@graphorin/server 0.5.0

package/dist/routes/agents.js

@@ -0,0 +1,213 @@
+import { AgentNotFoundError } from "../errors/index.js";
+import { createScopeMiddleware } from "../middleware/scope.js";
+import { newRequestId } from "../internal/ids.js";
+import { Hono } from "hono";
+import { z } from "zod";
+
+//#region src/routes/agents.ts
+const RunBodySchema = z.object({
+	input: z.unknown().optional(),
+	sessionId: z.string().min(1).optional(),
+	userId: z.string().min(1).optional()
+}).strict().default({});
+/**
+* @stable
+*/
+function createAgentRoutes(deps) {
+	const app = new Hono();
+	const newRunId = deps.newRunId ?? newRequestId;
+	app.get("/", createScopeMiddleware("agents:read"), (c) => c.json({ agents: deps.agents.list() }));
+	app.get("/:id", createScopeMiddleware((_path, params) => `agents:read:${params.id}`), (c) => {
+		const id = c.req.param("id");
+		const summary = deps.agents.describe(id);
+		if (summary === void 0) return c.json({
+			error: "agent-not-found",
+			message: `Agent '${id}' is not registered.`
+		}, 404);
+		return c.json(summary);
+	});
+	app.post("/:id/run", createScopeMiddleware((_path, params) => `agents:invoke:${params.id}`), async (c) => {
+		const id = c.req.param("id");
+		const agent = deps.agents.get(id);
+		if (agent === void 0) {
+			const err = new AgentNotFoundError(id);
+			return c.json({
+				error: err.kind,
+				message: err.message
+			}, 404);
+		}
+		const parsed = RunBodySchema.safeParse(await safelyParseJson(c));
+		if (!parsed.success) return c.json({
+			error: "config-invalid",
+			message: "Invalid run body.",
+			issues: parsed.error.issues.map((i) => ({
+				path: i.path,
+				message: i.message
+			}))
+		}, 400);
+		const runId = newRunId();
+		const sessionId = parsed.data.sessionId;
+		const userId = parsed.data.userId;
+		const tracker = deps.runs.start(runId, {
+			kind: "agent",
+			agentId: id,
+			...sessionId !== void 0 ? { sessionId } : {},
+			...userId !== void 0 ? { userId } : {}
+		});
+		try {
+			const callOptions = { signal: tracker.signal };
+			if (sessionId !== void 0) callOptions.sessionId = sessionId;
+			if (userId !== void 0) callOptions.userId = userId;
+			const result = await agent.run(parsed.data.input ?? "", callOptions);
+			deps.runs.complete(runId, "completed");
+			return c.json({
+				runId,
+				status: "completed",
+				result
+			}, 200);
+		} catch (err) {
+			const aborted = tracker.signal.aborted;
+			deps.runs.complete(runId, aborted ? "aborted" : "failed", err);
+			return c.json({
+				runId,
+				status: aborted ? "aborted" : "failed",
+				error: aborted ? "run-aborted" : "run-failed",
+				message: err instanceof Error ? err.message : String(err)
+			}, aborted ? 408 : 500);
+		}
+	});
+	app.post("/:id/stream", createScopeMiddleware((_path, params) => `agents:invoke:${params.id}`), async (c) => {
+		const id = c.req.param("id");
+		if (!deps.agents.has(id)) {
+			const err = new AgentNotFoundError(id);
+			return c.json({
+				error: err.kind,
+				message: err.message
+			}, 404);
+		}
+		const runId = newRunId();
+		const parsed = RunBodySchema.safeParse(await safelyParseJson(c));
+		const sessionId = parsed.success ? parsed.data.sessionId : void 0;
+		const userId = parsed.success ? parsed.data.userId : void 0;
+		const input = parsed.success ? parsed.data.input ?? "" : "";
+		const tracker = deps.runs.start(runId, {
+			kind: "agent",
+			agentId: id,
+			...sessionId !== void 0 ? { sessionId } : {},
+			...userId !== void 0 ? { userId } : {}
+		});
+		const subject = `agent:${id}/runs/${runId}/events`;
+		const agent = deps.agents.get(id);
+		if (agent !== void 0) backgroundStreamAgent(agent, input, {
+			signal: tracker.signal,
+			...sessionId !== void 0 ? { sessionId } : {},
+			...userId !== void 0 ? { userId } : {},
+			runs: deps.runs,
+			runId,
+			subject,
+			...deps.dispatcher !== void 0 ? { dispatcher: deps.dispatcher } : {}
+		});
+		return c.json({
+			runId,
+			status: "running",
+			subscribe: { websocket: subject }
+		}, 202);
+	});
+	return app;
+}
+/**
+* IP-2: consume the agent's event stream in the background and emit
+* every event onto the run subject. Falls back to `run(...)` (a single
+* terminal frame) for registry entries without a `stream` surface.
+*/
+function backgroundStreamAgent(agent, input, opts) {
+	const emit = (type, payload) => {
+		opts.dispatcher?.emit(opts.subject, {
+			type,
+			payload
+		});
+	};
+	(async () => {
+		try {
+			const callOpts = {
+				signal: opts.signal,
+				...opts.sessionId !== void 0 ? { sessionId: opts.sessionId } : {},
+				...opts.userId !== void 0 ? { userId: opts.userId } : {}
+			};
+			if (typeof agent.stream === "function") for await (const ev of agent.stream(input, callOpts)) {
+				if (opts.signal.aborted) break;
+				emit(typeof ev.type === "string" ? ev.type : "agent.event", ev);
+			}
+			else {
+				const output = await agent.run(input, callOpts);
+				emit("agent.end", {
+					runId: opts.runId,
+					output
+				});
+			}
+			opts.runs.complete(opts.runId, opts.signal.aborted ? "aborted" : "completed");
+		} catch (err) {
+			emit("agent.error", {
+				runId: opts.runId,
+				message: err instanceof Error ? err.message : String(err)
+			});
+			opts.runs.complete(opts.runId, opts.signal.aborted ? "aborted" : "failed", err);
+		}
+	})();
+}
+/**
+* Companion router for the `/runs/...` surface. Kept separate so the
+* `createServer` factory can mount it under the top-level base path
+* rather than under `/agents`.
+*
+* @stable
+*/
+function createRunRoutes(deps) {
+	const app = new Hono();
+	app.get("/:runId/state", createScopeMiddleware("agents:read"), (c) => {
+		const runId = c.req.param("runId");
+		const state = deps.runs.snapshot(runId);
+		if (state === void 0) return c.json({
+			error: "run-not-found",
+			message: `Run '${runId}' is not registered.`
+		}, 404);
+		return c.json(state);
+	});
+	app.post("/:runId/abort", createScopeMiddleware("agents:invoke"), (c) => {
+		const runId = c.req.param("runId");
+		if (!deps.runs.abort(runId)) return c.json({
+			error: "run-not-found",
+			message: `Run '${runId}' is not registered.`
+		}, 404);
+		return c.json({
+			runId,
+			status: "aborted"
+		});
+	});
+	app.post("/:runId/resume", createScopeMiddleware("agents:invoke"), async (c) => {
+		const runId = c.req.param("runId");
+		const state = deps.runs.snapshot(runId);
+		if (state === void 0) return c.json({
+			error: "run-not-found",
+			message: `Run '${runId}' is not registered.`
+		}, 404);
+		return c.json({
+			error: "resume-not-implemented",
+			runId,
+			status: state.status,
+			message: "Server-side HITL resume is not implemented yet. Resume library-side: agent.run(result.state, { directive }) — the suspended RunState is on the AgentResult."
+		}, 501);
+	});
+	return app;
+}
+async function safelyParseJson(c) {
+	try {
+		return await c.req.json();
+	} catch {
+		return {};
+	}
+}
+
+//#endregion
+export { createAgentRoutes, createRunRoutes };
+//# sourceMappingURL=agents.js.map

package/dist/routes/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","names":["callOptions: { signal?: AbortSignal; sessionId?: string; userId?: string }"],"sources":["../../src/routes/agents.ts"],"sourcesContent":["/**\n * Agent REST routes.\n *\n *   GET    /agents                       (scope `agents:read`)\n *   GET    /agents/:id                   (scope `agents:read`)\n *   POST   /agents/:id/run               (idempotent; scope `agents:invoke[:id]`)\n *   POST   /agents/:id/stream            (scope `agents:invoke[:id]`)\n *   GET    /runs/:runId/state            (scope `agents:read`)\n *   POST   /runs/:runId/abort            (scope `agents:invoke`)\n *   POST   /runs/:runId/resume           (idempotent; scope `agents:invoke`)\n *\n * Agents are looked up via {@link AgentRegistry}; missing entries\n * surface a 404 with a typed error body.\n *\n * @packageDocumentation\n */\n\nimport type { Context } from 'hono';\nimport { Hono } from 'hono';\nimport { z } from 'zod';\nimport { AgentNotFoundError } from '../errors/index.js';\nimport type { ServerVariables } from '../internal/context.js';\nimport { newRequestId } from '../internal/ids.js';\nimport { createScopeMiddleware } from '../middleware/scope.js';\nimport type { AgentRegistry } from '../registry/index.js';\nimport type { RunStateTracker } from '../runtime/run-state.js';\n\n/**\n * @stable\n */\nexport interface AgentRoutesDeps {\n  readonly agents: AgentRegistry;\n  readonly runs: RunStateTracker;\n  readonly newRunId?: () => string;\n  /**\n   * Streaming dispatcher (IP-2). When present, `POST /:id/stream`\n   * actually runs the agent and emits every event onto the\n   * `agent:<id>/runs/<runId>/events` subject.\n   */\n  readonly dispatcher?: import('../ws/dispatcher.js').WsDispatcher;\n}\n\nconst RunBodySchema = z\n  .object({\n    input: z.unknown().optional(),\n    sessionId: z.string().min(1).optional(),\n    userId: z.string().min(1).optional(),\n  })\n  .strict()\n  .default({});\n\n/**\n * @stable\n */\nexport function createAgentRoutes(deps: AgentRoutesDeps): Hono<{ Variables: ServerVariables }> {\n  const app = new Hono<{ Variables: ServerVariables }>();\n  const newRunId = deps.newRunId ?? newRequestId;\n\n  app.get('/', createScopeMiddleware('agents:read'), (c) => c.json({ agents: deps.agents.list() }));\n\n  app.get(\n    '/:id',\n    createScopeMiddleware((_path, params) => `agents:read:${params.id}`),\n    (c) => {\n      const id = c.req.param('id');\n      const summary = deps.agents.describe(id);\n      if (summary === undefined) {\n        return c.json(\n          { error: 'agent-not-found', message: `Agent '${id}' is not registered.` },\n          404,\n        );\n      }\n      return c.json(summary);\n    },\n  );\n\n  app.post(\n    '/:id/run',\n    createScopeMiddleware((_path, params) => `agents:invoke:${params.id}`),\n    async (c) => {\n      const id = c.req.param('id');\n      const agent = deps.agents.get(id);\n      if (agent === undefined) {\n        const err = new AgentNotFoundError(id);\n        return c.json({ error: err.kind, message: err.message }, 404);\n      }\n      const parsed = RunBodySchema.safeParse(await safelyParseJson(c));\n      if (!parsed.success) {\n        return c.json(\n          {\n            error: 'config-invalid',\n            message: 'Invalid run body.',\n            issues: parsed.error.issues.map((i) => ({ path: i.path, message: i.message })),\n          },\n          400,\n        );\n      }\n      const runId = newRunId();\n      const sessionId = parsed.data.sessionId;\n      const userId = parsed.data.userId;\n      const tracker = deps.runs.start(runId, {\n        kind: 'agent',\n        agentId: id,\n        ...(sessionId !== undefined ? { sessionId } : {}),\n        ...(userId !== undefined ? { userId } : {}),\n      });\n      try {\n        const callOptions: { signal?: AbortSignal; sessionId?: string; userId?: string } = {\n          signal: tracker.signal,\n        };\n        if (sessionId !== undefined) callOptions.sessionId = sessionId;\n        if (userId !== undefined) callOptions.userId = userId;\n        const result = await agent.run(parsed.data.input ?? '', callOptions);\n        deps.runs.complete(runId, 'completed');\n        return c.json({ runId, status: 'completed', result }, 200);\n      } catch (err) {\n        const aborted = tracker.signal.aborted;\n        deps.runs.complete(runId, aborted ? 'aborted' : 'failed', err);\n        return c.json(\n          {\n            runId,\n            status: aborted ? 'aborted' : 'failed',\n            error: aborted ? 'run-aborted' : 'run-failed',\n            message: err instanceof Error ? err.message : String(err),\n          },\n          aborted ? 408 : 500,\n        );\n      }\n    },\n  );\n\n  app.post(\n    '/:id/stream',\n    createScopeMiddleware((_path, params) => `agents:invoke:${params.id}`),\n    async (c) => {\n      const id = c.req.param('id');\n      if (!deps.agents.has(id)) {\n        const err = new AgentNotFoundError(id);\n        return c.json({ error: err.kind, message: err.message }, 404);\n      }\n      const runId = newRunId();\n      const parsed = RunBodySchema.safeParse(await safelyParseJson(c));\n      const sessionId = parsed.success ? parsed.data.sessionId : undefined;\n      const userId = parsed.success ? parsed.data.userId : undefined;\n      const input = parsed.success ? (parsed.data.input ?? '') : '';\n      // IP-2: actually run the agent. The old handler parsed the input\n      // and threw it away — the run sat 'pending' forever while the 202\n      // advertised subjects nothing would ever emit on.\n      const tracker = deps.runs.start(runId, {\n        kind: 'agent',\n        agentId: id,\n        ...(sessionId !== undefined ? { sessionId } : {}),\n        ...(userId !== undefined ? { userId } : {}),\n      });\n      const subject = `agent:${id}/runs/${runId}/events`;\n      const agent = deps.agents.get(id);\n      if (agent !== undefined) {\n        backgroundStreamAgent(agent, input, {\n          signal: tracker.signal,\n          ...(sessionId !== undefined ? { sessionId } : {}),\n          ...(userId !== undefined ? { userId } : {}),\n          runs: deps.runs,\n          runId,\n          subject,\n          ...(deps.dispatcher !== undefined ? { dispatcher: deps.dispatcher } : {}),\n        });\n      }\n      return c.json(\n        {\n          runId,\n          status: 'running',\n          subscribe: {\n            // The SSE URL previously advertised here pointed at a path\n            // that was never mounted — the WebSocket subject is the\n            // delivery channel (IP-2).\n            websocket: subject,\n          },\n        },\n        202,\n      );\n    },\n  );\n\n  return app;\n}\n\n/**\n * IP-2: consume the agent's event stream in the background and emit\n * every event onto the run subject. Falls back to `run(...)` (a single\n * terminal frame) for registry entries without a `stream` surface.\n */\nfunction backgroundStreamAgent(\n  agent: ReturnType<AgentRegistry['get']> & object,\n  input: unknown,\n  opts: {\n    readonly signal: AbortSignal;\n    readonly sessionId?: string;\n    readonly userId?: string;\n    readonly runs: RunStateTracker;\n    readonly runId: string;\n    readonly subject: string;\n    readonly dispatcher?: import('../ws/dispatcher.js').WsDispatcher;\n  },\n): void {\n  const emit = (type: string, payload: unknown): void => {\n    opts.dispatcher?.emit(opts.subject, { type, payload });\n  };\n  void (async () => {\n    try {\n      const callOpts = {\n        signal: opts.signal,\n        ...(opts.sessionId !== undefined ? { sessionId: opts.sessionId } : {}),\n        ...(opts.userId !== undefined ? { userId: opts.userId } : {}),\n      };\n      if (typeof agent.stream === 'function') {\n        for await (const ev of agent.stream(input, callOpts)) {\n          if (opts.signal.aborted) break;\n          const type =\n            typeof (ev as { type?: unknown }).type === 'string'\n              ? (ev as { type: string }).type\n              : 'agent.event';\n          emit(type, ev);\n        }\n      } else {\n        const output = await agent.run(input, callOpts);\n        emit('agent.end', { runId: opts.runId, output });\n      }\n      opts.runs.complete(opts.runId, opts.signal.aborted ? 'aborted' : 'completed');\n    } catch (err) {\n      emit('agent.error', {\n        runId: opts.runId,\n        message: err instanceof Error ? err.message : String(err),\n      });\n      opts.runs.complete(opts.runId, opts.signal.aborted ? 'aborted' : 'failed', err);\n    }\n  })();\n}\n\n/**\n * Companion router for the `/runs/...` surface. Kept separate so the\n * `createServer` factory can mount it under the top-level base path\n * rather than under `/agents`.\n *\n * @stable\n */\nexport function createRunRoutes(deps: AgentRoutesDeps): Hono<{ Variables: ServerVariables }> {\n  const app = new Hono<{ Variables: ServerVariables }>();\n\n  app.get('/:runId/state', createScopeMiddleware('agents:read'), (c) => {\n    const runId = c.req.param('runId');\n    const state = deps.runs.snapshot(runId);\n    if (state === undefined) {\n      return c.json({ error: 'run-not-found', message: `Run '${runId}' is not registered.` }, 404);\n    }\n    return c.json(state);\n  });\n\n  app.post('/:runId/abort', createScopeMiddleware('agents:invoke'), (c) => {\n    const runId = c.req.param('runId');\n    const aborted = deps.runs.abort(runId);\n    if (!aborted) {\n      return c.json({ error: 'run-not-found', message: `Run '${runId}' is not registered.` }, 404);\n    }\n    return c.json({ runId, status: 'aborted' });\n  });\n\n  app.post('/:runId/resume', createScopeMiddleware('agents:invoke'), async (c) => {\n    const runId = c.req.param('runId');\n    const state = deps.runs.snapshot(runId);\n    if (state === undefined) {\n      return c.json({ error: 'run-not-found', message: `Run '${runId}' is not registered.` }, 404);\n    }\n    // IP-14: a 202 that persists nothing and resumes nothing is a lie\n    // the client SDK was built on. Until the server can rehydrate the\n    // RunState and re-enter the agent loop (the persisted-approvals\n    // work — Wave 3), the honest answer is 501 with the working\n    // library-side path: `agent.run(result.state, { directive })`\n    // executes approved tools for real (AG-1/AG-9).\n    return c.json(\n      {\n        error: 'resume-not-implemented',\n        runId,\n        status: state.status,\n        message:\n          'Server-side HITL resume is not implemented yet. Resume library-side: ' +\n          'agent.run(result.state, { directive }) — the suspended RunState is on the AgentResult.',\n      },\n      501,\n    );\n  });\n\n  return app;\n}\n\nasync function safelyParseJson(c: Context<{ Variables: ServerVariables }>): Promise<unknown> {\n  try {\n    return await c.req.json();\n  } catch {\n    return {};\n  }\n}\n"],"mappings":";;;;;;;AA0CA,MAAM,gBAAgB,EACnB,OAAO;CACN,OAAO,EAAE,SAAS,CAAC,UAAU;CAC7B,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACvC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,UAAU;CACrC,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,CAAC;;;;AAKd,SAAgB,kBAAkB,MAA6D;CAC7F,MAAM,MAAM,IAAI,MAAsC;CACtD,MAAM,WAAW,KAAK,YAAY;AAElC,KAAI,IAAI,KAAK,sBAAsB,cAAc,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,KAAK,OAAO,MAAM,EAAE,CAAC,CAAC;AAEjG,KAAI,IACF,QACA,uBAAuB,OAAO,WAAW,eAAe,OAAO,KAAK,GACnE,MAAM;EACL,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK;EAC5B,MAAM,UAAU,KAAK,OAAO,SAAS,GAAG;AACxC,MAAI,YAAY,OACd,QAAO,EAAE,KACP;GAAE,OAAO;GAAmB,SAAS,UAAU,GAAG;GAAuB,EACzE,IACD;AAEH,SAAO,EAAE,KAAK,QAAQ;GAEzB;AAED,KAAI,KACF,YACA,uBAAuB,OAAO,WAAW,iBAAiB,OAAO,KAAK,EACtE,OAAO,MAAM;EACX,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK;EAC5B,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,MAAI,UAAU,QAAW;GACvB,MAAM,MAAM,IAAI,mBAAmB,GAAG;AACtC,UAAO,EAAE,KAAK;IAAE,OAAO,IAAI;IAAM,SAAS,IAAI;IAAS,EAAE,IAAI;;EAE/D,MAAM,SAAS,cAAc,UAAU,MAAM,gBAAgB,EAAE,CAAC;AAChE,MAAI,CAAC,OAAO,QACV,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS;GACT,QAAQ,OAAO,MAAM,OAAO,KAAK,OAAO;IAAE,MAAM,EAAE;IAAM,SAAS,EAAE;IAAS,EAAE;GAC/E,EACD,IACD;EAEH,MAAM,QAAQ,UAAU;EACxB,MAAM,YAAY,OAAO,KAAK;EAC9B,MAAM,SAAS,OAAO,KAAK;EAC3B,MAAM,UAAU,KAAK,KAAK,MAAM,OAAO;GACrC,MAAM;GACN,SAAS;GACT,GAAI,cAAc,SAAY,EAAE,WAAW,GAAG,EAAE;GAChD,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;GAC3C,CAAC;AACF,MAAI;GACF,MAAMA,cAA6E,EACjF,QAAQ,QAAQ,QACjB;AACD,OAAI,cAAc,OAAW,aAAY,YAAY;AACrD,OAAI,WAAW,OAAW,aAAY,SAAS;GAC/C,MAAM,SAAS,MAAM,MAAM,IAAI,OAAO,KAAK,SAAS,IAAI,YAAY;AACpE,QAAK,KAAK,SAAS,OAAO,YAAY;AACtC,UAAO,EAAE,KAAK;IAAE;IAAO,QAAQ;IAAa;IAAQ,EAAE,IAAI;WACnD,KAAK;GACZ,MAAM,UAAU,QAAQ,OAAO;AAC/B,QAAK,KAAK,SAAS,OAAO,UAAU,YAAY,UAAU,IAAI;AAC9D,UAAO,EAAE,KACP;IACE;IACA,QAAQ,UAAU,YAAY;IAC9B,OAAO,UAAU,gBAAgB;IACjC,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IAC1D,EACD,UAAU,MAAM,IACjB;;GAGN;AAED,KAAI,KACF,eACA,uBAAuB,OAAO,WAAW,iBAAiB,OAAO,KAAK,EACtE,OAAO,MAAM;EACX,MAAM,KAAK,EAAE,IAAI,MAAM,KAAK;AAC5B,MAAI,CAAC,KAAK,OAAO,IAAI,GAAG,EAAE;GACxB,MAAM,MAAM,IAAI,mBAAmB,GAAG;AACtC,UAAO,EAAE,KAAK;IAAE,OAAO,IAAI;IAAM,SAAS,IAAI;IAAS,EAAE,IAAI;;EAE/D,MAAM,QAAQ,UAAU;EACxB,MAAM,SAAS,cAAc,UAAU,MAAM,gBAAgB,EAAE,CAAC;EAChE,MAAM,YAAY,OAAO,UAAU,OAAO,KAAK,YAAY;EAC3D,MAAM,SAAS,OAAO,UAAU,OAAO,KAAK,SAAS;EACrD,MAAM,QAAQ,OAAO,UAAW,OAAO,KAAK,SAAS,KAAM;EAI3D,MAAM,UAAU,KAAK,KAAK,MAAM,OAAO;GACrC,MAAM;GACN,SAAS;GACT,GAAI,cAAc,SAAY,EAAE,WAAW,GAAG,EAAE;GAChD,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;GAC3C,CAAC;EACF,MAAM,UAAU,SAAS,GAAG,QAAQ,MAAM;EAC1C,MAAM,QAAQ,KAAK,OAAO,IAAI,GAAG;AACjC,MAAI,UAAU,OACZ,uBAAsB,OAAO,OAAO;GAClC,QAAQ,QAAQ;GAChB,GAAI,cAAc,SAAY,EAAE,WAAW,GAAG,EAAE;GAChD,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;GAC1C,MAAM,KAAK;GACX;GACA;GACA,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,YAAY,GAAG,EAAE;GACzE,CAAC;AAEJ,SAAO,EAAE,KACP;GACE;GACA,QAAQ;GACR,WAAW,EAIT,WAAW,SACZ;GACF,EACD,IACD;GAEJ;AAED,QAAO;;;;;;;AAQT,SAAS,sBACP,OACA,OACA,MASM;CACN,MAAM,QAAQ,MAAc,YAA2B;AACrD,OAAK,YAAY,KAAK,KAAK,SAAS;GAAE;GAAM;GAAS,CAAC;;AAExD,EAAM,YAAY;AAChB,MAAI;GACF,MAAM,WAAW;IACf,QAAQ,KAAK;IACb,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,WAAW,GAAG,EAAE;IACrE,GAAI,KAAK,WAAW,SAAY,EAAE,QAAQ,KAAK,QAAQ,GAAG,EAAE;IAC7D;AACD,OAAI,OAAO,MAAM,WAAW,WAC1B,YAAW,MAAM,MAAM,MAAM,OAAO,OAAO,SAAS,EAAE;AACpD,QAAI,KAAK,OAAO,QAAS;AAKzB,SAHE,OAAQ,GAA0B,SAAS,WACtC,GAAwB,OACzB,eACK,GAAG;;QAEX;IACL,MAAM,SAAS,MAAM,MAAM,IAAI,OAAO,SAAS;AAC/C,SAAK,aAAa;KAAE,OAAO,KAAK;KAAO;KAAQ,CAAC;;AAElD,QAAK,KAAK,SAAS,KAAK,OAAO,KAAK,OAAO,UAAU,YAAY,YAAY;WACtE,KAAK;AACZ,QAAK,eAAe;IAClB,OAAO,KAAK;IACZ,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI;IAC1D,CAAC;AACF,QAAK,KAAK,SAAS,KAAK,OAAO,KAAK,OAAO,UAAU,YAAY,UAAU,IAAI;;KAE/E;;;;;;;;;AAUN,SAAgB,gBAAgB,MAA6D;CAC3F,MAAM,MAAM,IAAI,MAAsC;AAEtD,KAAI,IAAI,iBAAiB,sBAAsB,cAAc,GAAG,MAAM;EACpE,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ;EAClC,MAAM,QAAQ,KAAK,KAAK,SAAS,MAAM;AACvC,MAAI,UAAU,OACZ,QAAO,EAAE,KAAK;GAAE,OAAO;GAAiB,SAAS,QAAQ,MAAM;GAAuB,EAAE,IAAI;AAE9F,SAAO,EAAE,KAAK,MAAM;GACpB;AAEF,KAAI,KAAK,iBAAiB,sBAAsB,gBAAgB,GAAG,MAAM;EACvE,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ;AAElC,MAAI,CADY,KAAK,KAAK,MAAM,MAAM,CAEpC,QAAO,EAAE,KAAK;GAAE,OAAO;GAAiB,SAAS,QAAQ,MAAM;GAAuB,EAAE,IAAI;AAE9F,SAAO,EAAE,KAAK;GAAE;GAAO,QAAQ;GAAW,CAAC;GAC3C;AAEF,KAAI,KAAK,kBAAkB,sBAAsB,gBAAgB,EAAE,OAAO,MAAM;EAC9E,MAAM,QAAQ,EAAE,IAAI,MAAM,QAAQ;EAClC,MAAM,QAAQ,KAAK,KAAK,SAAS,MAAM;AACvC,MAAI,UAAU,OACZ,QAAO,EAAE,KAAK;GAAE,OAAO;GAAiB,SAAS,QAAQ,MAAM;GAAuB,EAAE,IAAI;AAQ9F,SAAO,EAAE,KACP;GACE,OAAO;GACP;GACA,QAAQ,MAAM;GACd,SACE;GAEH,EACD,IACD;GACD;AAEF,QAAO;;AAGT,eAAe,gBAAgB,GAA8D;AAC3F,KAAI;AACF,SAAO,MAAM,EAAE,IAAI,MAAM;SACnB;AACN,SAAO,EAAE"}

package/dist/routes/audit.d.ts

@@ -0,0 +1,57 @@
+import { ServerVariables } from "../internal/context.js";
+import { Hono } from "hono";
+
+//#region src/routes/audit.d.ts
+
+/**
+ * @stable
+ */
+interface AuditApi {
+  list(opts: {
+    readonly limit?: number;
+    readonly fromSeq?: number;
+    /** Inclusive lower bound on the entry timestamp (epoch ms). */
+    readonly fromTs?: number;
+    /** Inclusive upper bound on the entry timestamp (epoch ms). */
+    readonly toTs?: number;
+    /** Restrict to entries whose `action` matches the supplied id. */
+    readonly action?: string;
+  }): Promise<ReadonlyArray<unknown>>;
+  export(opts: {
+    readonly fromSeq?: number;
+    readonly toSeq?: number;
+    readonly format?: 'jsonl' | 'csv';
+  }): Promise<{
+    readonly bytes: number;
+    readonly format?: 'jsonl' | 'csv';
+  }>;
+  /**
+   * Verify the chain integrity of every audit row in the inclusive
+   * range. Phase 14c surfaces this through `POST /v1/audit/verify`.
+   * Optional — operators that opt out of the audit chain should
+   * leave this method off.
+   */
+  verify?(opts: {
+    readonly fromSeq?: number;
+    readonly toSeq?: number;
+  }): Promise<{
+    readonly ok: boolean;
+    readonly count?: number;
+    readonly brokenAt?: number;
+  }>;
+}
+/**
+ * @stable
+ */
+interface AuditRoutesDeps {
+  readonly audit: AuditApi;
+}
+/**
+ * @stable
+ */
+declare function createAuditRoutes(deps: AuditRoutesDeps): Hono<{
+  Variables: ServerVariables;
+}>;
+//#endregion
+export { AuditApi, AuditRoutesDeps, createAuditRoutes };
+//# sourceMappingURL=audit.d.ts.map

package/dist/routes/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","names":[],"sources":["../../src/routes/audit.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAsBiB,QAAA;;;;;;;;;;MAUX,QAAQ;;;;;MAKR;;;;;;;;;;;;;MAUA;;;;;;;;;UAkCW,eAAA;kBACC;;;;;iBAMF,iBAAA,OAAwB,kBAAkB;aAAkB"}

package/dist/routes/audit.js

@@ -0,0 +1,116 @@
+import { createScopeMiddleware } from "../middleware/scope.js";
+import { Hono } from "hono";
+import { z } from "zod";
+
+//#region src/routes/audit.ts
+const ISO_OR_EPOCH = z.union([z.coerce.number().int().nonnegative(), z.string().min(1)]);
+const ListQuerySchema = z.object({
+	limit: z.coerce.number().int().positive().max(1e3).optional(),
+	fromSeq: z.coerce.number().int().nonnegative().optional(),
+	from: ISO_OR_EPOCH.optional(),
+	to: ISO_OR_EPOCH.optional(),
+	action: z.string().min(1).max(256).optional()
+}).strict();
+function parseTimestamp(input) {
+	if (input === void 0) return void 0;
+	if (typeof input === "number") return input;
+	const parsed = Date.parse(String(input));
+	return Number.isNaN(parsed) ? void 0 : parsed;
+}
+const ExportBodySchema = z.object({
+	fromSeq: z.number().int().nonnegative().optional(),
+	toSeq: z.number().int().nonnegative().optional(),
+	format: z.enum(["jsonl", "csv"]).optional()
+}).strict().default({});
+/**
+* @stable
+*/
+function createAuditRoutes(deps) {
+	const app = new Hono();
+	app.get("/", createScopeMiddleware("audit:read"), async (c) => {
+		const parsed = ListQuerySchema.safeParse({
+			limit: c.req.query("limit"),
+			fromSeq: c.req.query("fromSeq"),
+			from: c.req.query("from"),
+			to: c.req.query("to"),
+			action: c.req.query("action")
+		});
+		if (!parsed.success) return c.json({
+			error: "config-invalid",
+			message: "Invalid audit query.",
+			issues: parsed.error.issues.map((i) => ({
+				path: i.path,
+				message: i.message
+			}))
+		}, 400);
+		const fromTs = parseTimestamp(parsed.data.from);
+		const toTs = parseTimestamp(parsed.data.to);
+		if (parsed.data.from !== void 0 && fromTs === void 0) return c.json({
+			error: "config-invalid",
+			message: `Invalid 'from' timestamp: '${String(parsed.data.from)}' is not parseable.`
+		}, 400);
+		if (parsed.data.to !== void 0 && toTs === void 0) return c.json({
+			error: "config-invalid",
+			message: `Invalid 'to' timestamp: '${String(parsed.data.to)}' is not parseable.`
+		}, 400);
+		const filters = {};
+		if (parsed.data.limit !== void 0) filters.limit = parsed.data.limit;
+		if (parsed.data.fromSeq !== void 0) filters.fromSeq = parsed.data.fromSeq;
+		if (fromTs !== void 0) filters.fromTs = fromTs;
+		if (toTs !== void 0) filters.toTs = toTs;
+		if (parsed.data.action !== void 0) filters.action = parsed.data.action;
+		const entries = await deps.audit.list(filters);
+		return c.json({ entries });
+	});
+	app.post("/verify", createScopeMiddleware("audit:verify"), async (c) => {
+		if (deps.audit.verify === void 0) return c.json({
+			error: "not-implemented",
+			message: "Audit chain verification is not enabled on this deployment."
+		}, 501);
+		const parsed = ExportBodySchema.safeParse(await safelyParseJson(c));
+		if (!parsed.success) return c.json({
+			error: "config-invalid",
+			message: "Invalid verify body.",
+			issues: parsed.error.issues.map((i) => ({
+				path: i.path,
+				message: i.message
+			}))
+		}, 400);
+		const opts = {};
+		if (parsed.data.fromSeq !== void 0) opts.fromSeq = parsed.data.fromSeq;
+		if (parsed.data.toSeq !== void 0) opts.toSeq = parsed.data.toSeq;
+		const result = await deps.audit.verify(opts);
+		return c.json({ verify: result });
+	});
+	app.post("/export", createScopeMiddleware("audit:export"), async (c) => {
+		const parsed = ExportBodySchema.safeParse(await safelyParseJson(c));
+		if (!parsed.success) return c.json({
+			error: "config-invalid",
+			message: "Invalid export body.",
+			issues: parsed.error.issues.map((i) => ({
+				path: i.path,
+				message: i.message
+			}))
+		}, 400);
+		const queryFormat = c.req.query("format");
+		const requestedFormat = parsed.data.format ?? (queryFormat === "csv" ? "csv" : queryFormat === "jsonl" ? "jsonl" : void 0);
+		const opts = {};
+		if (parsed.data.fromSeq !== void 0) opts.fromSeq = parsed.data.fromSeq;
+		if (parsed.data.toSeq !== void 0) opts.toSeq = parsed.data.toSeq;
+		if (requestedFormat !== void 0) opts.format = requestedFormat;
+		const result = await deps.audit.export(opts);
+		return c.json({ export: result });
+	});
+	return app;
+}
+async function safelyParseJson(c) {
+	try {
+		return await c.req.json();
+	} catch {
+		return {};
+	}
+}
+
+//#endregion
+export { createAuditRoutes };
+//# sourceMappingURL=audit.js.map

package/dist/routes/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","names":["filters: {\n      limit?: number;\n      fromSeq?: number;\n      fromTs?: number;\n      toTs?: number;\n      action?: string;\n    }","opts: { fromSeq?: number; toSeq?: number }","opts: { fromSeq?: number; toSeq?: number; format?: 'jsonl' | 'csv' }"],"sources":["../../src/routes/audit.ts"],"sourcesContent":["/**\n * Audit-log REST routes.\n *\n *   GET    /audit                      (scope `audit:read`)\n *   POST   /audit/export               (scope `audit:export`)\n *\n * The handler delegates to a structurally-typed `AuditApi` so the\n * server code stays decoupled from any single audit backend.\n *\n * @packageDocumentation\n */\n\nimport type { Context } from 'hono';\nimport { Hono } from 'hono';\nimport { z } from 'zod';\n\nimport type { ServerVariables } from '../internal/context.js';\nimport { createScopeMiddleware } from '../middleware/scope.js';\n\n/**\n * @stable\n */\nexport interface AuditApi {\n  list(opts: {\n    readonly limit?: number;\n    readonly fromSeq?: number;\n    /** Inclusive lower bound on the entry timestamp (epoch ms). */\n    readonly fromTs?: number;\n    /** Inclusive upper bound on the entry timestamp (epoch ms). */\n    readonly toTs?: number;\n    /** Restrict to entries whose `action` matches the supplied id. */\n    readonly action?: string;\n  }): Promise<ReadonlyArray<unknown>>;\n  export(opts: {\n    readonly fromSeq?: number;\n    readonly toSeq?: number;\n    readonly format?: 'jsonl' | 'csv';\n  }): Promise<{ readonly bytes: number; readonly format?: 'jsonl' | 'csv' }>;\n  /**\n   * Verify the chain integrity of every audit row in the inclusive\n   * range. Phase 14c surfaces this through `POST /v1/audit/verify`.\n   * Optional — operators that opt out of the audit chain should\n   * leave this method off.\n   */\n  verify?(opts: {\n    readonly fromSeq?: number;\n    readonly toSeq?: number;\n  }): Promise<{ readonly ok: boolean; readonly count?: number; readonly brokenAt?: number }>;\n}\n\nconst ISO_OR_EPOCH = z.union([z.coerce.number().int().nonnegative(), z.string().min(1)]);\n\nconst ListQuerySchema = z\n  .object({\n    limit: z.coerce.number().int().positive().max(1000).optional(),\n    fromSeq: z.coerce.number().int().nonnegative().optional(),\n    from: ISO_OR_EPOCH.optional(),\n    to: ISO_OR_EPOCH.optional(),\n    action: z.string().min(1).max(256).optional(),\n  })\n  .strict();\n\nfunction parseTimestamp(input: unknown): number | undefined {\n  if (input === undefined) return undefined;\n  if (typeof input === 'number') return input;\n  const parsed = Date.parse(String(input));\n  return Number.isNaN(parsed) ? undefined : parsed;\n}\n\nconst ExportBodySchema = z\n  .object({\n    fromSeq: z.number().int().nonnegative().optional(),\n    toSeq: z.number().int().nonnegative().optional(),\n    format: z.enum(['jsonl', 'csv']).optional(),\n  })\n  .strict()\n  .default({});\n\n/**\n * @stable\n */\nexport interface AuditRoutesDeps {\n  readonly audit: AuditApi;\n}\n\n/**\n * @stable\n */\nexport function createAuditRoutes(deps: AuditRoutesDeps): Hono<{ Variables: ServerVariables }> {\n  const app = new Hono<{ Variables: ServerVariables }>();\n\n  app.get('/', createScopeMiddleware('audit:read'), async (c) => {\n    const parsed = ListQuerySchema.safeParse({\n      limit: c.req.query('limit'),\n      fromSeq: c.req.query('fromSeq'),\n      from: c.req.query('from'),\n      to: c.req.query('to'),\n      action: c.req.query('action'),\n    });\n    if (!parsed.success) {\n      return c.json(\n        {\n          error: 'config-invalid',\n          message: 'Invalid audit query.',\n          issues: parsed.error.issues.map((i) => ({ path: i.path, message: i.message })),\n        },\n        400,\n      );\n    }\n    const fromTs = parseTimestamp(parsed.data.from);\n    const toTs = parseTimestamp(parsed.data.to);\n    if (parsed.data.from !== undefined && fromTs === undefined) {\n      return c.json(\n        {\n          error: 'config-invalid',\n          message: `Invalid 'from' timestamp: '${String(parsed.data.from)}' is not parseable.`,\n        },\n        400,\n      );\n    }\n    if (parsed.data.to !== undefined && toTs === undefined) {\n      return c.json(\n        {\n          error: 'config-invalid',\n          message: `Invalid 'to' timestamp: '${String(parsed.data.to)}' is not parseable.`,\n        },\n        400,\n      );\n    }\n    const filters: {\n      limit?: number;\n      fromSeq?: number;\n      fromTs?: number;\n      toTs?: number;\n      action?: string;\n    } = {};\n    if (parsed.data.limit !== undefined) filters.limit = parsed.data.limit;\n    if (parsed.data.fromSeq !== undefined) filters.fromSeq = parsed.data.fromSeq;\n    if (fromTs !== undefined) filters.fromTs = fromTs;\n    if (toTs !== undefined) filters.toTs = toTs;\n    if (parsed.data.action !== undefined) filters.action = parsed.data.action;\n    const entries = await deps.audit.list(filters);\n    return c.json({ entries });\n  });\n\n  app.post('/verify', createScopeMiddleware('audit:verify'), async (c) => {\n    if (deps.audit.verify === undefined) {\n      return c.json(\n        {\n          error: 'not-implemented',\n          message: 'Audit chain verification is not enabled on this deployment.',\n        },\n        501,\n      );\n    }\n    const parsed = ExportBodySchema.safeParse(await safelyParseJson(c));\n    if (!parsed.success) {\n      return c.json(\n        {\n          error: 'config-invalid',\n          message: 'Invalid verify body.',\n          issues: parsed.error.issues.map((i) => ({ path: i.path, message: i.message })),\n        },\n        400,\n      );\n    }\n    const opts: { fromSeq?: number; toSeq?: number } = {};\n    if (parsed.data.fromSeq !== undefined) opts.fromSeq = parsed.data.fromSeq;\n    if (parsed.data.toSeq !== undefined) opts.toSeq = parsed.data.toSeq;\n    const result = await deps.audit.verify(opts);\n    return c.json({ verify: result });\n  });\n\n  app.post('/export', createScopeMiddleware('audit:export'), async (c) => {\n    const parsed = ExportBodySchema.safeParse(await safelyParseJson(c));\n    if (!parsed.success) {\n      return c.json(\n        {\n          error: 'config-invalid',\n          message: 'Invalid export body.',\n          issues: parsed.error.issues.map((i) => ({ path: i.path, message: i.message })),\n        },\n        400,\n      );\n    }\n    const queryFormat = c.req.query('format');\n    const requestedFormat =\n      parsed.data.format ??\n      (queryFormat === 'csv' ? 'csv' : queryFormat === 'jsonl' ? 'jsonl' : undefined);\n    const opts: { fromSeq?: number; toSeq?: number; format?: 'jsonl' | 'csv' } = {};\n    if (parsed.data.fromSeq !== undefined) opts.fromSeq = parsed.data.fromSeq;\n    if (parsed.data.toSeq !== undefined) opts.toSeq = parsed.data.toSeq;\n    if (requestedFormat !== undefined) opts.format = requestedFormat;\n    const result = await deps.audit.export(opts);\n    return c.json({ export: result });\n  });\n\n  return app;\n}\n\nasync function safelyParseJson(c: Context<{ Variables: ServerVariables }>): Promise<unknown> {\n  try {\n    return await c.req.json();\n  } catch {\n    return {};\n  }\n}\n"],"mappings":";;;;;AAkDA,MAAM,eAAe,EAAE,MAAM,CAAC,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;AAExF,MAAM,kBAAkB,EACrB,OAAO;CACN,OAAO,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAK,CAAC,UAAU;CAC9D,SAAS,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU;CACzD,MAAM,aAAa,UAAU;CAC7B,IAAI,aAAa,UAAU;CAC3B,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU;CAC9C,CAAC,CACD,QAAQ;AAEX,SAAS,eAAe,OAAoC;AAC1D,KAAI,UAAU,OAAW,QAAO;AAChC,KAAI,OAAO,UAAU,SAAU,QAAO;CACtC,MAAM,SAAS,KAAK,MAAM,OAAO,MAAM,CAAC;AACxC,QAAO,OAAO,MAAM,OAAO,GAAG,SAAY;;AAG5C,MAAM,mBAAmB,EACtB,OAAO;CACN,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU;CAClD,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU;CAChD,QAAQ,EAAE,KAAK,CAAC,SAAS,MAAM,CAAC,CAAC,UAAU;CAC5C,CAAC,CACD,QAAQ,CACR,QAAQ,EAAE,CAAC;;;;AAYd,SAAgB,kBAAkB,MAA6D;CAC7F,MAAM,MAAM,IAAI,MAAsC;AAEtD,KAAI,IAAI,KAAK,sBAAsB,aAAa,EAAE,OAAO,MAAM;EAC7D,MAAM,SAAS,gBAAgB,UAAU;GACvC,OAAO,EAAE,IAAI,MAAM,QAAQ;GAC3B,SAAS,EAAE,IAAI,MAAM,UAAU;GAC/B,MAAM,EAAE,IAAI,MAAM,OAAO;GACzB,IAAI,EAAE,IAAI,MAAM,KAAK;GACrB,QAAQ,EAAE,IAAI,MAAM,SAAS;GAC9B,CAAC;AACF,MAAI,CAAC,OAAO,QACV,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS;GACT,QAAQ,OAAO,MAAM,OAAO,KAAK,OAAO;IAAE,MAAM,EAAE;IAAM,SAAS,EAAE;IAAS,EAAE;GAC/E,EACD,IACD;EAEH,MAAM,SAAS,eAAe,OAAO,KAAK,KAAK;EAC/C,MAAM,OAAO,eAAe,OAAO,KAAK,GAAG;AAC3C,MAAI,OAAO,KAAK,SAAS,UAAa,WAAW,OAC/C,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS,8BAA8B,OAAO,OAAO,KAAK,KAAK,CAAC;GACjE,EACD,IACD;AAEH,MAAI,OAAO,KAAK,OAAO,UAAa,SAAS,OAC3C,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS,4BAA4B,OAAO,OAAO,KAAK,GAAG,CAAC;GAC7D,EACD,IACD;EAEH,MAAMA,UAMF,EAAE;AACN,MAAI,OAAO,KAAK,UAAU,OAAW,SAAQ,QAAQ,OAAO,KAAK;AACjE,MAAI,OAAO,KAAK,YAAY,OAAW,SAAQ,UAAU,OAAO,KAAK;AACrE,MAAI,WAAW,OAAW,SAAQ,SAAS;AAC3C,MAAI,SAAS,OAAW,SAAQ,OAAO;AACvC,MAAI,OAAO,KAAK,WAAW,OAAW,SAAQ,SAAS,OAAO,KAAK;EACnE,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK,QAAQ;AAC9C,SAAO,EAAE,KAAK,EAAE,SAAS,CAAC;GAC1B;AAEF,KAAI,KAAK,WAAW,sBAAsB,eAAe,EAAE,OAAO,MAAM;AACtE,MAAI,KAAK,MAAM,WAAW,OACxB,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS;GACV,EACD,IACD;EAEH,MAAM,SAAS,iBAAiB,UAAU,MAAM,gBAAgB,EAAE,CAAC;AACnE,MAAI,CAAC,OAAO,QACV,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS;GACT,QAAQ,OAAO,MAAM,OAAO,KAAK,OAAO;IAAE,MAAM,EAAE;IAAM,SAAS,EAAE;IAAS,EAAE;GAC/E,EACD,IACD;EAEH,MAAMC,OAA6C,EAAE;AACrD,MAAI,OAAO,KAAK,YAAY,OAAW,MAAK,UAAU,OAAO,KAAK;AAClE,MAAI,OAAO,KAAK,UAAU,OAAW,MAAK,QAAQ,OAAO,KAAK;EAC9D,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,KAAK;AAC5C,SAAO,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC;GACjC;AAEF,KAAI,KAAK,WAAW,sBAAsB,eAAe,EAAE,OAAO,MAAM;EACtE,MAAM,SAAS,iBAAiB,UAAU,MAAM,gBAAgB,EAAE,CAAC;AACnE,MAAI,CAAC,OAAO,QACV,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS;GACT,QAAQ,OAAO,MAAM,OAAO,KAAK,OAAO;IAAE,MAAM,EAAE;IAAM,SAAS,EAAE;IAAS,EAAE;GAC/E,EACD,IACD;EAEH,MAAM,cAAc,EAAE,IAAI,MAAM,SAAS;EACzC,MAAM,kBACJ,OAAO,KAAK,WACX,gBAAgB,QAAQ,QAAQ,gBAAgB,UAAU,UAAU;EACvE,MAAMC,OAAuE,EAAE;AAC/E,MAAI,OAAO,KAAK,YAAY,OAAW,MAAK,UAAU,OAAO,KAAK;AAClE,MAAI,OAAO,KAAK,UAAU,OAAW,MAAK,QAAQ,OAAO,KAAK;AAC9D,MAAI,oBAAoB,OAAW,MAAK,SAAS;EACjD,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,KAAK;AAC5C,SAAO,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC;GACjC;AAEF,QAAO;;AAGT,eAAe,gBAAgB,GAA8D;AAC3F,KAAI;AACF,SAAO,MAAM,EAAE,IAAI,MAAM;SACnB;AACN,SAAO,EAAE"}

package/dist/routes/auth.d.ts

@@ -0,0 +1,26 @@
+import { ServerVariables } from "../internal/context.js";
+import { WsTicketStore } from "../ws/ticket.js";
+import { Hono } from "hono";
+
+//#region src/routes/auth.d.ts
+
+/**
+ * Stable shape consumed by {@link createAuthRoutes}.
+ *
+ * @stable
+ */
+interface AuthRoutesDeps {
+  readonly tickets: WsTicketStore;
+}
+/**
+ * Build the auth router. The router is mounted at the same base path
+ * as the rest of the REST surface (defaults to `/v1`).
+ *
+ * @stable
+ */
+declare function createAuthRoutes(deps: AuthRoutesDeps): Hono<{
+  Variables: ServerVariables;
+}>;
+//#endregion
+export { AuthRoutesDeps, createAuthRoutes };
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","names":[],"sources":["../../src/routes/auth.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;UA4BiB,cAAA;oBACG;;;;;;;;iBASJ,gBAAA,OAAuB,iBAAiB;aAAkB"}

package/dist/routes/auth.js

@@ -0,0 +1,54 @@
+import { createScopeMiddleware } from "../middleware/scope.js";
+import { Hono } from "hono";
+
+//#region src/routes/auth.ts
+/**
+* Auth-related REST routes that exist purely to support the WebSocket
+* surface in `@graphorin/server/ws`.
+*
+*   POST /session/ws-ticket    (scope `agents:invoke`)
+*
+* Browser clients call the endpoint with a regular HTTP `Authorization:
+* Bearer <token>` header to mint a single-use, short-lived ticket; the
+* ticket value is then attached to the WebSocket upgrade request as a
+* second `Sec-WebSocket-Protocol` token (`ticket.<value>`). The
+* server-side WS upgrade handler (see `../ws/upgrade.ts`) consumes the
+* ticket against the same in-memory store so the round-trip is
+* race-free.
+*
+* @packageDocumentation
+*/
+/**
+* Build the auth router. The router is mounted at the same base path
+* as the rest of the REST surface (defaults to `/v1`).
+*
+* @stable
+*/
+function createAuthRoutes(deps) {
+	const app = new Hono();
+	app.post("/session/ws-ticket", createScopeMiddleware("agents:invoke"), (c) => {
+		const auth = c.get("state").auth;
+		const principal = auth.kind === "token" ? {
+			tokenId: auth.token.tokenId,
+			scopes: auth.grantedScopes
+		} : auth.kind === "anonymous" ? {
+			tokenId: "anonymous",
+			scopes: auth.grantedScopes
+		} : void 0;
+		if (principal === void 0) return c.json({
+			error: "auth-required",
+			message: "Bearer token required to mint a WS ticket."
+		}, 401);
+		const ticket = deps.tickets.issue(principal);
+		return c.json({
+			ticket: ticket.value,
+			expiresAt: ticket.expiresAt,
+			ttlMs: deps.tickets.ttlMs
+		}, 201);
+	});
+	return app;
+}
+
+//#endregion
+export { createAuthRoutes };
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":[],"sources":["../../src/routes/auth.ts"],"sourcesContent":["/**\n * Auth-related REST routes that exist purely to support the WebSocket\n * surface in `@graphorin/server/ws`.\n *\n *   POST /session/ws-ticket    (scope `agents:invoke`)\n *\n * Browser clients call the endpoint with a regular HTTP `Authorization:\n * Bearer <token>` header to mint a single-use, short-lived ticket; the\n * ticket value is then attached to the WebSocket upgrade request as a\n * second `Sec-WebSocket-Protocol` token (`ticket.<value>`). The\n * server-side WS upgrade handler (see `../ws/upgrade.ts`) consumes the\n * ticket against the same in-memory store so the round-trip is\n * race-free.\n *\n * @packageDocumentation\n */\n\nimport { Hono } from 'hono';\n\nimport type { ServerVariables } from '../internal/context.js';\nimport { createScopeMiddleware } from '../middleware/scope.js';\nimport type { WsTicketStore } from '../ws/ticket.js';\n\n/**\n * Stable shape consumed by {@link createAuthRoutes}.\n *\n * @stable\n */\nexport interface AuthRoutesDeps {\n  readonly tickets: WsTicketStore;\n}\n\n/**\n * Build the auth router. The router is mounted at the same base path\n * as the rest of the REST surface (defaults to `/v1`).\n *\n * @stable\n */\nexport function createAuthRoutes(deps: AuthRoutesDeps): Hono<{ Variables: ServerVariables }> {\n  const app = new Hono<{ Variables: ServerVariables }>();\n\n  app.post('/session/ws-ticket', createScopeMiddleware('agents:invoke'), (c) => {\n    const auth = c.get('state').auth;\n    // IP-13: in the no-auth loopback mode (`auth.kind='none'`) there is no\n    // bearer token, but the anonymous principal is fully authorized — mint a\n    // ticket bound to a synthetic `anonymous` id so a browser client written\n    // for token mode still completes the round-trip.\n    const principal =\n      auth.kind === 'token'\n        ? { tokenId: auth.token.tokenId, scopes: auth.grantedScopes }\n        : auth.kind === 'anonymous'\n          ? { tokenId: 'anonymous', scopes: auth.grantedScopes }\n          : undefined;\n    if (principal === undefined) {\n      return c.json(\n        {\n          error: 'auth-required',\n          message: 'Bearer token required to mint a WS ticket.',\n        },\n        401,\n      );\n    }\n    const ticket = deps.tickets.issue(principal);\n    return c.json(\n      {\n        ticket: ticket.value,\n        expiresAt: ticket.expiresAt,\n        ttlMs: deps.tickets.ttlMs,\n      },\n      201,\n    );\n  });\n\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,SAAgB,iBAAiB,MAA4D;CAC3F,MAAM,MAAM,IAAI,MAAsC;AAEtD,KAAI,KAAK,sBAAsB,sBAAsB,gBAAgB,GAAG,MAAM;EAC5E,MAAM,OAAO,EAAE,IAAI,QAAQ,CAAC;EAK5B,MAAM,YACJ,KAAK,SAAS,UACV;GAAE,SAAS,KAAK,MAAM;GAAS,QAAQ,KAAK;GAAe,GAC3D,KAAK,SAAS,cACZ;GAAE,SAAS;GAAa,QAAQ,KAAK;GAAe,GACpD;AACR,MAAI,cAAc,OAChB,QAAO,EAAE,KACP;GACE,OAAO;GACP,SAAS;GACV,EACD,IACD;EAEH,MAAM,SAAS,KAAK,QAAQ,MAAM,UAAU;AAC5C,SAAO,EAAE,KACP;GACE,QAAQ,OAAO;GACf,WAAW,OAAO;GAClB,OAAO,KAAK,QAAQ;GACrB,EACD,IACD;GACD;AAEF,QAAO"}

package/dist/routes/health.d.ts

@@ -0,0 +1,22 @@
+import { ServerVariables } from "../internal/context.js";
+import { Hono } from "hono";
+
+//#region src/routes/health.d.ts
+
+/**
+ * @stable
+ */
+interface HealthRoutesDeps {
+  readonly version: string;
+  readonly startedAt: number;
+  readonly now?: () => number;
+}
+/**
+ * @stable
+ */
+declare function createHealthRoutes(deps: HealthRoutesDeps): Hono<{
+  Variables: ServerVariables;
+}>;
+//#endregion
+export { HealthRoutesDeps, createHealthRoutes };
+//# sourceMappingURL=health.d.ts.map

package/dist/routes/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","names":[],"sources":["../../src/routes/health.ts"],"sourcesContent":[],"mappings":";;;;;;;;UAqBiB,gBAAA;;;;;;;;iBASD,kBAAA,OAAyB,mBAAmB;aAAkB"}

package/dist/routes/health.js

@@ -0,0 +1,33 @@
+import { Hono } from "hono";
+
+//#region src/routes/health.ts
+/**
+* `GET /v1/health` — minimal health endpoint kept for backward
+* compatibility with consumers that wired the Phase 14a route
+* factory directly. The active server now mounts the extended
+* Phase 14c routes from `@graphorin/server/health`. New code should
+* use {@link import('../health/routes.js').createExtendedHealthRoutes}.
+*
+* @deprecated Phase 14c. Use `createExtendedHealthRoutes` from
+*             `@graphorin/server/health` instead. This export
+*             stays available so existing consumers do not break.
+*
+* @packageDocumentation
+*/
+/**
+* @stable
+*/
+function createHealthRoutes(deps) {
+	const app = new Hono();
+	const now = deps.now ?? Date.now;
+	app.get("/", (c) => c.json({
+		status: "ok",
+		version: deps.version,
+		uptimeSeconds: Math.max(0, Math.floor((now() - deps.startedAt) / 1e3))
+	}));
+	return app;
+}
+
+//#endregion
+export { createHealthRoutes };
+//# sourceMappingURL=health.js.map

package/dist/routes/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","names":[],"sources":["../../src/routes/health.ts"],"sourcesContent":["/**\n * `GET /v1/health` — minimal health endpoint kept for backward\n * compatibility with consumers that wired the Phase 14a route\n * factory directly. The active server now mounts the extended\n * Phase 14c routes from `@graphorin/server/health`. New code should\n * use {@link import('../health/routes.js').createExtendedHealthRoutes}.\n *\n * @deprecated Phase 14c. Use `createExtendedHealthRoutes` from\n *             `@graphorin/server/health` instead. This export\n *             stays available so existing consumers do not break.\n *\n * @packageDocumentation\n */\n\nimport { Hono } from 'hono';\n\nimport type { ServerVariables } from '../internal/context.js';\n\n/**\n * @stable\n */\nexport interface HealthRoutesDeps {\n  readonly version: string;\n  readonly startedAt: number;\n  readonly now?: () => number;\n}\n\n/**\n * @stable\n */\nexport function createHealthRoutes(deps: HealthRoutesDeps): Hono<{ Variables: ServerVariables }> {\n  const app = new Hono<{ Variables: ServerVariables }>();\n  const now = deps.now ?? Date.now;\n  app.get('/', (c) =>\n    c.json({\n      status: 'ok' as const,\n      version: deps.version,\n      uptimeSeconds: Math.max(0, Math.floor((now() - deps.startedAt) / 1000)),\n    }),\n  );\n  return app;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,mBAAmB,MAA8D;CAC/F,MAAM,MAAM,IAAI,MAAsC;CACtD,MAAM,MAAM,KAAK,OAAO,KAAK;AAC7B,KAAI,IAAI,MAAM,MACZ,EAAE,KAAK;EACL,QAAQ;EACR,SAAS,KAAK;EACd,eAAe,KAAK,IAAI,GAAG,KAAK,OAAO,KAAK,GAAG,KAAK,aAAa,IAAK,CAAC;EACxE,CAAC,CACH;AACD,QAAO"}

package/dist/routes/index.d.ts

@@ -0,0 +1,10 @@
+import { AgentRoutesDeps, createAgentRoutes, createRunRoutes } from "./agents.js";
+import { AuditApi, AuditRoutesDeps, createAuditRoutes } from "./audit.js";
+import { AuthRoutesDeps, createAuthRoutes } from "./auth.js";
+import { HealthRoutesDeps, createHealthRoutes } from "./health.js";
+import { McpApi, McpRoutesDeps, createMcpRoutes } from "./mcp.js";
+import { MemoryApi, MemoryRoutesDeps, createMemoryRoutes } from "./memory.js";
+import { SessionApi, SessionRoutesDeps, createSessionRoutes } from "./sessions.js";
+import { SkillsApi, SkillsRoutesDeps, createSkillsRoutes } from "./skills.js";
+import { TokensRoutesDeps, createTokensRoutes } from "./tokens.js";
+import { WorkflowRoutesDeps, createWorkflowRoutes } from "./workflows.js";

package/dist/routes/index.js

@@ -0,0 +1,12 @@
+import { createAgentRoutes, createRunRoutes } from "./agents.js";
+import { createAuditRoutes } from "./audit.js";
+import { createAuthRoutes } from "./auth.js";
+import { createHealthRoutes } from "./health.js";
+import { createMcpRoutes } from "./mcp.js";
+import { createMemoryRoutes } from "./memory.js";
+import { createSessionRoutes } from "./sessions.js";
+import { createSkillsRoutes } from "./skills.js";
+import { createTokensRoutes } from "./tokens.js";
+import { createWorkflowRoutes } from "./workflows.js";
+
+export {  };