@agentlensai/server 0.11.0 → 0.14.0

package/dist/routes/compliance.js

@@ -0,0 +1,151 @@
+/**
+ * Compliance Report & Export Endpoints (Feature 9 — EU AI Act)
+ *
+ * GET /report           — Generate compliance report (JSON)
+ * GET /export/events    — Export events as JSON or streaming CSV
+ */
+import { Hono } from 'hono';
+import { getTenantId } from './tenant-helper.js';
+import { stream } from 'hono/streaming';
+import { EventRepository } from '../db/repositories/event-repository.js';
+import { AnalyticsRepository } from '../db/repositories/analytics-repository.js';
+import { GuardrailStore } from '../db/guardrail-store.js';
+import { ComplianceReportBuilder } from '../lib/compliance-report.js';
+import { CsvEventTransform, collectAllEvents } from '../lib/compliance-export.js';
+import { runVerification } from '../lib/audit-verify.js';
+const REPORT_TIMEOUT_MS = 30_000;
+const BATCH_SIZE = 5000;
+// ─── Validation Helpers ─────────────────────────────────────
+function validateDateRange(from, to) {
+    if (!from || !to) {
+        return { error: 'Both "from" and "to" query parameters are required (ISO 8601)', from: '', to: '' };
+    }
+    if (isNaN(Date.parse(from))) {
+        return { error: `Invalid ISO 8601 date for "from": ${from}`, from: '', to: '' };
+    }
+    if (isNaN(Date.parse(to))) {
+        return { error: `Invalid ISO 8601 date for "to": ${to}`, from: '', to: '' };
+    }
+    const diffMs = new Date(to).getTime() - new Date(from).getTime();
+    const oneYearMs = 365.25 * 24 * 60 * 60 * 1000;
+    if (diffMs > oneYearMs) {
+        return { error: 'Date range must not exceed 365 days', from: '', to: '' };
+    }
+    if (diffMs < 0) {
+        return { error: '"from" must be before "to"', from: '', to: '' };
+    }
+    return { from, to };
+}
+// ─── Route Factory ──────────────────────────────────────────
+export function complianceRoutes(db, signingKey, opts) {
+    const app = new Hono();
+    const eventRepo = new EventRepository(db);
+    const analyticsRepo = new AnalyticsRepository(db);
+    const guardrailStore = new GuardrailStore(db);
+    const builder = new ComplianceReportBuilder(eventRepo, analyticsRepo, guardrailStore, signingKey, opts?.retentionDays ?? 90, opts?.minimumRetentionDays ?? 180);
+    // ─── GET /report ────────────────────────────────────────
+    app.get('/report', async (c) => {
+        const auth = c.var.auth;
+        const tenantId = getTenantId(c);
+        const validation = validateDateRange(c.req.query('from'), c.req.query('to'));
+        if (validation.error) {
+            return c.json({ error: validation.error, status: 400 }, 400);
+        }
+        const { from, to } = validation;
+        // Build with timeout
+        const buildPromise = builder.build(tenantId, from, to);
+        const timeoutPromise = new Promise((resolve) => setTimeout(() => resolve(null), REPORT_TIMEOUT_MS));
+        const result = await Promise.race([buildPromise, timeoutPromise]);
+        if (result === null) {
+            return c.json({
+                error: 'Report generation timed out',
+                message: 'Generation did not complete within 30 seconds. Try a smaller date range.',
+                status: 504,
+            }, 504);
+        }
+        // Audit log
+        const audit = c.get('audit');
+        if (audit) {
+            audit.log({
+                tenantId,
+                actorType: auth?.type === 'jwt' ? 'user' : 'api_key',
+                actorId: auth?.userId ?? auth?.keyId ?? 'unknown',
+                action: 'compliance_report_generated',
+                resourceType: 'compliance_report',
+                details: { from, to },
+            });
+        }
+        return c.json(result, 200);
+    });
+    // ─── GET /export/events ─────────────────────────────────
+    app.get('/export/events', async (c) => {
+        const auth = c.var.auth;
+        const tenantId = getTenantId(c);
+        const validation = validateDateRange(c.req.query('from'), c.req.query('to'));
+        if (validation.error) {
+            return c.json({ error: validation.error, status: 400 }, 400);
+        }
+        const { from, to } = validation;
+        const format = c.req.query('format') ?? 'json';
+        if (format !== 'json' && format !== 'csv') {
+            return c.json({ error: 'Invalid format. Use "json" or "csv"', status: 400 }, 400);
+        }
+        // Audit log
+        const audit = c.get('audit');
+        if (audit) {
+            audit.log({
+                tenantId,
+                actorType: auth?.type === 'jwt' ? 'user' : 'api_key',
+                actorId: auth?.userId ?? auth?.keyId ?? 'unknown',
+                action: 'compliance_export_events',
+                resourceType: 'compliance_export',
+                details: { from, to, format },
+            });
+        }
+        if (format === 'csv') {
+            // Chain verification for header
+            const verification = await runVerification(eventRepo, { tenantId, from, to, signingKey });
+            const verificationStatus = verification.verified ? 'verified' : 'broken';
+            c.header('Content-Type', 'text/csv; charset=utf-8');
+            c.header('Content-Disposition', `attachment; filename="agentlens-events-${from}-${to}.csv"`);
+            c.header('Transfer-Encoding', 'chunked');
+            c.header('X-Chain-Verification', verificationStatus);
+            return stream(c, async (s) => {
+                const transform = new CsvEventTransform();
+                // Pipe transform output to the response stream
+                transform.on('data', (chunk) => {
+                    s.write(typeof chunk === 'string' ? new TextEncoder().encode(chunk) : chunk);
+                });
+                const done = new Promise((resolve) => {
+                    transform.on('end', resolve);
+                });
+                let offset = 0;
+                while (true) {
+                    const batch = eventRepo.getEventsBatchByTenantAndRange(tenantId, from, to, offset, BATCH_SIZE);
+                    if (batch.length === 0)
+                        break;
+                    for (const row of batch) {
+                        transform.write(row);
+                    }
+                    offset += batch.length;
+                    if (batch.length < BATCH_SIZE)
+                        break;
+                }
+                transform.end();
+                await done;
+            });
+        }
+        // JSON format
+        const allEvents = collectAllEvents(eventRepo, tenantId, from, to);
+        const verification = await runVerification(eventRepo, { tenantId, from, to, signingKey });
+        return c.json({
+            exportedAt: new Date().toISOString(),
+            range: { from, to },
+            totalEvents: allEvents.length,
+            chainVerification: verification,
+            events: allEvents,
+        }, 200);
+    });
+    return app;
+}
+//# sourceMappingURL=compliance.js.map

package/dist/routes/compliance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compliance.js","sourceRoot":"","sources":["../../src/routes/compliance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,MAAM,wCAAwC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAGzD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AACjC,MAAM,UAAU,GAAG,IAAI,CAAC;AAExB,+DAA+D;AAE/D,SAAS,iBAAiB,CAAC,IAAwB,EAAE,EAAsB;IACzE,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,EAAE,KAAK,EAAE,+DAA+D,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IACtG,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,qCAAqC,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,mCAAmC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAC/C,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,qCAAqC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;AACtB,CAAC;AAED,+DAA+D;AAE/D,MAAM,UAAU,gBAAgB,CAC9B,EAAY,EACZ,UAAmB,EACnB,IAAgE;IAEhE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAwD,CAAC;IAC7E,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,mBAAmB,CAAC,EAAE,CAAC,CAAC;IAClD,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,EAAE,CAAC,CAAC;IAE9C,MAAM,OAAO,GAAG,IAAI,uBAAuB,CACzC,SAAS,EACT,aAAa,EACb,cAAc,EACd,UAAU,EACV,IAAI,EAAE,aAAa,IAAI,EAAE,EACzB,IAAI,EAAE,oBAAoB,IAAI,GAAG,CAClC,CAAC;IAEF,2DAA2D;IAE3D,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC;QAEhC,qBAAqB;QACrB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,iBAAiB,CAAC,CACnD,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;QAElE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,6BAA6B;gBACpC,OAAO,EAAE,0EAA0E;gBACnF,MAAM,EAAE,GAAG;aACZ,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,YAAY;QACZ,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC;gBACR,QAAQ;gBACR,SAAS,EAAE,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACpD,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,SAAS;gBACjD,MAAM,EAAE,6BAA6B;gBACrC,YAAY,EAAE,mBAAmB;gBACjC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,2DAA2D;IAE3D,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAEhC,MAAM,UAAU,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,UAAU,CAAC;QAChC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;QAE/C,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qCAAqC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACpF,CAAC;QAED,YAAY;QACZ,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC;gBACR,QAAQ;gBACR,SAAS,EAAE,IAAI,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;gBACpD,OAAO,EAAE,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,KAAK,IAAI,SAAS;gBACjD,MAAM,EAAE,0BAA0B;gBAClC,YAAY,EAAE,mBAAmB;gBACjC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE;aAC9B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,gCAAgC;YAChC,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1F,MAAM,kBAAkB,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;YAEzE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC,CAAC;YACpD,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,0CAA0C,IAAI,IAAI,EAAE,OAAO,CAAC,CAAC;YAC7F,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,CAAC;YAErD,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBAC3B,MAAM,SAAS,GAAG,IAAI,iBAAiB,EAAE,CAAC;gBAE1C,+CAA+C;gBAC/C,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;oBAC9C,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBAC/E,CAAC,CAAC,CAAC;gBAEH,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;oBACzC,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/B,CAAC,CAAC,CAAC;gBAEH,IAAI,MAAM,GAAG,CAAC,CAAC;gBACf,OAAO,IAAI,EAAE,CAAC;oBACZ,MAAM,KAAK,GAAG,SAAS,CAAC,8BAA8B,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;oBAC/F,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM;oBAC9B,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;wBACxB,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;oBACvB,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC;oBACvB,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU;wBAAE,MAAM;gBACvC,CAAC;gBACD,SAAS,CAAC,GAAG,EAAE,CAAC;gBAChB,MAAM,IAAI,CAAC;YACb,CAAC,CAAC,CAAC;QACL,CAAC;QAED,cAAc;QACd,MAAM,SAAS,GAAG,gBAAgB,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC;QAE1F,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;YACnB,WAAW,EAAE,SAAS,CAAC,MAAM;YAC7B,iBAAiB,EAAE,YAAY;YAC/B,MAAM,EAAE,SAAS;SAClB,EAAE,GAAG,CAAC,CAAC;IACV,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/config.d.ts

@@ -22,19 +22,7 @@ declare const configUpdateSchema: z.ZodObject<{
     agentGateSecret: z.ZodOptional<z.ZodString>;
     formBridgeUrl: z.ZodOptional<z.ZodString>;
     formBridgeSecret: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    retentionDays?: number | undefined;
-    agentGateUrl?: string | undefined;
-    agentGateSecret?: string | undefined;
-    formBridgeUrl?: string | undefined;
-    formBridgeSecret?: string | undefined;
-}, {
-    retentionDays?: number | undefined;
-    agentGateUrl?: string | undefined;
-    agentGateSecret?: string | undefined;
-    formBridgeUrl?: string | undefined;
-    formBridgeSecret?: string | undefined;
-}>;
+}, z.core.$strip>;
 export type ConfigValues = z.infer<typeof configUpdateSchema>;
 export declare function getConfigValue(db: SqliteDb, key: string): string | null;
 export declare function configRoutes(db: SqliteDb): Hono<{

package/dist/routes/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAW/C;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAM/E;AAED,uCAAuC;AACvC,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;EAMtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAS9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAsBD,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ;eACL,aAAa;0CAwDhD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/routes/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAW/C;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAM/E;AAED,uCAAuC;AACvC,QAAA,MAAM,kBAAkB;;;;;;iBAMtB,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAS9D,wBAAgB,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAKvE;AAsBD,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ;eACL,aAAa;0CAwDhD"}

package/dist/routes/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/routes/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAM/C,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,QAAQ,CAAC;IACb,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB;eACpC,aAAa;0CAgDhD"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/routes/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAQ/C,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,QAAQ,CAAC;IACb,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC1C,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,gBAAgB;eACpC,aAAa;0CA+ChD"}

package/dist/routes/context.js

@@ -7,14 +7,15 @@
  * and key events, ranked by relevance.
  */
 import { Hono } from 'hono';
+import { getTenantId } from './tenant-helper.js';
 import { SessionSummaryStore } from '../db/session-summary-store.js';
-import { LessonStore } from '../db/lesson-store.js';
 import { ContextRetriever } from '../lib/context/retrieval.js';
 import { getTenantStore } from './tenant-helper.js';
+import { createLogger } from '../lib/logger.js';
+const log = createLogger('Context');
 export function contextRoutes(store, deps) {
     const app = new Hono();
     const sessionSummaryStore = new SessionSummaryStore(deps.db);
-    const lessonStore = new LessonStore(deps.db);
     // GET /api/context
     app.get('/', async (c) => {
         const topic = c.req.query('topic');
@@ -22,7 +23,7 @@ export function contextRoutes(store, deps) {
             return c.json({ error: 'Missing required query parameter: topic', status: 400 }, 400);
         }
         const apiKeyInfo = c.get('apiKey');
-        const tenantId = apiKeyInfo?.tenantId ?? 'default';
+        const tenantId = getTenantId(c);
         const tenantStore = getTenantStore(store, c);
         const userId = c.req.query('userId') || undefined;
         const agentId = c.req.query('agentId') || undefined;
@@ -31,7 +32,7 @@ export function contextRoutes(store, deps) {
         const limitStr = c.req.query('limit');
         const limit = limitStr ? Math.max(1, Math.min(parseInt(limitStr, 10) || 10, 100)) : 10;
         try {
-            const retriever = new ContextRetriever(deps.embeddingStore, deps.embeddingService, sessionSummaryStore, lessonStore, tenantStore);
+            const retriever = new ContextRetriever(deps.embeddingStore, deps.embeddingService, sessionSummaryStore, null, tenantStore);
             const result = await retriever.retrieve(tenantId, {
                 topic,
                 userId,
@@ -43,7 +44,7 @@ export function contextRoutes(store, deps) {
             return c.json(result);
         }
         catch (error) {
-            console.error('[context] Retrieval failed:', error instanceof Error ? error.message : error);
+            log.error('Retrieval failed', { error: error instanceof Error ? error.message : String(error) });
             return c.json({ error: 'Context retrieval failed', status: 500 }, 500);
         }
     });

package/dist/routes/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/routes/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAQpD,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,IAAsB;IACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgC,CAAC;IACrD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7C,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,UAAU,EAAE,QAAQ,IAAI,SAAS,CAAC;QACnD,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvF,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,gBAAgB,CACpC,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,gBAAgB,EACrB,mBAAmB,EACnB,WAAW,EACX,WAAW,CACZ,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBAChD,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,IAAI;gBACJ,EAAE;gBACF,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC7F,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/routes/context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAMjD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAQpC,MAAM,UAAU,aAAa,CAAC,KAAkB,EAAE,IAAsB;IACtE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgC,CAAC;IACrD,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE7D,mBAAmB;IACnB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yCAAyC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAE7C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC;QAC9C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;QAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAEvF,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,gBAAgB,CACpC,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,gBAAgB,EACrB,mBAAmB,EACnB,IAAI,EACJ,WAAW,CACZ,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE;gBAChD,KAAK;gBACL,MAAM;gBACN,OAAO;gBACP,IAAI;gBACJ,EAAE;gBACF,KAAK;aACN,CAAC,CAAC;YAEH,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/cost-budgets.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Cost Budget REST API Routes (Feature 5 — Story 5)
+ *
+ * POST   /                   — Create budget
+ * GET    /                   — List budgets
+ * PUT    /:id                — Update budget
+ * DELETE /:id                — Delete budget
+ * GET    /:id/status         — Budget status (spend vs limit)
+ * GET    /anomaly/config     — Get anomaly config
+ * PUT    /anomaly/config     — Update anomaly config
+ */
+import { Hono } from 'hono';
+import type { IEventStore } from '@agentlensai/core';
+import type { AuthVariables } from '../middleware/auth.js';
+import type { CostBudgetStore } from '../db/cost-budget-store.js';
+import type { BudgetEngine } from '../lib/budget-engine.js';
+export declare function costBudgetRoutes(store: CostBudgetStore, eventStore: IEventStore, budgetEngine: BudgetEngine): Hono<{
+    Variables: AuthVariables;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=cost-budgets.d.ts.map

package/dist/routes/cost-budgets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-budgets.d.ts","sourceRoot":"","sources":["../../src/routes/cost-budgets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,KAAK,EAAiC,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAI5D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY;eACxE,aAAa;0CAkLhD"}

package/dist/routes/cost-budgets.js

@@ -0,0 +1,177 @@
+/**
+ * Cost Budget REST API Routes (Feature 5 — Story 5)
+ *
+ * POST   /                   — Create budget
+ * GET    /                   — List budgets
+ * PUT    /:id                — Update budget
+ * DELETE /:id                — Delete budget
+ * GET    /:id/status         — Budget status (spend vs limit)
+ * GET    /anomaly/config     — Get anomaly config
+ * PUT    /anomaly/config     — Update anomaly config
+ */
+import { Hono } from 'hono';
+import { ulid } from 'ulid';
+import { createCostBudgetSchema, updateCostBudgetSchema, updateAnomalyConfigSchema, } from '@agentlensai/core';
+import { getTenantId } from './tenant-helper.js';
+import { parseBody, notFound, created } from './helpers.js';
+export function costBudgetRoutes(store, eventStore, budgetEngine) {
+    const app = new Hono();
+    // ─── Budget CRUD ─────────────────────────────────────────
+    app.post('/', async (c) => {
+        const tenantId = getTenantId(c);
+        const parsed = await parseBody(c, createCostBudgetSchema);
+        if (!parsed.success)
+            return parsed.response;
+        const now = new Date().toISOString();
+        const budget = {
+            id: ulid(),
+            tenantId,
+            scope: parsed.data.scope,
+            agentId: parsed.data.agentId,
+            period: parsed.data.period,
+            limitUsd: parsed.data.limitUsd,
+            onBreach: parsed.data.onBreach,
+            downgradeTargetModel: parsed.data.downgradeTargetModel,
+            enabled: parsed.data.enabled,
+            createdAt: now,
+            updatedAt: now,
+        };
+        store.createBudget(budget);
+        return created(c, budget);
+    });
+    app.get('/', async (c) => {
+        const tenantId = getTenantId(c);
+        const agentId = c.req.query('agentId');
+        const scope = c.req.query('scope');
+        const enabledStr = c.req.query('enabled');
+        const enabled = enabledStr === 'true' ? true : enabledStr === 'false' ? false : undefined;
+        const budgets = store.listBudgets(tenantId, {
+            agentId: agentId || undefined,
+            scope: scope || undefined,
+            enabled,
+        });
+        return c.json({ budgets });
+    });
+    app.get('/anomaly/config', async (c) => {
+        const tenantId = getTenantId(c);
+        const config = store.getAnomalyConfig(tenantId);
+        if (!config) {
+            return c.json({
+                tenantId,
+                multiplier: 3.0,
+                minSessions: 5,
+                enabled: true,
+                updatedAt: new Date().toISOString(),
+            });
+        }
+        return c.json(config);
+    });
+    app.put('/anomaly/config', async (c) => {
+        const tenantId = getTenantId(c);
+        const rawBody = await c.req.json().catch(() => null);
+        if (!rawBody) {
+            return c.json({ error: 'Invalid JSON body', status: 400 }, 400);
+        }
+        const result = updateAnomalyConfigSchema.safeParse(rawBody);
+        if (!result.success) {
+            return c.json({
+                error: 'Validation failed',
+                status: 400,
+                details: result.error.issues.map((i) => ({ path: i.path.join('.'), message: i.message })),
+            }, 400);
+        }
+        const existing = store.getAnomalyConfig(tenantId);
+        const config = {
+            tenantId,
+            multiplier: result.data.multiplier ?? existing?.multiplier ?? 3.0,
+            minSessions: result.data.minSessions ?? existing?.minSessions ?? 5,
+            enabled: result.data.enabled ?? existing?.enabled ?? true,
+            updatedAt: new Date().toISOString(),
+        };
+        store.upsertAnomalyConfig(config);
+        return c.json(config);
+    });
+    app.get('/:id/status', async (c) => {
+        const tenantId = getTenantId(c);
+        const budgetId = c.req.param('id');
+        const budget = store.getBudget(tenantId, budgetId);
+        if (!budget) {
+            return notFound(c, 'Budget');
+        }
+        // Compute current spend
+        let currentSpend = 0;
+        const periodStart = budgetEngine.getPeriodStart(budget.period);
+        if (budget.scope === 'agent' && budget.agentId) {
+            currentSpend = await eventStore.sumSessionCost({
+                agentId: budget.agentId,
+                from: periodStart,
+                tenantId: budget.tenantId,
+            });
+        }
+        // For session scope, we can't compute without a specific session context
+        // Return the cached state value if available
+        if (budget.scope === 'session') {
+            const state = store.getState(tenantId, budgetId);
+            currentSpend = state?.currentSpend ?? 0;
+        }
+        const percentUsed = budget.limitUsd > 0 ? (currentSpend / budget.limitUsd) * 100 : 0;
+        // Compute period end
+        let periodEnd;
+        const now = new Date();
+        switch (budget.period) {
+            case 'daily': {
+                const d = new Date(periodStart);
+                d.setUTCDate(d.getUTCDate() + 1);
+                periodEnd = d.toISOString();
+                break;
+            }
+            case 'weekly': {
+                const d = new Date(periodStart);
+                d.setUTCDate(d.getUTCDate() + 7);
+                periodEnd = d.toISOString();
+                break;
+            }
+            case 'monthly': {
+                const d = new Date(periodStart);
+                d.setUTCMonth(d.getUTCMonth() + 1);
+                periodEnd = d.toISOString();
+                break;
+            }
+            default:
+                periodEnd = now.toISOString();
+        }
+        return c.json({
+            budget,
+            currentSpend,
+            limitUsd: budget.limitUsd,
+            percentUsed: Math.round(percentUsed * 100) / 100,
+            breached: currentSpend >= budget.limitUsd,
+            periodStart,
+            periodEnd,
+        });
+    });
+    app.put('/:id', async (c) => {
+        const tenantId = getTenantId(c);
+        const budgetId = c.req.param('id');
+        const parsed = await parseBody(c, updateCostBudgetSchema);
+        if (!parsed.success)
+            return parsed.response;
+        const updated = store.updateBudget(tenantId, budgetId, parsed.data);
+        if (!updated) {
+            return notFound(c, 'Budget');
+        }
+        const budget = store.getBudget(tenantId, budgetId);
+        return c.json(budget);
+    });
+    app.delete('/:id', async (c) => {
+        const tenantId = getTenantId(c);
+        const budgetId = c.req.param('id');
+        const deleted = store.deleteBudget(tenantId, budgetId);
+        if (!deleted) {
+            return notFound(c, 'Budget');
+        }
+        return c.json({ id: budgetId, deleted: true });
+    });
+    return app;
+}
+//# sourceMappingURL=cost-budgets.js.map

package/dist/routes/cost-budgets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cost-budgets.js","sourceRoot":"","sources":["../../src/routes/cost-budgets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAK3B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAE5D,MAAM,UAAU,gBAAgB,CAAC,KAAsB,EAAE,UAAuB,EAAE,YAA0B;IAC1G,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgC,CAAC;IAErD,4DAA4D;IAE5D,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QAE5C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,MAAM,GAAe;YACzB,EAAE,EAAE,IAAI,EAAE;YACV,QAAQ;YACR,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;YACxB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM;YAC1B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;YAC9B,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB;YACtD,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO;YAC5B,SAAS,EAAE,GAAG;YACd,SAAS,EAAE,GAAG;SACf,CAAC;QAEF,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1F,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE;YAC1C,OAAO,EAAE,OAAO,IAAI,SAAS;YAC7B,KAAK,EAAE,KAAK,IAAI,SAAS;YACzB,OAAO;SACR,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,QAAQ;gBACR,UAAU,EAAE,GAAG;gBACf,WAAW,EAAE,CAAC;gBACd,OAAO,EAAE,IAAI;gBACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACpC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;aAC1F,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,MAAM,GAAsB;YAChC,QAAQ;YACR,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,IAAI,QAAQ,EAAE,UAAU,IAAI,GAAG;YACjE,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,IAAI,CAAC;YAClE,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,IAAI;YACzD,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC;QAEF,KAAK,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,wBAAwB;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,MAAM,WAAW,GAAG,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE/D,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/C,YAAY,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC;gBAC7C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,yEAAyE;QACzE,6CAA6C;QAC7C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACjD,YAAY,GAAG,KAAK,EAAE,YAAY,IAAI,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAErF,qBAAqB;QACrB,IAAI,SAAiB,CAAC;QACtB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,OAAO,CAAC,CAAC,CAAC;gBACb,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;gBACjC,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM;YACR,CAAC;YACD,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;gBACjC,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM;YACR,CAAC;YACD,KAAK,SAAS,CAAC,CAAC,CAAC;gBACf,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;gBAChC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;gBACnC,SAAS,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;gBAC5B,MAAM;YACR,CAAC;YACD;gBACE,SAAS,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAClC,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM;YACN,YAAY;YACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,GAAG,CAAC,GAAG,GAAG;YAChD,QAAQ,EAAE,YAAY,IAAI,MAAM,CAAC,QAAQ;YACzC,WAAW;YACX,SAAS;SACV,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,QAAQ,CAAC;QAE5C,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,IAA2B,CAAC,CAAC;QAC3F,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/B,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACnD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/delegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../src/routes/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAK1F,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa;;mBACnC,aAAa;;;EA4GhD"}
+{"version":3,"file":"delegation.d.ts","sourceRoot":"","sources":["../../src/routes/delegation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAQ1F,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa;;mBACnC,aAAa;;;EAqIhD"}

package/dist/routes/delegation.js

@@ -10,53 +10,64 @@
 import { Hono } from 'hono';
 import { DelegationService } from '../services/delegation-service.js';
 import { TASK_TYPES } from '@agentlensai/core';
+import { createDelegationSchema, rejectDelegationSchema, completeDelegationSchema } from '../schemas/delegation.js';
+import { formatZodErrors } from '../middleware/validation.js';
+import { getTenantId } from './tenant-helper.js';
 const VALID_TASK_TYPES = new Set(TASK_TYPES);
 export function delegationRoutes(db, transport) {
     const app = new Hono();
     const service = new DelegationService(db, transport);
-    function getTenantId(c) {
-        return c.get('apiKey')?.tenantId ?? 'default';
-    }
-    // POST /delegate — send a delegation request (outbound)
+    /**
+     * @summary Send a delegation request to another agent
+     * @description Creates an outbound delegation request targeting another agent by its anonymous ID.
+     * The request specifies a task type and input, with optional timeout, fallback, and retry settings.
+     * The call blocks until the delegate responds or the timeout expires.
+     * @body {{ agentId: string, targetAnonymousId: string, taskType: TaskType, input?: unknown, timeoutMs?: number, fallbackEnabled?: boolean, maxRetries?: number }}
+     * @returns {200} `{ result }` — delegation outcome from the target agent
+     * @throws {400} Missing or invalid agentId, targetAnonymousId, or taskType
+     * @throws {400} Invalid JSON body
+     */
     app.post('/delegate', async (c) => {
         const tenantId = getTenantId(c);
-        let body;
-        try {
-            body = await c.req.json();
-        }
-        catch {
+        const rawBody = await c.req.json().catch(() => null);
+        if (rawBody === null) {
             return c.json({ error: 'Invalid JSON body', status: 400 }, 400);
         }
-        const agentId = body.agentId;
-        if (!agentId) {
-            return c.json({ error: 'agentId is required', status: 400 }, 400);
-        }
-        const targetAnonymousId = body.targetAnonymousId;
-        if (!targetAnonymousId) {
-            return c.json({ error: 'targetAnonymousId is required', status: 400 }, 400);
-        }
-        const taskType = body.taskType;
-        if (!taskType || !VALID_TASK_TYPES.has(taskType)) {
-            return c.json({ error: 'taskType is required and must be valid', status: 400 }, 400);
+        const parseResult = createDelegationSchema.safeParse(rawBody);
+        if (!parseResult.success) {
+            return c.json({ error: 'Validation failed', status: 400, details: formatZodErrors(parseResult.error) }, 400);
         }
+        const { agentId, targetAnonymousId, taskType, input, timeoutMs, fallbackEnabled, maxRetries } = parseResult.data;
         const result = await service.delegate(tenantId, agentId, {
             targetAnonymousId,
             taskType: taskType,
-            input: body.input,
-            timeoutMs: body.timeoutMs ?? 30000,
-            fallbackEnabled: body.fallbackEnabled,
-            maxRetries: body.maxRetries,
+            input,
+            timeoutMs: timeoutMs ?? 30000,
+            fallbackEnabled,
+            maxRetries,
         });
         return c.json({ result });
     });
-    // GET /:id/delegations/inbox — poll for pending requests
+    /**
+     * @summary Poll for pending inbound delegation requests
+     * @description Returns all pending delegation requests addressed to the specified agent.
+     * @param {string} id — Agent ID (path)
+     * @returns {200} `{ requests: DelegationRequest[], total: number }`
+     */
     app.get('/:id/delegations/inbox', async (c) => {
         const tenantId = getTenantId(c);
         const agentId = c.req.param('id');
         const inbox = await service.getInbox(tenantId, agentId);
         return c.json({ requests: inbox, total: inbox.length });
     });
-    // POST /:id/delegations/:requestId/accept
+    /**
+     * @summary Accept a pending delegation request
+     * @description Marks the delegation request as accepted by the target agent.
+     * @param {string} id — Agent ID (path)
+     * @param {string} requestId — Delegation request ID (path)
+     * @returns {200} `{ accepted: true }`
+     * @throws {400} Request not found, already processed, or agent mismatch
+     */
     app.post('/:id/delegations/:requestId/accept', async (c) => {
         const tenantId = getTenantId(c);
         const agentId = c.req.param('id');
@@ -67,37 +78,52 @@ export function delegationRoutes(db, transport) {
         }
         return c.json({ accepted: true });
     });
-    // POST /:id/delegations/:requestId/reject
+    /**
+     * @summary Reject a pending delegation request
+     * @description Marks the delegation request as rejected, with an optional reason.
+     * @param {string} id — Agent ID (path)
+     * @param {string} requestId — Delegation request ID (path)
+     * @body {{ reason?: string }} — optional rejection reason
+     * @returns {200} `{ rejected: true }`
+     * @throws {400} Request not found, already processed, or agent mismatch
+     */
     app.post('/:id/delegations/:requestId/reject', async (c) => {
         const tenantId = getTenantId(c);
         const agentId = c.req.param('id');
         const requestId = c.req.param('requestId');
-        let body = {};
-        try {
-            body = await c.req.json();
+        const rawBody = await c.req.json().catch(() => ({}));
+        const parseResult = rejectDelegationSchema.safeParse(rawBody);
+        if (!parseResult.success) {
+            return c.json({ error: 'Validation failed', status: 400, details: formatZodErrors(parseResult.error) }, 400);
         }
-        catch {
-            // Body is optional for reject
-        }
-        const result = await service.rejectDelegation(tenantId, agentId, requestId, body.reason);
+        const result = await service.rejectDelegation(tenantId, agentId, requestId, parseResult.data.reason);
         if (!result.ok) {
             return c.json({ error: result.error, status: 400 }, 400);
         }
         return c.json({ rejected: true });
     });
-    // POST /:id/delegations/:requestId/complete
+    /**
+     * @summary Complete a delegation request with a result
+     * @description Marks the delegation as completed and delivers the output back to the requester.
+     * @param {string} id — Agent ID (path)
+     * @param {string} requestId — Delegation request ID (path)
+     * @body {{ output: unknown }} — the delegation result payload
+     * @returns {200} `{ completed: true }`
+     * @throws {400} Invalid JSON body, request not found, or not in accepted state
+     */
     app.post('/:id/delegations/:requestId/complete', async (c) => {
         const tenantId = getTenantId(c);
         const agentId = c.req.param('id');
         const requestId = c.req.param('requestId');
-        let body;
-        try {
-            body = await c.req.json();
-        }
-        catch {
+        const rawBody = await c.req.json().catch(() => null);
+        if (rawBody === null) {
             return c.json({ error: 'Invalid JSON body', status: 400 }, 400);
         }
-        const result = await service.completeDelegation(tenantId, agentId, requestId, body.output);
+        const parseResult = completeDelegationSchema.safeParse(rawBody);
+        if (!parseResult.success) {
+            return c.json({ error: 'Validation failed', status: 400, details: formatZodErrors(parseResult.error) }, 400);
+        }
+        const result = await service.completeDelegation(tenantId, agentId, requestId, parseResult.data.output);
         if (!result.ok) {
             return c.json({ error: result.error, status: 400 }, 400);
         }