@wairon/cli 5.1.1-dev.65 → 5.1.1-dev.67

package/dist/cli/index.js

@@ -65,7 +65,7 @@ var init_defaults = __esm({
       copilot: ".github/prompts",
       codex: ".codex/agents"
     };
-    WAIRON_VERSION = "5.1.1-dev.65";
+    WAIRON_VERSION = "5.1.1-dev.67";
     GITHUB_REPO = "SYW-Apps/Waffle-AIron";
     SUPPORTED_ALIASES = ["wai"];
     SCAN_EXCLUDE_DIRS = /* @__PURE__ */ new Set([
@@ -37582,13 +37582,29 @@ function storeInstallGlobalPackArchive(archive, name) {
   descriptor.tier = "instance";
   return descriptor;
 }
+function declaredName2(loadRef, baseRoot, scope) {
+  const d = probe(loadRef, baseRoot, scope, loadRef);
+  return d.error ? void 0 : d.name;
+}
+function pickByName(candidates, name, fileOf, manifestOf) {
+  const byFile = candidates.find((c) => stem(fileOf(c)) === name || path53.basename(fileOf(c)) === name);
+  if (byFile !== void 0) return byFile;
+  const byManifest = candidates.filter((c) => manifestOf(c) === name);
+  if (byManifest.length > 1) {
+    throw new Error(
+      `Pack name "${name}" is ambiguous: ${byManifest.map((c) => `"${fileOf(c)}"`).join(", ")} all declare it. Remove one by its file name instead.`
+    );
+  }
+  return byManifest[0];
+}
 function storeRemoveGlobalPack(name) {
   assertName(name);
   const dir = hostCore.globalPacksDir();
-  const match = hostCore.discoverPacks(dir).find((ref) => stem(ref) === name || path53.basename(ref) === name);
+  const manifestOf = (ref) => declaredName2(ref, path53.dirname(ref), "global");
+  const match = pickByName(hostCore.discoverPacks(dir), name, path53.basename, manifestOf);
   if (!match) {
     const inImage = hostCore.discoverPacks(imagePacksDir()).some(
-      (ref) => stem(ref) === name || path53.basename(ref) === name
+      (ref) => stem(ref) === name || path53.basename(ref) === name || manifestOf(ref) === name
     );
     throw new Error(
       inImage ? `Pack "${name}" is an immutable image-layer pack (WAIRON_IMAGE_PACKS_DIR) and cannot be removed at runtime; rebuild the extension image without it.` : `No server-global instance pack named "${name}".`
@@ -37650,7 +37666,12 @@ function boundProject2(cfg, project2) {
 }
 function findPackRegistration(config, name) {
   const relRef = `.wai/packs/${name}.yaml`;
-  return (config?.extensions?.packs ?? []).find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path53.basename(entry) === name : entry.name === name);
+  const entries = config?.extensions?.packs ?? [];
+  const direct = entries.find((entry) => typeof entry === "string" ? entry === relRef || stem(entry) === name || path53.basename(entry) === name : entry.name === name);
+  if (direct !== void 0) return direct;
+  const root = getProjectRoot();
+  const refs = entries.filter((entry) => typeof entry === "string");
+  return pickByName(refs, name, (ref) => ref, (ref) => declaredName2(ref, root, "project"));
 }
 function listGlobalPacks(cfg, credential) {
   requireCap(cfg, credential, "project:admin", "instance", "", "Forbidden \u2014 managing server-global packs requires instance-level project:admin");
@@ -42453,6 +42474,10 @@ function removeUnit(cfg, sessionId, unitId, disposition) {
   }
   const units = listOrganizationUnits(cfg.dataDir);
   const subtree = subtreeUnitIds2(units, unitId);
+  const kind = disposition?.kind;
+  if (kind !== "migrate" && kind !== "alternative" && kind !== "absorb" && kind !== "cascade") {
+    throw new Error("A disposition kind is required: migrate, alternative, absorb or cascade");
+  }
   if (disposition.kind === "cascade") {
     for (const placement of listProjectPlacements(cfg.dataDir)) {
       if (subtree.has(placement.unitId)) {
@@ -45242,85 +45267,71 @@ details.adv summary { cursor:pointer; color:var(--dim); font-size:12px; margin-b
 </body>
 </html>`;
 }
-function loginWithPassword(cfg, body, res, secureCookie) {
-  const sessionId = signInWithPassword(cfg, String(body?.user ?? ""), String(body?.password ?? ""));
-  res.writeHead(200, {
-    "content-type": "application/json",
-    "set-cookie": setSessionCookie(sessionId, secureCookie)
-  });
-  res.end(JSON.stringify({ ok: true }));
+function loginWithPassword(cfg, user, password) {
+  return signInWithPassword(cfg, user, password);
 }
-function adminListUsers(cfg, sessionId, url, res) {
-  const project2 = url.searchParams.get("project") ?? void 0;
-  sendJson(res, 200, { users: listUsers3(cfg, sessionId, project2) });
+function adminListUsers(cfg, sessionId, project2) {
+  return listUsers3(cfg, sessionId, project2);
 }
-function adminUpsertUser(cfg, sessionId, body, res) {
-  sendJson(res, 200, upsertUser3(cfg, sessionId, body));
+function adminUpsertUser(cfg, sessionId, record2) {
+  return upsertUser3(cfg, sessionId, record2);
 }
-function adminSetUserStatus(cfg, sessionId, body, res) {
-  sendJson(res, 200, setUserStatus3(cfg, sessionId, String(body?.userId ?? ""), String(body?.status ?? "")));
+function adminSetUserStatus(cfg, sessionId, userId, status2) {
+  return setUserStatus3(cfg, sessionId, userId, status2);
 }
-function adminCreateShareLink(cfg, sessionId, body, res) {
-  sendJson(res, 201, createShareLink(cfg, sessionId, body ?? {}));
+function adminCreateShareLink(cfg, sessionId, input) {
+  return createShareLink(cfg, sessionId, input);
 }
-function adminListShareLinks(cfg, sessionId, url, res) {
-  sendJson(res, 200, { links: listShareLinks(cfg, sessionId, url.searchParams.get("projectId") ?? "") });
+function adminListShareLinks(cfg, sessionId, projectId) {
+  return listShareLinks(cfg, sessionId, projectId);
 }
-function adminRefreshShareSnapshot(cfg, sessionId, body, res) {
-  sendJson(res, 200, refreshSnapshot(cfg, sessionId, String(body?.linkId ?? "")));
+function adminRefreshShareSnapshot(cfg, sessionId, linkId) {
+  return refreshSnapshot(cfg, sessionId, linkId);
 }
-function adminUpdateShareLink(cfg, sessionId, body, res) {
-  sendJson(res, 200, updateShareLink(cfg, sessionId, String(body?.linkId ?? ""), body?.changes ?? {}));
+function adminUpdateShareLink(cfg, sessionId, linkId, changes) {
+  return updateShareLink(cfg, sessionId, linkId, changes);
 }
-function adminRemoveShareLink(cfg, sessionId, body, res) {
-  removeShareLink(cfg, sessionId, String(body?.linkId ?? ""));
-  sendJson(res, 200, { ok: true });
+function adminRemoveShareLink(cfg, sessionId, linkId) {
+  removeShareLink(cfg, sessionId, linkId);
 }
-function adminGetShareAccessLog(cfg, sessionId, url, res) {
-  const limit = Number(url.searchParams.get("limit") ?? "100") || 100;
-  sendJson(res, 200, { entries: getShareAccessLog(cfg, sessionId, url.searchParams.get("linkId") ?? "", limit) });
+function adminGetShareAccessLog(cfg, sessionId, linkId, limit) {
+  return getShareAccessLog(cfg, sessionId, linkId, limit);
 }
-function adminListProviders(cfg, sessionId, res) {
-  sendJson(res, 200, { providers: listIdentityProviders(cfg, sessionId) });
+function adminListProviders(cfg, sessionId) {
+  return listIdentityProviders(cfg, sessionId);
 }
-function adminUpsertProvider(cfg, sessionId, body, res) {
-  sendJson(res, 200, upsertIdentityProvider(cfg, sessionId, body));
+function adminUpsertProvider(cfg, sessionId, config) {
+  return upsertIdentityProvider(cfg, sessionId, config);
 }
-function adminRemoveProvider(cfg, sessionId, body, res) {
-  removeIdentityProvider(cfg, sessionId, String(body?.id ?? ""));
-  sendJson(res, 200, { ok: true });
+function adminRemoveProvider(cfg, sessionId, id) {
+  removeIdentityProvider(cfg, sessionId, id);
 }
-function mintAgentToken(cfg, sessionId, body, res) {
-  const token = mintProjectToken(cfg, sessionId, String(body?.projectId ?? ""), body?.write === true);
-  sendJson(res, 201, { token });
+function mintAgentToken(cfg, sessionId, projectId, write) {
+  return mintProjectToken(cfg, sessionId, projectId, write);
 }
-function revokeAgentToken(cfg, sessionId, body, res) {
-  revokeProjectToken(cfg, sessionId, String(body?.id ?? ""));
-  sendJson(res, 200, { ok: true });
+function revokeAgentToken(cfg, sessionId, tokenId) {
+  revokeProjectToken(cfg, sessionId, tokenId);
 }
-function listAgentTokens(cfg, sessionId, res) {
-  sendJson(res, 200, { tokens: listMyTokens(cfg, sessionId) });
+function listAgentTokens(cfg, sessionId) {
+  return listMyTokens(cfg, sessionId);
 }
-function adminListOrgUnits(cfg, sessionId, res) {
-  sendJson(res, 200, { units: listOrganizationUnits2(cfg, sessionId) });
+function adminListOrgUnits(cfg, sessionId) {
+  return listOrganizationUnits2(cfg, sessionId);
 }
-function adminListSecretRefs(cfg, sessionId, res) {
-  sendJson(res, 200, { refs: listSecretRefs(cfg, sessionId) });
+function adminListSecretRefs(cfg, sessionId) {
+  return listSecretRefs(cfg, sessionId);
 }
-function adminSetSecret(cfg, sessionId, body, res) {
-  setSecret3(cfg, sessionId, String(body?.key ?? ""), String(body?.value ?? ""));
-  sendJson(res, 200, { ok: true });
+function adminSetSecret(cfg, sessionId, key, value) {
+  setSecret3(cfg, sessionId, key, value);
 }
-function adminUpsertOrgUnit(cfg, sessionId, body, res) {
-  sendJson(res, 200, upsertOrganizationUnit(cfg, sessionId, body));
+function adminUpsertOrgUnit(cfg, sessionId, record2) {
+  return upsertOrganizationUnit(cfg, sessionId, record2);
 }
-function adminPlaceProject(cfg, sessionId, body, res) {
-  placeProject3(cfg, sessionId, String(body?.projectId ?? ""), String(body?.unitId ?? ""));
-  sendJson(res, 200, { ok: true });
+function adminPlaceProject(cfg, sessionId, projectId, unitId) {
+  placeProject3(cfg, sessionId, projectId, unitId);
 }
-function adminRemoveUnit(cfg, sessionId, body, res) {
-  removeUnit(cfg, sessionId, String(body?.unitId ?? ""), body?.disposition ?? {});
-  sendJson(res, 200, { ok: true });
+function adminRemoveUnit(cfg, sessionId, unitId, disposition) {
+  removeUnit(cfg, sessionId, unitId, disposition);
 }
 function bodyScope(body) {
   return {
@@ -45328,69 +45339,44 @@ function bodyScope(body) {
     scopeId: body?.scopeId !== void 0 ? String(body.scopeId) : void 0
   };
 }
-function adminListRoles(cfg, sessionId, res) {
-  sendJson(res, 200, { roles: listRoles3(cfg, sessionId) });
-}
-function adminCreateRole(cfg, sessionId, body, res) {
-  sendJson(res, 200, createRole3(cfg, sessionId, body));
-}
-function adminUpdateRole(cfg, sessionId, body, res) {
-  sendJson(res, 200, updateRole3(cfg, sessionId, body));
-}
-function adminDeleteRole(cfg, sessionId, body, res) {
-  deleteRole3(cfg, sessionId, String(body?.id ?? ""));
-  sendJson(res, 200, { ok: true });
-}
-function adminBindRole(cfg, sessionId, body, res) {
-  const scope = bodyScope(body);
-  sendJson(res, 200, bindRole2(cfg, sessionId, String(body?.userId ?? ""), String(body?.roleId ?? ""), scope.scopeKind, scope.scopeId));
-}
-function adminUnbindRole(cfg, sessionId, body, res) {
-  const scope = bodyScope(body);
-  sendJson(res, 200, unbindRole2(cfg, sessionId, String(body?.userId ?? ""), String(body?.roleId ?? ""), scope.scopeKind, scope.scopeId));
-}
-function adminListAssignments(cfg, sessionId, url, res) {
-  const q2 = (name) => url.searchParams.get(name) ?? void 0;
-  sendJson(res, 200, {
-    assignments: listAssignments3(
-      cfg,
-      sessionId,
-      q2("scopeKind"),
-      q2("scopeId"),
-      q2("subjectKind"),
-      q2("subjectId")
-    )
-  });
+function adminListRoles(cfg, sessionId) {
+  return listRoles3(cfg, sessionId);
 }
-function adminSetAssignment(cfg, sessionId, body, res) {
-  sendJson(res, 200, setAssignment3(cfg, sessionId, body));
-}
-function adminRemoveAssignment(cfg, sessionId, body, res) {
-  removeAssignment3(cfg, sessionId, String(body?.id ?? ""));
-  sendJson(res, 200, { ok: true });
-}
-function projectList(cfg, sessionId, res) {
-  sendJson(res, 200, { projects: listProjects2(cfg, sessionId) });
-}
-function projectCreate(cfg, sessionId, body, res) {
-  sendJson(
-    res,
-    201,
-    createProject2(
-      cfg,
-      sessionId,
-      String(body?.id ?? ""),
-      String(body?.unitId ?? ""),
-      body?.profileSelection
-    )
-  );
+function adminCreateRole(cfg, sessionId, role) {
+  return createRole3(cfg, sessionId, role);
+}
+function adminUpdateRole(cfg, sessionId, role) {
+  return updateRole3(cfg, sessionId, role);
+}
+function adminDeleteRole(cfg, sessionId, roleId) {
+  deleteRole3(cfg, sessionId, roleId);
+}
+function adminBindRole(cfg, sessionId, userId, roleId, scopeKind, scopeId) {
+  return bindRole2(cfg, sessionId, userId, roleId, scopeKind, scopeId);
+}
+function adminUnbindRole(cfg, sessionId, userId, roleId, scopeKind, scopeId) {
+  return unbindRole2(cfg, sessionId, userId, roleId, scopeKind, scopeId);
+}
+function adminListAssignments(cfg, sessionId, scopeKind, scopeId, subjectKind, subjectId) {
+  return listAssignments3(cfg, sessionId, scopeKind, scopeId, subjectKind, subjectId);
+}
+function adminSetAssignment(cfg, sessionId, assignment) {
+  return setAssignment3(cfg, sessionId, assignment);
+}
+function adminRemoveAssignment(cfg, sessionId, assignmentId) {
+  removeAssignment3(cfg, sessionId, assignmentId);
+}
+function projectList(cfg, sessionId) {
+  return listProjects2(cfg, sessionId);
 }
-function projectLock(cfg, sessionId, body, res) {
-  sendJson(res, 200, lockProject3(cfg, sessionId, String(body?.projectId ?? "")));
+function projectCreate(cfg, sessionId, id, unitId, profileSelection) {
+  return createProject2(cfg, sessionId, id, unitId, profileSelection);
 }
-function projectDestroy(cfg, sessionId, body, res) {
-  destroyProject2(cfg, sessionId, String(body?.id ?? ""));
-  sendJson(res, 200, { ok: true });
+function projectLock(cfg, sessionId, projectId) {
+  return lockProject3(cfg, sessionId, projectId);
+}
+function projectDestroy(cfg, sessionId, id) {
+  destroyProject2(cfg, sessionId, id);
 }
 var q = (url, name) => url.searchParams.get(name) ?? void 0;
 function archiveBody(body) {
@@ -45402,159 +45388,107 @@ function packNameOverride(req) {
   const v = Array.isArray(h) ? h[0] : h;
   return v && v.trim() ? v.trim() : void 0;
 }
-function opsListGlobalPacks(cfg, sessionId, res) {
-  sendJson(res, 200, { packs: listGlobalPacks2(cfg, sessionId) });
+function opsListGlobalPacks(cfg, sessionId) {
+  return listGlobalPacks2(cfg, sessionId);
 }
-function opsInstallGlobalPack(cfg, sessionId, body, res) {
-  sendJson(res, 200, installGlobalPack2(cfg, sessionId, String(body?.name ?? ""), String(body?.content ?? "")));
+function opsInstallGlobalPack(cfg, sessionId, name, content) {
+  return installGlobalPack2(cfg, sessionId, name, content);
 }
-function opsRemoveGlobalPack(cfg, sessionId, body, res) {
-  removeGlobalPack2(cfg, sessionId, String(body?.name ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsRemoveGlobalPack(cfg, sessionId, name) {
+  removeGlobalPack2(cfg, sessionId, name);
 }
-function opsListProjectPacks(cfg, sessionId, url, res) {
-  sendJson(res, 200, { packs: listProjectPacks2(cfg, sessionId, q(url, "projectId") ?? "") });
+function opsListProjectPacks(cfg, sessionId, project2) {
+  return listProjectPacks2(cfg, sessionId, project2);
 }
-function opsInstallProjectPack(cfg, sessionId, body, res) {
-  sendJson(res, 200, installProjectPack2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.name ?? ""), String(body?.content ?? "")));
+function opsInstallProjectPack(cfg, sessionId, project2, name, content) {
+  return installProjectPack2(cfg, sessionId, project2, name, content);
 }
-function opsRemoveProjectPack(cfg, sessionId, body, res) {
-  removeProjectPack2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.name ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsRemoveProjectPack(cfg, sessionId, project2, name) {
+  removeProjectPack2(cfg, sessionId, project2, name);
 }
-function opsInstallGlobalPackArchive(cfg, sessionId, req, body, res) {
-  sendJson(res, 200, installGlobalPackArchive2(cfg, sessionId, archiveBody(body), packNameOverride(req)));
+function opsInstallGlobalPackArchive(cfg, sessionId, archive, name) {
+  return installGlobalPackArchive2(cfg, sessionId, archive, name);
 }
-function opsInstallProjectPackArchive(cfg, sessionId, req, url, body, res) {
-  sendJson(res, 200, installProjectPackArchive2(cfg, sessionId, q(url, "projectId") ?? "", archiveBody(body), packNameOverride(req)));
+function opsInstallProjectPackArchive(cfg, sessionId, project2, archive, name) {
+  return installProjectPackArchive2(cfg, sessionId, project2, archive, name);
 }
-function opsExportProjectTree(cfg, sessionId, url, res) {
-  const result = exportProjectTree2(
-    cfg,
-    sessionId,
-    q(url, "projectId") ?? "",
-    void 0,
-    q(url, "includeDerived") === "1",
-    q(url, "allowPartial") === "1"
-  );
-  res.writeHead(200, {
-    "content-type": "application/zip",
-    "content-disposition": `attachment; filename="${result.suggestedFileName}"`
-  });
-  res.end(Buffer.from(result.archive));
-}
-function opsImportProjectTree(cfg, sessionId, url, body, res) {
-  sendJson(
-    res,
-    200,
-    importProjectTree2(
-      cfg,
-      sessionId,
-      q(url, "projectId") ?? "",
-      archiveBody(body),
-      void 0,
-      q(url, "replace") === "1"
-    )
-  );
+function opsExportProjectTree(cfg, sessionId, project2, subproject, includeDerived, allowPartial) {
+  return exportProjectTree2(cfg, sessionId, project2, subproject, includeDerived, allowPartial);
 }
-function opsListAvailableProfiles(cfg, sessionId, res) {
-  sendJson(res, 200, { profiles: listAvailableProfiles2(cfg, sessionId) });
+function opsImportProjectTree(cfg, sessionId, project2, archive, subproject, replaceExisting) {
+  return importProjectTree2(cfg, sessionId, project2, archive, subproject, replaceExisting);
 }
-function opsListAdoptableProjectPacks(cfg, sessionId, url, res) {
-  sendJson(res, 200, { packs: listAdoptableProjectPacks2(cfg, sessionId, q(url, "projectId") ?? "") });
+function opsListAvailableProfiles(cfg, sessionId) {
+  return listAvailableProfiles2(cfg, sessionId);
 }
-function opsAdoptProjectPack(cfg, sessionId, body, res) {
-  sendJson(res, 200, adoptProjectPack2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.name ?? "")));
+function opsListAdoptableProjectPacks(cfg, sessionId, project2) {
+  return listAdoptableProjectPacks2(cfg, sessionId, project2);
 }
-function opsGetPackPolicy(cfg, sessionId, res) {
-  sendJson(res, 200, getPackPolicy2(cfg, sessionId));
+function opsAdoptProjectPack(cfg, sessionId, project2, name) {
+  return adoptProjectPack2(cfg, sessionId, project2, name);
 }
-function opsSetPackPolicy(cfg, sessionId, body, res) {
-  sendJson(res, 200, setPackPolicy2(cfg, sessionId, body));
+function opsGetPackPolicy(cfg, sessionId) {
+  return getPackPolicy2(cfg, sessionId);
 }
-function opsPolicyEvaluate(cfg, sessionId, url, res) {
-  sendJson(res, 200, evaluateProjectPolicy2(cfg, sessionId, q(url, "projectId") ?? ""));
+function opsSetPackPolicy(cfg, sessionId, policy) {
+  return setPackPolicy2(cfg, sessionId, policy);
 }
-function opsPolicyReconcile(cfg, sessionId, body, res) {
-  sendJson(res, 200, reconcileProjectPolicy2(cfg, sessionId, String(body?.projectId ?? "")));
+function opsPolicyEvaluate(cfg, sessionId, projectId) {
+  return evaluateProjectPolicy2(cfg, sessionId, projectId);
 }
-function opsGetProjectConfig(cfg, sessionId, url, res) {
-  sendJson(res, 200, getProjectConfig2(cfg, sessionId, q(url, "projectId") ?? ""));
+function opsPolicyReconcile(cfg, sessionId, projectId) {
+  return reconcileProjectPolicy2(cfg, sessionId, projectId);
 }
-function opsSetProjectConfig(cfg, sessionId, body, res) {
-  sendJson(res, 200, setProjectType3(cfg, sessionId, String(body?.projectId ?? ""), String(body?.projectType ?? "")));
+function opsGetProjectConfig(cfg, sessionId, projectId) {
+  return getProjectConfig2(cfg, sessionId, projectId);
 }
-function opsListProjectProfiles(cfg, sessionId, url, res) {
-  sendJson(res, 200, { profiles: listProjectProfiles2(cfg, sessionId, q(url, "projectId") ?? "") });
+function opsSetProjectConfig(cfg, sessionId, projectId, projectType) {
+  return setProjectType3(cfg, sessionId, projectId, projectType);
 }
-function opsListProducers(cfg, sessionId, url, res) {
-  sendJson(res, 200, { producers: listProducers2(cfg, sessionId, q(url, "projectId") ?? "") });
+function opsListProjectProfiles(cfg, sessionId, project2) {
+  return listProjectProfiles2(cfg, sessionId, project2);
 }
-function opsConfigureProducer(cfg, sessionId, body, res) {
-  configureProducer2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.target ?? ""), String(body?.parentPageId ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsListProducers(cfg, sessionId, project2) {
+  return listProducers2(cfg, sessionId, project2);
 }
-function opsRemoveProducer(cfg, sessionId, body, res) {
-  removeProducer2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.target ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsConfigureProducer(cfg, sessionId, project2, target, parentPageId) {
+  configureProducer2(cfg, sessionId, project2, target, parentPageId);
 }
-async function opsRunProducer(cfg, sessionId, body, res) {
-  await produceProducer2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.target ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsRemoveProducer(cfg, sessionId, project2, target) {
+  removeProducer2(cfg, sessionId, project2, target);
 }
-function opsGitStatus(cfg, sessionId, url, res) {
-  sendJson(res, 200, getGitBinding2(cfg, sessionId, q(url, "projectId") ?? ""));
+async function opsRunProducer(cfg, sessionId, project2, target) {
+  await produceProducer2(cfg, sessionId, project2, target);
 }
-function opsGitBind(cfg, sessionId, body, res) {
-  const pat = body?.pat ? String(body.pat) : void 0;
-  sendJson(res, 200, enableGit2(cfg, sessionId, String(body?.projectId ?? ""), String(body?.remote ?? ""), String(body?.branch ?? ""), pat));
+function opsGitStatus(cfg, sessionId, project2) {
+  return getGitBinding2(cfg, sessionId, project2);
 }
-function opsGitUnbind(cfg, sessionId, body, res) {
-  disableGit2(cfg, sessionId, String(body?.projectId ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsGitBind(cfg, sessionId, project2, remote, branch, pat) {
+  return enableGit2(cfg, sessionId, project2, remote, branch, pat);
 }
-function opsGitSync(cfg, sessionId, body, res) {
-  syncGit2(cfg, sessionId, String(body?.projectId ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsGitUnbind(cfg, sessionId, project2) {
+  disableGit2(cfg, sessionId, project2);
 }
-function opsGitCommit(cfg, sessionId, body, res) {
-  sendJson(
-    res,
-    200,
-    commitProject2(
-      cfg,
-      sessionId,
-      String(body?.projectId ?? ""),
-      typeof body?.subsystem === "string" && body.subsystem ? body.subsystem : void 0,
-      typeof body?.message === "string" && body.message ? body.message : void 0
-    )
-  );
+function opsGitSync(cfg, sessionId, project2) {
+  syncGit2(cfg, sessionId, project2);
 }
-function opsGitSyncConfig(cfg, sessionId, body, res) {
-  configureGitSync2(
-    cfg,
-    sessionId,
-    String(body?.projectId ?? ""),
-    typeof body?.periodicSyncMinutes === "number" ? body.periodicSyncMinutes : void 0,
-    typeof body?.skipIfClean === "boolean" ? body.skipIfClean : void 0
-  );
-  sendJson(res, 200, { ok: true });
+function opsGitCommit(cfg, sessionId, project2, subsystem, message) {
+  return commitProject2(cfg, sessionId, project2, subsystem, message);
 }
-function opsListGitBacking(cfg, sessionId, res) {
-  sendJson(res, 200, { bindings: listBackingBindings2(cfg, sessionId) });
+function opsGitSyncConfig(cfg, sessionId, project2, periodicSyncMinutes, skipIfClean) {
+  configureGitSync2(cfg, sessionId, project2, periodicSyncMinutes, skipIfClean);
 }
-function opsBindGitBacking(cfg, sessionId, body, res) {
-  const pat = body?.pat ? String(body.pat) : void 0;
-  const binding = { ...body ?? {} };
-  delete binding.pat;
-  sendJson(res, 200, bindBackingScope(cfg, sessionId, binding, pat));
+function opsListGitBacking(cfg, sessionId) {
+  return listBackingBindings2(cfg, sessionId);
 }
-function opsUnbindGitBacking(cfg, sessionId, body, res) {
-  unbindBackingScope(cfg, sessionId, String(body?.id ?? ""));
-  sendJson(res, 200, { ok: true });
+function opsBindGitBacking(cfg, sessionId, binding, pat) {
+  return bindBackingScope(cfg, sessionId, binding, pat);
 }
-function opsSyncGitBacking(cfg, sessionId, body, res) {
-  sendJson(res, 200, { published: syncBackingScope(cfg, sessionId, String(body?.id ?? "")) });
+function opsUnbindGitBacking(cfg, sessionId, bindingId) {
+  unbindBackingScope(cfg, sessionId, bindingId);
+}
+function opsSyncGitBacking(cfg, sessionId, bindingId) {
+  return syncBackingScope(cfg, sessionId, bindingId);
 }
 function auditQueryFrom(url) {
   const query = {};
@@ -45578,17 +45512,17 @@ function auditQueryFrom(url) {
   if (limit !== void 0) query.limit = Number(limit);
   return query;
 }
-function opsAuditQuery(cfg, sessionId, url, res) {
-  sendJson(res, 200, { events: queryAuditEvents3(cfg, sessionId, auditQueryFrom(url)) });
+function opsAuditQuery(cfg, sessionId, query) {
+  return queryAuditEvents3(cfg, sessionId, query);
 }
-function opsAuditCount(cfg, sessionId, url, res) {
-  sendJson(res, 200, { count: countAuditEvents3(cfg, sessionId, auditQueryFrom(url)) });
+function opsAuditCount(cfg, sessionId, query) {
+  return countAuditEvents3(cfg, sessionId, query);
 }
-function opsGetExposure(cfg, sessionId, res) {
-  sendJson(res, 200, getExposurePolicy2(cfg, sessionId));
+function opsGetExposure(cfg, sessionId) {
+  return getExposurePolicy2(cfg, sessionId);
 }
-function opsSetExposure(cfg, sessionId, body, res) {
-  sendJson(res, 200, setExposurePolicy2(cfg, sessionId, body));
+function opsSetExposure(cfg, sessionId, policy) {
+  return setExposurePolicy2(cfg, sessionId, policy);
 }
 async function handleWebRequest(cfg, req, res, body, url, ctx) {
   const parts = url.pathname.split("/").filter(Boolean).map(decodeURIComponent);
@@ -45635,7 +45569,13 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       return sendJson(res, 200, getLoginOptions(cfg));
     }
     if (req.method === "POST" && parts.length === 2 && parts[1] === "login") {
-      return loginWithPassword(cfg, body, res, ctx.secureCookie);
+      const loginSessionId = loginWithPassword(cfg, String(body?.user ?? ""), String(body?.password ?? ""));
+      res.writeHead(200, {
+        "content-type": "application/json",
+        "set-cookie": setSessionCookie(loginSessionId, ctx.secureCookie)
+      });
+      res.end(JSON.stringify({ ok: true }));
+      return;
     }
     if (req.method === "POST" && parts.length === 2 && parts[1] === "logout") {
       signOut(cfg, sessionId);
@@ -45678,223 +45618,310 @@ async function handleWebRequest(cfg, req, res, body, url, ctx) {
       return;
     }
     if (req.method === "GET" && parts.length === 2 && parts[1] === "tokens") {
-      return listAgentTokens(cfg, sessionId, res);
+      return sendJson(res, 200, { tokens: listAgentTokens(cfg, sessionId) });
     }
     if (req.method === "POST" && parts.length === 2 && parts[1] === "tokens") {
-      return mintAgentToken(cfg, sessionId, body, res);
+      const token = mintAgentToken(cfg, sessionId, String(body?.projectId ?? ""), body?.write === true);
+      return sendJson(res, 201, { token });
     }
     if (req.method === "POST" && parts.length === 3 && parts[1] === "tokens" && parts[2] === "revoke") {
-      return revokeAgentToken(cfg, sessionId, body, res);
+      revokeAgentToken(cfg, sessionId, String(body?.id ?? ""));
+      return sendJson(res, 200, { ok: true });
     }
     if (parts.length >= 2 && parts[1] === "projects") {
       if (req.method === "GET" && parts.length === 2) {
-        return projectList(cfg, sessionId, res);
+        return sendJson(res, 200, { projects: projectList(cfg, sessionId) });
       }
       if (req.method === "POST" && parts.length === 2) {
-        return projectCreate(cfg, sessionId, body, res);
+        return sendJson(
+          res,
+          201,
+          projectCreate(
+            cfg,
+            sessionId,
+            String(body?.id ?? ""),
+            String(body?.unitId ?? ""),
+            body?.profileSelection
+          )
+        );
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "lock") {
-        return projectLock(cfg, sessionId, body, res);
+        return sendJson(res, 200, projectLock(cfg, sessionId, String(body?.projectId ?? "")));
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "destroy") {
-        return projectDestroy(cfg, sessionId, body, res);
+        projectDestroy(cfg, sessionId, String(body?.id ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "packs") {
-        return opsListProjectPacks(cfg, sessionId, url, res);
+        return sendJson(res, 200, { packs: opsListProjectPacks(cfg, sessionId, q(url, "projectId") ?? "") });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "packs") {
-        return opsInstallProjectPack(cfg, sessionId, body, res);
+        return sendJson(res, 200, opsInstallProjectPack(cfg, sessionId, String(body?.projectId ?? ""), String(body?.name ?? ""), String(body?.content ?? "")));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "packs" && parts[3] === "upload") {
-        return opsInstallProjectPackArchive(cfg, sessionId, req, url, body, res);
+        return sendJson(res, 200, opsInstallProjectPackArchive(cfg, sessionId, q(url, "projectId") ?? "", archiveBody(body), packNameOverride(req)));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "packs" && parts[3] === "remove") {
-        return opsRemoveProjectPack(cfg, sessionId, body, res);
+        opsRemoveProjectPack(cfg, sessionId, String(body?.projectId ?? ""), String(body?.name ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "GET" && parts.length === 4 && parts[2] === "packs" && parts[3] === "adoptable") {
-        return opsListAdoptableProjectPacks(cfg, sessionId, url, res);
+        return sendJson(res, 200, { packs: opsListAdoptableProjectPacks(cfg, sessionId, q(url, "projectId") ?? "") });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "packs" && parts[3] === "adopt") {
-        return opsAdoptProjectPack(cfg, sessionId, body, res);
+        return sendJson(res, 200, opsAdoptProjectPack(cfg, sessionId, String(body?.projectId ?? ""), String(body?.name ?? "")));
       }
       if (req.method === "GET" && parts.length === 4 && parts[2] === "tree" && parts[3] === "export") {
-        return opsExportProjectTree(cfg, sessionId, url, res);
+        const result = opsExportProjectTree(
+          cfg,
+          sessionId,
+          q(url, "projectId") ?? "",
+          void 0,
+          q(url, "includeDerived") === "1",
+          q(url, "allowPartial") === "1"
+        );
+        res.writeHead(200, {
+          "content-type": "application/zip",
+          "content-disposition": `attachment; filename="${result.suggestedFileName}"`
+        });
+        res.end(Buffer.from(result.archive));
+        return;
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "tree" && parts[3] === "import") {
-        return opsImportProjectTree(cfg, sessionId, url, body, res);
+        return sendJson(
+          res,
+          200,
+          opsImportProjectTree(
+            cfg,
+            sessionId,
+            q(url, "projectId") ?? "",
+            archiveBody(body),
+            void 0,
+            q(url, "replace") === "1"
+          )
+        );
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "config") {
-        return opsGetProjectConfig(cfg, sessionId, url, res);
+        return sendJson(res, 200, opsGetProjectConfig(cfg, sessionId, q(url, "projectId") ?? ""));
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "config") {
-        return opsSetProjectConfig(cfg, sessionId, body, res);
+        return sendJson(res, 200, opsSetProjectConfig(cfg, sessionId, String(body?.projectId ?? ""), String(body?.projectType ?? "")));
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "profiles") {
-        return opsListProjectProfiles(cfg, sessionId, url, res);
+        return sendJson(res, 200, { profiles: opsListProjectProfiles(cfg, sessionId, q(url, "projectId") ?? "") });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "policy") {
-        return opsPolicyEvaluate(cfg, sessionId, url, res);
+        return sendJson(res, 200, opsPolicyEvaluate(cfg, sessionId, q(url, "projectId") ?? ""));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "policy" && parts[3] === "reconcile") {
-        return opsPolicyReconcile(cfg, sessionId, body, res);
+        return sendJson(res, 200, opsPolicyReconcile(cfg, sessionId, String(body?.projectId ?? "")));
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "producers") {
-        return opsListProducers(cfg, sessionId, url, res);
+        return sendJson(res, 200, { producers: opsListProducers(cfg, sessionId, q(url, "projectId") ?? "") });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "producers") {
-        return opsConfigureProducer(cfg, sessionId, body, res);
+        opsConfigureProducer(cfg, sessionId, String(body?.projectId ?? ""), String(body?.target ?? ""), String(body?.parentPageId ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "producers" && parts[3] === "remove") {
-        return opsRemoveProducer(cfg, sessionId, body, res);
+        opsRemoveProducer(cfg, sessionId, String(body?.projectId ?? ""), String(body?.target ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "producers" && parts[3] === "run") {
-        return opsRunProducer(cfg, sessionId, body, res);
+        await opsRunProducer(cfg, sessionId, String(body?.projectId ?? ""), String(body?.target ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "git") {
-        return opsGitStatus(cfg, sessionId, url, res);
+        return sendJson(res, 200, opsGitStatus(cfg, sessionId, q(url, "projectId") ?? ""));
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "git") {
-        return opsGitBind(cfg, sessionId, body, res);
+        const pat = body?.pat ? String(body.pat) : void 0;
+        return sendJson(res, 200, opsGitBind(cfg, sessionId, String(body?.projectId ?? ""), String(body?.remote ?? ""), String(body?.branch ?? ""), pat));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "git" && parts[3] === "disconnect") {
-        return opsGitUnbind(cfg, sessionId, body, res);
+        opsGitUnbind(cfg, sessionId, String(body?.projectId ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "git" && parts[3] === "sync") {
-        return opsGitSync(cfg, sessionId, body, res);
+        opsGitSync(cfg, sessionId, String(body?.projectId ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "git" && parts[3] === "commit") {
-        return opsGitCommit(cfg, sessionId, body, res);
+        return sendJson(
+          res,
+          200,
+          opsGitCommit(
+            cfg,
+            sessionId,
+            String(body?.projectId ?? ""),
+            typeof body?.subsystem === "string" && body.subsystem ? body.subsystem : void 0,
+            typeof body?.message === "string" && body.message ? body.message : void 0
+          )
+        );
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "git" && parts[3] === "sync-config") {
-        return opsGitSyncConfig(cfg, sessionId, body, res);
+        opsGitSyncConfig(
+          cfg,
+          sessionId,
+          String(body?.projectId ?? ""),
+          typeof body?.periodicSyncMinutes === "number" ? body.periodicSyncMinutes : void 0,
+          typeof body?.skipIfClean === "boolean" ? body.skipIfClean : void 0
+        );
+        return sendJson(res, 200, { ok: true });
       }
     }
     if (parts.length >= 2 && parts[1] === "admin") {
       if (req.method === "GET" && parts.length === 3 && parts[2] === "users") {
-        return adminListUsers(cfg, sessionId, url, res);
+        const project2 = url.searchParams.get("project") ?? void 0;
+        return sendJson(res, 200, { users: adminListUsers(cfg, sessionId, project2) });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "users" && parts[3] === "status") {
-        return adminSetUserStatus(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminSetUserStatus(cfg, sessionId, String(body?.userId ?? ""), String(body?.status ?? "")));
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "users") {
-        return adminUpsertUser(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminUpsertUser(cfg, sessionId, body));
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "providers") {
-        return adminListProviders(cfg, sessionId, res);
+        return sendJson(res, 200, { providers: adminListProviders(cfg, sessionId) });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "providers" && parts[3] === "remove") {
-        return adminRemoveProvider(cfg, sessionId, body, res);
+        adminRemoveProvider(cfg, sessionId, String(body?.id ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "providers") {
-        return adminUpsertProvider(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminUpsertProvider(cfg, sessionId, body));
       }
       if (req.method === "GET" && parts.length === 4 && parts[2] === "org" && parts[3] === "units") {
-        return adminListOrgUnits(cfg, sessionId, res);
+        return sendJson(res, 200, { units: adminListOrgUnits(cfg, sessionId) });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "secrets") {
-        return adminListSecretRefs(cfg, sessionId, res);
+        return sendJson(res, 200, { refs: adminListSecretRefs(cfg, sessionId) });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "secrets") {
-        return adminSetSecret(cfg, sessionId, body, res);
+        adminSetSecret(cfg, sessionId, String(body?.key ?? ""), String(body?.value ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "org" && parts[3] === "units") {
-        return adminUpsertOrgUnit(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminUpsertOrgUnit(cfg, sessionId, body));
       }
       if (req.method === "POST" && parts.length === 5 && parts[2] === "org" && parts[3] === "units" && parts[4] === "remove") {
-        return adminRemoveUnit(cfg, sessionId, body, res);
+        adminRemoveUnit(cfg, sessionId, String(body?.unitId ?? ""), body?.disposition ?? {});
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "org" && parts[3] === "placements") {
-        return adminPlaceProject(cfg, sessionId, body, res);
+        adminPlaceProject(cfg, sessionId, String(body?.projectId ?? ""), String(body?.unitId ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "roles") {
-        return adminListRoles(cfg, sessionId, res);
+        return sendJson(res, 200, { roles: adminListRoles(cfg, sessionId) });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "roles") {
-        return adminCreateRole(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminCreateRole(cfg, sessionId, body));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "roles" && parts[3] === "update") {
-        return adminUpdateRole(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminUpdateRole(cfg, sessionId, body));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "roles" && parts[3] === "remove") {
-        return adminDeleteRole(cfg, sessionId, body, res);
+        adminDeleteRole(cfg, sessionId, String(body?.id ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "roles" && parts[3] === "bind") {
-        return adminBindRole(cfg, sessionId, body, res);
+        const scope = bodyScope(body);
+        return sendJson(res, 200, adminBindRole(cfg, sessionId, String(body?.userId ?? ""), String(body?.roleId ?? ""), scope.scopeKind, scope.scopeId));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "roles" && parts[3] === "unbind") {
-        return adminUnbindRole(cfg, sessionId, body, res);
+        const scope = bodyScope(body);
+        return sendJson(res, 200, adminUnbindRole(cfg, sessionId, String(body?.userId ?? ""), String(body?.roleId ?? ""), scope.scopeKind, scope.scopeId));
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "permissions") {
-        return adminListAssignments(cfg, sessionId, url, res);
+        const q2 = (name) => url.searchParams.get(name) ?? void 0;
+        return sendJson(res, 200, {
+          assignments: adminListAssignments(
+            cfg,
+            sessionId,
+            q2("scopeKind"),
+            q2("scopeId"),
+            q2("subjectKind"),
+            q2("subjectId")
+          )
+        });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "permissions") {
-        return adminSetAssignment(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminSetAssignment(cfg, sessionId, body));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "permissions" && parts[3] === "remove") {
-        return adminRemoveAssignment(cfg, sessionId, body, res);
+        adminRemoveAssignment(cfg, sessionId, String(body?.id ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "packs") {
-        return opsListGlobalPacks(cfg, sessionId, res);
+        return sendJson(res, 200, { packs: opsListGlobalPacks(cfg, sessionId) });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "packs") {
-        return opsInstallGlobalPack(cfg, sessionId, body, res);
+        return sendJson(res, 200, opsInstallGlobalPack(cfg, sessionId, String(body?.name ?? ""), String(body?.content ?? "")));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "packs" && parts[3] === "upload") {
-        return opsInstallGlobalPackArchive(cfg, sessionId, req, body, res);
+        return sendJson(res, 200, opsInstallGlobalPackArchive(cfg, sessionId, archiveBody(body), packNameOverride(req)));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "packs" && parts[3] === "remove") {
-        return opsRemoveGlobalPack(cfg, sessionId, body, res);
+        opsRemoveGlobalPack(cfg, sessionId, String(body?.name ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "profiles") {
-        return opsListAvailableProfiles(cfg, sessionId, res);
+        return sendJson(res, 200, { profiles: opsListAvailableProfiles(cfg, sessionId) });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "policy") {
-        return opsGetPackPolicy(cfg, sessionId, res);
+        return sendJson(res, 200, opsGetPackPolicy(cfg, sessionId));
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "policy") {
-        return opsSetPackPolicy(cfg, sessionId, body, res);
+        return sendJson(res, 200, opsSetPackPolicy(cfg, sessionId, body));
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "audit") {
-        return opsAuditQuery(cfg, sessionId, url, res);
+        return sendJson(res, 200, { events: opsAuditQuery(cfg, sessionId, auditQueryFrom(url)) });
       }
       if (req.method === "GET" && parts.length === 4 && parts[2] === "audit" && parts[3] === "count") {
-        return opsAuditCount(cfg, sessionId, url, res);
+        return sendJson(res, 200, { count: opsAuditCount(cfg, sessionId, auditQueryFrom(url)) });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "exposure") {
-        return opsGetExposure(cfg, sessionId, res);
+        return sendJson(res, 200, opsGetExposure(cfg, sessionId));
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "exposure") {
-        return opsSetExposure(cfg, sessionId, body, res);
+        return sendJson(res, 200, opsSetExposure(cfg, sessionId, body));
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "git-backing") {
-        return opsListGitBacking(cfg, sessionId, res);
+        return sendJson(res, 200, { bindings: opsListGitBacking(cfg, sessionId) });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "git-backing") {
-        return opsBindGitBacking(cfg, sessionId, body, res);
+        const pat = body?.pat ? String(body.pat) : void 0;
+        const binding = { ...body ?? {} };
+        delete binding.pat;
+        return sendJson(res, 200, opsBindGitBacking(cfg, sessionId, binding, pat));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "git-backing" && parts[3] === "remove") {
-        return opsUnbindGitBacking(cfg, sessionId, body, res);
+        opsUnbindGitBacking(cfg, sessionId, String(body?.id ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "git-backing" && parts[3] === "sync") {
-        return opsSyncGitBacking(cfg, sessionId, body, res);
+        return sendJson(res, 200, { published: opsSyncGitBacking(cfg, sessionId, String(body?.id ?? "")) });
       }
       if (req.method === "POST" && parts.length === 3 && parts[2] === "share") {
-        return adminCreateShareLink(cfg, sessionId, body, res);
+        return sendJson(res, 201, adminCreateShareLink(cfg, sessionId, body ?? {}));
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "share") {
-        return adminListShareLinks(cfg, sessionId, url, res);
+        return sendJson(res, 200, { links: adminListShareLinks(cfg, sessionId, url.searchParams.get("projectId") ?? "") });
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "share" && parts[3] === "refresh") {
-        return adminRefreshShareSnapshot(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminRefreshShareSnapshot(cfg, sessionId, String(body?.linkId ?? "")));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "share" && parts[3] === "update") {
-        return adminUpdateShareLink(cfg, sessionId, body, res);
+        return sendJson(res, 200, adminUpdateShareLink(cfg, sessionId, String(body?.linkId ?? ""), body?.changes ?? {}));
       }
       if (req.method === "POST" && parts.length === 4 && parts[2] === "share" && parts[3] === "remove") {
-        return adminRemoveShareLink(cfg, sessionId, body, res);
+        adminRemoveShareLink(cfg, sessionId, String(body?.linkId ?? ""));
+        return sendJson(res, 200, { ok: true });
       }
       if (req.method === "GET" && parts.length === 4 && parts[2] === "share" && parts[3] === "access") {
-        return adminGetShareAccessLog(cfg, sessionId, url, res);
+        const limit = Number(url.searchParams.get("limit") ?? "100") || 100;
+        return sendJson(res, 200, { entries: adminGetShareAccessLog(cfg, sessionId, url.searchParams.get("linkId") ?? "", limit) });
       }
       if (req.method === "GET" && parts.length === 3 && parts[2] === "landscape") {
         return sendJson(res, 200, generateLandscape(cfg, sessionId));
@@ -46833,6 +46860,7 @@ var WEB_MUTATION_PATHS = /* @__PURE__ */ new Set([
   "/web/projects/git/sync",
   "/web/projects/git/commit",
   "/web/projects/git/sync-config",
+  "/web/projects/config",
   "/web/tokens",
   "/web/tokens/revoke",
   "/web/projects",