@cogitator-ai/hono 0.8.6 → 0.10.0

package/README.md

@@ -44,21 +44,25 @@ Creates a Hono sub-application with all Cogitator endpoints.
 
 **Options:**
 
-| Option               | Type                          | Description                                                                                                                            |
-| -------------------- | ----------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| `cogitator`          | `Cogitator`                   | **Required.** Cogitator runtime instance                                                                                               |
-| `agents`             | `Record<string, Agent>`       | Named agents to expose                                                                                                                 |
-| `workflows`          | `Record<string, Workflow>`    | Named workflows                                                                                                                        |
-| `swarms`             | `Record<string, SwarmConfig>` | Named swarms                                                                                                                           |
-| `auth`               | `AuthFunction`                | `(c) => AuthContext \| undefined` (sync or async), receives the Hono Context, throw to answer `401 UNAUTHORIZED`                       |
-| `enableSwagger`      | `boolean`                     | Serve `/openapi.json` and Swagger UI at `/docs`                                                                                        |
-| `swagger`            | `SwaggerConfig`               | Swagger configuration                                                                                                                  |
-| `enableWebSocket`    | `boolean`                     | Enable the WebSocket endpoint                                                                                                          |
-| `websocket`          | `WebSocketConfig`             | `{ path?, maxPayloadSize?, upgradeWebSocket? }` (see below)                                                                            |
-| `bodyLimit`          | `number`                      | Max request body size in bytes (default 1 MiB)                                                                                         |
-| `sseHeartbeatMs`     | `number`                      | How often SSE streams write a `: keep-alive` comment while a run is silent (default `5000`, `0` turns it off)                          |
-| `acceptContext`      | `boolean \| string[]`         | Keys of a run `context` clients may send: none by default, a list, or `true` for any (the model reads it as data from the application) |
-| `threadMessageRoles` | `ThreadMessageRole[]`         | Roles `POST /threads/:id/messages` accepts (default `user` and `assistant`)                                                            |
+| Option               | Type                                              | Description                                                                                                                                                      |
+| -------------------- | ------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `cogitator`          | `Cogitator`                                       | **Required.** Cogitator runtime instance                                                                                                                         |
+| `agents`             | `Record<string, Agent>`                           | Named agents to expose                                                                                                                                           |
+| `workflows`          | `Record<string, Workflow>`                        | Named workflows                                                                                                                                                  |
+| `swarms`             | `Record<string, SwarmConfig>`                     | Named swarms                                                                                                                                                     |
+| `auth`               | `AuthFunction`                                    | `(c) => AuthContext \| undefined` (sync or async), receives the Hono Context, throw to answer `401 UNAUTHORIZED`                                                 |
+| `enableSwagger`      | `boolean`                                         | Serve `/openapi.json` and Swagger UI at `/docs`                                                                                                                  |
+| `swagger`            | `SwaggerConfig`                                   | Swagger configuration                                                                                                                                            |
+| `enableWebSocket`    | `boolean`                                         | Enable the WebSocket endpoint                                                                                                                                    |
+| `websocket`          | `WebSocketConfig`                                 | `{ path?, maxPayloadSize?, upgradeWebSocket? }` (see below)                                                                                                      |
+| `bodyLimit`          | `number`                                          | Max request body size in bytes (default 1 MiB)                                                                                                                   |
+| `sseHeartbeatMs`     | `number`                                          | How often SSE streams write a `: keep-alive` comment while a run is silent (default `5000`, `0` turns it off)                                                    |
+| `acceptContext`      | `boolean \| string[]`                             | Keys of a run `context` clients may send: none by default, a list, or `true` for any (the model reads it as data from the application)                           |
+| `threadMessageRoles` | `ThreadMessageRole[]`                             | Roles `POST /threads/:id/messages` accepts (default `user` and `assistant`)                                                                                      |
+| `limits`             | `RunLimits`                                       | `{ swarmTimeout?, workflowMaxIterations?, workflowMaxConcurrency? }`: caps on what a request may ask a swarm or workflow run for (see [Run limits](#run-limits)) |
+| `anonymous`          | `'allow' \| 'deny'`                               | Whether callers without a `userId` may use the API (default `'allow'`), `'deny'` answers `401 UNAUTHORIZED`                                                      |
+| `authorizeThread`    | `(auth, threadId) => boolean \| Promise<boolean>` | Decides whether a caller may touch a thread, on top of the owner check, `false` answers `403 THREAD_FORBIDDEN`                                                   |
+| `deps`               | `(c) => unknown \| Promise<unknown>`              | Builds the `deps` agent runs pass to their tools, from the Hono Context (see [Run deps](#run-deps))                                                              |
 
 ## Request Handling
 
@@ -73,7 +77,8 @@ Creates a Hono sub-application with all Cogitator endpoints.
 - Swarm routes close each swarm they build once its run ends, so a distributed swarm leaves no Redis connections behind and its state expires. `GET /swarms` lists every agent, the router and pipeline stages included.
 - Thread routes use `cogitator.getMemory()`, which connects the configured memory adapter on first use, so threads can be read on a fresh server before any agent has run. Only a `Cogitator` without `memory` configured answers `503 UNAVAILABLE`.
 - Bodies above `bodyLimit` return `413 PAYLOAD_TOO_LARGE`.
-- `CogitatorError`s are returned with their HTTP status and code (for example `429 LLM_RATE_LIMITED`). Any other error is logged and returned as `500 Internal server error` (code `INTERNAL_ERROR`) without internal details; the same masking applies to SSE `error` events, `node_error`/`agent_error` stream events and WebSocket errors. A workflow that finishes with an error is answered like a thrown error (its `CogitatorError` status, otherwise `500`), never as a successful result. Missing optional packages (`@cogitator-ai/workflows`, `@cogitator-ai/swarms`) answer `501 UNIMPLEMENTED`.
+- `GET /threads/:id` answers the whole thread, or one page of it with `?limit=50`: the newest 50 messages (oldest first within the page) and a `nextCursor`. Pass it back as `?limit=50&cursor=<nextCursor>` for the 50 before them, until an answer has no `nextCursor`. Messages written in the same millisecond are neither skipped nor repeated across pages. A `limit` outside 1 to 1000 or a cursor the server did not give answers `400 INVALID_INPUT`.
+- Every error answer has the same envelope, `{ error: { message, code } }`, the one Express, Fastify, Koa and Next use. A `CogitatorError` is answered with its HTTP status and code (for example `429 LLM_RATE_LIMITED`), plus a `Retry-After` header in whole seconds when the provider said when to retry. A swarm that ran out of time answers `504 RUN_TIMEOUT`. Any other error is logged and answered as `500 Internal server error` (code `INTERNAL_ERROR`) without internal details, and the same masking applies to SSE `error` events, `node_error` and `agent_error` stream events and WebSocket errors. A workflow that finishes with an error is answered like a thrown error (its `CogitatorError` status, otherwise `500`), never as a successful result. Missing optional packages (`@cogitator-ai/workflows`, `@cogitator-ai/swarms`) answer `501 UNIMPLEMENTED`.
 - When the client disconnects, the running agent, workflow or swarm is aborted, for both JSON and SSE endpoints.
 - `GET /agents` returns each agent's `description` and never exposes its `instructions`.
 - `GET /tools` returns tool parameters as JSON Schema.
@@ -82,20 +87,21 @@ Creates a Hono sub-application with all Cogitator endpoints.
 
 ### Agents
 
-| Method | Path                   | Description               |
-| ------ | ---------------------- | ------------------------- |
-| `GET`  | `/agents`              | List all agents           |
-| `POST` | `/agents/:name/run`    | Run agent (JSON response) |
-| `POST` | `/agents/:name/stream` | Run agent (SSE stream)    |
-| `POST` | `/agents/:name/resume` | Resume a paused run       |
+| Method | Path                          | Description                      |
+| ------ | ----------------------------- | -------------------------------- |
+| `GET`  | `/agents`                     | List all agents                  |
+| `POST` | `/agents/:name/run`           | Run agent (JSON response)        |
+| `POST` | `/agents/:name/stream`        | Run agent (SSE stream)           |
+| `POST` | `/agents/:name/resume`        | Resume a paused run              |
+| `POST` | `/agents/:name/resume/stream` | Resume a paused run (SSE stream) |
 
 ### Threads (Memory)
 
-| Method   | Path                    | Description           |
-| -------- | ----------------------- | --------------------- |
-| `GET`    | `/threads/:id`          | Get thread messages   |
-| `POST`   | `/threads/:id/messages` | Add message to thread |
-| `DELETE` | `/threads/:id`          | Delete thread         |
+| Method   | Path                    | Description                                      |
+| -------- | ----------------------- | ------------------------------------------------ |
+| `GET`    | `/threads/:id`          | Get thread messages, a page with `?limit&cursor` |
+| `POST`   | `/threads/:id/messages` | Add message to thread                            |
+| `DELETE` | `/threads/:id`          | Delete thread                                    |
 
 ### Workflows
 
@@ -153,6 +159,51 @@ When `auth` returns a `userId`, everything a caller does with threads is scoped
 - Another user's thread answers `403` with code `THREAD_ACCESS_DENIED`, and its messages are neither returned nor changed.
 - Threads created earlier without an owner (no `userId`) stay open only to callers without a `userId`, such as servers with no `auth` configured.
 
+### Anonymous callers
+
+By default a caller without a `userId` (no `auth`, or `auth` returned none) may use the API as an anonymous user. With `anonymous: 'deny'` such a caller gets `401 UNAUTHORIZED` on every API route, the WebSocket upgrade included. `/health`, `/ready`, `/openapi.json` and `/docs` stay open, so probes and API docs keep working. A path the app does not serve answers `401` under `'deny'` too, so an anonymous caller cannot tell which paths exist, and `404 NOT_FOUND` in the error envelope under `'allow'`.
+
+### Thread authorization
+
+Core lets a caller touch only threads they own. `authorizeThread` adds your own rule on top, for example a tenant check:
+
+```typescript
+const api = cogitatorApp({
+  cogitator,
+  agents: { chat: chatAgent },
+  auth,
+  authorizeThread: (auth, threadId) => tenants.ownsThread(auth?.metadata?.tenant, threadId),
+});
+```
+
+It is called with what `auth` returned and the thread a request names: the body `threadId` of agent runs, streams and resumes and of swarm runs and streams, the `:id` of `GET`, `DELETE` and `POST /threads/:id/messages`, and the `threadId` of WebSocket runs and resumes. It runs after the body is validated and before the owner check, and `false` answers `403 THREAD_FORBIDDEN` (a WebSocket `error` message) without starting a run.
+
+### Run deps
+
+`deps` builds what an agent's tools get as `context.deps` for one request: a database handle, the tenant, a client with the caller's credentials. The model never sees them, and they never come from the request body.
+
+```typescript
+const api = cogitatorApp({
+  cogitator,
+  agents: { chat: chatAgent },
+  deps: async (c) => ({ db: await pool.connect(), tenant: c.req.header('x-tenant') }),
+});
+```
+
+Agent runs, streams and resumes call it once per run. WebSocket runs call it with the upgrade request's Context.
+
+### Run limits
+
+`limits` caps what a request may ask a run for: `swarmTimeout` (ms) for swarm runs, `workflowMaxIterations` and `workflowMaxConcurrency` for workflow runs. A request that asks for more is held to the cap, and one that asks for nothing gets the cap, over HTTP, SSE and WebSocket alike. Each limit must be a positive integer, or `cogitatorApp` throws. The OpenAPI spec shows each limit as the default of its field.
+
+```typescript
+const api = cogitatorApp({
+  cogitator,
+  swarms: { research: researchSwarm },
+  limits: { swarmTimeout: 120_000, workflowMaxIterations: 50, workflowMaxConcurrency: 4 },
+});
+```
+
 ### Approvals
 
 A tool with `requiresApproval` (`true`, or a function of the arguments) pauses the run before that turn executes:
@@ -175,6 +226,8 @@ await fetch('/agents/support/resume', {
 
 The body is `{ threadId, decisions?, defaultDecision? }`, where a decision is `{ approved: boolean, reason?: string }`; malformed bodies get `400 INVALID_INPUT`. The response has the same shape as `/run` and may pause again for calls left without a decision. The run resumes as the authenticated `userId`: a thread with no paused run answers `409 RUN_NOT_PAUSED`, and another user's paused run `403 THREAD_ACCESS_DENIED`. Over WebSocket, send `resume` with `{ name, threadId, decisions?, defaultDecision? }`; a paused run's `complete` event carries `status` and `pendingApprovals`.
 
+`POST /agents/:name/resume/stream` takes the same body and streams the rest of the run like `/stream`. `start` and `finish` name the resumed thread, and a body, agent or thread refused before the stream opens is answered as JSON, just like `/resume`. A thread with no paused run ends the open stream with an `error` event, `code: 'RUN_NOT_PAUSED'`, and disconnecting aborts the resume.
+
 ## Multi-Runtime
 
 ```typescript
@@ -265,11 +318,11 @@ On Bun use `upgradeWebSocket` from `hono/bun`, on Deno from `hono/deno`, on Clou
 | `stop`       | Cancels the current run                                                        |
 | `ping`       | Answered with `pong` (echoes `id`)                                             |
 
-| Server sends | Description                                                                                            |
-| ------------ | ------------------------------------------------------------------------------------------------------ |
-| `event`      | `token`, `reasoning`, `tool-call`, `tool-result`, `complete` (with the serialized result), `cancelled` |
-| `error`      | Invalid message, unknown resource, run already in progress, or a masked run failure                    |
-| `pong`       | Heartbeat reply                                                                                        |
+| Server sends | Description                                                                                                             |
+| ------------ | ----------------------------------------------------------------------------------------------------------------------- |
+| `event`      | `token`, `reasoning`, `tool-call`, `tool-result`, `complete` (with the serialized result), `cancelled`                  |
+| `error`      | Invalid message, unknown resource, a thread `authorizeThread` refused, run already in progress, or a masked run failure |
+| `pong`       | Heartbeat reply                                                                                                         |
 
 Messages larger than `maxPayloadSize` are rejected and the socket is closed with code `1009`. Closing the socket aborts the active run. `handleWebSocketMessage` and `createClientState` are exported for custom WebSocket integrations.
 
@@ -287,6 +340,7 @@ import {
   createWebSocketRoutes,
   createContextMiddleware,
   createAuthMiddleware,
+  createAnonymousMiddleware,
   createBodyLimitMiddleware,
   errorHandler,
 } from '@cogitator-ai/hono';

package/dist/app.d.ts

@@ -1,4 +1,9 @@
 import { Hono } from 'hono';
 import type { HonoEnv, CogitatorAppOptions } from './types.js';
+/**
+ * The Cogitator API as a Hono app.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export declare function cogitatorApp(opts: CogitatorAppOptions): Hono<HonoEnv>;
 //# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAgB/D,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,CA+BrE"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAiB/D;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAAC,OAAO,CAAC,CAuCrE"}

package/dist/app.js

@@ -1,11 +1,17 @@
 import { Hono } from 'hono';
 import { createContextMiddleware } from './middleware/context.js';
-import { createAuthMiddleware } from './middleware/auth.js';
+import { createAnonymousMiddleware, createAuthMiddleware } from './middleware/auth.js';
 import { createBodyLimitMiddleware } from './middleware/body-limit.js';
 import { errorHandler } from './middleware/error-handler.js';
 import { createHealthRoutes, createAgentRoutes, createThreadRoutes, createToolRoutes, createWorkflowRoutes, createSwarmRoutes, } from './routes/index.js';
 import { createSwaggerRoutes } from './swagger/index.js';
 import { createWebSocketRoutes } from './websocket/handler.js';
+import { notFound } from './utils/request.js';
+/**
+ * The Cogitator API as a Hono app.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export function cogitatorApp(opts) {
     const app = new Hono();
     app.use('*', createContextMiddleware(opts));
@@ -14,17 +20,23 @@ export function cogitatorApp(opts) {
         app.use('*', createAuthMiddleware(opts.auth));
     }
     app.route('/', createHealthRoutes());
+    if (opts.enableSwagger) {
+        app.route('/', createSwaggerRoutes({
+            ...opts.swagger,
+            auth: opts.swagger?.auth ?? Boolean(opts.auth),
+            ...(opts.limits && { limits: opts.limits }),
+        }));
+    }
+    app.use('*', createAnonymousMiddleware(opts.anonymous));
     app.route('/', createAgentRoutes());
     app.route('/', createThreadRoutes());
     app.route('/', createToolRoutes());
     app.route('/', createWorkflowRoutes());
     app.route('/', createSwarmRoutes());
-    if (opts.enableSwagger) {
-        app.route('/', createSwaggerRoutes({ ...opts.swagger, auth: opts.swagger?.auth ?? Boolean(opts.auth) }));
-    }
     if (opts.enableWebSocket) {
         app.route('/', createWebSocketRoutes(opts.websocket));
     }
+    app.notFound((c) => notFound(c, 'Not found'));
     app.onError(errorHandler);
     return app;
 }

package/dist/app.js.map

@@ -1 +1 @@
-{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAW,CAAC;IAEhC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACnC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,mBAAmB,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE1B,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAW,CAAC;IAEhC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAErC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,GAAG,CAAC,KAAK,CACP,GAAG,EACH,mBAAmB,CAAC;YAClB,GAAG,IAAI,CAAC,OAAO;YACf,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IAExD,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;IACrC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;IACnC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACvC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE1B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 export { cogitatorApp } from './app.js';
-export type { CogitatorAppOptions, CogitatorContext, HonoEnv, AuthContext, AuthFunction, WebSocketConfig, AgentListResponse, AgentRunRequest, AgentRunResponse, AgentResumeRequest, PendingApproval, ThreadResponse, AddMessageRequest, ToolListResponse, WorkflowListResponse, WorkflowRunRequest, WorkflowRunResponse, WorkflowStatusResponse, SwarmListResponse, SwarmRunRequest, SwarmRunResponse, BlackboardResponse, HealthResponse, ReadinessResponse, ReadinessCheckStatus, ErrorResponse, SwaggerConfig, WebSocketMessage, WebSocketResponse, WebSocketRunPayload, WebSocketResumePayload, WebSocketClientState, WebSocketLike, } from './types.js';
+export type { CogitatorAppOptions, CogitatorContext, HonoEnv, AuthContext, AuthFunction, DepsFunction, RunLimits, AnonymousPolicy, AuthorizeThread, WebSocketConfig, AgentListResponse, AgentRunRequest, AgentRunResponse, AgentResumeRequest, PendingApproval, ThreadResponse, AddMessageRequest, ToolListResponse, WorkflowListResponse, WorkflowRunRequest, WorkflowRunResponse, WorkflowStatusResponse, SwarmListResponse, SwarmRunRequest, SwarmRunResponse, BlackboardResponse, HealthResponse, ReadinessResponse, ReadinessCheckStatus, ErrorResponse, SwaggerConfig, WebSocketMessage, WebSocketResponse, WebSocketRunPayload, WebSocketResumePayload, WebSocketClientState, WebSocketLike, } from './types.js';
 export { HonoStreamWriter } from './streaming/hono-stream-writer.js';
 export type { HonoStreamWriterOptions } from './streaming/hono-stream-writer.js';
 export { createContextMiddleware } from './middleware/context.js';
-export { createAuthMiddleware } from './middleware/auth.js';
+export { createAnonymousMiddleware, createAuthMiddleware } from './middleware/auth.js';
 export { errorHandler } from './middleware/error-handler.js';
 export { createBodyLimitMiddleware } from './middleware/body-limit.js';
 export { createHealthRoutes, createAgentRoutes, createThreadRoutes, createToolRoutes, createWorkflowRoutes, createSwarmRoutes, } from './routes/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,YAAY,EACZ,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,YAAY,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,GACX,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,EACP,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,eAAe,EACf,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,YAAY,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAEhC,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AAEtE,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,GACX,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 export { cogitatorApp } from './app.js';
 export { HonoStreamWriter } from './streaming/hono-stream-writer.js';
 export { createContextMiddleware } from './middleware/context.js';
-export { createAuthMiddleware } from './middleware/auth.js';
+export { createAnonymousMiddleware, createAuthMiddleware } from './middleware/auth.js';
 export { errorHandler } from './middleware/error-handler.js';
 export { createBodyLimitMiddleware } from './middleware/body-limit.js';
 export { createHealthRoutes, createAgentRoutes, createThreadRoutes, createToolRoutes, createWorkflowRoutes, createSwarmRoutes, } from './routes/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAsCxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAGrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,GACX,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AA0CxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AAGrE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAIhC,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,GACX,MAAM,6BAA6B,CAAC"}

package/dist/middleware/auth.d.ts

@@ -1,3 +1,9 @@
+import { type AnonymousPolicy } from '@cogitator-ai/server-shared';
 import type { HonoEnv, AuthFunction } from '../types.js';
 export declare function createAuthMiddleware(authFn: AuthFunction): import("hono").MiddlewareHandler<HonoEnv, string, {}, Response>;
+/**
+ * Turns away callers without a `userId` when `anonymous` is `'deny'`, with
+ * `401 UNAUTHORIZED`. Routes registered before it, such as health and docs, stay open.
+ */
+export declare function createAnonymousMiddleware(anonymous: AnonymousPolicy | undefined): import("hono").MiddlewareHandler<HonoEnv, string, {}, Response>;
 //# sourceMappingURL=auth.d.ts.map

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAEzD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,mEAUxD"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9F,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAGzD,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,mEAUxD;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,eAAe,GAAG,SAAS,mEAM/E"}

package/dist/middleware/auth.js

@@ -1,4 +1,6 @@
 import { createMiddleware } from 'hono/factory';
+import { UNAUTHORIZED, admitCaller } from '@cogitator-ai/server-shared';
+import { sendError } from '../utils/request.js';
 export function createAuthMiddleware(authFn) {
     return createMiddleware(async (c, next) => {
         try {
@@ -6,9 +8,21 @@ export function createAuthMiddleware(authFn) {
             c.set('cogitatorAuth', auth);
         }
         catch {
-            return c.json({ error: { message: 'Unauthorized', code: 'UNAUTHORIZED' } }, 401);
+            return sendError(c, { ...UNAUTHORIZED, message: 'Unauthorized' });
         }
         await next();
     });
 }
+/**
+ * Turns away callers without a `userId` when `anonymous` is `'deny'`, with
+ * `401 UNAUTHORIZED`. Routes registered before it, such as health and docs, stay open.
+ */
+export function createAnonymousMiddleware(anonymous) {
+    return createMiddleware(async (c, next) => {
+        const refusal = admitCaller(c.get('cogitatorAuth')?.userId, anonymous);
+        if (refusal)
+            return sendError(c, refusal);
+        await next();
+    });
+}
 //# sourceMappingURL=auth.js.map

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,gBAAgB,CAAU,KAAK,EAAE,CAAC,EAAE,IAAI,EAA4B,EAAE;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAwB,MAAM,6BAA6B,CAAC;AAE9F,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,OAAO,gBAAgB,CAAU,KAAK,EAAE,CAAC,EAAE,IAAI,EAA4B,EAAE;QAC3E,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,EAAE,EAAE,GAAG,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAsC;IAC9E,OAAO,gBAAgB,CAAU,KAAK,EAAE,CAAC,EAAE,IAAI,EAA4B,EAAE;QAC3E,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO;YAAE,OAAO,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC1C,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/body-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,MAA2B,GACnC,iBAAiB,CAAC,OAAO,CAAC,CAM5B"}
+{"version":3,"file":"body-limit.d.ts","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,eAAO,MAAM,kBAAkB,QAAc,CAAC;AAE9C,wBAAgB,yBAAyB,CACvC,OAAO,GAAE,MAA2B,GACnC,iBAAiB,CAAC,OAAO,CAAC,CAK5B"}

package/dist/middleware/body-limit.js

@@ -1,9 +1,11 @@
 import { bodyLimit } from 'hono/body-limit';
+import { PAYLOAD_TOO_LARGE } from '@cogitator-ai/server-shared';
+import { sendError } from '../utils/request.js';
 export const DEFAULT_BODY_LIMIT = 1024 * 1024;
 export function createBodyLimitMiddleware(maxSize = DEFAULT_BODY_LIMIT) {
     return bodyLimit({
         maxSize,
-        onError: (c) => c.json({ error: { message: 'Payload too large', code: 'PAYLOAD_TOO_LARGE' } }, 413),
+        onError: (c) => sendError(c, PAYLOAD_TOO_LARGE),
     });
 }
 //# sourceMappingURL=body-limit.js.map

package/dist/middleware/body-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAI5C,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,yBAAyB,CACvC,UAAkB,kBAAkB;IAEpC,OAAO,SAAS,CAAC;QACf,OAAO;QACP,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CACb,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAAE,EAAE,GAAG,CAAC;KACtF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"body-limit.js","sourceRoot":"","sources":["../../src/middleware/body-limit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE9C,MAAM,UAAU,yBAAyB,CACvC,UAAkB,kBAAkB;IAEpC,OAAO,SAAS,CAAC;QACf,OAAO;QACP,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,iBAAiB,CAAC;KAChD,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/context.d.ts

@@ -1,3 +1,8 @@
 import type { HonoEnv, CogitatorAppOptions } from '../types.js';
+/**
+ * Sets the Cogitator context of each request.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export declare function createContextMiddleware(opts: CogitatorAppOptions): import("hono").MiddlewareHandler<HonoEnv, string, {}, Response>;
 //# sourceMappingURL=context.d.ts.map

package/dist/middleware/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,mEAiBhE"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,mBAAmB,mEAqBhE"}

package/dist/middleware/context.js

@@ -1,7 +1,13 @@
 import { createMiddleware } from 'hono/factory';
-import { DEFAULT_THREAD_MESSAGE_ROLES, generateId, resolveSseHeartbeatMs, } from '@cogitator-ai/server-shared';
+import { DEFAULT_THREAD_MESSAGE_ROLES, checkRunLimits, generateId, resolveSseHeartbeatMs, } from '@cogitator-ai/server-shared';
+/**
+ * Sets the Cogitator context of each request.
+ *
+ * @throws Error when `opts.limits` holds a limit that is not a positive integer
+ */
 export function createContextMiddleware(opts) {
     const sseHeartbeatMs = resolveSseHeartbeatMs(opts.sseHeartbeatMs);
+    const limits = checkRunLimits(opts.limits);
     return createMiddleware(async (c, next) => {
         c.set('cogitator', {
             runtime: opts.cogitator,
@@ -11,6 +17,9 @@ export function createContextMiddleware(opts) {
             sseHeartbeatMs,
             acceptContext: opts.acceptContext ?? false,
             threadMessageRoles: opts.threadMessageRoles ?? DEFAULT_THREAD_MESSAGE_ROLES,
+            limits,
+            authorizeThread: opts.authorizeThread,
+            deps: opts.deps,
         });
         c.set('cogitatorRequestId', generateId('req'));
         c.set('cogitatorStartTime', Date.now());

package/dist/middleware/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,4BAA4B,EAC5B,UAAU,EACV,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAGrC,MAAM,UAAU,uBAAuB,CAAC,IAAyB;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClE,OAAO,gBAAgB,CAAU,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACjD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE;YACjB,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,cAAc;YACd,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;YAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,4BAA4B;SAC5E,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAExC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/middleware/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,UAAU,EACV,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAGrC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAyB;IAC/D,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,gBAAgB,CAAU,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACjD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE;YACjB,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,EAAE;YAC/B,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;YACzB,cAAc;YACd,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;YAC1C,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,4BAA4B;YAC3E,MAAM;YACN,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/C,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAExC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/error-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAGzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAG3C,eAAO,MAAM,YAAY,EAAE,YAAY,CAAC,OAAO,CAe9C,CAAC"}
+{"version":3,"file":"error-handler.d.ts","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAC;AAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAI3C,eAAO,MAAM,YAAY,EAAE,YAAY,CAAC,OAAO,CAM9C,CAAC"}

package/dist/middleware/error-handler.js

@@ -1,14 +1,10 @@
 import { HTTPException } from 'hono/http-exception';
-import { CogitatorError, ErrorCode } from '@cogitator-ai/types';
-import { cogitatorErrorStatus } from '../utils/errors.js';
+import { describeError } from '../utils/errors.js';
+import { sendError } from '../utils/request.js';
 export const errorHandler = (err, c) => {
     if (err instanceof HTTPException) {
         return err.getResponse();
     }
-    if (CogitatorError.isCogitatorError(err)) {
-        return c.json({ error: { message: err.message, code: err.code } }, cogitatorErrorStatus(err));
-    }
-    console.error('[CogitatorHono] Unhandled error:', err);
-    return c.json({ error: { message: 'Internal server error', code: ErrorCode.INTERNAL_ERROR } }, 500);
+    return sendError(c, describeError(err, 'Unhandled error'));
 };
 //# sourceMappingURL=error-handler.js.map

package/dist/middleware/error-handler.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;IAC5D,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI,cAAc,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;IAChG,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC;IAEvD,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,EAAE,EAC/E,GAAG,CACJ,CAAC;AACJ,CAAC,CAAC"}
+{"version":3,"file":"error-handler.js","sourceRoot":"","sources":["../../src/middleware/error-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,MAAM,CAAC,MAAM,YAAY,GAA0B,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;IAC5D,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;QACjC,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAC7D,CAAC,CAAC"}

package/dist/routes/agents.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,aAAa,CAAC;AAa9D,wBAAgB,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,CAoIjD"}
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAW5B,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,aAAa,CAAC;AAgD9D,wBAAgB,iBAAiB,IAAI,IAAI,CAAC,OAAO,CAAC,CAqJjD"}