ListSkillsByWorkspace returns all skills installed in the given workspace.

ListUserWorkspaces returns all workspaces the given user belongs to.

===================================================================== Provisioning (called once when the owning entity is created) ===================

ReplyToSession Reply TODO: implement streaming for remote mode. Currently waits for the full response before returning, so the user sees no output unt

SaveMemoryForUser SaveMemory creates a new memory entry attributed to (agentID, userID) and links it to the source messages it was derived from.

Search executes a web search and returns formatted results. Count is the max number of results to return (1-10). timeRange is an optional filter: "d"

SetReplyURL sets the URL of the Reply Lambda Function URL. Required before calling Chat. CLIs typically read it from env ASTROCLAW_REPLY_URL.

SetToken stores a bearer token to be attached to subsequent requests.

SetUserPassword hashes plaintext with Argon2id and stores the PHC-encoded result for the given user. Used both for initial password setup and for pass

WithProvisioner attaches a DataKeyProvisioner. Required for any caller that creates users or workspaces because we need to create data key for them;

buildLambdaHandler wires DSQL, wsbus, storage/kms, chat.Service, and the api.ReplyHandler, then mounts POST /sessions/{sessionID}/reply on a chi route

buildLambdaHandler connects to DSQL, wires the services, and returns a Lambda-compatible handler. Pulled out of init() so `go test` can import this pa

connectWS establishes a WebSocket connection to the API Gateway.

createSessionInWorkspace handles POST /workspaces/{workspaceID}/sessions. It decodes the request body and creates a new chat session in the workspace.

deleteSession handles DELETE /workspaces/{workspaceID}/sessions/{sessionID}. It soft-deletes the session identified by sessionID.

errorFromResponse maps a non-2xx status + body to a sentinel-wrapped error so callers can use errors.Is to make decisions.

extractSystem pulls out system messages from the msg slice and returns the concatenated system prompt + the remaining non-system messages.

filterTable removes entries belonging to a specific table (used to exclude the _migrations tracking table from Database B).

filterSupportingFiles removes SKILL.md from the file list, returning only supporting files (references, templates, scripts, etc.)

getAdmin handles GET /users/admin. It returns the platform admin user.

getSession handles GET /workspaces/{workspaceID}/sessions/{sessionID}. It returns a single session by ID, or 404 if it does not exist.

getSystemSetting handles GET /settings/{name}. It returns a deploy-wide system setting by name.

getWorkspaceSetting handles GET /workspaces/{workspaceID}/settings/{name}. It returns a workspace-scoped setting by name.

isRetryableStatus returns true for HTTP status codes that are worth retrying: 429 (rate limit) and 5xx (server errors).

listFiles lists all files under a skill's storage prefix. TODO: this only returns the first page. Fine for skills (they're small), but should iterate

listSessions handles GET /workspaces/{workspaceID}/sessions. It returns all sessions belonging to the given workspace.

listUserWorkspaces handles GET /users/{userID}/workspaces. It returns all workspaces the given user belongs to.

login handles POST /login. It verifies the supplied credentials and returns a signed JWT plus the public user record. The response collapses "unknown

newSafeHTTPClient returns an http.Client with SSRF protections: - Custom dialer that validates resolved IPs at connect time - Redirect checker that bl

parseFrontmatter extracts description, when_to_use, and version from SKILL.md YAML frontmatter. Missing fields are returned as empty strings.

processContent detects the content type and converts the body to text. Returns the extracted text and the extractor name. The extractor is a string la

providerToChatMessages converts provider messages to chat messages for persisting Agent output back to the database. SessionID is set on each message;

retryDelay determines how long to wait before the next retry attempt. Priority: 1. Retry-After header as numeric seconds (e.g. "30") 2. Retry-After he

safeDialContext wraps a dialer to validate resolved IPs at connect time. This prevents DNS rebinding attacks where a hostname resolves to a public IP

seedCredentials writes initial system-scope credentials into the database from environment variables set by CDK parameters. The system data key must a

seedDefaultAgent creates the genesis agent in the default workspace on first deploy if none exists. This is the first agent created in the system, and

seedDefaultSkills reads skill directories bundled with the Lambda, uploads each file to the storage bucket under skills/{author}/{name}/{version}/...,

seedDefaultUser creates the admin user on the first deployment if none exists, and (re)sets the admin password whenever a fresh value is provided via

seedDefaultWorkspace creates a default workspace and adds the admin to it as owner, unless the admin is already a member of some workspace.

seedJWTSecret ensures a secret used to sign session JWTs exists in the system-scope credentials. The secret never appears in any env var or log output

seedSystemDataKey ensures the system-scope data key exists. Must run before any seedXxxCredential call that touches system credentials.

serverErrorMessage pulls the "error" field out of our handlers' standard {"error": "..."} JSON body. Falls back to the raw bytes if the body is not JS

toSDKMessages converts AstroClaw Messages to Anthropic SDK MessageParam slice. Key differences from AstroClaw's format: - Content is an array of typed