@sema-agent/server 7.79.0 → 7.79.1

package/dist/http/dispatch.js

@@ -0,0 +1,499 @@
+import { createHash } from "node:crypto";
+import { setSsoPrincipal, ssoVerifiedPrincipal, setSsoScope, isDestructiveSessionWrite, PRINCIPAL_TOKEN_HEADER, APPROVAL_MAC_HEADER, APPROVAL_MAC_KID_HEADER } from "../security.js";
+import { publicStoreProbeError } from "../store-live-probe.js";
+import { looksLikeJwt } from "@sema-agent/settings-schema/api/auth-bridge";
+import { handleCapabilities } from "./routes/capabilities.js";
+import { handleObservability } from "./routes/observability.js";
+import { handleDiagnostics } from "./routes/diagnostics.js";
+import { handleAdoption } from "./routes/adoption.js";
+import { handleRetention } from "./routes/retention-ops.js";
+import { handleAdminDrain } from "./routes/admin-drain.js";
+import { handleDevices } from "./routes/devices.js";
+import { handleAdminConfigRefresh } from "./routes/admin-config-refresh.js";
+import { handleConfigCatalog } from "./routes/config-catalog.js";
+import { handleMemoryOptOut } from "./routes/admin-memory-optout.js";
+import { handleMemoryPolicy } from "./routes/memory-policy.js";
+import { handleMemoryBundle } from "./routes/memory-bundle.js";
+import { handleMemoryCompliance } from "./routes/memory-compliance.js";
+import { handleMemoryOrigin } from "./routes/memory-origin.js";
+import { handleMemoryConsolidation } from "./routes/memory-consolidation.js";
+import { handleSharedMemory } from "./routes/shared-memory.js";
+import { handleRules } from "./routes/rules.js";
+import { handleSessionsList } from "./routes/sessions-list.js";
+import { handleAgentRoster } from "./routes/agents-roster.js";
+import { handleSessions } from "./routes/sessions.js";
+import { handleSessionSync } from "./routes/session-sync.js";
+import { handleAttachments } from "./routes/attachments.js";
+import { handleFleet } from "./routes/fleet.js";
+import { handleA2aServe, handleA2a } from "./routes/a2a-serve.js";
+import { handleTraceUsage } from "./routes/trace-usage.js";
+import { handleWorkflows, handleWorkflowAgentSteer } from "./routes/workflows.js";
+import { handleNotifyWake, SESSION_WAKE_RE } from "./routes/notify-wake.js";
+import { handleApprovalsAssistant, ASSISTANT_RESUME_RE, ASSISTANT_PLAN_REVIEW_RE } from "./routes/approvals-assistant.js";
+import { handleRuns, handleRunVerbs, RUN_SUBAGENT_RESUME_RE } from "./routes/runs.js";
+import { handleRunMemoryCapture } from "./routes/run-memory-capture.js";
+import { handleSideQuery } from "./routes/side-query.js";
+import { handleTasks } from "./routes/tasks.js";
+import { handleLeader } from "./routes/leader.js";
+import { handleImages } from "./routes/images.js";
+import { sendJson, sendError, isSseResponse } from "./send.js";
+import { authorized, systemFor } from "./principal-gate.js";
+const PROCESS_STARTED_AT_MS = Date.now() - Math.round(process.uptime() * 1000);
+const ROUTE_DOMAINS = [
+    handleTraceUsage,
+    handleWorkflows,
+    handleFleet,
+    handleA2aServe,
+    handleCapabilities,
+    handleSideQuery,
+    handleTasks,
+    handleRuns,
+    handleA2a,
+    handleWorkflowAgentSteer,
+    handleRunVerbs,
+    handleRunMemoryCapture,
+    handleLeader,
+    handleImages,
+    handleApprovalsAssistant,
+    handleObservability,
+    handleDiagnostics,
+    handleAdoption,
+    handleRetention,
+    handleAdminDrain,
+    handleDevices,
+    handleAdminConfigRefresh,
+    handleConfigCatalog,
+    handleMemoryOptOut,
+    handleMemoryPolicy,
+    handleMemoryBundle,
+    handleMemoryCompliance,
+    handleMemoryOrigin,
+    handleMemoryConsolidation,
+    handleRules,
+    handleSharedMemory,
+    handleSessionsList,
+    handleAgentRoster,
+    handleSessions,
+    handleSessionSync,
+    handleAttachments,
+    handleNotifyWake,
+];
+void ROUTE_DOMAINS;
+export function isMethodDispatchedSubmitPath(url) {
+    return url === "/v1/a2a";
+}
+export function hasServiceAuth(config) {
+    return Boolean(config.authToken) || Object.keys(config.authTokens ?? {}).length > 0;
+}
+export function isBillableSubmitPath(url) {
+    return (url === "/v1/side-query" ||
+        url === "/v1/tasks" ||
+        url === "/v1/tasks/stream" ||
+        url === "/v1/runs" ||
+        url === "/v1/leader" ||
+        url === "/v1/a2a" ||
+        url === "/v1/admin/memory/consolidation/run" ||
+        ASSISTANT_RESUME_RE.test(url) ||
+        ASSISTANT_PLAN_REVIEW_RE.test(url) ||
+        RUN_SUBAGENT_RESUME_RE.test(url) ||
+        SESSION_WAKE_RE.test(url) ||
+        url.startsWith("/v1/approvals"));
+}
+export function isCredentialGatedRewrite(method, url) {
+    const m = method.toUpperCase();
+    if (m === "POST") {
+        return (url === "/v1/adoption" ||
+            url.startsWith("/v1/rules/cc-import/") ||
+            url.startsWith("/v1/rules/local-import/") ||
+            url === "/v1/memory/import" ||
+            url === "/v1/memory/export" ||
+            url === "/v1/memory/erase" ||
+            url.startsWith("/v1/memory/origin/entries/") ||
+            url.startsWith("/v1/devices/"));
+    }
+    if (m === "PUT")
+        return url === "/v1/admin/memory-optout" || url.startsWith("/v1/admin/memory-optout/");
+    if (m === "DELETE")
+        return url === "/v1/rules" || url.startsWith("/v1/admin/memory-optout/");
+    if (m === "GET") {
+        return (/^\/v1\/memory\/entries\/[^/]+\/provenance$/.test(url) ||
+            url === "/v1/memory/origin/external" ||
+            url === "/v1/memory/origin/clearances" ||
+            url === "/v1/admin/memory-optout" ||
+            url === "/v1/devices" ||
+            /^\/v1\/devices\/sessions\/[^/]+$/.test(url));
+    }
+    return false;
+}
+const ROUTE_LABEL_PATTERNS = [
+    [/^\/v1\/runs\/[^/]+\/steer$/, "/v1/runs/:id/steer"],
+    [/^\/v1\/runs\/[^/]+\/memory\/capture-optout$/, "/v1/runs/:id/memory/capture-optout"],
+    [/^\/v1\/runs\/[^/]+\/interrupt$/, "/v1/runs/:id/interrupt"],
+    [/^\/v1\/runs\/[^/]+\/detach$/, "/v1/runs/:id/detach"],
+    [/^\/v1\/runs\/[^/]+\/cancel$/, "/v1/runs/:id/cancel"],
+    [/^\/v1\/runs\/[^/]+\/compact$/, "/v1/runs/:id/compact"],
+    [/^\/v1\/runs\/[^/]+\/events$/, "/v1/runs/:id/events"],
+    [/^\/v1\/runs\/[^/]+\/subagents\/[^/]+\/(steer|resume|output|stream)$/, "/v1/runs/:id/subagents/:sub/*"],
+    [/^\/v1\/runs\/[^/]+\/tasks\/[^/]+\/(output|stop)$/, "/v1/runs/:id/tasks/:tid/*"],
+    [/^\/v1\/runs\/[^/]+$/, "/v1/runs/:id"],
+    [/^\/v1\/images\/bakes\/[^/]+\/events$/, "/v1/images/bakes/:id/events"],
+    [/^\/v1\/images\/bakes\/[^/]+\/cancel$/, "/v1/images/bakes/:id/cancel"],
+    [/^\/v1\/images\/bakes\/[^/]+\/claim$/, "/v1/images/bakes/:id/claim"],
+    [/^\/v1\/images\/bakes\/[^/]+\/ingest$/, "/v1/images/bakes/:id/ingest"],
+    [/^\/v1\/images\/bakes\/[^/]+$/, "/v1/images/bakes/:id"],
+    [/^\/v1\/images\/digests\/[^/]+$/, "/v1/images/digests/:digest"],
+    [/^\/v1\/images\/[^/]+$/, "/v1/images/:profile"],
+    [/^\/v1\/approvals\/[^/]+\/decide$/, "/v1/approvals/:id/decide"],
+    [/^\/v1\/approvals\/[^/]+\/exemptions(\/[^/]+)?$/, "/v1/approvals/:id/exemptions"],
+    [/^\/v1\/sessions\/[^/]+\/(wake|fork|init|notify|events|head|mcp|a2a|policy|settings)$/, "/v1/sessions/:id/$verb"],
+    [/^\/v1\/admin\/memory-optout\/[^/]+$/, "/v1/admin/memory-optout/:principal"],
+    [/^\/v1\/sessions\/[^/]+\/memory\/erase$/, "/v1/sessions/:id/memory/erase"],
+    [/^\/v1\/sessions\/[^/]+\/memory-status$/, "/v1/sessions/:id/memory-status"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/(manifest|entries|plan)$/, "/v1/sessions/:id/sync/$verb"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/import(\/[^/]+\/entries)?$/, "/v1/sessions/:id/sync/import"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/blobs(\/[^/]+)?$/, "/v1/sessions/:id/sync/blobs"],
+    [/^\/v1\/sessions\/[^/]+\/sync\/history\/blobs\/[^/]+$/, "/v1/sessions/:id/sync/history/blobs/:hash"],
+    [/^\/v1\/sessions\/[^/]+\/workspace(\/[^/]+(\/(tree|file|archive))?)?$/, "/v1/sessions/:id/workspace"],
+    [/^\/v1\/sessions\/[^/]+$/, "/v1/sessions/:id"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/preempt$/, "/v1/assistant/tasks/:id/preempt"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/resume$/, "/v1/assistant/tasks/:id/resume"],
+    [/^\/v1\/assistant\/tasks\/[^/]+\/plan_review$/, "/v1/assistant/tasks/:id/plan_review"],
+    [/^\/v1\/elicitations\/[^/]+\/respond$/, "/v1/elicitations/:id/respond"],
+    [/^\/v1\/questions\/[^/]+\/respond$/, "/v1/questions/:id/respond"],
+    [/^\/v1\/tool-approvals\/[^/]+\/respond$/, "/v1/tool-approvals/:id/respond"],
+    [/^\/v1\/workflows\/[^/]+\/agents\/[^/]+\/steer$/, "/v1/workflows/:id/agents/:aid/steer"],
+    [/^\/v1\/workflows\/[^/]+\/(stream|journal)$/, "/v1/workflows/:id/$sub"],
+    [/^\/v1\/workflows\/[^/]+$/, "/v1/workflows/:id"],
+    [/^\/v1\/tasks\/[^/]+\/asks\/[^/]+\/decision$/, "/v1/tasks/:id/asks/:askId/decision"],
+    [/^\/v1\/tasks\/[^/]+\/tool-results\/[^/]+$/, "/v1/tasks/:id/tool-results/:ref"],
+    [/^\/v1\/tasks\/[^/]+\/(turns|stream|artifacts)$/, "/v1/tasks/:id/$sub"],
+    [/^\/v1\/leader\/[^/]+$/, "/v1/leader/:id"],
+    [/^\/v1\/devices\/sessions\/[^/]+\/rebind$/, "/v1/devices/sessions/:id/rebind"],
+    [/^\/v1\/devices\/sessions\/[^/]+$/, "/v1/devices/sessions/:id"],
+    [/^\/v1\/attachments\/[^/]+$/, "/v1/attachments/:id"],
+    [/^\/v1\/capabilities\/scenarios\/[^/]+$/, "/v1/capabilities/scenarios/:name"],
+    [/^\/v1\/adoption\/[^/]+$/, "/v1/adoption/:id"],
+    [/^\/v1\/ops\/retention\/holds\/[^/]*$/, "/v1/ops/retention/holds/:domain"],
+    [/^\/v1\/memory\/sync\/[^/]+$/, "/v1/memory/sync/:scope"],
+    [/^\/v1\/memory\/entries\/[^/]+\/provenance$/, "/v1/memory/entries/:entryId/provenance"],
+    [/^\/v1\/memory\/origin\/entries\/[^/]+\/clear$/, "/v1/memory/origin/entries/:entryId/clear"],
+    [/^\/v1\/usage\/(summary|series|breakdown)$/, "/v1/usage/$sub"],
+    [/^\/v1\/shared-memory\/stores\/[^/]+\/documents$/, "/v1/shared-memory/stores/:store/documents"],
+    [/^\/v1\/shared-memory\/stores\/[^/]+\/document$/, "/v1/shared-memory/stores/:store/document"],
+];
+const ROUTE_LABEL_LITERALS = new Set([
+    "/health", "/metrics", "/metrics/summary", "/metrics/plan-cache",
+    "/v1/models", "/v1/tasks", "/v1/tasks/stream", "/v1/tasks/source-summary",
+    "/v1/runs", "/v1/sessions", "/v1/approvals", "/v1/approvals/stream",
+    "/v1/assistant/inbox", "/v1/assistant/tasks", "/v1/usage", "/v1/policy", "/v1/capabilities",
+    "/v1/images", "/v1/images/bakes", "/v1/images/bakes/claim", "/v1/images/select", "/v1/images/register",
+    "/v1/workflows", "/v1/attachments", "/v1/leader", "/v1/outcomes", "/v1/side-query",
+    "/v1/devices",
+    "/v1/fleet/stream",
+    "/v1/memory/export", "/v1/sendfile-links",
+    "/v1/memory/import",
+    "/v1/memory/erase",
+    "/v1/memory/origin/external", "/v1/memory/origin/clearances",
+    "/v1/shared-memory/stores",
+    "/v1/diagnostics/wiring",
+    "/v1/adoption",
+    "/v1/admin/drain",
+    "/v1/admin/config/refresh",
+    "/v1/config/catalog",
+    "/v1/admin/memory-optout",
+    "/v1/admin/memory/consolidation/run", "/v1/admin/memory/consolidation",
+    "/v1/rules/cc-import/prepare", "/v1/rules/cc-import/redeem",
+    "/v1/rules/local-import/prepare", "/v1/rules/local-import/redeem",
+    "/v1/rules",
+    "/.well-known/agent-card.json", "/v1/a2a",
+    "/v1/agents/roster",
+    "/v1/ops/retention/audit",
+]);
+export function routeLabel(_method, url) {
+    if (ROUTE_LABEL_LITERALS.has(url))
+        return url;
+    for (const [re, label] of ROUTE_LABEL_PATTERNS)
+        if (re.test(url))
+            return label;
+    return "other";
+}
+function cors(res, req, origins, principalHeader) {
+    if (!origins || origins.length === 0)
+        return;
+    let allow;
+    if (origins.length === 1) {
+        allow = origins[0];
+    }
+    else {
+        res.setHeader("vary", "Origin");
+        const reqOrigin = typeof req.headers.origin === "string" ? req.headers.origin : undefined;
+        allow = reqOrigin !== undefined && origins.includes(reqOrigin) ? reqOrigin : undefined;
+    }
+    if (allow === undefined)
+        return;
+    res.setHeader("access-control-allow-origin", allow);
+    res.setHeader("access-control-allow-methods", "GET, POST, PUT, DELETE, OPTIONS");
+    res.setHeader("access-control-allow-headers", `content-type, authorization, last-event-id, ${principalHeader}, idempotency-key, x-detach-on-disconnect, ${PRINCIPAL_TOKEN_HEADER}, ${APPROVAL_MAC_HEADER}, ${APPROVAL_MAC_KID_HEADER}, if-none-match`);
+    res.setHeader("access-control-expose-headers", "x-task-id, retry-after");
+}
+export function createDispatch(ctx) {
+    const { deps, noteActivity, routeCtxBase, counters } = ctx;
+    const openResponses = new Set();
+    let lastAttachEndedAt = 0;
+    if (deps.drainState) {
+        deps.drainState.attachedStreams = () => {
+            let n = 0;
+            for (const r of openResponses)
+                if (isSseResponse(r))
+                    n++;
+            return n;
+        };
+        deps.drainState.lastAttachEndedAt = () => lastAttachEndedAt;
+    }
+    async function handle(req, res) {
+        const startedAt = Date.now();
+        const method = req.method ?? "GET";
+        const url = (req.url ?? "/").split("?")[0];
+        noteActivity(url);
+        const admitted = method !== "OPTIONS" && url !== "/health" && !url.startsWith("/metrics");
+        if (admitted)
+            counters.admittedInflight++;
+        if (admitted)
+            openResponses.add(res);
+        let logged = false;
+        const reqState = { streamTaskId: undefined, streamDetached: false, source: null };
+        const ctx = { deps: routeCtxBase.deps, registry: routeCtxBase.registry, helpers: routeCtxBase.helpers, local: routeCtxBase.local, legs: routeCtxBase.legs, req: reqState };
+        const record = (viaClose) => {
+            if (logged)
+                return;
+            logged = true;
+            if (admitted)
+                counters.admittedInflight--;
+            if (openResponses.delete(res) && isSseResponse(res))
+                lastAttachEndedAt = performance.now();
+            const route = routeLabel(method, url);
+            const seconds = (Date.now() - startedAt) / 1000;
+            const aborted = viaClose && !res.writableEnded;
+            const status = aborted ? "499" : String(res.statusCode);
+            deps.metrics?.inc("http_requests_total", { route, method, status });
+            deps.metrics?.observe("http_request_duration_seconds", seconds, { route });
+            const log = route === "/health" || route === "/metrics" ? deps.logger?.debug : deps.logger?.info;
+            log?.call(deps.logger, "request", { method, route, status, ms: Date.now() - startedAt, ...(reqState.runStatus !== undefined ? { runStatus: reqState.runStatus } : {}), ...(reqState.runErrorCode !== undefined ? { errorCode: reqState.runErrorCode } : {}), ...(aborted ? { aborted: true, ...(reqState.streamTaskId ? { taskId: reqState.streamTaskId } : {}), ...(reqState.streamDetached ? { detached: true } : {}) } : {}) });
+        };
+        res.on("finish", () => record(false));
+        res.on("close", () => record(true));
+        cors(res, req, deps.config.corsOrigins, deps.config.principalHeader);
+        if (req.method === "OPTIONS") {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        if (req.method === "GET" && url === "/health") {
+            const restart = deps.restartState?.();
+            const configHash = createHash("sha256")
+                .update(JSON.stringify({ model: deps.config.model.id, sessionBackend: deps.config.sessionBackend, dbBackend: deps.config.dbBackend, dataRoot: deps.config.localDataRoot, configProvider: deps.config.configProvider, remoteExec: deps.config.remoteExec?.provider, port: deps.config.port }))
+                .digest("hex")
+                .slice(0, 16);
+            sendJson(res, 200, {
+                status: "ok",
+                ...(typeof deps.capabilities?.version === "string" ? { version: deps.capabilities.version } : {}),
+                ...(deps.drainState?.draining ? { draining: true, ...(deps.drainState.since ? { drainingSince: deps.drainState.since } : {}), ...(deps.drainState.reason ? { drainReason: deps.drainState.reason } : {}) } : {}),
+                ...(deps.drainState?.inflight ? { inflight: deps.drainState.inflight() } : {}),
+                ...(deps.storeDegraded ? { durable: false, storeDegraded: true } : {}),
+                ...(deps.modelReady && !deps.modelReady() ? { ready: false, readyReason: "model roster pending (first effective-config pull)" } : {}),
+                model: deps.config.model.id,
+                sessionBackend: deps.sessionStoreLabel ?? deps.config.sessionBackend,
+                sessions: deps.runner.sessions.size,
+                ...(deps.instanceId ? { instanceId: deps.instanceId } : {}),
+                ...(deps.config.localDataRoot ? { dataRoot: deps.config.localDataRoot } : {}),
+                configHash,
+                pid: process.pid,
+                startedAt: PROCESS_STARTED_AT_MS,
+                port: deps.config.port,
+                ...(deps.config.directDoorActive ? { directDoorActive: true } : {}),
+                ...(restart ? { restartRequired: true, restart: { reasons: restart.reasons, version: restart.version, since: restart.since } } : {}),
+                ...(() => {
+                    const stuck = deps.planeDeferredState?.();
+                    return stuck ? { modelPlaneDeferred: { version: stuck.version, since: stuck.since, noHandoff: true, ...(stuck.blocked ? { blockedReasons: stuck.blocked } : {}) } } : {};
+                })(),
+                ...(() => {
+                    const gen = deps.configApplyState?.();
+                    if (!gen)
+                        return {};
+                    return {
+                        configTargetVersion: gen.configTargetVersion,
+                        configAppliedVersion: gen.configAppliedVersion,
+                        configTargetOrdinal: gen.configTargetOrdinal,
+                        configAppliedOrdinal: gen.configAppliedOrdinal,
+                        ...(gen.configApplyStaleMs !== undefined ? { configApplyStaleMs: gen.configApplyStaleMs } : {}),
+                    };
+                })(),
+                ...(() => {
+                    const probe = deps.storeLiveState?.();
+                    if (!probe)
+                        return {};
+                    return {
+                        ...(probe.live ? {} : { storeLive: false }),
+                        storeProbe: { live: probe.live, ageMs: probe.ageMs, ...(probe.error !== undefined ? { error: publicStoreProbeError(probe.error) } : {}) },
+                    };
+                })(),
+            });
+            return;
+        }
+        if (req.method === "GET" && (url === "/metrics" || url === "/metrics/summary" || url === "/metrics/plan-cache")) {
+            if (!deps.metrics) {
+                sendError(res, 404, "feature.metrics_disabled", "metrics disabled");
+                return;
+            }
+            const { authToken: t, metricsToken: mt } = deps.config;
+            const anyT = Boolean(t) || Object.keys(deps.config.authTokens ?? {}).length > 0;
+            const devOpen = !anyT && !mt && !deps.config.requirePrincipal;
+            const ok = devOpen || (anyT && systemFor(req, deps.config) !== undefined) || (!!mt && authorized(req, mt));
+            if (!ok) {
+                sendError(res, 401, "auth.unauthorized", "unauthorized");
+                return;
+            }
+            if (url === "/metrics/summary") {
+                sendJson(res, 200, { model: deps.config.model.id, ...deps.metrics.summarize() });
+                return;
+            }
+            if (url === "/metrics/plan-cache") {
+                sendJson(res, 200, { scopes: deps.planCacheProbe?.dump() ?? {} });
+                return;
+            }
+            res.writeHead(200, { "content-type": "text/plain; version=0.0.4" });
+            res.end(deps.metrics.render());
+            return;
+        }
+        if (deps.registryJwtVerifier) {
+            const authz = req.headers.authorization ?? "";
+            const rawBearer = /^Bearer\s/i.test(authz) ? authz.replace(/^Bearer\s+/i, "") : "";
+            if (rawBearer && looksLikeJwt(rawBearer)) {
+                const v = await deps.registryJwtVerifier.verify(rawBearer);
+                if (v.ok) {
+                    setSsoPrincipal(req, v.identity.principal);
+                    req.headers[deps.config.principalHeader.toLowerCase()] = v.identity.principal;
+                    if (v.identity.scope)
+                        setSsoScope(req, v.identity.scope);
+                    deps.logger?.info?.("auth_bridge_principal_accepted", { principal: v.identity.principal, ...(v.identity.scope ? { scope: v.identity.scope } : {}) });
+                }
+            }
+        }
+        if (await handleTraceUsage(req, res, url, ctx))
+            return;
+        if (await handleWorkflows(req, res, url, ctx))
+            return;
+        if (await handleFleet(req, res, url, ctx))
+            return;
+        if (await handleA2aServe(req, res, url, ctx))
+            return;
+        let source = null;
+        const anyServiceAuth = hasServiceAuth(deps.config);
+        if (anyServiceAuth) {
+            const sys = systemFor(req, deps.config);
+            if (sys === undefined) {
+                if (ssoVerifiedPrincipal(req)) {
+                    source = "sso";
+                }
+                else {
+                    sendError(res, 401, "auth.unauthorized", "unauthorized");
+                    return;
+                }
+            }
+            else {
+                source = sys;
+            }
+        }
+        reqState.source = source;
+        if (!anyServiceAuth &&
+            !deps.config.allowUnauthedWrites &&
+            ((req.method === "POST" && (isBillableSubmitPath(url) || url.startsWith("/v1/images/bakes"))) ||
+                isCredentialGatedRewrite(req.method ?? "", url))) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting task submissions");
+            return;
+        }
+        if (deps.drainState?.draining && req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
+            res.setHeader("retry-after", "15");
+            sendError(res, 503, "draining", "draining", { message: "this instance is draining for shutdown/upgrade — retry against the replacement instance", ...(deps.drainState.reason ? { reason: deps.drainState.reason } : {}) });
+            return;
+        }
+        if (deps.modelReady && !deps.modelReady() && req.method === "POST" && isBillableSubmitPath(url) && !isMethodDispatchedSubmitPath(url)) {
+            res.setHeader("retry-after", "5");
+            sendError(res, 503, "state.model_roster_pending", "model_roster_pending", { message: "this worker has no model yet (waiting for the first effective-config pull to land the roster) — retry shortly" });
+            return;
+        }
+        if (isDestructiveSessionWrite(req.method ?? "", url) && !anyServiceAuth && !deps.config.allowUnauthedWrites) {
+            sendError(res, 503, "auth.service_token_required", "this worker requires a service auth token (set SERVICE_AUTH_TOKEN) before accepting destructive session writes (policy / sync-import / fork / delete)");
+            return;
+        }
+        if (await handleCapabilities(req, res, url, ctx))
+            return;
+        if (await handleSideQuery(req, res, url, ctx))
+            return;
+        if (await handleTasks(req, res, url, ctx))
+            return;
+        if (await handleRuns(req, res, url, ctx))
+            return;
+        if (await handleA2a(req, res, url, ctx))
+            return;
+        if (await handleWorkflowAgentSteer(req, res, url, ctx))
+            return;
+        if (await handleRunVerbs(req, res, url, ctx))
+            return;
+        if (await handleRunMemoryCapture(req, res, url, ctx))
+            return;
+        if (await handleLeader(req, res, url, ctx))
+            return;
+        if (await handleImages(req, res, url, ctx))
+            return;
+        if (await handleApprovalsAssistant(req, res, url, ctx))
+            return;
+        if (await handleObservability(req, res, url, ctx))
+            return;
+        if (await handleDiagnostics(req, res, url, ctx))
+            return;
+        if (await handleAdoption(req, res, url, ctx))
+            return;
+        if (await handleRetention(req, res, url, ctx))
+            return;
+        if (await handleAdminDrain(req, res, url, ctx))
+            return;
+        if (await handleDevices(req, res, url, ctx))
+            return;
+        if (await handleAdminConfigRefresh(req, res, url, ctx))
+            return;
+        if (await handleConfigCatalog(req, res, url, ctx))
+            return;
+        if (await handleMemoryOptOut(req, res, url, ctx))
+            return;
+        if (await handleMemoryPolicy(req, res, url, ctx))
+            return;
+        if (await handleMemoryBundle(req, res, url, ctx))
+            return;
+        if (await handleMemoryCompliance(req, res, url, ctx))
+            return;
+        if (await handleMemoryOrigin(req, res, url, ctx))
+            return;
+        if (deps.memoryConsolidation && (await handleMemoryConsolidation(req, res, url, ctx)))
+            return;
+        if (await handleRules(req, res, url, ctx))
+            return;
+        if (deps.sharedMemoryStore && deps.orgMemoryDirectory && (await handleSharedMemory(req, res, url, ctx)))
+            return;
+        if (await handleSessionsList(req, res, url, ctx))
+            return;
+        if (await handleAgentRoster(req, res, url, ctx))
+            return;
+        if (await handleSessions(req, res, url, ctx))
+            return;
+        if (await handleSessionSync(req, res, url, ctx))
+            return;
+        if (await handleAttachments(req, res, url, ctx))
+            return;
+        if (await handleNotifyWake(req, res, url, ctx))
+            return;
+        sendError(res, 404, "not_found.route", "not found");
+    }
+    return { handle };
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/http/request-guards.d.ts

@@ -0,0 +1,51 @@
+/**
+ * 请求守门族(S-147 切片:`http/server.ts` 4837–5195 + `MAX_BODY` 逐字搬家,正文一字未改)。
+ * 配额 / 租约 / 用量窗 / 限流 / owner-scope / 体读取 —— 每只守门的判据与它自己的头注原位随行。
+ * ctx 字段 1 只(`deps`):本族对外围的耦合就这一格,它也是这一族的可测性读数。
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { FlatServiceDeps } from "./server.js";
+export declare function createRequestGuards(ctx: {
+    deps: FlatServiceDeps;
+}): {
+    quotaExceeded: (req: IncomingMessage, res: ServerResponse) => boolean;
+    ownerCostQuotaDenied: (principal: string | undefined) => {
+        status: number;
+        body: object;
+    } | undefined;
+    ownerFleetLeaseDenied: (owner: string | undefined) => Promise<{
+        status: number;
+        body: object;
+    } | undefined>;
+    ownerLeaseDenied: (res: ServerResponse, owner: string | undefined) => Promise<boolean>;
+    ownerQuotaDenied: (res: ServerResponse, owner: string | undefined) => boolean;
+    leaseDenied: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    usageWindowDenialFor: (key: string) => Promise<{
+        status: number;
+        body: {
+            error: string;
+            errorCode: string;
+            retryAfterSec: number;
+        };
+        retryAfterSec: number;
+    } | undefined>;
+    usageWindowDenied: (req: IncomingMessage, res: ServerResponse) => Promise<boolean>;
+    rateLimited: (req: IncomingMessage, res: ServerResponse) => boolean;
+    safeDecode: (seg: string) => string | null;
+    isFleetWide: (req: IncomingMessage) => boolean;
+    sessionOwnerScope: (req: IncomingMessage) => {
+        fleetWide: boolean;
+        gateOwner: string | null;
+    };
+    sessionOwnerScopeForWrite: (req: IncomingMessage) => {
+        fleetWide: boolean;
+        gateOwner: string | null;
+    };
+    runOwnerOk: (req: IncomingMessage, res: ServerResponse, owner: string | null, notFoundForm?: "run" | "session") => boolean;
+    runSessionAcceptOk: (req: IncomingMessage, res: ServerResponse, run: {
+        sessionId: string | null;
+    }, face: string, notFoundError?: string) => boolean;
+    readJson: (req: IncomingMessage) => Promise<unknown>;
+    readRawBody: (req: IncomingMessage, max: number) => Promise<Buffer>;
+};
+//# sourceMappingURL=request-guards.d.ts.map