Hatch

Put a sign-in screen in front of a `forever` roost so visitors must authenticate. Pass `tenantId` plus an `action`: • `enable` with `mode: "password"` and a `password` → ONE shared site password (everyone uses the same one). Best for a private demo or staging link. • `setPassword` with a new `password` → rotate the shared password. • `disable` → remove the login and serve the site publicly again. • `status` → report whether auth is on and which mode. Returns `{ enabled, mode, loginUrl }`. Auth is only available on `forever` roosts — `convert` a free roost first. The sign-in screen lives at `/__roost/login`. Prefer `password` mode; `useraccounts` is unavailable (per-tenant databases are no longer provisioned).

Create a human-in-the-loop review on the live artifact. Default options: Approve / Request changes / Reject. Reviewers see a Review required chip → modal. Request changes is non-terminal: webhook or poll returns changes_requested, then call continue_decision after regenerating. Optional timeoutSeconds and maxIterations (default 5). If the page has interactive controls (sliders/forms), the hatch HTML MUST expose window.__VR_HITL_GET_SETTINGS__ so the review can attach those assumptions as JSON. When the user integrates n8n, Temporal, CI, or any external workflow, pass webhookUrl (MCP opens the review; the platform POSTs each transition to that URL — prefer webhook over poll_decision for automation). See PARTNER-WEBHOOKS.md for event payloads.

After poll_decision returns status changes_requested, regenerate, then call this to reopen the same decision as pending_review for the next human round.

Atomically rename a roost's URL and/or change its tier. Pass `tenantId` plus at least one of `newPreferredSlug` (rename), `newTier` (e.g. `free` → `forever`), or `galleryListed` (opt in/out of the Barnyard carousel on viberooster.com). Do NOT call `hatch` again to upgrade — that creates a second site with a new id. Forever roosts are hidden from the carousel by default; pass `galleryListed: true` when promoting to forever to feature the site publicly.

Replace the server-side code of an existing roost. Advanced — most agents should use `upload` (for static files) or `convert` (for renames) instead. Pass `tenantId`, `workerName`, and a full ES module `script` (text only, 1.5 MiB max).

Issue a fresh pairing code + URL (TTL 10 minutes) for claiming a tenant or authorizing a new agent session. Render pairingUrl as a QR for the Vibe Rooster app. Prefer this over whoami when starting a pairing flow. Do not call again until poll_pairing returns expired/completed — repeated calls invalidate the previous code.

Create a NEW site (a 'roost') and return its public URL in one call. Returns `{ tenantId, slug, url, apex, uploads? }` — show `url` to the user and remember `tenantId`. NEVER call hatch twice for the same site — use `convert` to rename or change tier, and `upload`/`deploy` for content updates. Pick `apex` from the user's intent (homes / estate / land / wedding / events / agency / site / omit for theroost.dev). Do NOT invent other apexes. Four ways to call it: • Omit `manifest`, `site`, and `script` → a placeholder page is published instantly (best zero-token first turn). • Pass `manifest` (file list with sizes) → returns presigned `uploads[]`; you PUT each file's bytes directly to its URL. PREFER this for any project with images, fonts, video, or more than a few KB of HTML. • Pass `site` (inline files map) → small text-only sites only. Files are sent in the request body, so this is expensive in tokens for anything bigger than a handful of HTML/CSS files. • Pass `script` → advanced: full server-side code as one ES module (1.5 MiB max, text only — NEVER base64-embed binaries here).

Resolve a roost by `slug` or `tenantId`. Returns a compact view `{ tenantId, slug, url, apex, tier, state, expiresAt, customDomain, galleryListed }`. Use this to recover state across turns when the user mentions their site without giving you the tenantId.

Poll a pending Tier-2 phone approval. Returns the result once the owner approves or denies on their phone.

Long-poll (~20s) until the decision leaves pending_review. Returns changes_requested (regenerate + continue_decision), approved, rejected, timeout_exceeded, max_iterations_exceeded, or still pending_review. Includes comment, settings, conversation, iteration.

Poll for pairing completion (Device-Grant style). Waits up to ~20s for phone approval before returning. Statuses: pending / completed / expired / not_found. On completed, store sessionToken, refreshToken, and grantId — refreshToken renews access for up to 7 days without re-pairing. When sessionToken expires (~1h), call refresh_session. The server also binds tokens to this connector session. Pass tenantId when known. Device claim ≠ forever billing upgrade.

Renew a short-lived access token (~1h) using the refreshToken from poll_pairing. The grant (and refresh capability) lasts up to 7 days — after that, re-pair via get_pairing_code. Each refresh rotates the refreshToken; store the new one. Requires the same connector session (MCP-Session-Id) as when you paired — if fingerprint mismatches, re-pair.

Issue a signed, expiring guest view URL for any tier (`?vt=…`). Use for private run reports without forever-tier password auth. Returns `{ url, viewToken, expiresAt }`.

Add or replace files on an EXISTING roost. Pass `tenantId` plus a `manifest` listing each file's path, size, and optional content type. Returns one presigned PUT URL per file — upload bytes directly via HTTP (e.g. `curl -T file.png -H 'Content-Type: image/png' "$url"`). Files go live immediately as each PUT completes; no separate publish call is needed. Use after regenerating a dashboard locally; Hatch does not schedule regenerations.

Return the caller's current identity and tenant state. Never errors when unidentified — returns a pairing path instead. After poll_pairing completes, whoami with the same tenantId should show identified:true via server-side session binding. Returns sessionExpiresAt (~1h) and grantExpiresAt (~7d). If sessionExpired:true, call refresh_session with your stored refreshToken.