{ "openapi": "3.1.0", "info": { "title": "TrustFortress Resource Library API", "version": "2026-08-01", "summary": "Browse, search, ask, and inspect Cloudflare-backed resource-library artifacts.", "description": "This Worker exposes R2 resource-library objects, ranked manifest search, source-grounded answer lookup, Cloudflare capability metadata, and a developer workbench." }, "servers": [ { "url": "https://lib.trustfortress.ai" } ], "tags": [ { "name": "Library", "description": "R2 listing and object access." }, { "name": "Claims", "description": "Grounded public claim registry and evidence pointers." }, { "name": "Search", "description": "Ranked source lookup and answer finding." }, { "name": "Developer", "description": "Schema and Cloudflare capability discovery." }, { "name": "CUB Registry", "description": "Public-safe projection of the centralized TrustFortress CUB registry." } ], "paths": { "/api/list": { "get": { "tags": [ "Library" ], "summary": "List R2 objects by prefix", "parameters": [ { "name": "prefix", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Prefix, child prefixes, and object metadata.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListResponse" } } } } } }, "head": { "tags": [ "Library" ], "summary": "Check list route availability", "responses": { "200": { "description": "OK" } } } }, "/api/catalog": { "get": { "tags": [ "Library" ], "summary": "Return the machine-readable resource catalog", "description": "Returns the D1-backed object catalog when available, otherwise the R2-listing catalog.", "responses": { "200": { "description": "Catalog grouped by collection with object keys, sizes, hashes, and source refs when available.", "content": { "application/json": { "schema": { "type": "object" } } } } } } }, "/api/claims": { "get": { "tags": [ "Claims" ], "summary": "Return the grounded claims registry", "description": "Machine-readable source of truth for headline TrustFortress / cubie-tf claims, including scope boundaries, pinned evidence, public downloads, reproduction steps, and known gaps.", "responses": { "200": { "description": "Claims registry with public-safe evidence metadata.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClaimsRegistry" } } } } } } }, "/api/reindex": { "post": { "tags": [ "Developer" ], "summary": "Refresh the D1 catalog from R2", "description": "Manual D1 reindex route. Requires a Worker REINDEX_TOKEN secret sent as a Bearer token or x-resource-library-reindex-token header. The scheduled cron reindex does not use this public route.", "responses": { "200": { "description": "Reindex summary.", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "description": "Missing or invalid reindex token." }, "503": { "description": "Manual reindex is disabled until REINDEX_TOKEN is configured." } } } }, "/api/search": { "get": { "tags": [ "Search" ], "summary": "Rank library sources for a text query", "parameters": [ { "name": "q", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "prefix", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ranked source links.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SearchResponse" } } } } } } }, "/api/ai-search": { "get": { "tags": [ "Search" ], "summary": "Semantically search visible library content", "description": "Uses the bound Cloudflare AI Search index when configured. This public route always returns only public source chunks; the authenticated /internal/api/ai-search alias can include email-gated chunks.", "parameters": [ { "name": "q", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Semantic search results, or a configuration notice when AI Search is unavailable.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Missing query." } } } }, "/api/ask": { "post": { "tags": [ "Search" ], "summary": "Ask a source-grounded library question", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AskRequest" }, "examples": { "publicFaq": { "summary": "Find the public Data Center FAQ", "value": { "question": "Where is the Data Center Stakeholder FAQ?", "prefix": "" } } } } } }, "responses": { "200": { "description": "Answer plus ranked sources.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AskResponse" } } } }, "400": { "description": "Invalid JSON or missing question." }, "413": { "description": "Request body too large." } } } }, "/api/capabilities": { "get": { "tags": [ "Developer" ], "summary": "Describe live and planned Cloudflare resource-library capabilities", "responses": { "200": { "description": "Current Worker state and selected Cloudflare knowledgebase path.", "content": { "application/json": { "schema": { "type": "object" } } } } } } }, "/api/openapi.json": { "get": { "tags": [ "Developer" ], "summary": "Return this OpenAPI document", "responses": { "200": { "description": "OpenAPI 3.1 schema.", "content": { "application/json": { "schema": { "type": "object" } } } } } } }, "/objects/{key}": { "get": { "tags": [ "Library" ], "summary": "Fetch an R2 object", "parameters": [ { "name": "key", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Object body." }, "404": { "description": "Object not found." } } }, "head": { "tags": [ "Library" ], "summary": "Check object metadata", "parameters": [ { "name": "key", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Object headers." }, "404": { "description": "Object not found." } } } }, "/browse/{prefix}": { "get": { "tags": [ "Library" ], "summary": "Open the HTML browser for a prefix", "parameters": [ { "name": "prefix", "in": "path", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "HTML browser view." } } } }, "/health": { "get": { "tags": [ "Developer" ], "summary": "Health check", "responses": { "200": { "description": "Worker health JSON." } } } }, "/api/cubs": { "get": { "tags": [ "CUB Registry" ], "summary": "Search or list centralized CUB records", "parameters": [ { "name": "q", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "repo", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "status", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "verification_state", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "production_consumption", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "proof_consumption", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "wiring", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "crate", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "use_case", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "invocation", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "invocation_role", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "formal_systems", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "kernels", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "proof_scope", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "deployable", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "lane", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "tier", "in": "query", "required": false, "schema": { "type": "string" } }, { "name": "limit", "in": "query", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "Public-safe CUB records." } } } }, "/api/cubs/{id}": { "get": { "tags": [ "CUB Registry" ], "summary": "Get one CUB by exact ID", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "One public-safe CUB record." }, "400": { "description": "Invalid CUB ID." }, "404": { "description": "CUB not found." }, "503": { "description": "Central registry unavailable." } } } }, "/api/cubs/{id}/code": { "get": { "tags": [ "CUB Registry" ], "summary": "Get the integrity index for a CUB's proof and runtime files", "description": "Returns exact-head file hashes and gated download availability without inlining source bytes.", "parameters": [ { "name": "id", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Public code-integrity index." }, "400": { "description": "Invalid CUB ID." }, "404": { "description": "CUB not found." }, "503": { "description": "Registry or exact-head code store unavailable." } } } }, "/api/code/{repo}/{head}/{path}": { "get": { "tags": [ "CUB Registry" ], "summary": "Download an exact-head code file", "description": "In-worker Cloudflare Access-gated raw file download (requireLibraryAccess). The Worker authenticates before any D1 lookup and re-hashes stored content before returning bytes. The path parameter may contain slash-separated segments.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ], "parameters": [ { "name": "repo", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "head", "in": "path", "required": true, "schema": { "type": "string" } }, { "name": "path", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Raw file bytes with X-CUB-Sha256 set to the computed verified SHA-256 digest. Cache-Control: private, no-store." }, "400": { "description": "Invalid repository, head, or path." }, "401": { "description": "Cloudflare Access credentials are missing or invalid." }, "403": { "description": "Cloudflare Access identity is not authorized." }, "404": { "description": "File not found in the exact-head store." }, "503": { "description": "Exact-head code store unavailable, or stored content failed digest verification." } } } }, "/api/cubs/meta": { "get": { "tags": [ "CUB Registry" ], "summary": "Get central registry freshness and reconciliation metadata", "responses": { "200": { "description": "Registry metadata." } } } }, "/mcp": { "post": { "tags": [ "Library" ], "summary": "Call the public read-only M2MTF MCP server", "description": "Stateless JSON-RPC 2.0 MCP. Public callers see public-safe collections and tools.", "responses": { "200": { "description": "JSON-RPC response." } } } }, "/internal/api/catalog": { "get": { "tags": [ "Library" ], "summary": "Return the authenticated full Resource Library catalog", "description": "Read-only 20-collection view. Credentials must remain server-side; responses are private and no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ], "responses": { "200": { "description": "Authorized public plus email-gated catalog." }, "401": { "description": "Authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." }, "503": { "description": "Catalog data plane unavailable." } } } }, "/internal/api/list": { "get": { "tags": [ "Library" ], "summary": "List authorized Resource Library objects", "parameters": [ { "name": "prefix", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Prefix, child prefixes, and object metadata.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ListResponse" } } } }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] }, "head": { "tags": [ "Library" ], "summary": "Check the authorized list route", "responses": { "200": { "description": "OK" }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/api/search": { "get": { "tags": [ "Search" ], "summary": "Search authorized Resource Library sources", "parameters": [ { "name": "q", "in": "query", "required": true, "schema": { "type": "string" } }, { "name": "prefix", "in": "query", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Ranked source links.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SearchResponse" } } } }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/api/ai-search": { "get": { "tags": [ "Search" ], "summary": "Semantically search authorized Library content", "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "parameters": [ { "name": "q", "in": "query", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Semantic search results, or a configuration notice when AI Search is unavailable.", "content": { "application/json": { "schema": { "type": "object" } } } }, "400": { "description": "Missing query." }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/library/api/ask": { "post": { "tags": [ "Search" ], "summary": "Ask an authorized source-grounded Library question", "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AskRequest" }, "examples": { "publicFaq": { "summary": "Find the public Data Center FAQ", "value": { "question": "Where is the Data Center Stakeholder FAQ?", "prefix": "" } } } } } }, "responses": { "200": { "description": "Answer plus ranked sources.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AskResponse" } } } }, "400": { "description": "Invalid JSON or missing question." }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." }, "413": { "description": "Request body too large." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/api/capabilities": { "get": { "tags": [ "Developer" ], "summary": "Read protected Library capability metadata", "responses": { "200": { "description": "Current Worker state and selected Cloudflare knowledgebase path.", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/api/claims": { "get": { "tags": [ "Claims" ], "summary": "Read claims through the protected Library namespace", "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "responses": { "200": { "description": "Claims registry with public-safe evidence metadata.", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClaimsRegistry" } } } }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/api/openapi.json": { "get": { "tags": [ "Developer" ], "summary": "Read the Resource Library OpenAPI contract", "responses": { "200": { "description": "OpenAPI 3.1 schema.", "content": { "application/json": { "schema": { "type": "object" } } } }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/objects/{key}": { "get": { "tags": [ "Library" ], "summary": "Fetch an authorized R2 object", "parameters": [ { "name": "key", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Object body." }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." }, "404": { "description": "Object not found." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] }, "head": { "tags": [ "Library" ], "summary": "Check authorized R2 object metadata", "parameters": [ { "name": "key", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "Object headers." }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." }, "404": { "description": "Object not found." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/browse/{prefix}": { "get": { "tags": [ "Library" ], "summary": "Browse authorized Resource Library collections", "parameters": [ { "name": "prefix", "in": "path", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "HTML browser view." }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "description": "Read-only public plus email-gated view. Credentials stay server-side and responses are private, no-store.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/llms.txt": { "get": { "tags": [ "Library" ], "responses": { "200": { "description": "Authorized LLM discovery index." }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "summary": "Return the authorized Resource Library LLM index", "description": "Text index for all authorized collections with protected browse, list, object, and MCP links.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] }, "head": { "tags": [ "Library" ], "responses": { "200": { "description": "Authorized LLM index headers." }, "401": { "description": "Cloudflare Access authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." } }, "summary": "Check the authorized LLM index", "description": "Returns headers for the protected LLM discovery index.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ] } }, "/internal/mcp": { "post": { "tags": [ "Library" ], "summary": "Call the authenticated read-only M2MTF MCP server", "description": "Same bounded tool set as /mcp, with public plus email-gated collections visible to an authorized server-side identity.", "security": [ { "cloudflareAccessToken": [] }, { "cloudflareAccessServiceTokenId": [], "cloudflareAccessServiceTokenSecret": [] } ], "responses": { "200": { "description": "JSON-RPC response." }, "401": { "description": "Authentication missing or invalid." }, "403": { "description": "Authenticated identity is not authorized." }, "413": { "description": "MCP request body exceeds the bounded limit." } } } } }, "components": { "schemas": { "LibraryObject": { "type": "object", "properties": { "key": { "type": "string" }, "size": { "type": "integer" }, "uploaded": { "type": [ "string", "null" ], "format": "date-time" }, "etag": { "type": [ "string", "null" ] } } }, "ListResponse": { "type": "object", "properties": { "prefix": { "type": "string" }, "prefixes": { "type": "array", "items": { "type": "string" } }, "objects": { "type": "array", "items": { "$ref": "#/components/schemas/LibraryObject" } } } }, "Source": { "type": "object", "properties": { "title": { "type": "string" }, "kind": { "type": "string" }, "key": { "type": "string" }, "href": { "type": "string" }, "summary": { "type": "string" }, "snippet": { "type": "string" }, "score": { "type": "number" } } }, "SearchResponse": { "type": "object", "properties": { "query": { "type": "string" }, "prefix": { "type": "string" }, "results": { "type": "array", "items": { "$ref": "#/components/schemas/Source" } } } }, "AskRequest": { "type": "object", "required": [ "question" ], "properties": { "question": { "type": "string", "maxLength": 500 }, "prefix": { "type": "string" } } }, "AskResponse": { "type": "object", "properties": { "query": { "type": "string" }, "prefix": { "type": "string" }, "mode": { "enum": [ "ai", "search" ] }, "answer": { "type": "string" }, "sources": { "type": "array", "items": { "$ref": "#/components/schemas/Source" } }, "notice": { "type": "string" } } }, "ClaimsRegistry": { "type": "object", "required": [ "meta", "claims" ], "properties": { "meta": { "type": "object", "properties": { "title": { "type": "string" }, "subtitle": { "type": "string" }, "generated": { "type": "string" }, "fact_checked": { "type": "string" }, "note": { "type": "string" }, "pins": { "type": "object", "additionalProperties": { "type": "string" } } } }, "claims": { "type": "array", "items": { "$ref": "#/components/schemas/Claim" } } } }, "Claim": { "type": "object", "required": [ "id", "title", "status", "scope", "statement" ], "properties": { "id": { "type": "string" }, "title": { "type": "string" }, "status": { "enum": [ "verified", "scoped", "partial" ] }, "scope": { "type": "string" }, "statement": { "type": "string" }, "runContract": { "type": "object", "description": "Machine-readable execution, provenance, estimand, and claim-boundary contract for empirical claims.", "additionalProperties": true }, "evidence": { "type": "array", "items": { "$ref": "#/components/schemas/ClaimEvidence" } }, "reproduce": { "type": "array", "items": { "type": "string" } }, "verify": { "type": "array", "items": { "type": "string" } }, "gaps": { "type": "array", "items": { "type": "string" } } } }, "ClaimEvidence": { "type": "object", "required": [ "artifact", "kind", "access" ], "properties": { "artifact": { "type": "string" }, "kind": { "type": "string" }, "access": { "enum": [ "public", "email-gated", "private" ] }, "repo": { "type": "string" }, "path": { "type": "string" }, "ref": { "type": "string" }, "url": { "type": "string" }, "sha256": { "type": "string" } } } }, "securitySchemes": { "cloudflareAccessToken": { "type": "apiKey", "in": "header", "name": "cf-access-token", "description": "Cloudflare Access application JWT from an authorized identity or prior service-token exchange." }, "cloudflareAccessServiceTokenId": { "type": "apiKey", "in": "header", "name": "CF-Access-Client-Id", "description": "Cloudflare Access service-token client ID for machine access." }, "cloudflareAccessServiceTokenSecret": { "type": "apiKey", "in": "header", "name": "CF-Access-Client-Secret", "description": "Cloudflare Access service-token client secret for machine access." } } } }