toolroll 0.9.57 → 0.9.59

package/dist/task-status.js

@@ -261,7 +261,9 @@ export const taskStatusOf = statusOf;
  * wait on a person stay Needs you; everything else waits in the queue. */
 const CODE_STAGE = {
     queued: ["queued"], ready: ["queued"], "worker-at-capacity": ["queued"], "retry-scheduled": ["queued"], updating: ["queued"],
-    "waiting-dependency": ["queued"], "scouting-ready": ["queued"], "planning-ready": ["queued"], "provider-quota": ["queued"], "planner-source": ["queued"],
+    "waiting-dependency": ["queued"], "scouting-ready": ["queued"], "planning-ready": ["queued"], "provider-quota": ["queued"],
+    // A request the planner cannot be given (too long to hand back, say) waits on a person to shorten it.
+    "planner-source": ["needs-you", "fix-request"],
     running: ["building"], reviewing: ["reviewing"], "review-pending": ["building"],
     "signed-out": ["needs-you", "sign-in"],
     "needs-approval": ["needs-you", "approval"],

package/dist/team-cli.d.ts

@@ -14,6 +14,9 @@ export type TeamCliOptions = {
 export declare const TEAM_CLI_ACTIONS: readonly ['connect', 'lead list', 'lead create', 'lead update', 'lead member', 'lead transfer', 'conversation list', 'conversation create', 'conversation show', 'conversation member', 'conversation edit', 'conversation withdraw', 'conversation read', 'conversation follow', 'conversation stop'];
 export declare class UsageError extends Error {
 }
+/** Credentials are never sent to a URL with embedded authority, an API path, query, fragment or an insecure remote
+ * host. Fetch cannot follow redirects. */
+export declare function serviceOrigin(raw: string): string;
 type Profile = {
     origin: string;
     account: string;

package/dist/team-cli.js

@@ -5,11 +5,11 @@ import { randomBytes } from 'node:crypto';
 import { createInterface } from 'node:readline/promises';
 import { setTimeout as delay } from 'node:timers/promises';
 import { envelopeJson } from './envelope.js';
-import { sessionServiceOrigin } from './session-cli.js';
 import { databasePath } from './store.js';
 import { configBase, namedPath } from './names.js';
 import { parseApiToken } from './api-tokens.js';
 import { deprecationWarning } from './deprecations.js';
+import { PASSWORD_PROFILE_WARNING } from './password-bearer.js';
 /** The central service's own lead verbs; every other `lead …` (token, say, or none) is the local lead's. */
 const CENTRAL_LEAD_ACTIONS = ['list', 'create', 'update', 'member', 'transfer'];
 /** D5: deprecated (deprecations.ts). Each still runs this release, hidden from help and the contract, with one warning on stderr. */
@@ -45,6 +45,22 @@ existing local commands. Credentials stay in a private file, never in URLs or ar
 Reads and attachment do not start model work. Server permissions remain authoritative.`;
 export class UsageError extends Error {
 }
+/** Credentials are never sent to a URL with embedded authority, an API path, query, fragment or an insecure remote
+ * host. Fetch cannot follow redirects. */
+export function serviceOrigin(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new UsageError('The service origin must be HTTPS or loopback HTTP.');
+    }
+    if (url.username || url.password || url.search || url.hash || url.pathname !== '/')
+        throw new UsageError('The service origin must contain only the origin, with no credentials, path, query or fragment.');
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['127.0.0.1', '[::1]', 'localhost'].includes(url.hostname)))
+        throw new UsageError('The service origin requires HTTPS except for loopback HTTP.');
+    return url.origin;
+}
 /** Transport metadata stays local to the CLI; only an actual HTTP 429 permits a follower read retry. */
 const RETRY_AFTER_MS = Symbol('retry-after-ms');
 function retryDelay(header) {
@@ -104,7 +120,7 @@ function profiles(options) {
         if (!record(parsed) || parsed.version !== 1 || typeof parsed.active !== 'string' || !record(parsed.profiles))
             throw new Error();
         for (const [name, one] of Object.entries(parsed.profiles)) {
-            if (!/^[A-Za-z0-9_-]{1,64}$/.test(name) || !record(one) || typeof one.origin !== 'string' || sessionServiceOrigin(one.origin) !== one.origin || typeof one.account !== 'string' || !accountValid(one.account) || typeof one.token !== 'string' || !tokenValid(one.token))
+            if (!/^[A-Za-z0-9_-]{1,64}$/.test(name) || !record(one) || typeof one.origin !== 'string' || serviceOrigin(one.origin) !== one.origin || typeof one.account !== 'string' || !accountValid(one.account) || typeof one.token !== 'string' || !tokenValid(one.token))
                 throw new Error();
         }
         if (!Object.hasOwn(parsed.profiles, parsed.active))
@@ -387,7 +403,7 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (command === 'connect') {
             let origin;
             try {
-                origin = sessionServiceOrigin(parsed.positions[0]);
+                origin = serviceOrigin(parsed.positions[0]);
             }
             catch {
                 throw new UsageError('Use an HTTPS service origin (loopback HTTP is allowed), without credentials, paths, query or fragment.');
@@ -408,6 +424,8 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
                 secret = (flags['token-file'] ? privateFile(value(flags, 'token-file'), 8192) : await (options.readStdin ?? stdinSecret)()).trim();
             if (!accountValid(account) || !tokenValid(secret))
                 throw new UsageError('Provide an account name and a valid sign-in secret from your selected source.');
+            if (parseApiToken(secret) === null)
+                stderr(PASSWORD_PROFILE_WARNING);
             const profile = { origin, account, token: secret }, checked = await perform(profile, { operation: 'list', args: {} }, options);
             if (!checked.ok) {
                 emit(checked);
@@ -421,6 +439,8 @@ export async function maybeRunTeamCommand(argv, write, options = {}) {
         if (!profile || !Object.hasOwn(saved.profiles, profileName))
             throw new UsageError('No saved connection. Use connect with your individual sign-in first.');
         secret = profile.token;
+        if (parseApiToken(secret) === null)
+            stderr(PASSWORD_PROFILE_WARNING);
         const call = (operation, args, signal) => perform(profile, { operation, args }, { ...options, ...(signal === undefined ? {} : { signal }) });
         if (command === 'chat' || command === 'brief')
             return await chat(command, flags, profile.account, call, emit, options, stderr);

package/dist/telegram-lead.js

@@ -204,6 +204,12 @@ export function applyProposalTap(store, binding, token, message, repos, options,
     const who = verified.who;
     const preview = proposalPreview(store, proposal, actionRepos, "telegram");
     const origin = options.phoneOrigin?.() ?? null;
+    if (preview.closed) {
+        store.consumeTelegramProposalActions(proposal.id, now);
+        ack("This question is closed.");
+        edit(preview.text, []);
+        return { effects, confirmed: false, ignored: true };
+    }
     if (action.phase === "dismiss") {
         if (!store.consumeTelegramProposalAction(token, now)) {
             ack("that button was already used");

package/dist/telegram.js

@@ -25,7 +25,7 @@ import { resultImageFileName, resultTaskLabel, verifyResultImage } from "./chat-
 import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
 import { chmodSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { validateNote } from "./decision.js";
+import { closedQuestionWords, validateNote } from "./decision.js";
 import { isShotsKind, resultShotsFor } from "./result-shots.js";
 import { isLifecycleNotification, isTelegramProgressNotification, RESULT_SHOTS_KIND, TELEGRAM_HOLD_REASONS } from "./store.js";
 import { telegramProgressCard } from "./telegram-progress.js";
@@ -1998,7 +1998,7 @@ function applyNote(context, update, effects) {
         return;
     }
     if (decision.state === "answered") {
-        say(`already answered: ${decision.choice ?? "?"} — this note did not travel`);
+        say(`${decision.supersededReason !== null ? closedQuestionWords(decision.supersededReason) : `already answered: ${decision.choice ?? "?"}`} — this note did not travel`);
         report.ignored++;
         return;
     }
@@ -2344,8 +2344,8 @@ function applyCallback(context, update, effects) {
     }
     if (decision.state === "answered") {
         store.consumeTelegramAction(token, clock());
-        ack(`already answered: ${decision.choice ?? "?"}`);
-        editText(answeredText(store, decision));
+        ack(decision.supersededReason !== null ? closedQuestionWords(decision.supersededReason) : `already answered: ${decision.choice ?? "?"}`);
+        editText(answeredText(store, decision), []);
         return;
     }
     if (action.phase === "choose") {
@@ -2451,13 +2451,13 @@ function answerNow(context, decision, choice, binding, ack, editText) {
         editText(answeredText(store, answered.decision));
         return;
     }
-    if (answered.reason === "already-answered") {
+    if (answered.reason === "already-answered" || answered.reason === "closed") {
         if (draft !== null)
             store.setNoteDraftState(draft.id, "discarded");
         const settled = store.getDecision(decision.id);
-        ack(`already answered: ${settled?.choice ?? "?"}${draft === null ? "" : " — your note did NOT travel"}`);
+        ack(`${settled?.supersededReason != null ? closedQuestionWords(settled.supersededReason) : `already answered: ${settled?.choice ?? "?"}`}${draft === null ? "" : " — your note did NOT travel"}`);
         if (settled !== null)
-            editText(answeredText(store, settled));
+            editText(answeredText(store, settled), []);
         return;
     }
     ack(`could not answer: ${answered.reason}`);
@@ -2479,6 +2479,8 @@ function armedDecisionText(option, note) {
     ].join("\n");
 }
 function answeredText(store, decision) {
+    if (decision.supersededReason !== null)
+        return [closedQuestionWords(decision.supersededReason), taskOf(store, decision)].join("\n");
     const chosen = decision.options.find(one => one.id === decision.choice)?.label ?? decision.choice ?? "?";
     return [
         `✓ Answered: ${chosen}`,

package/dist/toolroll-update.js

@@ -35,7 +35,7 @@ import { processMayBeAlive } from "./process-liveness.js";
 import { assertCodingUpdateStopped, backupCodingCatalog, codingCatalogExists, releaseStaleCodingOwner, removeCodingUpdateGate } from "./coding-update.js";
 import { installLaunchdService, launchdPlist, stopLaunchdService, writeFileDurably } from "./daemon.js";
 import { NAME } from "./names.js";
-import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES } from "./store.js";
+import { orphanKey, updateSafeSchema, V117_RENAMED_COLUMNS, V117_RENAMED_TABLES, V118_MERGED_TABLES, V119_ADDED_COLUMNS } from "./store.js";
 import { isNewer, REGISTRY } from "./releases.js";
 import { markNeverIndex } from "./never-index.js";
 import { readRuntimeUpdateJournal, RUNTIME_PHASES, RUNTIME_UPDATE_STEPS, stagedStartedAt, updaterStartingOf } from "./contracts/update-journal.js";
@@ -382,6 +382,11 @@ const HISTORY_RULES = {
     // subagent*); a column renamed in a table that keeps its name keeps its values under the new one.
     ...Object.fromEntries(Object.entries(V117_RENAMED_TABLES).map(([old, now]) => [old, { moved: { into: now, where: "1" } }])),
     ...Object.fromEntries(V117_RENAMED_COLUMNS.filter(([table]) => !Object.values(V117_RENAMED_TABLES).includes(table)).map(([table, from, to]) => [table, { renamed: { [from]: to } }])),
+    // v118 (D7): every API token, coordinator and lead token arrives in the one credential table under its kind.
+    ...Object.fromEntries(Object.entries(V118_MERGED_TABLES).map(([table, kind]) => [table, { moved: { into: "credential", where: `kind = '${kind}'` } }])),
+    // v119: planning generations and a question's closure reason are new columns; every row saved before them reads
+    // the declared value (generation 0, no closure reason).
+    ...Object.fromEntries(Object.entries(V119_ADDED_COLUMNS).map(([table, columns]) => [table, { added: Object.fromEntries(Object.entries(columns).map(([column, { saved }]) => [column, saved])) }])),
 };
 /** The tables a migration may remove whole (v115's removed features). */
 export const RETIRED_TABLES = Object.freeze(Object.keys(HISTORY_RULES).filter(name => HISTORY_RULES[name].retired));
@@ -535,6 +540,10 @@ export function changedHistory(db, before) {
         if (t.columns.some(c => !kept(c) && (!rule?.dropped?.includes(c) || (t.nonNull?.[c] !== 0 && !accounted(rule, t)))))
             return true;
         const columns = t.columns.filter(c => present.has(c));
+        // A declared new column: every row saved before it reads its declared value.
+        const added = Object.entries(rule?.added ?? {}).filter(([c]) => !t.columns.includes(c) && present.has(c));
+        if (t.rowid && added.some(([c, saved]) => Number(db.prepare("SELECT count(*) AS n FROM " + quote(t.name) + " WHERE rowid <= ? AND " + quote(c) + " IS NOT " + saved).get(t.last)["n"]) > 0))
+            return true;
         if (!t.rowid) {
             const after = rowsHash(db, t.name, columns);
             return after.count !== t.count || after.hash !== t.hash;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.57",
+  "version": "0.9.59",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"

package/dist/session-http.d.ts

@@ -1,24 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { type SessionOperation, type SessionRequests, type SessionResponse } from './session-contract.js';
-import { type Admission } from './request-budget.js';
-export type SessionHttpActor = {
-    name: string;
-    generation: number;
-};
-export type SessionHttpExecute = <O extends SessionOperation>(actor: SessionHttpActor, operation: O, request: SessionRequests[O]) => Promise<SessionResponse>;
-export type SessionHttpOptions = {
-    /** Verify the bearer against the current account and installation-wide
-     * operator role. Derive both fields here, never from the JSON request.
-     * Host, TLS and other server admission checks remain with the caller. */
-    authenticate: (request: IncomingMessage) => SessionHttpActor | null | Promise<SessionHttpActor | null>;
-    /** The existing live owner's operation. Null means no owner is ready.
-     * The service rechecks actor generation and project access at execution. */
-    execute: SessionHttpExecute | null;
-    /** The bearer request's budget by source (request-budget.ts): charged once, before the credential is checked or a body read. */
-    admit?: (request: IncomingMessage) => Admission;
-    /** Account admission after successful authentication, before any body read or owner call. */
-    admitAuthenticated?: (request: IncomingMessage, actor: SessionHttpActor) => Admission;
-};
-/** Handle this API family before the browser's form parser or login redirects.
- * This adapter dispatches at most once. It owns no catalog, database or provider. */
-export declare function handleSessionHttp(request: IncomingMessage, response: ServerResponse, options: SessionHttpOptions): Promise<boolean>;

package/dist/session-http.js

@@ -1,170 +0,0 @@
-import { adapterPolicy } from "./server/route-policy.js";
-import { SESSION_REQUEST_BYTES, SESSION_RESPONSE_BYTES, isSessionResponse, sessionDescriptor, validateSessionRequest, } from './session-contract.js';
-import { limitWords } from './request-budget.js';
-function readBody(request) {
-    return new Promise(resolve => {
-        let size = 0;
-        let chunks = [];
-        let settled = false;
-        const finish = (result) => {
-            if (settled)
-                return;
-            settled = true;
-            chunks = [];
-            resolve(result);
-        };
-        const cleanup = () => {
-            request.off('data', onData);
-            request.off('end', onEnd);
-            request.off('aborted', onAborted);
-            request.off('error', onError);
-            request.off('close', onClose);
-        };
-        const onData = (chunk) => {
-            // After rejecting an oversized request, drain without retaining it.
-            if (settled)
-                return;
-            const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-            size += bytes.length;
-            if (size > SESSION_REQUEST_BYTES)
-                finish({ ok: false, status: 413, reason: 'request-too-large', message: 'The session request is too large.' });
-            else
-                chunks.push(bytes);
-        };
-        const onEnd = () => {
-            cleanup();
-            if (settled)
-                return;
-            try {
-                const value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)));
-                finish({ ok: true, value });
-            }
-            catch {
-                finish({ ok: false, status: 400, reason: 'invalid-json', message: 'Send a valid UTF-8 JSON request.' });
-            }
-        };
-        const onAborted = () => {
-            finish({ ok: false, status: 400, reason: 'incomplete-request', message: 'The session request did not finish arriving.' });
-        };
-        const onError = () => { onAborted(); cleanup(); };
-        const onClose = () => { onAborted(); cleanup(); };
-        request.on('data', onData);
-        request.once('end', onEnd);
-        request.once('aborted', onAborted);
-        request.once('error', onError);
-        request.once('close', onClose);
-        if (request.aborted)
-            onAborted();
-    });
-}
-/** Handle this API family before the browser's form parser or login redirects.
- * This adapter dispatches at most once. It owns no catalog, database or provider. */
-export async function handleSessionHttp(request, response, options) {
-    const path = (request.url ?? '').split('?')[0] ?? '';
-    if (path !== '/api/sessions' && !path.startsWith('/api/sessions/'))
-        return false;
-    const match = /^\/api\/sessions\/([a-z]+)$/.exec(request.url ?? '');
-    const spec = match?.[1] === undefined ? undefined : sessionDescriptor(match[1]);
-    const operation = spec?.operation;
-    const write = (status, body, notSent = false) => {
-        if (response.destroyed || response.writableEnded)
-            return;
-        response.statusCode = status;
-        response.setHeader('content-type', 'application/json; charset=utf-8');
-        response.setHeader('content-length', Buffer.byteLength(body));
-        response.setHeader('cache-control', 'no-store');
-        response.setHeader('x-content-type-options', 'nosniff');
-        if (notSent)
-            response.setHeader('x-standing-orders-session-delivery', 'not-sent');
-        else
-            response.removeHeader('x-standing-orders-session-delivery');
-        response.end(body);
-    };
-    const reject = (status, reason, message) => {
-        // No owner call has occurred. This marker is never inferred from an
-        // exception, a lost response, or a response too large to deliver.
-        const reply = { version: 1, ...(operation === undefined ? {} : { operation }), ok: false,
-            status: 'rejected', delivery: 'not-sent', retry: spec?.mutation === false ? 'safe-read' : 'never', reason, message, nextActions: [] };
-        write(status, JSON.stringify(reply), true);
-        request.resume();
-        return true;
-    };
-    if (!spec || operation === undefined)
-        return reject(404, 'unsupported-operation', 'This session operation is not supported.');
-    if (request.method !== 'POST') {
-        response.setHeader('allow', 'POST');
-        return reject(405, 'method-not-allowed', 'Session operations require POST.');
-    }
-    if (request.headers.origin !== undefined)
-        return reject(403, 'browser-request', 'Use the authenticated session client for this operation.');
-    const authorizationCount = request.rawHeaders.filter((_, index) => index % 2 === 0 && request.rawHeaders[index]?.toLowerCase() === 'authorization').length;
-    if (authorizationCount !== 1 || !/^Bearer (.+):(.+)$/.test(request.headers.authorization ?? '')) {
-        return reject(401, 'unauthenticated', 'Current operator bearer credentials are required.');
-    }
-    const refuseAdmission = (admitted) => {
-        if (admitted.ok)
-            return false;
-        if (admitted.status === 503)
-            return reject(503, 'limits-unavailable', 'Request limits could not be checked; nothing ran. Try again shortly.');
-        response.setHeader('retry-after', String(admitted.retryAfter));
-        return reject(429, 'rate-limited', limitWords(admitted.limit, admitted.retryAfter));
-    };
-    if (options.admit && refuseAdmission(options.admit(request)))
-        return true;
-    let actor;
-    try {
-        actor = await options.authenticate(request);
-    }
-    catch {
-        return reject(503, 'authentication-unavailable', 'Operator access could not be checked. Try again after the service is ready.');
-    }
-    if (actor === null || typeof actor.name !== 'string' || !actor.name.trim() || !Number.isSafeInteger(actor.generation) || actor.generation < 1) {
-        return reject(401, 'unauthenticated', 'Current operator bearer credentials are required.');
-    }
-    if (options.admitAuthenticated && refuseAdmission(options.admitAuthenticated(request, actor)))
-        return true;
-    if (!adapterPolicy({ caller: "bearer", capability: "act" }, spec.mutation ? "act" : "read").ok)
-        return reject(403, "forbidden", "Current operator access is required.");
-    const media = request.headers['content-type']?.split(';')[0]?.trim().toLowerCase();
-    if (media !== 'application/json')
-        return reject(415, 'unsupported-media-type', 'Send the session request as application/json.');
-    const length = request.headers['content-length'];
-    if (length !== undefined && Number(length) > SESSION_REQUEST_BYTES)
-        return reject(413, 'request-too-large', 'The session request is too large.');
-    if (options.execute === null)
-        return reject(503, 'session-unavailable', 'The session owner is not ready.');
-    const body = await readBody(request);
-    if (!body.ok)
-        return reject(body.status, body.reason, body.message);
-    const validated = validateSessionRequest(operation, body.value);
-    if (!validated.ok)
-        return reject(400, 'invalid-request', validated.message);
-    if (request.aborted || response.destroyed)
-        return true;
-    const uncertain = (reason, message) => {
-        const sessionId = 'sessionId' in validated.request ? validated.request.sessionId : undefined;
-        return { version: 1, operation, ok: false, status: 'uncertain', delivery: 'unknown', retry: 'inspect-first', reason, message,
-            nextActions: [{ operation: sessionId ? 'show' : 'list', label: sessionId ? 'Inspect session' : 'Inspect saved sessions', ...(sessionId ? { sessionId } : {}) }] };
-    };
-    let reply;
-    let encoded;
-    let status;
-    try {
-        reply = await options.execute(actor, operation, validated.request);
-        if (!isSessionResponse(reply, operation))
-            throw new Error('Invalid owner response');
-        encoded = JSON.stringify(reply);
-        if (Buffer.byteLength(encoded) > SESSION_RESPONSE_BYTES) {
-            reply = uncertain('response-too-large', 'The owner response is too large to deliver. Inspect saved activity before continuing; this request was not retried.');
-            encoded = JSON.stringify(reply);
-        }
-        status = reply.status === 'rejected' ? 409 : reply.status === 'uncertain' ? 502 : reply.status === 'pending' ? 202 : 200;
-    }
-    catch {
-        reply = uncertain('unconfirmed-response', 'The owner response could not be confirmed. Inspect saved activity before continuing; this request was not retried.');
-        encoded = JSON.stringify(reply);
-        status = 502;
-    }
-    write(status, encoded);
-    return true;
-}

package/dist/session-server.d.ts

@@ -1,17 +0,0 @@
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { Store } from './store.js';
-import type { CodingWorkspace } from './coding-workspace.js';
-import { type SessionHttpActor } from './session-http.js';
-import type { Admission } from './request-budget.js';
-/** Bind the transport to createDecisionServer's existing catalog owner and
- * live project admission. No cookie, coordinator token or caller-supplied actor
- * can acquire installation-wide native coding authority through this adapter. */
-export declare function createSessionEndpoint(options: {
-    store: Store;
-    workspace: CodingWorkspace | null;
-    projects: () => readonly string[];
-    projectAllowed: (repo: string) => boolean;
-    /** The request's source budget (request-budget.ts), charged once before the password is checked. */
-    admit?: (request: IncomingMessage) => Admission;
-    admitAuthenticated?: (request: IncomingMessage, actor: SessionHttpActor) => Admission;
-}): (request: IncomingMessage, response: ServerResponse) => Promise<boolean>;

package/dist/session-server.js

@@ -1,39 +0,0 @@
-import { realpathSync } from 'node:fs';
-import { authenticateAccount } from './scope.js';
-import { handleSessionHttp } from './session-http.js';
-import { SessionService } from './session-service.js';
-/** Bind the transport to createDecisionServer's existing catalog owner and
- * live project admission. No cookie, coordinator token or caller-supplied actor
- * can acquire installation-wide native coding authority through this adapter. */
-export function createSessionEndpoint(options) {
-    const { store } = options;
-    const authorized = (actor, repo) => {
-        const account = store.accountOf(actor.name);
-        return account !== null && account.revokedAt === null && account.generation === actor.generation && store.isInstanceOperator(actor.name)
-            && (repo === undefined || (options.projectAllowed(repo) && options.projects().includes(repo)));
-    };
-    const service = options.workspace === null || store.isDemo() ? null : new SessionService({ workspace: options.workspace, authorized,
-        project: (actor, input) => {
-            const path = realpathSync(input);
-            if (!authorized(actor, path) || !options.projects().includes(path))
-                throw Error('Choose a project already admitted to this installation.');
-            return path;
-        },
-    });
-    return (request, response) => handleSessionHttp(request, response, {
-        ...(options.admit === undefined ? {} : { admit: options.admit }),
-        ...(options.admitAuthenticated === undefined ? {} : { admitAuthenticated: options.admitAuthenticated }),
-        authenticate: request => {
-            const bearer = /^Bearer (.+):(.+)$/.exec(request.headers.authorization ?? '');
-            if (!bearer)
-                return null;
-            const name = bearer[1];
-            const authentication = authenticateAccount(store, name, bearer[2]);
-            if (!authentication.ok)
-                return null;
-            const actor = { name, generation: authentication.generation };
-            return authorized(actor) ? actor : null;
-        },
-        execute: service === null ? null : (actor, operation, request) => service.execute(actor, operation, request),
-    });
-}