bunqueue-dashboard 0.0.36 → 0.0.37

package/agent/server/router.ts

@@ -1,12 +1,14 @@
 import { routeBackupRequest } from '../backup/routes';
 import type { BackupRunnerPort } from '../backup/runner';
 import { routeFlowRequest } from '../flow/routes';
+import type { ManagedTargetPolicy } from '../managedTarget';
 import type { ProcessManager } from '../manager';
 import { routeQueueOperationsRequest } from '../queue/routes';
 import type { QueueOperationsPort } from '../queue/types';
 import type { WorkflowRuntimePort } from '../workflow/runtime';
 import { routeWorkflowRuntimeRequest } from '../workflow/runtimeRoutes';
-import { routeControlRequest } from './controlRoutes';
+import { assertManagedControl, routeControlRequest } from './controlRoutes';
+import type { ServerControlTarget } from './controlTarget';
 import { routeDatabaseRequest } from './databaseRoutes';
 import type { AgentLifecyclePort } from './lifecycle';
 import { managedRuntimeAdmission } from './managedRuntime';
@@ -23,7 +25,9 @@ export async function routeAgentRequest(
   queueRuntime: QueueOperationsPort,
   lifecycle: AgentLifecyclePort,
   origin: string | null,
-  allowedOrigins: string[]
+  allowedOrigins: string[],
+  controlTarget: ServerControlTarget,
+  managedTargetPolicy?: ManagedTargetPolicy
 ): Promise<RouteResponse | Response | null> {
   if (pathname.startsWith('/control/')) {
     const control = await routeControlRequest(
@@ -32,7 +36,8 @@ export async function routeAgentRequest(
       method,
       manager,
       runtime,
-      lifecycle
+      lifecycle,
+      controlTarget
     );
     if (control) return control;
   }
@@ -47,7 +52,7 @@ export async function routeAgentRequest(
       method,
       managedConfig,
       snapshot.status === 'running',
-      { admission }
+      { admission, targetPolicy: managedTargetPolicy }
     );
     if (flow) return flow;
   }
@@ -62,7 +67,8 @@ export async function routeAgentRequest(
       managedConfig,
       runtime,
       snapshot.status === 'running',
-      admission
+      admission,
+      managedTargetPolicy
     );
     if (workflowRuntime) return workflowRuntime;
   }
@@ -84,13 +90,15 @@ export async function routeAgentRequest(
       managedConfig,
       queueRuntime,
       snapshot.status === 'running',
-      admission
+      admission,
+      managedTargetPolicy
     );
     if (queueOperation) return queueOperation;
   }
 
   if (pathname.startsWith('/backup/')) {
     if (pathname === '/backup/restore' && method === 'POST') {
+      assertManagedControl(controlTarget);
       return manager.withStoppedMaintenance('restoring a backup', async () => {
         const stoppedSnapshot = manager.getStatus();
         const restoreDesired = manager.getConfig();
@@ -105,7 +113,9 @@ export async function routeAgentRequest(
           restoreConfig,
           stoppedSnapshot.status === 'running',
           await manager.dbStats(),
-          backupRunner
+          backupRunner,
+          undefined,
+          managedTargetPolicy
         );
       });
     }
@@ -119,7 +129,8 @@ export async function routeAgentRequest(
       snapshot.status === 'running',
       database,
       backupRunner,
-      (extraEnv) => manager.setConfig({ extraEnv })
+      (extraEnv) => manager.setConfig({ extraEnv }),
+      managedTargetPolicy
     );
     if (backup) return backup;
   }

package/agent/server/types.ts

@@ -1,4 +1,5 @@
 import type { WorkflowRuntimePort } from '../workflow/runtime';
+import type { ServerControlTarget } from './controlTarget';
 
 export interface AgentOptions {
   allowedOrigins: string[];
@@ -8,6 +9,12 @@ export interface AgentOptions {
   token?: string;
   /** Network exposure: require token on every non-OPTIONS request. */
   requireTokenForAll?: boolean;
+  /** Managed child by default; external mode makes lifecycle routes attach-only. */
+  controlTarget?: ServerControlTarget;
+  /** Exact browser-visible `/api` alias accepted by target-pinned agent routes. */
+  managedProxyPath?: string;
+  /** Upstream URL the alias must resolve to; it still passes the local-target gate. */
+  managedProxyUrl?: string;
 }
 
 export interface AgentFetchHandler {

package/agent/server.ts

@@ -6,6 +6,16 @@
  * agent/server/; this file preserves the existing public import path.
  */
 export { createFetchHandler } from './server/handler';
+export {
+  MANAGED_CONTROL_TARGET,
+  probeExternalHealth,
+  resolveServerControlTarget,
+} from './server/controlTarget';
+export type {
+  ExternalHealthProbe,
+  ServerControlTarget,
+  ServerManagementMode,
+} from './server/controlTarget';
 export { AgentLifecycleGate } from './server/lifecycle';
 export type { AgentLifecyclePort } from './server/lifecycle';
 export {

package/agent/workflow/runtimeRoutes.ts

@@ -1,5 +1,5 @@
 import type { ExecutionState } from 'bunqueue/workflow';
-import { assertManagedTarget } from '../managedTarget';
+import { assertManagedTarget, type ManagedTargetPolicy } from '../managedTarget';
 import type { ServerConfig } from '../manager';
 import { readLimitedJsonBody } from '../server/jsonBody';
 import type {
@@ -24,17 +24,18 @@ export async function routeWorkflowRuntimeRequest(
   config: ServerConfig,
   runtime: WorkflowRuntimePort,
   serverRunning: boolean,
-  admission?: ManagedRuntimeAdmission
+  admission?: ManagedRuntimeAdmission,
+  targetPolicy?: ManagedTargetPolicy
 ): Promise<WorkflowRuntimeRouteResponse | null> {
   if (!isRuntimePath(pathname, method)) return null;
   const query = exactTargetQuery(request.url);
-  assertManagedTarget(query, config);
+  assertManagedTarget(query, config, targetPolicy);
   const admitted = <T>(
     requiresRunning: boolean,
     operation: (snapshot: ManagedRuntimeSnapshot) => Promise<T>
   ): Promise<T> => {
     const execute = async (snapshot: ManagedRuntimeSnapshot) => {
-      assertManagedTarget(query, snapshot.config);
+      assertManagedTarget(query, snapshot.config, targetPolicy);
       if (requiresRunning && !snapshot.running) {
         throw new Error('Start the managed Bunqueue server before workflow control.');
       }

package/agent/workflows.ts

@@ -1,5 +1,5 @@
 /**
- * Read-only facade for Bunqueue 2.8.57 Workflow Engine observability.
+ * Read-only facade for Bunqueue 2.8.59 Workflow Engine observability.
  * Persistence, decoding and validation live behind this stable public module.
  */
 export { workflowExecution } from './workflow/detail';