@synth-deploy/server 0.1.0 → 1.1.0

package/dist/middleware/auth.js

@@ -1,6 +1,6 @@
 import { SignJWT, jwtVerify } from "jose";
 const EXEMPT_ROUTES = ["/health", "/api/health", "/api/auth/login", "/api/auth/register", "/api/auth/refresh", "/api/auth/status", "/api/auth/providers", "/api/envoy/report"];
-const EXEMPT_PREFIXES = ["/api/auth/oidc/", "/api/auth/callback/oidc/", "/api/auth/saml/", "/api/auth/callback/saml/", "/api/auth/ldap/", "/api/intake/webhook/"];
+const EXEMPT_PREFIXES = ["/api/auth/oidc/", "/api/auth/callback/oidc/", "/api/auth/saml/", "/api/auth/callback/saml/", "/api/auth/ldap/", "/api/intake/webhook/", "/api/alert-webhooks/receive/"];
 // Envoy callback endpoints — validated by envoy token, not user JWT
 const EXEMPT_PATTERNS = [/^\/api\/deployments\/[^/]+\/progress$/];
 /**

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAgB1C,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAC/K,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,sBAAsB,CAAC,CAAC;AAClK,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,SAAqB,EACrB,aAA6B,EAC7B,YAA2B,EAC3B,SAAqB;IAErB,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC9E,qBAAqB;QACrB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO;QACjE,wCAAwC;QACxC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO;QACnE,gFAAgF;QAChF,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO;QAC7D,kFAAkF;QAClF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO;QAEhF,gEAAgE;QAChE,0EAA0E;QAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,MAAM,UAAU,GAAI,OAAO,CAAC,KAAgC,EAAE,KAAK,CAAC;QACpE,MAAM,QAAQ,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAa,CAAC;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,SAAqB;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACvC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI;YAClC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;SAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,iBAAiB,CAAC,UAAU,CAAC;SAC7B,IAAI,CAAC,SAAS,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACrE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,SAAS,CAAC,CAAC;IAEnB,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC;AACjF,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAgB1C,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AAC/K,MAAM,eAAe,GAAG,CAAC,iBAAiB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,8BAA8B,CAAC,CAAC;AAClM,oEAAoE;AACpE,MAAM,eAAe,GAAG,CAAC,uCAAuC,CAAC,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAoB,EACpB,SAAqB,EACrB,aAA6B,EAC7B,YAA2B,EAC3B,SAAqB;IAErB,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAuB,EAAE,KAAmB,EAAE,EAAE;QAC9E,qBAAqB;QACrB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO;QACjE,wCAAwC;QACxC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO;QACnE,gFAAgF;QAChF,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO;QAC7D,kFAAkF;QAClF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO;QAEhF,gEAAgE;QAChE,0EAA0E;QAC1E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QACjD,MAAM,UAAU,GAAI,OAAO,CAAC,KAAgC,EAAE,KAAK,CAAC;QACpE,MAAM,QAAQ,GAAG,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACtF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,QAAQ,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAa,CAAC;YACrC,MAAM,IAAI,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,aAAa,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC;QACjF,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAc,EACd,SAAqB;IAErB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,IAAI,CAAC;IACzD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC3C,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACvC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,IAAI;YAClC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAEvB,MAAM,KAAK,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;SAC7C,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,iBAAiB,CAAC,UAAU,CAAC;SAC7B,IAAI,CAAC,SAAS,CAAC,CAAC;IAEnB,MAAM,YAAY,GAAG,MAAM,IAAI,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;SACrE,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,iBAAiB,CAAC,IAAI,CAAC;SACvB,IAAI,CAAC,SAAS,CAAC,CAAC;IAEnB,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC,EAAE,CAAC;AACjF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@synth-deploy/server",
-  "version": "0.1.0",
+  "version": "1.1.0",
   "license": "BUSL-1.1",
   "type": "module",
   "publishConfig": {

package/src/agent/envoy-client.ts

@@ -3,7 +3,7 @@ import type {
   HealthCheckResult,
 } from "./health-checker.js";
 import { serverLog, serverWarn, serverError } from "../logger.js";
-import type { DecisionType, DeploymentPlan, PlannedStep, SecurityBoundary } from "@synth-deploy/core";
+import type { DecisionType, DeploymentPlan, PlannedStep, SecurityBoundary, MonitoringDirective } from "@synth-deploy/core";
 
 // ---------------------------------------------------------------------------
 // Types — Envoy API responses
@@ -11,6 +11,7 @@ import type { DecisionType, DeploymentPlan, PlannedStep, SecurityBoundary } from
 
 export interface EnvoyDeployResult {
   deploymentId: string;
+  operationId: string;
   success: boolean;
   workspacePath: string;
   artifacts: string[];
@@ -25,7 +26,7 @@ export interface EnvoyDeployResult {
     id: string;
     timestamp: string;
     partitionId: string | null;
-    deploymentId: string | null;
+    operationId: string | null;
     agent: "server" | "envoy";
     decisionType: DecisionType;
     decision: string;
@@ -176,9 +177,9 @@ export class EnvoyClient {
    */
   async deploy(instruction: {
     deploymentId: string;
+    operationId: string;
     partitionId: string;
     environmentId: string;
-    operationId: string;
     version: string;
     variables: Record<string, string>;
     environmentName: string;
@@ -202,7 +203,7 @@ export class EnvoyClient {
    * Dispatch an approved plan to the Envoy for deterministic execution.
    */
   async executeApprovedPlan(params: {
-    deploymentId: string;
+    operationId: string;
     plan: DeploymentPlan;
     rollbackPlan: DeploymentPlan;
     artifactType: string;
@@ -211,7 +212,7 @@ export class EnvoyClient {
     progressCallbackUrl?: string;
     callbackToken?: string;
   }): Promise<EnvoyDeployResult> {
-    serverLog("ENVOY-EXECUTE", { deploymentId: params.deploymentId, envoyUrl: this.baseUrl, artifact: params.artifactName, steps: params.plan?.steps?.length ?? 0 });
+    serverLog("ENVOY-EXECUTE", { operationId: params.operationId, envoyUrl: this.baseUrl, artifact: params.artifactName, steps: params.plan?.steps?.length ?? 0 });
     const execStart = Date.now();
     const response = await fetchWithRetry(
       `${this.baseUrl}/execute`,
@@ -225,9 +226,9 @@ export class EnvoyClient {
 
     const execResult = (await response.json()) as EnvoyDeployResult;
     if (execResult.success) {
-      serverLog("ENVOY-EXECUTE-COMPLETE", { deploymentId: params.deploymentId, durationMs: Date.now() - execStart });
+      serverLog("ENVOY-EXECUTE-COMPLETE", { operationId: params.operationId, durationMs: Date.now() - execStart });
     } else {
-      serverLog("ENVOY-EXECUTE-FAILED", { deploymentId: params.deploymentId, failureReason: execResult.failureReason, durationMs: Date.now() - execStart });
+      serverLog("ENVOY-EXECUTE-FAILED", { operationId: params.operationId, failureReason: execResult.failureReason, durationMs: Date.now() - execStart });
     }
     return execResult;
   }
@@ -238,8 +239,13 @@ export class EnvoyClient {
    * POST /api/deployments/:id/plan to move the deployment to awaiting_approval.
    */
   async requestPlan(params: {
-    deploymentId: string;
-    artifact: {
+    operationId: string;
+    operationType?: "deploy" | "query" | "investigate" | "maintain" | "trigger";
+    intent?: string;
+    allowWrite?: boolean;
+    triggerCondition?: string;
+    triggerResponseIntent?: string;
+    artifact?: {
       id: string;
       name: string;
       type: string;
@@ -264,10 +270,21 @@ export class EnvoyClient {
     version: string;
     resolvedVariables: Record<string, string>;
     refinementFeedback?: string;
-  }): Promise<{ plan: DeploymentPlan; rollbackPlan: DeploymentPlan; delta?: string; assessmentSummary?: string; blocked?: boolean; blockReason?: string }> {
+  }): Promise<{
+    plan: DeploymentPlan;
+    rollbackPlan: DeploymentPlan;
+    delta?: string;
+    assessmentSummary?: string;
+    blocked?: boolean;
+    blockReason?: string;
+    queryFindings?: { targetsSurveyed: string[]; summary: string; findings: Array<{ target: string; observations: string[] }> };
+    investigationFindings?: { targetsSurveyed: string[]; summary: string; findings: Array<{ target: string; observations: string[] }>; rootCause?: string; proposedResolution?: { intent: string; operationType: "deploy" | "maintain"; parameters?: Record<string, unknown> } };
+    intervalMs?: number;
+    cooldownMs?: number;
+  }> {
     // Forward the LLM API key so the Envoy can use it if it started without one.
     // Sent in the request body (not headers) over the trusted server↔envoy channel.
-    serverLog("ENVOY-PLAN-REQUEST", { deploymentId: params.deploymentId, envoyUrl: this.baseUrl, artifact: params.artifact.name, version: params.version, environment: params.environment.name });
+    serverLog("ENVOY-PLAN-REQUEST", { operationId: params.operationId, envoyUrl: this.baseUrl, artifact: params.artifact?.name, version: params.version, environment: params.environment.name });
     const llmApiKey = process.env.SYNTH_LLM_API_KEY;
     const planStart = Date.now();
     const response = await fetchWithRetry(
@@ -282,12 +299,12 @@ export class EnvoyClient {
 
     if (!response.ok) {
       const body = await response.text().catch(() => "");
-      serverLog("ENVOY-PLAN-FAILED", { deploymentId: params.deploymentId, status: response.status, durationMs: Date.now() - planStart });
+      serverLog("ENVOY-PLAN-FAILED", { operationId: params.operationId, status: response.status, durationMs: Date.now() - planStart });
       throw new Error(`Envoy planning failed (HTTP ${response.status}): ${body}`);
     }
 
-    const planResult = (await response.json()) as { plan: DeploymentPlan; rollbackPlan: DeploymentPlan; delta?: string; assessmentSummary?: string; blocked?: boolean; blockReason?: string };
-    serverLog("ENVOY-PLAN-RECEIVED", { deploymentId: params.deploymentId, steps: planResult.plan?.steps?.length ?? 0, blocked: planResult.blocked ?? false, durationMs: Date.now() - planStart });
+    const planResult = (await response.json()) as Awaited<ReturnType<typeof this.requestPlan>>;
+    serverLog("ENVOY-PLAN-RECEIVED", { operationId: params.operationId, steps: planResult.plan?.steps?.length ?? 0, blocked: planResult.blocked ?? false, durationMs: Date.now() - planStart });
     return planResult;
   }
 
@@ -297,7 +314,7 @@ export class EnvoyClient {
    * than the forward plan, so the rollback is targeted to what actually changed.
    */
   async requestRollbackPlan(params: {
-    deploymentId: string;
+    operationId: string;
     artifact: {
       name: string;
       type: string;
@@ -381,6 +398,81 @@ export class EnvoyClient {
     );
     return (await response.json()) as { mode: "replan" | "rejection" | "response"; message: string };
   }
+
+  /**
+   * Install a monitoring directive on the Envoy for health-based triggering.
+   */
+  async installMonitoringDirective(directive: MonitoringDirective): Promise<void> {
+    serverLog("ENVOY-MONITOR-INSTALL", { directiveId: directive.id, envoyUrl: this.baseUrl });
+    const response = await fetchWithRetry(
+      `${this.baseUrl}/monitor`,
+      {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(directive),
+      },
+      this.timeoutMs,
+    );
+    if (!response.ok) {
+      const body = await response.text().catch(() => "");
+      throw new Error(`Failed to install monitoring directive (HTTP ${response.status}): ${body}`);
+    }
+  }
+
+  /**
+   * Pause a monitoring directive on the Envoy.
+   */
+  async pauseMonitoringDirective(directiveId: string): Promise<void> {
+    const response = await fetchWithRetry(
+      `${this.baseUrl}/monitor/${directiveId}/pause`,
+      { method: "POST", headers: { "Content-Type": "application/json" } },
+      this.timeoutMs,
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to pause monitoring directive (HTTP ${response.status})`);
+    }
+  }
+
+  /**
+   * Resume a monitoring directive on the Envoy.
+   */
+  async resumeMonitoringDirective(directiveId: string): Promise<void> {
+    const response = await fetchWithRetry(
+      `${this.baseUrl}/monitor/${directiveId}/resume`,
+      { method: "POST", headers: { "Content-Type": "application/json" } },
+      this.timeoutMs,
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to resume monitoring directive (HTTP ${response.status})`);
+    }
+  }
+
+  /**
+   * Remove a monitoring directive from the Envoy.
+   */
+  async removeMonitoringDirective(directiveId: string): Promise<void> {
+    const response = await fetchWithRetry(
+      `${this.baseUrl}/monitor/${directiveId}`,
+      { method: "DELETE", headers: { "Content-Type": "application/json" } },
+      this.timeoutMs,
+    );
+    if (!response.ok) {
+      throw new Error(`Failed to remove monitoring directive (HTTP ${response.status})`);
+    }
+  }
+
+  /**
+   * List active monitoring directives on the Envoy.
+   */
+  async listMonitoringDirectives(): Promise<Array<{ directive: MonitoringDirective; lastFiredAt: number; fireCount: number; suppressedCount: number }>> {
+    const response = await fetchWithRetry(
+      `${this.baseUrl}/monitor`,
+      {},
+      this.timeoutMs,
+    );
+    const data = (await response.json()) as { directives: Array<{ directive: MonitoringDirective; lastFiredAt: number; fireCount: number; suppressedCount: number }> };
+    return data.directives;
+  }
 }
 
 // ---------------------------------------------------------------------------

package/src/agent/stale-deployment-detector.ts

@@ -37,7 +37,7 @@ export function markStaleDeployments(
 
     debrief.record({
       partitionId: deployment.partitionId ?? null,
-      deploymentId: deployment.id,
+      operationId: deployment.id,
       agent: "server",
       decisionType: "deployment-failure",
       decision: `Marked deployment as failed: exceeded ${Math.round(thresholdMs / 60_000)} minute stale threshold`,

package/src/agent/synth-agent.ts

@@ -2,7 +2,8 @@ import crypto from "node:crypto";
 import type {
   Deployment,
   DeploymentId,
-  DeploymentTrigger,
+  OperationInput,
+  OperationTrigger,
   DebriefWriter,
   Environment,
   Partition,
@@ -25,7 +26,7 @@ import { serverLog, serverError } from "../logger.js";
 // Public interfaces
 // ---------------------------------------------------------------------------
 
-export interface DeploymentStore {
+export interface OperationStore {
   save(deployment: Deployment): void;
   get(id: DeploymentId): Deployment | undefined;
   getByPartition(partitionId: string): Deployment[];
@@ -36,6 +37,8 @@ export interface DeploymentStore {
   findRecentByArtifact(artifactId: string, since: Date, status?: string): Deployment[];
   findLatestByEnvironment(envId: string): Deployment | undefined;
 }
+/** @deprecated Use OperationStore */
+export type DeploymentStore = OperationStore;
 
 export interface AgentOptions {
   /** Number of health check retries after initial failure. Default: 1 */
@@ -172,7 +175,7 @@ export class SynthAgent {
 
   constructor(
     private debrief: DebriefWriter,
-    private deployments: DeploymentStore,
+    private deployments: OperationStore,
     private artifactStore: IArtifactStore,
     private environmentStore: IEnvironmentStore,
     private partitionStore: IPartitionStore,
@@ -217,14 +220,23 @@ export class SynthAgent {
   // Main entry point
   // -----------------------------------------------------------------------
 
-  async triggerDeployment(
-    trigger: DeploymentTrigger,
+  async triggerOperation(
+    input: OperationInput,
+    trigger: OperationTrigger,
   ): Promise<Deployment> {
+    if (input.type !== "deploy") {
+      throw new OrchestrationError(
+        "resolve-entities",
+        `Operation type "${input.type}" is not supported via programmatic triggers`,
+        `"query" and "investigate" operations run through the REST API path (web UI), not programmatic triggers. Only "deploy" is supported via triggerOperation().`,
+      );
+    }
+
     const deploymentId = crypto.randomUUID();
 
     // --- Look up entities from stores -----------------------------------------------
 
-    serverLog("DEPLOY-TRIGGER", { deploymentId, artifactId: trigger.artifactId, environmentId: trigger.environmentId, partitionId: trigger.partitionId ?? null, triggeredBy: trigger.triggeredBy });
+    serverLog("DEPLOY-TRIGGER", { operationId: deploymentId, artifactId: input.artifactId, environmentId: trigger.environmentId, partitionId: trigger.partitionId ?? null, triggeredBy: trigger.triggeredBy });
 
     const environment = this.environmentStore.get(trigger.environmentId);
     if (!environment) {
@@ -249,12 +261,12 @@ export class SynthAgent {
       }
     }
 
-    const artifact = this.artifactStore.get(trigger.artifactId);
+    const artifact = this.artifactStore.get(input.artifactId);
     if (!artifact) {
       throw new OrchestrationError(
         "resolve-entities",
-        `Artifact not found: ${trigger.artifactId}`,
-        `The trigger references artifact ID "${trigger.artifactId}" which does not exist in the artifact store. ` +
+        `Artifact not found: ${input.artifactId}`,
+        `The trigger references artifact ID "${input.artifactId}" which does not exist in the artifact store. ` +
         `Verify the artifact ID is correct and the artifact has been created.`,
       );
     }
@@ -275,7 +287,7 @@ export class SynthAgent {
 
     const analysisEntry = this.debrief.record({
       partitionId: trigger.partitionId ?? null,
-      deploymentId,
+      operationId: deploymentId,
       agent: "server",
       decisionType: "artifact-analysis",
       decision: `Analyzed artifact "${artifact.name}" (${artifact.type}) — confidence ${artifact.analysis.confidence}`,
@@ -299,7 +311,7 @@ export class SynthAgent {
 
     // --- Step 1: Plan the pipeline -----------------------------------------
 
-    const version = trigger.artifactVersionId ?? "latest";
+    const version = input.artifactVersionId ?? "latest";
     const pipelineSteps = [
       "resolve-configuration",
       "preflight-health-check",
@@ -309,7 +321,7 @@ export class SynthAgent {
 
     const planEntry = this.debrief.record({
       partitionId: trigger.partitionId ?? null,
-      deploymentId,
+      operationId: deploymentId,
       agent: "server",
       decisionType: "pipeline-plan",
       decision: `Planned deployment pipeline: ${pipelineSteps.join(" → ")}`,
@@ -349,7 +361,7 @@ export class SynthAgent {
 
     const planGenEntry = this.debrief.record({
       partitionId: trigger.partitionId ?? null,
-      deploymentId,
+      operationId: deploymentId,
       agent: "server",
       decisionType: "plan-generation",
       decision: `Generated deployment plan for "${artifact.name}" v${version} — ${initialPlan.steps.length} step(s)`,
@@ -363,7 +375,7 @@ export class SynthAgent {
 
     const approvalEntry = this.debrief.record({
       partitionId: trigger.partitionId ?? null,
-      deploymentId,
+      operationId: deploymentId,
       agent: "server",
       decisionType: "plan-approval",
       decision: `Auto-approved deployment plan for "${artifact.name}" v${version}`,
@@ -378,8 +390,7 @@ export class SynthAgent {
 
     const deployment: Deployment = {
       id: deploymentId,
-      artifactId: trigger.artifactId,
-      artifactVersionId: trigger.artifactVersionId,
+      input,
       environmentId: trigger.environmentId,
       partitionId: trigger.partitionId,
       version,
@@ -397,7 +408,7 @@ export class SynthAgent {
     try {
       // --- Step 2: Resolve configuration -----------------------------------
 
-      serverLog("DEPLOY-CONFIG-RESOLVE", { deploymentId: deployment.id });
+      serverLog("DEPLOY-CONFIG-RESOLVE", { operationId: deployment.id });
       const { variables, hasConflicts } = this.resolveConfiguration(
         deployment,
         trigger.variables,
@@ -411,13 +422,13 @@ export class SynthAgent {
 
       deployment.status = "running";
       this.deployments.save(deployment);
-      serverLog("DEPLOY-HEALTH-CHECK", { deploymentId: deployment.id, environment: environment.name });
+      serverLog("DEPLOY-HEALTH-CHECK", { operationId: deployment.id, environment: environment.name });
 
       await this.preflightHealthCheck(deployment, partition, environment, artifact);
 
       // --- Step 4: Execute deployment ----------------------------------------
 
-      serverLog("DEPLOY-EXECUTE", { deploymentId: deployment.id, artifact: artifact.name, version: deployment.version, environment: environment.name });
+      serverLog("DEPLOY-EXECUTE", { operationId: deployment.id, artifact: artifact.name, version: deployment.version, environment: environment.name });
       const delegated = await this.executeDeployment(deployment, partition, environment, artifact);
 
       // --- Step 5: Post-deploy verify ----------------------------------------
@@ -433,11 +444,11 @@ export class SynthAgent {
 
       deployment.status = "succeeded";
       deployment.completedAt = new Date();
-      serverLog("DEPLOY-SUCCEEDED", { deploymentId: deployment.id, artifact: artifact.name, version: deployment.version, environment: environment.name, durationMs: deployment.completedAt.getTime() - deployment.createdAt.getTime() });
+      serverLog("DEPLOY-SUCCEEDED", { operationId: deployment.id, artifact: artifact.name, version: deployment.version, environment: environment.name, durationMs: deployment.completedAt.getTime() - deployment.createdAt.getTime() });
 
       const completionEntry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "deployment-completion",
         decision: `Marking deployment of ${artifact.name} v${deployment.version} as succeeded on "${environment.name}"`,
@@ -465,11 +476,11 @@ export class SynthAgent {
         error instanceof OrchestrationError
           ? error.message
           : `Unexpected error: ${error instanceof Error ? error.message : String(error)}`;
-      serverError("DEPLOY-FAILED", { deploymentId: deployment.id, reason: deployment.failureReason, durationMs: deployment.completedAt.getTime() - deployment.createdAt.getTime() });
+      serverError("DEPLOY-FAILED", { operationId: deployment.id, reason: deployment.failureReason, durationMs: deployment.completedAt.getTime() - deployment.createdAt.getTime() });
 
       const failEntry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "deployment-failure",
         decision: `Deployment failed: ${deployment.failureReason}`,
@@ -532,7 +543,7 @@ export class SynthAgent {
 
       this.debrief.record({
         partitionId,
-        deploymentId: null,
+        operationId: null,
         agent: "server",
         decisionType: "diagnostic-investigation",
         decision: `${tools.length} external tool(s) available from ${connectedServers.length} MCP server(s)`,
@@ -557,7 +568,7 @@ export class SynthAgent {
       // Never let external checks block the deployment
       this.debrief.record({
         partitionId,
-        deploymentId: null,
+        operationId: null,
         agent: "server",
         decisionType: "diagnostic-investigation",
         decision: "External MCP check failed — proceeding without external intelligence",
@@ -648,7 +659,7 @@ export class SynthAgent {
     const partitionVarCount = partition ? Object.keys(partition.variables).length : 0;
     const configEntry = this.debrief.record({
       partitionId: deployment.partitionId ?? null,
-      deploymentId: deployment.id,
+      operationId: deployment.id,
       agent: "server",
       decisionType: "configuration-resolved",
       decision:
@@ -828,7 +839,7 @@ export class SynthAgent {
     if (crossEnvConn) {
       const entry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "variable-conflict",
         decision:
@@ -859,7 +870,7 @@ export class SynthAgent {
         .join("; ");
       const entry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "variable-conflict",
         decision: `Cross-environment variable pattern in ${crossEnv.length} non-connectivity variable(s)`,
@@ -884,7 +895,7 @@ export class SynthAgent {
     if (sensitiveDetails) {
       const entry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "variable-conflict",
         decision: `Security-sensitive variable(s) overridden: ${sensitiveDetails.map((d) => d.conflict.variable).join(", ")}`,
@@ -919,7 +930,7 @@ export class SynthAgent {
         .join("; ");
       const entry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "variable-conflict",
         decision: `Resolved ${standardDetails.length} variable conflict(s) via precedence rules`,
@@ -993,7 +1004,7 @@ export class SynthAgent {
     if (firstCheck.reachable) {
       const entry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "health-check",
         decision: `Proceeding with deployment — target environment "${environment.name}" confirmed healthy in ${firstCheck.responseTimeMs}ms`,
@@ -1025,7 +1036,7 @@ export class SynthAgent {
       // Reasoning determined retrying won't help (e.g., DNS failure)
       const abortEntry = this.debrief.record({
         partitionId: deployment.partitionId ?? null,
-        deploymentId: deployment.id,
+        operationId: deployment.id,
         agent: "server",
         decisionType: "health-check",
         decision: "Pre-flight health check failed — aborting without retry",
@@ -1050,7 +1061,7 @@ export class SynthAgent {
     // Decision is to retry
     const retryEntry = this.debrief.record({
       partitionId: deployment.partitionId ?? null,
-      deploymentId: deployment.id,
+      operationId: deployment.id,
       agent: "server",
       decisionType: "health-check",
       decision: "Pre-flight health check failed — attempting retry",
@@ -1079,7 +1090,7 @@ export class SynthAgent {
       if (retryCheck.reachable) {
         const recoveryEntry = this.debrief.record({
           partitionId: deployment.partitionId ?? null,
-          deploymentId: deployment.id,
+          operationId: deployment.id,
           agent: "server",
           decisionType: "health-check",
           decision:
@@ -1297,7 +1308,7 @@ export class SynthAgent {
     // No settingsReader configured — execution skipped (test/offline environment)
     const execEntry = this.debrief.record({
       partitionId: deployment.partitionId ?? null,
-      deploymentId: deployment.id,
+      operationId: deployment.id,
       agent: "server",
       decisionType: "deployment-execution",
       decision: `Skipped Envoy delegation for ${artifact.name} v${deployment.version} — no settings reader configured`,
@@ -1355,7 +1366,7 @@ export class SynthAgent {
     // Envoy is healthy — delegate the deployment
     const delegateEntry = this.debrief.record({
       partitionId: deployment.partitionId ?? null,
-      deploymentId: deployment.id,
+      operationId: deployment.id,
       agent: "server",
       decisionType: "deployment-execution",
       decision: `Delegating execution of ${artifact.name} v${deployment.version} to Envoy at ${envoyConfig.url}`,
@@ -1382,10 +1393,10 @@ export class SynthAgent {
 
       envoyResult = await client.deploy({
         deploymentId: deployment.id,
+        operationId: deployment.id,
         partitionId: deployment.partitionId ?? "",
         environmentId: deployment.environmentId ?? "",
-        operationId: deployment.artifactId, // Envoy still uses operationId in its API
-        version: deployment.version,
+        version: deployment.version ?? "",
         variables: deployment.variables,
         environmentName: environment.name,
         partitionName: partition?.name ?? "",
@@ -1407,7 +1418,7 @@ export class SynthAgent {
       for (const entry of envoyResult.debriefEntries) {
         const ingested = this.debrief.record({
           partitionId: entry.partitionId ?? deployment.partitionId ?? null,
-          deploymentId: entry.deploymentId ?? deployment.id,
+          operationId: entry.operationId ?? deployment.id,
           agent: entry.agent,
           decisionType: entry.decisionType,
           decision: entry.decision,
@@ -1442,7 +1453,7 @@ export class SynthAgent {
     // Record successful delegation completion
     const completionEntry = this.debrief.record({
       partitionId: deployment.partitionId ?? null,
-      deploymentId: deployment.id,
+      operationId: deployment.id,
       agent: "server",
       decisionType: "deployment-execution",
       decision: `Envoy completed deployment successfully in ${envoyResult.executionDurationMs}ms — ${envoyResult.artifacts.length} artifact(s) produced`,
@@ -1475,7 +1486,7 @@ export class SynthAgent {
   ): Promise<void> {
     const entry = this.debrief.record({
       partitionId: deployment.partitionId ?? null,
-      deploymentId: deployment.id,
+      operationId: deployment.id,
       agent: "server",
       decisionType: "deployment-verification",
       decision: `Post-deploy verification skipped for ${artifact.name} v${deployment.version} — no Envoy configured`,
@@ -1506,7 +1517,10 @@ export class SynthAgent {
 // In-memory deployment store
 // ---------------------------------------------------------------------------
 
-export class InMemoryDeploymentStore implements DeploymentStore {
+const getArtifactId = (op: Deployment): string =>
+  op.input?.type === "deploy" ? (op.input as { type: "deploy"; artifactId: string }).artifactId : "";
+
+export class InMemoryDeploymentStore implements OperationStore {
   private deployments: Map<DeploymentId, Deployment> = new Map();
 
   save(deployment: Deployment): void {
@@ -1525,7 +1539,7 @@ export class InMemoryDeploymentStore implements DeploymentStore {
 
   getByArtifact(artifactId: string): Deployment[] {
     return [...this.deployments.values()].filter(
-      (d) => d.artifactId === artifactId,
+      (d) => getArtifactId(d) === artifactId,
     );
   }
 
@@ -1542,7 +1556,7 @@ export class InMemoryDeploymentStore implements DeploymentStore {
   findByArtifactVersion(artifactId: string, version: string, status?: string): Deployment[] {
     return [...this.deployments.values()].filter(
       (d) =>
-        d.artifactId === artifactId &&
+        getArtifactId(d) === artifactId &&
         d.version === version &&
         (!status || d.status === status),
     );
@@ -1552,7 +1566,7 @@ export class InMemoryDeploymentStore implements DeploymentStore {
     return [...this.deployments.values()]
       .filter(
         (d) =>
-          d.artifactId === artifactId &&
+          getArtifactId(d) === artifactId &&
           new Date(d.createdAt).getTime() >= since.getTime() &&
           (!status || d.status === status),
       )