@agentlensai/server 0.8.0 → 0.9.0

package/dist/lib/redaction/semantic-denylist-layer.js

@@ -0,0 +1,64 @@
+/**
+ * Layer 5: Semantic Deny List (Story 2.2)
+ */
+export class SemanticDenyListLayer {
+    name = 'semantic_denylist';
+    order = 500;
+    process(input, context) {
+        const findings = [];
+        for (const pattern of context.denyListPatterns) {
+            let matched = false;
+            let matchStart = -1;
+            let matchEnd = -1;
+            let matchedText = '';
+            if (pattern.startsWith('/') && pattern.lastIndexOf('/') > 0) {
+                // Regex pattern: /pattern/flags
+                const lastSlash = pattern.lastIndexOf('/');
+                const regexBody = pattern.slice(1, lastSlash);
+                const flags = pattern.slice(lastSlash + 1);
+                try {
+                    const regex = new RegExp(regexBody, flags.includes('i') ? 'gi' : 'g');
+                    const match = regex.exec(input);
+                    if (match) {
+                        matched = true;
+                        matchStart = match.index;
+                        matchEnd = match.index + match[0].length;
+                        matchedText = match[0];
+                    }
+                }
+                catch {
+                    // Invalid regex — skip
+                }
+            }
+            else {
+                // Plain text match (case-insensitive)
+                const idx = input.toLowerCase().indexOf(pattern.toLowerCase());
+                if (idx !== -1) {
+                    matched = true;
+                    matchStart = idx;
+                    matchEnd = idx + pattern.length;
+                    matchedText = input.slice(idx, idx + pattern.length);
+                }
+            }
+            if (matched) {
+                findings.push({
+                    layer: 'semantic_denylist',
+                    category: 'denied_content',
+                    originalLength: matchedText.length,
+                    replacement: '',
+                    startOffset: matchStart,
+                    endOffset: matchEnd,
+                    confidence: 1.0,
+                });
+                return {
+                    output: input,
+                    findings,
+                    blocked: true,
+                    blockReason: `Content matched deny-list pattern: ${pattern}`,
+                };
+            }
+        }
+        return { output: input, findings, blocked: false };
+    }
+}
+//# sourceMappingURL=semantic-denylist-layer.js.map

package/dist/lib/redaction/semantic-denylist-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"semantic-denylist-layer.js","sourceRoot":"","sources":["../../../src/lib/redaction/semantic-denylist-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,mBAA4B,CAAC;IACpC,KAAK,GAAG,GAAG,CAAC;IAErB,OAAO,CAAC,KAAa,EAAE,OAAyB;QAC9C,MAAM,QAAQ,GAAuB,EAAE,CAAC;QAExC,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;YAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC;YACpB,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;YAClB,IAAI,WAAW,GAAG,EAAE,CAAC;YAErB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5D,gCAAgC;gBAChC,MAAM,SAAS,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;gBAC3C,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;oBACtE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBAChC,IAAI,KAAK,EAAE,CAAC;wBACV,OAAO,GAAG,IAAI,CAAC;wBACf,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC;wBACzB,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;wBACzC,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;oBACzB,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,sCAAsC;gBACtC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;gBAC/D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;oBACf,OAAO,GAAG,IAAI,CAAC;oBACf,UAAU,GAAG,GAAG,CAAC;oBACjB,QAAQ,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC;oBAChC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;gBACvD,CAAC;YACH,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,mBAAmB;oBAC1B,QAAQ,EAAE,gBAAgB;oBAC1B,cAAc,EAAE,WAAW,CAAC,MAAM;oBAClC,WAAW,EAAE,EAAE;oBACf,WAAW,EAAE,UAAU;oBACvB,SAAS,EAAE,QAAQ;oBACnB,UAAU,EAAE,GAAG;iBAChB,CAAC,CAAC;gBAEH,OAAO;oBACL,MAAM,EAAE,KAAK;oBACb,QAAQ;oBACR,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,sCAAsC,OAAO,EAAE;iBAC7D,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;CACF"}

package/dist/lib/redaction/tenant-deidentification-layer.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Layer 4: Tenant De-identification (Story 2.2)
+ */
+import type { RedactionLayer, RedactionLayerResult, RedactionContext } from '@agentlensai/core';
+export declare class TenantDeidentificationLayer implements RedactionLayer {
+    readonly name: "tenant_deidentification";
+    readonly order = 400;
+    process(input: string, context: RedactionContext): RedactionLayerResult;
+}
+//# sourceMappingURL=tenant-deidentification-layer.d.ts.map

package/dist/lib/redaction/tenant-deidentification-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-deidentification-layer.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/tenant-deidentification-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAK3B,qBAAa,2BAA4B,YAAW,cAAc;IAChE,QAAQ,CAAC,IAAI,EAAG,yBAAyB,CAAU;IACnD,QAAQ,CAAC,KAAK,OAAO;IAErB,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,oBAAoB;CA2DxE"}

package/dist/lib/redaction/tenant-deidentification-layer.js

@@ -0,0 +1,64 @@
+/**
+ * Layer 4: Tenant De-identification (Story 2.2)
+ */
+// UUID v4 pattern
+const UUID_RE = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi;
+export class TenantDeidentificationLayer {
+    name = 'tenant_deidentification';
+    order = 400;
+    process(input, context) {
+        const findings = [];
+        let output = input;
+        // Build list of terms to strip
+        const terms = [];
+        if (context.tenantId)
+            terms.push(context.tenantId);
+        if (context.agentId)
+            terms.push(context.agentId);
+        terms.push(...context.knownTenantTerms);
+        // Filter empty/very short terms (avoid stripping single chars)
+        const validTerms = terms.filter(t => t.length >= 3);
+        // Sort by length descending to replace longer terms first
+        validTerms.sort((a, b) => b.length - a.length);
+        for (const term of validTerms) {
+            const escaped = term.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            const regex = new RegExp(escaped, 'gi');
+            let match;
+            while ((match = regex.exec(output)) !== null) {
+                findings.push({
+                    layer: 'tenant_deidentification',
+                    category: 'tenant_term',
+                    originalLength: match[0].length,
+                    replacement: '[TENANT_ENTITY]',
+                    startOffset: match.index,
+                    endOffset: match.index + match[0].length,
+                    confidence: 0.90,
+                });
+            }
+            output = output.replace(regex, '[TENANT_ENTITY]');
+        }
+        // Strip UUIDs (could be tenant/agent/user IDs)
+        const uuidRegex = new RegExp(UUID_RE.source, 'gi');
+        let uuidMatch;
+        const uuidMatches = [];
+        while ((uuidMatch = uuidRegex.exec(output)) !== null) {
+            uuidMatches.push({ start: uuidMatch.index, end: uuidMatch.index + uuidMatch[0].length });
+        }
+        // Replace UUIDs from end
+        for (let i = uuidMatches.length - 1; i >= 0; i--) {
+            const m = uuidMatches[i];
+            findings.push({
+                layer: 'tenant_deidentification',
+                category: 'uuid',
+                originalLength: m.end - m.start,
+                replacement: '[TENANT_ENTITY]',
+                startOffset: m.start,
+                endOffset: m.end,
+                confidence: 0.85,
+            });
+            output = output.slice(0, m.start) + '[TENANT_ENTITY]' + output.slice(m.end);
+        }
+        return { output, findings, blocked: false };
+    }
+}
+//# sourceMappingURL=tenant-deidentification-layer.js.map

package/dist/lib/redaction/tenant-deidentification-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-deidentification-layer.js","sourceRoot":"","sources":["../../../src/lib/redaction/tenant-deidentification-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,kBAAkB;AAClB,MAAM,OAAO,GAAG,oEAAoE,CAAC;AAErF,MAAM,OAAO,2BAA2B;IAC7B,IAAI,GAAG,yBAAkC,CAAC;IAC1C,KAAK,GAAG,GAAG,CAAC;IAErB,OAAO,CAAC,KAAa,EAAE,OAAyB;QAC9C,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,IAAI,MAAM,GAAG,KAAK,CAAC;QAEnB,+BAA+B;QAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,OAAO;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAExC,+DAA+D;QAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;QAEpD,0DAA0D;QAC1D,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;QAE/C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACxC,IAAI,KAA6B,CAAC;YAClC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAC7C,QAAQ,CAAC,IAAI,CAAC;oBACZ,KAAK,EAAE,yBAAyB;oBAChC,QAAQ,EAAE,aAAa;oBACvB,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBAC/B,WAAW,EAAE,iBAAiB;oBAC9B,WAAW,EAAE,KAAK,CAAC,KAAK;oBACxB,SAAS,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBACxC,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;QACpD,CAAC;QAED,+CAA+C;QAC/C,MAAM,SAAS,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,SAAiC,CAAC;QACtC,MAAM,WAAW,GAA0C,EAAE,CAAC;QAC9D,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,yBAAyB;QACzB,KAAK,IAAI,CAAC,GAAG,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,yBAAyB;gBAChC,QAAQ,EAAE,MAAM;gBAChB,cAAc,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;gBAC/B,WAAW,EAAE,iBAAiB;gBAC9B,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,SAAS,EAAE,CAAC,CAAC,GAAG;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9E,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/lib/redaction/url-path-scrubbing-layer.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Layer 3: URL/Path Scrubbing (Story 2.1)
+ */
+import type { RedactionLayer, RedactionLayerResult, RedactionContext } from '@agentlensai/core';
+/** Default public domain allowlist — URLs to these domains are preserved */
+export declare const DEFAULT_PUBLIC_DOMAINS: Set<string>;
+export declare class UrlPathScrubbingLayer implements RedactionLayer {
+    readonly name: "url_path_scrubbing";
+    readonly order = 300;
+    private readonly allowlist;
+    constructor(publicDomainAllowlist?: string[]);
+    process(input: string, _context: RedactionContext): RedactionLayerResult;
+}
+//# sourceMappingURL=url-path-scrubbing-layer.d.ts.map

package/dist/lib/redaction/url-path-scrubbing-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-path-scrubbing-layer.d.ts","sourceRoot":"","sources":["../../../src/lib/redaction/url-path-scrubbing-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,oBAAoB,EACpB,gBAAgB,EAEjB,MAAM,mBAAmB,CAAC;AAE3B,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,aAoBjC,CAAC;AAmDH,qBAAa,qBAAsB,YAAW,cAAc;IAC1D,QAAQ,CAAC,IAAI,EAAG,oBAAoB,CAAU;IAC9C,QAAQ,CAAC,KAAK,OAAO;IAErB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAc;gBAE5B,qBAAqB,CAAC,EAAE,MAAM,EAAE;IAM5C,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,gBAAgB,GAAG,oBAAoB;CAuFzE"}

package/dist/lib/redaction/url-path-scrubbing-layer.js

@@ -0,0 +1,156 @@
+/**
+ * Layer 3: URL/Path Scrubbing (Story 2.1)
+ */
+/** Default public domain allowlist — URLs to these domains are preserved */
+export const DEFAULT_PUBLIC_DOMAINS = new Set([
+    'github.com', 'gitlab.com', 'bitbucket.org',
+    'stackoverflow.com', 'stackexchange.com',
+    'docs.python.org', 'docs.rs', 'pkg.go.dev',
+    'npmjs.com', 'pypi.org', 'crates.io',
+    'developer.mozilla.org', 'mdn.io',
+    'wikipedia.org', 'en.wikipedia.org',
+    'google.com', 'youtube.com',
+    'medium.com', 'dev.to',
+    'reddit.com', 'news.ycombinator.com',
+    'twitter.com', 'x.com',
+    'microsoft.com', 'docs.microsoft.com', 'learn.microsoft.com',
+    'aws.amazon.com', 'docs.aws.amazon.com',
+    'cloud.google.com',
+    'azure.microsoft.com',
+    'docker.com', 'hub.docker.com',
+    'kubernetes.io',
+    'vercel.com', 'netlify.com', 'heroku.com',
+    'openai.com', 'platform.openai.com',
+    'anthropic.com', 'docs.anthropic.com',
+]);
+const PRIVATE_IP_RE = /\b(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3})\b/g;
+const UNIX_PATH_RE = /(?:\/(?:home|Users|var|etc|tmp|opt|usr|root|srv|mnt|proc|dev|sys|run))\/?[^\s,;:)"'`\]}>]*/g;
+const WINDOWS_PATH_RE = /[A-Z]:\\[^\s,;:)"'`\]}>]*/g;
+const UNC_PATH_RE = /\\\\[a-zA-Z0-9._-]+\\[^\s,;:)"'`\]}>]*/g;
+const URL_RE = /https?:\/\/[^\s,;)"'`\]}>]+/g;
+const INTERNAL_HOST_PATTERNS = [
+    /\.local\b/i,
+    /\.internal\b/i,
+    /\.corp\b/i,
+    /\.private\b/i,
+    /\.lan\b/i,
+    /\.intranet\b/i,
+    /\.compute\.internal\b/i,
+    /localhost/i,
+];
+function extractHostFromUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.hostname;
+    }
+    catch {
+        // Try extracting manually
+        const match = url.match(/https?:\/\/([^/:]+)/);
+        return match?.[1] ?? null;
+    }
+}
+function isPrivateIP(host) {
+    return /^(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.test(host);
+}
+function isInternalHost(host) {
+    if (isPrivateIP(host))
+        return true;
+    return INTERNAL_HOST_PATTERNS.some(p => p.test(host));
+}
+function isPublicDomain(host, allowlist) {
+    // Check exact match and parent domains
+    const parts = host.split('.');
+    for (let i = 0; i < parts.length - 1; i++) {
+        const domain = parts.slice(i).join('.');
+        if (allowlist.has(domain))
+            return true;
+    }
+    return false;
+}
+export class UrlPathScrubbingLayer {
+    name = 'url_path_scrubbing';
+    order = 300;
+    allowlist;
+    constructor(publicDomainAllowlist) {
+        this.allowlist = publicDomainAllowlist
+            ? new Set([...DEFAULT_PUBLIC_DOMAINS, ...publicDomainAllowlist])
+            : DEFAULT_PUBLIC_DOMAINS;
+    }
+    process(input, _context) {
+        const findings = [];
+        const replacements = [];
+        // Detect URLs
+        const urlRegex = new RegExp(URL_RE.source, 'g');
+        let match;
+        while ((match = urlRegex.exec(input)) !== null) {
+            const url = match[0];
+            const host = extractHostFromUrl(url);
+            if (host && !isPublicDomain(host, this.allowlist)) {
+                if (isInternalHost(host) || !host.includes('.') || host === 'localhost') {
+                    replacements.push({
+                        start: match.index,
+                        end: match.index + url.length,
+                        replacement: '[INTERNAL_URL]',
+                        category: 'internal_url',
+                    });
+                }
+            }
+        }
+        // Detect private IPs (standalone, not in URLs already matched)
+        const ipRegex = new RegExp(PRIVATE_IP_RE.source, 'g');
+        while ((match = ipRegex.exec(input)) !== null) {
+            const alreadyCovered = replacements.some(r => match.index >= r.start && match.index < r.end);
+            if (!alreadyCovered) {
+                replacements.push({
+                    start: match.index,
+                    end: match.index + match[0].length,
+                    replacement: '[PRIVATE_IP]',
+                    category: 'private_ip',
+                });
+            }
+        }
+        // Detect file paths
+        for (const pathRe of [UNIX_PATH_RE, WINDOWS_PATH_RE, UNC_PATH_RE]) {
+            const re = new RegExp(pathRe.source, pathRe.flags);
+            while ((match = re.exec(input)) !== null) {
+                const alreadyCovered = replacements.some(r => match.index >= r.start && match.index < r.end);
+                if (!alreadyCovered) {
+                    replacements.push({
+                        start: match.index,
+                        end: match.index + match[0].length,
+                        replacement: '[FILE_PATH]',
+                        category: 'file_path',
+                    });
+                }
+            }
+        }
+        // Deduplicate overlapping
+        replacements.sort((a, b) => b.start - a.start);
+        const deduped = [];
+        for (const r of replacements) {
+            if (!deduped.some(d => r.start < d.end && r.end > d.start)) {
+                deduped.push(r);
+            }
+        }
+        // Record findings ascending
+        const ascending = [...deduped].sort((a, b) => a.start - b.start);
+        for (const r of ascending) {
+            findings.push({
+                layer: 'url_path_scrubbing',
+                category: r.category,
+                originalLength: r.end - r.start,
+                replacement: r.replacement,
+                startOffset: r.start,
+                endOffset: r.end,
+                confidence: 0.90,
+            });
+        }
+        // Apply replacements descending
+        let output = input;
+        for (const r of deduped) {
+            output = output.slice(0, r.start) + r.replacement + output.slice(r.end);
+        }
+        return { output, findings, blocked: false };
+    }
+}
+//# sourceMappingURL=url-path-scrubbing-layer.js.map

package/dist/lib/redaction/url-path-scrubbing-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-path-scrubbing-layer.js","sourceRoot":"","sources":["../../../src/lib/redaction/url-path-scrubbing-layer.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IAC5C,YAAY,EAAE,YAAY,EAAE,eAAe;IAC3C,mBAAmB,EAAE,mBAAmB;IACxC,iBAAiB,EAAE,SAAS,EAAE,YAAY;IAC1C,WAAW,EAAE,UAAU,EAAE,WAAW;IACpC,uBAAuB,EAAE,QAAQ;IACjC,eAAe,EAAE,kBAAkB;IACnC,YAAY,EAAE,aAAa;IAC3B,YAAY,EAAE,QAAQ;IACtB,YAAY,EAAE,sBAAsB;IACpC,aAAa,EAAE,OAAO;IACtB,eAAe,EAAE,oBAAoB,EAAE,qBAAqB;IAC5D,gBAAgB,EAAE,qBAAqB;IACvC,kBAAkB;IAClB,qBAAqB;IACrB,YAAY,EAAE,gBAAgB;IAC9B,eAAe;IACf,YAAY,EAAE,aAAa,EAAE,YAAY;IACzC,YAAY,EAAE,qBAAqB;IACnC,eAAe,EAAE,oBAAoB;CACtC,CAAC,CAAC;AAEH,MAAM,aAAa,GAAG,8IAA8I,CAAC;AAErK,MAAM,YAAY,GAAG,6FAA6F,CAAC;AACnH,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,WAAW,GAAG,yCAAyC,CAAC;AAE9D,MAAM,MAAM,GAAG,8BAA8B,CAAC;AAE9C,MAAM,sBAAsB,GAAG;IAC7B,YAAY;IACZ,eAAe;IACf,WAAW;IACX,cAAc;IACd,UAAU;IACV,eAAe;IACf,wBAAwB;IACxB,YAAY;CACb,CAAC;AAEF,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,0BAA0B;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC/C,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,2IAA2I,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChK,CAAC;AAED,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,WAAW,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,SAAsB;IAC1D,uCAAuC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IACzC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,OAAO,qBAAqB;IACvB,IAAI,GAAG,oBAA6B,CAAC;IACrC,KAAK,GAAG,GAAG,CAAC;IAEJ,SAAS,CAAc;IAExC,YAAY,qBAAgC;QAC1C,IAAI,CAAC,SAAS,GAAG,qBAAqB;YACpC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,sBAAsB,EAAE,GAAG,qBAAqB,CAAC,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC;IAC7B,CAAC;IAED,OAAO,CAAC,KAAa,EAAE,QAA0B;QAC/C,MAAM,QAAQ,GAAuB,EAAE,CAAC;QACxC,MAAM,YAAY,GAAiF,EAAE,CAAC;QAEtG,cAAc;QACd,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;oBACxE,YAAY,CAAC,IAAI,CAAC;wBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM;wBAC7B,WAAW,EAAE,gBAAgB;wBAC7B,QAAQ,EAAE,cAAc;qBACzB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,+DAA+D;QAC/D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,KAAM,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,KAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CACrD,CAAC;YACF,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,YAAY,CAAC,IAAI,CAAC;oBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;oBAClC,WAAW,EAAE,cAAc;oBAC3B,QAAQ,EAAE,YAAY;iBACvB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,KAAK,MAAM,MAAM,IAAI,CAAC,YAAY,EAAE,eAAe,EAAE,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACnD,OAAO,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,cAAc,GAAG,YAAY,CAAC,IAAI,CACtC,CAAC,CAAC,EAAE,CAAC,KAAM,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,KAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,CACrD,CAAC;gBACF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,YAAY,CAAC,IAAI,CAAC;wBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,GAAG,EAAE,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM;wBAClC,WAAW,EAAE,aAAa;wBAC1B,QAAQ,EAAE,WAAW;qBACtB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,0BAA0B;QAC1B,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAwB,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;QAED,4BAA4B;QAC5B,MAAM,SAAS,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,KAAK,EAAE,oBAAoB;gBAC3B,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,cAAc,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK;gBAC/B,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,WAAW,EAAE,CAAC,CAAC,KAAK;gBACpB,SAAS,EAAE,CAAC,CAAC,GAAG;gBAChB,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;QACL,CAAC;QAED,gCAAgC;QAChC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1E,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9C,CAAC;CACF"}

package/dist/routes/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW;eACX,aAAa;0CA4DhD"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,wBAAgB,YAAY,CAAC,KAAK,EAAE,WAAW;eACX,aAAa;0CAsDhD"}

package/dist/routes/agents.js

@@ -33,16 +33,10 @@ export function agentsRoutes(store) {
         catch {
             // No body or invalid JSON — that's fine
         }
-        // Unpause by clearing pause fields
-        const updates = {
-            id,
-            pausedAt: undefined,
-            pauseReason: undefined,
-        };
-        if (clearModelOverride) {
-            updates.modelOverride = undefined;
+        // Unpause by clearing pause fields via dedicated method
+        if ('unpauseAgent' in tenantStore && typeof tenantStore.unpauseAgent === 'function') {
+            await tenantStore.unpauseAgent(id, clearModelOverride);
         }
-        await tenantStore.upsertAgent(updates);
         // Return the updated agent
         const updated = await tenantStore.getAgent(id);
         return c.json(updated);

package/dist/routes/agents.js.map

@@ -1 +1 @@
-{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,UAAU,YAAY,CAAC,KAAkB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgC,CAAC;IAErD,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC;QAE9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,6CAA6C;QAC7C,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QAED,mCAAmC;QACnC,MAAM,OAAO,GAAgE;YAC3E,EAAE;YACF,QAAQ,EAAE,SAAS;YACnB,WAAW,EAAE,SAAS;SACvB,CAAC;QACF,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC;QACpC,CAAC;QACD,MAAM,WAAW,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAEvC,2BAA2B;QAC3B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,MAAM,UAAU,YAAY,CAAC,KAAkB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgC,CAAC;IAErD,8DAA8D;IAC9D,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,CAAC;QAE9C,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,kEAAkE;IAClE,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAE7B,sCAAsC;QACtC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,6CAA6C;QAC7C,IAAI,kBAAkB,GAAG,KAAK,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClD,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,KAAK,IAAI,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,wCAAwC;QAC1C,CAAC;QAED,wDAAwD;QACxD,IAAI,cAAc,IAAI,WAAW,IAAI,OAAO,WAAW,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACpF,MAAO,WAAmF,CAAC,YAAY,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;QAClI,CAAC;QAED,2BAA2B;QAC3B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,qCAAqC;IACrC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAE7C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/audit.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Sharing Audit & Export Routes (Story 7.4)
+ *
+ * GET  /api/community/audit          — query audit log with filters
+ * GET  /api/community/audit/export   — JSON export of sharing audit events
+ * GET  /api/community/alerts         — get volume alert config
+ * PUT  /api/community/alerts         — update volume alert config
+ */
+import { Hono } from 'hono';
+import type { AuthVariables } from '../middleware/auth.js';
+import type { SqliteDb } from '../db/index.js';
+export declare function auditRoutes(db: SqliteDb): Hono<{
+    Variables: AuthVariables;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=audit.d.ts.map

package/dist/routes/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAI/C,wBAAgB,WAAW,CAAC,EAAE,EAAE,QAAQ;eACJ,aAAa;0CA4LhD"}

package/dist/routes/audit.js

@@ -0,0 +1,177 @@
+/**
+ * Sharing Audit & Export Routes (Story 7.4)
+ *
+ * GET  /api/community/audit          — query audit log with filters
+ * GET  /api/community/audit/export   — JSON export of sharing audit events
+ * GET  /api/community/alerts         — get volume alert config
+ * PUT  /api/community/alerts         — update volume alert config
+ */
+import { Hono } from 'hono';
+import { eq, and, gte, lte, desc } from 'drizzle-orm';
+import * as schema from '../db/schema.sqlite.js';
+export function auditRoutes(db) {
+    const app = new Hono();
+    function getTenantId(c) {
+        return c.get('apiKey')?.tenantId ?? 'default';
+    }
+    // ─── GET /audit — query audit log with filters ─────
+    app.get('/', async (c) => {
+        const tenantId = getTenantId(c);
+        const eventType = c.req.query('type');
+        const agentId = c.req.query('agentId');
+        const dateFrom = c.req.query('dateFrom');
+        const dateTo = c.req.query('dateTo');
+        const limitStr = c.req.query('limit');
+        const offsetStr = c.req.query('offset');
+        const limit = limitStr ? Math.min(Math.max(1, parseInt(limitStr, 10) || 50), 500) : 50;
+        const offset = offsetStr ? Math.max(0, parseInt(offsetStr, 10) || 0) : 0;
+        // Query all rows for this tenant, then filter in JS (sqlite doesn't have great dynamic WHERE)
+        let rows = db
+            .select()
+            .from(schema.sharingAuditLog)
+            .where(eq(schema.sharingAuditLog.tenantId, tenantId))
+            .all();
+        // Apply filters
+        if (eventType) {
+            rows = rows.filter((r) => r.eventType === eventType);
+        }
+        if (agentId) {
+            // agentId filtering: match initiatedBy field
+            rows = rows.filter((r) => r.initiatedBy === agentId);
+        }
+        if (dateFrom) {
+            rows = rows.filter((r) => r.timestamp >= dateFrom);
+        }
+        if (dateTo) {
+            rows = rows.filter((r) => r.timestamp <= dateTo);
+        }
+        // Sort by timestamp descending
+        rows.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+        const total = rows.length;
+        const paged = rows.slice(offset, offset + limit);
+        const events = paged.map((r) => ({
+            id: r.id,
+            tenantId: r.tenantId,
+            eventType: r.eventType,
+            lessonId: r.lessonId ?? undefined,
+            anonymousLessonId: r.anonymousLessonId ?? undefined,
+            lessonHash: r.lessonHash ?? undefined,
+            redactionFindings: r.redactionFindings ? JSON.parse(r.redactionFindings) : undefined,
+            queryText: r.queryText ?? undefined,
+            resultIds: r.resultIds ? JSON.parse(r.resultIds) : undefined,
+            poolEndpoint: r.poolEndpoint ?? undefined,
+            initiatedBy: r.initiatedBy ?? 'system',
+            timestamp: r.timestamp,
+        }));
+        return c.json({ events, total, hasMore: offset + paged.length < total });
+    });
+    // ─── GET /audit/export — JSON export ───────────────
+    app.get('/export', async (c) => {
+        const tenantId = getTenantId(c);
+        const type = c.req.query('type'); // optional filter by event type
+        let rows = db
+            .select()
+            .from(schema.sharingAuditLog)
+            .where(eq(schema.sharingAuditLog.tenantId, tenantId))
+            .all();
+        if (type) {
+            rows = rows.filter((r) => r.eventType === type);
+        }
+        rows.sort((a, b) => b.timestamp.localeCompare(a.timestamp));
+        const events = rows.map((r) => ({
+            id: r.id,
+            tenantId: r.tenantId,
+            eventType: r.eventType,
+            lessonId: r.lessonId,
+            anonymousLessonId: r.anonymousLessonId,
+            lessonHash: r.lessonHash,
+            redactionFindings: r.redactionFindings ? JSON.parse(r.redactionFindings) : null,
+            queryText: r.queryText,
+            resultIds: r.resultIds ? JSON.parse(r.resultIds) : null,
+            poolEndpoint: r.poolEndpoint,
+            initiatedBy: r.initiatedBy,
+            timestamp: r.timestamp,
+        }));
+        c.header('Content-Type', 'application/json');
+        c.header('Content-Disposition', `attachment; filename="audit-export-${tenantId}-${new Date().toISOString().slice(0, 10)}.json"`);
+        return c.json({ exportedAt: new Date().toISOString(), tenantId, count: events.length, events });
+    });
+    // ─── GET /alerts — get volume alert config ─────────
+    app.get('/alerts', async (c) => {
+        const tenantId = getTenantId(c);
+        const config = db
+            .select()
+            .from(schema.sharingConfig)
+            .where(eq(schema.sharingConfig.tenantId, tenantId))
+            .get();
+        return c.json({
+            threshold: config?.volumeAlertThreshold ?? 100,
+            rateLimitPerHour: config?.rateLimitPerHour ?? 50,
+            enabled: config?.enabled ?? false,
+        });
+    });
+    // ─── PUT /alerts — update volume alert config ──────
+    app.put('/alerts', async (c) => {
+        const tenantId = getTenantId(c);
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            return c.json({ error: 'Invalid JSON body' }, 400);
+        }
+        const updates = {};
+        if (body.threshold !== undefined) {
+            const val = Number(body.threshold);
+            if (isNaN(val) || val < 1)
+                return c.json({ error: 'threshold must be >= 1' }, 400);
+            updates.volumeAlertThreshold = val;
+        }
+        if (body.rateLimitPerHour !== undefined) {
+            const val = Number(body.rateLimitPerHour);
+            if (isNaN(val) || val < 1)
+                return c.json({ error: 'rateLimitPerHour must be >= 1' }, 400);
+            updates.rateLimitPerHour = val;
+        }
+        if (Object.keys(updates).length === 0) {
+            return c.json({ error: 'No valid fields to update' }, 400);
+        }
+        const existing = db
+            .select()
+            .from(schema.sharingConfig)
+            .where(eq(schema.sharingConfig.tenantId, tenantId))
+            .get();
+        const now = new Date().toISOString();
+        if (existing) {
+            db.update(schema.sharingConfig)
+                .set({ ...updates, updatedAt: now })
+                .where(eq(schema.sharingConfig.tenantId, tenantId))
+                .run();
+        }
+        else {
+            db.insert(schema.sharingConfig).values({
+                tenantId,
+                enabled: false,
+                humanReviewEnabled: false,
+                poolEndpoint: null,
+                anonymousContributorId: null,
+                purgeToken: null,
+                rateLimitPerHour: updates.rateLimitPerHour ?? 50,
+                volumeAlertThreshold: updates.volumeAlertThreshold ?? 100,
+                updatedAt: now,
+            }).run();
+        }
+        const config = db
+            .select()
+            .from(schema.sharingConfig)
+            .where(eq(schema.sharingConfig.tenantId, tenantId))
+            .get();
+        return c.json({
+            threshold: config?.volumeAlertThreshold ?? 100,
+            rateLimitPerHour: config?.rateLimitPerHour ?? 50,
+            enabled: config?.enabled ?? false,
+        });
+    });
+    return app;
+}
+//# sourceMappingURL=audit.js.map

package/dist/routes/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAC;AAGjD,MAAM,UAAU,WAAW,CAAC,EAAY;IACtC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAgC,CAAC;IAErD,SAAS,WAAW,CAAC,CAA4D;QAC/E,OAAO,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,QAAQ,IAAI,SAAS,CAAC;IAChD,CAAC;IAED,sDAAsD;IAEtD,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,8FAA8F;QAC9F,IAAI,IAAI,GAAG,EAAE;aACV,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACpD,GAAG,EAAE,CAAC;QAET,gBAAgB;QAChB,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,6CAA6C;YAC7C,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,CAAC;QACnD,CAAC;QAED,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAwB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpD,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAA2C;YACxD,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;YACjC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,SAAS;YACnD,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,SAAS;YACrC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS;YACpF,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;YACnC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;YAC5D,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,SAAS;YACzC,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,QAAQ;YACtC,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;QAEJ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,sDAAsD;IAEtD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,gCAAgC;QAElE,IAAI,IAAI,GAAG,EAAE;aACV,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;aAC5B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aACpD,GAAG,EAAE,CAAC;QAET,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB;YACtC,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI;YAC/E,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI;YACvD,YAAY,EAAE,CAAC,CAAC,YAAY;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;QAEJ,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,qBAAqB,EAAE,sCAAsC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QACjI,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,sDAAsD;IAEtD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,EAAE;aACd,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAClD,GAAG,EAAE,CAAC;QAET,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,MAAM,EAAE,oBAAoB,IAAI,GAAG;YAC9C,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,EAAE;YAChD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,KAAK;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IAEtD,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAA6B,CAAC;QAClC,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,GAAG,CAAC,CAAC;YACnF,OAAO,CAAC,oBAAoB,GAAG,GAAG,CAAC;QACrC,CAAC;QACD,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1F,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;QACjC,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE;aAChB,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAClD,GAAG,EAAE,CAAC;QAET,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,QAAQ,EAAE,CAAC;YACb,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC;iBAC5B,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACnC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;iBAClD,GAAG,EAAE,CAAC;QACX,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC;gBACrC,QAAQ;gBACR,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,KAAK;gBACzB,YAAY,EAAE,IAAI;gBAClB,sBAAsB,EAAE,IAAI;gBAC5B,UAAU,EAAE,IAAI;gBAChB,gBAAgB,EAAG,OAAO,CAAC,gBAA2B,IAAI,EAAE;gBAC5D,oBAAoB,EAAG,OAAO,CAAC,oBAA+B,IAAI,GAAG;gBACrE,SAAS,EAAE,GAAG;aACf,CAAC,CAAC,GAAG,EAAE,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAG,EAAE;aACd,MAAM,EAAE;aACR,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;aAClD,GAAG,EAAE,CAAC;QAET,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,SAAS,EAAE,MAAM,EAAE,oBAAoB,IAAI,GAAG;YAC9C,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,EAAE;YAChD,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,KAAK;SAClC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/routes/capabilities.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Capability Registration REST API (Story 5.2)
+ *
+ * PUT    /api/agents/:id/capabilities              — register a new capability
+ * GET    /api/agents/:id/capabilities              — list agent's capabilities
+ * DELETE /api/agents/:id/capabilities/:capabilityId — remove a capability
+ */
+import { Hono } from 'hono';
+import type { IEventStore } from '@agentlensai/core';
+import type { AuthVariables } from '../middleware/auth.js';
+import type { SqliteDb } from '../db/index.js';
+export declare function capabilityRoutes(store: IEventStore, db: SqliteDb): Hono<{
+    Variables: AuthVariables;
+}, import("hono/types").BlankSchema, "/">;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/routes/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/routes/capabilities.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ;eAC7B,aAAa;0CAmFhD"}