@claw-network/node 0.2.0

package/dist/api/response.js

@@ -0,0 +1,185 @@
+/**
+ * Standardized HTTP response helpers.
+ *
+ * All 2xx responses use the envelope: { data, meta?, links? }
+ * All errors use RFC 7807 Problem Details: { type, title, status, detail, instance }
+ */
+// ─── Constants ──────────────────────────────────────────────────
+const ERROR_BASE_URL = 'https://clawnet.dev/errors';
+export const ErrorTypes = {
+    VALIDATION: `${ERROR_BASE_URL}/validation-error`,
+    UNAUTHORIZED: `${ERROR_BASE_URL}/unauthorized`,
+    FORBIDDEN: `${ERROR_BASE_URL}/forbidden`,
+    TOO_MANY_REQUESTS: `${ERROR_BASE_URL}/too-many-requests`,
+    NOT_FOUND: `${ERROR_BASE_URL}/not-found`,
+    CONFLICT: `${ERROR_BASE_URL}/conflict`,
+    UNPROCESSABLE: `${ERROR_BASE_URL}/unprocessable-entity`,
+    INTERNAL: `${ERROR_BASE_URL}/internal-error`,
+    METHOD_NOT_ALLOWED: `${ERROR_BASE_URL}/method-not-allowed`,
+};
+// ─── Response Helpers ───────────────────────────────────────────
+function send(res, status, body) {
+    const json = JSON.stringify(body);
+    res.writeHead(status, {
+        'Content-Type': 'application/json; charset=utf-8',
+        'Content-Length': Buffer.byteLength(json),
+    });
+    res.end(json);
+}
+/** 200 OK — single resource */
+export function ok(res, data, links) {
+    const body = { data };
+    if (links)
+        body.links = links;
+    send(res, 200, body);
+}
+/** 201 Created — resource just created */
+export function created(res, data, links) {
+    const body = { data };
+    if (links)
+        body.links = links;
+    if (links?.self) {
+        res.setHeader('Location', links.self);
+    }
+    send(res, 201, body);
+}
+/** 204 No Content — successful action with no body (e.g. DELETE) */
+export function noContent(res) {
+    res.writeHead(204);
+    res.end();
+}
+/** 200 OK — paginated collection */
+export function paginated(res, data, opts) {
+    const { page, perPage, total, basePath, query = {} } = opts;
+    const totalPages = Math.max(1, Math.ceil(total / perPage));
+    const buildUrl = (p) => {
+        const params = new URLSearchParams({ ...query, page: String(p), per_page: String(perPage) });
+        return `${basePath}?${params.toString()}`;
+    };
+    const body = {
+        data,
+        meta: {
+            pagination: { page, perPage, total, totalPages },
+        },
+        links: {
+            self: buildUrl(page),
+            first: buildUrl(1),
+            last: buildUrl(totalPages),
+            prev: page > 1 ? buildUrl(page - 1) : null,
+            next: page < totalPages ? buildUrl(page + 1) : null,
+        },
+    };
+    send(res, 200, body);
+}
+// ─── Error Helpers (RFC 7807) ───────────────────────────────────
+export function problem(res, p) {
+    send(res, p.status, {
+        type: p.type,
+        title: p.title,
+        status: p.status,
+        detail: p.detail,
+        instance: p.instance,
+    });
+}
+export function badRequest(res, detail, instance) {
+    problem(res, {
+        type: ErrorTypes.VALIDATION,
+        title: 'Bad Request',
+        status: 400,
+        detail,
+        instance,
+    });
+}
+export function unauthorized(res, detail, instance) {
+    problem(res, {
+        type: ErrorTypes.UNAUTHORIZED,
+        title: 'Unauthorized',
+        status: 401,
+        detail: detail ?? 'Authentication required',
+        instance,
+    });
+}
+export function forbidden(res, detail, instance) {
+    problem(res, {
+        type: ErrorTypes.FORBIDDEN,
+        title: 'Forbidden',
+        status: 403,
+        detail: detail ?? 'Insufficient permissions',
+        instance,
+    });
+}
+export function tooManyRequests(res, detail, instance, retryAfterSeconds) {
+    if (typeof retryAfterSeconds === 'number' &&
+        Number.isFinite(retryAfterSeconds) &&
+        retryAfterSeconds > 0) {
+        res.setHeader('Retry-After', String(Math.ceil(retryAfterSeconds)));
+    }
+    problem(res, {
+        type: ErrorTypes.TOO_MANY_REQUESTS,
+        title: 'Too Many Requests',
+        status: 429,
+        detail: detail ?? 'Rate limit exceeded',
+        instance,
+    });
+}
+export function notFound(res, detail, instance) {
+    problem(res, {
+        type: ErrorTypes.NOT_FOUND,
+        title: 'Not Found',
+        status: 404,
+        detail: detail ?? 'Resource not found',
+        instance,
+    });
+}
+export function conflict(res, detail, instance) {
+    problem(res, {
+        type: ErrorTypes.CONFLICT,
+        title: 'Conflict',
+        status: 409,
+        detail,
+        instance,
+    });
+}
+export function unprocessable(res, detail, instance) {
+    problem(res, {
+        type: ErrorTypes.UNPROCESSABLE,
+        title: 'Unprocessable Entity',
+        status: 422,
+        detail,
+        instance,
+    });
+}
+export function methodNotAllowed(res, allowed, instance) {
+    res.setHeader('Allow', allowed.join(', '));
+    problem(res, {
+        type: ErrorTypes.METHOD_NOT_ALLOWED,
+        title: 'Method Not Allowed',
+        status: 405,
+        detail: `Allowed methods: ${allowed.join(', ')}`,
+        instance,
+    });
+}
+export function internalError(res, detail, instance) {
+    problem(res, {
+        type: ErrorTypes.INTERNAL,
+        title: 'Internal Server Error',
+        status: 500,
+        detail: detail ?? 'An unexpected error occurred',
+        instance,
+    });
+}
+export function parsePagination(searchParams) {
+    const page = Math.max(1, parseInt(searchParams.get('page') ?? '1', 10) || 1);
+    const perPage = Math.min(100, Math.max(1, parseInt(searchParams.get('per_page') ?? '20', 10) || 20));
+    return { page, perPage, offset: (page - 1) * perPage };
+}
+export function parseSort(searchParams) {
+    const sort = searchParams.get('sort');
+    if (!sort)
+        return undefined;
+    if (sort.startsWith('-')) {
+        return { field: sort.slice(1), order: 'desc' };
+    }
+    return { field: sort, order: 'asc' };
+}
+//# sourceMappingURL=response.js.map

package/dist/api/response.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"response.js","sourceRoot":"","sources":["../../src/api/response.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyCH,mEAAmE;AAEnE,MAAM,cAAc,GAAG,4BAA4B,CAAC;AAEpD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,UAAU,EAAE,GAAG,cAAc,mBAAmB;IAChD,YAAY,EAAE,GAAG,cAAc,eAAe;IAC9C,SAAS,EAAE,GAAG,cAAc,YAAY;IACxC,iBAAiB,EAAE,GAAG,cAAc,oBAAoB;IACxD,SAAS,EAAE,GAAG,cAAc,YAAY;IACxC,QAAQ,EAAE,GAAG,cAAc,WAAW;IACtC,aAAa,EAAE,GAAG,cAAc,uBAAuB;IACvD,QAAQ,EAAE,GAAG,cAAc,iBAAiB;IAC5C,kBAAkB,EAAE,GAAG,cAAc,qBAAqB;CAClD,CAAC;AAEX,mEAAmE;AAEnE,SAAS,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;IAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE;QACpB,cAAc,EAAE,iCAAiC;QACjD,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;KAC1C,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,EAAE,CAAI,GAAmB,EAAE,IAAO,EAAE,KAAa;IAC/D,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,OAAO,CAAI,GAAmB,EAAE,IAAO,EAAE,KAAa;IACpE,MAAM,IAAI,GAAsB,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9B,IAAI,KAAK,EAAE,IAAI,EAAE,CAAC;QAChB,GAAG,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,GAAmB;IAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACnB,GAAG,CAAC,GAAG,EAAE,CAAC;AACZ,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,SAAS,CACvB,GAAmB,EACnB,IAAS,EACT,IAMC;IAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7F,OAAO,GAAG,QAAQ,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IAC5C,CAAC,CAAC;IAEF,MAAM,IAAI,GAA0B;QAClC,IAAI;QACJ,IAAI,EAAE;YACJ,UAAU,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE;SACjD;QACD,KAAK,EAAE;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;YACpB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;YAClB,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAC;YAC1B,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;YAC1C,IAAI,EAAE,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;SACpD;KACF,CAAC;IACF,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AACvB,CAAC;AAED,mEAAmE;AAEnE,MAAM,UAAU,OAAO,CAAC,GAAmB,EAAE,CAAgB;IAC3D,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,QAAQ,EAAE,CAAC,CAAC,QAAQ;KACrB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAmB,EAAE,MAAc,EAAE,QAAiB;IAC/E,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,UAAU;QAC3B,KAAK,EAAE,aAAa;QACpB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAmB,EAAE,MAAe,EAAE,QAAiB;IAClF,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,YAAY;QAC7B,KAAK,EAAE,cAAc;QACrB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,MAAM,IAAI,yBAAyB;QAC3C,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAmB,EAAE,MAAe,EAAE,QAAiB;IAC/E,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,SAAS;QAC1B,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,MAAM,IAAI,0BAA0B;QAC5C,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,GAAmB,EACnB,MAAe,EACf,QAAiB,EACjB,iBAA0B;IAE1B,IACE,OAAO,iBAAiB,KAAK,QAAQ;QACrC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;QAClC,iBAAiB,GAAG,CAAC,EACrB,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,iBAAiB;QAClC,KAAK,EAAE,mBAAmB;QAC1B,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,MAAM,IAAI,qBAAqB;QACvC,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAe,EAAE,QAAiB;IAC9E,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,SAAS;QAC1B,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,MAAM,IAAI,oBAAoB;QACtC,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAmB,EAAE,MAAc,EAAE,QAAiB;IAC7E,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,MAAc,EAAE,QAAiB;IAClF,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,aAAa;QAC9B,KAAK,EAAE,sBAAsB;QAC7B,MAAM,EAAE,GAAG;QACX,MAAM;QACN,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAmB,EAAE,OAAiB,EAAE,QAAiB;IACxF,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,kBAAkB;QACnC,KAAK,EAAE,oBAAoB;QAC3B,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,oBAAoB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAChD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,MAAe,EAAE,QAAiB;IACnF,OAAO,CAAC,GAAG,EAAE;QACX,IAAI,EAAE,UAAU,CAAC,QAAQ;QACzB,KAAK,EAAE,uBAAuB;QAC9B,MAAM,EAAE,GAAG;QACX,MAAM,EAAE,MAAM,IAAI,8BAA8B;QAChD,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAUD,MAAM,UAAU,eAAe,CAAC,YAA6B;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,GAAG,EACH,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CACtE,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,YAA6B;IAE7B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACvC,CAAC"}

package/dist/api/router.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Lightweight path-matching router for node:http.
+ *
+ * Supports:
+ * - Method + path pattern matching: GET /api/v1/contracts/:id
+ * - Named path params: { id: "abc", idx: "0" }
+ * - Middleware chain (CORS, body parsing)
+ * - 404 / 405 fallback
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+export type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE' | 'OPTIONS' | 'HEAD';
+export interface RouteContext {
+    /** Parsed URL */
+    url: URL;
+    /** Matched path parameters (e.g. { id: "abc" }) */
+    params: Record<string, string>;
+    /** Parsed query parameters */
+    query: URLSearchParams;
+    /** Parsed JSON body (only for methods with body) */
+    body: unknown;
+}
+export type RouteHandler = (req: IncomingMessage, res: ServerResponse, ctx: RouteContext) => Promise<void> | void;
+export type Middleware = (req: IncomingMessage, res: ServerResponse, next: () => Promise<void>) => Promise<void> | void;
+export declare class Router {
+    private routes;
+    private middlewares;
+    /** Register global middleware. */
+    use(mw: Middleware): this;
+    /** Register a route. Pattern supports :param segments. */
+    on(method: HttpMethod, pattern: string, handler: RouteHandler): this;
+    get(pattern: string, handler: RouteHandler): this;
+    post(pattern: string, handler: RouteHandler): this;
+    put(pattern: string, handler: RouteHandler): this;
+    patch(pattern: string, handler: RouteHandler): this;
+    delete(pattern: string, handler: RouteHandler): this;
+    /** Mount all routes from another router under a prefix. */
+    mount(prefix: string, child: Router): this;
+    /** Handle an incoming request. Returns true if matched. */
+    handle(req: IncomingMessage, res: ServerResponse): Promise<boolean>;
+    private matchRoute;
+    private findMatchingMethods;
+    private parseBody;
+    private runMiddlewareChain;
+}
+//# sourceMappingURL=router.d.ts.map

package/dist/api/router.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAIjE,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAE1F,MAAM,WAAW,YAAY;IAC3B,iBAAiB;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,8BAA8B;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,oDAAoD;IACpD,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,MAAM,YAAY,GAAG,CACzB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,GAAG,EAAE,YAAY,KACd,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAE1B,MAAM,MAAM,UAAU,GAAG,CACvB,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KACtB,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AAa1B,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAAoB;IAClC,OAAO,CAAC,WAAW,CAAoB;IAEvC,kCAAkC;IAClC,GAAG,CAAC,EAAE,EAAE,UAAU,GAAG,IAAI;IAKzB,0DAA0D;IAC1D,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI;IAYpE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI;IAIjD,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI;IAIlD,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI;IAIjD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI;IAInD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,IAAI;IAIpD,2DAA2D;IAC3D,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAa1C,2DAA2D;IACrD,MAAM,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAsCzE,OAAO,CAAC,UAAU;IA6BlB,OAAO,CAAC,mBAAmB;YAiBb,SAAS;YAqCT,kBAAkB;CAmBjC"}

package/dist/api/router.js

@@ -0,0 +1,183 @@
+/**
+ * Lightweight path-matching router for node:http.
+ *
+ * Supports:
+ * - Method + path pattern matching: GET /api/v1/contracts/:id
+ * - Named path params: { id: "abc", idx: "0" }
+ * - Middleware chain (CORS, body parsing)
+ * - 404 / 405 fallback
+ */
+// ─── Router ─────────────────────────────────────────────────────
+const MAX_BODY_BYTES = 1_000_000;
+export class Router {
+    routes = [];
+    middlewares = [];
+    /** Register global middleware. */
+    use(mw) {
+        this.middlewares.push(mw);
+        return this;
+    }
+    /** Register a route. Pattern supports :param segments. */
+    on(method, pattern, handler) {
+        const segments = pattern.split('/').filter(Boolean);
+        const paramNames = [];
+        for (const seg of segments) {
+            if (seg.startsWith(':')) {
+                paramNames.push(seg.slice(1));
+            }
+        }
+        this.routes.push({ method, segments, paramNames, handler });
+        return this;
+    }
+    get(pattern, handler) {
+        return this.on('GET', pattern, handler);
+    }
+    post(pattern, handler) {
+        return this.on('POST', pattern, handler);
+    }
+    put(pattern, handler) {
+        return this.on('PUT', pattern, handler);
+    }
+    patch(pattern, handler) {
+        return this.on('PATCH', pattern, handler);
+    }
+    delete(pattern, handler) {
+        return this.on('DELETE', pattern, handler);
+    }
+    /** Mount all routes from another router under a prefix. */
+    mount(prefix, child) {
+        const prefixSegments = prefix.split('/').filter(Boolean);
+        for (const route of child.routes) {
+            this.routes.push({
+                method: route.method,
+                segments: [...prefixSegments, ...route.segments],
+                paramNames: route.paramNames,
+                handler: route.handler,
+            });
+        }
+        return this;
+    }
+    /** Handle an incoming request. Returns true if matched. */
+    async handle(req, res) {
+        const urlStr = req.url ?? '/';
+        const url = new URL(urlStr, `http://${req.headers.host ?? 'localhost'}`);
+        const method = (req.method ?? 'GET').toUpperCase();
+        const reqSegments = url.pathname.split('/').filter(Boolean);
+        // Find matching route
+        const match = this.matchRoute(method, reqSegments);
+        if (!match) {
+            // Check if path matches any method (→ 405) or nothing (→ 404)
+            const pathMatches = this.findMatchingMethods(reqSegments);
+            if (pathMatches.length > 0) {
+                // 405 Method Not Allowed
+                const { methodNotAllowed } = await import('./response.js');
+                methodNotAllowed(res, pathMatches, url.pathname);
+                return true;
+            }
+            return false; // no match at all
+        }
+        // Build context
+        const body = await this.parseBody(req);
+        const ctx = {
+            url,
+            params: match.params,
+            query: url.searchParams,
+            body,
+        };
+        // Run middleware chain then handler
+        await this.runMiddlewareChain(req, res, () => match.handler(req, res, ctx));
+        return true;
+    }
+    // ─── Internal ───────────────────────────────────────────────
+    matchRoute(method, reqSegments) {
+        for (const route of this.routes) {
+            if (route.method !== method)
+                continue;
+            if (route.segments.length !== reqSegments.length)
+                continue;
+            const params = {};
+            let matched = true;
+            let paramIdx = 0;
+            for (let i = 0; i < route.segments.length; i++) {
+                const seg = route.segments[i];
+                if (seg.startsWith(':')) {
+                    params[route.paramNames[paramIdx++]] = decodeURIComponent(reqSegments[i]);
+                }
+                else if (seg !== reqSegments[i]) {
+                    matched = false;
+                    break;
+                }
+            }
+            if (matched) {
+                return { handler: route.handler, params };
+            }
+        }
+        return null;
+    }
+    findMatchingMethods(reqSegments) {
+        const methods = new Set();
+        for (const route of this.routes) {
+            if (route.segments.length !== reqSegments.length)
+                continue;
+            let matched = true;
+            for (let i = 0; i < route.segments.length; i++) {
+                const seg = route.segments[i];
+                if (!seg.startsWith(':') && seg !== reqSegments[i]) {
+                    matched = false;
+                    break;
+                }
+            }
+            if (matched)
+                methods.add(route.method);
+        }
+        return [...methods];
+    }
+    async parseBody(req) {
+        const method = req.method ?? 'GET';
+        if (method === 'GET' || method === 'HEAD' || method === 'OPTIONS' || method === 'DELETE') {
+            return undefined;
+        }
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            let totalBytes = 0;
+            req.on('data', (chunk) => {
+                totalBytes += chunk.length;
+                if (totalBytes > MAX_BODY_BYTES) {
+                    req.destroy();
+                    reject(new Error('Request body too large'));
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            req.on('end', () => {
+                if (chunks.length === 0) {
+                    resolve(undefined);
+                    return;
+                }
+                try {
+                    const text = Buffer.concat(chunks).toString('utf-8');
+                    resolve(JSON.parse(text));
+                }
+                catch {
+                    resolve(undefined);
+                }
+            });
+            req.on('error', reject);
+        });
+    }
+    async runMiddlewareChain(req, res, final) {
+        let idx = 0;
+        const mws = this.middlewares;
+        const next = async () => {
+            if (idx < mws.length) {
+                const mw = mws[idx++];
+                await mw(req, res, next);
+            }
+            else {
+                await final();
+            }
+        };
+        await next();
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/api/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../src/api/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAsCH,mEAAmE;AAEnE,MAAM,cAAc,GAAG,SAAS,CAAC;AAEjC,MAAM,OAAO,MAAM;IACT,MAAM,GAAiB,EAAE,CAAC;IAC1B,WAAW,GAAiB,EAAE,CAAC;IAEvC,kCAAkC;IAClC,GAAG,CAAC,EAAc;QAChB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0DAA0D;IAC1D,EAAE,CAAC,MAAkB,EAAE,OAAe,EAAE,OAAqB;QAC3D,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,UAAU,GAAa,EAAE,CAAC;QAChC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,OAAqB;QACxC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,CAAC,OAAe,EAAE,OAAqB;QACzC,OAAO,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,GAAG,CAAC,OAAe,EAAE,OAAqB;QACxC,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,OAAe,EAAE,OAAqB;QAC1C,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,CAAC,OAAe,EAAE,OAAqB;QAC3C,OAAO,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,MAAc,EAAE,KAAa;QACjC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,CAAC,GAAG,cAAc,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;gBAChD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QACpD,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;QACzE,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAgB,CAAC;QACjE,MAAM,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAE5D,sBAAsB;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAEnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,8DAA8D;YAC9D,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC;YAC1D,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,yBAAyB;gBACzB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;gBAC3D,gBAAgB,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,kBAAkB;QAClC,CAAC;QAED,gBAAgB;QAChB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,GAAG,GAAiB;YACxB,GAAG;YACH,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,KAAK,EAAE,GAAG,CAAC,YAAY;YACvB,IAAI;SACL,CAAC;QAEF,oCAAoC;QACpC,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QAE5E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,+DAA+D;IAEvD,UAAU,CAChB,MAAkB,EAClB,WAAqB;QAErB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;gBAAE,SAAS;YACtC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;gBAAE,SAAS;YAE3D,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,IAAI,QAAQ,GAAG,CAAC,CAAC;YAEjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,CAAC;qBAAM,IAAI,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClC,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM;gBACR,CAAC;YACH,CAAC;YAED,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,mBAAmB,CAAC,WAAqB;QAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;gBAAE,SAAS;YAC3D,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM;gBACR,CAAC;YACH,CAAC;YACD,IAAI,OAAO;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,GAAoB;QAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;QACnC,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;YAEnB,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;gBAC3B,IAAI,UAAU,GAAG,cAAc,EAAE,CAAC;oBAChC,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC;oBAC5C,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,OAAO,CAAC,SAAS,CAAC,CAAC;oBACnB,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;oBACrD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC5B,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,SAAS,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC,CAAC,CAAC;YAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,KAAiC;QAEjC,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAE7B,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YACrC,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBACtB,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,EAAE,CAAC;YAChB,CAAC;QACH,CAAC,CAAC;QAEF,MAAM,IAAI,EAAE,CAAC;IACf,CAAC;CACF"}

package/dist/api/routes/admin.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Admin routes — /api/v1/admin
+ *
+ * API key management endpoints. These routes are only accessible
+ * from localhost (127.0.0.1 / ::1) for security — they never pass
+ * through the Caddy reverse proxy.
+ */
+import { Router } from '../router.js';
+import type { RuntimeContext } from '../types.js';
+export declare function adminRoutes(ctx: RuntimeContext): Router;
+//# sourceMappingURL=admin.d.ts.map

package/dist/api/routes/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/api/routes/admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAItC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAgClD,wBAAgB,WAAW,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CA4GvD"}

package/dist/api/routes/admin.js

@@ -0,0 +1,124 @@
+/**
+ * Admin routes — /api/v1/admin
+ *
+ * API key management endpoints. These routes are only accessible
+ * from localhost (127.0.0.1 / ::1) for security — they never pass
+ * through the Caddy reverse proxy.
+ */
+import { Router } from '../router.js';
+import { ok, badRequest, notFound, forbidden } from '../response.js';
+import { validate } from '../schemas/common.js';
+import { z } from 'zod';
+// ---------------------------------------------------------------------------
+// Schemas
+// ---------------------------------------------------------------------------
+const CreateKeySchema = z.object({
+    label: z.string().min(1).max(128),
+});
+const _RevokeKeySchema = z.object({
+    id: z.number().int().positive(),
+});
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function isLocalhost(req) {
+    const remoteAddress = req.socket.remoteAddress ?? '';
+    return (remoteAddress === '127.0.0.1' ||
+        remoteAddress === '::1' ||
+        remoteAddress === '::ffff:127.0.0.1');
+}
+// ---------------------------------------------------------------------------
+// Routes
+// ---------------------------------------------------------------------------
+export function adminRoutes(ctx) {
+    const r = new Router();
+    // ── POST /api-keys — create new API key ───────────────────────
+    r.post('/api-keys', async (req, res, route) => {
+        if (!isLocalhost(req)) {
+            forbidden(res, 'Admin API is only accessible from localhost', route.url.pathname);
+            return;
+        }
+        const store = ctx.apiKeyStore;
+        if (!store) {
+            badRequest(res, 'API key management not enabled', route.url.pathname);
+            return;
+        }
+        const v = validate(CreateKeySchema, route.body);
+        if (!v.success) {
+            badRequest(res, v.error, route.url.pathname);
+            return;
+        }
+        const record = store.create(v.data.label);
+        // Return full key only on creation (not visible again)
+        ok(res, {
+            id: record.id,
+            key: record.key,
+            label: record.label,
+            status: record.status,
+            createdAt: record.createdAt,
+        }, { self: '/api/v1/admin/api-keys' });
+    });
+    // ── GET /api-keys — list all keys (truncated) ────────────────
+    r.get('/api-keys', async (req, res, route) => {
+        if (!isLocalhost(req)) {
+            forbidden(res, 'Admin API is only accessible from localhost', route.url.pathname);
+            return;
+        }
+        const store = ctx.apiKeyStore;
+        if (!store) {
+            badRequest(res, 'API key management not enabled', route.url.pathname);
+            return;
+        }
+        const includeRevoked = route.query.get('includeRevoked') === 'true';
+        const keys = store.list(includeRevoked);
+        ok(res, keys, { self: '/api/v1/admin/api-keys' });
+    });
+    // ── POST /api-keys/:id/revoke — revoke a key ─────────────────
+    r.post('/api-keys/:id/revoke', async (req, res, route) => {
+        if (!isLocalhost(req)) {
+            forbidden(res, 'Admin API is only accessible from localhost', route.url.pathname);
+            return;
+        }
+        const store = ctx.apiKeyStore;
+        if (!store) {
+            badRequest(res, 'API key management not enabled', route.url.pathname);
+            return;
+        }
+        const id = Number(route.params.id);
+        if (Number.isNaN(id) || id <= 0) {
+            badRequest(res, 'Invalid key ID', route.url.pathname);
+            return;
+        }
+        const revoked = store.revoke(id);
+        if (!revoked) {
+            notFound(res, `Key #${id} not found or already revoked`);
+            return;
+        }
+        ok(res, { id, status: 'revoked' }, { self: `/api/v1/admin/api-keys/${id}` });
+    });
+    // ── DELETE /api-keys/:id — permanently delete a key ───────────
+    r.delete('/api-keys/:id', async (req, res, route) => {
+        if (!isLocalhost(req)) {
+            forbidden(res, 'Admin API is only accessible from localhost', route.url.pathname);
+            return;
+        }
+        const store = ctx.apiKeyStore;
+        if (!store) {
+            badRequest(res, 'API key management not enabled', route.url.pathname);
+            return;
+        }
+        const id = Number(route.params.id);
+        if (Number.isNaN(id) || id <= 0) {
+            badRequest(res, 'Invalid key ID', route.url.pathname);
+            return;
+        }
+        const deleted = store.delete(id);
+        if (!deleted) {
+            notFound(res, `Key #${id} not found`);
+            return;
+        }
+        ok(res, { id, status: 'deleted' }, { self: `/api/v1/admin/api-keys/${id}` });
+    });
+    return r;
+}
+//# sourceMappingURL=admin.js.map

package/dist/api/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../../src/api/routes/admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,WAAW,CAAC,GAAoB;IACvC,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC;IACrD,OAAO,CACL,aAAa,KAAK,WAAW;QAC7B,aAAa,KAAK,KAAK;QACvB,aAAa,KAAK,kBAAkB,CACrC,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,SAAS;AACT,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CAAC,GAAmB;IAC7C,MAAM,CAAC,GAAG,IAAI,MAAM,EAAE,CAAC;IAEvB,iEAAiE;IACjE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,6CAA6C,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;YACf,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7C,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,uDAAuD;QACvD,EAAE,CAAC,GAAG,EAAE;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;SAC5B,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,6CAA6C,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,MAAM,CAAC;QACpE,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxC,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,gEAAgE;IAChE,CAAC,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACvD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,6CAA6C,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,+BAA+B,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAClD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,SAAS,CAAC,GAAG,EAAE,6CAA6C,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,UAAU,CAAC,GAAG,EAAE,gCAAgC,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,EAAE,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/api/routes/contracts.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Service contract routes — /api/v1/contracts
+ */
+import { Router } from '../router.js';
+import type { RuntimeContext } from '../types.js';
+export declare function contractRoutes(ctx: RuntimeContext): Router;
+//# sourceMappingURL=contracts.d.ts.map

package/dist/api/routes/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../../../src/api/routes/contracts.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAsBtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AA4BlD,wBAAgB,cAAc,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,CAusB1D"}