wicked-crew 0.6.0 → 0.7.1

package/README.md

@@ -0,0 +1,103 @@
+# wicked-crew
+
+**The harness for your agent harnesses** — run the coding-agent CLIs you already use as governed
+workers through durable, multi-agent workflows. Intent in, verified work out: the evaluator is
+structurally not the creator, gates are deny-dominates, and "done" is re-derived from evidence
+instead of asserted.
+
+Local-first: loopback only, no accounts, no billing, no model reselling. Crew drives the agents
+*you* already pay for, on *your* auth and *your* plan.
+
+## Install
+
+Requires Node.js ≥ 22 and at least one coding-agent CLI on your machine (e.g. Claude Code, Codex).
+
+```bash
+npm install -g wicked-crew
+wicked-crew serve
+```
+
+Or without installing:
+
+```bash
+npx wicked-crew serve
+```
+
+Or use the family installer — [`npx wicked-installer`](https://www.npmjs.com/package/wicked-installer)
+installs/updates the whole wicked-\* family, crew included.
+
+`serve` starts the daemon on `http://127.0.0.1:7701` (override with `--port` or `CREW_PORT`) and
+serves the bundled **wicked-studio** browser console same-origin — open the URL and you have the
+control room: launch and steer runs, answer human gates, browse projects and evidence, watch live
+engine events. Durable state (runs, evidence, event log) lives in `~/.wicked-crew/` (`--db`
+overrides).
+
+## Quickstart
+
+```bash
+# 1. Start the daemon (leave it running)
+wicked-crew serve
+
+# 2. Launch a governed run — from the console at http://127.0.0.1:7701,
+#    or headless over the API:
+curl -X POST http://127.0.0.1:7701/api/v1/runs \
+     -H 'content-type: application/json' \
+     -d '{"problem": "Add input validation to the signup form", "workflow": "feature"}'
+
+# 3. Watch it move through the workflow's phases; approve or reject at the gates.
+```
+
+One run token moves through the workflow's phases with a gate between every one — e.g. for
+`feature`: clarify → design → build → adversarial-review → test → review. Each phase is executed
+by a versioned skill on an assigned CLI worker; the gates decide, and every decision is audited.
+
+## The governed-run model
+
+- **You own the workflow; the agent owns the work.** The orchestrator sequences phases and holds
+  the gates; the agent does the coding inside a phase.
+- **Workflows are data.** `feature` / `bug` / `migration` ship built-in; new ones are drop-in JSON
+  files, not code.
+- **Gates are real, not self-graded.** Phase transitions resolve **deny-dominates** on a
+  deterministic structural floor, with an independent evaluator seat that reads cold evidence
+  only — a model may fail a gate, never solely approve one.
+- **Evidence, not assertion.** "Done" is re-derived from evidence at the gate, never claimed by
+  the agent that did the work.
+
+The engine underneath is [wicked-core](https://github.com/mikeparcewski/wicked-core) (Rust,
+single-writer), embedded via the `wicked-core-ts` napi bridge — the daemon is a thin REST+WS
+layer over it.
+
+## The acceptance gate
+
+`GET /api/v1/runs/:id/acceptance` answers "does the QE evidence ledger accept this run's work?" —
+crew's machine gate, absorbed from the retired wicked-testing product. <!-- historical --> It reads the repo's
+evidence ledger (a wicked-ledger store at `<repo>/.wicked-qe/`, written by wicked-garden's QE
+skills; legacy `.wicked-testing/` ledgers are still read) and resolves the workflow's acceptance
+requirement **deny-dominates**: only a `PASS` verdict satisfies it. `FAIL`, `CONDITIONAL`,
+`PARTIAL`, `INCONCLUSIVE`, a missing ledger, or a missing verdict each deny with their own named
+reason — no evidence is never a pass. The route always returns 200 for a known run ("no verdict"
+is a real answer about the gate, not an error); `?qeRun=<id>` pins the read to one QE run.
+
+## CLI
+
+```
+wicked-crew serve|start|resume|gate|status|mcp
+```
+
+| command | what it does |
+|---|---|
+| `serve` | run the daemon: REST `/api/v1` + WS `/ws` + the bundled studio console |
+| `start` | boot and launch a run headless (`--problem`, `--workflow`, `--repo`) |
+| `resume` | resume a persisted run (`--session <id>`) |
+| `gate` | answer a pending human gate from the terminal |
+| `status` | inspect run state |
+| `mcp` | stdio MCP server — crew-as-a-tool for coding agents |
+
+## Links
+
+- Repo: <https://github.com/mikeparcewski/wicked-crew>
+- Site & docs: <https://wc.wickedagile.com>
+- Wire contract (every `/api/v1` + `/ws` shape, types-only): [`wicked-crew-api-types`](https://www.npmjs.com/package/wicked-crew-api-types)
+- Engine: [wicked-core](https://github.com/mikeparcewski/wicked-core) · Console: [wicked-studio](https://github.com/mikeparcewski/wicked-studio)
+
+MIT

package/dist/api/audit.d.ts

@@ -21,6 +21,8 @@ export interface AuditReadFilter {
     /** Max entries returned (newest first). Default 200, capped at 1000. */
     limit?: number;
 }
+/** `readAll`'s filter: no limit — the whole point is that nothing gets trimmed. */
+export type AuditScanFilter = Omit<AuditReadFilter, 'limit'>;
 export declare class AuditLog {
     readonly path: string;
     private readonly warn;
@@ -53,5 +55,16 @@ export declare class AuditLog {
      * still answers.
      */
     read(filter?: AuditReadFilter): Promise<AuditEntry[]>;
+    /**
+     * Read the trail EXHAUSTIVELY, newest first — no read cap. The hydrate path
+     * for the boot-time indexes (`RetryIndex`, `GuidanceIndex`): durable facts
+     * like retry lineage must not vanish because 1000+ newer launches landed on
+     * top of them (BRIEF-UX-002 C5). Same cost class as `read` — that already
+     * parses the whole file and only trims the returned slice — so this is a
+     * one-time full-file scan at boot, measured at ~19ms on a 19k-line live trail.
+     */
+    readAll(filter?: AuditScanFilter): Promise<AuditEntry[]>;
+    /** The shared full-file parse: every matching entry, newest first, uncapped. */
+    private scan;
 }
 //# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1D,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,QAAQ;IAMjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANvB,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;gBAGd,IAAI,GAAE,MAA2B,EACzB,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAA6B;IAGvE;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,IAAI,QAAQ;IAMvB;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAyBzG,wCAAwC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;OAIG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;CA2B5D"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE1D,qDAAqD;AACrD,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAE7E;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,wEAAwE;IACxE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,mFAAmF;AACnF,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;AAE7D,qBAAa,QAAQ;IAMjB,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IANvB,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAS;gBAGd,IAAI,GAAE,MAA2B,EACzB,IAAI,GAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAA6B;IAGvE;;;;;;OAMG;IACH,MAAM,CAAC,IAAI,IAAI,QAAQ;IAMvB;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,IAAI;IAyBzG,wCAAwC;IACxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;OAIG;IACG,IAAI,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAM3D;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAIxD,gFAAgF;YAClE,IAAI;CA0BnB"}

package/dist/api/audit.js

@@ -77,6 +77,23 @@ export class AuditLog {
      * still answers.
      */
     async read(filter) {
+        const entries = await this.scan(filter);
+        const limit = Math.min(Math.max(filter?.limit ?? 200, 1), 1000);
+        return entries.slice(0, limit);
+    }
+    /**
+     * Read the trail EXHAUSTIVELY, newest first — no read cap. The hydrate path
+     * for the boot-time indexes (`RetryIndex`, `GuidanceIndex`): durable facts
+     * like retry lineage must not vanish because 1000+ newer launches landed on
+     * top of them (BRIEF-UX-002 C5). Same cost class as `read` — that already
+     * parses the whole file and only trims the returned slice — so this is a
+     * one-time full-file scan at boot, measured at ~19ms on a 19k-line live trail.
+     */
+    readAll(filter) {
+        return this.scan(filter);
+    }
+    /** The shared full-file parse: every matching entry, newest first, uncapped. */
+    async scan(filter) {
         if (this.disabled)
             return [];
         await this.flush();
@@ -108,8 +125,7 @@ export class AuditLog {
             }
         }
         entries.reverse(); // file order is append order; the API answers newest first
-        const limit = Math.min(Math.max(filter?.limit ?? 200, 1), 1000);
-        return entries.slice(0, limit);
+        return entries;
     }
 }
 //# sourceMappingURL=audit.js.map

package/dist/api/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AACtF,CAAC;AASD,MAAM,OAAO,QAAQ;IAMR;IACQ;IANX,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACW,OAAe,gBAAgB,EAAE,EACzB,OAA8B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAD5D,SAAI,GAAJ,IAAI,CAA6B;QACzB,SAAI,GAAJ,IAAI,CAAgD;IACpE,CAAC;IAEJ;;;;;;OAMG;IACH,MAAM,CAAC,IAAI;QACT,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAc,EAAE,KAAY,EAAE,MAA6D;QAChG,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,KAAK;YACL,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CACP,4BAA4B,MAAM,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,KAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,sDAAsD,CACvD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC,CAAC,uBAAuB;YACxF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACjC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBACzC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBACvE,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;oBAAE,SAAS;gBACtE,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBAAE,SAAS;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,2DAA2D;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;CACF"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAG1C,qDAAqD;AACrD,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,OAAO,GAAG,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;AACtF,CAAC;AAYD,MAAM,OAAO,QAAQ;IAMR;IACQ;IANX,KAAK,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,QAAQ,GAAG,KAAK,CAAC;IACjB,QAAQ,GAAG,KAAK,CAAC;IAEzB,YACW,OAAe,gBAAgB,EAAE,EACzB,OAA8B,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAD5D,SAAI,GAAJ,IAAI,CAA6B;QACzB,SAAI,GAAJ,IAAI,CAAgD;IACpE,CAAC;IAEJ;;;;;;OAMG;IACH,MAAM,CAAC,IAAI;QACT,MAAM,GAAG,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAc,EAAE,KAAY,EAAE,MAA6D;QAChG,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,KAAK,GAAe;YACxB,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE;YACd,MAAM;YACN,KAAK;YACL,GAAG,CAAC,MAAM,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACvB,CAAC;YACD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACpC,IAAI,CAAC,IAAI,CACP,4BAA4B,MAAM,OAAO,KAAK,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,KAC/D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,sDAAsD,CACvD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,MAAwB;QACjC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAChE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;;OAOG;IACH,OAAO,CAAC,MAAwB;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,IAAI,CAAC,MAAwB;QACzC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC,CAAC,uBAAuB;YACxF,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,MAAM,OAAO,GAAiB,EAAE,CAAC;QACjC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;gBAAE,SAAS;YACjC,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBACzC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;oBAAE,SAAS;gBACvE,IAAI,MAAM,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK;oBAAE,SAAS;gBACtE,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;oBAAE,SAAS;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,kDAAkD;YACpD,CAAC;QACH,CAAC;QACD,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,2DAA2D;QAC9E,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/api/endpoint-manifest-live.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Build the LIVE endpoint manifest by booting the real server assembly (TH-11).
+ *
+ * A separate module from endpoint-manifest.ts on purpose: this imports `createServer` while
+ * server.ts imports the hook installer — folding both into one file would make the cycle
+ * structural instead of avoiding it.
+ *
+ * # Why boot `createServer` rather than re-list routes by hand
+ *
+ * The manifest's whole value is that it cannot drift from the daemon: it is read from the same
+ * `onRoute` hook, over the same registration calls (`registerRoutes`, project routes, terminal
+ * WS, `/ws`, interactive event routes), that the served daemon runs. A hand-maintained list would
+ * be a second spelling of the route table — the exact thing the manifest exists to end.
+ *
+ * # What is faked, and why it is safe
+ *
+ * Route REGISTRATION never calls the engine — only handlers do, and no request is ever injected
+ * here. The adapter stub answers the three things `createServer` itself asks at boot:
+ * `getSettings()` (worker-config root export), `projectsSupported()` → false (skips membership
+ * hydration), and `stub: true` (any answering seam that were ever armed would refuse rather than
+ * subscribe). Every optional seam is disabled explicitly, the audit trail goes to a temp file
+ * (never `~/.wicked-crew/audit.log`), and `studioRoot` points at a nonexistent directory so the
+ * server boots HEADLESS — deliberately: the static wildcard route depends on whether a studio
+ * bundle is installed on the generating machine, and a committed manifest must not vary by
+ * install state. The manifest documents the API + WS surface.
+ */
+import { type EndpointManifest } from './endpoint-manifest.js';
+export declare function collectLiveEndpointManifest(): Promise<EndpointManifest>;
+//# sourceMappingURL=endpoint-manifest-live.d.ts.map

package/dist/api/endpoint-manifest-live.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-manifest-live.d.ts","sourceRoot":"","sources":["../../src/api/endpoint-manifest-live.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAQH,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAEtF,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAmC7E"}

package/dist/api/endpoint-manifest-live.js

@@ -0,0 +1,72 @@
+/**
+ * Build the LIVE endpoint manifest by booting the real server assembly (TH-11).
+ *
+ * A separate module from endpoint-manifest.ts on purpose: this imports `createServer` while
+ * server.ts imports the hook installer — folding both into one file would make the cycle
+ * structural instead of avoiding it.
+ *
+ * # Why boot `createServer` rather than re-list routes by hand
+ *
+ * The manifest's whole value is that it cannot drift from the daemon: it is read from the same
+ * `onRoute` hook, over the same registration calls (`registerRoutes`, project routes, terminal
+ * WS, `/ws`, interactive event routes), that the served daemon runs. A hand-maintained list would
+ * be a second spelling of the route table — the exact thing the manifest exists to end.
+ *
+ * # What is faked, and why it is safe
+ *
+ * Route REGISTRATION never calls the engine — only handlers do, and no request is ever injected
+ * here. The adapter stub answers the three things `createServer` itself asks at boot:
+ * `getSettings()` (worker-config root export), `projectsSupported()` → false (skips membership
+ * hydration), and `stub: true` (any answering seam that were ever armed would refuse rather than
+ * subscribe). Every optional seam is disabled explicitly, the audit trail goes to a temp file
+ * (never `~/.wicked-crew/audit.log`), and `studioRoot` points at a nonexistent directory so the
+ * server boots HEADLESS — deliberately: the static wildcard route depends on whether a studio
+ * bundle is installed on the generating machine, and a committed manifest must not vary by
+ * install state. The manifest documents the API + WS surface.
+ */
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createServer } from './server.js';
+import { buildEndpointManifest } from './endpoint-manifest.js';
+export async function collectLiveEndpointManifest() {
+    // Deterministic boot: auth mode is pinned OFF via options (no env/file resolution), and the
+    // logger is silenced for the duration — this runs inside test output and CI logs.
+    const savedLogLevel = process.env['LOG_LEVEL'];
+    process.env['LOG_LEVEL'] = 'silent';
+    const scratch = mkdtempSync(join(tmpdir(), 'crew-endpoint-manifest-'));
+    const adapter = {
+        stub: true,
+        projectsSupported: () => false,
+        getSettings: async () => ({}),
+        // The daemon's single CoreEvent fan-out subscribes at boot; no event ever arrives here.
+        onEvent: () => () => { },
+    };
+    try {
+        const app = await createServer(adapter, {
+            auth: { mode: 'off' },
+            auditPath: join(scratch, 'audit.log'),
+            projectEvents: { disabled: true },
+            interactiveWsRelay: { disabled: true },
+            seatHealthProbe: { enabled: false },
+            stallWatchdog: { enabled: false },
+            // Nonexistent on purpose — headless boot; see the module header.
+            studioRoot: join(scratch, 'no-studio-bundle'),
+        });
+        try {
+            await app.ready();
+            return buildEndpointManifest(app.endpointManifest ?? []);
+        }
+        finally {
+            await app.close();
+        }
+    }
+    finally {
+        if (savedLogLevel === undefined)
+            delete process.env['LOG_LEVEL'];
+        else
+            process.env['LOG_LEVEL'] = savedLogLevel;
+        rmSync(scratch, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=endpoint-manifest-live.js.map

package/dist/api/endpoint-manifest-live.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-manifest-live.js","sourceRoot":"","sources":["../../src/api/endpoint-manifest-live.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAyB,MAAM,wBAAwB,CAAC;AAEtF,MAAM,CAAC,KAAK,UAAU,2BAA2B;IAC/C,4FAA4F;IAC5F,kFAAkF;IAClF,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC,CAAC;IACvE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,IAAI;QACV,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;QAC9B,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QAC7B,wFAAwF;QACxF,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC;KACE,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE;YACtC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC;YACrC,aAAa,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACjC,kBAAkB,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;YACtC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACnC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE;YACjC,iEAAiE;YACjE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,kBAAkB,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,qBAAqB,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;gBAAS,CAAC;YACT,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;;YAC5D,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,aAAa,CAAC;QAC9C,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/api/endpoint-manifest.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The endpoint manifest (TH-11) — crew's route table as a MACHINE-READABLE build artifact.
+ *
+ * # Why this exists
+ *
+ * routes.ts declares zero fastify schemas (verified: grep `schema:` = 0), no OpenAPI spec exists
+ * anywhere in crew, and `wicked-crew-api-types` is types-only with no endpoint-to-type binding —
+ * so nothing machine-readable said which methods+paths this daemon serves, what a request body is
+ * called, or which status codes a route can answer. Request validation is NOT a vacuum (13
+ * `.strict()` zod objects guard the bodies), but zod objects are route-internal: a test harness,
+ * a drift check, or an API-test generator had nothing to read. With no fastify schemas declared,
+ * `@fastify/swagger` has nothing to generate from either — the `onRoute` hook IS the cheap path.
+ *
+ * # How it works
+ *
+ * {@link installEndpointManifestHook} registers a fastify `onRoute` hook (added by `createServer`
+ * BEFORE any route registration, so every route the daemon serves is seen) that accumulates one
+ * {@link EndpointEntry} per method+path. Two declaration channels feed the type/status fields:
+ *
+ *   1. `config.manifest` on the route options ({@link ManifestRouteConfig}) — the explicit
+ *      channel. Names should reference `wicked-crew-api-types` exports where one exists
+ *      (`LaunchRunBody`, `GateDecision`, …) so the manifest binds endpoints to the published
+ *      wire contract; a structural spelling (`'{ runId: string }'`) is the honest fallback for
+ *      wire shapes the contract has no name for.
+ *   2. `schema.response` keys, when fastify schemas start existing (the longer-term
+ *      zod-to-json-schema path) — status codes are folded in automatically, so migrating a route
+ *      to real fastify schemas enriches the manifest without touching this module.
+ *
+ * Routes that declare neither still land in the manifest with `requestType`/`responseType` null
+ * and `statusCodes: []` — the manifest records "where declared", never invents.
+ *
+ * # What consumes it
+ *
+ * - `scripts/generate-endpoint-manifest.ts` (npm run manifest:endpoints) writes the committed
+ *   `endpoint-manifest.json` at the package root — the build artifact.
+ * - `tests/endpoint-manifest.test.ts` rebuilds the live route table and fails on ANY drift from
+ *   the committed file, so an added/removed/renamed endpoint fails CI until the manifest is
+ *   regenerated and the diff reviewed. The manifest diff IS the API regression trigger.
+ * - `scripts/generate-api-tests.ts` derives positive + 400/404/409 negative API tests from the
+ *   committed manifest (see `tests/generated/`).
+ *
+ * HEAD entries are dropped: fastify v5 auto-exposes a HEAD twin for every GET
+ * (`exposeHeadRoutes`), which would double the GET surface with rows nobody declared.
+ */
+import type { FastifyInstance } from 'fastify';
+/** The explicit per-route declaration channel — `{ config: { manifest: {...} } }` on a route. */
+export interface ManifestRouteConfig {
+    /** Request-body type name — a `wicked-crew-api-types` export where one exists. */
+    requestType?: string;
+    /** Success-response type name, or a structural spelling when the contract has no name for it. */
+    responseType?: string;
+    /** Every status code this route answers on purpose (success + named error codes). */
+    statusCodes?: number[];
+}
+declare module 'fastify' {
+    interface FastifyContextConfig {
+        /** TH-11 — this route's row in the committed endpoint manifest. */
+        manifest?: ManifestRouteConfig;
+    }
+    interface FastifyInstance {
+        /** Accumulated by `createServer`'s onRoute hook; read after `app.ready()`. */
+        endpointManifest?: EndpointEntry[];
+    }
+}
+/** One method+path the daemon serves. */
+export interface EndpointEntry {
+    method: string;
+    path: string;
+    /** Declared request-body type name, or null — "where declared", never invented. */
+    requestType: string | null;
+    /** Declared response type name, or null. */
+    responseType: string | null;
+    /** Declared status codes (config.manifest + fastify schema.response keys), sorted. */
+    statusCodes: number[];
+    /** Present (true) only on websocket routes (`/ws`, `/ws/terminals/:id`). */
+    websocket?: boolean;
+}
+/** The committed artifact's shape (endpoint-manifest.json). */
+export interface EndpointManifest {
+    version: 1;
+    /**
+     * The `wicked-crew-api-types` version this route table was generated against — the published
+     * wire contract the type names bind to. Evidence manifests that cite endpoints should carry
+     * this (recon R8/R11: api-types drift is live; studio pinned ^0.8.0 against 0.10.0).
+     */
+    apiTypesVersion: string;
+    /** Sorted by path, then method — a stable order so drift diffs are readable. */
+    endpoints: EndpointEntry[];
+}
+/**
+ * Register the accumulating `onRoute` hook. MUST run before any route is registered — fastify
+ * only replays `onRoute` for routes added after the hook exists. Returns the live array the hook
+ * appends to; `createServer` exposes it as `app.endpointManifest`.
+ */
+export declare function installEndpointManifestHook(app: FastifyInstance): EndpointEntry[];
+/**
+ * The published wire contract's version, read from the actually-installed dependency.
+ *
+ * NOT `require('wicked-crew-api-types/package.json')`: that package's exports map exposes only
+ * `.` (types-only, no runtime condition), so both the subpath and a bare resolve are refused.
+ * Walking the resolver's candidate directories and reading the file with fs sidesteps the
+ * exports map while still honoring the real resolution order (workspace link included).
+ */
+export declare function apiTypesVersion(): string;
+/** Entries → the committed artifact: stable order, contract version stamped. */
+export declare function buildEndpointManifest(entries: EndpointEntry[]): EndpointManifest;
+//# sourceMappingURL=endpoint-manifest.d.ts.map

package/dist/api/endpoint-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-manifest.d.ts","sourceRoot":"","sources":["../../src/api/endpoint-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAgB,MAAM,SAAS,CAAC;AAE7D,iGAAiG;AACjG,MAAM,WAAW,mBAAmB;IAClC,kFAAkF;IAClF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,oBAAoB;QAC5B,mEAAmE;QACnE,QAAQ,CAAC,EAAE,mBAAmB,CAAC;KAChC;IACD,UAAU,eAAe;QACvB,8EAA8E;QAC9E,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC;KACpC;CACF;AAED,yCAAyC;AACzC,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4CAA4C;IAC5C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,sFAAsF;IACtF,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,+DAA+D;AAC/D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,CAAC;IACX;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,SAAS,EAAE,aAAa,EAAE,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,eAAe,GAAG,aAAa,EAAE,CAgCjF;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,IAAI,MAAM,CAWxC;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,aAAa,EAAE,GAAG,gBAAgB,CAKhF"}

package/dist/api/endpoint-manifest.js

@@ -0,0 +1,108 @@
+/**
+ * The endpoint manifest (TH-11) — crew's route table as a MACHINE-READABLE build artifact.
+ *
+ * # Why this exists
+ *
+ * routes.ts declares zero fastify schemas (verified: grep `schema:` = 0), no OpenAPI spec exists
+ * anywhere in crew, and `wicked-crew-api-types` is types-only with no endpoint-to-type binding —
+ * so nothing machine-readable said which methods+paths this daemon serves, what a request body is
+ * called, or which status codes a route can answer. Request validation is NOT a vacuum (13
+ * `.strict()` zod objects guard the bodies), but zod objects are route-internal: a test harness,
+ * a drift check, or an API-test generator had nothing to read. With no fastify schemas declared,
+ * `@fastify/swagger` has nothing to generate from either — the `onRoute` hook IS the cheap path.
+ *
+ * # How it works
+ *
+ * {@link installEndpointManifestHook} registers a fastify `onRoute` hook (added by `createServer`
+ * BEFORE any route registration, so every route the daemon serves is seen) that accumulates one
+ * {@link EndpointEntry} per method+path. Two declaration channels feed the type/status fields:
+ *
+ *   1. `config.manifest` on the route options ({@link ManifestRouteConfig}) — the explicit
+ *      channel. Names should reference `wicked-crew-api-types` exports where one exists
+ *      (`LaunchRunBody`, `GateDecision`, …) so the manifest binds endpoints to the published
+ *      wire contract; a structural spelling (`'{ runId: string }'`) is the honest fallback for
+ *      wire shapes the contract has no name for.
+ *   2. `schema.response` keys, when fastify schemas start existing (the longer-term
+ *      zod-to-json-schema path) — status codes are folded in automatically, so migrating a route
+ *      to real fastify schemas enriches the manifest without touching this module.
+ *
+ * Routes that declare neither still land in the manifest with `requestType`/`responseType` null
+ * and `statusCodes: []` — the manifest records "where declared", never invents.
+ *
+ * # What consumes it
+ *
+ * - `scripts/generate-endpoint-manifest.ts` (npm run manifest:endpoints) writes the committed
+ *   `endpoint-manifest.json` at the package root — the build artifact.
+ * - `tests/endpoint-manifest.test.ts` rebuilds the live route table and fails on ANY drift from
+ *   the committed file, so an added/removed/renamed endpoint fails CI until the manifest is
+ *   regenerated and the diff reviewed. The manifest diff IS the API regression trigger.
+ * - `scripts/generate-api-tests.ts` derives positive + 400/404/409 negative API tests from the
+ *   committed manifest (see `tests/generated/`).
+ *
+ * HEAD entries are dropped: fastify v5 auto-exposes a HEAD twin for every GET
+ * (`exposeHeadRoutes`), which would double the GET surface with rows nobody declared.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+/**
+ * Register the accumulating `onRoute` hook. MUST run before any route is registered — fastify
+ * only replays `onRoute` for routes added after the hook exists. Returns the live array the hook
+ * appends to; `createServer` exposes it as `app.endpointManifest`.
+ */
+export function installEndpointManifestHook(app) {
+    const entries = [];
+    app.addHook('onRoute', (route) => {
+        const methods = Array.isArray(route.method) ? route.method : [route.method];
+        const declared = route.config?.manifest;
+        // The future-proofing channel: fastify response schemas keyed by status code. None exist
+        // today (routes.ts declares zero), but the fold means the zod→fastify-schema migration
+        // enriches the manifest for free.
+        const schemaResponse = route.schema
+            ?.response;
+        const schemaCodes = Object.keys(schemaResponse ?? {})
+            .map(Number)
+            .filter((n) => Number.isInteger(n) && n >= 100 && n <= 599);
+        const statusCodes = [...new Set([...(declared?.statusCodes ?? []), ...schemaCodes])].sort((a, b) => a - b);
+        const websocket = route.websocket === true;
+        for (const method of methods) {
+            // Fastify v5 auto-exposes a HEAD twin per GET; recording it would double the GET surface
+            // with rows nobody declared and no client calls on purpose.
+            if (method === 'HEAD')
+                continue;
+            entries.push({
+                method,
+                path: route.url,
+                requestType: declared?.requestType ?? null,
+                responseType: declared?.responseType ?? null,
+                statusCodes,
+                ...(websocket ? { websocket: true } : {}),
+            });
+        }
+    });
+    return entries;
+}
+/**
+ * The published wire contract's version, read from the actually-installed dependency.
+ *
+ * NOT `require('wicked-crew-api-types/package.json')`: that package's exports map exposes only
+ * `.` (types-only, no runtime condition), so both the subpath and a bare resolve are refused.
+ * Walking the resolver's candidate directories and reading the file with fs sidesteps the
+ * exports map while still honoring the real resolution order (workspace link included).
+ */
+export function apiTypesVersion() {
+    const require = createRequire(import.meta.url);
+    for (const dir of require.resolve.paths('wicked-crew-api-types') ?? []) {
+        const pkgPath = join(dir, 'wicked-crew-api-types', 'package.json');
+        if (existsSync(pkgPath)) {
+            return JSON.parse(readFileSync(pkgPath, 'utf8')).version;
+        }
+    }
+    throw new Error('wicked-crew-api-types is not resolvable from packages/crew — the manifest cannot stamp the wire-contract version');
+}
+/** Entries → the committed artifact: stable order, contract version stamped. */
+export function buildEndpointManifest(entries) {
+    const endpoints = [...entries].sort((a, b) => a.path.localeCompare(b.path) || a.method.localeCompare(b.method));
+    return { version: 1, apiTypesVersion: apiTypesVersion(), endpoints };
+}
+//# sourceMappingURL=endpoint-manifest.js.map

package/dist/api/endpoint-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoint-manifest.js","sourceRoot":"","sources":["../../src/api/endpoint-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmDjC;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAoB;IAC9D,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAwD,EAAE,EAAE;QAClF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;QACxC,yFAAyF;QACzF,uFAAuF;QACvF,kCAAkC;QAClC,MAAM,cAAc,GAAI,KAAK,CAAC,MAA6D;YACzF,EAAE,QAAQ,CAAC;QACb,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;aAClD,GAAG,CAAC,MAAM,CAAC;aACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CACvF,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAChB,CAAC;QACF,MAAM,SAAS,GAAI,KAAiC,CAAC,SAAS,KAAK,IAAI,CAAC;QACxE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,yFAAyF;YACzF,4DAA4D;YAC5D,IAAI,MAAM,KAAK,MAAM;gBAAE,SAAS;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,MAAM;gBACN,IAAI,EAAE,KAAK,CAAC,GAAG;gBACf,WAAW,EAAE,QAAQ,EAAE,WAAW,IAAI,IAAI;gBAC1C,YAAY,EAAE,QAAQ,EAAE,YAAY,IAAI,IAAI;gBAC5C,WAAW;gBACX,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,IAAI,EAAE,EAAE,CAAC;QACvE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,OAAQ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAyB,CAAC,OAAO,CAAC;QACpF,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,OAAwB;IAC5D,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAC3E,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,eAAe,EAAE,EAAE,SAAS,EAAE,CAAC;AACvE,CAAC"}

package/dist/api/guidance-index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The run→operator-guidance index (DES-UX-002 §7.2, CREW-UX-7).
+ *
+ * NAMING NOTE: DES-UX-002 §7.2 labels this slice CREW-UX-4, but that id was already spent on an
+ * unrelated merged slice (crew#308) — this implementation is CREW-UX-7; the doc's §7.2 spec is
+ * what it implements.
+ *
+ * A durable pre-gate annotation: ONE operator guidance note per run, upserted via
+ * `PUT /runs/:id/guidance` and echoed as `AgentSession.guidance` on the run DTOs. The engine's
+ * run record carries no such field (wicked-core-ts 0.6.x), so — exactly like retry lineage
+ * (CREW-UX-3) and the actor trail (task #88) — the durable record is the audit trail: every
+ * write lands as a `guidance.set` entry whose `detail.text` is the full note (empty string =
+ * cleared), and this map is the read-side latency layer that lets the run DTOs echo it without
+ * a trail scan per request.
+ *
+ * Mirrors `RetryIndex`'s posture: hydrated once at server start (best-effort — a missing or
+ * unreadable trail leaves guidance blank, the pre-CREW-UX-7 behavior, not an error) and updated
+ * at the same post-commit point that writes the audit entry, so the map can only lag by a
+ * failed hydrate, never diverge silently.
+ */
+import type { AuditLog } from './audit.js';
+export declare class GuidanceIndex {
+    private readonly runToGuidance;
+    /**
+     * Load guidance from EVERY `guidance.set` entry in the trail — exhaustively, not capped
+     * (BRIEF-UX-002 C5, same defect as `RetryIndex.hydrate`: a durable note must not vanish
+     * because 1000+ newer writes landed on top of it). The trail answers newest first, so the
+     * FIRST entry seen per run is the current note — later (older) entries for the same run
+     * are superseded writes and are skipped, which is also what keeps a cleared note (newest
+     * entry has `text: ''`) from being resurrected by an older non-empty one. Still best-effort,
+     * like `RetryIndex.hydrate`; cost is one full-file scan at boot.
+     */
+    hydrate(audit: AuditLog, log?: (msg: string) => void): Promise<void>;
+    /** Upsert the note; the empty string CLEARS it (the DTO field goes back to absent). */
+    set(runId: string, text: string): void;
+    /** The note for this run, or `undefined` (the DTO spells that as an ABSENT field). */
+    guidanceFor(runId: string): string | undefined;
+}
+//# sourceMappingURL=guidance-index.d.ts.map

package/dist/api/guidance-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guidance-index.d.ts","sourceRoot":"","sources":["../../src/api/guidance-index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA6B;IAE3D;;;;;;;;OAQG;IACG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB1E,uFAAuF;IACvF,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAKtC,sFAAsF;IACtF,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAG/C"}

package/dist/api/guidance-index.js

@@ -0,0 +1,67 @@
+/**
+ * The run→operator-guidance index (DES-UX-002 §7.2, CREW-UX-7).
+ *
+ * NAMING NOTE: DES-UX-002 §7.2 labels this slice CREW-UX-4, but that id was already spent on an
+ * unrelated merged slice (crew#308) — this implementation is CREW-UX-7; the doc's §7.2 spec is
+ * what it implements.
+ *
+ * A durable pre-gate annotation: ONE operator guidance note per run, upserted via
+ * `PUT /runs/:id/guidance` and echoed as `AgentSession.guidance` on the run DTOs. The engine's
+ * run record carries no such field (wicked-core-ts 0.6.x), so — exactly like retry lineage
+ * (CREW-UX-3) and the actor trail (task #88) — the durable record is the audit trail: every
+ * write lands as a `guidance.set` entry whose `detail.text` is the full note (empty string =
+ * cleared), and this map is the read-side latency layer that lets the run DTOs echo it without
+ * a trail scan per request.
+ *
+ * Mirrors `RetryIndex`'s posture: hydrated once at server start (best-effort — a missing or
+ * unreadable trail leaves guidance blank, the pre-CREW-UX-7 behavior, not an error) and updated
+ * at the same post-commit point that writes the audit entry, so the map can only lag by a
+ * failed hydrate, never diverge silently.
+ */
+export class GuidanceIndex {
+    runToGuidance = new Map();
+    /**
+     * Load guidance from EVERY `guidance.set` entry in the trail — exhaustively, not capped
+     * (BRIEF-UX-002 C5, same defect as `RetryIndex.hydrate`: a durable note must not vanish
+     * because 1000+ newer writes landed on top of it). The trail answers newest first, so the
+     * FIRST entry seen per run is the current note — later (older) entries for the same run
+     * are superseded writes and are skipped, which is also what keeps a cleared note (newest
+     * entry has `text: ''`) from being resurrected by an older non-empty one. Still best-effort,
+     * like `RetryIndex.hydrate`; cost is one full-file scan at boot.
+     */
+    async hydrate(audit, log) {
+        try {
+            const superseded = new Set();
+            for (const entry of await audit.readAll({ action: 'guidance.set' })) {
+                if (typeof entry.runId !== 'string')
+                    continue;
+                if (superseded.has(entry.runId))
+                    continue;
+                // The NEWEST entry for a run decides — even when its text is malformed. Marking the
+                // run seen BEFORE the text check keeps a corrupt newest write from resurrecting an
+                // older superseded note (Copilot, #312): unknowable current note = no note.
+                superseded.add(entry.runId);
+                const text = entry.detail?.['text'];
+                if (typeof text !== 'string')
+                    continue;
+                if (text !== '')
+                    this.runToGuidance.set(entry.runId, text);
+            }
+        }
+        catch (err) {
+            log?.(`[runs] guidance-index hydrate failed (prior runs read as no-guidance until restart): ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    /** Upsert the note; the empty string CLEARS it (the DTO field goes back to absent). */
+    set(runId, text) {
+        if (text === '')
+            this.runToGuidance.delete(runId);
+        else
+            this.runToGuidance.set(runId, text);
+    }
+    /** The note for this run, or `undefined` (the DTO spells that as an ABSENT field). */
+    guidanceFor(runId) {
+        return this.runToGuidance.get(runId);
+    }
+}
+//# sourceMappingURL=guidance-index.js.map