kortext 2.2.0 → 3.0.0

package/dist/server/routes/approvals.js

@@ -0,0 +1,52 @@
+import { Router } from 'express';
+export function approvalRouter(deps) {
+    const r = Router();
+    r.get('/questions', (_req, res) => {
+        const questions = deps.repos.pendingQuestions.listOpen();
+        res.json({ questions });
+    });
+    r.post('/questions/:id/answer', (req, res) => {
+        const id = Number(req.params.id);
+        if (!Number.isFinite(id)) {
+            res.status(400).json({ error: 'invalid_id' });
+            return;
+        }
+        const existing = deps.repos.pendingQuestions.get(id);
+        if (!existing) {
+            res.status(404).json({ error: 'not_found' });
+            return;
+        }
+        const body = req.body;
+        if (typeof body.answer !== 'string' || typeof body.answered_by !== 'string') {
+            res.status(400).json({ error: 'missing_fields' });
+            return;
+        }
+        try {
+            const answered = deps.queue.answer(id, body.answer, body.answered_by);
+            res.json({ question: answered });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            res.status(409).json({ error: 'cannot_answer', message });
+        }
+    });
+    r.post('/runs/:runId/approve', (req, res) => {
+        const runId = Number(req.params.runId);
+        if (!Number.isFinite(runId)) {
+            res.status(400).json({ error: 'invalid_run_id' });
+            return;
+        }
+        const open = deps.queue.findOpenForRun(runId);
+        if (!open) {
+            res.status(404).json({ error: 'no_open_question' });
+            return;
+        }
+        const body = req.body;
+        const answeredBy = typeof body.answered_by === 'string' ? body.answered_by : 'unknown';
+        const answer = typeof body.answer === 'string' ? body.answer : 'approve';
+        const answered = deps.queue.answer(open.id, answer, answeredBy);
+        res.json({ question: answered });
+    });
+    return r;
+}
+//# sourceMappingURL=approvals.js.map

package/dist/server/routes/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../../server/routes/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,SAAS,CAAC;AAiB9D,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAa,EAAE,GAAa,EAAE,EAAE;QACnD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,uBAAuB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAmD,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAmD,CAAC;QACrE,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACvF,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server/routes/backlog.js

@@ -0,0 +1,44 @@
+import { Router } from 'express';
+/**
+ * GET /api/backlog        — list backlog items (filters: type, status, owner, parent_id)
+ * GET /api/backlog/:id    — single item
+ *
+ * Faz 6.4 Board uses this to render kanban columns.
+ */
+export function backlogRouter(deps) {
+    const r = Router();
+    r.get('/backlog', (req, res) => {
+        const items = deps.repos.backlog.list({
+            type: pickStr(req.query.type),
+            status: pickStr(req.query.status),
+            owner: pickStr(req.query.owner),
+            parent_id: pickStr(req.query.parent_id),
+            limit: clampLimit(req.query.limit, 100, 500),
+        });
+        res.json({ items });
+    });
+    r.get('/backlog/:id', (req, res) => {
+        const id = req.params.id;
+        if (typeof id !== 'string' || id.length === 0) {
+            res.status(400).json({ error: 'invalid_id' });
+            return;
+        }
+        const item = deps.repos.backlog.get(id);
+        if (!item) {
+            res.status(404).json({ error: 'not_found' });
+            return;
+        }
+        res.json({ item });
+    });
+    return r;
+}
+function pickStr(v) {
+    return typeof v === 'string' && v.length > 0 ? v : null;
+}
+function clampLimit(raw, fallback, max) {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0)
+        return fallback;
+    return Math.min(Math.floor(n), max);
+}
+//# sourceMappingURL=backlog.js.map

package/dist/server/routes/backlog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog.js","sourceRoot":"","sources":["../../../server/routes/backlog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,IAA6B;IACzD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACpC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAU;YACtC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAU;YAC1C,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC;YAC/B,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC;YACvC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;SAC7C,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACjC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,QAAgB,EAAE,GAAW;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC"}

package/dist/server/routes/db-info.js

@@ -0,0 +1,21 @@
+import { Router } from 'express';
+import { getDb } from "../db/client.js";
+export const dbInfoRouter = Router();
+dbInfoRouter.get('/db/info', (_req, res) => {
+    const { db, schemaVersion } = getDb();
+    const tables = db
+        .prepare("SELECT name FROM sqlite_master WHERE type = 'table' AND name NOT LIKE 'sqlite_%' ORDER BY name")
+        .all();
+    res.json({
+        schemaVersion,
+        tableCount: tables.length,
+        tables: tables.map((t) => t.name),
+        dbPath: db.name,
+    });
+});
+dbInfoRouter.get('/db/audit', (req, res) => {
+    const { repositories } = getDb();
+    const limit = Math.min(Number(req.query.limit ?? 50), 500);
+    res.json({ items: repositories.auditLog.list({ limit }) });
+});
+//# sourceMappingURL=db-info.js.map

package/dist/server/routes/db-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-info.js","sourceRoot":"","sources":["../../../server/routes/db-info.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAExC,MAAM,CAAC,MAAM,YAAY,GAAW,MAAM,EAAE,CAAC;AAE7C,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACzC,MAAM,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,KAAK,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,EAAE;SACd,OAAO,CACN,gGAAgG,CACjG;SACA,GAAG,EAAwB,CAAC;IAC/B,GAAG,CAAC,IAAI,CAAC;QACP,aAAa;QACb,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,MAAM,EAAE,EAAE,CAAC,IAAI;KAChB,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;IACzC,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;IAC3D,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;AAC7D,CAAC,CAAC,CAAC"}

package/dist/server/routes/docs.js

@@ -0,0 +1,70 @@
+import { readFile, readdir } from 'node:fs/promises';
+import { resolve, sep } from 'node:path';
+import { Router } from 'express';
+/**
+ * /api/docs/:scope        — list .md files in the scope
+ * /api/docs/:scope/:file  — return raw markdown body
+ *
+ * Scopes are an allow-list of workspace subdirectories. The resolved
+ * absolute path of the requested file is verified to live under its scope
+ * root — that's the path-traversal barrier ('..' or absolute paths cannot
+ * escape).
+ */
+const FILE_RE = /^[\w][\w.-]*\.md$/;
+export function docsRouter(deps) {
+    const r = Router();
+    r.get('/docs/:scope', async (req, res) => {
+        const scope = req.params.scope;
+        const root = scope ? deps.scopes[scope] : undefined;
+        if (!scope || !root) {
+            res.status(404).json({ error: 'unknown_scope' });
+            return;
+        }
+        try {
+            const entries = await readdir(root, { withFileTypes: true });
+            const files = entries
+                .filter((e) => e.isFile() && FILE_RE.test(e.name))
+                .map((e) => e.name)
+                .sort();
+            res.json({ scope, files });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            res.status(500).json({ error: 'list_failed', message });
+        }
+    });
+    r.get('/docs/:scope/:file', async (req, res) => {
+        const scope = req.params.scope;
+        const file = req.params.file;
+        const root = scope ? deps.scopes[scope] : undefined;
+        if (!scope || !root) {
+            res.status(404).json({ error: 'unknown_scope' });
+            return;
+        }
+        if (!file || !FILE_RE.test(file)) {
+            res.status(400).json({ error: 'invalid_filename' });
+            return;
+        }
+        const target = resolve(root, file);
+        // Path-traversal barrier: the resolved file must live directly under root.
+        if (!target.startsWith(root + sep)) {
+            res.status(403).json({ error: 'outside_scope' });
+            return;
+        }
+        try {
+            const body = await readFile(target, 'utf8');
+            res.json({ scope, file, body });
+        }
+        catch (err) {
+            const code = err.code;
+            if (code === 'ENOENT') {
+                res.status(404).json({ error: 'not_found' });
+                return;
+            }
+            const message = err instanceof Error ? err.message : String(err);
+            res.status(500).json({ error: 'read_failed', message });
+        }
+    });
+    return r;
+}
+//# sourceMappingURL=docs.js.map

package/dist/server/routes/docs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"docs.js","sourceRoot":"","sources":["../../../server/routes/docs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC;;;;;;;;GAQG;AAEH,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAOpC,MAAM,UAAU,UAAU,CAAC,IAAoB;IAC7C,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,OAAO;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;iBACjD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;iBAClB,IAAI,EAAE,CAAC;YACV,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,2EAA2E;QAC3E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server/routes/doctor.js

@@ -0,0 +1,19 @@
+import { Router } from 'express';
+import { runDoctor } from "../cli/doctor.js";
+/**
+ * GET /api/doctor — same report shape as `kortext doctor`. Drives the
+ * dashboard health badge + Faz 6.6 toast for new errors.
+ */
+export function doctorRouter(deps) {
+    const r = Router();
+    r.get('/doctor', (_req, res) => {
+        const report = runDoctor({
+            repos: deps.repos,
+            workflows: deps.workflows,
+            personas: deps.personas,
+        });
+        res.json(report);
+    });
+    return r;
+}
+//# sourceMappingURL=doctor.js.map

package/dist/server/routes/doctor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"doctor.js","sourceRoot":"","sources":["../../../server/routes/doctor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAIjC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAI5B;IACC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,SAAS,CAAC;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server/routes/handovers.js

@@ -0,0 +1,25 @@
+import { Router } from 'express';
+/**
+ * GET /api/handovers              — recent handovers (default 20, max 100)
+ * GET /api/handovers/by-item/:id  — all handovers attached to a backlog item
+ */
+export function handoversRouter(deps) {
+    const r = Router();
+    r.get('/handovers', (req, res) => {
+        const raw = Number(req.query.limit);
+        const limit = Number.isFinite(raw) && raw > 0 ? Math.min(Math.floor(raw), 100) : 20;
+        const handovers = deps.repos.handovers.listRecent(limit);
+        res.json({ handovers });
+    });
+    r.get('/handovers/by-item/:id', (req, res) => {
+        const itemId = req.params.id;
+        if (typeof itemId !== 'string' || itemId.length === 0) {
+            res.status(400).json({ error: 'invalid_item_id' });
+            return;
+        }
+        const handovers = deps.repos.handovers.listByItem(itemId);
+        res.json({ handovers });
+    });
+    return r;
+}
+//# sourceMappingURL=handovers.js.map

package/dist/server/routes/handovers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handovers.js","sourceRoot":"","sources":["../../../server/routes/handovers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAA6B;IAC3D,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GACT,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACzD,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server/routes/health.js

@@ -0,0 +1,11 @@
+import { Router } from 'express';
+const startedAt = Date.now();
+export const healthRouter = Router();
+healthRouter.get('/health', (_req, res) => {
+    res.json({
+        status: 'ok',
+        version: '3.0.0-alpha.0',
+        uptimeMs: Date.now() - startedAt,
+    });
+});
+//# sourceMappingURL=health.js.map

package/dist/server/routes/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../server/routes/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEjC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,YAAY,GAAW,MAAM,EAAE,CAAC;AAE7C,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IACxC,GAAG,CAAC,IAAI,CAAC;QACP,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,eAAe;QACxB,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACjC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/server/routes/personas.js

@@ -0,0 +1,96 @@
+import { writeFile } from 'node:fs/promises';
+import { resolve, sep } from 'node:path';
+import { Router } from 'express';
+import { parsePersonaMarkdown, } from "../engine/persona-registry.js";
+const HANDLE_RE = /^\+?[\w-]+$/;
+const FILENAME_RE = /^[\w-]+\.md$/;
+export function personasRouter(deps) {
+    const r = Router();
+    r.get('/personas', (_req, res) => {
+        const personas = deps.personas.list().map((p) => ({
+            handle: p.handle,
+            id: p.id,
+            description: p.description,
+            promptLength: p.systemPrompt.length,
+        }));
+        const errors = deps.personas.errors();
+        res.json({ personas, errors });
+    });
+    r.get('/personas/:handle', (req, res) => {
+        const handle = req.params.handle;
+        if (typeof handle !== 'string' || !HANDLE_RE.test(handle)) {
+            res.status(400).json({ error: 'invalid_handle' });
+            return;
+        }
+        const persona = deps.personas.get(handle);
+        if (!persona) {
+            res.status(404).json({ error: 'not_found' });
+            return;
+        }
+        res.json({ persona });
+    });
+    r.put('/personas/:handle', async (req, res) => {
+        const handle = req.params.handle;
+        if (typeof handle !== 'string' || !HANDLE_RE.test(handle)) {
+            res.status(400).json({ error: 'invalid_handle' });
+            return;
+        }
+        const existing = deps.personas.get(handle);
+        if (!existing) {
+            res.status(404).json({ error: 'not_found' });
+            return;
+        }
+        const body = req.body;
+        if (typeof body.systemPrompt !== 'string' || body.systemPrompt.length === 0) {
+            res.status(400).json({ error: 'missing_systemPrompt' });
+            return;
+        }
+        // Validate: parse must succeed AND yield the same handle.
+        try {
+            const parsed = parsePersonaMarkdown(body.systemPrompt, existing.id);
+            if (parsed.handle !== existing.handle) {
+                res.status(400).json({
+                    error: 'handle_changed',
+                    message: `parsed handle '${parsed.handle}' differs from URL handle '${existing.handle}'`,
+                });
+                return;
+            }
+        }
+        catch (err) {
+            res.status(400).json({
+                error: 'parse_failed',
+                message: err instanceof Error ? err.message : String(err),
+            });
+            return;
+        }
+        const filename = `${existing.id}.md`;
+        if (!FILENAME_RE.test(filename)) {
+            res.status(400).json({ error: 'invalid_filename' });
+            return;
+        }
+        const target = resolve(deps.agentsDir, filename);
+        if (!target.startsWith(deps.agentsDir + sep)) {
+            res.status(403).json({ error: 'outside_scope' });
+            return;
+        }
+        try {
+            await writeFile(target, body.systemPrompt, 'utf8');
+            deps.personas.reload();
+        }
+        catch (err) {
+            res.status(500).json({
+                error: 'write_failed',
+                message: err instanceof Error ? err.message : String(err),
+            });
+            return;
+        }
+        const reloaded = deps.personas.get(handle);
+        if (!reloaded) {
+            res.status(500).json({ error: 'reload_lost_persona' });
+            return;
+        }
+        res.json({ persona: reloaded });
+    });
+    return r;
+}
+//# sourceMappingURL=personas.js.map

package/dist/server/routes/personas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"personas.js","sourceRoot":"","sources":["../../../server/routes/personas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EACL,oBAAoB,GAErB,MAAM,+BAA+B,CAAC;AAkBvC,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,WAAW,GAAG,cAAc,CAAC;AAEnC,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAChD,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM;SACpC,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC;QACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAkC,CAAC;QACpD,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,gBAAgB;oBACvB,OAAO,EAAE,kBAAkB,MAAM,CAAC,MAAM,8BAA8B,QAAQ,CAAC,MAAM,GAAG;iBACzF,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,EAAE,KAAK,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server/routes/runs.js

@@ -0,0 +1,41 @@
+import { Router } from 'express';
+/**
+ * GET  /api/runs              — list runs (filter: ?status=...&workflow_id=...&limit=...)
+ * GET  /api/runs/:id          — run detail + ordered steps
+ */
+export function runsRouter(deps) {
+    const r = Router();
+    r.get('/runs', (req, res) => {
+        const status = typeof req.query.status === 'string' ? req.query.status : null;
+        const workflowId = typeof req.query.workflow_id === 'string' ? req.query.workflow_id : null;
+        const limit = clampLimit(req.query.limit);
+        const runs = deps.repos.runs.listRuns({
+            status: status, // schema validates inside repo
+            workflow_id: workflowId,
+            limit,
+        });
+        res.json({ runs });
+    });
+    r.get('/runs/:id', (req, res) => {
+        const id = Number(req.params.id);
+        if (!Number.isFinite(id)) {
+            res.status(400).json({ error: 'invalid_id' });
+            return;
+        }
+        const run = deps.repos.runs.getRun(id);
+        if (!run) {
+            res.status(404).json({ error: 'not_found' });
+            return;
+        }
+        const steps = deps.repos.runs.listSteps(id);
+        res.json({ run, steps });
+    });
+    return r;
+}
+function clampLimit(raw) {
+    const n = Number(raw);
+    if (!Number.isFinite(n) || n <= 0)
+        return 50;
+    return Math.min(Math.floor(n), 200);
+}
+//# sourceMappingURL=runs.js.map

package/dist/server/routes/runs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs.js","sourceRoot":"","sources":["../../../server/routes/runs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,IAA6B;IACtD,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9E,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;YACpC,MAAM,EAAE,MAAe,EAAE,+BAA+B;YACxD,WAAW,EAAE,UAAU;YACvB,KAAK;SACN,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YACzB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC"}

package/dist/server/routes/workflows.js

@@ -0,0 +1,38 @@
+import { Router } from 'express';
+/**
+ * GET /api/workflows         — list (id, title, step count, gate count)
+ * GET /api/workflows/:id     — single workflow definition (steps + gates)
+ *
+ * Faz 6.5 Workflows pane consumes the list endpoint; the detail endpoint
+ * feeds the DAG visualisation drawer.
+ */
+export function workflowsRouter(deps) {
+    const r = Router();
+    r.get('/workflows', (_req, res) => {
+        const workflows = deps.workflows.list().map((w) => ({
+            id: w.id,
+            title: w.title,
+            startCommand: w.startCommand,
+            nextWorkflowId: w.nextWorkflowId,
+            stepCount: w.steps.length,
+            gateCount: w.gates.length,
+        }));
+        const errors = deps.workflows.errors();
+        res.json({ workflows, errors });
+    });
+    r.get('/workflows/:id', (req, res) => {
+        const id = req.params.id;
+        if (typeof id !== 'string' || id.length === 0) {
+            res.status(400).json({ error: 'invalid_id' });
+            return;
+        }
+        const workflow = deps.workflows.get(id);
+        if (!workflow) {
+            res.status(404).json({ error: 'not_found' });
+            return;
+        }
+        res.json({ workflow });
+    });
+    return r;
+}
+//# sourceMappingURL=workflows.js.map

package/dist/server/routes/workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../../server/routes/workflows.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAGjC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAqC;IACnE,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;IAEnB,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;YACzB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;SAC1B,CAAC,CAAC,CAAC;QACJ,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACzB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/server/safety/harmful-output-filter.js

@@ -0,0 +1,40 @@
+/**
+ * Harmful output filter — placeholder.
+ *
+ * v3.0 ships an extension point only. The real implementation (v3.1+) will
+ * incorporate a curated bad-word list, prompt-injection signature matching,
+ * and policy-based classifiers. For now this module exposes the contract so
+ * downstream callers (worker-pool integration, dashboard) can wire it up
+ * without churn later.
+ */
+export class HarmfulOutputFilter {
+    phrases;
+    constructor(opts = {}) {
+        this.phrases = (opts.bannedPhrases ?? []).map((p) => p.toLowerCase());
+    }
+    /**
+     * Scan a chunk of output text. Returns an empty finding list when no
+     * banned phrases are configured.
+     */
+    scanText(body) {
+        const findings = [];
+        if (this.phrases.length === 0)
+            return { findings, shouldFailRun: false };
+        const lines = body.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i += 1) {
+            const lower = (lines[i] ?? '').toLowerCase();
+            for (const phrase of this.phrases) {
+                if (lower.includes(phrase)) {
+                    findings.push({
+                        kind: 'banned-phrase',
+                        message: `output contains banned phrase '${phrase}'`,
+                        line_number: i + 1,
+                        context: (lines[i] ?? '').slice(0, 200),
+                    });
+                }
+            }
+        }
+        return { findings, shouldFailRun: findings.length > 0 };
+    }
+}
+//# sourceMappingURL=harmful-output-filter.js.map

package/dist/server/safety/harmful-output-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harmful-output-filter.js","sourceRoot":"","sources":["../../../server/safety/harmful-output-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAwBH,MAAM,OAAO,mBAAmB;IACb,OAAO,CAAW;IAEnC,YAAY,OAAmC,EAAE;QAC/C,IAAI,CAAC,OAAO,GAAG,CAAC,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,IAAY;QACnB,MAAM,QAAQ,GAA2B,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;QAEzE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3B,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,eAAe;wBACrB,OAAO,EAAE,kCAAkC,MAAM,GAAG;wBACpD,WAAW,EAAE,CAAC,GAAG,CAAC;wBAClB,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;qBACxC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;CACF"}