> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Say what a source is, and whether installing it needs trust > Reads a source off the host's disk — a directory, a single .go file or a Go module reference — and reports what kind of package it is and whether installing it needs an acknowledgement. Nothing is installed, nothing is written, and a module reference is NOT downloaded: nothing may fetch a package's code in order to decide whether to ask permission to fetch its code, so a reference is reported as unread rather than described. It exists because the decision belongs to the host and the QUESTION belongs to a surface. A client has to know whether to ask before it can ask. installPackage still enforces the same rule server-side regardless of what any caller did with this answer. A local path must be sent ABSOLUTE. A relative one resolves against the HOST's working directory, which is not the caller's, and the artifact the answer describes would not be the one the caller meant. ## OpenAPI ````yaml /pt/openapi/v3-current/narya.yaml get /v1/packages/classification openapi: 3.1.0 info: title: Narya Host API version: 1.0.0 description: >- The contract between the Narya host and every client. One long-lived host serves this API over a Unix socket in your Narya home. The terminal client and the one-shot command that Lerian ships drive this API, and a client you write drives the same one. Requests authenticate with a bearer token issued by the identity provider the host is configured with. An operation that declares another security scheme also accepts that credential. A request without a valid credential gets 401 with NRY-0011. A caller whose role lacks the permission an operation needs gets 403 with NRY-0028. Submitting a message returns 202 with a turn id. Everything the turn produces streams over GET /v1/events as server-sent events with a typed envelope, and a stream resumes from a Last-Event-ID header. One error envelope: code, title and message. Codes are NRY- followed by four digits. Cursors are opaque. servers: [] security: - bearerAuth: [] tags: - name: host description: The host process itself — version, uptime, mode, store. - name: sessions description: Durable conversation containers. Archive, never destroy. - name: messages description: Submitting work into a session and interrupting it. - name: events description: The server-sent event stream every client consumes. - name: lanes description: Parallel tracks inside a session — main, subagent, side. - name: agents description: Named recipes — instructions, tools, model, policy. Read-only in v1. - name: ladder description: >- What a person can type: the skills and command files in force for one repository, and expanding one into text. Five origins merged, nearest winning a name, the repository's own rungs gated on trust. - name: permissions description: Pending permission asks, decisions, and the decision audit. - name: intercom description: Sessions on one machine finding and messaging each other. - name: packages description: The one thing a user installs — resources, Go code, or both. - name: extensions description: >- Host-side extensions and the operations each exposes over the wire. This is the generic lane a host extension uses to serve its own client half (a TUI component, a web panel) or any API-only consumer, without adding routes to this contract. - name: workflows description: Deterministic multi-agent orchestration runs. - name: providers description: Model suppliers, their auth state, and the model catalogue. - name: monitors description: >- Long-running watchers a session keeps beside its conversation — a test runner in watch mode, a build, a log being followed. Started by the model or by the person, always listed, always killable. - name: records description: The queryable local record of everything that happened. - name: environments description: >- Where a session's code lives and its commands run — this machine, or a container narya operates. A session that names none runs here. - name: schedules description: >- Work the host's own clock starts with nobody present — a repository, a prompt, a rule and what one fire may spend. Cancel, never destroy. - name: sharing description: >- Publishing a session from a developer's own home to the organisation's, and what is held back before a byte leaves the machine. - name: refinements description: >- What this owner has taught narya and allowed it to keep — distilled facts, and the skills, agents and commands the model wrote for itself. Propose, read, consent, roll back. Nothing here fires until a person answers. - name: platform description: >- Calls Lerian's control plane made to a home it hosts, as this home recorded them. paths: /v1/packages/classification: get: tags: - packages summary: Say what a source is, and whether installing it needs trust description: >- Reads a source off the host's disk — a directory, a single .go file or a Go module reference — and reports what kind of package it is and whether installing it needs an acknowledgement. Nothing is installed, nothing is written, and a module reference is NOT downloaded: nothing may fetch a package's code in order to decide whether to ask permission to fetch its code, so a reference is reported as unread rather than described. It exists because the decision belongs to the host and the QUESTION belongs to a surface. A client has to know whether to ask before it can ask. installPackage still enforces the same rule server-side regardless of what any caller did with this answer. A local path must be sent ABSOLUTE. A relative one resolves against the HOST's working directory, which is not the caller's, and the artifact the answer describes would not be the one the caller meant. operationId: classifyPackageSource parameters: - name: source in: query required: true schema: type: string maxLength: 1024 description: An absolute local path, or a registry/module reference. responses: '200': description: What that source is. content: application/json: schema: $ref: '#/components/schemas/PackageClassification' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalServerError' components: schemas: PackageClassification: type: object description: >- What a source turns out to be, learned without compiling it, importing it or downloading it. required: - source - name - kind - requiresFetch - requiresTrust properties: source: type: string description: >- The CANONICAL form of the source, and what an install must be started with: an absolute path for a local directory or file, the reference unchanged for a module. A consent surface that names one artifact and installs another is the one thing it may not do, so the caller carries this value through to installPackage rather than the word somebody typed. name: type: string description: The package name. kind: type: string enum: - resources - code - both x-enum-varnames: - PackageKindResources - PackageKindCode - PackageKindBoth description: >- resources installs instantly; code and both carry Go source and cost a rebuild and a binary swap. Reported as code for a module reference nothing has downloaded yet, which is the safe side of a guess nobody can make without fetching. requiresFetch: type: boolean description: >- The source is a module reference whose real kind and claims stay unknown until it is downloaded. A caller asking a person for consent says so rather than describing contents nobody has read. requiresTrust: type: boolean description: >- Installing this needs an acknowledgement: true for anything carrying compiled Go code, and equally true for a resources-only package declaring a hook, since a hook is an executable narya runs through the shell with no sandbox. A resources-only package with no hooks is never gated. examples: - source: /home/dev/packages/review name: acme/review kind: code requiresFetch: false requiresTrust: true Error: type: object description: >- The single error envelope every operation returns. Codes are NRY- followed by four digits and are catalogued in the top-level x-error-catalog extension. required: - code - title - message properties: code: type: string pattern: ^NRY-[0-9]{4}$ description: Machine-readable error code from the NRY catalogue. title: type: string maxLength: 256 description: Short human-readable summary of the error class. message: type: string maxLength: 4096 description: Specific, actionable description of what went wrong. fields: type: object description: Per-field validation problems. additionalProperties: type: string examples: - code: NRY-0002 title: Session not found message: >- No session with id 6b9f6d2e-1c3a-4f5b-9d7e-2a8c4e6f0b1d exists on this host. responses: BadRequest: description: Malformed request — invalid parameter, cursor, or JSON body. content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: >- Authentication required — a request carrying no valid identity token (NRY-0011). content: application/json: schema: $ref: '#/components/schemas/Error' UnprocessableEntity: description: The request was well-formed but failed validation. content: application/json: schema: $ref: '#/components/schemas/Error' InternalServerError: description: The host failed — including a store that refuses writes (NRY-0012). content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Enforced on every transport, with no exempt operation. A person's request — over the default local unix socket exactly as over a TCP listener — must carry a JWT issued by the configured identity provider, which the host verifies itself against that issuer's key set: signature, issuer, expiry, and the person and organisation it names. Requests without a valid one receive 401 NRY-0011. The socket's file permissions are transport and are not an authorisation. ````