crewly 1.20.209 → 1.20.210

package/dist/backend/backend/src/controllers/apps/apps.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.controller.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/apps/apps.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa,EAAE,GAAY;IACvD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,qBAAqB,CAAC,WAAW,CAAC,aAAa;YAC1D,CAAC,CAAC,+EAA+E;YACjF,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW;gBACxB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,SAAS,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAClH,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;AAClI,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,EAA0D,EAAE,MAAM,GAAG,GAAG;IACtF,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAAY,EAA2B,EAAE,CACrD,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAEpH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,OAAO,CACjD,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAClH,MAAM,CACP,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC,CAAC;IAC/I,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,mDAAmD;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjI,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAEtF,oCAAoC;AACpC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/G,wDAAwD;AACxD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7C,YAAY,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CACrI,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAEnJ,mDAAmD;AACnD,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEhJ,8DAA8D;AAC9D,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC3C,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CACjH,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9H,CAAC,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC"}

package/dist/backend/backend/src/controllers/apps/apps.routes.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Crewly Apps routes — mounted at `/api/apps`. Owner or a verified agent
+ * (badge / process tree) only (specs/2026-10-04-crewly-apps-p2.md §1).
+ *
+ * - POST   /publish                                — publish a bundle (find/create the app)
+ * - GET    /                                       — apps of the caller (owner: all)
+ * - POST   /:appId/rollback                        — `{ version }`
+ * - GET    /:appId/versions                        — versions, newest first
+ * - GET    /:appId/data/:collection                — `?limit&after`
+ * - POST   /:appId/data/:collection                — add `{ data }`
+ * - GET    /:appId/data/:collection/:docId         — one doc
+ * - PUT    /:appId/data/:collection/:docId         — replace `{ data }`
+ * - PATCH  /:appId/data/:collection/:docId         — merge `{ data, ifRev? }`
+ * - DELETE /:appId/data/:collection/:docId         — delete
+ *
+ * The publish body is skipped by the app-wide parsers (index.ts) and parsed
+ * here, after the caller check, so an unauthenticated client cannot make the
+ * server buffer a large body.
+ *
+ * @module controllers/apps/apps.routes
+ */
+import { Router, type NextFunction, type Request, type RequestHandler, type Response } from 'express';
+/**
+ * The caller gate. A refused request that declares a large body is answered
+ * with `Connection: close`, so the server stops receiving the upload rather
+ * than draining it.
+ *
+ * @param gate - The identity gate
+ * @returns Middleware
+ */
+export declare function gateClosingLargeRejects(gate: RequestHandler): RequestHandler;
+/**
+ * Refuse a publish whose declared size is over the limit before reading it.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export declare function rejectOversizedPublish(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Creates the Crewly Apps router.
+ *
+ * @returns Express router
+ */
+export declare function createAppsRouter(): Router;
+//# sourceMappingURL=apps.routes.d.ts.map

package/dist/backend/backend/src/controllers/apps/apps.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.routes.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/apps/apps.routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAgB,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAmB/G;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAS5E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAQ5F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAczC"}

package/dist/backend/backend/src/controllers/apps/apps.routes.js

@@ -0,0 +1,94 @@
+/**
+ * Crewly Apps routes — mounted at `/api/apps`. Owner or a verified agent
+ * (badge / process tree) only (specs/2026-10-04-crewly-apps-p2.md §1).
+ *
+ * - POST   /publish                                — publish a bundle (find/create the app)
+ * - GET    /                                       — apps of the caller (owner: all)
+ * - POST   /:appId/rollback                        — `{ version }`
+ * - GET    /:appId/versions                        — versions, newest first
+ * - GET    /:appId/data/:collection                — `?limit&after`
+ * - POST   /:appId/data/:collection                — add `{ data }`
+ * - GET    /:appId/data/:collection/:docId         — one doc
+ * - PUT    /:appId/data/:collection/:docId         — replace `{ data }`
+ * - PATCH  /:appId/data/:collection/:docId         — merge `{ data, ifRev? }`
+ * - DELETE /:appId/data/:collection/:docId         — delete
+ *
+ * The publish body is skipped by the app-wide parsers (index.ts) and parsed
+ * here, after the caller check, so an unauthenticated client cannot make the
+ * server buffer a large body.
+ *
+ * @module controllers/apps/apps.routes
+ */
+import express, { Router } from 'express';
+import { ownerOrVerifiedAgent } from '../../middleware/caller-identity.middleware.js';
+import { CREWLY_APPS_CONSTANTS } from '../../constants.js';
+import { publishApp, listApps, rollbackApp, listVersions, listDocs, addDoc, getDoc, setDoc, updateDoc, deleteDoc } from './apps.controller.js';
+const C = CREWLY_APPS_CONSTANTS;
+/**
+ * The declared body size, or null when the request does not say.
+ *
+ * @param req - Request
+ * @returns Bytes or null
+ */
+function declaredLength(req) {
+    const raw = req.headers['content-length'];
+    const n = typeof raw === 'string' ? Number(raw) : NaN;
+    return Number.isFinite(n) && n >= 0 ? n : null;
+}
+/**
+ * The caller gate. A refused request that declares a large body is answered
+ * with `Connection: close`, so the server stops receiving the upload rather
+ * than draining it.
+ *
+ * @param gate - The identity gate
+ * @returns Middleware
+ */
+export function gateClosingLargeRejects(gate) {
+    return (req, res, next) => {
+        const large = (declaredLength(req) ?? 0) > C.PUBLISH_CLOSE_ABOVE_BYTES || req.headers['transfer-encoding'] !== undefined;
+        if (large)
+            res.setHeader('Connection', 'close');
+        gate(req, res, (err) => {
+            if (large)
+                res.removeHeader('Connection');
+            next(err);
+        });
+    };
+}
+/**
+ * Refuse a publish whose declared size is over the limit before reading it.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export function rejectOversizedPublish(req, res, next) {
+    const n = declaredLength(req);
+    if (n !== null && n > C.PUBLISH_BODY_MAX_BYTES) {
+        res.setHeader('Connection', 'close');
+        res.status(413).json({ success: false, error: 'too_large', message: `A publish can be at most ${C.PUBLISH_BODY_LIMIT}.` });
+        return;
+    }
+    next();
+}
+/**
+ * Creates the Crewly Apps router.
+ *
+ * @returns Express router
+ */
+export function createAppsRouter() {
+    const router = Router();
+    router.use(gateClosingLargeRejects(ownerOrVerifiedAgent('Crewly Apps')));
+    router.post('/publish', rejectOversizedPublish, express.json({ limit: C.PUBLISH_BODY_LIMIT }), publishApp);
+    router.get('/', listApps);
+    router.post('/:appId/rollback', rollbackApp);
+    router.get('/:appId/versions', listVersions);
+    router.get('/:appId/data/:collection', listDocs);
+    router.post('/:appId/data/:collection', addDoc);
+    router.get('/:appId/data/:collection/:docId', getDoc);
+    router.put('/:appId/data/:collection/:docId', setDoc);
+    router.patch('/:appId/data/:collection/:docId', updateDoc);
+    router.delete('/:appId/data/:collection/:docId', deleteDoc);
+    return router;
+}
+//# sourceMappingURL=apps.routes.js.map

package/dist/backend/backend/src/controllers/apps/apps.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.routes.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/apps/apps.routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,OAAO,EAAE,EAAE,MAAM,EAAuE,MAAM,SAAS,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE/I,MAAM,CAAC,GAAG,qBAAqB,CAAC;AAEhC;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAoB;IAC1D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,yBAAyB,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;QACzH,IAAI,KAAK;YAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAa,EAAE,EAAE;YAC/B,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACpF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,CAAC,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QAC3H,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3G,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,CAAC,MAAM,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/backend/backend/src/index.d.ts

@@ -306,6 +306,7 @@ export declare class CrewlyServer {
      * @param tokenUsage - The ledger
      */
     private startRuntimeUsageSyncs;
+    private startCrewlyApps;
     private startDecisionCards;
     private startOwnerMessageWatchdog;
     /**

package/dist/backend/backend/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AA4CA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA+SjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IACnF,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAC,CAAyD;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,eAAe,CAAmB;IAC1C,qEAAqE;IACrE,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,sBAAsB,CAAiD;IAC/E,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,kGAAkG;IAClG,OAAO,CAAC,sBAAsB,CAAuC;IAGrE,OAAO,CAAC,+BAA+B,CAAgD;IACvF,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAAqC;IACjE,8HAA8H;IAC9H,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,OAAO,CAAC,6BAA6B,CAA8C;IACnF,OAAO,CAAC,wBAAwB,CAAyC;IACzE,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAChE,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,kBAAkB,CAA0C;IAKpE,OAAO,CAAC,aAAa,CAAuE;IAC5F,OAAO,CAAC,gBAAgB,CAET;IAGf,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAA2G;IACxI,0EAA0E;IAC1E,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,gBAAgB,CAAiG;IACzH,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAAuB;IACrD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAMhC;IACH,oGAAoG;IACpG,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAsE3C,OAAO,CAAC,kBAAkB;IAguC1B,OAAO,CAAC,mBAAmB;IA4D3B,OAAO,CAAC,eAAe;IAsMvB,OAAO,CAAC,kBAAkB;IA0BpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAy5D5B;;;OAGG;YACW,2BAA2B;IAuCzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;OAGG;YACW,8BAA8B;IAsB5C;;;;OAIG;YACW,8BAA8B;IA8M5C;;;;;;;;;;;;OAYG;YACW,6BAA6B;IAsB3C;;;;;OAKG;YACW,iCAAiC;IA0L/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;IAsBnC;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;YAqCZ,eAAe;YAoFf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAsC9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAyEvB;;;;;;;OAOG;YACW,2BAA2B;IAWzC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA+E1B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IA4DvB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;;;;OAKG;YACW,0BAA0B;IAkExC;;;;OAIG;YACW,qBAAqB;IA6DnC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAuBlC;;;;;;OAMG;YACW,kBAAkB;IAmBhC;;;;;OAKG;YACW,8BAA8B;IA6C5C;;;;OAIG;YACW,+BAA+B;IA2C7C;;;;;;OAMG;YACW,kBAAkB;IA6BhC,OAAO,CAAC,qBAAqB;IAoC7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAoE1B;;;;;;;;;OASG;IACH;;;;;;;;;;;;;;OAcG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;;;;OAQG;IACH;;OAEG;IACH;;;;;OAKG;YACW,sBAAsB;YA4CtB,kBAAkB;YAqHlB,yBAAyB;IAyFvC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IA2BtB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAmChC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;YAkEf,wBAAwB;IAWtC,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,cAAc;IActB;;;;;;;;OAQG;IACG,QAAQ,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA4W1H,SAAS,IAAI,aAAa;CAG1B;AAmCD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AA4CA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAgTjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IACnF,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAC,CAAyD;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,eAAe,CAAmB;IAC1C,qEAAqE;IACrE,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,sBAAsB,CAAiD;IAC/E,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,kGAAkG;IAClG,OAAO,CAAC,sBAAsB,CAAuC;IAGrE,OAAO,CAAC,+BAA+B,CAAgD;IACvF,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAAqC;IACjE,8HAA8H;IAC9H,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,OAAO,CAAC,6BAA6B,CAA8C;IACnF,OAAO,CAAC,wBAAwB,CAAyC;IACzE,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAChE,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,kBAAkB,CAA0C;IAKpE,OAAO,CAAC,aAAa,CAAuE;IAC5F,OAAO,CAAC,gBAAgB,CAET;IAGf,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAA2G;IACxI,0EAA0E;IAC1E,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,gBAAgB,CAAiG;IACzH,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAAuB;IACrD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAMhC;IACH,oGAAoG;IACpG,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAsE3C,OAAO,CAAC,kBAAkB;IAguC1B,OAAO,CAAC,mBAAmB;IAuE3B,OAAO,CAAC,eAAe;IAsMvB,OAAO,CAAC,kBAAkB;IA0BpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA45D5B;;;OAGG;YACW,2BAA2B;IAuCzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;OAGG;YACW,8BAA8B;IAsB5C;;;;OAIG;YACW,8BAA8B;IA8M5C;;;;;;;;;;;;OAYG;YACW,6BAA6B;IAsB3C;;;;;OAKG;YACW,iCAAiC;IA0L/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;IAsBnC;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;YAqCZ,eAAe;YAoFf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAsC9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAyEvB;;;;;;;OAOG;YACW,2BAA2B;IAWzC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA+E1B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IA4DvB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;;;;OAKG;YACW,0BAA0B;IAkExC;;;;OAIG;YACW,qBAAqB;IA6DnC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAuBlC;;;;;;OAMG;YACW,kBAAkB;IAmBhC;;;;;OAKG;YACW,8BAA8B;IA6C5C;;;;OAIG;YACW,+BAA+B;IA2C7C;;;;;;OAMG;YACW,kBAAkB;IA6BhC,OAAO,CAAC,qBAAqB;IAoC7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAoE1B;;;;;;;;;OASG;IACH;;;;;;;;;;;;;;OAcG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;;;;OAQG;IACH;;OAEG;IACH;;;;;OAKG;YACW,sBAAsB;YA4CtB,eAAe;YAwCf,kBAAkB;YAqHlB,yBAAyB;IAyFvC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IA2BtB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAmChC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;YAkEf,wBAAwB;IAWtC,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,cAAc;IActB;;;;;;;;OAQG;IACG,QAAQ,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA6W1H,SAAS,IAAI,aAAa;CAG1B;AAmCD,eAAe,YAAY,CAAC"}

package/dist/backend/backend/src/index.js

@@ -75,7 +75,7 @@ import { parseInboundOrigin } from './services/orc/orc-reply-route.service.js';
 import { parseSlackThreadKey } from './services/slack/slack-thread-key.js';
 import { LIVENESS_MONITOR_CONSTANTS } from './constants.js';
 import { InputBlockedRetryService } from './services/messaging/input-blocked-retry.service.js';
-import { SUB_AGENT_QUEUE_CONSTANTS, CHAT_CONTEXT_CONSTANTS, SAFE_RESTART, AUTO_UPDATE_CONSTANTS, PROCESS_EXIT_CODES, CLAUDE_STARTUP_CONSTANTS, WEB_CONSTANTS, TICKET_CONSTANTS, UNASSIGNED_ROUTE_CONSTANTS, CLOUD_TALK_CONSTANTS, STANDING_ANSWERS_CONSTANTS, TICKET_AUTOPILOT_CONSTANTS, EXPERIMENT_CONSTANTS, WORK_ITEM_DESTINATION_CONSTANTS, CODEX_USAGE_SYNC_CONSTANTS, ANTIGRAVITY_USAGE_SYNC_CONSTANTS, OWNER_AUTH_CONSTANTS } from './constants.js';
+import { SUB_AGENT_QUEUE_CONSTANTS, CHAT_CONTEXT_CONSTANTS, SAFE_RESTART, AUTO_UPDATE_CONSTANTS, PROCESS_EXIT_CODES, CLAUDE_STARTUP_CONSTANTS, WEB_CONSTANTS, TICKET_CONSTANTS, UNASSIGNED_ROUTE_CONSTANTS, CLOUD_TALK_CONSTANTS, STANDING_ANSWERS_CONSTANTS, TICKET_AUTOPILOT_CONSTANTS, EXPERIMENT_CONSTANTS, WORK_ITEM_DESTINATION_CONSTANTS, CODEX_USAGE_SYNC_CONSTANTS, ANTIGRAVITY_USAGE_SYNC_CONSTANTS, OWNER_AUTH_CONSTANTS, CREWLY_APPS_CONSTANTS } from './constants.js';
 import { PtyActivityTrackerService } from './services/agent/pty-activity-tracker.service.js';
 import { InFlightTurnTracker } from './services/restart/in-flight-turn-tracker.service.js';
 import { TicketIntakeService, setTicketIntakeService, resolveTicketIdForSession, } from './services/v3/ticket-intake.service.js';
@@ -108,6 +108,7 @@ import { TokenUsageService } from './services/monitoring/token-usage.service.js'
 import { agentHeartbeatMiddleware } from './middleware/agent-heartbeat.middleware.js';
 import { agentOriginMiddleware, liveSessionPids } from './middleware/agent-origin.middleware.js';
 import { createCallerIdentityMiddleware } from './middleware/caller-identity.middleware.js';
+import { bodyParserExcept } from './middleware/body-parser-except.js';
 import { PeerProcessService } from './services/core/peer-process.service.js';
 import { createOwnerSessionPageMiddleware, createOwnerSessionRouter } from './controllers/auth/owner-session.controller.js';
 import { dashboardBuildHeader, dashboardBuildMessage, loadDashboardEntry } from './services/core/dashboard-build.js';
@@ -1550,23 +1551,27 @@ export class CrewlyServer {
         }));
         // Logging
         this.app.use(morgan(process.env.NODE_ENV === 'production' ? 'combined' : 'dev'));
+        // Crewly Apps publish (a whole bundle as base64) is NOT parsed here:
+        // these parsers run before authentication, so its router parses it with
+        // a larger limit only after the caller is the owner or a verified agent.
+        const unparsedHere = [CREWLY_APPS_CONSTANTS.PUBLISH_ROUTE];
         // Body parsing — `verify` captures the raw bytes so the error handler
         // below can log the exact payload when JSON parsing fails. Without this
         // we only see the position-of-failure, not the bytes.
-        this.app.use(express.json({
+        this.app.use(bodyParserExcept(unparsedHere, express.json({
             limit: '10mb',
             verify: (req, _res, buf) => {
                 req.rawBody = buf.toString('utf8');
             },
-        }));
-        this.app.use(express.urlencoded({
+        })));
+        this.app.use(bodyParserExcept(unparsedHere, express.urlencoded({
             extended: true,
             limit: '10mb',
             // Slack's interactive `payload=` form is verified over the exact bytes.
             verify: (req, _res, buf) => {
                 req.rawBody = buf.toString('utf8');
             },
-        }));
+        })));
         // Note: Static files are configured in configureRoutes() after API routes
     }
     configureRoutes() {
@@ -3206,6 +3211,9 @@ export class CrewlyServer {
                 // questions posted by the responsible agent's own bot, answered by
                 // button / reaction / thread reply / dashboard; deadlines applied here.
                 await this.startDecisionCards();
+                // Crewly Apps (specs/2026-10-04-crewly-apps-p2.md): the owner's edits in
+                // an app wake the agent that published it.
+                await this.startCrewlyApps();
             }
             catch (autoClaimErr) {
                 this.logger.warn('AgentAutoClaimService initialization failed (non-critical)', {
@@ -5198,6 +5206,49 @@ export class CrewlyServer {
             this.logger.warn('Antigravity usage sync not started (non-fatal)', { error: err instanceof Error ? err.message : String(err) });
         }
     }
+    async startCrewlyApps() {
+        try {
+            const { startAppWake } = await import('./services/apps/apps.wiring.js');
+            startAppWake({
+                skillsPath: path.join(findPackageRoot(__dirname), 'config', 'skills', 'agent'),
+                getTeams: () => this.storageService.getTeams(),
+                sessionExists: (session) => {
+                    try {
+                        return getSessionBackendSync()?.sessionExists(session) ?? false;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                sendToAgent: async (session, text, activate) => {
+                    let exists = false;
+                    try {
+                        exists = getSessionBackendSync()?.sessionExists(session) ?? false;
+                    }
+                    catch {
+                        exists = false;
+                    }
+                    if (!exists) {
+                        // Only the app's publisher is started; an `ask` never starts a stopped agent.
+                        if (!activate)
+                            return false;
+                        const { activateAgentBySession } = await import('./controllers/team/team.controller.js');
+                        await activateAgentBySession(this.apiController, session).catch(() => undefined);
+                    }
+                    const result = await this.apiController.agentRegistrationService.sendMessageToAgent(session, text);
+                    return result.success;
+                },
+                sendToOrchestrator: async (text) => {
+                    this.messageQueueService.enqueue({ content: text, conversationId: 'system', source: 'system_event' });
+                    return true;
+                },
+            });
+            this.logger.info('Crewly Apps change poller started');
+        }
+        catch (error) {
+            this.logger.warn('Crewly Apps change poller not started (non-critical)', { error: error instanceof Error ? error.message : String(error) });
+        }
+    }
     async startDecisionCards() {
         try {
             const { createDecisionService, attachDecisionSlackListeners, attachSkipAllCommand } = await import('./services/decisions/decision.wiring.js');
@@ -5798,6 +5849,7 @@ export class CrewlyServer {
         }
         this.logger.info('Shutting down Crewly server...', { reason: options.reason ?? 'unspecified' });
         AutoUpdateService.getInstance()?.stop();
+        void import('./services/apps/apps.wiring.js').then((m) => m.stopAppWake()).catch(() => undefined);
         this.cloudDisconnectNotice?.stop();
         this.conversationCloudSync?.stop();
         this.waitingItemsSync?.stop();