@sema-agent/server 7.79.2 → 7.80.0

package/dist/http/routes/approvals-assistant.d.ts

@@ -2,7 +2,7 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { QuestionAnswer } from "@sema-agent/core";
 import type { CheckpointStoreFull } from "../../plugins/store-backend.js";
 import { type GovernancePosture } from "../active-run-conflict.js";
-import { type RouteCtx } from "../route-ctx.js";
+import { type RouteCtx, type RouteMatch, type RouteIdsOf } from "../route-ctx.js";
 import { type KeyClosureIssue } from "../../request-key-closure.js";
 /**
  * FRESH 决裁面的**顶层**键闭集裁决:受理集之外的键 ⇒ 返回拒体(调用方 400 `request.body_shape`);
@@ -16,9 +16,6 @@ import { type KeyClosureIssue } from "../../request-key-closure.js";
  * 的两种兑现方式:**门只站在人**(或客户端)**现写的那份字节**上。
  */
 export declare function decideBodyKeyIssue(raw: unknown): KeyClosureIssue | null;
-export declare const ASSISTANT_PREEMPT_RE: RegExp;
-export declare const ASSISTANT_RESUME_RE: RegExp;
-export declare const ASSISTANT_PLAN_REVIEW_RE: RegExp;
 /**
  * S-342 —— 「空串的理由 = 没有理由 = 这是一次**裸拒**」。这条语义只适用于**本仓自铸**的那一个域。
  *
@@ -45,7 +42,9 @@ export declare function decisionReasonOf(body: {
  *  load-bearing shape — `answers[]` non-empty, each `{header: string, selected: string[], note?: string}` —
  *  so a typo'd payload fails the request instead of resuming the task with an answer the tool can't use. */
 export declare function isQuestionAnswer(v: unknown): v is QuestionAnswer;
-export declare function handleApprovalsAssistant(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+/** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
+ *  = 「本域已应答」;走到函数尾才是「没匹配上」。跨域的东西一律在首行解构出来。 */
+export declare function handleApprovalsAssistant(req: IncomingMessage, res: ServerResponse, match: RouteMatch<ApprovalsAssistantRouteId>, ctx: RouteCtx): Promise<void>;
 /**
  * GET /v1/approvals/stream ([ref] native push): SSE — pushes pending-approval deltas so the portal
  * SUBSCRIBES ONCE instead of polling GET /v1/approvals every ~10s (better UX: near-real-time + no client poll
@@ -71,4 +70,58 @@ export declare function streamApprovals(req: IncomingMessage, res: ServerRespons
 /** [ref]②:出身归因的部署侧一半(缺席 ⇒ 归不出治理出身 ⇒ 键缺席,与 best-effort 同方向)。**位置在
  *  `pollMs` 之前**是刻意的:`pollMs` 只有测试传,而本参数是每个生产调用点都必须给的那一个。 */
 governance?: GovernancePosture, pollMs?: number): Promise<void>;
+export declare const APPROVALS_ASSISTANT_ROUTES: readonly [{
+    readonly id: "approvals-list";
+    readonly path: "/v1/approvals";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "approvals-stream";
+    readonly path: "/v1/approvals/stream";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "assistant-inbox";
+    readonly path: "/v1/assistant/inbox";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "assistant-tasks";
+    readonly path: "/v1/assistant/tasks";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "approval-decide";
+    readonly pattern: RegExp;
+    readonly label: "/v1/approvals/:id/decide";
+    readonly methods: readonly ["POST"];
+}, {
+    readonly id: "approval-exemptions-list";
+    readonly pattern: RegExp;
+    readonly label: "/v1/approvals/:id/exemptions";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "approval-exemption-delete";
+    readonly pattern: RegExp;
+    readonly label: "/v1/approvals/:id/exemptions";
+    readonly methods: readonly ["DELETE"];
+}, {
+    readonly id: "assistant-task-preempt";
+    readonly pattern: RegExp;
+    readonly label: "/v1/assistant/tasks/:id/preempt";
+    readonly methods: readonly ["POST"];
+}, {
+    readonly id: "assistant-task-resume";
+    readonly pattern: RegExp;
+    readonly label: "/v1/assistant/tasks/:id/resume";
+    readonly billable: true;
+    readonly methods: readonly ["POST"];
+}, {
+    readonly id: "assistant-task-plan-review";
+    readonly pattern: RegExp;
+    readonly label: "/v1/assistant/tasks/:id/plan_review";
+    readonly billable: true;
+    readonly methods: readonly ["POST"];
+}, {
+    readonly prefix: "/v1/approvals";
+    readonly billable: true;
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
+export type ApprovalsAssistantRouteId = RouteIdsOf<typeof APPROVALS_ASSISTANT_ROUTES>;
 //# sourceMappingURL=approvals-assistant.d.ts.map

package/dist/http/routes/approvals-assistant.js

@@ -17,6 +17,7 @@ import { sendJson, sendError, sseHeaders, SSE_MAX_STREAM_MS, SSE_HEARTBEAT_IDLE_
 import { gatedPrincipal, explicitOperatorOk, isOperator, sendPrincipalRefusal } from "../principal-gate.js";
 import { governanceOriginOf } from "../active-run-conflict.js";
 import { sendResumeOutcome } from "../route-ctx.js";
+import { assertNever } from "../route-ctx.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "../../request-key-closure.js";
 const DECIDE_BODY_DECLARED_KEYS = [
     "answer", "boundCallId", "boundInputHash", "checkpointToken", "decision", "reason", "remember", "updatedInput",
@@ -45,9 +46,6 @@ export function decideBodyKeyIssue(raw) {
         unsupportedKeys: buckets.unsupported.slice(0, MAX_KEY_ECHO),
     };
 }
-export const ASSISTANT_PREEMPT_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/preempt$/;
-export const ASSISTANT_RESUME_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/resume$/;
-export const ASSISTANT_PLAN_REVIEW_RE = /^\/v1\/assistant\/tasks\/([^/]+)\/plan_review$/;
 export function decisionReasonOf(body) {
     return typeof body.reason === "string" && body.reason !== "" ? body.reason : undefined;
 }
@@ -132,30 +130,25 @@ async function decideIdempotentReplay(cs, args) {
         },
     };
 }
-export async function handleApprovalsAssistant(req, res, url, ctx) {
-    const miss = { fell: false };
-    await handleApprovalsAssistantBody(req, res, url, ctx, miss);
-    return !miss.fell;
-}
-async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
+export async function handleApprovalsAssistant(req, res, match, ctx) {
     const { deps } = ctx;
     const { preemptableRuns } = ctx.registry;
     const { readJson, rateLimited, quotaExceeded } = ctx.helpers;
     const { resumeCheckpoint, resumePreempted, resumePlanReview } = ctx.legs;
-    if (deps.checkpointStore && (url.startsWith("/v1/approvals") || url.startsWith("/v1/assistant"))) {
+    {
         const cs = deps.checkpointStore;
         const principal = gatedPrincipal(req, deps.config);
         const operator = isOperator(principal, deps.config.operatorPrincipals);
-        if (req.method === "GET" && url === "/v1/approvals/stream") {
+        if (match.decl.id === "approvals-stream") {
             const scope = operator
-                ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
+                ? (new URLSearchParams(match.search).get("owner") ?? undefined)
                 : (principal ?? "__none__");
             await streamApprovals(req, res, cs, scope, deps.config);
             return;
         }
-        if (req.method === "GET" && url === "/v1/approvals") {
+        if (match.decl.id === "approvals-list") {
             const scope = operator
-                ? (new URL(req.url ?? "", "http://x").searchParams.get("owner") ?? undefined)
+                ? (new URLSearchParams(match.search).get("owner") ?? undefined)
                 : (principal ?? "__none__");
             sendJson(res, 200, {
                 pending: (await cs.listPending(scope)).map((r) => projectPendingForWire(r, deps.config)),
@@ -166,8 +159,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             return;
         }
         {
-            const em = /^\/v1\/approvals\/([^/]+)\/exemptions(?:\/([^/]+))?$/.exec(url);
-            if (em && (req.method === "GET" || req.method === "DELETE")) {
+            if (match.decl.id === "approval-exemptions-list" || match.decl.id === "approval-exemption-delete") {
                 if (!deps.approvalExemptionStore) {
                     sendError(res, 501, "capability.store_required", "approval exemptions need a store backend");
                     return;
@@ -175,8 +167,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 let exSessionId;
                 let exToolName;
                 try {
-                    exSessionId = decodeURIComponent(em[1]);
-                    exToolName = em[2] !== undefined ? decodeURIComponent(em[2]) : undefined;
+                    exSessionId = decodeURIComponent(match.params.sessionId);
+                    exToolName = match.params.tool !== undefined ? decodeURIComponent(match.params.tool) : undefined;
                 }
                 catch {
                     sendError(res, 400, "request.path_malformed", "malformed id (invalid percent-encoding)");
@@ -196,7 +188,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                         return;
                     }
                 }
-                if (req.method === "GET") {
+                if (match.decl.id === "approval-exemptions-list") {
                     if (exToolName !== undefined) {
                         sendError(res, 404, "request.route_unsupported", "not found");
                         return;
@@ -213,8 +205,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 return;
             }
         }
-        if (req.method === "GET" && url === "/v1/assistant/inbox") {
-            const ownerParam = new URL(req.url ?? "", "http://x").searchParams.get("owner") || undefined;
+        if (match.decl.id === "assistant-inbox") {
+            const ownerParam = new URLSearchParams(match.search).get("owner") || undefined;
             const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
             const summaries = await cs.listByScope(scope);
             const inbox = (await Promise.all(summaries.map(async (s) => {
@@ -240,8 +232,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendJson(res, 200, { inbox });
             return;
         }
-        if (req.method === "GET" && url === "/v1/assistant/tasks") {
-            const ownerParam = new URL(req.url ?? "", "http://x").searchParams.get("owner") || undefined;
+        if (match.decl.id === "assistant-tasks") {
+            const ownerParam = new URLSearchParams(match.search).get("owner") || undefined;
             const scope = operator && ownerParam ? ownerParam : (principal ?? "__none__");
             if (!deps.runStore) {
                 sendJson(res, 200, { tasks: [] });
@@ -268,8 +260,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendJson(res, 200, { tasks });
             return;
         }
-        const preemptMatch = req.method === "POST" ? ASSISTANT_PREEMPT_RE.exec(url) : null;
-        if (preemptMatch) {
+        if (match.decl.id === "assistant-task-preempt") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
             if (!deps.runStore) {
@@ -284,7 +275,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendError(res, 501, "feature.preemption_disabled", "preemption not enabled on this worker (needs RESOURCE_SUSPEND=true + a durable checkpoint store)");
                 return;
             }
-            const taskId = preemptMatch[1];
+            const taskId = match.params.taskId;
             const run = await deps.runStore.getRun(taskId);
             if (!run) {
                 sendError(res, 404, "not_found.run", "task not found");
@@ -332,8 +323,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             }
             return;
         }
-        const resumeMatch = req.method === "POST" ? ASSISTANT_RESUME_RE.exec(url) : null;
-        if (resumeMatch) {
+        if (match.decl.id === "assistant-task-resume") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
             if (!deps.runStore) {
@@ -344,7 +334,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const taskId = resumeMatch[1];
+            const taskId = match.params.taskId;
             const run = await deps.runStore.getRun(taskId);
             if (!run) {
                 sendError(res, 404, "not_found.run", "task not found");
@@ -360,8 +350,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
-        const planReviewMatch = req.method === "POST" ? ASSISTANT_PLAN_REVIEW_RE.exec(url) : null;
-        if (planReviewMatch) {
+        if (match.decl.id === "assistant-task-plan-review") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
             if (!deps.runStore) {
@@ -372,7 +361,7 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
                 sendPrincipalRefusal(res, req, deps.config);
                 return;
             }
-            const taskId = planReviewMatch[1];
+            const taskId = match.params.taskId;
             const body = (await readJson(req));
             const decision = body?.decision === "approve" ? "approve" : body?.decision === "edit" ? "edit" : body?.decision === "reject" ? "reject" : undefined;
             if (!decision) {
@@ -465,13 +454,12 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendResumeOutcome(res, out, deps.logger);
             return;
         }
-        const m = /^\/v1\/approvals\/([^/]+)\/decide$/.exec(url);
-        if (m && req.method === "POST") {
+        if (match.decl.id === "approval-decide") {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
             let sessionId;
             try {
-                sessionId = decodeURIComponent(m[1]);
+                sessionId = decodeURIComponent(match.params.sessionId);
             }
             catch {
                 sendError(res, 400, "request.path_malformed", "malformed approval id (invalid percent-encoding)");
@@ -615,10 +603,8 @@ async function handleApprovalsAssistantBody(req, res, url, ctx, miss) {
             sendResumeOutcome(res, out, deps.logger, remember && deps.approvalExemptionStore ? { rememberApplied } : undefined);
             return;
         }
-        sendError(res, 404, "not_found.route", "not found");
-        return;
     }
-    miss.fell = true;
+    return assertNever(match.decl.id);
 }
 const APPROVALS_STREAM_POLL_MS = 3000;
 function redactPendingDisclosures(row) {
@@ -686,4 +672,17 @@ export async function streamApprovals(req, res, cs, scope, governance, pollMs =
     }
     res.end();
 }
+export const APPROVALS_ASSISTANT_ROUTES = [
+    { id: "approvals-list", path: "/v1/approvals", methods: ["GET"] },
+    { id: "approvals-stream", path: "/v1/approvals/stream", methods: ["GET"] },
+    { id: "assistant-inbox", path: "/v1/assistant/inbox", methods: ["GET"] },
+    { id: "assistant-tasks", path: "/v1/assistant/tasks", methods: ["GET"] },
+    { id: "approval-decide", pattern: /^\/v1\/approvals\/(?<sessionId>[^/]+)\/decide$/, label: "/v1/approvals/:id/decide", methods: ["POST"] },
+    { id: "approval-exemptions-list", pattern: /^\/v1\/approvals\/(?<sessionId>[^/]+)\/exemptions(?:\/(?<tool>[^/]+))?$/, label: "/v1/approvals/:id/exemptions", methods: ["GET"] },
+    { id: "approval-exemption-delete", pattern: /^\/v1\/approvals\/(?<sessionId>[^/]+)\/exemptions(?:\/(?<tool>[^/]+))?$/, label: "/v1/approvals/:id/exemptions", methods: ["DELETE"] },
+    { id: "assistant-task-preempt", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/preempt$/, label: "/v1/assistant/tasks/:id/preempt", methods: ["POST"] },
+    { id: "assistant-task-resume", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/resume$/, label: "/v1/assistant/tasks/:id/resume", billable: true, methods: ["POST"] },
+    { id: "assistant-task-plan-review", pattern: /^\/v1\/assistant\/tasks\/(?<taskId>[^/]+)\/plan_review$/, label: "/v1/assistant/tasks/:id/plan_review", billable: true, methods: ["POST"] },
+    { prefix: "/v1/approvals", billable: true },
+];
 //# sourceMappingURL=approvals-assistant.js.map

package/dist/http/routes/attachments.d.ts

@@ -1,4 +1,24 @@
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { RouteCtx } from "../route-ctx.js";
-export declare function handleAttachments(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+/** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
+ *  的语义原样 =「本域已应答」;走到函数尾才是「没匹配上」,置 `miss.fell` 交回装配器继续下一个域。
+ *  跨域的东西(deps / 助手 / 单域状态 / 每请求量)一律在首行解构出来,于是下面每一行都逐字不变。 */
+export declare function handleAttachments(req: IncomingMessage, res: ServerResponse, match: RouteMatch<AttachmentsRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const ATTACHMENTS_ROUTES: readonly [{
+    readonly id: "attachment-upload";
+    readonly path: "/v1/attachments";
+    readonly methods: readonly ["POST"];
+}, {
+    readonly id: "attachment-fetch";
+    readonly pattern: RegExp;
+    readonly label: "/v1/attachments/:id";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "attachment-delete";
+    readonly pattern: RegExp;
+    readonly label: "/v1/attachments/:id";
+    readonly methods: readonly ["DELETE"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
+export type AttachmentsRouteId = RouteIdsOf<typeof ATTACHMENTS_ROUTES>;
 //# sourceMappingURL=attachments.d.ts.map

package/dist/http/routes/attachments.js

@@ -3,17 +3,12 @@ import { uuidv7, sanitizePathComponent } from "@sema-agent/core";
 import { HttpError } from "../../security.js";
 import { sendJson, sendError } from "../send.js";
 import { gatedPrincipal, sendPrincipalRefusal } from "../principal-gate.js";
-export async function handleAttachments(req, res, url, ctx) {
-    const miss = { fell: false };
-    await handleAttachmentsBody(req, res, url, ctx, miss);
-    return !miss.fell;
-}
-async function handleAttachmentsBody(req, res, url, ctx, miss) {
+import { assertNever } from "../route-ctx.js";
+export async function handleAttachments(req, res, match, ctx) {
     const { deps } = ctx;
     const { rateLimited, quotaExceeded, safeDecode, readRawBody } = ctx.helpers;
     {
-        const am = /^\/v1\/attachments(?:\/([^/?]+))?$/.exec(url);
-        if (am) {
+        {
             if (rateLimited(req, res) || quotaExceeded(req, res))
                 return;
             const store = deps.taskAttachmentStore;
@@ -27,80 +22,94 @@ async function handleAttachmentsBody(req, res, url, ctx, miss) {
                 return;
             }
             const owner = principal ?? "default";
-            const attId = am[1] !== undefined ? safeDecode(am[1]) : undefined;
-            if (attId === undefined && req.method === "POST") {
-                const q = new URL(req.url ?? "", "http://x").searchParams;
-                const rawName = q.get("name");
-                const base = ((rawName ?? "").split(/[/\\]/).filter(Boolean).pop() ?? "").slice(0, 128);
-                if (!rawName || base === "" || base === "." || base === ".." || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(base)) {
-                    sendError(res, 400, "request.query_invalid", "query param `name` is required and must reduce to a safe basename ([A-Za-z0-9._-], not starting with a dot)");
-                    return;
-                }
-                const name = sanitizePathComponent(base);
-                const mime = String(req.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
-                if (!/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/.test(mime) || mime.length > 128) {
-                    sendError(res, 400, "request.query_invalid", "content-type must be a well-formed mime type (type/subtype)");
-                    return;
-                }
-                const allow = deps.config.attachmentMimeAllowlist;
-                if (allow && !allow.some((a) => a === mime || (a.endsWith("/*") && mime.startsWith(a.slice(0, -1))))) {
-                    sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { allowed: allow });
+            const attId = match.decl.id === "attachment-upload" ? null : safeDecode(match.params.id);
+            switch (match.decl.id) {
+                case "attachment-upload": {
+                    const q = new URLSearchParams(match.search);
+                    const rawName = q.get("name");
+                    const base = ((rawName ?? "").split(/[/\\]/).filter(Boolean).pop() ?? "").slice(0, 128);
+                    if (!rawName || base === "" || base === "." || base === ".." || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(base)) {
+                        sendError(res, 400, "request.query_invalid", "query param `name` is required and must reduce to a safe basename ([A-Za-z0-9._-], not starting with a dot)");
+                        return;
+                    }
+                    const name = sanitizePathComponent(base);
+                    const mime = String(req.headers["content-type"] ?? "").split(";")[0].trim().toLowerCase();
+                    if (!/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/.test(mime) || mime.length > 128) {
+                        sendError(res, 400, "request.query_invalid", "content-type must be a well-formed mime type (type/subtype)");
+                        return;
+                    }
+                    const allow = deps.config.attachmentMimeAllowlist;
+                    if (allow && !allow.some((a) => a === mime || (a.endsWith("/*") && mime.startsWith(a.slice(0, -1))))) {
+                        sendError(res, 415, "attachment.mime_not_allowed", `mime '${mime}' is not in this deployment's allowlist`, { allowed: allow });
+                        return;
+                    }
+                    const max = deps.config.attachmentMaxBytes ?? 32 * 1024 * 1024;
+                    let body;
+                    try {
+                        body = await readRawBody(req, max);
+                    }
+                    catch (err) {
+                        if (err instanceof HttpError && err.status === 413) {
+                            sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { maxBytes: max });
+                            return;
+                        }
+                        throw err;
+                    }
+                    const rec = {
+                        id: uuidv7(),
+                        owner,
+                        name,
+                        mime,
+                        sha256: createHash("sha256").update(body).digest("hex"),
+                        sizeBytes: body.length,
+                        createdAtMs: Date.now(),
+                    };
+                    await store.put({ ...rec, content: new Uint8Array(body) });
+                    deps.metrics?.inc("attachment_uploads_total");
+                    sendJson(res, 201, { id: rec.id, name: rec.name, mime: rec.mime, sha256: rec.sha256, sizeBytes: rec.sizeBytes });
                     return;
                 }
-                const max = deps.config.attachmentMaxBytes ?? 32 * 1024 * 1024;
-                let body;
-                try {
-                    body = await readRawBody(req, max);
-                }
-                catch (err) {
-                    if (err instanceof HttpError && err.status === 413) {
-                        sendError(res, 413, "attachment.too_large", `attachment exceeds the per-file limit (${max} bytes)`, { maxBytes: max });
+                case "attachment-fetch": {
+                    if (attId === null) {
+                        sendError(res, 404, "not_found.route", "not found");
                         return;
                     }
-                    throw err;
-                }
-                const rec = {
-                    id: uuidv7(),
-                    owner,
-                    name,
-                    mime,
-                    sha256: createHash("sha256").update(body).digest("hex"),
-                    sizeBytes: body.length,
-                    createdAtMs: Date.now(),
-                };
-                await store.put({ ...rec, content: new Uint8Array(body) });
-                deps.metrics?.inc("attachment_uploads_total");
-                sendJson(res, 201, { id: rec.id, name: rec.name, mime: rec.mime, sha256: rec.sha256, sizeBytes: rec.sizeBytes });
-                return;
-            }
-            if (attId !== undefined && attId !== null && req.method === "GET") {
-                const meta = await store.get(owner, attId);
-                const bytes = meta ? await store.getContent(owner, attId) : null;
-                if (!meta || !bytes) {
-                    sendError(res, 404, "not_found.attachment", "not found");
+                    const meta = await store.get(owner, attId);
+                    const bytes = meta ? await store.getContent(owner, attId) : null;
+                    if (!meta || !bytes) {
+                        sendError(res, 404, "not_found.attachment", "not found");
+                        return;
+                    }
+                    res.writeHead(200, {
+                        "content-type": meta.mime,
+                        "content-length": String(bytes.byteLength),
+                        "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(meta.name)}`,
+                    });
+                    res.end(Buffer.from(bytes));
                     return;
                 }
-                res.writeHead(200, {
-                    "content-type": meta.mime,
-                    "content-length": String(bytes.byteLength),
-                    "content-disposition": `attachment; filename*=UTF-8''${encodeURIComponent(meta.name)}`,
-                });
-                res.end(Buffer.from(bytes));
-                return;
-            }
-            if (attId !== undefined && attId !== null && req.method === "DELETE") {
-                const ok = await store.delete(owner, attId);
-                if (!ok) {
-                    sendError(res, 404, "not_found.attachment", "not found");
+                case "attachment-delete": {
+                    if (attId === null) {
+                        sendError(res, 404, "not_found.route", "not found");
+                        return;
+                    }
+                    const ok = await store.delete(owner, attId);
+                    if (!ok) {
+                        sendError(res, 404, "not_found.attachment", "not found");
+                        return;
+                    }
+                    res.writeHead(204).end();
                     return;
                 }
-                res.writeHead(204).end();
-                return;
+                default:
+                    return assertNever(match.decl.id);
             }
-            sendError(res, 404, "not_found.route", "not found");
-            return;
         }
     }
-    miss.fell = true;
 }
+export const ATTACHMENTS_ROUTES = [
+    { id: "attachment-upload", path: "/v1/attachments", methods: ["POST"] },
+    { id: "attachment-fetch", pattern: /^\/v1\/attachments\/(?<id>[^/]+)$/, label: "/v1/attachments/:id", methods: ["GET"] },
+    { id: "attachment-delete", pattern: /^\/v1\/attachments\/(?<id>[^/]+)$/, label: "/v1/attachments/:id", methods: ["DELETE"] },
+];
 //# sourceMappingURL=attachments.js.map

package/dist/http/routes/capabilities.d.ts

@@ -6,6 +6,25 @@
  * 本域零可变状态;deps 面宽(能力布尔逐条对应各路由的 501 门,单源不许漂移)但全是存在性只读。
  */
 import type { IncomingMessage, ServerResponse } from "node:http";
-import type { RouteCtx } from "../route-ctx.js";
-export declare function handleCapabilities(req: IncomingMessage, res: ServerResponse, url: string, ctx: RouteCtx): Promise<boolean>;
+import type { RouteCtx, RouteMatch, RouteIdsOf } from "../route-ctx.js";
+/** 路由体 = 从 `server.ts` 的 `handle()` 里**整段剪切**过来的原文(唯一改动:统一去缩进两格)。裸 `return;`
+ *  的语义原样 =「本域已应答」;走到函数尾才是「没匹配上」,置 `miss.fell` 交回装配器继续下一个域。
+ *  跨域的东西(deps / 助手 / 单域状态 / 每请求量)一律在首行解构出来,于是下面每一行都逐字不变。 */
+export declare function handleCapabilities(req: IncomingMessage, res: ServerResponse, match: RouteMatch<CapabilitiesRouteId>, ctx: RouteCtx): Promise<void>;
+export declare const CAPABILITIES_ROUTES: readonly [{
+    readonly id: "models";
+    readonly path: "/v1/models";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "capabilities";
+    readonly path: "/v1/capabilities";
+    readonly methods: readonly ["GET"];
+}, {
+    readonly id: "capability-scenario";
+    readonly pattern: RegExp;
+    readonly label: "/v1/capabilities/scenarios/:name";
+    readonly methods: readonly ["GET"];
+}];
+/** 本域可分派行的 `id` 闭集 —— handler 的 `switch` 按它判穷尽(漏一口 = 编译红)。 */
+export type CapabilitiesRouteId = RouteIdsOf<typeof CAPABILITIES_ROUTES>;
 //# sourceMappingURL=capabilities.d.ts.map