1/images/bakes/${busy.bakeId}/events` } : {}) });
-                        return;
-                    }
-                    sendJson(res, 202, { bakeId: r.bake.bakeId, eventsUrl: `/v1/images/bakes/${r.bake.bakeId}/events`, status: r.bake.status, state: r.bake.state });
-                    return;
-                }
-                const { bake } = await bakes.createBake(createInput);
-                sendJson(res, 202, { bakeId: bake.bakeId, eventsUrl: `/v1/images/bakes/${bake.bakeId}/events`, status: bake.status, state: bake.state });
-                return;
-            }
-            const evMatch = req.method === "GET" ? BAKE_EVENTS_RE.exec(url) : null;
-            if (evMatch) {
-                if (!explicitOperator) {
-                    sendJson(res, 403, { error: "operator only" });
-                    return;
-                }
-                const bakeId = decodeURIComponent(evMatch[1]);
-                const bake = await bakes.getBake(bakeId);
-                if (!bake) {
-                    sendJson(res, 404, { error: "bake not found" });
-                    return;
-                }
-                await streamBakeEvents(req, res, bakes, bakeId, cfg.staleMs);
-                return;
-            }
-            const cancelMatch = req.method === "POST" ? BAKE_CANCEL_RE.exec(url) : null;
-            if (cancelMatch) {
-                if (!explicitOperator) {
-                    sendJson(res, 403, { error: "operator only" });
-                    return;
-                }
-                const bakeId = decodeURIComponent(cancelMatch[1]);
-                const bake = await bakes.getBake(bakeId);
-                if (!bake) {
-                    sendJson(res, 404, { error: "bake not found" });
-                    return;
-                }
-                const flagged = await bakes.requestCancel(bakeId);
-                sendJson(res, 202, { bakeId, cancelRequested: true, note: flagged ? "cancel requested — the runner kills the build at the next heartbeat" : "bake already terminal — cancel is a no-op" });
-                return;
-            }
-            if (req.method === "POST" && url === "/v1/images/bakes/claim") {
-                if (!isRunner) {
-                    sendJson(res, 403, { error: "bake-runner only" });
-                    return;
-                }
-                const body = (await readJson(req));
-                const runnerId = typeof body.runnerId === "string" && body.runnerId.length > 0 ? body.runnerId : (principal ?? source ?? cfg.runnerPrincipal);
-                let claimed = null;
-                for (let attempt = 0; attempt < 4 && !claimed; attempt++) {
-                    const nextId = await bakes.findNextQueuedId();
-                    if (!nextId)
-                        break;
-                    claimed = await bakes.claimBake(nextId, runnerId, cfg.leaseMs);
-                }
-                if (!claimed) {
-                    res.writeHead(204).end();
-                    return;
-                }
-                sendJson(res, 200, claimResponse(claimed));
-                return;
-            }
-            const claimMatch = req.method === "POST" ? BAKE_CLAIM_RE.exec(url) : null;
-            if (claimMatch) {
-                if (!isRunner) {
-                    sendJson(res, 403, { error: "bake-runner only" });
-                    return;
-                }
-                const bakeId = decodeURIComponent(claimMatch[1]);
-                const body = (await readJson(req));
-                const runnerId = typeof body.runnerId === "string" && body.runnerId.length > 0 ? body.runnerId : (principal ?? source ?? cfg.runnerPrincipal);
-                const claimed = await bakes.claimBake(bakeId, runnerId, cfg.leaseMs);
-                if (!claimed) {
-                    sendJson(res, 409, { error: "bake not claimable (already claimed or the build lease is held)" });
-                    return;
-                }
-                sendJson(res, 200, claimResponse(claimed));
-                return;
-            }
-            const ingestMatch = req.method === "POST" ? BAKE_INGEST_RE.exec(url) : null;
-            if (ingestMatch) {
-                if (!isRunner) {
-                    sendJson(res, 403, { error: "bake-runner only" });
-                    return;
-                }
-                const bakeId = decodeURIComponent(ingestMatch[1]);
-                const bake = await bakes.getBake(bakeId);
-                if (!bake) {
-                    sendJson(res, 404, { error: "bake not found" });
-                    return;
-                }
-                const presented = headerStr(req.headers["x-bake-ingest-secret"]);
-                if (!bake.ingestSecret || !presented || !safeEqual(presented, bake.ingestSecret)) {
-                    sendJson(res, 403, { error: "invalid ingest secret" });
-                    return;
-                }
-                const line = (await readJson(req));
-                if (line.event === "heartbeat") {
-                    const fresh = await bakes.getBake(bakeId);
-                    if (!fresh || fresh.status !== "running") {
-                        sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
-                        return;
-                    }
-                    const ok = bake.runnerId ? await bakes.heartbeatLease(bakeId, bake.runnerId, cfg.leaseMs) : false;
-                    if (!ok) {
-                        sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh.cancelRequested });
-                        return;
-                    }
-                    sendJson(res, 200, { accepted: true, leaseValid: true, cancelRequested: fresh.cancelRequested });
-                    return;
-                }
-                const fresh = await bakes.getBake(bakeId);
-                if (!fresh || fresh.status !== "running") {
-                    sendJson(res, 409, { accepted: false, leaseValid: false, cancelRequested: fresh?.cancelRequested ?? false });
-                    return;
-                }
-                if (fresh.runnerId) {
-                    await bakes.heartbeatLease(bakeId, fresh.runnerId, cfg.leaseMs).catch(() => undefined);
-                }
-                const result = await ingestBakeLine(bakes, idx, fresh, line, cfg.registry);
-                const after = await bakes.getBake(bakeId);
-                sendJson(res, result.status, { ...result.body, cancelRequested: after?.cancelRequested ?? false, leaseValid: true });
-                return;
-            }
-            const idMatch = req.method === "GET" ? BAKE_ID_RE.exec(url) : null;
-            if (idMatch) {
-                if (!explicitOperator) {
-                    sendJson(res, 403, { error: "operator only" });
-                    return;
-                }
-                const bakeId = decodeURIComponent(idMatch[1]);
-                const bake = await bakes.getBake(bakeId);
-                if (!bake) {
-                    sendJson(res, 404, { error: "bake not found" });
-                    return;
-                }
-                sendJson(res, 200, { bake: bakeView(bake) });
-                return;
-            }
-            sendJson(res, 404, { error: "not found" });
+        if (await handleImages(req, res, url, ctx))
             return;
-        }
-        if (deps.imageIndex && url.startsWith("/v1/images")) {
-            const idx = deps.imageIndex;
-            const principal = gatedPrincipal(req, deps.config);
-            const operator = explicitOperator(principal, deps.config.operatorPrincipals);
-            const viewer = { operator, tenantId: principal ?? null };
-            const q = new URL(req.url ?? "", "http://x").searchParams;
-            if (req.method === "GET" && url === "/v1/images") {
-                const limRaw = q.get("limit");
-                const { entries, nextCursor } = await idx.list({
-                    ...viewer,
-                    profile: q.get("profile") ?? undefined,
-                    status: q.get("status") ?? undefined,
-                    capability: q.get("capability") ?? undefined,
-                    latestOnly: q.get("latest") === "true",
-                    limit: limRaw ? Number(limRaw) : undefined,
-                    cursor: q.get("cursor") ?? undefined,
-                });
-                sendJson(res, 200, { images: entries, nextCursor });
-                return;
-            }
-            if (req.method === "POST" && url === "/v1/images/select") {
-                const body = (await readJson(req));
-                const profile = typeof body.profile === "string" ? body.profile : "";
-                if (!profile) {
-                    sendJson(res, 400, { error: "profile is required" });
-                    return;
-                }
-                const entry = await idx.latestPublished(profile, viewer);
-                if (!entry) {
-                    sendJson(res, 404, { error: `no published image for profile '${profile}' visible to this principal` });
-                    return;
-                }
-                const needed = Array.isArray(body.capabilitiesNeeded)
-                    ? body.capabilitiesNeeded.filter((c) => typeof c === "string")
-                    : [];
-                const caps = entry.capabilities;
-                const missing = needed.filter((c) => !caps[c]);
-                if (missing.length > 0) {
-                    sendJson(res, 409, { error: "capabilities not satisfied by the image", missing });
-                    return;
-                }
-                sendJson(res, 200, {
-                    profile: entry.profile,
-                    digest: entry.digest,
-                    repo: entry.repo,
-                    ref: `${entry.repo}@${entry.digest}`,
-                    podContract: entry.podContract,
-                    capabilities: entry.capabilities,
-                    manifestSha: entry.manifestSha,
-                });
-                return;
-            }
-            if (req.method === "POST" && url === "/v1/images/register") {
-                if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-                    sendJson(res, 403, { error: "operator only" });
-                    return;
-                }
-                const b = (await readJson(req));
-                if (typeof b.profile !== "string" || typeof b.repo !== "string" || typeof b.digest !== "string") {
-                    sendJson(res, 400, { error: "profile, repo, digest are required" });
-                    return;
-                }
-                const id = await idx.registerBuilding({
-                    profile: b.profile,
-                    bands: Array.isArray(b.bands) ? b.bands : [],
-                    repo: b.repo,
-                    tag: typeof b.tag === "string" ? b.tag : "",
-                    digest: b.digest,
-                    toolchainVersions: b.toolchainVersions ?? {},
-                    capabilities: b.capabilities ?? {},
-                    podContract: b.podContract ?? {},
-                    sizeBytes: typeof b.sizeBytes === "number" ? b.sizeBytes : null,
-                    status: (typeof b.status === "string" ? b.status : "building"),
-                    visibility: b.visibility === "tenant" ? "tenant" : "public",
-                    tenantId: typeof b.tenantId === "string" ? b.tenantId : null,
-                    manifestSha: typeof b.manifestSha === "string" ? b.manifestSha : null,
-                    recipeGitSha: typeof b.recipeGitSha === "string" ? b.recipeGitSha : null,
-                    generatorVersion: typeof b.generatorVersion === "string" ? b.generatorVersion : null,
-                    buildDate: typeof b.buildDate === "string" ? b.buildDate : null,
-                    supersedes: typeof b.supersedes === "string" ? b.supersedes : null,
-                    signed: b.signed === true,
-                });
-                sendJson(res, 200, { id });
-                return;
-            }
-            const digMatch = req.method === "GET" ? IMAGE_DIGEST_RE.exec(url) : null;
-            if (digMatch) {
-                const entry = await idx.getByDigest(decodeURIComponent(digMatch[1]));
-                if (!entry || (!viewer.operator && entry.visibility === "tenant" && entry.tenantId !== viewer.tenantId)) {
-                    sendJson(res, 404, { error: "not found" });
-                    return;
-                }
-                sendJson(res, 200, { image: entry });
-                return;
-            }
-            const profMatch = req.method === "GET" ? IMAGE_PROFILE_RE.exec(url) : null;
-            if (profMatch) {
-                const entry = await idx.latestPublished(decodeURIComponent(profMatch[1]), viewer);
-                if (!entry) {
-                    sendJson(res, 404, { error: "not found" });
-                    return;
-                }
-                sendJson(res, 200, { image: entry });
-                return;
-            }
-        }
         if (deps.checkpointStore && (url.startsWith("/v1/approvals") || url.startsWith("/v1/assistant"))) {
             const cs = deps.checkpointStore;
             const principal = gatedPrincipal(req, deps.config);
@@ -3183,1593 +2725,112 @@ export function createHttpServer(deps) {
             sendJson(res, 404, { error: "not found" });
             return;
         }
-        if (url === "/v1/outcomes" && req.method === "GET") {
-            if (deps.config.requirePrincipal) {
-                const principal = gatedPrincipal(req, deps.config);
-                if (!explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-                    sendJson(res, 403, { error: "outcomes view is operator-only on a multi-tenant worker" });
-                    return;
-                }
-            }
-            if (!deps.outcomeSink?.summary) {
-                sendJson(res, 501, { error: "no queryable outcome ledger on this worker (File sink — read the JSONL dataset directly)" });
-                return;
-            }
-            const q = new URL(req.url ?? "/", "http://localhost").searchParams;
-            const sig = q.get("signature") ?? undefined;
-            try {
-                const rows = await deps.outcomeSink.summary({ ...(sig ? { taskSignature: sig } : {}), includeAborted: q.get("includeAborted") === "true" });
-                sendJson(res, 200, { outcomes: rows });
-            }
-            catch (err) {
-                deps.logger?.warn?.("outcomes_summary_failed", { err: String(err) });
-                sendJson(res, 500, { error: "outcome summary failed" });
-            }
+        if (await handleObservability(req, res, url, ctx))
             return;
-        }
-        if (url === "/v1/usage" && req.method === "GET") {
+        if (await handleMemoryPolicy(req, res, url, ctx))
+            return;
+        if (await handleSessionsList(req, res, url, ctx))
+            return;
+        if (await handleSessions(req, res, url, ctx))
+            return;
+        if (await handleSessionSync(req, res, url, ctx))
+            return;
+        if (await handleAttachments(req, res, url, ctx))
+            return;
+        if (req.method === "POST" && /^\/v1\/sessions\/[^/]+\/notify$/.test(url)) {
+            if (rateLimited(req, res) || quotaExceeded(req, res))
+                return;
             const principal = gatedPrincipal(req, deps.config);
-            if (!principal) {
+            if (deps.config.requirePrincipal && principal === undefined) {
                 sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
                 return;
             }
-            const windowSec = deps.config.costQuotaWindowSec;
-            if (!deps.costQuota) {
-                sendJson(res, 200, { enabled: false, windowSec, maxTaskCostUsd: deps.config.maxTaskCostUsd, maxTaskTokens: deps.config.maxTaskTokens });
-                return;
+            const notifySession = decodeURIComponent(url.split("/")[3]);
+            let nb;
+            try {
+                nb = (await readJson(req));
             }
-            const d = deps.costQuota.check(principal);
-            sendJson(res, 200, {
-                enabled: true,
-                windowSec,
-                usedMicroUsd: d.usedMicroUsd,
-                usedUsd: d.usedMicroUsd / 1_000_000,
-                limitMicroUsd: d.limitMicroUsd,
-                limitUsd: d.limitMicroUsd / 1_000_000,
-                remainingMicroUsd: Math.max(0, d.limitMicroUsd - d.usedMicroUsd),
-                overLimit: !d.allowed,
-                retryAfterSec: d.retryAfterSec,
-                maxTaskCostUsd: deps.config.maxTaskCostUsd,
-                maxTaskTokens: deps.config.maxTaskTokens,
-            });
-            return;
-        }
-        if (url === "/v1/memory/export" && req.method === "GET") {
-            const principal = gatedPrincipal(req, deps.config);
-            if (!principal) {
-                sendJson(res, 401, { error: "unauthorized" });
+            catch {
+                sendJson(res, 400, { error: "body must be JSON: { task_id, status, summary, result?, seq?, source? }" });
                 return;
             }
-            if (deps.config.memoryEngineBackend === "file" || !deps.memoryExport) {
-                sendJson(res, 501, { error: "memory export requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)" });
+            if (typeof nb.task_id !== "string" || nb.task_id.trim().length === 0 || nb.task_id.length > 190) {
+                sendJson(res, 400, { error: "task_id must be a non-empty string of at most 190 characters" });
                 return;
             }
-            const scope = new URL(req.url ?? "", "http://x").searchParams.get("scope");
-            if (!scope) {
-                sendJson(res, 400, { error: "missing ?scope=<key>" });
+            const NOTIFY_STATUSES = ["completed", "failed", "killed", "cancelled", "event"];
+            if (typeof nb.status !== "string" || !NOTIFY_STATUSES.includes(nb.status)) {
+                sendJson(res, 400, { error: `status must be one of ${NOTIFY_STATUSES.join("/")}` });
                 return;
             }
-            if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-                sendJson(res, 404, { error: "not found" });
+            if (typeof nb.summary !== "string" || nb.summary.trim().length === 0) {
+                sendJson(res, 400, { error: "summary must be a non-empty string" });
                 return;
             }
-            try {
-                const entries = await deps.memoryExport(scope);
-                sendJson(res, 200, { scope, exportedAt: new Date().toISOString(), entries });
-            }
-            catch (err) {
-                deps.logger?.warn?.("memory_export_failed", { scope, err: String(err) });
-                sendJson(res, 500, { error: "memory export failed" });
-            }
-            return;
-        }
-        if (req.method === "POST" && url.startsWith("/v1/memory/sync/")) {
-            const principal = gatedPrincipal(req, deps.config);
-            if (!principal) {
-                sendJson(res, 401, { error: "unauthorized" });
+            if (nb.result !== undefined && typeof nb.result !== "string") {
+                sendJson(res, 400, { error: "result must be a string when present" });
                 return;
             }
-            if (deps.config.memoryEngineBackend === "file" || !deps.memorySync) {
-                sendJson(res, 501, { error: "memory sync requires a DB memory backend (MEMORY_ENGINE_BACKEND=pg|tidb)" });
+            if (nb.seq !== undefined && (typeof nb.seq !== "number" || !Number.isInteger(nb.seq) || nb.seq < 1)) {
+                sendJson(res, 400, { error: "seq must be a positive integer when present" });
                 return;
             }
-            let scope;
-            try {
-                scope = decodeURIComponent(url.slice("/v1/memory/sync/".length));
-            }
-            catch {
-                sendError(res, 400, "memory_sync_invalid_scope", "malformed percent-encoding in :scope", { code: "memory_sync_invalid_scope" });
+            if (nb.source !== undefined && (typeof nb.source !== "string" || nb.source.length > 190)) {
+                sendJson(res, 400, { error: "source must be a string of at most 190 characters when present" });
                 return;
             }
-            if (scope.length === 0) {
-                sendError(res, 400, "memory_sync_invalid_scope", "missing :scope", { code: "memory_sync_invalid_scope" });
+            if (!deps.sessionStorage?.ownerOf) {
+                sendJson(res, 501, { error: "external notify requires the session-ownership face (sessionStorage.ownerOf)" });
                 return;
             }
-            if (scope !== formatUserScope(principal) && !explicitOperatorOk(principal, deps.config.operatorPrincipals)) {
-                sendJson(res, 404, { error: "not found" });
+            const notifyOwner = await deps.sessionStorage.ownerOf(notifySession);
+            if (notifyOwner === undefined) {
+                sendJson(res, 404, { error: "session not found" });
                 return;
             }
-            const body = await readJson(req);
-            const parsed = parseMemorySyncRequest(body, scope);
-            if (!parsed.ok) {
-                sendError(res, 422, "memory_sync_invalid_body", parsed.error, { code: "memory_sync_invalid_body" });
+            const notifyOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
+            if (!notifyOperator && notifyOwner !== null && notifyOwner !== principal) {
+                sendJson(res, 404, { error: "session not found" });
                 return;
             }
-            try {
-                const out = await deps.memorySync(scope, parsed.value);
-                sendJson(res, 200, out);
-            }
-            catch (err) {
-                deps.logger?.warn?.("memory_sync_failed", { scope, peer: parsed.value.peer, err: String(err) });
-                sendJson(res, 500, { error: "memory sync failed" });
+            const payload = {
+                task_id: nb.task_id,
+                status: nb.status,
+                summary: nb.summary,
+                ...(nb.result !== undefined ? { result: nb.result } : {}),
+                ...(nb.seq !== undefined ? { seq: nb.seq } : {}),
+                ...(nb.source !== undefined ? { source: nb.source } : {}),
+            };
+            const liveTaskId = await deps.runStore?.getActiveTaskId?.(notifySession).catch(() => undefined);
+            const liveStream = liveTaskId !== undefined && liveTaskId !== null ? steerableRuns.get(liveTaskId) : undefined;
+            if (liveStream) {
+                try {
+                    await liveStream.notify(payload);
+                    sendJson(res, 200, { sessionId: notifySession, delivery: "live" });
+                    return;
+                }
+                catch (e) {
+                    const code = e.code;
+                    if (typeof code === "string" && code.startsWith("notify.")) {
+                        sendError(res, 400, code, e instanceof Error ? e.message : "invalid notification");
+                        return;
+                    }
+                }
             }
-            return;
-        }
-        if (url === "/v1/policy" && req.method === "GET") {
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && !principal) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
+            if (!deps.workflowCompletionInbox) {
+                sendJson(res, 501, { error: "external notify park requires the workflow completion inbox (WORKFLOW_RUN_STORE)" });
                 return;
             }
-            sendJson(res, 200, {
-                autonomy: deps.config.autonomy ?? null,
-                commandPolicy: deps.config.commandPolicy ?? [],
-                approvalRequire: deps.config.approvalRequire,
-                limits: {
-                    maxTaskCostUsd: deps.config.maxTaskCostUsd,
-                    maxTaskTokens: deps.config.maxTaskTokens,
-                    maxPrincipalCostUsd: deps.config.maxPrincipalCostUsd,
-                    costQuotaWindowSec: deps.config.costQuotaWindowSec,
-                },
-            });
+            await deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_id: payload.task_id, task_type: "external", status: payload.status, summary: payload.summary, ...(payload.result !== undefined ? { result: payload.result } : {}), ...(payload.seq !== undefined ? { seq: payload.seq } : {}), ...(payload.source !== undefined ? { source: payload.source } : {}) }, Date.now()));
+            sendJson(res, 202, { sessionId: notifySession, delivery: "parked", note: "no live stream — parked in the session inbox; drained as a task_notification on the next stream open" });
             return;
         }
-        if (req.method === "GET" && url === "/v1/sessions") {
-            const { fleetWide, gateOwner } = sessionOwnerScope(req);
-            if (!fleetWide && gateOwner === null) {
-                sendJson(res, 401, { error: "unauthorized" });
+        if (req.method === "POST" && /^\/v1\/sessions\/[^/]+\/wake$/.test(url)) {
+            if (!deps.checkpointStore) {
+                sendJson(res, 501, { error: "wake requires the checkpoint store" });
                 return;
             }
-            const lister = deps.sessionStorage?.listSessions?.bind(deps.sessionStorage) ?? deps.runStore?.listSessions?.bind(deps.runStore);
-            if (!lister) {
-                sendJson(res, 501, { error: "session list requires a durable session store (SESSION_BACKEND=tidb)" });
-                return;
-            }
-            await handleSessionList(res, lister, new URL(req.url ?? "", "http://x").searchParams, gateOwner);
-            return;
-        }
-        if (req.method === "GET" && url === "/v1/sendfile-links") {
-            const { fleetWide, gateOwner } = sessionOwnerScope(req);
-            if (!fleetWide && gateOwner === null) {
-                sendJson(res, 401, { error: "unauthorized" });
-                return;
-            }
-            if (!deps.sendFileLedger) {
-                sendJson(res, 501, { error: "sendfile ledger requires a store backend (DB_BACKEND=tidb|pg|local) and the SendUserFile issuer configured" });
-                return;
-            }
-            const query = new URL(req.url ?? "", "http://x").searchParams;
-            const limitRaw = query.get("limit");
-            if (limitRaw !== null && !(/^[0-9]+$/.test(limitRaw) && Number(limitRaw) >= 1 && Number(limitRaw) <= 100)) {
-                sendJson(res, 400, { error: "limit must be a decimal integer in 1..100" });
-                return;
-            }
-            const limit = limitRaw === null ? 50 : Number(limitRaw);
-            const beforeRaw = query.get("before");
-            if (beforeRaw !== null && !isUuidV7(beforeRaw)) {
-                sendJson(res, 400, { error: "before must be a uuidv7 link id (the `id`/`nextBefore` of a previous page)" });
-                return;
-            }
-            const before = beforeRaw ?? undefined;
-            let scope;
-            if (gateOwner !== null) {
-                scope = gateOwner;
-            }
-            else {
-                const scopeRaw = query.get("scope");
-                if (scopeRaw === null) {
-                    scope = "_";
-                }
-                else {
-                    const s = scopeRaw.trim();
-                    if (s === "" || s.length > 190) {
-                        sendJson(res, 400, { error: "scope must be a non-blank tenant principal of at most 190 characters (the sendfile_link.scope column width)" });
-                        return;
-                    }
-                    scope = s;
-                }
-            }
-            const rows = await deps.sendFileLedger.listByScope(scope, limit + 1, before);
-            const hasMore = rows.length > limit;
-            const page = hasMore ? rows.slice(0, limit) : rows;
-            sendJson(res, 200, {
-                links: page.map((r) => ({
-                    id: r.id,
-                    filename: r.filename,
-                    size: r.size,
-                    ttlSec: r.ttlSec,
-                    track: r.track,
-                    bucket: r.bucket,
-                    key: r.objectKey,
-                    createdAt: new Date(r.createdAt).toISOString(),
-                    ...(r.taskId !== undefined ? { taskId: r.taskId } : {}),
-                    ...(r.sessionId !== undefined ? { sessionId: r.sessionId } : {}),
-                })),
-                ...(hasMore ? { nextBefore: page[page.length - 1].id } : {}),
-            });
-            return;
-        }
-        {
-            const im = /^\/v1\/sessions\/([^/]+)\/init$/.exec(url);
-            if (im && req.method === "GET") {
-                const principal = gatedPrincipal(req, deps.config);
-                if (deps.config.requirePrincipal && !principal) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                sendJson(res, 200, {
-                    sessionId: im[1],
-                    model: { provider: deps.config.model.provider, modelId: deps.config.model.id },
-                    ...(deps.config.autonomy ? { mode: deps.config.autonomy } : {}),
-                });
-                return;
-            }
-        }
-        {
-            const stm = /^\/v1\/sessions\/([^/]+)\/settings$/.exec(url);
-            if (stm && req.method === "GET") {
-                const principal = gatedPrincipal(req, deps.config);
-                if (deps.config.requirePrincipal && !principal) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                sendJson(res, 200, {
-                    effective: {
-                        model: deps.config.model.id,
-                        ...(deps.config.autonomy ? { mode: deps.config.autonomy } : {}),
-                        approvalRequire: deps.config.approvalRequire,
-                        commandPolicy: deps.config.commandPolicy ?? [],
-                        limits: { maxTaskCostUsd: deps.config.maxTaskCostUsd, maxTaskTokens: deps.config.maxTaskTokens },
-                    },
-                    applied: { model: deps.config.model.id },
-                });
-                return;
-            }
-        }
-        {
-            const mm = /^\/v1\/sessions\/([^/]+)\/mcp$/.exec(url);
-            if (mm && req.method === "GET") {
-                if (deps.config.requirePrincipal && !gatedPrincipal(req, deps.config)) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                const specs = mcpForScenario(deps.config.mcpServers, deps.config.defaultScenario);
-                if (!specs || specs.length === 0) {
-                    sendJson(res, 200, { servers: [], asOf: new Date().toISOString() });
-                    return;
-                }
-                const principal = gatedPrincipal(req, deps.config);
-                const cacheKey = `${deps.config.defaultScenario}::${principal ?? ""}`;
-                const cached = mcpStatusCache.get(cacheKey);
-                if (!cached || Date.now() - cached.at > MCP_STATUS_TTL_MS) {
-                    if (mcpStatusCache.size > 1024)
-                        mcpStatusCache.clear();
-                    const panel = (async () => {
-                        const matP = materializeMcpTools(specs, principal);
-                        let timer;
-                        const mat = await Promise.race([matP.catch(() => null), new Promise((r) => { timer = setTimeout(() => r(null), MCP_MATERIALIZE_TIMEOUT_MS); })]);
-                        if (timer)
-                            clearTimeout(timer);
-                        if (!mat) {
-                            void matP.then((m) => m?.dispose().catch(() => undefined)).catch(() => undefined);
-                            return { servers: [], asOf: new Date().toISOString(), degraded: true };
-                        }
-                        try {
-                            return {
-                                asOf: new Date().toISOString(),
-                                servers: mat.statuses.map((s) => ({
-                                    name: s.name,
-                                    status: s.status,
-                                    ...(s.serverInfo ? { serverInfo: s.serverInfo } : {}),
-                                    ...(s.toolNames ? { toolNames: s.toolNames } : {}),
-                                    ...(s.error ? { error: redactSecrets(String(s.error)).slice(0, 200) } : {}),
-                                })),
-                            };
-                        }
-                        finally {
-                            await mat.dispose().catch(() => undefined);
-                        }
-                    })();
-                    mcpStatusCache.set(cacheKey, { at: Date.now(), panel });
-                }
-                sendJson(res, 200, await mcpStatusCache.get(cacheKey).panel);
-                return;
-            }
-        }
-        {
-            const hm = req.method === "GET" ? /^\/v1\/sessions\/([^/]+)\/head$/.exec(url) : null;
-            if (hm) {
-                const getLeafId = deps.sessionStorage?.getLeafId?.bind(deps.sessionStorage);
-                const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                if (!getLeafId || !ownerOf) {
-                    sendJson(res, 501, { error: "session head probe requires a durable session store (SESSION_BACKEND=tidb|pg|local)" });
-                    return;
-                }
-                const headSession = decodeURIComponent(hm[1]);
-                const getHead = deps.sessionStorage?.getHead?.bind(deps.sessionStorage);
-                let owner;
-                let leafId;
-                if (getHead) {
-                    const head = await getHead(headSession);
-                    if (head === undefined) {
-                        sendJson(res, 404, { error: "session not found" });
-                        return;
-                    }
-                    owner = head.owner;
-                    if (!runOwnerOk(req, res, owner ?? null))
-                        return;
-                    leafId = head.leafId;
-                }
-                else {
-                    owner = await ownerOf(headSession);
-                    if (owner === undefined) {
-                        sendJson(res, 404, { error: "session not found" });
-                        return;
-                    }
-                    if (!runOwnerOk(req, res, owner ?? null))
-                        return;
-                    leafId = await getLeafId(headSession);
-                }
-                const etag = `"${leafId ?? "empty"}"`;
-                if (req.headers["if-none-match"] === etag) {
-                    res.writeHead(304, { etag }).end();
-                    return;
-                }
-                res.setHeader("etag", etag);
-                sendJson(res, 200, { sessionId: headSession, leafId });
-                return;
-            }
-        }
-        {
-            const em = req.method === "GET" ? /^\/v1\/sessions\/([^/]+)\/events$/.exec(url) : null;
-            if (em) {
-                const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                const watch = deps.sessionWatch;
-                if (!deps.sessionStorage?.getLeafId || !ownerOf || !watch) {
-                    sendJson(res, 501, { error: "session events require a durable session store (SESSION_BACKEND=tidb|pg|local)" });
-                    return;
-                }
-                const evSession = decodeURIComponent(em[1]);
-                if (sseConnections >= (deps.sessionEventsMaxConnections ?? 256)) {
-                    res.writeHead(503, { "retry-after": "5", "content-type": "application/json" });
-                    res.end(JSON.stringify({ error: "session-events connection cap reached — fall back to /head polling" }));
-                    return;
-                }
-                sseConnections++;
-                let hb;
-                let unsubscribe;
-                let closed = false;
-                const cleanup = () => {
-                    if (closed)
-                        return;
-                    closed = true;
-                    sseConnections--;
-                    if (hb)
-                        clearInterval(hb);
-                    unsubscribe?.();
-                };
-                res.on("close", cleanup);
-                req.on("close", cleanup);
-                try {
-                    const stallBound = deps.sessionEventsStallMs ?? 60_000;
-                    if (sseOwnerLookups >= 64) {
-                        cleanup();
-                        res.writeHead(503, { "retry-after": "5", "content-type": "application/json" });
-                        res.end(JSON.stringify({ error: "session-events owner-lookup concurrency cap — retry" }));
-                        return;
-                    }
-                    sseOwnerLookups++;
-                    const ownerP = ownerOf(evSession);
-                    void ownerP.catch(() => undefined).then(() => { sseOwnerLookups--; });
-                    let stallTimer;
-                    let owner;
-                    try {
-                        owner = await Promise.race([
-                            ownerP,
-                            new Promise((r) => { stallTimer = setTimeout(() => r("__stall__"), stallBound); stallTimer.unref?.(); }),
-                        ]);
-                    }
-                    finally {
-                        if (stallTimer)
-                            clearTimeout(stallTimer);
-                    }
-                    if (closed)
-                        return;
-                    if (owner === "__stall__") {
-                        cleanup();
-                        res.writeHead(503, { "retry-after": "5", "content-type": "application/json" });
-                        res.end(JSON.stringify({ error: "session-events owner lookup stalled — retry" }));
-                        return;
-                    }
-                    if (owner === undefined) {
-                        cleanup();
-                        sendJson(res, 404, { error: "session not found" });
-                        return;
-                    }
-                    if (!runOwnerOk(req, res, owner ?? null)) {
-                        cleanup();
-                        return;
-                    }
-                    const q = new URL(req.url ?? url, "http://x").searchParams;
-                    const lastLeafId = q.get("lastLeafId");
-                    let first = true;
-                    let lastAccepted;
-                    let lastWritten;
-                    let writeBlocked = false;
-                    let blockedAt = 0;
-                    let pendingHead;
-                    const stallMs = deps.sessionEventsStallMs ?? 60_000;
-                    const writeRaw = (chunk) => {
-                        if (closed)
-                            return;
-                        try {
-                            const okW = res.write(chunk);
-                            if (!okW && !writeBlocked) {
-                                writeBlocked = true;
-                                blockedAt = Date.now();
-                                res.once("drain", () => {
-                                    writeBlocked = false;
-                                    const p = pendingHead;
-                                    pendingHead = undefined;
-                                    if (p && !closed && p.v !== lastWritten)
-                                        doWrite(p.v);
-                                });
-                            }
-                        }
-                        catch { }
-                    };
-                    const doWrite = (leafId) => {
-                        lastWritten = leafId;
-                        writeRaw(`event: head\ndata: ${JSON.stringify({ sessionId: evSession, leafId })}\n\n`);
-                    };
-                    const emit = (leafId) => {
-                        if (closed || leafId === lastAccepted)
-                            return;
-                        lastAccepted = leafId;
-                        const suppress = first && lastLeafId !== null && lastLeafId === (leafId ?? "null");
-                        first = false;
-                        if (suppress) {
-                            lastWritten = leafId;
-                            return;
-                        }
-                        if (writeBlocked) {
-                            pendingHead = { v: leafId };
-                            if (Date.now() - blockedAt > stallMs) {
-                                cleanup();
-                                try {
-                                    res.end();
-                                }
-                                catch { }
-                            }
-                            return;
-                        }
-                        doWrite(leafId);
-                    };
-                    let started = false;
-                    let preVal;
-                    const onHead = (leafId) => {
-                        if (!started)
-                            preVal = { v: leafId };
-                        else
-                            emit(leafId);
-                    };
-                    const onEnd = () => { cleanup(); try {
-                        res.end();
-                    }
-                    catch { } };
-                    unsubscribe = watch.subscribe(evSession, owner ?? null, onHead, onEnd);
-                    if (!unsubscribe) {
-                        cleanup();
-                        res.writeHead(503, { "retry-after": "5", "content-type": "application/json" });
-                        res.end(JSON.stringify({ error: "session-events probe cap reached — fall back to /head polling" }));
-                        return;
-                    }
-                    res.writeHead(200, { "content-type": "text/event-stream", "cache-control": "no-cache, no-transform", connection: "keep-alive", "x-accel-buffering": "no" });
-                    writeRaw(": connected\n\n");
-                    started = true;
-                    if (preVal !== undefined)
-                        emit(preVal.v);
-                    const hbMs = deps.sessionEventsHeartbeatMs ?? 25_000;
-                    let ownerCheckPending = false;
-                    let ownerCheckStartedAt = 0;
-                    hb = setInterval(() => {
-                        if (closed)
-                            return;
-                        if (writeBlocked && Date.now() - blockedAt > stallMs) {
-                            onEnd();
-                            return;
-                        }
-                        if (!writeBlocked)
-                            writeRaw(": hb\n\n");
-                        if (ownerCheckPending) {
-                            if (Date.now() - ownerCheckStartedAt > stallMs)
-                                onEnd();
-                            return;
-                        }
-                        ownerCheckPending = true;
-                        ownerCheckStartedAt = Date.now();
-                        void ownerOf(evSession).then((o) => {
-                            ownerCheckPending = false;
-                            if (!closed && o !== owner)
-                                onEnd();
-                        }).catch(() => { ownerCheckPending = false; });
-                    }, hbMs);
-                    hb.unref?.();
-                }
-                catch (e) {
-                    cleanup();
-                    if (!res.headersSent)
-                        sendJson(res, 500, { error: `session events failed: ${e instanceof Error ? e.message : "unknown"}` });
-                    else
-                        try {
-                            res.end();
-                        }
-                        catch { }
-                }
-                return;
-            }
-        }
-        if (deps.sessionAudit && req.method === "GET") {
-            const sm = /^\/v1\/sessions\/([^/]+)$/.exec(url);
-            if (sm) {
-                const audit = await deps.sessionAudit(sm[1]);
-                if (!audit) {
-                    sendJson(res, 404, { error: "session not found" });
-                    return;
-                }
-                if (!runOwnerOk(req, res, audit.owner))
-                    return;
-                const q = new URL(req.url ?? url, "http://x").searchParams;
-                const qi = (k) => {
-                    const v = q.get(k);
-                    if (v === null)
-                        return undefined;
-                    const n = Number(v);
-                    return Number.isFinite(n) && n >= 0 ? n : undefined;
-                };
-                const msgIndex = qi("message");
-                if (msgIndex !== undefined) {
-                    const messages = audit.messages;
-                    if (msgIndex >= messages.length) {
-                        sendJson(res, 404, { error: "message index out of range", total: messages.length });
-                        return;
-                    }
-                    sendJson(res, 200, { sessionId: audit.sessionId, floorEntryId: audit.floorEntryId, index: msgIndex, message: messages[msgIndex] });
-                    return;
-                }
-                const tail = qi("tail");
-                const before = qi("before");
-                const blobCap = qi("blobCap");
-                if (tail === undefined && before === undefined && blobCap === undefined) {
-                    sendJson(res, 200, audit);
-                    return;
-                }
-                let messages = audit.messages;
-                let window;
-                if (tail !== undefined || before !== undefined) {
-                    const w = windowMessages(messages, { ...(tail !== undefined ? { tail } : {}), ...(before !== undefined ? { before } : {}), ...(qi("limit") !== undefined ? { limit: qi("limit") } : {}) });
-                    messages = w.messages;
-                    window = w.window;
-                }
-                if (blobCap !== undefined && blobCap > 0)
-                    messages = truncateMessageBlobs(messages, blobCap);
-                sendJson(res, 200, { ...audit, messages, ...(window ? { window } : {}) });
-                return;
-            }
-        }
-        {
-            const fm = req.method === "POST" ? /^\/v1\/sessions\/([^/]+)\/fork$/.exec(url) : null;
-            if (fm) {
-                const fork = deps.sessionStorage?.fork?.bind(deps.sessionStorage);
-                const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                if (!fork || !ownerOf) {
-                    sendJson(res, 501, { error: "session fork requires a durable session store (SESSION_BACKEND=tidb)" });
-                    return;
-                }
-                const scope = sessionOwnerScopeForWrite(req);
-                if (!scope.fleetWide && scope.gateOwner === null) {
-                    sendJson(res, 401, { error: "unauthorized" });
-                    return;
-                }
-                const sourceId = safeDecode(fm[1]);
-                if (sourceId === null || !isUuidV7(sourceId)) {
-                    sendJson(res, 400, { error: "invalid session id (must be a uuidv7)" });
-                    return;
-                }
-                const owner = await ownerOf(sourceId);
-                if (owner === undefined) {
-                    sendJson(res, 404, { error: "session not found" });
-                    return;
-                }
-                if (!scope.fleetWide && owner !== scope.gateOwner) {
-                    sendJson(res, 404, { error: "session not found" });
-                    return;
-                }
-                const newOwner = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
-                const newId = await fork(sourceId, newOwner);
-                if (newId === null) {
-                    sendJson(res, 404, { error: "session not found" });
-                    return;
-                }
-                sendJson(res, 200, { sessionId: newId });
-                return;
-            }
-        }
-        {
-            const dm = req.method === "DELETE" ? /^\/v1\/sessions\/([^/]+)$/.exec(url) : null;
-            if (dm) {
-                const purge = deps.purgeSession;
-                const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                if (!purge || !ownerOf) {
-                    sendJson(res, 501, { error: "session delete requires a durable session store (SESSION_BACKEND=tidb)" });
-                    return;
-                }
-                const scope = sessionOwnerScopeForWrite(req);
-                if (!scope.fleetWide && scope.gateOwner === null) {
-                    sendJson(res, 401, { error: "unauthorized" });
-                    return;
-                }
-                const sessionId = safeDecode(dm[1]);
-                if (sessionId === null || !isUuidV7(sessionId)) {
-                    sendJson(res, 400, { error: "invalid session id (must be a uuidv7)" });
-                    return;
-                }
-                const owner = await ownerOf(sessionId);
-                if (owner === undefined) {
-                    sendJson(res, 200, { deleted: false });
-                    return;
-                }
-                if (!scope.fleetWide && owner !== scope.gateOwner) {
-                    sendJson(res, 200, { deleted: false });
-                    return;
-                }
-                const activeTaskId = await deps.runStore?.getActiveTaskId(sessionId);
-                if (activeTaskId) {
-                    sendJson(res, 409, { error: "session has an active run; cancel it before deleting", activeTaskId });
-                    return;
-                }
-                const result = await purge(sessionId, owner);
-                if ("active" in result) {
-                    sendJson(res, 409, { error: "session has an active run; cancel it before deleting", activeTaskId: result.active });
-                    return;
-                }
-                sendJson(res, 200, result);
-                return;
-            }
-        }
-        {
-            const pm = req.method === "GET" || req.method === "PUT" ? /^\/v1\/sessions\/([^/]+)\/policy$/.exec(url) : null;
-            if (pm) {
-                const store = deps.sessionPolicyStore;
-                const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                if (!store || !ownerOf) {
-                    sendJson(res, 501, { error: "session policy requires a session-store backend" });
-                    return;
-                }
-                const principal = gatedPrincipal(req, deps.config);
-                if (deps.config.requirePrincipal && principal === undefined) {
-                    sendJson(res, 401, { error: "unauthorized" });
-                    return;
-                }
-                const sessionId = safeDecode(pm[1]);
-                if (sessionId === null || !isUuidV7(sessionId)) {
-                    sendJson(res, 400, { error: "invalid session id (must be a uuidv7)" });
-                    return;
-                }
-                const owner = await ownerOf(sessionId);
-                if (owner === undefined) {
-                    sendJson(res, 404, { error: "session not found" });
-                    return;
-                }
-                if (owner === null) {
-                    sendJson(res, 409, { error: "session policy requires an owned session (set REQUIRE_PRINCIPAL / attach a principal); this session is ownerless" });
-                    return;
-                }
-                const operator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-                if (!operator && owner !== (principal ?? null)) {
-                    sendJson(res, 404, { error: "session not found" });
-                    return;
-                }
-                const target = owner;
-                if (req.method === "GET") {
-                    sendJson(res, 200, { rules: (await store.getRules(sessionId, target)) ?? { rev: 0 } });
-                    return;
-                }
-                let body;
-                try {
-                    body = (await readJson(req));
-                }
-                catch {
-                    sendJson(res, 400, { error: "invalid JSON body" });
-                    return;
-                }
-                if (typeof body.rules !== "object" || body.rules === null || Array.isArray(body.rules)) {
-                    sendJson(res, 400, { error: "rules must be a SessionPermissionRules object" });
-                    return;
-                }
-                if (body.expectedRev !== undefined && (typeof body.expectedRev !== "number" || !Number.isInteger(body.expectedRev) || body.expectedRev < 0)) {
-                    sendJson(res, 400, { error: "expectedRev must be a non-negative integer" });
-                    return;
-                }
-                const raw = body.rules;
-                const rules = {};
-                for (const f of ["toolAllow", "toolDeny", "allowDirs", "commandAllow", "commandDeny"]) {
-                    if (raw[f] === undefined)
-                        continue;
-                    if (!Array.isArray(raw[f]) || !raw[f].every((x) => typeof x === "string")) {
-                        sendJson(res, 400, { error: `${f} must be an array of strings` });
-                        return;
-                    }
-                    rules[f] = raw[f];
-                }
-                try {
-                    const stored = await store.putRules(sessionId, target, rules, { ...(typeof body.expectedRev === "number" ? { expectedRev: body.expectedRev } : {}), operator });
-                    sendJson(res, 200, { rules: stored });
-                }
-                catch (e) {
-                    if (e instanceof SessionPolicyError) {
-                        sendError(res, e.code === "conflict" ? 409 : 403, e.code, e.message);
-                        return;
-                    }
-                    throw e;
-                }
-                return;
-            }
-        }
-        {
-            const wm = req.method === "GET" ? /^\/v1\/sessions\/([^/]+)\/workspace(?:\/([^/]+)(?:\/(tree|file|archive))?)?$/.exec(url) : null;
-            if (wm) {
-                const fs = deps.fileSnapshotStore;
-                const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                if (!fs || typeof fs.listKeys !== "function" || typeof fs.exportManifest !== "function" || typeof fs.getBlob !== "function" || !ownerOf) {
-                    sendJson(res, 501, { error: "workspace browse requires a durable snapshot store (rewindFiles wiring) and a durable session store" });
-                    return;
-                }
-                const scope = sessionOwnerScope(req);
-                if (!scope.fleetWide && scope.gateOwner === null) {
-                    sendJson(res, 401, { error: "unauthorized" });
-                    return;
-                }
-                const wsSession = safeDecode(wm[1]);
-                if (wsSession === null || !isUuidShape(wsSession)) {
-                    sendJson(res, 400, { error: "invalid session id (must be a canonical uuid)" });
-                    return;
-                }
-                const wsOwner = await ownerOf(wsSession);
-                if (wsOwner === undefined || (!scope.fleetWide && wsOwner !== scope.gateOwner)) {
-                    sendJson(res, 404, { error: "session not found" });
-                    return;
-                }
-                const q = new URL(req.url ?? "", "http://x").searchParams;
-                const keys = (await fs.listKeys(wsSession)).sort().reverse();
-                const sub = wm[3];
-                if (wm[2] === undefined) {
-                    const limRaw = q.get("limit");
-                    if (limRaw !== null && !(/^[0-9]+$/.test(limRaw) && Number(limRaw) >= 1 && Number(limRaw) <= 100)) {
-                        sendJson(res, 400, { error: "limit must be a decimal integer in 1..100" });
-                        return;
-                    }
-                    const lim = limRaw === null ? 20 : Number(limRaw);
-                    const page = keys.slice(0, lim);
-                    const snapshots = [];
-                    for (const k of page) {
-                        const m = await fs.exportManifest(wsSession, k);
-                        if (m === null)
-                            continue;
-                        let bytes;
-                        if (typeof fs.blobSizes === "function") {
-                            const sizes = await fs.blobSizes([...new Set(m.values())]);
-                            bytes = 0;
-                            for (const h of m.values())
-                                bytes += sizes.get(h) ?? 0;
-                        }
-                        snapshots.push({ key: k, files: m.size, ...(bytes !== undefined ? { bytes } : {}) });
-                    }
-                    sendJson(res, 200, {
-                        sessionId: wsSession,
-                        snapshots,
-                        ...(snapshots.length > 0 ? { latest: snapshots[0].key } : {}),
-                        total: snapshots.length,
-                    });
-                    return;
-                }
-                const keyRaw = safeDecode(wm[2]);
-                if (keyRaw === null) {
-                    sendJson(res, 400, { error: "malformed snapshot key" });
-                    return;
-                }
-                const key = keyRaw === "latest" ? keys[0] : keyRaw;
-                const manifest = key !== undefined ? await fs.exportManifest(wsSession, key) : null;
-                if (key === undefined || manifest === null) {
-                    sendJson(res, 404, { error: "snapshot not found" });
-                    return;
-                }
-                if (sub === "tree") {
-                    const limRaw = q.get("limit");
-                    if (limRaw !== null && !(/^[0-9]+$/.test(limRaw) && Number(limRaw) >= 1 && Number(limRaw) <= 2000)) {
-                        sendJson(res, 400, { error: "limit must be a decimal integer in 1..2000" });
-                        return;
-                    }
-                    const offRaw = q.get("offset");
-                    if (offRaw !== null && !/^[0-9]+$/.test(offRaw)) {
-                        sendJson(res, 400, { error: "offset must be a non-negative integer" });
-                        return;
-                    }
-                    const lim = limRaw === null ? 500 : Number(limRaw);
-                    const off = offRaw === null ? 0 : Number(offRaw);
-                    const all = [...manifest.entries()].sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
-                    const page = all.slice(off, off + lim);
-                    const sizes = typeof fs.blobSizes === "function" ? await fs.blobSizes([...new Set(page.map(([, h]) => h))]) : undefined;
-                    sendJson(res, 200, {
-                        sessionId: wsSession,
-                        key,
-                        entries: page.map(([path, hash]) => ({ path, hash, ...(sizes?.get(hash) !== undefined ? { size: sizes.get(hash) } : {}) })),
-                        total: all.length,
-                        ...(off + lim < all.length ? { nextOffset: off + lim } : {}),
-                    });
-                    return;
-                }
-                if (sub === "file") {
-                    const pathParam = q.get("path");
-                    if (!pathParam) {
-                        sendJson(res, 400, { error: "missing ?path=<relPath from the tree>" });
-                        return;
-                    }
-                    const hash = manifest.get(pathParam);
-                    if (hash === undefined) {
-                        sendJson(res, 404, { error: "no such file in this snapshot (paths are the tree's relPaths, verbatim)" });
-                        return;
-                    }
-                    const cap = deps.config.workspaceFileMaxBytes ?? 8 * 1024 * 1024;
-                    if (typeof fs.blobSizes === "function") {
-                        const known = (await fs.blobSizes([hash])).get(hash);
-                        if (known !== undefined && known > cap) {
-                            sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: known, limit: cap });
-                            return;
-                        }
-                    }
-                    const bytes = await fs.getBlob(hash);
-                    if (bytes === undefined) {
-                        sendJson(res, 404, { error: "file content no longer available (snapshot raced a reap)" });
-                        return;
-                    }
-                    if (bytes.byteLength > cap) {
-                        sendError(res, 413, "workspace_file_too_large", "file exceeds the single-file read limit — download it via the archive endpoint", { code: "workspace_file_too_large", sizeBytes: bytes.byteLength, limit: cap });
-                        return;
-                    }
-                    const ct = workspaceContentType(pathParam);
-                    const bin = looksBinary(bytes);
-                    res.writeHead(200, {
-                        "content-type": ct,
-                        "content-length": bytes.byteLength,
-                        "x-content-type-options": "nosniff",
-                        "x-sema-content-binary": bin ? "true" : "false",
-                    });
-                    res.end(Buffer.from(bytes));
-                    return;
-                }
-                if (sub === "archive") {
-                    const entries = [...manifest.entries()].sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
-                    const bad = entries.filter(([p]) => splitTarPath(p) === null).map(([p]) => p);
-                    if (bad.length > 0) {
-                        sendJson(res, 422, { error: `snapshot contains ${bad.length} path(s) not representable in ustar (>255 bytes or unsplittable)`, paths: bad.slice(0, 5) });
-                        return;
-                    }
-                    if (typeof fs.hasBlobs === "function") {
-                        const present = await fs.hasBlobs([...new Set(entries.map(([, h]) => h))]);
-                        const missing = entries.filter(([, h]) => !present.has(h)).length;
-                        if (missing > 0) {
-                            sendJson(res, 502, { error: `snapshot is missing ${missing} blob(s) (raced a reap or a partial import) — retry, or pick another snapshot` });
-                            return;
-                        }
-                    }
-                    res.writeHead(200, {
-                        "content-type": "application/x-tar",
-                        "content-disposition": `attachment; filename="workspace-${key}.tar"`,
-                        "x-content-type-options": "nosniff",
-                    });
-                    const write = async (buf) => {
-                        if (res.writableEnded || res.destroyed)
-                            throw new Error("client gone");
-                        if (!res.write(buf)) {
-                            await new Promise((resolve, reject) => {
-                                const onDrain = () => { cleanup(); resolve(); };
-                                const onGone = () => { cleanup(); reject(new Error("client gone (closed while draining)")); };
-                                const cleanup = () => { res.off("drain", onDrain); res.off("close", onGone); res.off("error", onGone); };
-                                res.once("drain", onDrain);
-                                res.once("close", onGone);
-                                res.once("error", onGone);
-                            });
-                        }
-                    };
-                    try {
-                        for (const [p, h] of entries) {
-                            const bytes = await fs.getBlob(h);
-                            if (bytes === undefined)
-                                throw new Error(`blob vanished mid-stream: ${h}`);
-                            await write(tarHeader(p, bytes.byteLength, 0));
-                            await write(Buffer.from(bytes));
-                            await write(tarPadding(bytes.byteLength));
-                        }
-                        await write(TAR_END);
-                        res.end();
-                    }
-                    catch {
-                        res.destroy();
-                    }
-                    return;
-                }
-                sendJson(res, 404, { error: "unknown workspace verb — use /tree, /file?path=, or /archive" });
-                return;
-            }
-        }
-        {
-            const sm = /^\/v1\/sessions\/([^/]+)\/sync\/(manifest|entries|import|plan|blobs(?:\/([^/]+))?|snapshots\/([^/]+)\/blobs\/([^/]+)|import\/([^/]+)\/entries)$/.exec(url);
-            if (sm) {
-                const ownerOf = deps.sessionStorage?.ownerOf?.bind(deps.sessionStorage);
-                if (!deps.backend || !ownerOf) {
-                    sendJson(res, 501, { error: "session sync requires a durable session store" });
-                    return;
-                }
-                const scope = sessionOwnerScopeForWrite(req);
-                if (!scope.fleetWide && scope.gateOwner === null) {
-                    sendJson(res, 401, { error: "unauthorized" });
-                    return;
-                }
-                const sessionId = safeDecode(sm[1]);
-                if (sessionId === null || !isUuidShape(sessionId)) {
-                    sendJson(res, 400, { error: "invalid session id (must be a canonical uuid)" });
-                    return;
-                }
-                const owner = await ownerOf(sessionId);
-                const ownsOrFleet = (o) => scope.fleetWide || o === scope.gateOwner;
-                const pullGateOk = () => {
-                    if (owner === undefined) {
-                        sendJson(res, 404, { error: "session not found" });
-                        return false;
-                    }
-                    if (!ownsOrFleet(owner)) {
-                        sendJson(res, 404, { error: "session not found" });
-                        return false;
-                    }
-                    return true;
-                };
-                const pushGateOk = () => {
-                    if (owner !== undefined && !ownsOrFleet(owner)) {
-                        sendJson(res, 404, { error: "session not found" });
-                        return false;
-                    }
-                    return true;
-                };
-                if (sm[2] === "manifest" && req.method === "GET") {
-                    if (!pullGateOk())
-                        return;
-                    const out = await exportSessionManifest(sessionId, deps.backend);
-                    if (out === null) {
-                        sendJson(res, 404, { error: "session not found" });
-                        return;
-                    }
-                    sendJson(res, 200, { manifest: out.manifest });
-                    return;
-                }
-                if (sm[2] === "entries" && req.method === "GET") {
-                    if (!pullGateOk())
-                        return;
-                    const afterSeqRaw = new URL(req.url ?? "", "http://x").searchParams.get("afterSeq");
-                    let afterSeq;
-                    if (afterSeqRaw !== null) {
-                        const n = Number(afterSeqRaw);
-                        if (!Number.isInteger(n) || n < 0) {
-                            sendJson(res, 400, { error: "afterSeq must be a non-negative integer" });
-                            return;
-                        }
-                        afterSeq = n;
-                    }
-                    const stream = deps.sessionStorage?.exportEntriesStream?.bind(deps.sessionStorage);
-                    if (!stream) {
-                        sendJson(res, 501, { error: "session entry streaming requires a durable session store" });
-                        return;
-                    }
-                    const it = await stream(sessionId, afterSeq === undefined ? undefined : { afterSeq });
-                    if (it === null) {
-                        sendJson(res, 404, { error: "session not found" });
-                        return;
-                    }
-                    res.writeHead(200, { "content-type": "application/x-ndjson", "transfer-encoding": "chunked" });
-                    const write = async (line) => { if (!res.write(line))
-                        await once(res, "drain"); };
-                    let count = 0;
-                    try {
-                        await write(`${JSON.stringify({ __sync: "begin", sessionId })}\n`);
-                        for await (const entry of it) {
-                            await write(`${JSON.stringify(entry)}\n`);
-                            count++;
-                        }
-                        await write(`${JSON.stringify({ __sync: "end", count })}\n`);
-                        res.end();
-                    }
-                    catch (e) {
-                        deps.logger?.error?.("sync entries stream failed", { sessionId, count, error: msg(e) });
-                        res.end();
-                    }
-                    return;
-                }
-                if (sm[4] !== undefined && req.method === "GET") {
-                    if (!pullGateOk())
-                        return;
-                    const key = safeDecode(sm[4]);
-                    const hash = safeDecode(sm[5]);
-                    if (key === null || hash === null) {
-                        sendJson(res, 400, { error: "invalid snapshot key or blob hash" });
-                        return;
-                    }
-                    if (!SHA256_HEX_RE.test(hash)) {
-                        sendJson(res, 400, { error: "blob hash must be 64 lowercase-hex chars" });
-                        return;
-                    }
-                    const fs = deps.fileSnapshotStore;
-                    const manifest = await fs?.exportManifest?.(sessionId, key);
-                    if (!manifest || ![...manifest.values()].includes(hash)) {
-                        sendJson(res, 404, { error: "blob not found" });
-                        return;
-                    }
-                    const bytes = await fs?.getBlob?.(hash);
-                    if (!bytes) {
-                        sendJson(res, 404, { error: "blob not found" });
-                        return;
-                    }
-                    res.writeHead(200, { "content-type": "application/octet-stream" });
-                    res.end(Buffer.from(bytes));
-                    return;
-                }
-                if (sm[3] !== undefined && req.method === "PUT") {
-                    if (!pushGateOk())
-                        return;
-                    const hash = safeDecode(sm[3]);
-                    if (hash === null || !SHA256_HEX_RE.test(hash)) {
-                        sendJson(res, 400, { error: "blob hash must be 64 lowercase-hex chars" });
-                        return;
-                    }
-                    const fs = deps.fileSnapshotStore;
-                    if (typeof fs?.putBlob !== "function") {
-                        sendJson(res, 501, { error: "blob upload requires a durable snapshot store" });
-                        return;
-                    }
-                    const body = await readRawBody(req, SYNC_BLOB_MAX_BYTES);
-                    if (deps.snapshotBlobSqlCapBytes !== undefined && body.byteLength > deps.snapshotBlobSqlCapBytes) {
-                        sendError(res, 413, "blob_too_large_for_sql", `blob of ${body.byteLength} bytes exceeds this deployment's SQL snapshot-blob cap (${deps.snapshotBlobSqlCapBytes} bytes — TiDB's txn-entry-size-limit is the low wall at 6MiB by default; the mysql-protocol packet limit sits above it) — configure MinIO object storage (MINIO_ENDPOINT/MINIO_ACCESS_KEY/MINIO_SECRET_KEY) for large snapshot blobs, or raise SNAPSHOT_BLOB_SQL_MAX_BYTES if your deployment lifted those limits`, { code: "blob_too_large_for_sql" });
-                        return;
-                    }
-                    if (createHash("sha256").update(body).digest("hex") !== hash) {
-                        sendJson(res, 400, { error: "blob hash mismatch" });
-                        return;
-                    }
-                    const put = await fs.putBlob(hash, new Uint8Array(body));
-                    if (!put.ok) {
-                        sendError(res, 502, put.error.code, "blob store write failed", { code: put.error.code });
-                        return;
-                    }
-                    res.writeHead(204).end();
-                    return;
-                }
-                if (sm[2] === "import" && req.method === "POST") {
-                    if (!pushGateOk())
-                        return;
-                    if (deps.sessionMirrorRuling && !scope.fleetWide && scope.gateOwner !== null) {
-                        const auditPrincipal = scope.gateOwner;
-                        void deps.sessionMirrorRuling(auditPrincipal).then((mirror) => {
-                            if (mirror?.required) {
-                                deps.metrics?.inc("session_mirror_required_push_total");
-                                deps.logger?.info("session_mirror_required_push_observed", { principal: auditPrincipal, engineUrl: mirror.engineUrl, sessionId });
-                            }
-                        }).catch(() => { });
-                    }
-                    if (!deps.sessionStorage?.beginImportStaging) {
-                        sendJson(res, 501, { error: "staged session import requires a durable session store" });
-                        return;
-                    }
-                    let body;
-                    try {
-                        body = (await readJson(req));
-                    }
-                    catch {
-                        sendJson(res, 400, { error: "invalid JSON body" });
-                        return;
-                    }
-                    if (!Array.isArray(body.entryIds) || !body.entryIds.every((x) => typeof x === "string")) {
-                        sendJson(res, 400, { error: "entryIds must be an array of strings" });
-                        return;
-                    }
-                    const snapshotsOk = Array.isArray(body.snapshots) && body.snapshots.every((s) => typeof s === "object" && s !== null && typeof s.key === "string" && Array.isArray(s.manifest));
-                    if (!snapshotsOk || !Array.isArray(body.policy) || !Array.isArray(body.anchors)) {
-                        sendJson(res, 400, { error: "malformed import metadata" });
-                        return;
-                    }
-                    if (body.resolution !== undefined && body.resolution !== "overwrite-dst") {
-                        sendJson(res, 400, { error: "resolution must be 'overwrite-dst'" });
-                        return;
-                    }
-                    const resolution = body.resolution;
-                    const srcLogDigest = typeof body.logDigest === "string" && body.logDigest.length > 0 ? body.logDigest : undefined;
-                    const entryIds = body.entryIds;
-                    const snapshots = body.snapshots;
-                    const policy = body.policy;
-                    const anchors = body.anchors;
-                    const dstIds = (await deps.sessionStorage.listEntryIds?.(sessionId)) ?? null;
-                    const relA = classifySyncRelationshipByIds(entryIds, dstIds);
-                    if ((relA.relation === "fork" || relA.relation === "stale") && resolution !== "overwrite-dst") {
-                        sendError(res, 409, "conflict", "sync conflict", { relation: relA });
-                        return;
-                    }
-                    let payloadVerified = false;
-                    let digestSaysDiffer = false;
-                    if (relA.relation === "identical" && srcLogDigest !== undefined) {
-                        const dstEntries = await deps.sessionStorage.exportEntries?.(sessionId).catch(() => null) ?? null;
-                        const dstDigest = dstEntries === null ? undefined : sessionLogDigest(dstEntries);
-                        if (sessionLogDigestsComparable(srcLogDigest, dstDigest)) {
-                            if (srcLogDigest === dstDigest)
-                                payloadVerified = true;
-                            else
-                                digestSaysDiffer = true;
-                        }
-                        if (!payloadVerified)
-                            digestSaysDiffer = true;
-                    }
-                    if (relA.relation === "identical" && !digestSaysDiffer) {
-                        const fss = deps.fileSnapshotStore;
-                        if (fss?.importManifest && fss.getBlob && snapshots.length > 0) {
-                            const getBlobA = (h) => fss.getBlob(h);
-                            for (const snap of snapshots) {
-                                const r = await fss.importManifest(sessionId, snap.key, new Map(snap.manifest), getBlobA);
-                                if (!r.ok) {
-                                    sendError(res, 422, r.error.code === "restore_failed" ? "restore_failed" : "missing_blob", `snapshot import failed (${r.error.code})`);
-                                    return;
-                                }
-                            }
-                        }
-                        const opOk = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
-                        if (deps.sessionPolicyStore)
-                            for (const rec of policy)
-                                await deps.sessionPolicyStore.putRules(sessionId, rec.principal, rec.rules, { operator: opOk });
-                        const importingP = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
-                        if (deps.resumeAnchorStore)
-                            for (const a of anchors)
-                                await deps.resumeAnchorStore.put(sessionId, a.eventId, a.entryId, importingP);
-                        sendJson(res, 200, {
-                            relation: "identical",
-                            basis: payloadVerified ? "entry-ids+digest" : "entry-ids",
-                            payloadVerified,
-                        });
-                        return;
-                    }
-                    const activeTaskId = await deps.runStore?.getActiveTaskId(sessionId);
-                    if (activeTaskId) {
-                        sendError(res, 409, "session_active", "session has an active run; sync after it settles", { activeTaskId });
-                        return;
-                    }
-                    const heldLease = importLeases.get(sessionId);
-                    if (heldLease) {
-                        const staleSecRaw = deps.config.syncImportLeaseStaleSec;
-                        const staleSec = typeof staleSecRaw === "number" && Number.isFinite(staleSecRaw) ? staleSecRaw : 600;
-                        const staleMs = staleSec * 1000;
-                        const ageMs = Date.now() - heldLease.at;
-                        if (staleMs > 0 && ageMs >= staleMs) {
-                            deps.logger?.warn?.("sync_import_lease_taken_over", { sessionId, ageMs, staleMs, stagingId: heldLease.stagingId });
-                            cleanupStaging(heldLease.stagingId);
-                            importLeases.delete(sessionId);
-                        }
-                        else {
-                            const retryAfterSec = staleMs > 0 ? Math.max(1, Math.ceil((staleMs - ageMs) / 1000)) : undefined;
-                            sendError(res, 409, "import_in_flight", "an import is already in flight for this session"
-                                + (retryAfterSec !== undefined ? ` (a stalled holder is taken over after ${staleSec}s of inactivity; retry in ~${retryAfterSec}s)` : ""), retryAfterSec !== undefined ? { retryAfterSec } : undefined);
-                            return;
-                        }
-                    }
-                    const fss = deps.fileSnapshotStore;
-                    const canImportSnapshots = typeof fss?.importManifest === "function";
-                    if (canImportSnapshots) {
-                        const distinct = new Set();
-                        for (const snap of snapshots)
-                            for (const [, hash] of snap.manifest)
-                                distinct.add(hash);
-                        const all = [...distinct];
-                        if (typeof fss?.hasBlobs === "function") {
-                            const present = await fss.hasBlobs(all);
-                            const missing = all.find((h) => !present.has(h));
-                            if (missing !== undefined) {
-                                sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
-                                return;
-                            }
-                        }
-                        else {
-                            for (const hash of all) {
-                                if (!(await deps.fileSnapshotStore.getBlob(hash))) {
-                                    sendError(res, 422, "missing_blob", "missing blob; PUT all referenced blobs before import");
-                                    return;
-                                }
-                            }
-                        }
-                    }
-                    const importingPrincipal = scope.fleetWide ? (owner ?? null) : scope.gateOwner;
-                    const operatorOk = explicitOperatorOk(gatedPrincipal(req, deps.config), deps.config.operatorPrincipals);
-                    const token = randomBytes(8).toString("hex");
-                    const handle = deps.sessionStorage.beginImportStaging(sessionId, token);
-                    const stagingId = handle.stagingId;
-                    importLeases.set(sessionId, { at: Date.now(), stagingId });
-                    pendingStagings.set(stagingId, {
-                        handle, realSessionId: sessionId, owner: importingPrincipal, ...(resolution ? { resolution } : {}), operatorOk,
-                        snapshots, policy, anchors, declaredEntryIds: entryIds, openedBy: scope.gateOwner, openedFleetWide: scope.fleetWide,
-                    });
-                    sendJson(res, 200, { stagingId, relation: relA.relation });
-                    return;
-                }
-                if (sm[6] !== undefined && req.method === "POST") {
-                    const stagingId = safeDecode(sm[6]);
-                    if (stagingId === null) {
-                        sendJson(res, 400, { error: "invalid staging id" });
-                        return;
-                    }
-                    const pending = pendingStagings.get(stagingId);
-                    if (!pending || pending.realSessionId !== sessionId) {
-                        sendJson(res, 404, { error: "staging not found" });
-                        return;
-                    }
-                    if (!pending.openedFleetWide && !scope.fleetWide && pending.openedBy !== scope.gateOwner) {
-                        sendJson(res, 404, { error: "staging not found" });
-                        return;
-                    }
-                    const getBlob = (h) => deps.fileSnapshotStore.getBlob(h);
-                    const canImportSnapshots = typeof deps.fileSnapshotStore?.importManifest === "function";
-                    const validator = new StreamingImportValidator();
-                    let lineBuf = "";
-                    let pendingBatch = [];
-                    const flush = async () => { if (pendingBatch.length) {
-                        await pending.handle.appendBatch(pendingBatch);
-                        pendingBatch = [];
-                    } };
-                    class PrecheckError extends Error {
-                        status;
-                        constructor(status, msg) {
-                            super(msg);
-                            this.status = status;
-                        }
-                    }
-                    const streamedIds = new Set();
-                    const onEntry = (e) => {
-                        if (!e || typeof e !== "object" || typeof e.id !== "string")
-                            throw new PrecheckError(422, "malformed entry (missing id)");
-                        streamedIds.add(e.id);
-                        validator.step(e);
-                    };
-                    const utf8 = new StringDecoder("utf8");
-                    try {
-                        for await (const chunk of req) {
-                            touchImportLease(pending.realSessionId);
-                            lineBuf += utf8.write(chunk);
-                            if (Buffer.byteLength(lineBuf, "utf8") > SYNC_NDJSON_LINE_MAX_BYTES)
-                                throw new PrecheckError(413, "NDJSON line too large");
-                            let nl;
-                            while ((nl = lineBuf.indexOf("\n")) >= 0) {
-                                const line = lineBuf.slice(0, nl).trim();
-                                lineBuf = lineBuf.slice(nl + 1);
-                                if (line.length === 0)
-                                    continue;
-                                let e;
-                                try {
-                                    e = JSON.parse(line);
-                                }
-                                catch {
-                                    throw new PrecheckError(400, "malformed NDJSON line");
-                                }
-                                onEntry(e);
-                                pendingBatch.push(e);
-                                if (pendingBatch.length >= SYNC_IMPORT_BATCH)
-                                    await flush();
-                            }
-                        }
-                        lineBuf += utf8.end();
-                        const tail = lineBuf.trim();
-                        if (tail.length > 0) {
-                            let e;
-                            try {
-                                e = JSON.parse(tail);
-                            }
-                            catch {
-                                throw new PrecheckError(400, "malformed NDJSON line");
-                            }
-                            onEntry(e);
-                            pendingBatch.push(e);
-                        }
-                        await flush();
-                        validator.finish();
-                        if (streamedIds.size !== pending.declaredEntryIds.length || !pending.declaredEntryIds.every((id) => streamedIds.has(id))) {
-                            throw new PrecheckError(422, "streamed entries do not match the Phase-A declared entryIds");
-                        }
-                    }
-                    catch (e) {
-                        if (e instanceof PrecheckError) {
-                            await pending.handle.abort().catch(() => undefined);
-                            cleanupStaging(stagingId);
-                            sendError(res, e.status, "invalid_entries", e.message);
-                            return;
-                        }
-                        if (e instanceof SessionError && e.code === "invalid_session") {
-                            await pending.handle.abort().catch(() => undefined);
-                            cleanupStaging(stagingId);
-                            sendError(res, 422, "invalid_entries", "staged session log failed validation");
-                            return;
-                        }
-                        await pending.handle.abort().catch(() => undefined);
-                        cleanupStaging(stagingId);
-                        throw e;
-                    }
-                    const activeAtCommit = await deps.runStore?.getActiveTaskId(sessionId);
-                    if (activeAtCommit) {
-                        await pending.handle.abort().catch(() => undefined);
-                        cleanupStaging(stagingId);
-                        sendError(res, 409, "session_active", "session started an active run while the import streamed; sync after it settles", { activeTaskId: activeAtCommit });
-                        return;
-                    }
-                    try {
-                        const committed = await pending.handle.commit(pending.owner, pending.resolution ? { resolution: pending.resolution } : undefined);
-                        if (canImportSnapshots) {
-                            const importManifest = deps.fileSnapshotStore.importManifest.bind(deps.fileSnapshotStore);
-                            for (const snap of pending.snapshots) {
-                                const r = await importManifest(sessionId, snap.key, new Map(snap.manifest), getBlob);
-                                if (!r.ok) {
-                                    sendError(res, 422, r.error.code === "restore_failed" ? "restore_failed" : "missing_blob", `snapshot import failed (${r.error.code})`);
-                                    cleanupStaging(stagingId);
-                                    return;
-                                }
-                            }
-                        }
-                        const policyStore = deps.sessionPolicyStore;
-                        if (policyStore)
-                            for (const rec of pending.policy)
-                                await policyStore.putRules(sessionId, rec.principal, rec.rules, { operator: pending.operatorOk });
-                        const anchorStore = deps.resumeAnchorStore;
-                        if (anchorStore)
-                            for (const a of pending.anchors)
-                                await anchorStore.put(sessionId, a.eventId, a.entryId, pending.owner);
-                        deps.sessionStorage.evict?.(sessionId);
-                        cleanupStaging(stagingId);
-                        sendJson(res, 200, { relation: committed.relation });
-                    }
-                    catch (e) {
-                        if (e instanceof SyncConflictError) {
-                            await pending.handle.abort().catch(() => undefined);
-                            cleanupStaging(stagingId);
-                            sendError(res, 409, "conflict", "sync conflict", { relation: e.relation });
-                            return;
-                        }
-                        if (e instanceof SessionPolicyError) {
-                            cleanupStaging(stagingId);
-                            sendError(res, e.code === "loosen_forbidden" ? 403 : 409, e.code, e.message);
-                            return;
-                        }
-                        cleanupStaging(stagingId);
-                        throw e;
-                    }
-                    return;
-                }
-                if (sm[2] === "plan" && req.method === "POST") {
-                    if (!pushGateOk())
-                        return;
-                    let body;
-                    try {
-                        body = (await readJson(req));
-                    }
-                    catch {
-                        sendJson(res, 400, { error: "invalid JSON body" });
-                        return;
-                    }
-                    if (!Array.isArray(body.entryIds) || !body.entryIds.every((x) => typeof x === "string")) {
-                        sendJson(res, 400, { error: "entryIds must be an array of strings" });
-                        return;
-                    }
-                    const dst = await deps.sessionStorage?.exportEntries?.(sessionId);
-                    const relation = classifySyncRelationshipByIds(body.entryIds, dst ? dst.map((e) => e.id) : null);
-                    sendJson(res, 200, relation);
-                    return;
-                }
-                sendJson(res, 404, { error: "not found" });
-                return;
-            }
-        }
-        {
-            const am = /^\/v1\/attachments(?:\/([^/?]+))?$/.exec(url);
-            if (am) {
-                if (rateLimited(req, res) || quotaExceeded(req, res))
-                    return;
-                const store = deps.taskAttachmentStore;
-                if (!store) {
-                    sendJson(res, 501, { error: "attachment store not configured" });
-                    return;
-                }
-                const principal = gatedPrincipal(req, deps.config);
-                if (deps.config.requirePrincipal && principal === undefined) {
-                    sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                    return;
-                }
-                const owner = principal ?? "default";
-                const attId = am[1] !== undefined ? safeDecode(am[1]) : undefined;
-                if (attId === undefined && req.method === "POST") {
-                    const q = new URL(req.url ?? "", "http://x").searchParams;
-                    const rawName = q.get("name");
-                    const base = ((rawName ?? "").split(/[/\\]/).filter(Boolean).pop() ?? "").slice(0, 128);
-                    if (!rawName || base === "" || base === "." || base === ".." || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(base)) {
-                        sendJson(res, 400, { error: "query param `name` is required and must reduce to a safe basename ([A-Za-z0-9._-], not starting with a dot)" });
-                        return;
-                    }
-                    const name = sanitizePathComponent(base);
-                    const mime = String(req.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
-                    if (!/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/.test(mime) || mime.length > 128) {
-                        sendJson(res, 400, { error: "content-type must be a well-formed mime type (type/subtype)" });
-                        return;
-                    }
-                    const allow = deps.config.attachmentMimeAllowlist;
-                    if (allow && !allow.some((a) => a === mime || (a.endsWith("/*") && mime.startsWith(a.slice(0, -1))))) {
-                        sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { code: "attachment.mime_not_allowed", allowed: allow });
-                        return;
-                    }
-                    const max = deps.config.attachmentMaxBytes ?? 32 * 1024 * 1024;
-                    let body;
-                    try {
-                        body = await readRawBody(req, max);
-                    }
-                    catch (err) {
-                        if (err instanceof HttpError && err.status === 413) {
-                            sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { code: "attachment.too_large", maxBytes: max });
-                            return;
-                        }
-                        throw err;
-                    }
-                    const rec = {
-                        id: uuidv7(),
-                        owner,
-                        name,
-                        mime,
-                        sha256: createHash("sha256").update(body).digest("hex"),
-                        sizeBytes: body.length,
-                        createdAtMs: Date.now(),
-                    };
-                    await store.put({ ...rec, content: new Uint8Array(body) });
-                    deps.metrics?.inc("attachment_uploads_total");
-                    sendJson(res, 201, { id: rec.id, name: rec.name, mime: rec.mime, sha256: rec.sha256, sizeBytes: rec.sizeBytes });
-                    return;
-                }
-                if (attId !== undefined && attId !== null && req.method === "GET") {
-                    const meta = await store.get(owner, attId);
-                    const bytes = meta ? await store.getContent(owner, attId) : null;
-                    if (!meta || !bytes) {
-                        sendJson(res, 404, { error: "not found" });
-                        return;
-                    }
-                    res.writeHead(200, {
-                        "content-type": meta.mime,
-                        "content-length": String(bytes.byteLength),
-                        "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(meta.name)}`,
-                    });
-                    res.end(Buffer.from(bytes));
-                    return;
-                }
-                if (attId !== undefined && attId !== null && req.method === "DELETE") {
-                    const ok = await store.delete(owner, attId);
-                    if (!ok) {
-                        sendJson(res, 404, { error: "not found" });
-                        return;
-                    }
-                    res.writeHead(204).end();
-                    return;
-                }
-                sendJson(res, 404, { error: "not found" });
-                return;
-            }
-        }
-        if (req.method === "POST" && /^\/v1\/sessions\/[^/]+\/notify$/.test(url)) {
-            if (rateLimited(req, res) || quotaExceeded(req, res))
-                return;
-            const principal = gatedPrincipal(req, deps.config);
-            if (deps.config.requirePrincipal && principal === undefined) {
-                sendJson(res, 401, { error: `missing principal header '${deps.config.principalHeader}'` });
-                return;
-            }
-            const notifySession = decodeURIComponent(url.split("/")[3]);
-            let nb;
-            try {
-                nb = (await readJson(req));
-            }
-            catch {
-                sendJson(res, 400, { error: "body must be JSON: { task_id, status, summary, result?, seq?, source? }" });
-                return;
-            }
-            if (typeof nb.task_id !== "string" || nb.task_id.trim().length === 0 || nb.task_id.length > 190) {
-                sendJson(res, 400, { error: "task_id must be a non-empty string of at most 190 characters" });
-                return;
-            }
-            const NOTIFY_STATUSES = ["completed", "failed", "killed", "cancelled", "event"];
-            if (typeof nb.status !== "string" || !NOTIFY_STATUSES.includes(nb.status)) {
-                sendJson(res, 400, { error: `status must be one of ${NOTIFY_STATUSES.join("/")}` });
-                return;
-            }
-            if (typeof nb.summary !== "string" || nb.summary.trim().length === 0) {
-                sendJson(res, 400, { error: "summary must be a non-empty string" });
-                return;
-            }
-            if (nb.result !== undefined && typeof nb.result !== "string") {
-                sendJson(res, 400, { error: "result must be a string when present" });
-                return;
-            }
-            if (nb.seq !== undefined && (typeof nb.seq !== "number" || !Number.isInteger(nb.seq) || nb.seq < 1)) {
-                sendJson(res, 400, { error: "seq must be a positive integer when present" });
-                return;
-            }
-            if (nb.source !== undefined && (typeof nb.source !== "string" || nb.source.length > 190)) {
-                sendJson(res, 400, { error: "source must be a string of at most 190 characters when present" });
-                return;
-            }
-            if (!deps.sessionStorage?.ownerOf) {
-                sendJson(res, 501, { error: "external notify requires the session-ownership face (sessionStorage.ownerOf)" });
-                return;
-            }
-            const notifyOwner = await deps.sessionStorage.ownerOf(notifySession);
-            if (notifyOwner === undefined) {
-                sendJson(res, 404, { error: "session not found" });
-                return;
-            }
-            const notifyOperator = explicitOperatorOk(principal, deps.config.operatorPrincipals);
-            if (!notifyOperator && notifyOwner !== null && notifyOwner !== principal) {
-                sendJson(res, 404, { error: "session not found" });
-                return;
-            }
-            const payload = {
-                task_id: nb.task_id,
-                status: nb.status,
-                summary: nb.summary,
-                ...(nb.result !== undefined ? { result: nb.result } : {}),
-                ...(nb.seq !== undefined ? { seq: nb.seq } : {}),
-                ...(nb.source !== undefined ? { source: nb.source } : {}),
-            };
-            const liveTaskId = await deps.runStore?.getActiveTaskId?.(notifySession).catch(() => undefined);
-            const liveStream = liveTaskId !== undefined && liveTaskId !== null ? steerableRuns.get(liveTaskId) : undefined;
-            if (liveStream) {
-                try {
-                    await liveStream.notify(payload);
-                    sendJson(res, 200, { sessionId: notifySession, delivery: "live" });
-                    return;
-                }
-                catch (e) {
-                    const code = e.code;
-                    if (typeof code === "string" && code.startsWith("notify.")) {
-                        sendError(res, 400, code, e instanceof Error ? e.message : "invalid notification");
-                        return;
-                    }
-                }
-            }
-            if (!deps.workflowCompletionInbox) {
-                sendJson(res, 501, { error: "external notify park requires the workflow completion inbox (WORKFLOW_RUN_STORE)" });
-                return;
-            }
-            await deps.workflowCompletionInbox.enqueue(taskNotificationInboxEntry(notifySession, notifyOwner ?? principal ?? null, { task_id: payload.task_id, task_type: "external", status: payload.status, summary: payload.summary, ...(payload.result !== undefined ? { result: payload.result } : {}), ...(payload.seq !== undefined ? { seq: payload.seq } : {}), ...(payload.source !== undefined ? { source: payload.source } : {}) }, Date.now()));
-            sendJson(res, 202, { sessionId: notifySession, delivery: "parked", note: "no live stream — parked in the session inbox; drained as a task_notification on the next stream open" });
-            return;
-        }
-        if (req.method === "POST" && /^\/v1\/sessions\/[^/]+\/wake$/.test(url)) {
-            if (!deps.checkpointStore) {
-                sendJson(res, 501, { error: "wake requires the checkpoint store" });
-                return;
-            }
-            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
+            if (rateLimited(req, res) || quotaExceeded(req, res) || (await leaseDenied(req, res)))
                 return;
             const principal = gatedPrincipal(req, deps.config);
             if (deps.config.requirePrincipal && principal === undefined) {
@@ -6045,35 +4106,6 @@ async function handleTaskList(res, runStore, query, forceOwner) {
     const nextCursor = hasMore && last ? encodeCursor({ createdAt: last.createdAt, taskId: last.taskId }) : undefined;
     sendJson(res, 200, { tasks, ...(nextCursor ? { nextCursor } : {}) });
 }
-function encodeSessionCursor(c) {
-    return Buffer.from(JSON.stringify(c)).toString("base64url");
-}
-function decodeSessionCursor(s) {
-    if (!s)
-        return undefined;
-    try {
-        const o = JSON.parse(Buffer.from(s, "base64url").toString());
-        return o.lastActivityAt && o.sessionId && !Number.isNaN(Date.parse(o.lastActivityAt))
-            ? { lastActivityAt: o.lastActivityAt, sessionId: o.sessionId }
-            : undefined;
-    }
-    catch {
-        return undefined;
-    }
-}
-async function handleSessionList(res, lister, query, forceOwner) {
-    const owner = forceOwner != null ? forceOwner : (query.get("owner") ?? undefined);
-    const limit = Math.min(100, Math.max(1, Number(query.get("limit") ?? 50) || 50));
-    const cursor = decodeSessionCursor(query.get("cursor"));
-    const qRaw = (query.get("q") ?? "").trim();
-    const q = qRaw ? qRaw.slice(0, 256) : undefined;
-    const rows = await lister({ ...(owner ? { owner } : {}), ...(cursor ? { cursor } : {}), limit: limit + 1, ...(q ? { q } : {}) });
-    const hasMore = rows.length > limit;
-    const page = hasMore ? rows.slice(0, limit) : rows;
-    const last = page[page.length - 1];
-    const nextCursor = hasMore && last ? encodeSessionCursor({ lastActivityAt: last.lastActivityAt, sessionId: last.sessionId }) : undefined;
-    sendJson(res, 200, { sessions: page, ...(nextCursor ? { nextCursor } : {}) });
-}
 async function handleTaskArtifacts(res, runStore, taskId) {
     const run = await runStore.getRun(taskId);
     if (!run) {
@@ -6210,60 +4242,6 @@ export async function streamApprovals(req, res, cs, scope, pollMs = APPROVALS_ST
     }
     res.end();
 }
-async function streamSseLog(req, res, provider, id, staleMs) {
-    const lastId = Number(req.headers["last-event-id"] ?? new URL(req.url ?? "", "http://x").searchParams.get("from") ?? 0);
-    let from = Number.isFinite(lastId) ? lastId : 0;
-    if (from > 0) {
-        const retainedFrom = await provider.retainedFrom(id);
-        if (retainedFrom > from + 1) {
-            sendJson(res, 416, { error: "resume point evicted past retention", retainedFrom });
-            return;
-        }
-    }
-    sseHeaders(res);
-    let closed = false;
-    req.on("close", () => {
-        closed = true;
-    });
-    const start = Date.now();
-    const MAX_MS = 15 * 60 * 1000;
-    let lastBeat = Date.now();
-    const write = (events) => {
-        for (const ev of events) {
-            const f = provider.formatEvent(ev);
-            res.write(`id: ${f.id}\nevent: ${f.event}\ndata: ${JSON.stringify(f.data)}\n\n`);
-            from = ev.seq;
-        }
-    };
-    while (!closed) {
-        const [events, row] = await Promise.all([provider.getEvents(id, from), provider.statusOf(id)]);
-        write(events);
-        if (!row)
-            break;
-        if (row.status !== "running") {
-            write(await provider.getEvents(id, from));
-            break;
-        }
-        const stale = Date.now() - new Date(row.updatedAt).getTime() > staleMs;
-        if (stale && events.length === 0) {
-            const sf = provider.staleFrame();
-            res.write(`event: ${sf.event}\ndata: ${JSON.stringify(sf.data)}\n\n`);
-            break;
-        }
-        if (Date.now() - start > MAX_MS) {
-            res.write(`event: error\ndata: ${JSON.stringify({ type: "error", code: "STREAM_MAX_DURATION", message: "stream reached its 15-minute cap — reconnect with Last-Event-ID to continue (the run is still active)" })}\n\n`);
-            break;
-        }
-        if (events.length === 0) {
-            if (Date.now() - lastBeat > 15_000) {
-                res.write(`event: heartbeat\ndata: {}\n\n`);
-                lastBeat = Date.now();
-            }
-            await sleep(250);
-        }
-    }
-    res.end();
-}
 async function streamRunEvents(req, res, runStore, taskId, staleMs) {
     await streamSseLog(req, res, {
         statusOf: async (id) => {
@@ -6276,210 +4254,6 @@ async function streamRunEvents(req, res, runStore, taskId, staleMs) {
         staleFrame: () => ({ event: "failed", data: { type: "failed", errorMessage: "run stalled (instance lost?)" } }),
     }, taskId, staleMs);
 }
-async function streamBakeEvents(req, res, bakes, bakeId, staleMs) {
-    await streamSseLog(req, res, {
-        statusOf: async (id) => {
-            const bake = await bakes.getBake(id);
-            return bake ? { status: bake.status, updatedAt: bake.updatedAt } : undefined;
-        },
-        getEvents: (id, after) => bakes.getEvents(id, after),
-        retainedFrom: (id) => bakes.retainedFrom(id),
-        formatEvent: (ev) => ({
-            id: ev.seq,
-            event: ev.kind,
-            data: { kind: ev.kind, seq: ev.seq, ts: ev.ts, ...(ev.level ? { level: ev.level } : {}), ...(ev.data ?? {}) },
-        }),
-        staleFrame: () => ({ event: "done", data: { kind: "done", status: "FAILED", error: "bake-runner lost (no heartbeat)", digest: null, indexId: null, repo: null, ref: null } }),
-    }, bakeId, staleMs);
-}
-function bakeView(b) {
-    return {
-        bakeId: b.bakeId,
-        status: b.status,
-        state: b.state,
-        profile: b.profile,
-        bands: b.bands,
-        baseRef: b.baseRef,
-        push: b.push,
-        dryRun: b.dryRun,
-        logs: b.logs,
-        digest: b.digest,
-        repo: b.repo,
-        ref: b.ref,
-        indexId: b.indexId,
-        exitCode: b.exitCode,
-        error: b.error,
-        errorCode: b.errorCode,
-        manifestSha: b.manifestSha,
-        tag: b.tag,
-        requestedBy: b.requestedBy,
-        createdAt: b.createdAt,
-        updatedAt: b.updatedAt,
-    };
-}
-function claimResponse(claimed) {
-    return {
-        bakeId: claimed.bakeId,
-        argv: claimed.argv,
-        push: claimed.push,
-        dryRun: claimed.dryRun,
-        logs: claimed.logs,
-        profile: claimed.profile,
-        bands: claimed.bands,
-        ingestSecret: claimed.ingestSecret,
-        leaseUntil: claimed.leaseUntil,
-    };
-}
-async function ingestBakeLine(bakes, idx, bake, line, registry) {
-    const bakeId = bake.bakeId;
-    const event = typeof line.event === "string" ? line.event : "";
-    const lineOrd = typeof line.lineOrd === "number" ? line.lineOrd : typeof line.line_ord === "number" ? line.line_ord : null;
-    if (event !== "done") {
-        if (event === "state") {
-            const state = typeof line.state === "string" ? line.state : null;
-            if (state)
-                await bakes.setState(bakeId, state);
-            const seq = await bakes.appendEvent(bakeId, "state", { state }, { lineOrd });
-            return { status: 200, body: { accepted: true, seq } };
-        }
-        const kind = event === "manifest" ? "manifest" : event;
-        const level = event === "log" && line.level === "raw" ? "raw" : null;
-        const { event: _e, lineOrd: _lo, line_ord: _li, ...data } = line;
-        const seq = await bakes.appendEvent(bakeId, kind, redactDeep(data), { lineOrd, level });
-        return { status: 200, body: { accepted: true, seq } };
-    }
-    const doneStatus = typeof line.status === "string" ? line.status : "FAILED";
-    const exitCode = typeof line.exitCode === "number" ? line.exitCode : doneStatus === "COMPLETE" ? 0 : null;
-    const cancelled = doneStatus === "CANCELLED";
-    const errorText = typeof line.error === "string" ? redactSecrets(line.error) : null;
-    const tag = typeof line.tag === "string" ? line.tag : bake.tag;
-    let digest = typeof line.digest === "string" && line.digest.length > 0 ? line.digest : null;
-    let indexId = bake.indexId;
-    let repo = bake.repo;
-    let ref = bake.ref;
-    let manifestSha = bake.manifestSha;
-    let finalStatus = doneStatus;
-    let finalError = errorText;
-    let finalExit = exitCode;
-    let registerDowngraded = false;
-    const registerSteps = [];
-    if (doneStatus === "COMPLETE" && digest && idx) {
-        const manifestBody = (line.manifestBody ?? line.manifest);
-        const fresh = await bakes.getBake(bakeId);
-        const nonTerminal = !!fresh && (fresh.status === "queued" || fresh.status === "running");
-        if (manifestBody && typeof manifestBody === "object" && nonTerminal) {
-            const profile = bake.profile && bake.profile !== "custom" ? bake.profile : (manifestBody.profile && manifestBody.profile !== "custom" ? manifestBody.profile : "custom");
-            repo = registry ? `${registry}/${profile}` : `sema-images/${profile}`;
-            manifestSha = typeof line.manifestSha === "string" ? line.manifestSha : (typeof line.manifest?.sha256 === "string" ? String(line.manifest.sha256) : bake.manifestSha);
-            if (pgHasUnstorable(digest) || pgHasUnstorable(repo) || pgHasUnstorable(manifestSha)) {
-                indexId = null;
-                registerSteps.push({ step: "register", status: "skipped", reason: "identity fields contained unstorable bytes" });
-            }
-            else {
-                registerSteps.push({ step: "register", status: "running" });
-                try {
-                    const entry = manifestToIndexEntry(manifestBody, { repo, digest, status: "building", manifestSha, sizeBytes: manifestBody.sizeBytes ?? null, signed: false });
-                    entry.visibility = "public";
-                    entry.tenantId = null;
-                    indexId = await idx.registerBuilding(entry);
-                    ref = `${repo}@${digest}`;
-                    const bound = await bakes.setIndexId(bakeId, indexId);
-                    if (!bound)
-                        indexId = null;
-                    registerSteps.push({ step: "register", status: "ok" });
-                }
-                catch (err) {
-                    indexId = null;
-                    ref = `${repo}@${digest}`;
-                    finalStatus = "FAILED";
-                    registerDowngraded = true;
-                    finalExit = exitCode ?? 0;
-                    finalError = redactSecrets(`index register failed after a COMPLETE build (built-but-unregistered partial): ${String(err?.message ?? err)}`);
-                    registerSteps.push({ step: "register", status: "fail", reason: "index register failed (TiDB?)" });
-                }
-            }
-        }
-    }
-    const suppliedCode = typeof line.errorCode === "string" && RUNNER_ERROR_CODES.has(line.errorCode)
-        ? line.errorCode
-        : undefined;
-    const errorCode = cancelled
-        ? "cancelled"
-        : suppliedCode !== undefined && !registerDowngraded
-            ? suppliedCode
-            : errorCodeForExit(finalExit, cancelled);
-    const conflictBands = errorCode === "band-conflict" && Array.isArray(line.conflictBands)
-        ? line.conflictBands.filter((b) => typeof b === "string")
-        : null;
-    const identityInvalid = (typeof digest === "string" && pgHasUnstorable(digest)) ||
-        (typeof repo === "string" && pgHasUnstorable(repo)) ||
-        (typeof ref === "string" && pgHasUnstorable(ref)) ||
-        (typeof manifestSha === "string" && pgHasUnstorable(manifestSha));
-    if (identityInvalid) {
-        finalStatus = "FAILED";
-        digest = null;
-        repo = null;
-        ref = null;
-        manifestSha = null;
-        indexId = null;
-        finalError = finalError ? `${finalError}; identity fields contained unstorable bytes` : "terminal frame identity fields contained unstorable bytes";
-    }
-    const finalState = (finalStatus === "COMPLETE" ? "COMPLETE" : finalStatus === "CANCELLED" ? "CANCELLED" : "FAILED");
-    const coarse = coarseStatusForState(finalState);
-    let affectedRows = 0;
-    const terminal = {
-        status: coarse === "done" ? "done" : "failed",
-        state: finalState,
-        digest,
-        repo,
-        ref,
-        indexId,
-        exitCode: finalExit,
-        error: finalError,
-        errorCode,
-        manifestSha,
-        tag,
-    };
-    let lastErr;
-    for (let attempt = 0; attempt < 3; attempt += 1) {
-        try {
-            affectedRows = await bakes.setTerminal(bakeId, terminal);
-            lastErr = undefined;
-            break;
-        }
-        catch (err) {
-            lastErr = err;
-        }
-    }
-    if (lastErr !== undefined) {
-        return { status: 200, body: { accepted: true, terminal: false, needsFlip: true } };
-    }
-    if (affectedRows >= 1) {
-        for (const s of registerSteps)
-            await bakes.appendEvent(bakeId, "step", s);
-        await bakes.appendEvent(bakeId, "done", {
-            status: finalStatus,
-            digest,
-            repo,
-            ref,
-            indexId,
-            tag,
-            manifestSha,
-            sizeBytes: typeof line.sizeBytes === "number" ? line.sizeBytes : null,
-            exitCode: finalExit,
-            error: finalError,
-            errorCode,
-            ...(conflictBands ? { conflictBands } : {}),
-        }, { lineOrd });
-    }
-    return { status: 200, body: { accepted: true, terminal: affectedRows >= 1, indexId } };
-}
-function sleep(ms) {
-    return new Promise((r) => setTimeout(r, ms));
-}
-function headerStr(v) {
-    return Array.isArray(v) ? v[0] : v;
-}
 function isBillableSubmitPath(url) {
     return (url === "/v1/side-query" ||
         url === "/v1/tasks" ||
@@ -6745,14 +4519,6 @@ function streamFleet(req, res, bus, callerScope, callerSession = null, completio
         res.on("close", shutdown);
     });
 }
-function sseHeaders(res, extra) {
-    res.writeHead(200, {
-        "content-type": "text/event-stream",
-        "cache-control": "no-cache",
-        connection: "keep-alive",
-        ...extra,
-    });
-}
 function routeLabel(_method, url) {
     if (RUN_STEER_RE.test(url))
         return "/v1/runs/:id/steer";
@@ -6799,43 +4565,6 @@ function routeLabel(_method, url) {
         return url;
     return "other";
 }
-function workspaceContentType(relPath) {
-    const base = relPath.slice(relPath.lastIndexOf("/") + 1);
-    const dot = base.lastIndexOf(".");
-    const ext = dot > 0 ? base.slice(dot + 1).toLowerCase() : "";
-    const TABLE = {
-        txt: "text/plain; charset=utf-8", md: "text/plain; charset=utf-8", log: "text/plain; charset=utf-8",
-        json: "application/json; charset=utf-8", csv: "text/csv; charset=utf-8",
-        png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif", webp: "image/webp",
-        pdf: "application/pdf",
-    };
-    return TABLE[ext] ?? "application/octet-stream";
-}
-function looksBinary(bytes) {
-    const n = Math.min(bytes.byteLength, 8192);
-    for (let i = 0; i < n; i++)
-        if (bytes[i] === 0)
-            return true;
-    return false;
-}
-function authorized(req, token) {
-    const h = req.headers.authorization ?? "";
-    return safeEqual(h, `Bearer ${token}`) || safeEqual(h, `token ${token}`);
-}
-function systemFor(req, config) {
-    for (const [tok, system] of Object.entries(config.authTokens ?? {})) {
-        if (authorized(req, tok))
-            return system;
-    }
-    if (config.authToken && authorized(req, config.authToken))
-        return null;
-    return undefined;
-}
-function safeEqual(a, b) {
-    const ab = Buffer.from(a, "utf8");
-    const bb = Buffer.from(b, "utf8");
-    return ab.length === bb.length && timingSafeEqual(ab, bb);
-}
 function cors(res, req, origins, principalHeader) {
     if (!origins || origins.length === 0)
         return;
@@ -6854,14 +4583,4 @@ function cors(res, req, origins, principalHeader) {
     res.setHeader("access-control-allow-methods", "GET, POST, OPTIONS");
     res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}`);
 }
-function sendJson(res, status, body) {
-    res.writeHead(status, { "content-type": "application/json" });
-    res.end(JSON.stringify(body));
-}
-function sendError(res, status, errorCode, message, extra) {
-    sendJson(res, status, { error: message, errorCode, ...extra });
-}
-function msg(e) {
-    return e instanceof Error ? e.message : String(e);
-}
 //# sourceMappingURL=server.js.map