halfabyte-synapse 0.2.0__tar.gz → 0.3.7__tar.gz

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: halfabyte-synapse
-Version: 0.2.0
+Version: 0.3.7
 Summary: A compiler and runtime for AI agent workflows: faster and cheaper runs, with side effects protected and every change checked by a firewall.
 Author: Aryan Lomte, Radhesh, Aditya, Advay Chavan
 Maintainer: Half a Byte
@@ -46,13 +46,15 @@ Provides-Extra: langgraph
 Requires-Dist: langgraph<1.1,>=1.0; extra == "langgraph"
 Provides-Extra: adk
 Requires-Dist: google-adk<2.14,>=2.13; extra == "adk"
+Provides-Extra: slack
+Requires-Dist: slack_sdk<4,>=3.27; extra == "slack"
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
 Requires-Dist: mongomock>=4.1; extra == "dev"
 Provides-Extra: all
-Requires-Dist: halfabyte-synapse[bench,cloud,ml,ui]; extra == "all"
+Requires-Dist: halfabyte-synapse[bench,cloud,ml,slack,ui]; extra == "all"
 Dynamic: license-file
 
 # Synapse
@@ -64,7 +66,18 @@ pip install halfabyte-synapse
 synapse demo
 ```
 
-No API key, GPU or model needed: the demo runs on a built-in fake provider. The package is `halfabyte-synapse`; the command and the import are both `synapse`.
+That runs a built-in sample on a fake provider, with no key needed. **To use it on your own agent, change one line:**
+
+```python
+import synapse
+from openai import OpenAI
+
+client = synapse.wrap(OpenAI())   # your calls behave as before
+# ...run your agent...
+print(client.synapse_report())    # real calls, tokens, repeats and waste
+```
+
+Nothing leaves your process. Or point `base_url` at `synapse proxy`, or at a hosted workspace. The package is `halfabyte-synapse`; the command and the import are both `synapse`.
 
 Built by team **Half a Byte** for the BitNBuild 2026 "Around the World" final round (GDG On Campus, Fr. Conceicao Rodrigues College of Engineering), AI/ML problem statement 2.
 
@@ -186,6 +199,38 @@ def my_agent(question: str):
 
 Multi-agent workflows wrap steps in `with agent("researcher"):`, and they're still one graph.
 
+### If `synapse` isn't found
+
+pip can't change your PATH. Run this once, then open a new terminal:
+
+```
+python -m synapse path      # on Windows: py -m synapse path
+```
+
+### Plugin for Claude Code, OpenClaw and Hermes
+
+```
+synapse plugin --out synapse-plugin
+```
+
+That writes the skill, slash commands and MCP server into one folder, and prints the install command for each agent.
+
+### Two ways to run it
+
+| | **Synapse Local** | **Synapse Cloud** |
+|---|---|---|
+| Start | `pip install "halfabyte-synapse[ui]"`, `synapse ui` | Sign up at the site, make a project, copy its key |
+| Your code | `synapse.wrap(OpenAI())` | `synapse.wrap(OpenAI(), api_key="syn_k_...")` |
+| Data lives | On your machine, in SQLite | In our MongoDB Atlas: measurements only |
+| Account | None | Email, password and mobile number |
+| Only here | Nothing leaves your machine | Team roles, invites, read-only links, history across machines, daily token budgets, WhatsApp, mail and Slack alerts, activity log |
+
+Prompts and answers never leave your process with `wrap`. A report holds model names, timings, token counts, a one-way hash of each request and the workflow's shape.
+
+### Your key, your model
+
+Hosted, the Connect screen gives you a private address per provider, such as `https://HOST/w/TOKEN/groq/v1`. Your key goes through to your provider and is never stored. Prompts stay in memory for up to 24 hours, and never reach disk. It can also run the concurrency audit on your own model.
+
 ### Use it with no code changes
 
 ```bash

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/README.md

@@ -7,7 +7,18 @@ pip install halfabyte-synapse
 synapse demo
 ```
 
-No API key, GPU or model needed: the demo runs on a built-in fake provider. The package is `halfabyte-synapse`; the command and the import are both `synapse`.
+That runs a built-in sample on a fake provider, with no key needed. **To use it on your own agent, change one line:**
+
+```python
+import synapse
+from openai import OpenAI
+
+client = synapse.wrap(OpenAI())   # your calls behave as before
+# ...run your agent...
+print(client.synapse_report())    # real calls, tokens, repeats and waste
+```
+
+Nothing leaves your process. Or point `base_url` at `synapse proxy`, or at a hosted workspace. The package is `halfabyte-synapse`; the command and the import are both `synapse`.
 
 Built by team **Half a Byte** for the BitNBuild 2026 "Around the World" final round (GDG On Campus, Fr. Conceicao Rodrigues College of Engineering), AI/ML problem statement 2.
 
@@ -129,6 +140,38 @@ def my_agent(question: str):
 
 Multi-agent workflows wrap steps in `with agent("researcher"):`, and they're still one graph.
 
+### If `synapse` isn't found
+
+pip can't change your PATH. Run this once, then open a new terminal:
+
+```
+python -m synapse path      # on Windows: py -m synapse path
+```
+
+### Plugin for Claude Code, OpenClaw and Hermes
+
+```
+synapse plugin --out synapse-plugin
+```
+
+That writes the skill, slash commands and MCP server into one folder, and prints the install command for each agent.
+
+### Two ways to run it
+
+| | **Synapse Local** | **Synapse Cloud** |
+|---|---|---|
+| Start | `pip install "halfabyte-synapse[ui]"`, `synapse ui` | Sign up at the site, make a project, copy its key |
+| Your code | `synapse.wrap(OpenAI())` | `synapse.wrap(OpenAI(), api_key="syn_k_...")` |
+| Data lives | On your machine, in SQLite | In our MongoDB Atlas: measurements only |
+| Account | None | Email, password and mobile number |
+| Only here | Nothing leaves your machine | Team roles, invites, read-only links, history across machines, daily token budgets, WhatsApp, mail and Slack alerts, activity log |
+
+Prompts and answers never leave your process with `wrap`. A report holds model names, timings, token counts, a one-way hash of each request and the workflow's shape.
+
+### Your key, your model
+
+Hosted, the Connect screen gives you a private address per provider, such as `https://HOST/w/TOKEN/groq/v1`. Your key goes through to your provider and is never stored. Prompts stay in memory for up to 24 hours, and never reach disk. It can also run the concurrency audit on your own model.
+
 ### Use it with no code changes
 
 ```bash

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/halfabyte_synapse.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: halfabyte-synapse
-Version: 0.2.0
+Version: 0.3.7
 Summary: A compiler and runtime for AI agent workflows: faster and cheaper runs, with side effects protected and every change checked by a firewall.
 Author: Aryan Lomte, Radhesh, Aditya, Advay Chavan
 Maintainer: Half a Byte
@@ -46,13 +46,15 @@ Provides-Extra: langgraph
 Requires-Dist: langgraph<1.1,>=1.0; extra == "langgraph"
 Provides-Extra: adk
 Requires-Dist: google-adk<2.14,>=2.13; extra == "adk"
+Provides-Extra: slack
+Requires-Dist: slack_sdk<4,>=3.27; extra == "slack"
 Provides-Extra: dev
 Requires-Dist: pytest>=8; extra == "dev"
 Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
 Requires-Dist: ruff>=0.5; extra == "dev"
 Requires-Dist: mongomock>=4.1; extra == "dev"
 Provides-Extra: all
-Requires-Dist: halfabyte-synapse[bench,cloud,ml,ui]; extra == "all"
+Requires-Dist: halfabyte-synapse[bench,cloud,ml,slack,ui]; extra == "all"
 Dynamic: license-file
 
 # Synapse
@@ -64,7 +66,18 @@ pip install halfabyte-synapse
 synapse demo
 ```
 
-No API key, GPU or model needed: the demo runs on a built-in fake provider. The package is `halfabyte-synapse`; the command and the import are both `synapse`.
+That runs a built-in sample on a fake provider, with no key needed. **To use it on your own agent, change one line:**
+
+```python
+import synapse
+from openai import OpenAI
+
+client = synapse.wrap(OpenAI())   # your calls behave as before
+# ...run your agent...
+print(client.synapse_report())    # real calls, tokens, repeats and waste
+```
+
+Nothing leaves your process. Or point `base_url` at `synapse proxy`, or at a hosted workspace. The package is `halfabyte-synapse`; the command and the import are both `synapse`.
 
 Built by team **Half a Byte** for the BitNBuild 2026 "Around the World" final round (GDG On Campus, Fr. Conceicao Rodrigues College of Engineering), AI/ML problem statement 2.
 
@@ -186,6 +199,38 @@ def my_agent(question: str):
 
 Multi-agent workflows wrap steps in `with agent("researcher"):`, and they're still one graph.
 
+### If `synapse` isn't found
+
+pip can't change your PATH. Run this once, then open a new terminal:
+
+```
+python -m synapse path      # on Windows: py -m synapse path
+```
+
+### Plugin for Claude Code, OpenClaw and Hermes
+
+```
+synapse plugin --out synapse-plugin
+```
+
+That writes the skill, slash commands and MCP server into one folder, and prints the install command for each agent.
+
+### Two ways to run it
+
+| | **Synapse Local** | **Synapse Cloud** |
+|---|---|---|
+| Start | `pip install "halfabyte-synapse[ui]"`, `synapse ui` | Sign up at the site, make a project, copy its key |
+| Your code | `synapse.wrap(OpenAI())` | `synapse.wrap(OpenAI(), api_key="syn_k_...")` |
+| Data lives | On your machine, in SQLite | In our MongoDB Atlas: measurements only |
+| Account | None | Email, password and mobile number |
+| Only here | Nothing leaves your machine | Team roles, invites, read-only links, history across machines, daily token budgets, WhatsApp, mail and Slack alerts, activity log |
+
+Prompts and answers never leave your process with `wrap`. A report holds model names, timings, token counts, a one-way hash of each request and the workflow's shape.
+
+### Your key, your model
+
+Hosted, the Connect screen gives you a private address per provider, such as `https://HOST/w/TOKEN/groq/v1`. Your key goes through to your provider and is never stored. Prompts stay in memory for up to 24 hours, and never reach disk. It can also run the concurrency audit on your own model.
+
 ### Use it with no code changes
 
 ```bash

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/halfabyte_synapse.egg-info/SOURCES.txt

@@ -16,17 +16,40 @@ synapse/chaos_panel.py
 synapse/chatops.py
 synapse/ci.py
 synapse/cli.py
+synapse/cloud.py
+synapse/connect.py
 synapse/demo.py
 synapse/doctor.py
 synapse/export.py
 synapse/insights.py
+synapse/mail.py
 synapse/menus.py
 synapse/monitor.py
+synapse/openai.py
+synapse/pathsetup.py
 synapse/proxy.py
 synapse/quarantine.py
 synapse/search.py
+synapse/slack.py
 synapse/api/__init__.py
+synapse/api/cloud_routes.py
 synapse/api/main.py
+synapse/api/site/_redirects
+synapse/api/site/index.html
+synapse/api/site/assets/Graph3D-DVcdUeya.js
+synapse/api/site/assets/HeroSilicon-ktono7T_.js
+synapse/api/site/assets/LandingV2-3C75bSR_.js
+synapse/api/site/assets/graph-B5pWpvAm.js
+synapse/api/site/assets/graph-BnuhLJ6X.css
+synapse/api/site/assets/index-B8DPmNS7.js
+synapse/api/site/assets/index-XuVVhel1.css
+synapse/api/site/assets/motion-DDvmupEl.js
+synapse/api/site/assets/r3f-BtQsV2-H.js
+synapse/api/site/assets/silicon-DIMlxluB.js
+synapse/api/site/assets/three-Dc80Zr6c.js
+synapse/api/site/samples/blackbox_math_run.json
+synapse/api/site/samples/langfuse_support_agent.json
+synapse/api/site/samples/otel_refund_agent.json
 synapse/core/__init__.py
 synapse/core/agents.py
 synapse/core/effects.py
@@ -40,6 +63,7 @@ synapse/correctness/__init__.py
 synapse/correctness/audit.py
 synapse/correctness/chaos.py
 synapse/correctness/equivalence.py
+synapse/correctness/evidence.py
 synapse/correctness/firewall.py
 synapse/correctness/net_rule.py
 synapse/correctness/preconditions.py
@@ -55,6 +79,7 @@ synapse/frontend/adapters/__init__.py
 synapse/frontend/adapters/adk.py
 synapse/frontend/adapters/crewai.py
 synapse/frontend/adapters/langgraph.py
+synapse/frontend/adapters/state_trace.py
 synapse/frontend/importers/__init__.py
 synapse/frontend/importers/_common.py
 synapse/frontend/importers/blackbox.py
@@ -62,6 +87,8 @@ synapse/frontend/importers/langfuse.py
 synapse/frontend/importers/otel.py
 synapse/mcp/__init__.py
 synapse/mcp/__main__.py
+synapse/mcp/annotations.py
+synapse/mcp/cli_tools.py
 synapse/mcp/prompts.py
 synapse/mcp/protocol.py
 synapse/mcp/registry.py
@@ -113,6 +140,8 @@ tests/test_chaos.py
 tests/test_chatops.py
 tests/test_checkers.py
 tests/test_cli.py
+tests/test_cloud.py
+tests/test_connect.py
 tests/test_contracts.py
 tests/test_corpus.py
 tests/test_correctness.py
@@ -120,6 +149,7 @@ tests/test_cost_resources.py
 tests/test_crewai_adapter.py
 tests/test_dsl.py
 tests/test_effects.py
+tests/test_evidence.py
 tests/test_features.py
 tests/test_hashing.py
 tests/test_importers.py
@@ -129,12 +159,16 @@ tests/test_ledger.py
 tests/test_lift.py
 tests/test_manager.py
 tests/test_mcp.py
+tests/test_mcp_annotations.py
 tests/test_monitor_menus.py
 tests/test_net_rule.py
 tests/test_passes.py
+tests/test_pathsetup.py
+tests/test_plugin.py
 tests/test_policy_study.py
 tests/test_profile.py
 tests/test_providers.py
+tests/test_real_runs.py
 tests/test_recording.py
 tests/test_report.py
 tests/test_research_fanout.py
@@ -144,8 +178,10 @@ tests/test_runtime.py
 tests/test_search.py
 tests/test_sir.py
 tests/test_skill.py
+tests/test_slack.py
 tests/test_speculation.py
 tests/test_splits.py
+tests/test_state_trace.py
 tests/test_store_backends.py
 tests/test_suite.py
 tests/test_usp.py

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/halfabyte_synapse.egg-info/requires.txt

@@ -8,7 +8,7 @@ psutil>=5.9
 google-adk<2.14,>=2.13
 
 [all]
-halfabyte-synapse[bench,cloud,ml,ui]
+halfabyte-synapse[bench,cloud,ml,slack,ui]
 
 [bench]
 rank-bm25>=0.2
@@ -34,6 +34,9 @@ scikit-learn>=1.4
 lightgbm>=4
 numpy
 
+[slack]
+slack_sdk<4,>=3.27
+
 [ui]
 fastapi>=0.110
 uvicorn[standard]>=0.29

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "halfabyte-synapse"         # the PyPI name; the import and the command are both `synapse`
-version = "0.2.0"
+version = "0.3.7"
 description = "A compiler and runtime for AI agent workflows: faster and cheaper runs, with side effects protected and every change checked by a firewall."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -53,8 +53,9 @@ cloud = ["pymongo>=4.6"]                                     # the optional shar
 crewai = ["crewai>=1.15,<1.16"]
 langgraph = ["langgraph>=1.0,<1.1"]                         # the LangGraph adapter; pinned like crewai
 adk = ["google-adk>=2.13,<2.14"]                            # the ADK adapter. NOT installable with crewai: ADK pins opentelemetry<=1.44, CrewAI >=1.45.1                              # the CrewAI adapter; pinned, it follows CrewAI's context rules
+slack = ["slack_sdk>=3.27,<4"]                                  # `synapse slack listen` (Socket Mode); alerts need nothing
 dev   = ["pytest>=8", "pytest-asyncio>=0.23", "ruff>=0.5", "mongomock>=4.1"]
-all   = ["halfabyte-synapse[ui,ml,bench,cloud]"]
+all   = ["halfabyte-synapse[ui,ml,bench,cloud,slack]"]
 
 [project.scripts]
 synapse = "synapse.cli:main"
@@ -63,7 +64,7 @@ synapse = "synapse.cli:main"
 include = ["synapse*"]
 
 [tool.setuptools.package-data]
-"synapse.api" = ["static/*.html"]
+"synapse.api" = ["site/**/*"]
 "synapse.skills" = ["synapse/*.md", "synapse/references/*.md"]
 "synapse" = ["data/models.yaml"]
 

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/synapse/__init__.py

@@ -17,8 +17,9 @@ Calling `research("...")` builds a `Graph` and executes nothing. See docs/IR_SPE
 
 from __future__ import annotations
 
-__version__ = "0.2.0"
+__version__ = "0.3.7"
 
+from synapse.connect import wrap  # noqa: E402
 from synapse.core.sir import (
     SIR_VERSION,
     Determinism,
@@ -36,6 +37,7 @@ from synapse.core.sir import (
 from synapse.frontend.dsl import agent, model, node, tool, workflow
 
 __all__ = [
+    "wrap",
     "SIR_VERSION",
     "Determinism",
     "Effect",

{halfabyte_synapse-0.2.0 → halfabyte_synapse-0.3.7}/synapse/alerts.py

@@ -8,7 +8,7 @@ command that raised the alert.
 Alerts go out only when asked (`--notify`) or from `synapse alerts test`. The dashboard runs the
 firewall whenever a page scrolls into view, so it must never page anyone.
 
-    Slack     SLACK_WEBHOOK_URL
+    Slack     SLACK_BOT_TOKEN and SLACK_CHANNEL (the bot, synapse/slack.py), or SLACK_WEBHOOK_URL
     EmailJS   EMAILJS_SERVICE_ID, EMAILJS_TEMPLATE_ID, EMAILJS_PUBLIC_KEY, EMAILJS_PRIVATE_KEY, ALERT_EMAIL_TO
     WhatsApp  TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, TWILIO_WHATSAPP_FROM, ALERT_WHATSAPP_TO
 """
@@ -100,10 +100,25 @@ class Channel:
 
 
 class Slack(Channel):
+    """The Synapse bot when it is set up (SLACK_BOT_TOKEN, SLACK_CHANNEL: see synapse/slack.py), so the
+    buttons reach `synapse slack listen`; otherwise an incoming webhook, whose buttons need the VM bot."""
+
     name = "slack"
     required = ("SLACK_WEBHOOK_URL",)
 
+    def missing(self) -> list[str]:
+        from synapse import slack
+
+        if slack.configured():
+            return []
+        return super().missing()
+
     def send(self, alert: Alert) -> str:
+        from synapse import slack
+
+        if slack.configured():
+            sent = slack.post(alert.subject, slack.alert_blocks(alert))
+            return f"posted by the bot to {sent.get('channel')}"
         payload: dict = {"text": alert.text}
         if alert.actions:
             payload["blocks"] = [

halfabyte_synapse-0.3.7/synapse/api/cloud_routes.py

@@ -0,0 +1,211 @@
+"""The HTTP face of `synapse/cloud.py`. Sign-in uses a bearer session; apps report with a project key."""
+
+from __future__ import annotations
+
+import os
+
+from fastapi import APIRouter, BackgroundTasks, Depends, Header, Request
+
+from synapse import cloud, mail
+
+
+def _hosted() -> bool:
+    """Accounts exist only on the hosted site. `synapse ui` on someone's machine has no login at all."""
+    return _store().mode == "mongodb" or os.environ.get("SYNAPSE_CLOUD_ENABLED") == "1"
+
+
+def _hosted_only(request: Request) -> None:
+    if not _hosted() and not request.url.path.endswith(("/tier", "/local")):
+        raise cloud.CloudError(404, "local_tier", "This is Synapse Local. It has no accounts: everything stays here.")
+
+
+router = APIRouter(prefix="/api/cloud", dependencies=[Depends(_hosted_only)])
+
+
+def _store():
+    from synapse.api.main import store
+
+    return store()
+
+
+def _bearer(authorization: str | None) -> str | None:
+    if authorization and authorization.lower().startswith("bearer "):
+        return authorization[7:].strip()
+    return None
+
+
+def _account(authorization: str | None) -> dict:
+    return cloud.account_for(_store(), _bearer(authorization))
+
+
+@router.get("/tier")
+def tier():
+    return {"tier": "cloud" if _hosted() else "local"}
+
+
+@router.post("/signup")
+def signup(body: dict, background: BackgroundTasks):
+    made = cloud.signup(_store(), email=body.get("email"), password=body.get("password"), phone=body.get("phone"),
+                        name=body.get("name", ""))
+    account = made["account"]
+    background.add_task(mail.send_quietly, account["email"], mail.welcome(account["name"], account["link_code"]))
+    return made
+
+
+@router.post("/forgot")
+def forgot(body: dict, background: BackgroundTasks):
+    found = cloud.forgot_password(_store(), body.get("email"))
+    if found:
+        background.add_task(mail.send_quietly, found[0], mail.password_reset(found[1]))
+    return {"ok": True}
+
+
+@router.post("/reset")
+def reset(body: dict):
+    cloud.reset_password(_store(), body.get("token"), body.get("password"))
+    return {"ok": True}
+
+
+@router.post("/login")
+def login(body: dict):
+    return cloud.login(_store(), email=body.get("email"), password=body.get("password"))
+
+
+@router.post("/logout")
+def logout(authorization: str | None = Header(None)):
+    token = _bearer(authorization)
+    if token:
+        cloud.logout(_store(), token)
+    return {"ok": True}
+
+
+@router.get("/me")
+def me(authorization: str | None = Header(None)):
+    account = _account(authorization)
+    return {"account": cloud.public_account(account), "projects": cloud.list_projects(_store(), account)}
+
+
+@router.post("/me/link-code")
+def link_code(authorization: str | None = Header(None)):
+    return cloud.refresh_link_code(_store(), _account(authorization))
+
+
+@router.post("/projects")
+def create_project(body: dict, authorization: str | None = Header(None)):
+    project = cloud.create_project(_store(), _account(authorization), body.get("name"))
+    return cloud.public_project(_store(), project, "owner")
+
+
+@router.get("/projects/{pid}")
+def project(pid: str, authorization: str | None = Header(None)):
+    account = _account(authorization)
+    found = cloud.project_for(_store(), account, pid)
+    role = found["members"][account["phone"]]
+    board = cloud.dashboard(_store(), pid, name=found["name"])
+    return {"project": cloud.public_project(_store(), found, role), "dashboard": board}
+
+
+@router.patch("/projects/{pid}")
+def settings(pid: str, body: dict, authorization: str | None = Header(None)):
+    return cloud.update_settings(_store(), _account(authorization), pid, body)
+
+
+@router.get("/projects/{pid}/runs/{run_id}")
+def run_detail(pid: str, run_id: str, authorization: str | None = Header(None)):
+    cloud.project_for(_store(), _account(authorization), pid)
+    return cloud.run_detail(_store(), pid, run_id)
+
+
+@router.get("/projects/{pid}/audit")
+def audit_log(pid: str, authorization: str | None = Header(None)):
+    cloud.project_for(_store(), _account(authorization), pid, at_least="member")
+    return {"events": cloud.audit_log(_store(), pid)}
+
+
+@router.get("/projects/{pid}/export")
+def export(pid: str, authorization: str | None = Header(None)):
+    cloud.project_for(_store(), _account(authorization), pid)
+    return cloud.export(_store(), pid)
+
+
+@router.post("/projects/{pid}/keys")
+def create_key(pid: str, body: dict, authorization: str | None = Header(None)):
+    return cloud.create_key(_store(), _account(authorization), pid, body.get("name", ""))
+
+
+@router.delete("/projects/{pid}/keys/{key_id}")
+def revoke_key(pid: str, key_id: str, authorization: str | None = Header(None)):
+    cloud.revoke_key(_store(), _account(authorization), pid, key_id)
+    return {"ok": True}
+
+
+@router.post("/projects/{pid}/invites")
+def invite(pid: str, body: dict, background: BackgroundTasks, authorization: str | None = Header(None)):
+    account = _account(authorization)
+    role = body.get("role", "viewer")
+    made = cloud.create_invite(_store(), account, pid, role)
+    if body.get("email"):
+        project = _store().get_artifact("cloud_project", pid)
+        message = mail.invite(project["name"], account["name"] or account["email"], role, made["token"])
+        background.add_task(mail.send_quietly, cloud.normalize_email(body["email"]), message)
+    return made
+
+
+@router.post("/invites/{token}/accept")
+def accept(token: str, authorization: str | None = Header(None)):
+    return cloud.accept_invite(_store(), _account(authorization), token)
+
+
+@router.delete("/projects/{pid}/members/{phone}")
+def remove_member(pid: str, phone: str, authorization: str | None = Header(None)):
+    cloud.remove_member(_store(), _account(authorization), pid, phone)
+    return {"ok": True}
+
+
+@router.post("/projects/{pid}/shares")
+def create_share(pid: str, authorization: str | None = Header(None)):
+    return cloud.create_share(_store(), _account(authorization), pid)
+
+
+@router.delete("/projects/{pid}/shares/{share_id}")
+def revoke_share(pid: str, share_id: str, authorization: str | None = Header(None)):
+    cloud.revoke_share(_store(), _account(authorization), pid, share_id)
+    return {"ok": True}
+
+
+@router.get("/shared/{token}")
+def shared(token: str):
+    return cloud.shared_dashboard(_store(), token)
+
+
+@router.post("/ingest")
+async def ingest(request: Request, background: BackgroundTasks, authorization: str | None = Header(None)):
+    pid = cloud.project_for_key(_store(), _bearer(authorization))
+    raw = await request.body()
+    if len(raw) > 5_000_000:
+        raise cloud.CloudError(413, "too_large", "That report is too large.")
+    message = cloud.ingest(_store(), pid, await request.json())
+    if message:
+        background.add_task(cloud.notify, _store(), pid, message, budget_figures=message.figures)
+    return {"ok": True}
+
+
+@router.get("/key/dashboard")
+def key_dashboard(authorization: str | None = Header(None)):
+    """Read-only, with a project key, for agents. It sees what its project reported, and can't manage anything."""
+    pid = cloud.project_for_key(_store(), _bearer(authorization))
+    project = _store().get_artifact("cloud_project", pid)
+    return cloud.dashboard(_store(), pid, name=project["name"])
+
+
+@router.get("/key/runs/{run_id}")
+def key_run(run_id: str, authorization: str | None = Header(None)):
+    return cloud.run_detail(_store(), cloud.project_for_key(_store(), _bearer(authorization)), run_id)
+
+
+@router.get("/local")
+def local_dashboard():
+    """The local tier's own view. Never offered on a shared store, where it would mix up other people's data."""
+    if _hosted():
+        raise cloud.CloudError(404, "not_local", "This server is the hosted tier. Sign in to see your projects.")
+    return cloud.dashboard(_store(), "local", name="This machine")