crewly 1.20.209 → 1.20.211

package/dist/backend/backend/src/controllers/apps/apps.controller.js

@@ -0,0 +1,131 @@
+/**
+ * Crewly Apps controller — `/api/apps/*` on this instance.
+ *
+ * Agents publish apps and read/write their data here; this backend calls
+ * Crewly Cloud with the token it holds, so agents never touch it
+ * (specs/2026-10-04-crewly-apps-p2.md §1). Backs the publish-app and
+ * app-data skills. P3 (specs/2026-10-04-crewly-apps-p3.md) adds signed
+ * open-link cards, link management and public-app requests; the signed URL
+ * never appears in a response.
+ *
+ * @module controllers/apps/apps.controller
+ */
+import { LoggerService } from '../../services/core/logger.service.js';
+import { callerAgentSession } from '../../middleware/caller-identity.middleware.js';
+import { AppsCloudError } from '../../services/apps/apps-cloud.client.js';
+import { getAppsParts } from '../../services/apps/apps.wiring.js';
+import { CREWLY_APPS_CONSTANTS } from '../../constants.js';
+import { redactOpenLinkTokens } from '../../services/apps/app-open-link.js';
+const logger = LoggerService.getInstance().createComponentLogger('AppsController');
+/**
+ * Who is calling: the verified agent session, or the owner.
+ *
+ * @param req - Request (already through `ownerOrVerifiedAgent`)
+ * @returns Caller
+ */
+function callerOf(req) {
+    const session = callerAgentSession(req);
+    return session ? { agentSession: session } : {};
+}
+/**
+ * Answer a failure as `{ success:false, error, message, hint? }`.
+ *
+ * @param res - Response
+ * @param err - The failure
+ */
+export function sendAppsError(res, err) {
+    if (err instanceof AppsCloudError) {
+        const hint = err.code === CREWLY_APPS_CONSTANTS.ERROR_CODES.NOT_LOGGED_IN
+            ? 'Ask the owner to sign this machine in to Crewly Cloud (`crewly cloud login`).'
+            : err.code === 'not_found'
+                ? 'No such app, document or version for this account.'
+                : undefined;
+        res.status(err.status).json({ success: false, error: err.code, message: redactOpenLinkTokens(err.message), ...(hint ? { hint } : {}) });
+        return;
+    }
+    const message = redactOpenLinkTokens(err instanceof Error ? err.message : String(err));
+    logger.error('Unexpected Crewly Apps failure', { error: message });
+    res.status(500).json({ success: false, error: 'internal', message: 'Crewly Apps failed unexpectedly; check the backend log.' });
+}
+/**
+ * Wrap a handler: run it, answer `{ success:true, data }`, map errors.
+ *
+ * @param fn - Produces the data
+ * @param status - Success status
+ * @returns Express handler
+ */
+function handle(fn, status = 200, opts = {}) {
+    return async (req, res) => {
+        try {
+            let data = await fn(req, callerOf(req));
+            // Belt and braces for the routes that touch open-links: whatever the
+            // service returns, no open-link token reaches the caller (P3 §1).
+            if (opts.redact && data !== undefined)
+                data = JSON.parse(redactOpenLinkTokens(JSON.stringify(data)));
+            res.status(status).json({ success: true, data });
+        }
+        catch (err) {
+            sendAppsError(res, err);
+        }
+    };
+}
+const body = (req) => req.body && typeof req.body === 'object' && !Array.isArray(req.body) ? req.body : {};
+/** POST /api/apps/publish */
+export const publishApp = handle(async (req, caller) => {
+    const b = body(req);
+    const result = await getAppsParts().service.publish({ files: b.files, name: b.name, appId: b.appId, source: b.source, entry: b.entry, note: b.note, notify: b.notify, publicRequest: b.publicRequest }, caller);
+    logger.info('App published', {
+        appId: result.appId,
+        version: result.version,
+        created: result.created,
+        agent: caller.agentSession ?? 'owner',
+        ...(result.card ? { card: result.card } : {}),
+        ...(result.publicRequested !== undefined ? { publicRequested: result.publicRequested } : {}),
+    });
+    return result;
+}, 200, { redact: true });
+/** POST /api/apps/:appId/share `{ ttlDays? }` — fresh signed link, card to the owner */
+export const shareApp = handle(async (req, caller) => {
+    const result = await getAppsParts().service.share(req.params.appId, { ttlDays: body(req).ttlDays }, caller);
+    logger.info('App card shared', { appId: result.appId, card: result.card ?? 'none', place: result.cardPlace ?? 'none', agent: caller.agentSession ?? 'owner' });
+    return result;
+}, 200, { redact: true });
+/** GET /api/apps/:appId/links — open-links (never tokens) */
+export const listLinks = handle((req, caller) => getAppsParts().service.links(req.params.appId, caller), 200, { redact: true });
+/** DELETE /api/apps/:appId/links/:linkId */
+export const revokeLink = handle((req, caller) => getAppsParts().service.revokeLink(req.params.appId, req.params.linkId, caller));
+/** DELETE /api/apps/:appId/links — revoke all */
+export const revokeLinks = handle((req, caller) => getAppsParts().service.revokeLinks(req.params.appId, caller));
+/** POST /api/apps/:appId/visibility-request `{ publicRead?, publicSubmit?, note? }` — the owner approves in the app */
+export const requestPublic = handle(async (req, caller) => {
+    const b = body(req);
+    const result = await getAppsParts().service.requestPublic(req.params.appId, { publicRead: b.publicRead, publicSubmit: b.publicSubmit, note: b.note }, caller);
+    logger.info('Public app requested', { appId: result.appId, agent: caller.agentSession ?? 'owner', card: result.card ?? 'none' });
+    return result;
+}, 200, { redact: true });
+/** DELETE /api/apps/:appId/visibility-request */
+export const cancelPublicRequest = handle((req, caller) => getAppsParts().service.cancelPublicRequest(req.params.appId, caller));
+/** POST /api/apps/:appId/make-private */
+export const makePrivate = handle((req, caller) => getAppsParts().service.makePrivate(req.params.appId, caller));
+/** POST /api/apps/:appId/rollback `{ version }` */
+export const rollbackApp = handle((req, caller) => getAppsParts().service.rollback(req.params.appId, body(req).version, caller));
+/** GET /api/apps — apps this instance published */
+export const listApps = handle((_req, caller) => getAppsParts().service.list(caller));
+/** GET /api/apps/:appId/versions */
+export const listVersions = handle((req, caller) => getAppsParts().service.versions(req.params.appId, caller));
+/** GET /api/apps/:appId/data/:collection?limit&after */
+export const listDocs = handle((req, caller) => getAppsParts().service.listDocs(req.params.appId, req.params.collection, { limit: req.query.limit, after: req.query.after }, caller));
+/** POST /api/apps/:appId/data/:collection `{ data }` */
+export const addDoc = handle((req, caller) => getAppsParts().service.addDoc(req.params.appId, req.params.collection, body(req).data, caller), 201);
+/** GET /api/apps/:appId/data/:collection/:docId */
+export const getDoc = handle((req, caller) => getAppsParts().service.getDoc(req.params.appId, req.params.collection, req.params.docId, caller));
+/** PUT /api/apps/:appId/data/:collection/:docId `{ data }` */
+export const setDoc = handle((req, caller) => getAppsParts().service.setDoc(req.params.appId, req.params.collection, req.params.docId, body(req).data, caller));
+/** PATCH /api/apps/:appId/data/:collection/:docId `{ data, ifRev? }` */
+export const updateDoc = handle((req, caller) => {
+    const b = body(req);
+    return getAppsParts().service.updateDoc(req.params.appId, req.params.collection, req.params.docId, b.data, b.ifRev, caller);
+});
+/** DELETE /api/apps/:appId/data/:collection/:docId */
+export const deleteDoc = handle((req, caller) => getAppsParts().service.deleteDoc(req.params.appId, req.params.collection, req.params.docId, caller));
+//# sourceMappingURL=apps.controller.js.map

package/dist/backend/backend/src/controllers/apps/apps.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.controller.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/apps/apps.controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,uCAAuC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,gDAAgD,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,0CAA0C,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAE5E,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,EAAE,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;AAEnF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,GAAa,EAAE,GAAY;IACvD,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,MAAM,IAAI,GACR,GAAG,CAAC,IAAI,KAAK,qBAAqB,CAAC,WAAW,CAAC,aAAa;YAC1D,CAAC,CAAC,+EAA+E;YACjF,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,WAAW;gBACxB,CAAC,CAAC,oDAAoD;gBACtD,CAAC,CAAC,SAAS,CAAC;QAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxI,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACvF,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CAAC;AAClI,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,EAA0D,EAAE,MAAM,GAAG,GAAG,EAAE,OAA6B,EAAE;IACvH,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAiB,EAAE;QAC1D,IAAI,CAAC;YACH,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YACxC,qEAAqE;YACrE,kEAAkE;YAClE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS;gBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAAY,EAA2B,EAAE,CACrD,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAEpH,6BAA6B;AAC7B,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IACrD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,OAAO,CACjD,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,EAClJ,MAAM,CACP,CAAC;IACF,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO;QACrC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,GAAG,CAAC,MAAM,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1B,wFAAwF;AACxF,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IACnD,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5G,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,IAAI,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC,CAAC;IAC/J,OAAO,MAAM,CAAC;AAChB,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1B,6DAA6D;AAC7D,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhI,4CAA4C;AAC5C,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAElI,iDAAiD;AACjD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjH,uHAAuH;AACvH,MAAM,CAAC,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;IACxD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9J,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,IAAI,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC,CAAC;IACjI,OAAO,MAAM,CAAC;AAChB,CAAC,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AAE1B,iDAAiD;AACjD,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjI,yCAAyC;AACzC,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjH,mDAAmD;AACnD,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjI,mDAAmD;AACnD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAEtF,oCAAoC;AACpC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/G,wDAAwD;AACxD,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7C,YAAY,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CACrI,CAAC;AAEF,wDAAwD;AACxD,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;AAEnJ,mDAAmD;AACnD,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAEhJ,8DAA8D;AAC9D,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAC3C,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CACjH,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;IAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC9H,CAAC,CAAC,CAAC;AAEH,sDAAsD;AACtD,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC"}

package/dist/backend/backend/src/controllers/apps/apps.routes.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Crewly Apps routes — mounted at `/api/apps`. Owner or a verified agent
+ * (badge / process tree) only (specs/2026-10-04-crewly-apps-p2.md §1).
+ *
+ * - POST   /publish                                — publish a bundle (find/create the app)
+ * - GET    /                                       — apps of the caller (owner: all)
+ * - POST   /:appId/rollback                        — `{ version }`
+ * - GET    /:appId/versions                        — versions, newest first
+ * - GET    /:appId/data/:collection                — `?limit&after`
+ * - POST   /:appId/data/:collection                — add `{ data }`
+ * - GET    /:appId/data/:collection/:docId         — one doc
+ * - PUT    /:appId/data/:collection/:docId         — replace `{ data }`
+ * - PATCH  /:appId/data/:collection/:docId         — merge `{ data, ifRev? }`
+ * - DELETE /:appId/data/:collection/:docId         — delete
+ * - POST   /:appId/share                           — fresh signed link, card to the owner DM (P3)
+ * - GET    /:appId/links                           — open-links (never tokens)
+ * - DELETE /:appId/links/:linkId                   — revoke one
+ * - DELETE /:appId/links                           — revoke all
+ * - POST   /:appId/visibility-request              — ask the owner to make it public
+ * - DELETE /:appId/visibility-request              — withdraw the request
+ * - POST   /:appId/make-private                    — private again (instant)
+ *
+ * The publish body is skipped by the app-wide parsers (index.ts) and parsed
+ * here, after the caller check, so an unauthenticated client cannot make the
+ * server buffer a large body.
+ *
+ * @module controllers/apps/apps.routes
+ */
+import { Router, type NextFunction, type Request, type RequestHandler, type Response } from 'express';
+/**
+ * The caller gate. A refused request that declares a large body is answered
+ * with `Connection: close`, so the server stops receiving the upload rather
+ * than draining it.
+ *
+ * @param gate - The identity gate
+ * @returns Middleware
+ */
+export declare function gateClosingLargeRejects(gate: RequestHandler): RequestHandler;
+/**
+ * Refuse a publish whose declared size is over the limit before reading it.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export declare function rejectOversizedPublish(req: Request, res: Response, next: NextFunction): void;
+/**
+ * Creates the Crewly Apps router.
+ *
+ * @returns Express router
+ */
+export declare function createAppsRouter(): Router;
+//# sourceMappingURL=apps.routes.d.ts.map

package/dist/backend/backend/src/controllers/apps/apps.routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.routes.d.ts","sourceRoot":"","sources":["../../../../../../backend/src/controllers/apps/apps.routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAgB,EAAE,MAAM,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,KAAK,cAAc,EAAE,KAAK,QAAQ,EAAE,MAAM,SAAS,CAAC;AAqC/G;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,cAAc,CAS5E;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAQ5F;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAqBzC"}

package/dist/backend/backend/src/controllers/apps/apps.routes.js

@@ -0,0 +1,108 @@
+/**
+ * Crewly Apps routes — mounted at `/api/apps`. Owner or a verified agent
+ * (badge / process tree) only (specs/2026-10-04-crewly-apps-p2.md §1).
+ *
+ * - POST   /publish                                — publish a bundle (find/create the app)
+ * - GET    /                                       — apps of the caller (owner: all)
+ * - POST   /:appId/rollback                        — `{ version }`
+ * - GET    /:appId/versions                        — versions, newest first
+ * - GET    /:appId/data/:collection                — `?limit&after`
+ * - POST   /:appId/data/:collection                — add `{ data }`
+ * - GET    /:appId/data/:collection/:docId         — one doc
+ * - PUT    /:appId/data/:collection/:docId         — replace `{ data }`
+ * - PATCH  /:appId/data/:collection/:docId         — merge `{ data, ifRev? }`
+ * - DELETE /:appId/data/:collection/:docId         — delete
+ * - POST   /:appId/share                           — fresh signed link, card to the owner DM (P3)
+ * - GET    /:appId/links                           — open-links (never tokens)
+ * - DELETE /:appId/links/:linkId                   — revoke one
+ * - DELETE /:appId/links                           — revoke all
+ * - POST   /:appId/visibility-request              — ask the owner to make it public
+ * - DELETE /:appId/visibility-request              — withdraw the request
+ * - POST   /:appId/make-private                    — private again (instant)
+ *
+ * The publish body is skipped by the app-wide parsers (index.ts) and parsed
+ * here, after the caller check, so an unauthenticated client cannot make the
+ * server buffer a large body.
+ *
+ * @module controllers/apps/apps.routes
+ */
+import express, { Router } from 'express';
+import { ownerOrVerifiedAgent } from '../../middleware/caller-identity.middleware.js';
+import { CREWLY_APPS_CONSTANTS } from '../../constants.js';
+import { publishApp, listApps, rollbackApp, listVersions, listDocs, addDoc, getDoc, setDoc, updateDoc, deleteDoc, shareApp, listLinks, revokeLink, revokeLinks, requestPublic, cancelPublicRequest, makePrivate, } from './apps.controller.js';
+const C = CREWLY_APPS_CONSTANTS;
+/**
+ * The declared body size, or null when the request does not say.
+ *
+ * @param req - Request
+ * @returns Bytes or null
+ */
+function declaredLength(req) {
+    const raw = req.headers['content-length'];
+    const n = typeof raw === 'string' ? Number(raw) : NaN;
+    return Number.isFinite(n) && n >= 0 ? n : null;
+}
+/**
+ * The caller gate. A refused request that declares a large body is answered
+ * with `Connection: close`, so the server stops receiving the upload rather
+ * than draining it.
+ *
+ * @param gate - The identity gate
+ * @returns Middleware
+ */
+export function gateClosingLargeRejects(gate) {
+    return (req, res, next) => {
+        const large = (declaredLength(req) ?? 0) > C.PUBLISH_CLOSE_ABOVE_BYTES || req.headers['transfer-encoding'] !== undefined;
+        if (large)
+            res.setHeader('Connection', 'close');
+        gate(req, res, (err) => {
+            if (large)
+                res.removeHeader('Connection');
+            next(err);
+        });
+    };
+}
+/**
+ * Refuse a publish whose declared size is over the limit before reading it.
+ *
+ * @param req - Request
+ * @param res - Response
+ * @param next - Next
+ */
+export function rejectOversizedPublish(req, res, next) {
+    const n = declaredLength(req);
+    if (n !== null && n > C.PUBLISH_BODY_MAX_BYTES) {
+        res.setHeader('Connection', 'close');
+        res.status(413).json({ success: false, error: 'too_large', message: `A publish can be at most ${C.PUBLISH_BODY_LIMIT}.` });
+        return;
+    }
+    next();
+}
+/**
+ * Creates the Crewly Apps router.
+ *
+ * @returns Express router
+ */
+export function createAppsRouter() {
+    const router = Router();
+    router.use(gateClosingLargeRejects(ownerOrVerifiedAgent('Crewly Apps')));
+    router.post('/publish', rejectOversizedPublish, express.json({ limit: C.PUBLISH_BODY_LIMIT }), publishApp);
+    router.get('/', listApps);
+    router.post('/:appId/rollback', rollbackApp);
+    router.get('/:appId/versions', listVersions);
+    router.get('/:appId/data/:collection', listDocs);
+    router.post('/:appId/data/:collection', addDoc);
+    router.get('/:appId/data/:collection/:docId', getDoc);
+    router.put('/:appId/data/:collection/:docId', setDoc);
+    router.patch('/:appId/data/:collection/:docId', updateDoc);
+    router.delete('/:appId/data/:collection/:docId', deleteDoc);
+    router.post('/:appId/share', shareApp);
+    router.get('/:appId/links', listLinks);
+    router.delete('/:appId/links/:linkId', revokeLink);
+    router.delete('/:appId/links', revokeLinks);
+    router.post('/:appId/visibility-request', requestPublic);
+    router.delete('/:appId/visibility-request', cancelPublicRequest);
+    router.post('/:appId/make-private', makePrivate);
+    return router;
+}
+//# sourceMappingURL=apps.routes.js.map

package/dist/backend/backend/src/controllers/apps/apps.routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apps.routes.js","sourceRoot":"","sources":["../../../../../../backend/src/controllers/apps/apps.routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,OAAO,EAAE,EAAE,MAAM,EAAuE,MAAM,SAAS,CAAC;AAC/G,OAAO,EAAE,oBAAoB,EAAE,MAAM,gDAAgD,CAAC;AACtF,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EACL,UAAU,EACV,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,QAAQ,EACR,MAAM,EACN,MAAM,EACN,MAAM,EACN,SAAS,EACT,SAAS,EACT,QAAQ,EACR,SAAS,EACT,UAAU,EACV,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,WAAW,GACZ,MAAM,sBAAsB,CAAC;AAE9B,MAAM,CAAC,GAAG,qBAAqB,CAAC;AAEhC;;;;;GAKG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAoB;IAC1D,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAQ,EAAE;QAC/D,MAAM,KAAK,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,yBAAyB,IAAI,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;QACzH,IAAI,KAAK;YAAE,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAa,EAAE,EAAE;YAC/B,IAAI,KAAK;gBAAE,GAAG,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;YAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACpF,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,sBAAsB,EAAE,CAAC;QAC/C,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACrC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,4BAA4B,CAAC,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QAC3H,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,oBAAoB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,kBAAkB,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;IAC3G,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC1B,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IAC7C,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,QAAQ,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,MAAM,CAAC,CAAC;IAChD,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,GAAG,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,CAAC,MAAM,CAAC,iCAAiC,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,MAAM,CAAC,uBAAuB,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,CAAC,MAAM,CAAC,4BAA4B,EAAE,mBAAmB,CAAC,CAAC;IACjE,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,WAAW,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/backend/backend/src/index.d.ts

@@ -306,6 +306,7 @@ export declare class CrewlyServer {
      * @param tokenUsage - The ledger
      */
     private startRuntimeUsageSyncs;
+    private startCrewlyApps;
     private startDecisionCards;
     private startOwnerMessageWatchdog;
     /**

package/dist/backend/backend/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AA4CA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA+SjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IACnF,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAC,CAAyD;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,eAAe,CAAmB;IAC1C,qEAAqE;IACrE,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,sBAAsB,CAAiD;IAC/E,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,kGAAkG;IAClG,OAAO,CAAC,sBAAsB,CAAuC;IAGrE,OAAO,CAAC,+BAA+B,CAAgD;IACvF,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAAqC;IACjE,8HAA8H;IAC9H,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,OAAO,CAAC,6BAA6B,CAA8C;IACnF,OAAO,CAAC,wBAAwB,CAAyC;IACzE,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAChE,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,kBAAkB,CAA0C;IAKpE,OAAO,CAAC,aAAa,CAAuE;IAC5F,OAAO,CAAC,gBAAgB,CAET;IAGf,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAA2G;IACxI,0EAA0E;IAC1E,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,gBAAgB,CAAiG;IACzH,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAAuB;IACrD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAMhC;IACH,oGAAoG;IACpG,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAsE3C,OAAO,CAAC,kBAAkB;IAguC1B,OAAO,CAAC,mBAAmB;IA4D3B,OAAO,CAAC,eAAe;IAsMvB,OAAO,CAAC,kBAAkB;IA0BpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAy5D5B;;;OAGG;YACW,2BAA2B;IAuCzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;OAGG;YACW,8BAA8B;IAsB5C;;;;OAIG;YACW,8BAA8B;IA8M5C;;;;;;;;;;;;OAYG;YACW,6BAA6B;IAsB3C;;;;;OAKG;YACW,iCAAiC;IA0L/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;IAsBnC;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;YAqCZ,eAAe;YAoFf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAsC9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAyEvB;;;;;;;OAOG;YACW,2BAA2B;IAWzC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA+E1B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IA4DvB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;;;;OAKG;YACW,0BAA0B;IAkExC;;;;OAIG;YACW,qBAAqB;IA6DnC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAuBlC;;;;;;OAMG;YACW,kBAAkB;IAmBhC;;;;;OAKG;YACW,8BAA8B;IA6C5C;;;;OAIG;YACW,+BAA+B;IA2C7C;;;;;;OAMG;YACW,kBAAkB;IA6BhC,OAAO,CAAC,qBAAqB;IAoC7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAoE1B;;;;;;;;;OASG;IACH;;;;;;;;;;;;;;OAcG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;;;;OAQG;IACH;;OAEG;IACH;;;;;OAKG;YACW,sBAAsB;YA4CtB,kBAAkB;YAqHlB,yBAAyB;IAyFvC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IA2BtB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAmChC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;YAkEf,wBAAwB;IAWtC,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,cAAc;IActB;;;;;;;;OAQG;IACG,QAAQ,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA4W1H,SAAS,IAAI,aAAa;CAG1B;AAmCD,eAAe,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../backend/src/index.ts"],"names":[],"mappings":";AA4CA,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAgTjD,qBAAa,YAAY;IACxB,OAAO,CAAC,GAAG,CAAsB;IACjC,OAAO,CAAC,UAAU,CAAkC;IACpD,OAAO,CAAC,EAAE,CAAiB;IAC3B,iFAAiF;IACjF,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAqE;IACnF,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAC,CAAyD;IAEnF,OAAO,CAAC,cAAc,CAAkB;IACxC,OAAO,CAAC,WAAW,CAAe;IAClC,OAAO,CAAC,gBAAgB,CAAoB;IAC5C,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,sBAAsB,CAA0B;IACxD,OAAO,CAAC,4BAA4B,CAAgC;IACpE,OAAO,CAAC,uBAAuB,CAA2B;IAC1D,OAAO,CAAC,aAAa,CAAiB;IACtC,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,mBAAmB,CAAuB;IAClD,OAAO,CAAC,qBAAqB,CAAyB;IACtD,OAAO,CAAC,wBAAwB,CAA4B;IAC5D,OAAO,CAAC,eAAe,CAAmB;IAC1C,qEAAqE;IACrE,OAAO,CAAC,qBAAqB,CAAsC;IACnE,OAAO,CAAC,sBAAsB,CAAuC;IACrE,OAAO,CAAC,sBAAsB,CAAiD;IAC/E,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,kGAAkG;IAClG,OAAO,CAAC,sBAAsB,CAAuC;IAGrE,OAAO,CAAC,+BAA+B,CAAgD;IACvF,+FAA+F;IAC/F,OAAO,CAAC,oBAAoB,CAAqC;IACjE,8HAA8H;IAC9H,OAAO,CAAC,0BAA0B,CAA2C;IAC7E,OAAO,CAAC,6BAA6B,CAA8C;IACnF,OAAO,CAAC,wBAAwB,CAAyC;IACzE,OAAO,CAAC,2BAA2B,CAA+B;IAClE,OAAO,CAAC,0BAA0B,CAA8B;IAChE,OAAO,CAAC,iBAAiB,CAAkC;IAC3D,OAAO,CAAC,kBAAkB,CAA0C;IAKpE,OAAO,CAAC,aAAa,CAAuE;IAC5F,OAAO,CAAC,gBAAgB,CAET;IAGf,OAAO,CAAC,cAAc,CAAS;IAC/B,oEAAoE;IACpE,OAAO,CAAC,qBAAqB,CAA6C;IAC1E,OAAO,CAAC,qBAAqB,CAA2G;IACxI,0EAA0E;IAC1E,OAAO,CAAC,eAAe,CAAuC;IAC9D,OAAO,CAAC,gBAAgB,CAAiG;IACzH,oFAAoF;IACpF,OAAO,CAAC,oBAAoB,CAAK;IACjC,2EAA2E;IAC3E,OAAO,CAAC,sBAAsB,CAA8B;IAC5D,yGAAyG;IACzG,OAAO,CAAC,sBAAsB,CAAuB;IACrD;;;OAGG;IACH,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAMhC;IACH,oGAAoG;IACpG,OAAO,CAAC,qBAAqB,CAAwB;IACrD,OAAO,CAAC,wBAAwB,CAA+B;gBAEnD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC;IAsE3C,OAAO,CAAC,kBAAkB;IAguC1B,OAAO,CAAC,mBAAmB;IAuE3B,OAAO,CAAC,eAAe;IAsMvB,OAAO,CAAC,kBAAkB;IA0BpB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IA45D5B;;;OAGG;YACW,2BAA2B;IAuCzC;;;OAGG;YACW,8BAA8B;IAsB5C;;;OAGG;YACW,gCAAgC;IAsB9C;;;OAGG;YACW,8BAA8B;IAsB5C;;;;OAIG;YACW,8BAA8B;IA8M5C;;;;;;;;;;;;OAYG;YACW,6BAA6B;IAsB3C;;;;;OAKG;YACW,iCAAiC;IA0L/C;;;;OAIG;YACW,2BAA2B;YA0B3B,qBAAqB;IAsBnC;;;;;;OAMG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;;;;OAOG;IACH,OAAO,CAAC,kBAAkB;YAqCZ,eAAe;YAoFf,kBAAkB;IAgBhC,OAAO,CAAC,WAAW,CAAK;IAExB,OAAO,CAAC,sBAAsB;IAsC9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAwB5B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAoBvB;;;;OAIG;IACH,OAAO,CAAC,eAAe;IAyEvB;;;;;;;OAOG;YACW,2BAA2B;IAWzC;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB;IA+E1B;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IA4DvB;;;;;;;OAOG;IACH,OAAO,CAAC,0BAA0B;IAuClC;;;;;OAKG;YACW,0BAA0B;IAkExC;;;;OAIG;YACW,qBAAqB;IA6DnC;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAuBlC;;;;;;OAMG;YACW,kBAAkB;IAmBhC;;;;;OAKG;YACW,8BAA8B;IA6C5C;;;;OAIG;YACW,+BAA+B;IA2C7C;;;;;;OAMG;YACW,kBAAkB;IA6BhC,OAAO,CAAC,qBAAqB;IAoC7B;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAoE1B;;;;;;;;;OASG;IACH;;;;;;;;;;;;;;OAcG;IACH,sEAAsE;IACtE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAA6B;IAE1D;;;;;;;;OAQG;IACH;;OAEG;IACH;;;;;OAKG;YACW,sBAAsB;YA4CtB,eAAe;YAwCf,kBAAkB;YAqHlB,yBAAyB;IAyFvC;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IA8B5B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,cAAc;IA2BtB;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAkB5B;;;;;OAKG;IACH,OAAO,CAAC,wBAAwB;IAmChC;;;;;;OAMG;IACH,OAAO,CAAC,qBAAqB;YAkEf,wBAAwB;IAWtC,OAAO,CAAC,qBAAqB;IA8H7B,OAAO,CAAC,cAAc;IActB;;;;;;;;OAQG;IACG,QAAQ,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IA6W1H,SAAS,IAAI,aAAa;CAG1B;AAmCD,eAAe,YAAY,CAAC"}

package/dist/backend/backend/src/index.js

@@ -75,7 +75,7 @@ import { parseInboundOrigin } from './services/orc/orc-reply-route.service.js';
 import { parseSlackThreadKey } from './services/slack/slack-thread-key.js';
 import { LIVENESS_MONITOR_CONSTANTS } from './constants.js';
 import { InputBlockedRetryService } from './services/messaging/input-blocked-retry.service.js';
-import { SUB_AGENT_QUEUE_CONSTANTS, CHAT_CONTEXT_CONSTANTS, SAFE_RESTART, AUTO_UPDATE_CONSTANTS, PROCESS_EXIT_CODES, CLAUDE_STARTUP_CONSTANTS, WEB_CONSTANTS, TICKET_CONSTANTS, UNASSIGNED_ROUTE_CONSTANTS, CLOUD_TALK_CONSTANTS, STANDING_ANSWERS_CONSTANTS, TICKET_AUTOPILOT_CONSTANTS, EXPERIMENT_CONSTANTS, WORK_ITEM_DESTINATION_CONSTANTS, CODEX_USAGE_SYNC_CONSTANTS, ANTIGRAVITY_USAGE_SYNC_CONSTANTS, OWNER_AUTH_CONSTANTS } from './constants.js';
+import { SUB_AGENT_QUEUE_CONSTANTS, CHAT_CONTEXT_CONSTANTS, SAFE_RESTART, AUTO_UPDATE_CONSTANTS, PROCESS_EXIT_CODES, CLAUDE_STARTUP_CONSTANTS, WEB_CONSTANTS, TICKET_CONSTANTS, UNASSIGNED_ROUTE_CONSTANTS, CLOUD_TALK_CONSTANTS, STANDING_ANSWERS_CONSTANTS, TICKET_AUTOPILOT_CONSTANTS, EXPERIMENT_CONSTANTS, WORK_ITEM_DESTINATION_CONSTANTS, CODEX_USAGE_SYNC_CONSTANTS, ANTIGRAVITY_USAGE_SYNC_CONSTANTS, OWNER_AUTH_CONSTANTS, CREWLY_APPS_CONSTANTS } from './constants.js';
 import { PtyActivityTrackerService } from './services/agent/pty-activity-tracker.service.js';
 import { InFlightTurnTracker } from './services/restart/in-flight-turn-tracker.service.js';
 import { TicketIntakeService, setTicketIntakeService, resolveTicketIdForSession, } from './services/v3/ticket-intake.service.js';
@@ -108,6 +108,7 @@ import { TokenUsageService } from './services/monitoring/token-usage.service.js'
 import { agentHeartbeatMiddleware } from './middleware/agent-heartbeat.middleware.js';
 import { agentOriginMiddleware, liveSessionPids } from './middleware/agent-origin.middleware.js';
 import { createCallerIdentityMiddleware } from './middleware/caller-identity.middleware.js';
+import { bodyParserExcept } from './middleware/body-parser-except.js';
 import { PeerProcessService } from './services/core/peer-process.service.js';
 import { createOwnerSessionPageMiddleware, createOwnerSessionRouter } from './controllers/auth/owner-session.controller.js';
 import { dashboardBuildHeader, dashboardBuildMessage, loadDashboardEntry } from './services/core/dashboard-build.js';
@@ -1550,23 +1551,27 @@ export class CrewlyServer {
         }));
         // Logging
         this.app.use(morgan(process.env.NODE_ENV === 'production' ? 'combined' : 'dev'));
+        // Crewly Apps publish (a whole bundle as base64) is NOT parsed here:
+        // these parsers run before authentication, so its router parses it with
+        // a larger limit only after the caller is the owner or a verified agent.
+        const unparsedHere = [CREWLY_APPS_CONSTANTS.PUBLISH_ROUTE];
         // Body parsing — `verify` captures the raw bytes so the error handler
         // below can log the exact payload when JSON parsing fails. Without this
         // we only see the position-of-failure, not the bytes.
-        this.app.use(express.json({
+        this.app.use(bodyParserExcept(unparsedHere, express.json({
             limit: '10mb',
             verify: (req, _res, buf) => {
                 req.rawBody = buf.toString('utf8');
             },
-        }));
-        this.app.use(express.urlencoded({
+        })));
+        this.app.use(bodyParserExcept(unparsedHere, express.urlencoded({
             extended: true,
             limit: '10mb',
             // Slack's interactive `payload=` form is verified over the exact bytes.
             verify: (req, _res, buf) => {
                 req.rawBody = buf.toString('utf8');
             },
-        }));
+        })));
         // Note: Static files are configured in configureRoutes() after API routes
     }
     configureRoutes() {
@@ -3206,6 +3211,9 @@ export class CrewlyServer {
                 // questions posted by the responsible agent's own bot, answered by
                 // button / reaction / thread reply / dashboard; deadlines applied here.
                 await this.startDecisionCards();
+                // Crewly Apps (specs/2026-10-04-crewly-apps-p2.md): the owner's edits in
+                // an app wake the agent that published it.
+                await this.startCrewlyApps();
             }
             catch (autoClaimErr) {
                 this.logger.warn('AgentAutoClaimService initialization failed (non-critical)', {
@@ -5198,6 +5206,49 @@ export class CrewlyServer {
             this.logger.warn('Antigravity usage sync not started (non-fatal)', { error: err instanceof Error ? err.message : String(err) });
         }
     }
+    async startCrewlyApps() {
+        try {
+            const { startAppWake } = await import('./services/apps/apps.wiring.js');
+            startAppWake({
+                skillsPath: path.join(findPackageRoot(__dirname), 'config', 'skills', 'agent'),
+                getTeams: () => this.storageService.getTeams(),
+                sessionExists: (session) => {
+                    try {
+                        return getSessionBackendSync()?.sessionExists(session) ?? false;
+                    }
+                    catch {
+                        return false;
+                    }
+                },
+                sendToAgent: async (session, text, activate) => {
+                    let exists = false;
+                    try {
+                        exists = getSessionBackendSync()?.sessionExists(session) ?? false;
+                    }
+                    catch {
+                        exists = false;
+                    }
+                    if (!exists) {
+                        // Only the app's publisher is started; an `ask` never starts a stopped agent.
+                        if (!activate)
+                            return false;
+                        const { activateAgentBySession } = await import('./controllers/team/team.controller.js');
+                        await activateAgentBySession(this.apiController, session).catch(() => undefined);
+                    }
+                    const result = await this.apiController.agentRegistrationService.sendMessageToAgent(session, text);
+                    return result.success;
+                },
+                sendToOrchestrator: async (text) => {
+                    this.messageQueueService.enqueue({ content: text, conversationId: 'system', source: 'system_event' });
+                    return true;
+                },
+            });
+            this.logger.info('Crewly Apps change poller started');
+        }
+        catch (error) {
+            this.logger.warn('Crewly Apps change poller not started (non-critical)', { error: error instanceof Error ? error.message : String(error) });
+        }
+    }
     async startDecisionCards() {
         try {
             const { createDecisionService, attachDecisionSlackListeners, attachSkipAllCommand } = await import('./services/decisions/decision.wiring.js');
@@ -5798,6 +5849,7 @@ export class CrewlyServer {
         }
         this.logger.info('Shutting down Crewly server...', { reason: options.reason ?? 'unspecified' });
         AutoUpdateService.getInstance()?.stop();
+        void import('./services/apps/apps.wiring.js').then((m) => m.stopAppWake()).catch(() => undefined);
         this.cloudDisconnectNotice?.stop();
         this.conversationCloudSync?.stop();
         this.waitingItemsSync?.stop();