@sentry/junior 0.147.0 → 0.149.0

package/dist/api.js

@@ -1,4 +1,5 @@
 import {
+  acceptedConversationMessageSchema,
   activityDays,
   actorDirectoryReportSchema,
   actorProfileReportSchema,
@@ -12,8 +13,11 @@ import {
   conversationFeedQuerySchema,
   conversationFeedSchema,
   conversationParamsSchema,
+  conversationPendingMessagesReportSchema,
   conversationReportEventSchema,
   conversationStatsReportSchema,
+  createConversationBodySchema,
+  createConversationMessageBodySchema,
   createPersonalTokenBodySchema,
   createdPersonalTokenSchema,
   locationDetailReportSchema,
@@ -29,15 +33,21 @@ import {
   taskListSchema,
   taskParamsSchema,
   taskRunListSchema
-} from "./chunk-SVHUEHUL.js";
+} from "./chunk-3JVUWLR7.js";
 import {
+  appendAndEnqueueApiConversationMessage,
+  createAndEnqueueApiConversation,
   formatSlackConversationRedactedLabel,
   readHealthReport,
-  resolveSlackConversationContextFromThreadId
-} from "./chunk-34GS7B6L.js";
+  resolveSlackConversationContextFromThreadId,
+  webActorFromEmail
+} from "./chunk-5CWUQXXT.js";
 import {
   buildSentryConversationUrl
 } from "./chunk-4CODA7P5.js";
+import {
+  getConversation
+} from "./chunk-JMSMXXED.js";
 import {
   readTaskExecutionByConversationId,
   readTaskExecutionDays,
@@ -45,7 +55,8 @@ import {
   readTaskExecutionSummaries,
   readTaskExecutions,
   readTaskRuns
-} from "./chunk-AVOCH2Z5.js";
+} from "./chunk-UZGASGOD.js";
+import "./chunk-4YKPOYRV.js";
 import {
   healthReportSchema,
   pluginOperationalReportFeedSchema,
@@ -53,6 +64,11 @@ import {
   runtimeInfoReportSchema,
   skillReportsSchema
 } from "./chunk-UTL3MHPC.js";
+import {
+  getVercelConversationWorkQueue
+} from "./chunk-WR76IVA5.js";
+import "./chunk-JAL3CH4G.js";
+import "./chunk-5I6ORJUY.js";
 import {
   createSchedulerSqlStore,
   deleteEventTask,
@@ -64,18 +80,17 @@ import {
   listPublicEventTasksForTeams,
   listPublicScheduledTasksForTeams,
   readStats
-} from "./chunk-EFLJ2WJH.js";
+} from "./chunk-URDCZAL4.js";
 import {
   parseSlackThreadId
-} from "./chunk-CSZINQJ2.js";
-import {
-  fallbackShortTitle
-} from "./chunk-Z4YU7Z4L.js";
+} from "./chunk-MEMURSBG.js";
 import {
   agentTurnUsageSchema,
+  fallbackShortTitle,
   hasAgentTurnUsage,
   renderJuniorNativeConversationEvent
-} from "./chunk-HLXXQI5Q.js";
+} from "./chunk-EW2LNCRL.js";
+import "./chunk-3Y47VMHV.js";
 import "./chunk-PDO5BLNM.js";
 import {
   createPluginLogger,
@@ -83,56 +98,73 @@ import {
   listConversationAnnotations,
   renderPluginConversationEvent,
   resolveViewerUser
-} from "./chunk-YHDERDRO.js";
+} from "./chunk-7BH46NB4.js";
 import {
   getSlackClient,
   withSlackRetries
-} from "./chunk-SGZO7UWH.js";
+} from "./chunk-SWHPVZBV.js";
 import {
   decodeStoredConversationEvent,
+  getConversationStore,
   getDb,
   getSqlExecutor,
   locationFromRow,
   parseSessionSource
-} from "./chunk-YSB2N563.js";
+} from "./chunk-3GYZ5YEH.js";
 import {
   juniorApiTokens,
   juniorConversationEvents,
   juniorConversations,
   juniorIdentities,
   juniorUsers
-} from "./chunk-DU74WPIC.js";
+} from "./chunk-3I2IVWSZ.js";
 import "./chunk-EM225ITJ.js";
-import "./chunk-ORO3PWKQ.js";
-import "./chunk-7NVJVJID.js";
+import "./chunk-25SC7D6Z.js";
+import "./chunk-32CXPIZE.js";
 import {
   juniorDestinations
 } from "./chunk-VFUK3X5B.js";
 import {
   canExposeConversationPayload
-} from "./chunk-RXBVB2JM.js";
+} from "./chunk-3KGQOKIG.js";
+import "./chunk-RUIXF3YQ.js";
 import "./chunk-HZF5P5UN.js";
 import {
   parseSlackChannelId,
   parseSlackMessageTs,
   parseSlackTeamId
 } from "./chunk-F3B2YJ76.js";
-import "./chunk-4LJO56OJ.js";
+import {
+  logException
+} from "./chunk-RLVZIWNQ.js";
 import "./chunk-6GWA276C.js";
-import "./chunk-DLDRQHG5.js";
-import "./chunk-IIOOO4FQ.js";
+import "./chunk-6G5RCDKP.js";
+import "./chunk-ZYMYLLWG.js";
 import "./chunk-MLKGABMK.js";
 
 // src/api.ts
 import { Hono as Hono7 } from "hono";
+import { HTTPException as HTTPException2 } from "hono/http-exception";
 
 // src/api/conversations/routes.ts
 import { Hono } from "hono";
 
 // src/api/http.ts
 import { HTTPException } from "hono/http-exception";
+var NO_STORE_HEADERS = { "cache-control": "no-store" };
+function noStoreInit(init) {
+  if (!init) return { headers: NO_STORE_HEADERS };
+  const headers = new Headers(init.headers);
+  if (!headers.has("cache-control")) {
+    headers.set("cache-control", "no-store");
+  }
+  return { ...init, headers };
+}
 function jsonResponse(schema, value, init) {
-  return Response.json(schema.parse(value), init);
+  return Response.json(schema.parse(value), noStoreInit(init));
+}
+function emptyResponse(status = 204) {
+  return new Response(null, noStoreInit({ status }));
 }
 function throwApiError(status, message2, cause) {
   throw new HTTPException(status, {
@@ -141,35 +173,25 @@ function throwApiError(status, message2, cause) {
     res: jsonResponse(apiErrorSchema, { error: message2 }, { status })
   });
 }
-function parseParams(schema, params) {
-  const result = schema.safeParse(params);
-  if (result.success) return result.data;
-  return throwApiError(400, "Invalid route parameters.", result.error);
-}
-function parseQuery(schema, query) {
-  const result = schema.safeParse(query);
-  if (result.success) return result.data;
-  return throwApiError(400, "Invalid query parameters.", result.error);
-}
-function parseBody(schema, body) {
-  const result = schema.safeParse(body);
-  if (result.success) return result.data;
-  return throwApiError(400, "Invalid request body.", result.error);
+
+// src/api/validation.ts
+import { zValidator } from "@hono/zod-validator";
+function validateRequest(target, schema, message2) {
+  return zValidator(target, schema, (result) => {
+    if (!result.success) throwApiError(400, message2, result.error);
+  });
 }
 
-// src/api/route.ts
-function defineApiRoute(route) {
-  return route;
-}
-function registerApiRoutes(app, routes5) {
-  for (const route of routes5) {
-    app.on(
-      route.method,
-      route.path,
-      async (context) => jsonResponse(route.responseSchema, await route.handler(context))
-    );
+// src/api/viewer.ts
+import { createMiddleware } from "hono/factory";
+var requireViewer = createMiddleware(
+  async (context, next) => {
+    if (!context.get("viewer")) {
+      throwApiError(401, "Authentication required.");
+    }
+    await next();
   }
-}
+);
 
 // src/api/conversations/archive.ts
 import { and, eq, isNotNull } from "drizzle-orm";
@@ -190,32 +212,134 @@ async function archiveIfUnchanged(args) {
   if (!args.archived && existing.archivedAt === null) return "updated";
   return "conflict";
 }
-var archive_default = defineApiRoute({
-  method: "patch",
-  path: "/:conversationId/archive",
-  responseSchema: archiveConversationResponseSchema,
-  handler: async (c) => {
-    const { conversationId } = parseParams(
-      conversationParamsSchema,
-      c.req.param()
+async function archiveConversation(conversationId, body) {
+  const result = await archiveIfUnchanged({ ...body, conversationId });
+  if (result === "not_found") {
+    throwApiError(404, "Conversation not found.");
+  }
+  if (result === "conflict") {
+    throwApiError(409, "Conversation received new activity.");
+  }
+  return { archived: body.archived };
+}
+
+// src/api/conversations/access.ts
+import { eq as eq2, inArray } from "drizzle-orm";
+import { alias } from "drizzle-orm/pg-core";
+var rootConversation = alias(juniorConversations, "access_root_conversation");
+var rootDestination = alias(juniorDestinations, "access_root_destination");
+var rootIdentity = alias(juniorIdentities, "access_root_identity");
+async function readConversationAccessFromSql(db, conversationIds, viewer) {
+  if (conversationIds.length === 0) return /* @__PURE__ */ new Map();
+  const normalizedViewerEmail = viewer?.email.trim().toLowerCase() || void 0;
+  const rows = await db.select({
+    conversationId: juniorConversations.conversationId,
+    parentConversationId: juniorConversations.parentConversationId,
+    storedRootConversationId: juniorConversations.rootConversationId,
+    rootConversationId: rootConversation.conversationId,
+    rootParentConversationId: rootConversation.parentConversationId,
+    rootRootConversationId: rootConversation.rootConversationId,
+    visibility: rootDestination.visibility,
+    rootEmailNormalized: rootIdentity.emailNormalized,
+    rootEmailVerified: rootIdentity.emailVerified,
+    rootUserId: rootIdentity.userId
+  }).from(juniorConversations).leftJoin(
+    rootConversation,
+    eq2(
+      rootConversation.conversationId,
+      juniorConversations.rootConversationId
+    )
+  ).leftJoin(
+    rootDestination,
+    eq2(rootDestination.id, rootConversation.destinationId)
+  ).leftJoin(
+    rootIdentity,
+    eq2(rootIdentity.id, rootConversation.actorIdentityId)
+  ).where(inArray(juniorConversations.conversationId, [...conversationIds]));
+  return new Map(
+    rows.map((row) => {
+      const hasValidRoot = row.rootConversationId !== null && row.rootConversationId === row.storedRootConversationId && row.rootRootConversationId === row.rootConversationId && row.rootParentConversationId === null && (row.parentConversationId !== null || row.storedRootConversationId === row.conversationId);
+      const validRootConversationId = hasValidRoot ? row.rootConversationId ?? void 0 : void 0;
+      const visibility = validRootConversationId === void 0 ? null : row.visibility;
+      const isParticipant = validRootConversationId !== void 0 && viewer !== void 0 && (row.rootUserId === viewer.id || normalizedViewerEmail !== void 0 && row.rootEmailVerified === true && row.rootEmailNormalized === normalizedViewerEmail);
+      const canViewPrivateContent = isParticipant || validRootConversationId !== void 0 && canExposeConversationPayload({
+        visibility: visibility ?? void 0
+      });
+      return [
+        row.conversationId,
+        {
+          canViewPrivateContent,
+          isParticipant,
+          visibility
+        }
+      ];
+    })
+  );
+}
+
+// src/api/conversations/create.ts
+function actorFromViewer(viewer) {
+  const normalized = viewer.email.trim().toLowerCase();
+  return webActorFromEmail(normalized, {
+    ...viewer.displayName ? { fullName: viewer.displayName } : {},
+    userName: normalized.split("@")[0] || normalized
+  });
+}
+async function createConversationForViewer(viewer, body) {
+  try {
+    return await createAndEnqueueApiConversation(
+      {
+        actor: actorFromViewer(viewer),
+        idempotencyKey: body.idempotencyKey,
+        message: body.message,
+        ...body.visibility ? { visibility: body.visibility } : {}
+      },
+      {
+        conversationStore: getConversationStore(),
+        queue: getVercelConversationWorkQueue()
+      }
     );
-    let input;
-    try {
-      input = await c.req.json();
-    } catch (error) {
-      throwApiError(400, "Invalid request body.", error);
-    }
-    const body = parseBody(archiveConversationBodySchema, input);
-    const result = await archiveIfUnchanged({ ...body, conversationId });
-    if (result === "not_found") {
-      throwApiError(404, "Conversation not found.");
-    }
-    if (result === "conflict") {
-      throwApiError(409, "Conversation received new activity.");
-    }
-    return { archived: body.archived };
+  } catch (error) {
+    throwApiError(500, "Unable to create conversation.", error);
   }
-});
+}
+async function appendConversationMessageForViewer(viewer, conversationId, body) {
+  const conversation = await getConversationStore().get({
+    conversationId
+  });
+  if (!conversation) {
+    throwApiError(404, "Conversation not found.");
+  }
+  const destinationPlatform = conversation.destination?.platform;
+  const acceptsApiMessages = destinationPlatform === "local" && conversationId.startsWith("local:web:") || destinationPlatform === "slack";
+  if (!acceptsApiMessages) {
+    throwApiError(409, "Conversation does not accept API messages.");
+  }
+  const access = await readConversationAccessFromSql(
+    getDb(),
+    [conversationId],
+    viewer
+  );
+  if (!access.get(conversationId)?.isParticipant) {
+    throwApiError(403, "Only conversation participants can add messages.");
+  }
+  try {
+    return await appendAndEnqueueApiConversationMessage(
+      {
+        actor: actorFromViewer(viewer),
+        conversationId,
+        idempotencyKey: body.idempotencyKey,
+        message: body.message
+      },
+      {
+        conversationStore: getConversationStore(),
+        queue: getVercelConversationWorkQueue()
+      }
+    );
+  } catch (error) {
+    throwApiError(500, "Unable to append message.", error);
+  }
+}
 
 // src/chat/slack/source-link.ts
 function parseSlackTeamDomain(value) {
@@ -332,7 +456,7 @@ async function resolveSlackTeamDomains(teamIds) {
 }
 
 // src/chat/pi/sql-model-usage.ts
-import { and as and2, eq as eq2, sql } from "drizzle-orm";
+import { and as and2, eq as eq3, sql } from "drizzle-orm";
 var message = sql`${juniorConversationEvents.payload}`;
 var usage = sql`${message}->'usage'`;
 var cost = sql`${usage}->'cost'`;
@@ -426,14 +550,14 @@ async function readConversationModelUsageFromSql(executor, options) {
     costTotal: summedCost(nonnegativeNumber(cost, "total"))
   }).from(juniorConversationEvents).innerJoin(
     juniorConversations,
-    eq2(
+    eq3(
       juniorConversations.conversationId,
       juniorConversationEvents.conversationId
     )
   ).where(
     and2(
-      options.includeDescendants ? eq2(juniorConversations.rootConversationId, options.conversationId) : eq2(juniorConversationEvents.conversationId, options.conversationId),
-      eq2(juniorConversationEvents.type, "assistant_message"),
+      options.includeDescendants ? eq3(juniorConversations.rootConversationId, options.conversationId) : eq3(juniorConversationEvents.conversationId, options.conversationId),
+      eq3(juniorConversationEvents.type, "assistant_message"),
       sql`jsonb_typeof(${message}->'provider') = 'string'`,
       sql`jsonb_typeof(${message}->'model') = 'string'`,
       sql`coalesce(${message}->>'provider', '') <> ''`,
@@ -498,9 +622,9 @@ import {
   and as and3,
   asc,
   desc,
-  eq as eq3,
+  eq as eq4,
   getTableColumns,
-  inArray,
+  inArray as inArray2,
   lt,
   sql as sql2
 } from "drizzle-orm";
@@ -705,6 +829,7 @@ function reportEventData(args) {
         type: "message",
         messageId: data.messageId,
         role: data.role,
+        ...data.meta?.source === "web" ? { source: "web" } : {},
         ...actorIdentity ? { actorIdentity } : {},
         ...typeof data.meta?.eventType === "string" ? { eventType: data.meta.eventType } : {},
         ...args.canExposePayload ? { text: data.text } : { redacted: true }
@@ -912,17 +1037,17 @@ async function readConversationEventRows(executor, args) {
       end`
   }).from(juniorConversationEvents).where(
     and3(
-      eq3(juniorConversationEvents.conversationId, args.conversationId),
+      eq4(juniorConversationEvents.conversationId, args.conversationId),
       args.beforeSeq === void 0 ? void 0 : lt(juniorConversationEvents.seq, args.beforeSeq),
-      inArray(
+      inArray2(
         juniorConversationEvents.type,
         args.types ?? [...conversationReportSourceEventTypes]
       ),
-      args.subagentInvocationIds === void 0 ? void 0 : inArray(
+      args.subagentInvocationIds === void 0 ? void 0 : inArray2(
         sql2`${juniorConversationEvents.payload}->>'subagentInvocationId'`,
         args.subagentInvocationIds
       ),
-      args.toolCallIds === void 0 ? void 0 : inArray(
+      args.toolCallIds === void 0 ? void 0 : inArray2(
         sql2`${juniorConversationEvents.payload}->>'toolCallId'`,
         args.toolCallIds
       )
@@ -1043,8 +1168,8 @@ function surfaceFromConversationId(conversationId) {
   return "internal";
 }
 function surfaceFromSource(source, conversationId) {
-  if (source === "slack" || source === "api" || source === "scheduler") {
-    return source;
+  if (source === "slack" || source === "api" || source === "web" || source === "scheduler") {
+    return source === "web" ? "api" : source;
   }
   return surfaceFromConversationId(conversationId);
 }
@@ -1165,6 +1290,7 @@ function conversationSummaryFromStoredConversation(args) {
       visibility
     }),
     isParticipant: args.access?.isParticipant ?? false,
+    ...visibility ? { visibility } : {},
     lastProgressAt: new Date(
       conversation.execution.updatedAtMs ?? conversation.updatedAtMs
     ).toISOString(),
@@ -1184,59 +1310,6 @@ function conversationSummaryFromStoredConversation(args) {
   };
 }
 
-// src/api/conversations/access.ts
-import { eq as eq4, inArray as inArray2 } from "drizzle-orm";
-import { alias } from "drizzle-orm/pg-core";
-var rootConversation = alias(juniorConversations, "access_root_conversation");
-var rootDestination = alias(juniorDestinations, "access_root_destination");
-var rootIdentity = alias(juniorIdentities, "access_root_identity");
-async function readConversationAccessFromSql(db, conversationIds, verifiedViewerEmail) {
-  if (conversationIds.length === 0) return /* @__PURE__ */ new Map();
-  const normalizedViewerEmail = verifiedViewerEmail?.trim().toLowerCase() || void 0;
-  const rows = await db.select({
-    conversationId: juniorConversations.conversationId,
-    parentConversationId: juniorConversations.parentConversationId,
-    storedRootConversationId: juniorConversations.rootConversationId,
-    rootConversationId: rootConversation.conversationId,
-    rootParentConversationId: rootConversation.parentConversationId,
-    rootRootConversationId: rootConversation.rootConversationId,
-    visibility: rootDestination.visibility,
-    rootEmailNormalized: rootIdentity.emailNormalized,
-    rootEmailVerified: rootIdentity.emailVerified
-  }).from(juniorConversations).leftJoin(
-    rootConversation,
-    eq4(
-      rootConversation.conversationId,
-      juniorConversations.rootConversationId
-    )
-  ).leftJoin(
-    rootDestination,
-    eq4(rootDestination.id, rootConversation.destinationId)
-  ).leftJoin(
-    rootIdentity,
-    eq4(rootIdentity.id, rootConversation.actorIdentityId)
-  ).where(inArray2(juniorConversations.conversationId, [...conversationIds]));
-  return new Map(
-    rows.map((row) => {
-      const hasValidRoot = row.rootConversationId !== null && row.rootConversationId === row.storedRootConversationId && row.rootRootConversationId === row.rootConversationId && row.rootParentConversationId === null && (row.parentConversationId !== null || row.storedRootConversationId === row.conversationId);
-      const validRootConversationId = hasValidRoot ? row.rootConversationId ?? void 0 : void 0;
-      const visibility = validRootConversationId === void 0 ? null : row.visibility;
-      const isParticipant = validRootConversationId !== void 0 && normalizedViewerEmail !== void 0 && row.rootEmailVerified === true && row.rootEmailNormalized === normalizedViewerEmail;
-      const canViewPrivateContent = isParticipant || validRootConversationId !== void 0 && canExposeConversationPayload({
-        visibility: visibility ?? void 0
-      });
-      return [
-        row.conversationId,
-        {
-          canViewPrivateContent,
-          isParticipant,
-          visibility
-        }
-      ];
-    })
-  );
-}
-
 // src/api/conversations/usage.ts
 import { and as and4, eq as eq5, inArray as inArray3, isNull, sql as sql3 } from "drizzle-orm";
 import { alias as alias2 } from "drizzle-orm/pg-core";
@@ -1565,11 +1638,7 @@ async function readConversationFeedFromSql(options = {}) {
     metricsByRoot,
     teamDomainByTeamId
   ] = await Promise.all([
-    readConversationAccessFromSql(
-      db,
-      conversationIds,
-      options.verifiedViewerEmail
-    ),
+    readConversationAccessFromSql(db, conversationIds, options.viewer),
     readConversationAuxiliaryCostsFromSql(db, conversationIds, {
       includeDescendants: true
     }),
@@ -1603,22 +1672,6 @@ async function readConversationFeed(options = {}) {
     await readConversationFeedFromSql(options)
   );
 }
-var list_default = defineApiRoute({
-  method: "get",
-  path: "/",
-  responseSchema: conversationFeedSchema,
-  handler: async (c) => {
-    const { actorEmail } = parseQuery(
-      conversationFeedQuerySchema,
-      c.req.query()
-    );
-    const verifiedViewerEmail = c.get("verifiedViewerEmail");
-    return readConversationFeed({
-      ...actorEmail ? { actorEmail } : {},
-      ...verifiedViewerEmail ? { verifiedViewerEmail } : {}
-    });
-  }
-});
 
 // src/chat/tasks/read.ts
 import { and as and7, eq as eq8, or as or2 } from "drizzle-orm";
@@ -2086,12 +2139,9 @@ async function readConversationSourceTask(args) {
     conversationId: args.conversationId
   });
   if (!execution) return void 0;
-  const email = args.verifiedViewerEmail?.trim();
-  if (!email) return { kind: execution.kind };
-  const user = await resolveViewerUser(email);
-  if (!user) return { kind: execution.kind };
+  if (!args.viewer) return { kind: execution.kind };
   const candidate = await resolveViewerTaskCandidate(
-    user,
+    args.viewer,
     execution.kind,
     execution.taskId
   );
@@ -2199,11 +2249,7 @@ async function readConversationDetailFromSql(conversationId, options) {
     sourceTask,
     teamDomainByTeamId
   ] = await Promise.all([
-    readConversationAccessFromSql(
-      getDb(),
-      [conversationId],
-      options.verifiedViewerEmail
-    ),
+    readConversationAccessFromSql(getDb(), [conversationId], options.viewer),
     listConversationAnnotations(getDb(), conversationId),
     readConversationAuxiliaryCostsFromSql(getDb(), [conversationId], {
       includeDescendants: includeDescendantMetrics
@@ -2218,7 +2264,7 @@ async function readConversationDetailFromSql(conversationId, options) {
     ),
     readConversationSourceTask({
       conversationId,
-      ...options.verifiedViewerEmail ? { verifiedViewerEmail: options.verifiedViewerEmail } : {}
+      ...options.viewer ? { viewer: options.viewer } : {}
     }),
     resolveSlackTeamDomains(
       record.conversation.sessionSource?.platform === "slack" ? [record.conversation.sessionSource.teamId] : []
@@ -2252,25 +2298,6 @@ async function readConversationDetail(conversationId, options = {}) {
   });
   return report ? conversationDetailReportSchema.parse(report) : void 0;
 }
-var detail_default = defineApiRoute({
-  method: "get",
-  path: "/:conversationId",
-  responseSchema: conversationDetailReportSchema,
-  handler: async (c) => {
-    const { conversationId } = parseParams(
-      conversationParamsSchema,
-      c.req.param()
-    );
-    const query = parseQuery(conversationDetailQuerySchema, c.req.query());
-    const verifiedViewerEmail = c.get("verifiedViewerEmail");
-    const report = await readConversationDetail(conversationId, {
-      ...query,
-      ...verifiedViewerEmail ? { verifiedViewerEmail } : {}
-    });
-    if (!report) throwApiError(404, "Conversation not found.");
-    return report;
-  }
-});
 
 // src/api/conversations/event-list.ts
 async function readConversationEvents(conversationId, beforeValue, options = {}) {
@@ -2284,7 +2311,7 @@ async function readConversationEvents(conversationId, beforeValue, options = {})
   const accessByConversation = await readConversationAccessFromSql(
     getDb(),
     [conversationId],
-    options.verifiedViewerEmail
+    options.viewer
   );
   const access = accessByConversation.get(conversationId);
   const canExposePayload = access?.canViewPrivateContent ?? false;
@@ -2310,28 +2337,119 @@ async function readConversationEvents(conversationId, beforeValue, options = {})
     generatedAt: (/* @__PURE__ */ new Date()).toISOString()
   });
 }
-var event_list_default = defineApiRoute({
-  method: "get",
-  path: "/:conversationId/events",
-  responseSchema: conversationEventPageSchema,
-  handler: async (c) => {
-    const { conversationId } = parseParams(
-      conversationParamsSchema,
-      c.req.param()
+
+// src/api/conversations/pending-messages.ts
+import { z as z4 } from "zod";
+var apiTurnMailboxMetadataSchema = z4.object({
+  authorEmail: z4.string().email(),
+  authorFullName: z4.string().min(1).optional(),
+  authorUserId: z4.string().min(1),
+  authorUserName: z4.string().min(1).optional(),
+  kind: z4.literal("api_turn"),
+  messageId: z4.string().min(1)
+}).strict();
+var slackMailboxAuthorSchema = z4.object({
+  userId: z4.string(),
+  userName: z4.string().optional(),
+  fullName: z4.string().optional(),
+  isMe: z4.boolean().optional()
+}).passthrough();
+var slackMailboxMessageSchema = z4.object({
+  author: slackMailboxAuthorSchema,
+  id: z4.string().min(1)
+}).passthrough();
+var slackMailboxMetadataSchema = z4.object({
+  message: slackMailboxMessageSchema,
+  platform: z4.literal("slack")
+}).passthrough();
+function isoFromMs(value) {
+  return new Date(value).toISOString();
+}
+function actorIdentityFromApiMetadata(metadata2) {
+  return {
+    email: metadata2.authorEmail.trim().toLowerCase(),
+    ...metadata2.authorFullName ? { fullName: metadata2.authorFullName } : {}
+  };
+}
+function actorIdentityFromSlackMetadata(metadata2) {
+  if (metadata2.message.author.isMe === true) return void 0;
+  const slackUserId = metadata2.message.author.userId.trim();
+  if (!slackUserId) return void 0;
+  const slackUserName = metadata2.message.author.userName?.trim();
+  const fullName = metadata2.message.author.fullName?.trim();
+  return {
+    slackUserId,
+    ...slackUserName ? { slackUserName } : {},
+    ...fullName ? { fullName } : {}
+  };
+}
+function projectPendingMessage(message2, canExposePayload) {
+  if (message2.source === "web") {
+    const metadata2 = apiTurnMailboxMetadataSchema.safeParse(
+      message2.input.metadata
     );
-    const { before, limit } = parseQuery(
-      conversationEventsQuerySchema,
-      c.req.query()
+    if (!metadata2.success) return void 0;
+    const text = message2.input.text.trim();
+    if (!text) return void 0;
+    return {
+      createdAt: isoFromMs(message2.createdAtMs),
+      delivery: message2.delivery,
+      inboundMessageId: message2.inboundMessageId,
+      messageId: metadata2.data.messageId,
+      receivedAt: isoFromMs(message2.receivedAtMs),
+      role: "user",
+      source: "web",
+      ...canExposePayload ? {
+        actorIdentity: actorIdentityFromApiMetadata(metadata2.data),
+        text
+      } : { redacted: true }
+    };
+  }
+  if (message2.source === "slack") {
+    const metadata2 = slackMailboxMetadataSchema.safeParse(
+      message2.input.metadata
     );
-    const verifiedViewerEmail = c.get("verifiedViewerEmail");
-    const report = await readConversationEvents(conversationId, before, {
-      limit,
-      ...verifiedViewerEmail ? { verifiedViewerEmail } : {}
-    });
-    if (!report) throwApiError(404, "Conversation not found.");
-    return report;
+    if (!metadata2.success) return void 0;
+    if (metadata2.data.message.author.isMe === true) return void 0;
+    const text = message2.input.text.trim();
+    if (!text) return void 0;
+    const actorIdentity = actorIdentityFromSlackMetadata(metadata2.data);
+    return {
+      createdAt: isoFromMs(message2.createdAtMs),
+      delivery: message2.delivery,
+      inboundMessageId: message2.inboundMessageId,
+      messageId: metadata2.data.message.id,
+      receivedAt: isoFromMs(message2.receivedAtMs),
+      role: "user",
+      source: "slack",
+      ...canExposePayload ? {
+        ...actorIdentity ? { actorIdentity } : {},
+        text
+      } : { redacted: true }
+    };
   }
-});
+  return void 0;
+}
+async function readConversationPendingMessages(conversationId, options = {}) {
+  const conversation = await getConversationStore().get({ conversationId });
+  if (!conversation) return void 0;
+  const access = (await readConversationAccessFromSql(getDb(), [conversationId], options.viewer)).get(conversationId);
+  const canExposePayload = access?.canViewPrivateContent ?? false;
+  const work = await getConversation({ conversationId });
+  const messages = (work?.execution.pendingMessages ?? []).map((message2) => projectPendingMessage(message2, canExposePayload)).filter(
+    (message2) => Boolean(message2)
+  );
+  return conversationPendingMessagesReportSchema.parse({
+    conversationId,
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    messages
+  });
+}
+async function requireConversationPendingMessages(conversationId, options = {}) {
+  const report = await readConversationPendingMessages(conversationId, options);
+  if (!report) throwApiError(404, "Conversation not found.");
+  return report;
+}
 
 // src/api/conversations/stats.query.ts
 import { and as and8, eq as eq9, gte, isNull as isNull4, lte, sql as sql6 } from "drizzle-orm";
@@ -2339,6 +2457,13 @@ import { alias as alias4 } from "drizzle-orm/pg-core";
 
 // src/api/conversations/aggregate.ts
 import { sql as sql5 } from "drizzle-orm";
+function usageTokenValue(source, field) {
+  return sql5`CASE
+    WHEN ${source.usage}->>${field} IS NOT NULL
+      THEN (${source.usage}->>${field})::double precision
+    ELSE NULL
+  END`;
+}
 function tokenValue(source) {
   return sql5`
     CASE
@@ -2386,11 +2511,13 @@ function conversationAggregateColumns(sources) {
       WHERE ${roots.executionStatus} NOT IN ('idle', 'failed')
     )::integer`,
     conversations: sql5`${conversationCount}::integer`,
+    cachedInputTokens: sql5`SUM(${usageTokenValue(metrics, "cachedInputTokens")})::double precision`,
     costUsd: sql5`SUM(${costValue(metrics)})::double precision`,
     durationMs: sql5`COALESCE(SUM(${metrics.durationMs}), 0)::double precision`,
     failed: sql5`${conversationCount} FILTER (
       WHERE ${roots.executionStatus} = 'failed'
     )::integer`,
+    inputTokens: sql5`SUM(${usageTokenValue(metrics, "inputTokens")})::double precision`,
     tokens: sql5`SUM(${tokenValue(metrics)})::double precision`
   };
 }
@@ -2432,7 +2559,7 @@ function actorLabel(row) {
 }
 function surfaceLabel(source) {
   if (source === "scheduler") return "Scheduler";
-  if (source === "api") return "API";
+  if (source === "api" || source === "web") return "Web";
   if (source === "internal" || source === "local") return "Internal";
   return "Conversation";
 }
@@ -2496,7 +2623,9 @@ function metricDays(rows, endMs) {
       conversations: row?.conversations ?? 0,
       date,
       durationMs: row?.durationMs ?? 0,
+      ...row?.cachedInputTokens !== null && row?.cachedInputTokens !== void 0 ? { cachedInputTokens: row.cachedInputTokens } : {},
       ...row?.costUsd !== null && row?.costUsd !== void 0 ? { costUsd: addUsd(void 0, row.costUsd) } : {},
+      ...row?.inputTokens !== null && row?.inputTokens !== void 0 ? { inputTokens: row.inputTokens } : {},
       ...row?.tokens !== null && row?.tokens !== void 0 ? { tokens: row.tokens } : {}
     });
   }
@@ -2607,10 +2736,12 @@ async function aggregateStats(db, start, end) {
       juniorDestinations.visibility
     ),
     db.select({
+      cachedInputTokens: treeAggregateColumns.cachedInputTokens,
       conversations: treeAggregateColumns.conversations,
       costUsd: treeAggregateColumns.costUsd,
       date: activityDate,
       durationMs: treeAggregateColumns.durationMs,
+      inputTokens: treeAggregateColumns.inputTokens,
       tokens: treeAggregateColumns.tokens
     }).from(juniorConversations).innerJoin(
       treeConversation,
@@ -2666,6 +2797,7 @@ async function readConversationStatsFromSql() {
   }
   return {
     active: totals?.active ?? 0,
+    ...totals?.cachedInputTokens !== null && totals?.cachedInputTokens !== void 0 ? { cachedInputTokens: totals.cachedInputTokens } : {},
     conversations: totals?.conversations ?? 0,
     durationMs: totals?.durationMs ?? 0,
     failed: totals?.failed ?? 0,
@@ -2676,6 +2808,7 @@ async function readConversationStatsFromSql() {
     actors: statsItems(actors),
     source: "conversation_index",
     ...totals?.costUsd !== null && totals?.costUsd !== void 0 ? { costUsd: addUsd(void 0, totals.costUsd) } : {},
+    ...totals?.inputTokens !== null && totals?.inputTokens !== void 0 ? { inputTokens: totals.inputTokens } : {},
     ...totals?.tokens !== null && totals?.tokens !== void 0 ? { tokens: totals.tokens } : {},
     windowEnd: end.toISOString(),
     windowStart: start.toISOString()
@@ -2688,93 +2821,162 @@ async function readConversationStats() {
     await readConversationStatsFromSql()
   );
 }
-var stats_default = defineApiRoute({
-  method: "get",
-  path: "/stats",
-  responseSchema: conversationStatsReportSchema,
-  handler: readConversationStats
-});
 
 // src/api/conversations/routes.ts
-var routes = [
-  list_default,
-  stats_default,
-  archive_default,
-  event_list_default,
-  detail_default
-];
 function createConversationRoutes() {
   const app = new Hono();
-  registerApiRoutes(app, routes);
-  return app;
-}
-
-// src/reporting.ts
-import { readFileSync } from "fs";
-import path from "path";
-function readDescriptionText(home) {
-  try {
-    const raw = readFileSync(path.join(home, "DESCRIPTION.md"), "utf8").trim();
-    return raw || void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function readSkillReports() {
-  const { discoverSkills } = await import("./skills-AKE6W3WI.js");
-  const skills = await discoverSkills();
-  return skillReportsSchema.parse(
-    skills.map((skill) => ({
-      name: skill.name,
-      pluginProvider: skill.pluginProvider
-    }))
+  app.get(
+    "/",
+    validateRequest(
+      "query",
+      conversationFeedQuerySchema,
+      "Invalid query parameters."
+    ),
+    async (context) => {
+      const { actorEmail } = context.req.valid("query");
+      const viewer = context.get("viewer");
+      return jsonResponse(
+        conversationFeedSchema,
+        await readConversationFeed({
+          ...actorEmail ? { actorEmail } : {},
+          ...viewer ? { viewer } : {}
+        })
+      );
+    }
   );
-}
-async function readPlugins() {
-  const { pluginCatalogRuntime } = await import("./catalog-runtime-M6ZTPYRV.js");
-  return pluginsSchema.parse(
-    pluginCatalogRuntime.getProviders().map((plugin) => ({
-      configKeys: plugin.manifest.configKeys ?? [],
-      description: plugin.manifest.description,
-      displayName: plugin.manifest.displayName,
-      name: plugin.manifest.name
-    }))
+  app.get(
+    "/stats",
+    async () => jsonResponse(conversationStatsReportSchema, await readConversationStats())
   );
+  app.post(
+    "/",
+    requireViewer,
+    validateRequest(
+      "json",
+      createConversationBodySchema,
+      "Invalid request body."
+    ),
+    async (context) => {
+      const viewer = context.get("viewer");
+      const body = context.req.valid("json");
+      return jsonResponse(
+        acceptedConversationMessageSchema,
+        await createConversationForViewer(viewer, body)
+      );
+    }
+  );
+  app.post(
+    "/:conversationId/messages",
+    requireViewer,
+    validateRequest(
+      "param",
+      conversationParamsSchema,
+      "Invalid route parameters."
+    ),
+    validateRequest(
+      "json",
+      createConversationMessageBodySchema,
+      "Invalid request body."
+    ),
+    async (context) => {
+      const viewer = context.get("viewer");
+      const { conversationId } = context.req.valid("param");
+      const body = context.req.valid("json");
+      return jsonResponse(
+        acceptedConversationMessageSchema,
+        await appendConversationMessageForViewer(viewer, conversationId, body)
+      );
+    }
+  );
+  app.patch(
+    "/:conversationId/archive",
+    validateRequest(
+      "param",
+      conversationParamsSchema,
+      "Invalid route parameters."
+    ),
+    validateRequest(
+      "json",
+      archiveConversationBodySchema,
+      "Invalid request body."
+    ),
+    async (context) => {
+      const { conversationId } = context.req.valid("param");
+      const body = context.req.valid("json");
+      return jsonResponse(
+        archiveConversationResponseSchema,
+        await archiveConversation(conversationId, body)
+      );
+    }
+  );
+  app.get(
+    "/:conversationId/events",
+    validateRequest(
+      "param",
+      conversationParamsSchema,
+      "Invalid route parameters."
+    ),
+    validateRequest(
+      "query",
+      conversationEventsQuerySchema,
+      "Invalid query parameters."
+    ),
+    async (context) => {
+      const { conversationId } = context.req.valid("param");
+      const { before, limit } = context.req.valid("query");
+      const viewer = context.get("viewer");
+      const report = await readConversationEvents(conversationId, before, {
+        limit,
+        ...viewer ? { viewer } : {}
+      });
+      if (!report) throwApiError(404, "Conversation not found.");
+      return jsonResponse(conversationEventPageSchema, report);
+    }
+  );
+  app.get(
+    "/:conversationId/pending-messages",
+    validateRequest(
+      "param",
+      conversationParamsSchema,
+      "Invalid route parameters."
+    ),
+    async (context) => {
+      const { conversationId } = context.req.valid("param");
+      const viewer = context.get("viewer");
+      return jsonResponse(
+        conversationPendingMessagesReportSchema,
+        await requireConversationPendingMessages(conversationId, {
+          viewer
+        })
+      );
+    }
+  );
+  app.get(
+    "/:conversationId",
+    validateRequest(
+      "param",
+      conversationParamsSchema,
+      "Invalid route parameters."
+    ),
+    validateRequest(
+      "query",
+      conversationDetailQuerySchema,
+      "Invalid query parameters."
+    ),
+    async (context) => {
+      const { conversationId } = context.req.valid("param");
+      const query = context.req.valid("query");
+      const viewer = context.get("viewer");
+      const report = await readConversationDetail(conversationId, {
+        ...query,
+        ...viewer ? { viewer } : {}
+      });
+      if (!report) throwApiError(404, "Conversation not found.");
+      return jsonResponse(conversationDetailReportSchema, report);
+    }
+  );
+  return app;
 }
-async function readRuntimeInfoReport() {
-  const [{ homeDir }, { pluginCatalogRuntime }, plugins, skills] = await Promise.all([
-    import("./discovery-GUFTFBTL.js"),
-    import("./catalog-runtime-M6ZTPYRV.js"),
-    readPlugins(),
-    readSkillReports()
-  ]);
-  const home = homeDir();
-  return runtimeInfoReportSchema.parse({
-    cwd: process.cwd(),
-    homeDir: home,
-    descriptionText: readDescriptionText(home),
-    providers: plugins.map((plugin) => plugin.name),
-    skills,
-    packagedContent: pluginCatalogRuntime.getPackageContent()
-  });
-}
-async function readPluginOperationalReportFeed() {
-  const nowMs = Date.now();
-  const { getPluginOperationalReports } = await import("./agent-hooks-HS6VGUPM.js");
-  return pluginOperationalReportFeedSchema.parse({
-    source: "plugins",
-    generatedAt: new Date(nowMs).toISOString(),
-    reports: await getPluginOperationalReports(nowMs)
-  });
-}
-
-// src/api/health.ts
-var health_default = defineApiRoute({
-  method: "get",
-  path: "/api/health",
-  responseSchema: healthReportSchema,
-  handler: readHealthReport
-});
 
 // src/api/locations/routes.ts
 import { Hono as Hono2 } from "hono";
@@ -3175,7 +3377,7 @@ async function readLocationDetailFromSql(locationId, options = {}) {
     readConversationAccessFromSql(
       getDb(),
       recentConversationIds,
-      options.verifiedViewerEmail
+      options.viewer
     ),
     readRootConversationMetricsFromSql(getDb(), recentConversationIds)
   ]);
@@ -3203,21 +3405,6 @@ async function readLocationDetail(locationId, options = {}) {
   const report = await readLocationDetailFromSql(locationId, options);
   return report ? locationDetailReportSchema.parse(report) : void 0;
 }
-var detail_default2 = defineApiRoute({
-  method: "get",
-  path: "/:locationId",
-  responseSchema: locationDetailReportSchema,
-  handler: async (c) => {
-    const { locationId } = parseParams(locationParamsSchema, c.req.param());
-    const verifiedViewerEmail = c.get("verifiedViewerEmail");
-    const report = await readLocationDetail(
-      locationId,
-      verifiedViewerEmail ? { verifiedViewerEmail } : {}
-    );
-    if (!report) throwApiError(404, "Location not found.");
-    return report;
-  }
-});
 
 // src/api/locations/list.ts
 async function readLocationDirectory() {
@@ -3225,18 +3412,32 @@ async function readLocationDirectory() {
     await readLocationDirectoryFromSql()
   );
 }
-var list_default2 = defineApiRoute({
-  method: "get",
-  path: "/",
-  responseSchema: locationDirectoryReportSchema,
-  handler: readLocationDirectory
-});
 
 // src/api/locations/routes.ts
-var routes2 = [list_default2, detail_default2];
 function createLocationRoutes() {
   const app = new Hono2();
-  registerApiRoutes(app, routes2);
+  app.get(
+    "/",
+    async () => jsonResponse(locationDirectoryReportSchema, await readLocationDirectory())
+  );
+  app.get(
+    "/:locationId",
+    validateRequest(
+      "param",
+      locationParamsSchema,
+      "Invalid route parameters."
+    ),
+    async (context) => {
+      const { locationId } = context.req.valid("param");
+      const viewer = context.get("viewer");
+      const report = await readLocationDetail(
+        locationId,
+        viewer ? { viewer } : {}
+      );
+      if (!report) throwApiError(404, "Location not found.");
+      return jsonResponse(locationDetailReportSchema, report);
+    }
+  );
   return app;
 }
 
@@ -3474,12 +3675,6 @@ async function readPeopleListFromSql() {
 async function readPeopleList() {
   return actorDirectoryReportSchema.parse(await readPeopleListFromSql());
 }
-var list_default3 = defineApiRoute({
-  method: "get",
-  path: "/",
-  responseSchema: actorDirectoryReportSchema,
-  handler: readPeopleList
-});
 
 // src/api/people/profile.query.ts
 import { and as and12, eq as eq13, gte as gte4, sql as sql10 } from "drizzle-orm";
@@ -3631,7 +3826,7 @@ async function readPeopleProfileFromSql(email, options = {}) {
     readConversationAccessFromSql(
       getDb(),
       recentConversationIds,
-      options.verifiedViewerEmail
+      options.viewer
     ),
     readRootConversationMetricsFromSql(getDb(), recentConversationIds)
   ]);
@@ -3667,19 +3862,6 @@ async function readPeopleProfile(email, options = {}) {
     await readPeopleProfileFromSql(email, options)
   );
 }
-var profile_default = defineApiRoute({
-  method: "get",
-  path: "/:email",
-  responseSchema: actorProfileReportSchema,
-  handler: async (c) => {
-    const { email } = parseParams(personParamsSchema, c.req.param());
-    const verifiedViewerEmail = c.get("verifiedViewerEmail");
-    return readPeopleProfile(
-      email,
-      verifiedViewerEmail ? { verifiedViewerEmail } : {}
-    );
-  }
-});
 
 // src/api/people/spend.query.ts
 import { and as and13, eq as eq14, gte as gte5, lte as lte2, sql as sql11 } from "drizzle-orm";
@@ -3741,9 +3923,9 @@ async function readPersonalSpendFromSql(email, nowMs = Date.now()) {
 
 // src/api/people/spend.ts
 var PERSONAL_SPEND_CACHE_TTL_MS = 5 * 6e4;
-function createPersonalSpendRoute() {
+function createPersonalSpendReader() {
   const cache = /* @__PURE__ */ new Map();
-  async function read(email) {
+  return async function readPersonalSpend(email) {
     const normalizedEmail = email.trim().toLowerCase();
     const nowMs = Date.now();
     const cached = cache.get(normalizedEmail);
@@ -3763,39 +3945,39 @@ function createPersonalSpendRoute() {
       if (cache.get(normalizedEmail) === entry) cache.delete(normalizedEmail);
       throw error;
     }
-  }
-  return defineApiRoute({
-    method: "get",
-    path: "/me/spend",
-    responseSchema: personalSpendReportSchema,
-    handler: async (context) => {
-      const email = context.get("verifiedViewerEmail");
-      if (!email) throwApiError(403, "Verified viewer email required.");
-      return read(email);
-    }
-  });
+  };
 }
 
 // src/api/people/routes.ts
 function createPeopleRoutes() {
   const app = new Hono3();
-  const routes5 = [
-    createPersonalSpendRoute(),
-    list_default3,
-    profile_default
-  ];
-  registerApiRoutes(app, routes5);
+  const readPersonalSpend = createPersonalSpendReader();
+  app.get("/me/spend", requireViewer, async (context) => {
+    const viewer = context.get("viewer");
+    return jsonResponse(
+      personalSpendReportSchema,
+      await readPersonalSpend(viewer.email)
+    );
+  });
+  app.get(
+    "/",
+    async () => jsonResponse(actorDirectoryReportSchema, await readPeopleList())
+  );
+  app.get(
+    "/:email",
+    validateRequest("param", personParamsSchema, "Invalid route parameters."),
+    async (context) => {
+      const { email } = context.req.valid("param");
+      const viewer = context.get("viewer");
+      return jsonResponse(
+        actorProfileReportSchema,
+        await readPeopleProfile(email, viewer ? { viewer } : {})
+      );
+    }
+  );
   return app;
 }
 
-// src/api/plugin-reports.ts
-var plugin_reports_default = defineApiRoute({
-  method: "get",
-  path: "/api/plugin-reports",
-  responseSchema: pluginOperationalReportFeedSchema,
-  handler: readPluginOperationalReportFeed
-});
-
 // src/api/personal-tokens/routes.ts
 import { Hono as Hono4 } from "hono";
 
@@ -3874,63 +4056,57 @@ async function authenticatePersonalToken(token2, now = /* @__PURE__ */ new Date(
   return match.ownerEmailNormalized;
 }
 
-// src/api/personal-tokens/create.ts
-var create_default = defineApiRoute({
-  method: "post",
-  path: "/",
-  responseSchema: createdPersonalTokenSchema,
-  handler: async (c) => {
-    const email = c.get("verifiedViewerEmail");
-    if (!email) throwApiError(403, "Verified viewer email required.");
-    let input;
-    try {
-      input = await c.req.json();
-    } catch (error) {
-      throwApiError(400, "Invalid request body.", error);
-    }
-    const body = parseBody(createPersonalTokenBodySchema, input);
-    return createPersonalToken({ email, name: body.name });
-  }
-});
-
-// src/api/personal-tokens/list.ts
-var list_default4 = defineApiRoute({
-  method: "get",
-  path: "/",
-  responseSchema: personalTokenListSchema,
-  handler: async (c) => {
-    const email = c.get("verifiedViewerEmail");
-    if (!email) throwApiError(403, "Verified viewer email required.");
-    return { tokens: await listPersonalTokens(email) };
-  }
-});
-
-// src/api/personal-tokens/revoke.ts
-var revoke_default = defineApiRoute({
-  method: "delete",
-  path: "/:id",
-  responseSchema: revokePersonalTokenResponseSchema,
-  handler: async (c) => {
-    const email = c.get("verifiedViewerEmail");
-    if (!email) throwApiError(403, "Verified viewer email required.");
-    const { id } = parseParams(personalTokenParamsSchema, c.req.param());
-    if (!await revokePersonalToken({ email, id })) {
-      throwApiError(404, "Personal API token not found.");
-    }
-    return { revoked: true };
-  }
-});
-
 // src/api/personal-tokens/routes.ts
-var routes3 = [list_default4, create_default, revoke_default];
 function createPersonalTokenRoutes() {
   const app = new Hono4();
-  registerApiRoutes(app, routes3);
+  app.get("/", requireViewer, async (context) => {
+    const viewer = context.get("viewer");
+    return jsonResponse(personalTokenListSchema, {
+      tokens: await listPersonalTokens(viewer.email)
+    });
+  });
+  app.post(
+    "/",
+    requireViewer,
+    validateRequest(
+      "json",
+      createPersonalTokenBodySchema,
+      "Invalid request body."
+    ),
+    async (context) => {
+      const viewer = context.get("viewer");
+      const body = context.req.valid("json");
+      return jsonResponse(
+        createdPersonalTokenSchema,
+        await createPersonalToken({ email: viewer.email, name: body.name })
+      );
+    }
+  );
+  app.delete(
+    "/:id",
+    requireViewer,
+    validateRequest(
+      "param",
+      personalTokenParamsSchema,
+      "Invalid route parameters."
+    ),
+    async (context) => {
+      const viewer = context.get("viewer");
+      const { id } = context.req.valid("param");
+      if (!await revokePersonalToken({ email: viewer.email, id })) {
+        throwApiError(404, "Personal API token not found.");
+      }
+      return jsonResponse(revokePersonalTokenResponseSchema, {
+        revoked: true
+      });
+    }
+  );
   return app;
 }
 
 // src/api/user-pages/routes.ts
 import { Hono as Hono5 } from "hono";
+import { z as z5 } from "zod";
 import {
   pluginUserPageContentSchema as pluginUserPageContentSchema2,
   pluginUserPageInputSchema,
@@ -3968,8 +4144,8 @@ async function readPluginUserPage(input) {
     (candidate) => candidate.id === input.pageId
   );
   if (!plugin || !page) return void 0;
-  const viewer2 = await resolveViewerUser(input.email);
-  if (!viewer2) {
+  const viewer = await resolveViewerUser(input.email);
+  if (!viewer) {
     throw new Error("Authenticated viewer user could not be resolved");
   }
   const content = pluginUserPageContentSchema.parse(
@@ -3978,7 +4154,7 @@ async function readPluginUserPage(input) {
         db: getDb(),
         log: createPluginLogger(plugin.manifest.name),
         plugin: { name: plugin.manifest.name },
-        viewer: viewer2
+        viewer
       },
       input.query
     )
@@ -3996,167 +4172,114 @@ async function readPluginUserPage(input) {
 }
 
 // src/api/user-pages/routes.ts
+var userPageQuerySchema = z5.object({
+  cursor: z5.preprocess(
+    (value) => value || void 0,
+    pluginUserPageInputSchema.shape.cursor
+  ),
+  filter: z5.preprocess(
+    (value) => value || void 0,
+    pluginUserPageInputSchema.shape.filter
+  ),
+  limit: z5.preprocess(
+    (value) => value === "" ? void 0 : value,
+    z5.coerce.number().int().min(1).max(50).default(20)
+  ),
+  q: z5.preprocess(
+    (value) => value || void 0,
+    pluginUserPageInputSchema.shape.query
+  )
+});
 function createUserPageRoutes() {
   const app = new Hono5();
   app.get(
     "/",
     () => jsonResponse(pluginUserPageLinksSchema2, readPluginUserPageLinks())
   );
-  app.get("/:pluginName/:pageId", async (context) => {
-    const email = context.get("verifiedViewerEmail")?.trim();
-    if (!email) {
-      return jsonResponse(
-        apiErrorSchema,
-        { error: "Authentication required." },
-        { status: 401 }
-      );
-    }
-    const pageInput = pluginUserPageInputSchema.safeParse({
-      cursor: context.req.query("cursor") || void 0,
-      filter: context.req.query("filter") || void 0,
-      limit: context.req.query("limit") ? Number(context.req.query("limit")) : 20,
-      query: context.req.query("q") || void 0
-    });
-    if (!pageInput.success) {
-      return jsonResponse(
+  app.get(
+    "/:pluginName/:pageId",
+    requireViewer,
+    validateRequest("query", userPageQuerySchema, "Invalid user page query."),
+    async (context) => {
+      const viewer = context.get("viewer");
+      const { q, ...query } = context.req.valid("query");
+      const page = await readPluginUserPage({
+        email: viewer.email,
+        pageId: context.req.param("pageId"),
+        pluginName: context.req.param("pluginName"),
+        query: { ...query, ...q === void 0 ? {} : { query: q } }
+      });
+      return page ? jsonResponse(pluginUserPageContentSchema2, page) : jsonResponse(
         apiErrorSchema,
-        { error: "Invalid user page query." },
-        { status: 400 }
+        { error: "User page not found." },
+        { status: 404 }
       );
     }
-    const page = await readPluginUserPage({
-      email,
-      pageId: context.req.param("pageId"),
-      pluginName: context.req.param("pluginName"),
-      query: pageInput.data
-    });
-    return page ? jsonResponse(pluginUserPageContentSchema2, page) : jsonResponse(
-      apiErrorSchema,
-      { error: "User page not found." },
-      { status: 404 }
-    );
-  });
+  );
   return app;
 }
 
 // src/api/tasks/routes.ts
 import { Hono as Hono6 } from "hono";
-async function viewer(context) {
-  const email = context.get("verifiedViewerEmail")?.trim();
-  return email ? await resolveViewerUser(email) : void 0;
-}
 function createTaskRoutes() {
   const app = new Hono6();
-  app.get("/", async (context) => {
-    const user = await viewer(context);
-    return user ? jsonResponse(taskListSchema, await readViewerTasks(user)) : jsonResponse(
-      apiErrorSchema,
-      { error: "Authentication required." },
-      { status: 401 }
-    );
+  app.get("/", requireViewer, async (context) => {
+    const user = context.get("viewer");
+    return jsonResponse(taskListSchema, await readViewerTasks(user));
   });
-  app.get("/runs", async (context) => {
-    const user = await viewer(context);
-    return user ? jsonResponse(taskRunListSchema, await readViewerTaskRuns(user)) : jsonResponse(
-      apiErrorSchema,
-      { error: "Authentication required." },
-      { status: 401 }
-    );
+  app.get("/runs", requireViewer, async (context) => {
+    const user = context.get("viewer");
+    return jsonResponse(taskRunListSchema, await readViewerTaskRuns(user));
   });
-  app.get("/:kind/:id/executions", async (context) => {
-    const user = await viewer(context);
-    if (!user) {
-      return jsonResponse(
-        apiErrorSchema,
-        { error: "Authentication required." },
-        { status: 401 }
-      );
-    }
-    const params = taskParamsSchema.safeParse(context.req.param());
-    if (!params.success) {
-      return jsonResponse(
-        apiErrorSchema,
-        { error: "Invalid task." },
-        { status: 400 }
-      );
-    }
-    try {
-      return jsonResponse(
-        taskExecutionListSchema,
-        await readViewerTaskExecutions(user, params.data.kind, params.data.id)
-      );
-    } catch (error) {
-      if (error instanceof ViewerTaskNotFoundError) {
+  app.get(
+    "/:kind/:id/executions",
+    requireViewer,
+    validateRequest("param", taskParamsSchema, "Invalid task."),
+    async (context) => {
+      const user = context.get("viewer");
+      const params = context.req.valid("param");
+      try {
         return jsonResponse(
-          apiErrorSchema,
-          { error: error.message },
-          { status: 404 }
+          taskExecutionListSchema,
+          await readViewerTaskExecutions(user, params.kind, params.id)
         );
+      } catch (error) {
+        if (error instanceof ViewerTaskNotFoundError) {
+          return jsonResponse(
+            apiErrorSchema,
+            { error: error.message },
+            { status: 404 }
+          );
+        }
+        throw error;
       }
-      throw error;
     }
-  });
-  app.delete("/:kind/:id", async (context) => {
-    const user = await viewer(context);
-    if (!user) {
-      return jsonResponse(
-        apiErrorSchema,
-        { error: "Authentication required." },
-        { status: 401 }
-      );
-    }
-    const params = taskParamsSchema.safeParse(context.req.param());
-    if (!params.success) {
-      return jsonResponse(
-        apiErrorSchema,
-        { error: "Invalid task." },
-        { status: 400 }
-      );
-    }
-    try {
-      await deleteViewerTask(user, params.data.kind, params.data.id);
-      return new Response(null, {
-        headers: { "cache-control": "no-store" },
-        status: 204
-      });
-    } catch (error) {
-      if (error instanceof ViewerTaskNotFoundError) {
-        return jsonResponse(
-          apiErrorSchema,
-          { error: error.message },
-          { status: 404 }
-        );
+  );
+  app.delete(
+    "/:kind/:id",
+    requireViewer,
+    validateRequest("param", taskParamsSchema, "Invalid task."),
+    async (context) => {
+      const user = context.get("viewer");
+      const params = context.req.valid("param");
+      try {
+        await deleteViewerTask(user, params.kind, params.id);
+        return emptyResponse();
+      } catch (error) {
+        if (error instanceof ViewerTaskNotFoundError) {
+          return jsonResponse(
+            apiErrorSchema,
+            { error: error.message },
+            { status: 404 }
+          );
+        }
+        throw error;
       }
-      throw error;
     }
-  });
+  );
   return app;
 }
 
-// src/api/plugins.ts
-var plugins_default = defineApiRoute({
-  method: "get",
-  path: "/api/plugins",
-  responseSchema: pluginsSchema,
-  handler: readPlugins
-});
-
-// src/api/runtime.ts
-var runtime_default = defineApiRoute({
-  method: "get",
-  path: "/api/runtime",
-  responseSchema: runtimeInfoReportSchema,
-  handler: readRuntimeInfoReport
-});
-
-// src/api/skills.ts
-var skills_default = defineApiRoute({
-  method: "get",
-  path: "/api/skills",
-  responseSchema: skillReportsSchema,
-  handler: readSkillReports
-});
-
 // src/api/stats.ts
 var WINDOW_DAYS2 = 90;
 async function readStatsReport() {
@@ -4173,25 +4296,96 @@ async function readStatsReport() {
     windowStart: start
   });
 }
-var stats_default2 = defineApiRoute({
-  method: "get",
-  path: "/api/stats",
-  responseSchema: statsReportSchema,
-  handler: readStatsReport
-});
+
+// src/reporting.ts
+import { readFileSync } from "fs";
+import path from "path";
+function readDescriptionText(home) {
+  try {
+    const raw = readFileSync(path.join(home, "DESCRIPTION.md"), "utf8").trim();
+    return raw || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readSkillReports() {
+  const { discoverSkills } = await import("./skills-AU5ST2CG.js");
+  const skills = await discoverSkills();
+  return skillReportsSchema.parse(
+    skills.map((skill) => ({
+      name: skill.name,
+      pluginProvider: skill.pluginProvider
+    }))
+  );
+}
+async function readPlugins() {
+  const { pluginCatalogRuntime } = await import("./catalog-runtime-GAW5APVI.js");
+  return pluginsSchema.parse(
+    pluginCatalogRuntime.getProviders().map((plugin) => ({
+      configKeys: plugin.manifest.configKeys ?? [],
+      description: plugin.manifest.description,
+      displayName: plugin.manifest.displayName,
+      name: plugin.manifest.name
+    }))
+  );
+}
+async function readRuntimeInfoReport() {
+  const [{ homeDir }, { pluginCatalogRuntime }, plugins, skills] = await Promise.all([
+    import("./discovery-GUFTFBTL.js"),
+    import("./catalog-runtime-GAW5APVI.js"),
+    readPlugins(),
+    readSkillReports()
+  ]);
+  const home = homeDir();
+  return runtimeInfoReportSchema.parse({
+    cwd: process.cwd(),
+    homeDir: home,
+    descriptionText: readDescriptionText(home),
+    providers: plugins.map((plugin) => plugin.name),
+    skills,
+    packagedContent: pluginCatalogRuntime.getPackageContent()
+  });
+}
+async function readPluginOperationalReportFeed() {
+  const nowMs = Date.now();
+  const { getPluginOperationalReports } = await import("./agent-hooks-CWMCXAMT.js");
+  return pluginOperationalReportFeedSchema.parse({
+    source: "plugins",
+    generatedAt: new Date(nowMs).toISOString(),
+    reports: await getPluginOperationalReports(nowMs)
+  });
+}
 
 // src/api.ts
-var routes4 = [
-  health_default,
-  runtime_default,
-  plugins_default,
-  skills_default,
-  plugin_reports_default,
-  stats_default2
-];
 function createJuniorApi() {
   const app = new Hono7();
-  registerApiRoutes(app, routes4);
+  app.get(
+    "/api/health",
+    async () => jsonResponse(healthReportSchema, readHealthReport())
+  );
+  app.get(
+    "/api/runtime",
+    async () => jsonResponse(runtimeInfoReportSchema, await readRuntimeInfoReport())
+  );
+  app.get(
+    "/api/plugins",
+    async () => jsonResponse(pluginsSchema, await readPlugins())
+  );
+  app.get(
+    "/api/skills",
+    async () => jsonResponse(skillReportsSchema, await readSkillReports())
+  );
+  app.get(
+    "/api/plugin-reports",
+    async () => jsonResponse(
+      pluginOperationalReportFeedSchema,
+      await readPluginOperationalReportFeed()
+    )
+  );
+  app.get(
+    "/api/stats",
+    async () => jsonResponse(statsReportSchema, await readStatsReport())
+  );
   app.route("/api/conversations", createConversationRoutes());
   app.route("/api/personal-tokens", createPersonalTokenRoutes());
   app.route("/api/people", createPeopleRoutes());
@@ -4207,10 +4401,27 @@ function createJuniorApi() {
       }
     )
   );
+  app.onError((error, _context) => {
+    if (error instanceof HTTPException2) {
+      if (error.res) return error.res;
+      return jsonResponse(
+        apiErrorSchema,
+        { error: error.message || "Request failed." },
+        { status: error.status }
+      );
+    }
+    logException(error, "api.unhandled.exception");
+    return jsonResponse(
+      apiErrorSchema,
+      { error: "Internal Server Error" },
+      { status: 500 }
+    );
+  });
   return app;
 }
 export {
   authenticatePersonalToken,
   createJuniorApi,
-  jsonResponse
+  jsonResponse,
+  resolveViewerUser
 };