syncpoint-ai 0.1.0

package/dist/server/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../_build/src/server/router.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA6BH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BpB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC"}

package/dist/server/router.js

@@ -0,0 +1,58 @@
+/**
+ * tRPC router for SyncPoint.
+ * Composes domain-specific sub-routers from ./routers/*.
+ */
+import { t } from "./routers/_trpc.js";
+import { agentRouter } from "./routers/agent-router.js";
+import { taskRouter } from "./routers/task-router.js";
+import { checkpointRouter, diaryRouter } from "./routers/checkpoint-router.js";
+import { handoffRouter } from "./routers/handoff-router.js";
+import { contractRouter } from "./routers/contract-router.js";
+import { contextSnapshotRouter } from "./routers/context-snapshot-router.js";
+import { pinnedMemoryRouter } from "./routers/memory-router.js";
+import { resumeContextRouter, eventRouter, adapterRouter } from "./routers/context-router.js";
+import { loopRouter } from "./routers/loop-router.js";
+import { projectMemoryRouter } from "./routers/project-memory-router.js";
+import { wakeRouter } from "./routers/wake-router.js";
+import { syncStatusRouter } from "./routers/sync-status-router.js";
+import { checkpointReviewRouter } from "./routers/checkpoint-review-router.js";
+import { constraintRouter } from "./routers/constraint-router.js";
+import { syncGateRouter } from "./routers/sync-gate-router.js";
+import { negotiationRouter } from "./routers/negotiation-router.js";
+import { agentManifestRouter } from "./routers/agent-manifest-router.js";
+import { agentRegistrationRouter } from "./routers/agent-registration-router.js";
+import { agentRegistryRouter } from "./routers/agent-registry-router.js";
+import { fileAuditRouter } from "./routers/file-audit-router.js";
+import { writeRouter } from "./routers/write-router.js";
+import { guardRouter } from "./routers/guard-router.js";
+import { agentMessageRouter } from "./routers/agent-message-router.js";
+// ── Root router ────────────────────────────────────────
+export const appRouter = t.router({
+    agent: agentRouter,
+    task: taskRouter,
+    checkpoint: checkpointRouter,
+    diary: diaryRouter,
+    handoff: handoffRouter,
+    contract: contractRouter,
+    contextSnapshot: contextSnapshotRouter,
+    event: eventRouter,
+    pinnedMemory: pinnedMemoryRouter,
+    resumeContext: resumeContextRouter,
+    adapter: adapterRouter,
+    loop: loopRouter,
+    projectMemory: projectMemoryRouter,
+    wake: wakeRouter,
+    syncStatus: syncStatusRouter,
+    checkpointReview: checkpointReviewRouter,
+    constraint: constraintRouter,
+    syncGate: syncGateRouter,
+    negotiation: negotiationRouter,
+    agentManifest: agentManifestRouter,
+    agentRegistration: agentRegistrationRouter,
+    agentRegistry: agentRegistryRouter,
+    fileAudit: fileAuditRouter,
+    write: writeRouter,
+    guard: guardRouter,
+    agentMessage: agentMessageRouter,
+});
+//# sourceMappingURL=router.js.map

package/dist/server/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../_build/src/server/router.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,oBAAoB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AACjF,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAEvE,0DAA0D;AAE1D,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,UAAU;IAChB,UAAU,EAAE,gBAAgB;IAC5B,KAAK,EAAE,WAAW;IAClB,OAAO,EAAE,aAAa;IACtB,QAAQ,EAAE,cAAc;IACxB,eAAe,EAAE,qBAAqB;IACtC,KAAK,EAAE,WAAW;IAClB,YAAY,EAAE,kBAAkB;IAChC,aAAa,EAAE,mBAAmB;IAClC,OAAO,EAAE,aAAa;IACtB,IAAI,EAAE,UAAU;IAChB,aAAa,EAAE,mBAAmB;IAClC,IAAI,EAAE,UAAU;IAChB,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,sBAAsB;IACxC,UAAU,EAAE,gBAAgB;IAC5B,QAAQ,EAAE,cAAc;IACxB,WAAW,EAAE,iBAAiB;IAC9B,aAAa,EAAE,mBAAmB;IAClC,iBAAiB,EAAE,uBAAuB;IAC1C,aAAa,EAAE,mBAAmB;IAClC,SAAS,EAAE,eAAe;IAC1B,KAAK,EAAE,WAAW;IAClB,KAAK,EAAE,WAAW;IAClB,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC"}

package/dist/server/routers/_trpc.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Shared tRPC initialization.
+ *
+ * P0 Hardening: tRPC context carries authenticated caller identity.
+ * - publicProcedure: no auth required (reads, metadata, health).
+ * - protectedProcedure: requires `x-caller-id` header (mutations, exports, projection).
+ * - adminProcedure: requires `x-caller-id` + admin role (constraint management, config).
+ */
+import type { IncomingMessage } from "node:http";
+export interface TRPCContext {
+    /** Authenticated caller identity, derived from x-caller-id header. null if absent. */
+    callerId: string | null;
+    /** Agent role, derived from x-agent-role header or agent registry. null if unauthenticated. */
+    callerRole: string | null;
+    /** Agent token, derived from x-agent-token header. null if absent. */
+    callerToken: string | null;
+}
+/**
+ * Validate an agent token.
+ * Currently supports simple shared-secret tokens.
+ * Future: JWT validation, registry-backed lookup.
+ */
+declare function validateAgentToken(token: string): {
+    valid: boolean;
+    agentId?: string;
+    role?: string;
+};
+/**
+ * Create tRPC context from the incoming HTTP request.
+ * Extracts caller identity, role, and token from headers.
+ */
+export declare function createContext(req: IncomingMessage): TRPCContext;
+export declare const t: import("@trpc/server").TRPCRootObject<TRPCContext, object, import("@trpc/server").TRPCRuntimeConfigOptions<TRPCContext, object>, {
+    ctx: TRPCContext;
+    meta: object;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}>;
+/** Public: no auth required. Suitable for health checks, status, and read-only queries. */
+export declare const publicProcedure: import("@trpc/server").TRPCProcedureBuilder<TRPCContext, object, object, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
+/**
+ * Protected: requires authenticated caller identity.
+ * 1. Validates agent token if present (x-agent-token header).
+ * 2. Rejects with UNAUTHORIZED if caller identity cannot be established.
+ * 3. Applies rate limiting per caller.
+ */
+export declare const protectedProcedure: import("@trpc/server").TRPCProcedureBuilder<TRPCContext, object, {
+    callerId: string | null;
+    callerRole: string | null;
+    callerToken: string | null;
+}, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
+/**
+ * Admin: requires caller identity + admin role.
+ * Rejects with FORBIDDEN if the caller does not have an admin role.
+ */
+export declare const adminProcedure: import("@trpc/server").TRPCProcedureBuilder<TRPCContext, object, {
+    callerId: string | null;
+    callerRole: string | null;
+    callerToken: string | null;
+}, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, import("@trpc/server").TRPCUnsetMarker, false>;
+/**
+ * Authorize an operation against the caller context.
+ * Throws FORBIDDEN if the caller lacks the required role or ownership.
+ *
+ * @param ctx - Authenticated tRPC context
+ * @param operation - The operation being attempted (e.g. 'claimResource')
+ * @param resourceOwnerId - For ownResourceOnly checks, the owner of the resource
+ */
+export declare function authorize(ctx: TRPCContext, operation: string, resourceOwnerId?: string): void;
+/**
+ * Log an auditable operation. Call this from mutation handlers
+ * for sensitive operations (resource claims, constraint changes, approvals).
+ */
+export declare function auditLog(operation: string, ctx: TRPCContext, detail?: Record<string, unknown>): void;
+/** Exported for testing only. */
+export { validateAgentToken };
+//# sourceMappingURL=_trpc.d.ts.map

package/dist/server/routers/_trpc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_trpc.d.ts","sourceRoot":"","sources":["../../../_build/src/server/routers/_trpc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAMjD,MAAM,WAAW,WAAW;IAC1B,sFAAsF;IACtF,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+FAA+F;IAC/F,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,sEAAsE;IACtE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAoCD;;;;GAIG;AACH,iBAAS,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAS9F;AAID;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,GAAG,WAAW,CAQ/D;AAID,eAAO,MAAM,CAAC;;;;;EAA2C,CAAC;AAI1D,2FAA2F;AAC3F,eAAO,MAAM,eAAe,iPAAc,CAAC;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB;;;;yKA+B7B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,cAAc;;;;yKAQzB,CAAC;AAiBH;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CA+B7F;AAID;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAOpG;AAID,iCAAiC;AACjC,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/server/routers/_trpc.js

@@ -0,0 +1,194 @@
+/**
+ * Shared tRPC initialization.
+ *
+ * P0 Hardening: tRPC context carries authenticated caller identity.
+ * - publicProcedure: no auth required (reads, metadata, health).
+ * - protectedProcedure: requires `x-caller-id` header (mutations, exports, projection).
+ * - adminProcedure: requires `x-caller-id` + admin role (constraint management, config).
+ */
+import { initTRPC, TRPCError } from "@trpc/server";
+import { logger } from "../logger.js";
+import { withTrace } from "../trace.js";
+// ── Rate limiter (simple token bucket, per-caller) ─────
+const rateLimitBuckets = new Map();
+const RATE_LIMIT = 100; // requests per second
+const RATE_REFILL_MS = 1000; // refill interval
+function checkRateLimit(callerId) {
+    const now = Date.now();
+    let bucket = rateLimitBuckets.get(callerId);
+    if (!bucket) {
+        bucket = { tokens: RATE_LIMIT, lastRefill: now };
+        rateLimitBuckets.set(callerId, bucket);
+    }
+    // Refill
+    const elapsed = now - bucket.lastRefill;
+    if (elapsed > RATE_REFILL_MS) {
+        bucket.tokens = Math.min(RATE_LIMIT, bucket.tokens + Math.floor(elapsed / RATE_REFILL_MS) * RATE_LIMIT);
+        bucket.lastRefill = now;
+    }
+    if (bucket.tokens <= 0)
+        return false;
+    bucket.tokens--;
+    return true;
+}
+// Clean up stale rate limit entries every 5 minutes
+setInterval(() => {
+    const cutoff = Date.now() - 300_000;
+    for (const [id, bucket] of rateLimitBuckets) {
+        if (bucket.lastRefill < cutoff)
+            rateLimitBuckets.delete(id);
+    }
+}, 300_000).unref();
+// ── Auth helpers ────────────────────────────────────────
+/**
+ * Validate an agent token.
+ * Currently supports simple shared-secret tokens.
+ * Future: JWT validation, registry-backed lookup.
+ */
+function validateAgentToken(token) {
+    // If SYNCPOINT_SHARED_SECRET is set, require it as the token
+    const sharedSecret = process.env.SYNCPOINT_SHARED_SECRET;
+    if (sharedSecret) {
+        if (token !== sharedSecret)
+            return { valid: false };
+    }
+    // Without shared secret, accept any non-empty token (trust-on-localhost mode)
+    // The callerId from x-caller-id is the primary identity
+    return { valid: true };
+}
+// ── Context factory ─────────────────────────────────────
+/**
+ * Create tRPC context from the incoming HTTP request.
+ * Extracts caller identity, role, and token from headers.
+ */
+export function createContext(req) {
+    const rawCaller = req.headers["x-caller-id"];
+    const rawRole = req.headers["x-agent-role"];
+    const rawToken = req.headers["x-agent-token"];
+    const callerId = typeof rawCaller === "string" && rawCaller.trim().length > 0 ? rawCaller.trim() : null;
+    const callerRole = typeof rawRole === "string" && rawRole.trim().length > 0 ? rawRole.trim() : null;
+    const callerToken = typeof rawToken === "string" && rawToken.trim().length > 0 ? rawToken.trim() : null;
+    return { callerId, callerRole, callerToken };
+}
+// ── tRPC init ───────────────────────────────────────────
+export const t = initTRPC.context().create();
+// ── Procedures ──────────────────────────────────────────
+/** Public: no auth required. Suitable for health checks, status, and read-only queries. */
+export const publicProcedure = t.procedure;
+/**
+ * Protected: requires authenticated caller identity.
+ * 1. Validates agent token if present (x-agent-token header).
+ * 2. Rejects with UNAUTHORIZED if caller identity cannot be established.
+ * 3. Applies rate limiting per caller.
+ */
+export const protectedProcedure = t.procedure.use(({ ctx, next, path }) => {
+    // Token validation: if a token is provided, validate it
+    if (ctx.callerToken) {
+        const result = validateAgentToken(ctx.callerToken);
+        if (!result.valid) {
+            throw new TRPCError({
+                code: "UNAUTHORIZED",
+                message: "Invalid agent token.",
+            });
+        }
+    }
+    // Caller identity required — either from token or x-caller-id
+    if (!ctx.callerId) {
+        throw new TRPCError({
+            code: "UNAUTHORIZED",
+            message: "Authentication required. Provide x-caller-id header.",
+        });
+    }
+    // Rate limiting
+    if (!checkRateLimit(ctx.callerId)) {
+        logger.warn("Rate limit exceeded", { callerId: ctx.callerId, path });
+        throw new TRPCError({
+            code: "TOO_MANY_REQUESTS",
+            message: "Rate limit exceeded. Slow down.",
+        });
+    }
+    return withTrace(() => next({
+        ctx: { ...ctx, callerId: ctx.callerId },
+    }), { callerId: ctx.callerId, operation: path });
+});
+/**
+ * Admin: requires caller identity + admin role.
+ * Rejects with FORBIDDEN if the caller does not have an admin role.
+ */
+export const adminProcedure = protectedProcedure.use(({ ctx, next }) => {
+    if (ctx.callerRole !== "admin" && ctx.callerRole !== "owner") {
+        throw new TRPCError({
+            code: "FORBIDDEN",
+            message: "Admin role required for this operation.",
+        });
+    }
+    return next({ ctx });
+});
+// ── Per-operation authorization ─────────────────────────
+/** Operation permission rules: maps operation → required role/ownership constraint. */
+const OPERATION_PERMISSIONS = {
+    claimResource: { role: ["agent", "admin", "owner"] },
+    releaseResource: { role: ["agent", "admin", "owner"], ownResourceOnly: true },
+    resolveConflict: { role: ["agent", "admin", "owner"] },
+    createConstraint: { role: ["admin", "owner"] },
+    modifyConstraint: { role: ["admin", "owner"] },
+    createCheckpoint: { role: ["agent", "admin", "owner"] },
+    approveCheckpoint: { role: ["agent", "admin", "owner"] },
+    rejectCheckpoint: { role: ["agent", "admin", "owner"] },
+    forceRecover: { role: ["admin", "owner"] },
+};
+/**
+ * Authorize an operation against the caller context.
+ * Throws FORBIDDEN if the caller lacks the required role or ownership.
+ *
+ * @param ctx - Authenticated tRPC context
+ * @param operation - The operation being attempted (e.g. 'claimResource')
+ * @param resourceOwnerId - For ownResourceOnly checks, the owner of the resource
+ */
+export function authorize(ctx, operation, resourceOwnerId) {
+    const perm = OPERATION_PERMISSIONS[operation];
+    if (!perm) {
+        // Default-deny: operations without explicit permission rules are forbidden
+        throw new TRPCError({
+            code: "FORBIDDEN",
+            message: `Operation '${operation}' is not authorized. No permission rule defined.`,
+        });
+    }
+    // Role check
+    if (perm.role && perm.role.length > 0) {
+        const callerRole = ctx.callerRole ?? "agent"; // default role
+        if (!perm.role.includes(callerRole)) {
+            throw new TRPCError({
+                code: "FORBIDDEN",
+                message: `Role '${callerRole}' is not authorized for operation '${operation}'. Required: ${perm.role.join(", ")}`,
+            });
+        }
+    }
+    // Ownership check
+    if (perm.ownResourceOnly && resourceOwnerId && ctx.callerId !== resourceOwnerId) {
+        // Admin/owner can bypass ownership
+        if (ctx.callerRole !== "admin" && ctx.callerRole !== "owner") {
+            throw new TRPCError({
+                code: "FORBIDDEN",
+                message: `Only the resource owner or admin can perform '${operation}'.`,
+            });
+        }
+    }
+}
+// ── Audit logger ────────────────────────────────────────
+/**
+ * Log an auditable operation. Call this from mutation handlers
+ * for sensitive operations (resource claims, constraint changes, approvals).
+ */
+export function auditLog(operation, ctx, detail) {
+    logger.info(`AUDIT: ${operation}`, {
+        callerId: ctx.callerId,
+        callerRole: ctx.callerRole,
+        operation,
+        ...detail,
+    });
+}
+// ── Test exports ────────────────────────────────────────
+/** Exported for testing only. */
+export { validateAgentToken };
+//# sourceMappingURL=_trpc.js.map

package/dist/server/routers/_trpc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"_trpc.js","sourceRoot":"","sources":["../../../_build/src/server/routers/_trpc.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEnD,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAaxC,0DAA0D;AAE1D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAkD,CAAC;AACnF,MAAM,UAAU,GAAG,GAAG,CAAC,CAAQ,sBAAsB;AACrD,MAAM,cAAc,GAAG,IAAI,CAAC,CAAG,kBAAkB;AAEjD,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACjD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,SAAS;IACT,MAAM,OAAO,GAAG,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC;IACxC,IAAI,OAAO,GAAG,cAAc,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,cAAc,CAAC,GAAG,UAAU,CAAC,CAAC;QACxG,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,MAAM,EAAE,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,oDAAoD;AACpD,WAAW,CAAC,GAAG,EAAE;IACf,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;IACpC,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,gBAAgB,EAAE,CAAC;QAC5C,IAAI,MAAM,CAAC,UAAU,GAAG,MAAM;YAAE,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC;AAEpB,2DAA2D;AAE3D;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,6DAA6D;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACzD,IAAI,YAAY,EAAE,CAAC;QACjB,IAAI,KAAK,KAAK,YAAY;YAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC;IACD,8EAA8E;IAC9E,wDAAwD;IACxD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,2DAA2D;AAE3D;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,GAAoB;IAChD,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,MAAM,UAAU,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACpG,MAAM,WAAW,GAAG,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxG,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;AAC/C,CAAC;AAED,2DAA2D;AAE3D,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAe,CAAC,MAAM,EAAE,CAAC;AAE1D,2DAA2D;AAE3D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,SAAS,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;IACxE,wDAAwD;IACxD,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAClB,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,sBAAsB;aAChC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,sDAAsD;SAChE,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;IAChB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,iCAAiC;SAC3C,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC1B,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE;KACxC,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;IACrE,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,yCAAyC;SACnD,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,2DAA2D;AAE3D,uFAAuF;AACvF,MAAM,qBAAqB,GAAmE;IAC5F,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;IACpD,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE;IAC7E,eAAe,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;IACtD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;IAC9C,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;IAC9C,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;IACvD,iBAAiB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;IACxD,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;IACvD,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;CAC3C,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAAgB,EAAE,SAAiB,EAAE,eAAwB;IACrF,MAAM,IAAI,GAAG,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,2EAA2E;QAC3E,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,cAAc,SAAS,kDAAkD;SACnF,CAAC,CAAC;IACL,CAAC;IAED,aAAa;IACb,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,CAAC,eAAe;QAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,SAAS,UAAU,sCAAsC,SAAS,gBAAgB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAClH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,IAAI,IAAI,CAAC,eAAe,IAAI,eAAe,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAChF,mCAAmC;QACnC,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,IAAI,GAAG,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAC7D,MAAM,IAAI,SAAS,CAAC;gBAClB,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,iDAAiD,SAAS,IAAI;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,2DAA2D;AAE3D;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,SAAiB,EAAE,GAAgB,EAAE,MAAgC;IAC5F,MAAM,CAAC,IAAI,CAAC,UAAU,SAAS,EAAE,EAAE;QACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS;QACT,GAAG,MAAM;KACV,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAE3D,iCAAiC;AACjC,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/server/routers/agent-manifest-router.d.ts

@@ -0,0 +1,101 @@
+export declare const agentManifestRouter: import("@trpc/server").TRPCBuiltRouter<{
+    ctx: import("./_trpc.js").TRPCContext;
+    meta: object;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    upsert: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            agentId: string;
+            tags?: string[] | undefined;
+            capabilities?: {
+                domain: string;
+                resourceTypes?: string[] | undefined;
+                skills?: string[] | undefined;
+            }[] | undefined;
+            escalationPreference?: {
+                optIn?: "never" | "always" | "when_available" | undefined;
+                priority?: number | undefined;
+                maxConcurrentEscalations?: number | undefined;
+            } | undefined;
+            availability?: "online" | "busy" | "offline" | undefined;
+            canHandleHumanEscalation?: boolean | undefined;
+        };
+        output: {
+            agentId: string;
+            tags: string[];
+            capabilities: {
+                domain: string;
+                resourceTypes: string[];
+                skills: string[];
+            }[];
+            escalationPreference: {
+                optIn: import("../../index.js").EscalationOptIn;
+                priority: number;
+                maxConcurrentEscalations: number;
+            };
+            availability: import("../../index.js").AgentAvailability;
+            canHandleHumanEscalation: boolean;
+        };
+        meta: object;
+    }>;
+    get: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            agentId: string;
+        };
+        output: {
+            agentId: string;
+            tags: string[];
+            capabilities: {
+                domain: string;
+                resourceTypes: string[];
+                skills: string[];
+            }[];
+            escalationPreference: {
+                optIn: import("../../index.js").EscalationOptIn;
+                priority: number;
+                maxConcurrentEscalations: number;
+            };
+            availability: import("../../index.js").AgentAvailability;
+            canHandleHumanEscalation: boolean;
+        } | null;
+        meta: object;
+    }>;
+    list: import("@trpc/server").TRPCQueryProcedure<{
+        input: void;
+        output: {
+            agentId: string;
+            tags: string[];
+            capabilities: {
+                domain: string;
+                resourceTypes: string[];
+                skills: string[];
+            }[];
+            escalationPreference: {
+                optIn: import("../../index.js").EscalationOptIn;
+                priority: number;
+                maxConcurrentEscalations: number;
+            };
+            availability: import("../../index.js").AgentAvailability;
+            canHandleHumanEscalation: boolean;
+        }[];
+        meta: object;
+    }>;
+    delete: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            agentId: string;
+        };
+        output: {
+            ok: boolean;
+        };
+        meta: object;
+    }>;
+    routeEscalation: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            gateId: string;
+        };
+        output: import("../../index.js").EscalationCandidate[];
+        meta: object;
+    }>;
+}>>;
+//# sourceMappingURL=agent-manifest-router.d.ts.map

package/dist/server/routers/agent-manifest-router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-manifest-router.d.ts","sourceRoot":"","sources":["../../../_build/src/server/routers/agent-manifest-router.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmC9B,CAAC"}

package/dist/server/routers/agent-manifest-router.js

@@ -0,0 +1,38 @@
+/**
+ * Agent Manifest Router — tRPC endpoints for manifest CRUD + escalation routing.
+ */
+import { z } from "zod";
+import { manifestUpsert, manifestGet, manifestList, manifestDelete, routeGateEscalation, } from "../application/escalation-routing-service.js";
+import { t, publicProcedure, protectedProcedure } from "./_trpc.js";
+export const agentManifestRouter = t.router({
+    upsert: protectedProcedure
+        .input(z.object({
+        agentId: z.string(),
+        capabilities: z.array(z.object({
+            domain: z.string(),
+            skills: z.array(z.string()).optional().default([]),
+            resourceTypes: z.array(z.string()).optional().default([]),
+        })).optional(),
+        escalationPreference: z.object({
+            optIn: z.enum(["always", "when_available", "never"]).optional(),
+            priority: z.number().int().min(0).max(100).optional(),
+            maxConcurrentEscalations: z.number().int().min(0).optional(),
+        }).optional(),
+        availability: z.enum(["online", "busy", "offline"]).optional(),
+        canHandleHumanEscalation: z.boolean().optional(),
+        tags: z.array(z.string()).optional(),
+    }))
+        .mutation(({ input }) => manifestUpsert(input.agentId, input)),
+    get: publicProcedure
+        .input(z.object({ agentId: z.string() }))
+        .query(({ input }) => manifestGet(input.agentId)),
+    list: publicProcedure
+        .query(() => manifestList()),
+    delete: protectedProcedure
+        .input(z.object({ agentId: z.string() }))
+        .mutation(({ input }) => { manifestDelete(input.agentId); return { ok: true }; }),
+    routeEscalation: protectedProcedure
+        .input(z.object({ gateId: z.string() }))
+        .query(({ input }) => routeGateEscalation(input.gateId)),
+});
+//# sourceMappingURL=agent-manifest-router.js.map

package/dist/server/routers/agent-manifest-router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-manifest-router.js","sourceRoot":"","sources":["../../../_build/src/server/routers/agent-manifest-router.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EACzD,mBAAmB,GACpB,MAAM,8CAA8C,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEpE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAE1C,MAAM,EAAE,kBAAkB;SACvB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACd,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAClD,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;SAC1D,CAAC,CAAC,CAAC,QAAQ,EAAE;QACd,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC;YAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YACrD,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;SAC7D,CAAC,CAAC,QAAQ,EAAE;QACb,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC9D,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;KACrC,CAAC,CAAC;SACF,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAA6C,CAAC,CAAC;IAExG,GAAG,EAAE,eAAe;SACjB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACxC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEnD,IAAI,EAAE,eAAe;SAClB,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC;IAE9B,MAAM,EAAE,kBAAkB;SACvB,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACxC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEnF,eAAe,EAAE,kBAAkB;SAChC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;SACvC,KAAK,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;CAC3D,CAAC,CAAC"}

package/dist/server/routers/agent-message-router.d.ts

@@ -0,0 +1,149 @@
+import { AgentMessageKind, AgentMessageRequestStatus } from "../../adapters/index.js";
+export declare const agentMessageRouter: import("@trpc/server").TRPCBuiltRouter<{
+    ctx: import("./_trpc.js").TRPCContext;
+    meta: object;
+    errorShape: import("@trpc/server").TRPCDefaultErrorShape;
+    transformer: false;
+}, import("@trpc/server").TRPCDecorateCreateRouterOptions<{
+    send: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            fromAgent: string;
+            toAgent: string;
+            kind?: AgentMessageKind | undefined;
+            expiresAt?: string | null | undefined;
+            subject?: string | undefined;
+            body?: string | undefined;
+            threadRootId?: string | null | undefined;
+            replyToMessageId?: string | null | undefined;
+        };
+        output: {
+            id: string;
+            createdAt: string;
+            escalatedAt: string | null;
+            kind: AgentMessageKind;
+            expiresAt: string | null;
+            fromAgent: string;
+            toAgent: string;
+            subject: string;
+            body: string;
+            threadRootId: string | null;
+            replyToMessageId: string | null;
+            readStatus: import("../../adapters/agent-message.js").AgentMessageReadStatus;
+            readAt: string | null;
+            requestStatus: AgentMessageRequestStatus;
+            respondedAt: string | null;
+            retryCount: number;
+            lastRetryAt: string | null;
+        };
+        meta: object;
+    }>;
+    list: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            kind?: AgentMessageKind | undefined;
+            fromAgent?: string | undefined;
+            toAgent?: string | undefined;
+            requestStatus?: AgentMessageRequestStatus | undefined;
+            limit?: number | undefined;
+            unreadOnly?: boolean | undefined;
+        };
+        output: {
+            id: string;
+            createdAt: string;
+            escalatedAt: string | null;
+            kind: AgentMessageKind;
+            expiresAt: string | null;
+            fromAgent: string;
+            toAgent: string;
+            subject: string;
+            body: string;
+            threadRootId: string | null;
+            replyToMessageId: string | null;
+            readStatus: import("../../adapters/agent-message.js").AgentMessageReadStatus;
+            readAt: string | null;
+            requestStatus: AgentMessageRequestStatus;
+            respondedAt: string | null;
+            retryCount: number;
+            lastRetryAt: string | null;
+        }[];
+        meta: object;
+    }>;
+    read: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            agentId: string;
+            messageId: string;
+        };
+        output: {
+            id: string;
+            createdAt: string;
+            escalatedAt: string | null;
+            kind: AgentMessageKind;
+            expiresAt: string | null;
+            fromAgent: string;
+            toAgent: string;
+            subject: string;
+            body: string;
+            threadRootId: string | null;
+            replyToMessageId: string | null;
+            readStatus: import("../../adapters/agent-message.js").AgentMessageReadStatus;
+            readAt: string | null;
+            requestStatus: AgentMessageRequestStatus;
+            respondedAt: string | null;
+            retryCount: number;
+            lastRetryAt: string | null;
+        };
+        meta: object;
+    }>;
+    reply: import("@trpc/server").TRPCMutationProcedure<{
+        input: {
+            agentId: string;
+            body: string;
+            messageId: string;
+        };
+        output: {
+            id: string;
+            createdAt: string;
+            escalatedAt: string | null;
+            kind: AgentMessageKind;
+            expiresAt: string | null;
+            fromAgent: string;
+            toAgent: string;
+            subject: string;
+            body: string;
+            threadRootId: string | null;
+            replyToMessageId: string | null;
+            readStatus: import("../../adapters/agent-message.js").AgentMessageReadStatus;
+            readAt: string | null;
+            requestStatus: AgentMessageRequestStatus;
+            respondedAt: string | null;
+            retryCount: number;
+            lastRetryAt: string | null;
+        };
+        meta: object;
+    }>;
+    thread: import("@trpc/server").TRPCQueryProcedure<{
+        input: {
+            threadRootId: string;
+        };
+        output: {
+            id: string;
+            createdAt: string;
+            escalatedAt: string | null;
+            kind: AgentMessageKind;
+            expiresAt: string | null;
+            fromAgent: string;
+            toAgent: string;
+            subject: string;
+            body: string;
+            threadRootId: string | null;
+            replyToMessageId: string | null;
+            readStatus: import("../../adapters/agent-message.js").AgentMessageReadStatus;
+            readAt: string | null;
+            requestStatus: AgentMessageRequestStatus;
+            respondedAt: string | null;
+            retryCount: number;
+            lastRetryAt: string | null;
+        }[];
+        meta: object;
+    }>;
+}>>;
+//# sourceMappingURL=agent-message-router.d.ts.map