@kavachos/hono 0.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 KavachOS
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,74 @@
+# @kavachos/hono
+
+Hono adapter for KavachOS.
+
+[![npm](https://img.shields.io/npm/v/@kavachos/hono)](https://www.npmjs.com/package/@kavachos/hono)
+
+## Install
+
+```bash
+pnpm add kavachos @kavachos/hono
+```
+
+## Usage
+
+```typescript
+import { serve } from '@hono/node-server';
+import { Hono } from 'hono';
+import { createKavach } from 'kavachos';
+import { kavachHono } from '@kavachos/hono';
+
+const kavach = createKavach({
+  database: { provider: 'sqlite', url: 'kavach.db' },
+});
+
+const app = new Hono();
+
+// Mount all KavachOS routes at /api/kavach
+app.route('/api/kavach', kavachHono(kavach));
+
+serve({ fetch: app.fetch, port: 3000 });
+```
+
+This mounts the full KavachOS REST API: agent CRUD, authorization, delegations, audit logs, and dashboard stats.
+
+### With MCP OAuth 2.1
+
+```typescript
+import { createMcpModule } from 'kavachos/mcp';
+import { kavachHono } from '@kavachos/hono';
+
+const mcp = createMcpModule({
+  issuer: 'https://your-app.com',
+  // ...
+});
+
+app.route('/api/kavach', kavachHono(kavach, { mcp }));
+```
+
+When `mcp` is provided, the OAuth 2.1 endpoints are enabled:
+
+- `GET /.well-known/oauth-authorization-server`
+- `GET /.well-known/oauth-protected-resource`
+- `POST /mcp/register`
+- `GET /mcp/authorize`
+- `POST /mcp/token`
+
+## API surface
+
+`kavachHono(kavach, options?)` returns a `Hono` instance with all routes registered. Pass it to `app.route()` with your chosen prefix.
+
+| Option | Type | Description |
+|--------|------|-------------|
+| `mcp` | `McpAuthModule` | Enables MCP OAuth 2.1 endpoints |
+
+For full docs on agent identity, permissions, delegation, and audit, see the main [kavachos](https://www.npmjs.com/package/kavachos) package.
+
+## Links
+
+- [Documentation](https://kavachos.dev/docs)
+- [GitHub](https://github.com/kavachos/kavachos)
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,30 @@
+import { Hono } from 'hono';
+import { Kavach } from 'kavachos';
+import { McpAuthModule } from 'kavachos/mcp';
+
+/**
+ * Create a Hono app with all KavachOS REST API routes mounted.
+ *
+ * @example
+ * ```typescript
+ * import { createKavach } from 'kavachos';
+ * import { kavachHono } from '@kavachos/hono';
+ * import { serve } from '@hono/node-server';
+ *
+ * const kavach = createKavach({ database: { provider: 'sqlite', url: 'kavach.db' } });
+ * const app = kavachHono(kavach);
+ * serve({ fetch: app.fetch, port: 3000 });
+ * ```
+ *
+ * With MCP OAuth 2.1:
+ * ```typescript
+ * import { createMcpModule } from 'kavachos/mcp';
+ * const mcp = createMcpModule({ ... });
+ * const app = kavachHono(kavach, { mcp });
+ * ```
+ */
+declare function kavachHono(kavach: Kavach, options?: {
+    mcp?: McpAuthModule;
+}): Hono;
+
+export { kavachHono };

package/dist/index.js

@@ -0,0 +1,669 @@
+import { Hono } from 'hono';
+import { z } from 'zod';
+
+// src/adapter.ts
+var PermissionConstraintsSchema = z.object({
+  maxCallsPerHour: z.number().int().positive().optional(),
+  allowedArgPatterns: z.array(z.string()).optional(),
+  requireApproval: z.boolean().optional(),
+  timeWindow: z.object({
+    start: z.string(),
+    end: z.string()
+  }).optional(),
+  ipAllowlist: z.array(z.string()).optional()
+});
+var PermissionSchema = z.object({
+  resource: z.string().min(1),
+  actions: z.array(z.string().min(1)).min(1),
+  constraints: PermissionConstraintsSchema.optional()
+});
+var CreateAgentSchema = z.object({
+  ownerId: z.string().min(1),
+  name: z.string().min(1),
+  type: z.enum(["autonomous", "delegated", "service"]),
+  permissions: z.array(PermissionSchema).min(1),
+  expiresAt: z.coerce.date().optional(),
+  metadata: z.record(z.unknown()).optional()
+});
+var UpdateAgentSchema = z.object({
+  name: z.string().min(1).optional(),
+  permissions: z.array(PermissionSchema).optional(),
+  expiresAt: z.coerce.date().optional(),
+  metadata: z.record(z.unknown()).optional()
+});
+var AuthorizeSchema = z.object({
+  agentId: z.string().min(1),
+  action: z.string().min(1),
+  resource: z.string().min(1),
+  arguments: z.record(z.unknown()).optional()
+});
+var AuthorizeByTokenSchema = z.object({
+  action: z.string().min(1),
+  resource: z.string().min(1),
+  arguments: z.record(z.unknown()).optional()
+});
+var DelegateSchema = z.object({
+  fromAgent: z.string().min(1),
+  toAgent: z.string().min(1),
+  permissions: z.array(PermissionSchema).min(1),
+  expiresAt: z.coerce.date(),
+  maxDepth: z.number().int().positive().optional()
+});
+function ok(data, status = 200) {
+  return new Response(JSON.stringify({ data }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function created(data) {
+  return ok(data, 201);
+}
+function errorResponse(code, message, status) {
+  return new Response(JSON.stringify({ error: { code, message } }), {
+    status,
+    headers: { "Content-Type": "application/json" }
+  });
+}
+function badRequest(message) {
+  return errorResponse("BAD_REQUEST", message, 400);
+}
+function unauthorized(message = "Unauthorized") {
+  return errorResponse("UNAUTHORIZED", message, 401);
+}
+function notFound(message = "Not found") {
+  return errorResponse("NOT_FOUND", message, 404);
+}
+function internalError(message = "Internal server error") {
+  return errorResponse("INTERNAL_ERROR", message, 500);
+}
+function validationError(issues) {
+  const message = issues.map((i) => `${i.path.join(".")}: ${i.message}`).join(", ");
+  return badRequest(`Validation failed: ${message}`);
+}
+var MCP_CORS_HEADERS = {
+  "Access-Control-Allow-Origin": "*",
+  "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+  "Access-Control-Allow-Headers": "Content-Type, Authorization",
+  "Access-Control-Max-Age": "86400"
+};
+function mcpOk(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: { "Content-Type": "application/json", ...MCP_CORS_HEADERS }
+  });
+}
+function mcpError(code, message, status) {
+  return new Response(JSON.stringify({ error: code, error_description: message }), {
+    status,
+    headers: { "Content-Type": "application/json", ...MCP_CORS_HEADERS }
+  });
+}
+function mcpNoStore(data, status = 200) {
+  return new Response(JSON.stringify(data), {
+    status,
+    headers: {
+      "Content-Type": "application/json",
+      "Cache-Control": "no-store",
+      Pragma: "no-cache",
+      ...MCP_CORS_HEADERS
+    }
+  });
+}
+function kavachHono(kavach, options) {
+  const app = new Hono();
+  const mcp = options?.mcp;
+  app.post("/agents", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      const res = badRequest("Invalid JSON body");
+      return c.newResponse(res.body, res);
+    }
+    const parsed = CreateAgentSchema.safeParse(body);
+    if (!parsed.success) {
+      const res = validationError(parsed.error.issues);
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const input = {
+        ...parsed.data,
+        permissions: parsed.data.permissions
+      };
+      const agent = await kavach.agent.create(input);
+      const res = created(agent);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to create agent";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/agents", async (c) => {
+    const userId = c.req.query("userId");
+    const statusRaw = c.req.query("status");
+    const typeRaw = c.req.query("type");
+    const filter = {};
+    if (userId) filter.userId = userId;
+    if (statusRaw === "active" || statusRaw === "revoked" || statusRaw === "expired") {
+      filter.status = statusRaw;
+    }
+    if (typeRaw === "autonomous" || typeRaw === "delegated" || typeRaw === "service") {
+      filter.type = typeRaw;
+    }
+    try {
+      const agents = await kavach.agent.list(filter);
+      const res = ok(agents);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to list agents";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/agents/:id", async (c) => {
+    const id = c.req.param("id");
+    try {
+      const agent = await kavach.agent.get(id);
+      if (!agent) {
+        const res2 = notFound(`Agent "${id}" not found`);
+        return c.newResponse(res2.body, res2);
+      }
+      const res = ok(agent);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to get agent";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.patch("/agents/:id", async (c) => {
+    const id = c.req.param("id");
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      const res = badRequest("Invalid JSON body");
+      return c.newResponse(res.body, res);
+    }
+    const parsed = UpdateAgentSchema.safeParse(body);
+    if (!parsed.success) {
+      const res = validationError(parsed.error.issues);
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const input = {
+        ...parsed.data,
+        permissions: parsed.data.permissions
+      };
+      const agent = await kavach.agent.update(id, input);
+      const res = ok(agent);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to update agent";
+      if (message.includes("not found")) {
+        const res2 = notFound(message);
+        return c.newResponse(res2.body, res2);
+      }
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.delete("/agents/:id", async (c) => {
+    const id = c.req.param("id");
+    try {
+      await kavach.agent.revoke(id);
+      return new Response(null, { status: 204 });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to revoke agent";
+      if (message.includes("not found")) {
+        const res2 = notFound(message);
+        return c.newResponse(res2.body, res2);
+      }
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.post("/agents/:id/rotate", async (c) => {
+    const id = c.req.param("id");
+    try {
+      const agent = await kavach.agent.rotate(id);
+      const res = ok(agent);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to rotate agent token";
+      if (message.includes("not found")) {
+        const res2 = notFound(message);
+        return c.newResponse(res2.body, res2);
+      }
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.post("/authorize", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      const res = badRequest("Invalid JSON body");
+      return c.newResponse(res.body, res);
+    }
+    const parsed = AuthorizeSchema.safeParse(body);
+    if (!parsed.success) {
+      const res = validationError(parsed.error.issues);
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? c.req.header("x-real-ip") ?? void 0;
+      const userAgent = c.req.header("user-agent") ?? void 0;
+      const result = await kavach.authorize(
+        parsed.data.agentId,
+        {
+          action: parsed.data.action,
+          resource: parsed.data.resource,
+          arguments: parsed.data.arguments
+        },
+        { ip, userAgent }
+      );
+      const status = result.allowed ? 200 : 403;
+      const res = new Response(JSON.stringify({ data: result }), {
+        status,
+        headers: { "Content-Type": "application/json" }
+      });
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Authorization check failed";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.post("/authorize/token", async (c) => {
+    const authHeader = c.req.header("Authorization");
+    if (!authHeader?.startsWith("Bearer ")) {
+      const res = unauthorized("Missing or invalid Authorization header");
+      return c.newResponse(res.body, res);
+    }
+    const token = authHeader.slice(7);
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      const res = badRequest("Invalid JSON body");
+      return c.newResponse(res.body, res);
+    }
+    const parsed = AuthorizeByTokenSchema.safeParse(body);
+    if (!parsed.success) {
+      const res = validationError(parsed.error.issues);
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const ip = c.req.header("x-forwarded-for")?.split(",")[0]?.trim() ?? c.req.header("x-real-ip") ?? void 0;
+      const userAgent = c.req.header("user-agent") ?? void 0;
+      const result = await kavach.authorizeByToken(
+        token,
+        {
+          action: parsed.data.action,
+          resource: parsed.data.resource,
+          arguments: parsed.data.arguments
+        },
+        { ip, userAgent }
+      );
+      const status = result.allowed ? 200 : 403;
+      const res = new Response(JSON.stringify({ data: result }), {
+        status,
+        headers: { "Content-Type": "application/json" }
+      });
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Authorization check failed";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.post("/delegations", async (c) => {
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      const res = badRequest("Invalid JSON body");
+      return c.newResponse(res.body, res);
+    }
+    const parsed = DelegateSchema.safeParse(body);
+    if (!parsed.success) {
+      const res = validationError(parsed.error.issues);
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const input = {
+        ...parsed.data,
+        permissions: parsed.data.permissions
+      };
+      const chain = await kavach.delegate(input);
+      const res = created(chain);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to create delegation";
+      if (message.includes("not found")) {
+        const res2 = notFound(message);
+        return c.newResponse(res2.body, res2);
+      }
+      if (message.includes("exceeds") || message.includes("depth")) {
+        const res2 = badRequest(message);
+        return c.newResponse(res2.body, res2);
+      }
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.delete("/delegations/:id", async (c) => {
+    const id = c.req.param("id");
+    try {
+      await kavach.delegation.revoke(id);
+      return new Response(null, { status: 204 });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to revoke delegation";
+      if (message.includes("not found")) {
+        const res2 = notFound(message);
+        return c.newResponse(res2.body, res2);
+      }
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/delegations/:agentId", async (c) => {
+    const agentId = c.req.param("agentId");
+    try {
+      const chains = await kavach.delegation.listChains(agentId);
+      const res = ok(chains);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to list delegation chains";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/audit", async (c) => {
+    const filter = {};
+    const agentId = c.req.query("agentId");
+    const userId = c.req.query("userId");
+    const since = c.req.query("since");
+    const until = c.req.query("until");
+    const actions = c.req.query("actions");
+    const resultRaw = c.req.query("result");
+    const limit = c.req.query("limit");
+    const offset = c.req.query("offset");
+    if (agentId) filter.agentId = agentId;
+    if (userId) filter.userId = userId;
+    if (since) {
+      const d = new Date(since);
+      if (!Number.isNaN(d.getTime())) filter.since = d;
+    }
+    if (until) {
+      const d = new Date(until);
+      if (!Number.isNaN(d.getTime())) filter.until = d;
+    }
+    if (actions) filter.actions = actions.split(",").map((a) => a.trim());
+    if (resultRaw === "allowed" || resultRaw === "denied" || resultRaw === "rate_limited") {
+      filter.result = resultRaw;
+    }
+    if (limit) {
+      const n = Number.parseInt(limit, 10);
+      if (!Number.isNaN(n) && n > 0) filter.limit = n;
+    }
+    if (offset) {
+      const n = Number.parseInt(offset, 10);
+      if (!Number.isNaN(n) && n >= 0) filter.offset = n;
+    }
+    try {
+      const entries = await kavach.audit.query(filter);
+      const res = ok(entries);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to query audit logs";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/audit/export", async (c) => {
+    const format = c.req.query("format") ?? "json";
+    if (format !== "json" && format !== "csv") {
+      const res = badRequest('format must be "json" or "csv"');
+      return c.newResponse(res.body, res);
+    }
+    const since = c.req.query("since");
+    const until = c.req.query("until");
+    const options2 = { format };
+    if (since) {
+      const d = new Date(since);
+      if (!Number.isNaN(d.getTime())) options2.since = d;
+    }
+    if (until) {
+      const d = new Date(until);
+      if (!Number.isNaN(d.getTime())) options2.until = d;
+    }
+    try {
+      const exported = await kavach.audit.export(options2);
+      const contentType = format === "csv" ? "text/csv" : "application/json";
+      return new Response(exported, {
+        status: 200,
+        headers: {
+          "Content-Type": contentType,
+          "Content-Disposition": `attachment; filename="audit-export.${format}"`
+        }
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to export audit logs";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.options("/mcp/*", (_c) => {
+    return new Response(null, { status: 204, headers: MCP_CORS_HEADERS });
+  });
+  app.options("/.well-known/*", (_c) => {
+    return new Response(null, { status: 204, headers: MCP_CORS_HEADERS });
+  });
+  app.get("/.well-known/oauth-authorization-server", (c) => {
+    if (!mcp) {
+      const res = notFound("MCP module not configured");
+      return c.newResponse(res.body, res);
+    }
+    const metadata = mcp.getMetadata();
+    return c.newResponse(mcpOk(metadata).body, mcpOk(metadata));
+  });
+  app.get("/.well-known/oauth-protected-resource", (c) => {
+    if (!mcp) {
+      const res = notFound("MCP module not configured");
+      return c.newResponse(res.body, res);
+    }
+    const metadata = mcp.getProtectedResourceMetadata();
+    return c.newResponse(mcpOk(metadata).body, mcpOk(metadata));
+  });
+  app.post("/mcp/register", async (c) => {
+    if (!mcp) {
+      const res = notFound("MCP module not configured");
+      return c.newResponse(res.body, res);
+    }
+    let body;
+    try {
+      body = await c.req.json();
+    } catch {
+      const res = mcpError("invalid_request", "Invalid JSON body", 400);
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const result = await mcp.registerClient(body);
+      if (!result.success) {
+        const res2 = mcpError("invalid_client_metadata", result.error.message, 400);
+        return c.newResponse(res2.body, res2);
+      }
+      const res = mcpNoStore(result.data, 201);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Registration failed";
+      const res = mcpError("server_error", message, 500);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/mcp/authorize", async (c) => {
+    if (!mcp) {
+      const res = notFound("MCP module not configured");
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const result = await mcp.authorize(c.req.raw);
+      if (!result.success) {
+        if (result.error.code === "LOGIN_REQUIRED") {
+          const details = result.error.details;
+          if (details?.loginPage) {
+            const loginUrl = new URL(details.loginPage);
+            if (details.returnTo) {
+              loginUrl.searchParams.set("returnTo", details.returnTo);
+            }
+            return c.redirect(loginUrl.toString(), 302);
+          }
+        }
+        const res = mcpError(result.error.code.toLowerCase(), result.error.message, 400);
+        return c.newResponse(res.body, res);
+      }
+      return c.redirect(result.data.redirectUri, 302);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Authorization failed";
+      const res = mcpError("server_error", message, 500);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.post("/mcp/token", async (c) => {
+    if (!mcp) {
+      const res = notFound("MCP module not configured");
+      return c.newResponse(res.body, res);
+    }
+    try {
+      const result = await mcp.token(c.req.raw);
+      if (!result.success) {
+        const status = result.error.code === "INVALID_CLIENT" ? 401 : 400;
+        const res = mcpNoStore(
+          {
+            error: result.error.code.toLowerCase(),
+            error_description: result.error.message
+          },
+          status
+        );
+        return c.newResponse(res.body, res);
+      }
+      const successRes = mcpNoStore(result.data);
+      return c.newResponse(successRes.body, successRes);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Token exchange failed";
+      const res = mcpNoStore({ error: "server_error", error_description: message }, 500);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/dashboard/stats", async (c) => {
+    try {
+      const [agents, recentAudit] = await Promise.all([
+        kavach.agent.list(),
+        kavach.audit.query({
+          since: new Date(Date.now() - 24 * 60 * 60 * 1e3),
+          limit: 1e3
+        })
+      ]);
+      const ownerIds = new Set(agents.map((a) => a.ownerId));
+      const activeAgents = agents.filter((a) => a.status === "active");
+      const revokedAgents = agents.filter((a) => a.status === "revoked");
+      const expiredAgents = agents.filter((a) => a.status === "expired");
+      const stats = {
+        agents: {
+          total: agents.length,
+          active: activeAgents.length,
+          revoked: revokedAgents.length,
+          expired: expiredAgents.length
+        },
+        users: {
+          total: ownerIds.size
+        },
+        audit: {
+          last24h: recentAudit.length,
+          allowed: recentAudit.filter((e) => e.result === "allowed").length,
+          denied: recentAudit.filter((e) => e.result === "denied").length,
+          rateLimited: recentAudit.filter((e) => e.result === "rate_limited").length
+        }
+      };
+      const res = ok(stats);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to fetch dashboard stats";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/dashboard/agents", async (c) => {
+    const userId = c.req.query("userId");
+    const statusRaw = c.req.query("status");
+    const typeRaw = c.req.query("type");
+    const filter = {};
+    if (userId) filter.userId = userId;
+    if (statusRaw === "active" || statusRaw === "revoked" || statusRaw === "expired") {
+      filter.status = statusRaw;
+    }
+    if (typeRaw === "autonomous" || typeRaw === "delegated" || typeRaw === "service") {
+      filter.type = typeRaw;
+    }
+    try {
+      const agents = await kavach.agent.list(filter);
+      const res = ok(agents);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to list agents";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  app.get("/dashboard/audit", async (c) => {
+    const filter = {};
+    const agentId = c.req.query("agentId");
+    const userId = c.req.query("userId");
+    const since = c.req.query("since");
+    const until = c.req.query("until");
+    const actions = c.req.query("actions");
+    const resultRaw = c.req.query("result");
+    const limit = c.req.query("limit");
+    const offset = c.req.query("offset");
+    if (agentId) filter.agentId = agentId;
+    if (userId) filter.userId = userId;
+    if (since) {
+      const d = new Date(since);
+      if (!Number.isNaN(d.getTime())) filter.since = d;
+    }
+    if (until) {
+      const d = new Date(until);
+      if (!Number.isNaN(d.getTime())) filter.until = d;
+    }
+    if (actions) filter.actions = actions.split(",").map((a) => a.trim());
+    if (resultRaw === "allowed" || resultRaw === "denied" || resultRaw === "rate_limited") {
+      filter.result = resultRaw;
+    }
+    if (limit) {
+      const n = Number.parseInt(limit, 10);
+      if (!Number.isNaN(n) && n > 0) filter.limit = n;
+    }
+    if (offset) {
+      const n = Number.parseInt(offset, 10);
+      if (!Number.isNaN(n) && n >= 0) filter.offset = n;
+    }
+    try {
+      const entries = await kavach.audit.query(filter);
+      const res = ok(entries);
+      return c.newResponse(res.body, res);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "Failed to query audit logs";
+      const res = internalError(message);
+      return c.newResponse(res.body, res);
+    }
+  });
+  return app;
+}
+
+export { kavachHono };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/adapter.ts"],"names":["res","options"],"mappings":";;;;AAeA,IAAM,2BAAA,GAA8B,EAAE,MAAA,CAAO;AAAA,EAC5C,eAAA,EAAiB,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,QAAA,EAAS;AAAA,EACtD,oBAAoB,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACjD,eAAA,EAAiB,CAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EACtC,UAAA,EAAY,EACV,MAAA,CAAO;AAAA,IACP,KAAA,EAAO,EAAE,MAAA,EAAO;AAAA,IAChB,GAAA,EAAK,EAAE,MAAA;AAAO,GACd,EACA,QAAA,EAAS;AAAA,EACX,aAAa,CAAA,CAAE,KAAA,CAAM,EAAE,MAAA,EAAQ,EAAE,QAAA;AAClC,CAAC,CAAA;AAED,IAAM,gBAAA,GAAmB,EAAE,MAAA,CAAO;AAAA,EACjC,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,OAAA,EAAS,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAC,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA;AAAA,EACzC,WAAA,EAAa,4BAA4B,QAAA;AAC1C,CAAC,CAAA;AAED,IAAM,iBAAA,GAAoB,EAAE,MAAA,CAAO;AAAA,EAClC,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACtB,MAAM,CAAA,CAAE,IAAA,CAAK,CAAC,YAAA,EAAc,WAAA,EAAa,SAAS,CAAC,CAAA;AAAA,EACnD,aAAa,CAAA,CAAE,KAAA,CAAM,gBAAgB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAC5C,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA,GAAO,QAAA,EAAS;AAAA,EACpC,UAAU,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,QAAA;AACjC,CAAC,CAAA;AAED,IAAM,iBAAA,GAAoB,EAAE,MAAA,CAAO;AAAA,EAClC,MAAM,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACjC,WAAA,EAAa,CAAA,CAAE,KAAA,CAAM,gBAAgB,EAAE,QAAA,EAAS;AAAA,EAChD,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA,GAAO,QAAA,EAAS;AAAA,EACpC,UAAU,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,QAAA;AACjC,CAAC,CAAA;AAED,IAAM,eAAA,GAAkB,EAAE,MAAA,CAAO;AAAA,EAChC,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACxB,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,WAAW,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,QAAA;AAClC,CAAC,CAAA;AAED,IAAM,sBAAA,GAAyB,EAAE,MAAA,CAAO;AAAA,EACvC,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACxB,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,WAAW,CAAA,CAAE,MAAA,CAAO,EAAE,OAAA,EAAS,EAAE,QAAA;AAClC,CAAC,CAAA;AAED,IAAM,cAAA,GAAiB,EAAE,MAAA,CAAO;AAAA,EAC/B,SAAA,EAAW,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC3B,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,aAAa,CAAA,CAAE,KAAA,CAAM,gBAAgB,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EAC5C,SAAA,EAAW,CAAA,CAAE,MAAA,CAAO,IAAA,EAAK;AAAA,EACzB,QAAA,EAAU,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,QAAA;AACvC,CAAC,CAAA;AAID,SAAS,EAAA,CAAM,IAAA,EAAS,MAAA,GAAS,GAAA,EAAK;AACrC,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,CAAA,EAAG;AAAA,IAC7C,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC9C,CAAA;AACF;AAEA,SAAS,QAAW,IAAA,EAAS;AAC5B,EAAA,OAAO,EAAA,CAAG,MAAM,GAAG,CAAA;AACpB;AAEA,SAAS,aAAA,CAAc,IAAA,EAAc,OAAA,EAAiB,MAAA,EAAgB;AACrE,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,EAAE,IAAA,EAAM,OAAA,EAAQ,EAAG,CAAA,EAAG;AAAA,IACjE,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAC9C,CAAA;AACF;AAEA,SAAS,WAAW,OAAA,EAAiB;AACpC,EAAA,OAAO,aAAA,CAAc,aAAA,EAAe,OAAA,EAAS,GAAG,CAAA;AACjD;AAEA,SAAS,YAAA,CAAa,UAAU,cAAA,EAAgB;AAC/C,EAAA,OAAO,aAAA,CAAc,cAAA,EAAgB,OAAA,EAAS,GAAG,CAAA;AAClD;AAEA,SAAS,QAAA,CAAS,UAAU,WAAA,EAAa;AACxC,EAAA,OAAO,aAAA,CAAc,WAAA,EAAa,OAAA,EAAS,GAAG,CAAA;AAC/C;AAEA,SAAS,aAAA,CAAc,UAAU,uBAAA,EAAyB;AACzD,EAAA,OAAO,aAAA,CAAc,gBAAA,EAAkB,OAAA,EAAS,GAAG,CAAA;AACpD;AAEA,SAAS,gBAAgB,MAAA,EAAsB;AAC9C,EAAA,MAAM,UAAU,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,EAAA,EAAK,CAAA,CAAE,OAAO,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAChF,EAAA,OAAO,UAAA,CAAW,CAAA,mBAAA,EAAsB,OAAO,CAAA,CAAE,CAAA;AAClD;AAIA,IAAM,gBAAA,GAAmB;AAAA,EACxB,6BAAA,EAA+B,GAAA;AAAA,EAC/B,8BAAA,EAAgC,oBAAA;AAAA,EAChC,8BAAA,EAAgC,6BAAA;AAAA,EAChC,wBAAA,EAA0B;AAC3B,CAAA;AAEA,SAAS,KAAA,CAAS,IAAA,EAAS,MAAA,GAAS,GAAA,EAAK;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,IACzC,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,GAAG,gBAAA;AAAiB,GACnE,CAAA;AACF;AAEA,SAAS,QAAA,CAAS,IAAA,EAAc,OAAA,EAAiB,MAAA,EAAgB;AAChE,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,EAAE,OAAO,IAAA,EAAM,iBAAA,EAAmB,OAAA,EAAS,CAAA,EAAG;AAAA,IAChF,MAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAoB,GAAG,gBAAA;AAAiB,GACnE,CAAA;AACF;AAEA,SAAS,UAAA,CAAc,IAAA,EAAS,MAAA,GAAS,GAAA,EAAK;AAC7C,EAAA,OAAO,IAAI,QAAA,CAAS,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,EAAG;AAAA,IACzC,MAAA;AAAA,IACA,OAAA,EAAS;AAAA,MACR,cAAA,EAAgB,kBAAA;AAAA,MAChB,eAAA,EAAiB,UAAA;AAAA,MACjB,MAAA,EAAQ,UAAA;AAAA,MACR,GAAG;AAAA;AACJ,GACA,CAAA;AACF;AAyBO,SAAS,UAAA,CAAW,QAAgB,OAAA,EAAyC;AACnF,EAAA,MAAM,GAAA,GAAM,IAAI,IAAA,EAAK;AACrB,EAAA,MAAM,MAAM,OAAA,EAAS,GAAA;AAKrB,EAAA,GAAA,CAAI,IAAA,CAAK,SAAA,EAAW,OAAO,CAAA,KAAM;AAChC,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACH,MAAA,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACP,MAAA,MAAM,GAAA,GAAM,WAAW,mBAAmB,CAAA;AAC1C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,SAAA,CAAU,IAAI,CAAA;AAC/C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAC/C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,KAAA,GAA0B;AAAA,QAC/B,GAAG,MAAA,CAAO,IAAA;AAAA,QACV,WAAA,EAAa,OAAO,IAAA,CAAK;AAAA,OAC1B;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,KAAA,CAAM,OAAO,KAAK,CAAA;AAC7C,MAAA,MAAM,GAAA,GAAM,QAAQ,KAAK,CAAA;AACzB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,wBAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,SAAA,EAAW,OAAO,CAAA,KAAM;AAC/B,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAElC,IAAA,MAAM,SAAsB,EAAC;AAC7B,IAAA,IAAI,MAAA,SAAe,MAAA,GAAS,MAAA;AAC5B,IAAA,IAAI,SAAA,KAAc,QAAA,IAAY,SAAA,KAAc,SAAA,IAAa,cAAc,SAAA,EAAW;AACjF,MAAA,MAAA,CAAO,MAAA,GAAS,SAAA;AAAA,IACjB;AACA,IAAA,IAAI,OAAA,KAAY,YAAA,IAAgB,OAAA,KAAY,WAAA,IAAe,YAAY,SAAA,EAAW;AACjF,MAAA,MAAA,CAAO,IAAA,GAAO,OAAA;AAAA,IACf;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA,CAAM,KAAK,MAAM,CAAA;AAC7C,MAAA,MAAM,GAAA,GAAM,GAAG,MAAM,CAAA;AACrB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,uBAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,aAAA,EAAe,OAAO,CAAA,KAAM;AACnC,IAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3B,IAAA,IAAI;AACH,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,KAAA,CAAM,IAAI,EAAE,CAAA;AACvC,MAAA,IAAI,CAAC,KAAA,EAAO;AACX,QAAA,MAAMA,IAAAA,GAAM,QAAA,CAAS,CAAA,OAAA,EAAU,EAAE,CAAA,WAAA,CAAa,CAAA;AAC9C,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,KAAK,CAAA;AACpB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,qBAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,KAAA,CAAM,aAAA,EAAe,OAAO,CAAA,KAAM;AACrC,IAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3B,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACH,MAAA,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACP,MAAA,MAAM,GAAA,GAAM,WAAW,mBAAmB,CAAA;AAC1C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,MAAA,GAAS,iBAAA,CAAkB,SAAA,CAAU,IAAI,CAAA;AAC/C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAC/C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,KAAA,GAA0B;AAAA,QAC/B,GAAG,MAAA,CAAO,IAAA;AAAA,QACV,WAAA,EAAa,OAAO,IAAA,CAAK;AAAA,OAC1B;AACA,MAAA,MAAM,QAAQ,MAAM,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,IAAI,KAAK,CAAA;AACjD,MAAA,MAAM,GAAA,GAAM,GAAG,KAAK,CAAA;AACpB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,wBAAA;AACrD,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AAClC,QAAA,MAAMA,IAAAA,GAAM,SAAS,OAAO,CAAA;AAC5B,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,MAAA,CAAO,aAAA,EAAe,OAAO,CAAA,KAAM;AACtC,IAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3B,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,EAAE,CAAA;AAC5B,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,wBAAA;AACrD,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AAClC,QAAA,MAAMA,IAAAA,GAAM,SAAS,OAAO,CAAA;AAC5B,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,IAAA,CAAK,oBAAA,EAAsB,OAAO,CAAA,KAAM;AAC3C,IAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3B,IAAA,IAAI;AACH,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,KAAA,CAAM,OAAO,EAAE,CAAA;AAC1C,MAAA,MAAM,GAAA,GAAM,GAAG,KAAK,CAAA;AACpB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,8BAAA;AACrD,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AAClC,QAAA,MAAMA,IAAAA,GAAM,SAAS,OAAO,CAAA;AAC5B,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,IAAA,CAAK,YAAA,EAAc,OAAO,CAAA,KAAM;AACnC,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACH,MAAA,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACP,MAAA,MAAM,GAAA,GAAM,WAAW,mBAAmB,CAAA;AAC1C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,MAAA,GAAS,eAAA,CAAgB,SAAA,CAAU,IAAI,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAC/C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,KACL,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,GAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAG,IAAA,EAAK,IACrD,EAAE,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA,IACxB,KAAA,CAAA;AACD,MAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,IAAK,KAAA,CAAA;AAChD,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,SAAA;AAAA,QAC3B,OAAO,IAAA,CAAK,OAAA;AAAA,QACZ;AAAA,UACC,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAA;AAAA,UACpB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA;AAAA,UACtB,SAAA,EAAW,OAAO,IAAA,CAAK;AAAA,SACxB;AAAA,QACA,EAAE,IAAI,SAAA;AAAU,OACjB;AACA,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,GAAA,GAAM,GAAA;AACtC,MAAA,MAAM,GAAA,GAAM,IAAI,QAAA,CAAS,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA,EAAG;AAAA,QAC1D,MAAA;AAAA,QACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC9C,CAAA;AACD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,4BAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,IAAA,CAAK,kBAAA,EAAoB,OAAO,CAAA,KAAM;AACzC,IAAA,MAAM,UAAA,GAAa,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,eAAe,CAAA;AAC/C,IAAA,IAAI,CAAC,UAAA,EAAY,UAAA,CAAW,SAAS,CAAA,EAAG;AACvC,MAAA,MAAM,GAAA,GAAM,aAAa,yCAAyC,CAAA;AAClE,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,KAAA,CAAM,CAAC,CAAA;AAEhC,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACH,MAAA,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACP,MAAA,MAAM,GAAA,GAAM,WAAW,mBAAmB,CAAA;AAC1C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,SAAA,CAAU,IAAI,CAAA;AACpD,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAC/C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,KACL,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,iBAAiB,GAAG,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,GAAG,IAAA,EAAK,IACrD,EAAE,GAAA,CAAI,MAAA,CAAO,WAAW,CAAA,IACxB,KAAA,CAAA;AACD,MAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,MAAA,CAAO,YAAY,CAAA,IAAK,KAAA,CAAA;AAChD,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,gBAAA;AAAA,QAC3B,KAAA;AAAA,QACA;AAAA,UACC,MAAA,EAAQ,OAAO,IAAA,CAAK,MAAA;AAAA,UACpB,QAAA,EAAU,OAAO,IAAA,CAAK,QAAA;AAAA,UACtB,SAAA,EAAW,OAAO,IAAA,CAAK;AAAA,SACxB;AAAA,QACA,EAAE,IAAI,SAAA;AAAU,OACjB;AACA,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,OAAA,GAAU,GAAA,GAAM,GAAA;AACtC,MAAA,MAAM,GAAA,GAAM,IAAI,QAAA,CAAS,IAAA,CAAK,UAAU,EAAE,IAAA,EAAM,MAAA,EAAQ,CAAA,EAAG;AAAA,QAC1D,MAAA;AAAA,QACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAC9C,CAAA;AACD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,4BAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,IAAA,CAAK,cAAA,EAAgB,OAAO,CAAA,KAAM;AACrC,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACH,MAAA,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACP,MAAA,MAAM,GAAA,GAAM,WAAW,mBAAmB,CAAA;AAC1C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,MAAA,GAAS,cAAA,CAAe,SAAA,CAAU,IAAI,CAAA;AAC5C,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,MAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,MAAA,CAAO,KAAA,CAAM,MAAM,CAAA;AAC/C,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,KAAA,GAAuB;AAAA,QAC5B,GAAG,MAAA,CAAO,IAAA;AAAA,QACV,WAAA,EAAa,OAAO,IAAA,CAAK;AAAA,OAC1B;AACA,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AACzC,MAAA,MAAM,GAAA,GAAM,QAAQ,KAAK,CAAA;AACzB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,6BAAA;AACrD,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AAClC,QAAA,MAAMA,IAAAA,GAAM,SAAS,OAAO,CAAA;AAC5B,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,IAAI,QAAQ,QAAA,CAAS,SAAS,KAAK,OAAA,CAAQ,QAAA,CAAS,OAAO,CAAA,EAAG;AAC7D,QAAA,MAAMA,IAAAA,GAAM,WAAW,OAAO,CAAA;AAC9B,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,MAAA,CAAO,kBAAA,EAAoB,OAAO,CAAA,KAAM;AAC3C,IAAA,MAAM,EAAA,GAAK,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,IAAI,CAAA;AAC3B,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,CAAO,UAAA,CAAW,MAAA,CAAO,EAAE,CAAA;AACjC,MAAA,OAAO,IAAI,QAAA,CAAS,IAAA,EAAM,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IAC1C,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,6BAAA;AACrD,MAAA,IAAI,OAAA,CAAQ,QAAA,CAAS,WAAW,CAAA,EAAG;AAClC,QAAA,MAAMA,IAAAA,GAAM,SAAS,OAAO,CAAA;AAC5B,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,uBAAA,EAAyB,OAAO,CAAA,KAAM;AAC7C,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW,WAAW,OAAO,CAAA;AACzD,MAAA,MAAM,GAAA,GAAM,GAAG,MAAM,CAAA;AACrB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,kCAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,GAAA,CAAI,QAAA,EAAU,OAAO,CAAA,KAAM;AAC9B,IAAA,MAAM,SAAsB,EAAC;AAE7B,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AAEnC,IAAA,IAAI,OAAA,SAAgB,OAAA,GAAU,OAAA;AAC9B,IAAA,IAAI,MAAA,SAAe,MAAA,GAAS,MAAA;AAC5B,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,IAAI,IAAA,CAAK,KAAK,CAAA;AACxB,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,SAAU,KAAA,GAAQ,CAAA;AAAA,IAChD;AACA,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,IAAI,IAAA,CAAK,KAAK,CAAA;AACxB,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,SAAU,KAAA,GAAQ,CAAA;AAAA,IAChD;AACA,IAAA,IAAI,OAAA,EAAS,MAAA,CAAO,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACpE,IAAA,IAAI,SAAA,KAAc,SAAA,IAAa,SAAA,KAAc,QAAA,IAAY,cAAc,cAAA,EAAgB;AACtF,MAAA,MAAA,CAAO,MAAA,GAAS,SAAA;AAAA,IACjB;AACA,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AACnC,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAC,KAAK,CAAA,GAAI,CAAA,SAAU,KAAA,GAAQ,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI,MAAA,EAAQ;AACX,MAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA;AACpC,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAC,KAAK,CAAA,IAAK,CAAA,SAAU,MAAA,GAAS,CAAA;AAAA,IACjD;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,KAAA,CAAM,MAAM,MAAM,CAAA;AAC/C,MAAA,MAAM,GAAA,GAAM,GAAG,OAAO,CAAA;AACtB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,4BAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,eAAA,EAAiB,OAAO,CAAA,KAAM;AACrC,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA,IAAK,MAAA;AACxC,IAAA,IAAI,MAAA,KAAW,MAAA,IAAU,MAAA,KAAW,KAAA,EAAO;AAC1C,MAAA,MAAM,GAAA,GAAM,WAAW,gCAAgC,CAAA;AACvD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAEA,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AAEjC,IAAA,MAAMC,QAAAA,GAAkE,EAAE,MAAA,EAAO;AACjF,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,IAAI,IAAA,CAAK,KAAK,CAAA;AACxB,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,EAAGA,QAAAA,CAAQ,KAAA,GAAQ,CAAA;AAAA,IACjD;AACA,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,IAAI,IAAA,CAAK,KAAK,CAAA;AACxB,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,EAAGA,QAAAA,CAAQ,KAAA,GAAQ,CAAA;AAAA,IACjD;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,KAAA,CAAM,OAAOA,QAAO,CAAA;AAClD,MAAA,MAAM,WAAA,GAAc,MAAA,KAAW,KAAA,GAAQ,UAAA,GAAa,kBAAA;AACpD,MAAA,OAAO,IAAI,SAAS,QAAA,EAAU;AAAA,QAC7B,MAAA,EAAQ,GAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACR,cAAA,EAAgB,WAAA;AAAA,UAChB,qBAAA,EAAuB,sCAAsC,MAAM,CAAA,CAAA;AAAA;AACpE,OACA,CAAA;AAAA,IACF,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,6BAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,OAAA,CAAQ,QAAA,EAAU,CAAC,EAAA,KAAO;AAC7B,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,kBAAkB,CAAA;AAAA,EACrE,CAAC,CAAA;AAED,EAAA,GAAA,CAAI,OAAA,CAAQ,gBAAA,EAAkB,CAAC,EAAA,KAAO;AACrC,IAAA,OAAO,IAAI,SAAS,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,OAAA,EAAS,kBAAkB,CAAA;AAAA,EACrE,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,yCAAA,EAA2C,CAAC,CAAA,KAAM;AACzD,IAAA,IAAI,CAAC,GAAA,EAAK;AACT,MAAA,MAAM,GAAA,GAAM,SAAS,2BAA2B,CAAA;AAChD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,QAAA,GAAW,IAAI,WAAA,EAAY;AACjC,IAAA,OAAO,CAAA,CAAE,YAAY,KAAA,CAAM,QAAQ,EAAE,IAAA,EAAM,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,EAC3D,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,uCAAA,EAAyC,CAAC,CAAA,KAAM;AACvD,IAAA,IAAI,CAAC,GAAA,EAAK;AACT,MAAA,MAAM,GAAA,GAAM,SAAS,2BAA2B,CAAA;AAChD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,MAAM,QAAA,GAAW,IAAI,4BAAA,EAA6B;AAClD,IAAA,OAAO,CAAA,CAAE,YAAY,KAAA,CAAM,QAAQ,EAAE,IAAA,EAAM,KAAA,CAAM,QAAQ,CAAC,CAAA;AAAA,EAC3D,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,IAAA,CAAK,eAAA,EAAiB,OAAO,CAAA,KAAM;AACtC,IAAA,IAAI,CAAC,GAAA,EAAK;AACT,MAAA,MAAM,GAAA,GAAM,SAAS,2BAA2B,CAAA;AAChD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI;AACH,MAAA,IAAA,GAAO,MAAM,CAAA,CAAE,GAAA,CAAI,IAAA,EAAK;AAAA,IACzB,CAAA,CAAA,MAAQ;AACP,MAAA,MAAM,GAAA,GAAM,QAAA,CAAS,iBAAA,EAAmB,mBAAA,EAAqB,GAAG,CAAA;AAChE,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,cAAA,CAAe,IAAgD,CAAA;AACxF,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,QAAA,MAAMD,OAAM,QAAA,CAAS,yBAAA,EAA2B,MAAA,CAAO,KAAA,CAAM,SAAS,GAAG,CAAA;AACzE,QAAA,OAAO,CAAA,CAAE,WAAA,CAAYA,IAAAA,CAAI,IAAA,EAAMA,IAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,IAAA,EAAM,GAAG,CAAA;AACvC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,qBAAA;AACrD,MAAA,MAAM,GAAA,GAAM,QAAA,CAAS,cAAA,EAAgB,OAAA,EAAS,GAAG,CAAA;AACjD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,gBAAA,EAAkB,OAAO,CAAA,KAAM;AACtC,IAAA,IAAI,CAAC,GAAA,EAAK;AACT,MAAA,MAAM,GAAA,GAAM,SAAS,2BAA2B,CAAA;AAChD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,SAAA,CAAU,CAAA,CAAE,IAAI,GAAG,CAAA;AAC5C,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,QAAA,IAAI,MAAA,CAAO,KAAA,CAAM,IAAA,KAAS,gBAAA,EAAkB;AAC3C,UAAA,MAAM,OAAA,GAAU,OAAO,KAAA,CAAM,OAAA;AAG7B,UAAA,IAAI,SAAS,SAAA,EAAW;AACvB,YAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,OAAA,CAAQ,SAAS,CAAA;AAC1C,YAAA,IAAI,QAAQ,QAAA,EAAU;AACrB,cAAA,QAAA,CAAS,YAAA,CAAa,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,QAAQ,CAAA;AAAA,YACvD;AACA,YAAA,OAAO,CAAA,CAAE,QAAA,CAAS,QAAA,CAAS,QAAA,IAAY,GAAG,CAAA;AAAA,UAC3C;AAAA,QACD;AACA,QAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,aAAY,EAAG,MAAA,CAAO,KAAA,CAAM,OAAA,EAAS,GAAG,CAAA;AAC/E,QAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,MACnC;AACA,MAAA,OAAO,CAAA,CAAE,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,aAAa,GAAG,CAAA;AAAA,IAC/C,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,sBAAA;AACrD,MAAA,MAAM,GAAA,GAAM,QAAA,CAAS,cAAA,EAAgB,OAAA,EAAS,GAAG,CAAA;AACjD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,IAAA,CAAK,YAAA,EAAc,OAAO,CAAA,KAAM;AACnC,IAAA,IAAI,CAAC,GAAA,EAAK;AACT,MAAA,MAAM,GAAA,GAAM,SAAS,2BAA2B,CAAA;AAChD,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AACA,IAAA,IAAI;AACH,MAAA,MAAM,SAAS,MAAM,GAAA,CAAI,KAAA,CAAM,CAAA,CAAE,IAAI,GAAG,CAAA;AACxC,MAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACpB,QAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,IAAA,KAAS,mBAAmB,GAAA,GAAM,GAAA;AAC9D,QAAA,MAAM,GAAA,GAAM,UAAA;AAAA,UACX;AAAA,YACC,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,IAAA,CAAK,WAAA,EAAY;AAAA,YACrC,iBAAA,EAAmB,OAAO,KAAA,CAAM;AAAA,WACjC;AAAA,UACA;AAAA,SACD;AACA,QAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,MACnC;AACA,MAAA,MAAM,UAAA,GAAa,UAAA,CAAW,MAAA,CAAO,IAAI,CAAA;AACzC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,UAAA,CAAW,IAAA,EAAM,UAAU,CAAA;AAAA,IACjD,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,uBAAA;AACrD,MAAA,MAAM,GAAA,GAAM,WAAW,EAAE,KAAA,EAAO,gBAAgB,iBAAA,EAAmB,OAAA,IAAW,GAAG,CAAA;AACjF,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAKD,EAAA,GAAA,CAAI,GAAA,CAAI,kBAAA,EAAoB,OAAO,CAAA,KAAM;AACxC,IAAA,IAAI;AACH,MAAA,MAAM,CAAC,MAAA,EAAQ,WAAW,CAAA,GAAI,MAAM,QAAQ,GAAA,CAAI;AAAA,QAC/C,MAAA,CAAO,MAAM,IAAA,EAAK;AAAA,QAClB,MAAA,CAAO,MAAM,KAAA,CAAM;AAAA,UAClB,KAAA,EAAO,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA;AAAA,UAChD,KAAA,EAAO;AAAA,SACP;AAAA,OACD,CAAA;AAED,MAAA,MAAM,QAAA,GAAW,IAAI,GAAA,CAAI,MAAA,CAAO,IAAI,CAAC,CAAA,KAAM,CAAA,CAAE,OAAO,CAAC,CAAA;AACrD,MAAA,MAAM,eAAe,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,QAAQ,CAAA;AAC/D,MAAA,MAAM,gBAAgB,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,SAAS,CAAA;AACjE,MAAA,MAAM,gBAAgB,MAAA,CAAO,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,WAAW,SAAS,CAAA;AAEjE,MAAA,MAAM,KAAA,GAAQ;AAAA,QACb,MAAA,EAAQ;AAAA,UACP,OAAO,MAAA,CAAO,MAAA;AAAA,UACd,QAAQ,YAAA,CAAa,MAAA;AAAA,UACrB,SAAS,aAAA,CAAc,MAAA;AAAA,UACvB,SAAS,aAAA,CAAc;AAAA,SACxB;AAAA,QACA,KAAA,EAAO;AAAA,UACN,OAAO,QAAA,CAAS;AAAA,SACjB;AAAA,QACA,KAAA,EAAO;AAAA,UACN,SAAS,WAAA,CAAY,MAAA;AAAA,UACrB,OAAA,EAAS,YAAY,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,SAAS,CAAA,CAAE,MAAA;AAAA,UAC3D,MAAA,EAAQ,YAAY,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,QAAQ,CAAA,CAAE,MAAA;AAAA,UACzD,WAAA,EAAa,YAAY,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,cAAc,CAAA,CAAE;AAAA;AACrE,OACD;AACA,MAAA,MAAM,GAAA,GAAM,GAAG,KAAK,CAAA;AACpB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,iCAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,mBAAA,EAAqB,OAAO,CAAA,KAAM;AACzC,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,MAAM,CAAA;AAElC,IAAA,MAAM,SAAsB,EAAC;AAC7B,IAAA,IAAI,MAAA,SAAe,MAAA,GAAS,MAAA;AAC5B,IAAA,IAAI,SAAA,KAAc,QAAA,IAAY,SAAA,KAAc,SAAA,IAAa,cAAc,SAAA,EAAW;AACjF,MAAA,MAAA,CAAO,MAAA,GAAS,SAAA;AAAA,IACjB;AACA,IAAA,IAAI,OAAA,KAAY,YAAA,IAAgB,OAAA,KAAY,WAAA,IAAe,YAAY,SAAA,EAAW;AACjF,MAAA,MAAA,CAAO,IAAA,GAAO,OAAA;AAAA,IACf;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,KAAA,CAAM,KAAK,MAAM,CAAA;AAC7C,MAAA,MAAM,GAAA,GAAM,GAAG,MAAM,CAAA;AACrB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,uBAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAGD,EAAA,GAAA,CAAI,GAAA,CAAI,kBAAA,EAAoB,OAAO,CAAA,KAAM;AACxC,IAAA,MAAM,SAAsB,EAAC;AAE7B,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACnC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,OAAA,GAAU,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,SAAS,CAAA;AACrC,IAAA,MAAM,SAAA,GAAY,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AACtC,IAAA,MAAM,KAAA,GAAQ,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,OAAO,CAAA;AACjC,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,GAAA,CAAI,KAAA,CAAM,QAAQ,CAAA;AAEnC,IAAA,IAAI,OAAA,SAAgB,OAAA,GAAU,OAAA;AAC9B,IAAA,IAAI,MAAA,SAAe,MAAA,GAAS,MAAA;AAC5B,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,IAAI,IAAA,CAAK,KAAK,CAAA;AACxB,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,SAAU,KAAA,GAAQ,CAAA;AAAA,IAChD;AACA,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,IAAI,IAAA,CAAK,KAAK,CAAA;AACxB,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAA,CAAE,SAAS,CAAA,SAAU,KAAA,GAAQ,CAAA;AAAA,IAChD;AACA,IAAA,IAAI,OAAA,EAAS,MAAA,CAAO,OAAA,GAAU,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA;AACpE,IAAA,IAAI,SAAA,KAAc,SAAA,IAAa,SAAA,KAAc,QAAA,IAAY,cAAc,cAAA,EAAgB;AACtF,MAAA,MAAA,CAAO,MAAA,GAAS,SAAA;AAAA,IACjB;AACA,IAAA,IAAI,KAAA,EAAO;AACV,MAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AACnC,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAC,KAAK,CAAA,GAAI,CAAA,SAAU,KAAA,GAAQ,CAAA;AAAA,IAC/C;AACA,IAAA,IAAI,MAAA,EAAQ;AACX,MAAA,MAAM,CAAA,GAAI,MAAA,CAAO,QAAA,CAAS,MAAA,EAAQ,EAAE,CAAA;AACpC,MAAA,IAAI,CAAC,OAAO,KAAA,CAAM,CAAC,KAAK,CAAA,IAAK,CAAA,SAAU,MAAA,GAAS,CAAA;AAAA,IACjD;AAEA,IAAA,IAAI;AACH,MAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,KAAA,CAAM,MAAM,MAAM,CAAA;AAC/C,MAAA,MAAM,GAAA,GAAM,GAAG,OAAO,CAAA;AACtB,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACb,MAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,4BAAA;AACrD,MAAA,MAAM,GAAA,GAAM,cAAc,OAAO,CAAA;AACjC,MAAA,OAAO,CAAA,CAAE,WAAA,CAAY,GAAA,CAAI,IAAA,EAAM,GAAG,CAAA;AAAA,IACnC;AAAA,EACD,CAAC,CAAA;AAED,EAAA,OAAO,GAAA;AACR","file":"index.js","sourcesContent":["import { Hono } from \"hono\";\nimport type {\n\tAgentFilter,\n\tAuditFilter,\n\tCreateAgentInput,\n\tDelegateInput,\n\tKavach,\n\tPermission,\n\tUpdateAgentInput,\n} from \"kavachos\";\nimport type { McpAuthModule } from \"kavachos/mcp\";\nimport { z } from \"zod\";\n\n// ─── Zod Validation Schemas ──────────────────────────────────────────────────\n\nconst PermissionConstraintsSchema = z.object({\n\tmaxCallsPerHour: z.number().int().positive().optional(),\n\tallowedArgPatterns: z.array(z.string()).optional(),\n\trequireApproval: z.boolean().optional(),\n\ttimeWindow: z\n\t\t.object({\n\t\t\tstart: z.string(),\n\t\t\tend: z.string(),\n\t\t})\n\t\t.optional(),\n\tipAllowlist: z.array(z.string()).optional(),\n});\n\nconst PermissionSchema = z.object({\n\tresource: z.string().min(1),\n\tactions: z.array(z.string().min(1)).min(1),\n\tconstraints: PermissionConstraintsSchema.optional(),\n});\n\nconst CreateAgentSchema = z.object({\n\townerId: z.string().min(1),\n\tname: z.string().min(1),\n\ttype: z.enum([\"autonomous\", \"delegated\", \"service\"]),\n\tpermissions: z.array(PermissionSchema).min(1),\n\texpiresAt: z.coerce.date().optional(),\n\tmetadata: z.record(z.unknown()).optional(),\n});\n\nconst UpdateAgentSchema = z.object({\n\tname: z.string().min(1).optional(),\n\tpermissions: z.array(PermissionSchema).optional(),\n\texpiresAt: z.coerce.date().optional(),\n\tmetadata: z.record(z.unknown()).optional(),\n});\n\nconst AuthorizeSchema = z.object({\n\tagentId: z.string().min(1),\n\taction: z.string().min(1),\n\tresource: z.string().min(1),\n\targuments: z.record(z.unknown()).optional(),\n});\n\nconst AuthorizeByTokenSchema = z.object({\n\taction: z.string().min(1),\n\tresource: z.string().min(1),\n\targuments: z.record(z.unknown()).optional(),\n});\n\nconst DelegateSchema = z.object({\n\tfromAgent: z.string().min(1),\n\ttoAgent: z.string().min(1),\n\tpermissions: z.array(PermissionSchema).min(1),\n\texpiresAt: z.coerce.date(),\n\tmaxDepth: z.number().int().positive().optional(),\n});\n\n// ─── Response Helpers ────────────────────────────────────────────────────────\n\nfunction ok<T>(data: T, status = 200) {\n\treturn new Response(JSON.stringify({ data }), {\n\t\tstatus,\n\t\theaders: { \"Content-Type\": \"application/json\" },\n\t});\n}\n\nfunction created<T>(data: T) {\n\treturn ok(data, 201);\n}\n\nfunction errorResponse(code: string, message: string, status: number) {\n\treturn new Response(JSON.stringify({ error: { code, message } }), {\n\t\tstatus,\n\t\theaders: { \"Content-Type\": \"application/json\" },\n\t});\n}\n\nfunction badRequest(message: string) {\n\treturn errorResponse(\"BAD_REQUEST\", message, 400);\n}\n\nfunction unauthorized(message = \"Unauthorized\") {\n\treturn errorResponse(\"UNAUTHORIZED\", message, 401);\n}\n\nfunction notFound(message = \"Not found\") {\n\treturn errorResponse(\"NOT_FOUND\", message, 404);\n}\n\nfunction internalError(message = \"Internal server error\") {\n\treturn errorResponse(\"INTERNAL_ERROR\", message, 500);\n}\n\nfunction validationError(issues: z.ZodIssue[]) {\n\tconst message = issues.map((i) => `${i.path.join(\".\")}: ${i.message}`).join(\", \");\n\treturn badRequest(`Validation failed: ${message}`);\n}\n\n// ─── MCP CORS Headers ────────────────────────────────────────────────────────\n\nconst MCP_CORS_HEADERS = {\n\t\"Access-Control-Allow-Origin\": \"*\",\n\t\"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n\t\"Access-Control-Allow-Headers\": \"Content-Type, Authorization\",\n\t\"Access-Control-Max-Age\": \"86400\",\n};\n\nfunction mcpOk<T>(data: T, status = 200) {\n\treturn new Response(JSON.stringify(data), {\n\t\tstatus,\n\t\theaders: { \"Content-Type\": \"application/json\", ...MCP_CORS_HEADERS },\n\t});\n}\n\nfunction mcpError(code: string, message: string, status: number) {\n\treturn new Response(JSON.stringify({ error: code, error_description: message }), {\n\t\tstatus,\n\t\theaders: { \"Content-Type\": \"application/json\", ...MCP_CORS_HEADERS },\n\t});\n}\n\nfunction mcpNoStore<T>(data: T, status = 200) {\n\treturn new Response(JSON.stringify(data), {\n\t\tstatus,\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t\"Cache-Control\": \"no-store\",\n\t\t\tPragma: \"no-cache\",\n\t\t\t...MCP_CORS_HEADERS,\n\t\t},\n\t});\n}\n\n// ─── Adapter Factory ─────────────────────────────────────────────────────────\n\n/**\n * Create a Hono app with all KavachOS REST API routes mounted.\n *\n * @example\n * ```typescript\n * import { createKavach } from 'kavachos';\n * import { kavachHono } from '@kavachos/hono';\n * import { serve } from '@hono/node-server';\n *\n * const kavach = createKavach({ database: { provider: 'sqlite', url: 'kavach.db' } });\n * const app = kavachHono(kavach);\n * serve({ fetch: app.fetch, port: 3000 });\n * ```\n *\n * With MCP OAuth 2.1:\n * ```typescript\n * import { createMcpModule } from 'kavachos/mcp';\n * const mcp = createMcpModule({ ... });\n * const app = kavachHono(kavach, { mcp });\n * ```\n */\nexport function kavachHono(kavach: Kavach, options?: { mcp?: McpAuthModule }): Hono {\n\tconst app = new Hono();\n\tconst mcp = options?.mcp;\n\n\t// ── Agent REST API ──────────────────────────────────────────────\n\n\t// POST /agents - create agent\n\tapp.post(\"/agents\", async (c) => {\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await c.req.json();\n\t\t} catch {\n\t\t\tconst res = badRequest(\"Invalid JSON body\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst parsed = CreateAgentSchema.safeParse(body);\n\t\tif (!parsed.success) {\n\t\t\tconst res = validationError(parsed.error.issues);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst input: CreateAgentInput = {\n\t\t\t\t...parsed.data,\n\t\t\t\tpermissions: parsed.data.permissions as Permission[],\n\t\t\t};\n\t\t\tconst agent = await kavach.agent.create(input);\n\t\t\tconst res = created(agent);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to create agent\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// GET /agents - list agents\n\tapp.get(\"/agents\", async (c) => {\n\t\tconst userId = c.req.query(\"userId\");\n\t\tconst statusRaw = c.req.query(\"status\");\n\t\tconst typeRaw = c.req.query(\"type\");\n\n\t\tconst filter: AgentFilter = {};\n\t\tif (userId) filter.userId = userId;\n\t\tif (statusRaw === \"active\" || statusRaw === \"revoked\" || statusRaw === \"expired\") {\n\t\t\tfilter.status = statusRaw;\n\t\t}\n\t\tif (typeRaw === \"autonomous\" || typeRaw === \"delegated\" || typeRaw === \"service\") {\n\t\t\tfilter.type = typeRaw;\n\t\t}\n\n\t\ttry {\n\t\t\tconst agents = await kavach.agent.list(filter);\n\t\t\tconst res = ok(agents);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to list agents\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// GET /agents/:id - get agent\n\tapp.get(\"/agents/:id\", async (c) => {\n\t\tconst id = c.req.param(\"id\");\n\t\ttry {\n\t\t\tconst agent = await kavach.agent.get(id);\n\t\t\tif (!agent) {\n\t\t\t\tconst res = notFound(`Agent \"${id}\" not found`);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst res = ok(agent);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to get agent\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// PATCH /agents/:id - update agent\n\tapp.patch(\"/agents/:id\", async (c) => {\n\t\tconst id = c.req.param(\"id\");\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await c.req.json();\n\t\t} catch {\n\t\t\tconst res = badRequest(\"Invalid JSON body\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst parsed = UpdateAgentSchema.safeParse(body);\n\t\tif (!parsed.success) {\n\t\t\tconst res = validationError(parsed.error.issues);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst input: UpdateAgentInput = {\n\t\t\t\t...parsed.data,\n\t\t\t\tpermissions: parsed.data.permissions as Permission[] | undefined,\n\t\t\t};\n\t\t\tconst agent = await kavach.agent.update(id, input);\n\t\t\tconst res = ok(agent);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to update agent\";\n\t\t\tif (message.includes(\"not found\")) {\n\t\t\t\tconst res = notFound(message);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// DELETE /agents/:id - revoke agent\n\tapp.delete(\"/agents/:id\", async (c) => {\n\t\tconst id = c.req.param(\"id\");\n\t\ttry {\n\t\t\tawait kavach.agent.revoke(id);\n\t\t\treturn new Response(null, { status: 204 });\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to revoke agent\";\n\t\t\tif (message.includes(\"not found\")) {\n\t\t\t\tconst res = notFound(message);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// POST /agents/:id/rotate - rotate token\n\tapp.post(\"/agents/:id/rotate\", async (c) => {\n\t\tconst id = c.req.param(\"id\");\n\t\ttry {\n\t\t\tconst agent = await kavach.agent.rotate(id);\n\t\t\tconst res = ok(agent);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to rotate agent token\";\n\t\t\tif (message.includes(\"not found\")) {\n\t\t\t\tconst res = notFound(message);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// ── Authorization ───────────────────────────────────────────────\n\n\t// POST /authorize - authorize action by agentId\n\tapp.post(\"/authorize\", async (c) => {\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await c.req.json();\n\t\t} catch {\n\t\t\tconst res = badRequest(\"Invalid JSON body\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst parsed = AuthorizeSchema.safeParse(body);\n\t\tif (!parsed.success) {\n\t\t\tconst res = validationError(parsed.error.issues);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst ip =\n\t\t\t\tc.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n\t\t\t\tc.req.header(\"x-real-ip\") ??\n\t\t\t\tundefined;\n\t\t\tconst userAgent = c.req.header(\"user-agent\") ?? undefined;\n\t\t\tconst result = await kavach.authorize(\n\t\t\t\tparsed.data.agentId,\n\t\t\t\t{\n\t\t\t\t\taction: parsed.data.action,\n\t\t\t\t\tresource: parsed.data.resource,\n\t\t\t\t\targuments: parsed.data.arguments,\n\t\t\t\t},\n\t\t\t\t{ ip, userAgent },\n\t\t\t);\n\t\t\tconst status = result.allowed ? 200 : 403;\n\t\t\tconst res = new Response(JSON.stringify({ data: result }), {\n\t\t\t\tstatus,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\t});\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Authorization check failed\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// POST /authorize/token - authorize by bearer token\n\tapp.post(\"/authorize/token\", async (c) => {\n\t\tconst authHeader = c.req.header(\"Authorization\");\n\t\tif (!authHeader?.startsWith(\"Bearer \")) {\n\t\t\tconst res = unauthorized(\"Missing or invalid Authorization header\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst token = authHeader.slice(7);\n\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await c.req.json();\n\t\t} catch {\n\t\t\tconst res = badRequest(\"Invalid JSON body\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst parsed = AuthorizeByTokenSchema.safeParse(body);\n\t\tif (!parsed.success) {\n\t\t\tconst res = validationError(parsed.error.issues);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst ip =\n\t\t\t\tc.req.header(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ??\n\t\t\t\tc.req.header(\"x-real-ip\") ??\n\t\t\t\tundefined;\n\t\t\tconst userAgent = c.req.header(\"user-agent\") ?? undefined;\n\t\t\tconst result = await kavach.authorizeByToken(\n\t\t\t\ttoken,\n\t\t\t\t{\n\t\t\t\t\taction: parsed.data.action,\n\t\t\t\t\tresource: parsed.data.resource,\n\t\t\t\t\targuments: parsed.data.arguments,\n\t\t\t\t},\n\t\t\t\t{ ip, userAgent },\n\t\t\t);\n\t\t\tconst status = result.allowed ? 200 : 403;\n\t\t\tconst res = new Response(JSON.stringify({ data: result }), {\n\t\t\t\tstatus,\n\t\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\t});\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Authorization check failed\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// ── Delegation ──────────────────────────────────────────────────\n\n\t// POST /delegations - create delegation\n\tapp.post(\"/delegations\", async (c) => {\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await c.req.json();\n\t\t} catch {\n\t\t\tconst res = badRequest(\"Invalid JSON body\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst parsed = DelegateSchema.safeParse(body);\n\t\tif (!parsed.success) {\n\t\t\tconst res = validationError(parsed.error.issues);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst input: DelegateInput = {\n\t\t\t\t...parsed.data,\n\t\t\t\tpermissions: parsed.data.permissions as Permission[],\n\t\t\t};\n\t\t\tconst chain = await kavach.delegate(input);\n\t\t\tconst res = created(chain);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to create delegation\";\n\t\t\tif (message.includes(\"not found\")) {\n\t\t\t\tconst res = notFound(message);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tif (message.includes(\"exceeds\") || message.includes(\"depth\")) {\n\t\t\t\tconst res = badRequest(message);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// DELETE /delegations/:id - revoke delegation\n\tapp.delete(\"/delegations/:id\", async (c) => {\n\t\tconst id = c.req.param(\"id\");\n\t\ttry {\n\t\t\tawait kavach.delegation.revoke(id);\n\t\t\treturn new Response(null, { status: 204 });\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to revoke delegation\";\n\t\t\tif (message.includes(\"not found\")) {\n\t\t\t\tconst res = notFound(message);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// GET /delegations/:agentId - list chains for agent\n\tapp.get(\"/delegations/:agentId\", async (c) => {\n\t\tconst agentId = c.req.param(\"agentId\");\n\t\ttry {\n\t\t\tconst chains = await kavach.delegation.listChains(agentId);\n\t\t\tconst res = ok(chains);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to list delegation chains\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// ── Audit ───────────────────────────────────────────────────────\n\n\t// GET /audit - query audit logs\n\tapp.get(\"/audit\", async (c) => {\n\t\tconst filter: AuditFilter = {};\n\n\t\tconst agentId = c.req.query(\"agentId\");\n\t\tconst userId = c.req.query(\"userId\");\n\t\tconst since = c.req.query(\"since\");\n\t\tconst until = c.req.query(\"until\");\n\t\tconst actions = c.req.query(\"actions\");\n\t\tconst resultRaw = c.req.query(\"result\");\n\t\tconst limit = c.req.query(\"limit\");\n\t\tconst offset = c.req.query(\"offset\");\n\n\t\tif (agentId) filter.agentId = agentId;\n\t\tif (userId) filter.userId = userId;\n\t\tif (since) {\n\t\t\tconst d = new Date(since);\n\t\t\tif (!Number.isNaN(d.getTime())) filter.since = d;\n\t\t}\n\t\tif (until) {\n\t\t\tconst d = new Date(until);\n\t\t\tif (!Number.isNaN(d.getTime())) filter.until = d;\n\t\t}\n\t\tif (actions) filter.actions = actions.split(\",\").map((a) => a.trim());\n\t\tif (resultRaw === \"allowed\" || resultRaw === \"denied\" || resultRaw === \"rate_limited\") {\n\t\t\tfilter.result = resultRaw;\n\t\t}\n\t\tif (limit) {\n\t\t\tconst n = Number.parseInt(limit, 10);\n\t\t\tif (!Number.isNaN(n) && n > 0) filter.limit = n;\n\t\t}\n\t\tif (offset) {\n\t\t\tconst n = Number.parseInt(offset, 10);\n\t\t\tif (!Number.isNaN(n) && n >= 0) filter.offset = n;\n\t\t}\n\n\t\ttry {\n\t\t\tconst entries = await kavach.audit.query(filter);\n\t\t\tconst res = ok(entries);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to query audit logs\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// GET /audit/export - export audit logs\n\tapp.get(\"/audit/export\", async (c) => {\n\t\tconst format = c.req.query(\"format\") ?? \"json\";\n\t\tif (format !== \"json\" && format !== \"csv\") {\n\t\t\tconst res = badRequest('format must be \"json\" or \"csv\"');\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\n\t\tconst since = c.req.query(\"since\");\n\t\tconst until = c.req.query(\"until\");\n\n\t\tconst options: { format: \"json\" | \"csv\"; since?: Date; until?: Date } = { format };\n\t\tif (since) {\n\t\t\tconst d = new Date(since);\n\t\t\tif (!Number.isNaN(d.getTime())) options.since = d;\n\t\t}\n\t\tif (until) {\n\t\t\tconst d = new Date(until);\n\t\t\tif (!Number.isNaN(d.getTime())) options.until = d;\n\t\t}\n\n\t\ttry {\n\t\t\tconst exported = await kavach.audit.export(options);\n\t\t\tconst contentType = format === \"csv\" ? \"text/csv\" : \"application/json\";\n\t\t\treturn new Response(exported, {\n\t\t\t\tstatus: 200,\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": contentType,\n\t\t\t\t\t\"Content-Disposition\": `attachment; filename=\"audit-export.${format}\"`,\n\t\t\t\t},\n\t\t\t});\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to export audit logs\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// ── MCP OAuth 2.1 Endpoints ─────────────────────────────────────\n\n\t// OPTIONS preflight for MCP routes\n\tapp.options(\"/mcp/*\", (_c) => {\n\t\treturn new Response(null, { status: 204, headers: MCP_CORS_HEADERS });\n\t});\n\n\tapp.options(\"/.well-known/*\", (_c) => {\n\t\treturn new Response(null, { status: 204, headers: MCP_CORS_HEADERS });\n\t});\n\n\t// GET /.well-known/oauth-authorization-server\n\tapp.get(\"/.well-known/oauth-authorization-server\", (c) => {\n\t\tif (!mcp) {\n\t\t\tconst res = notFound(\"MCP module not configured\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst metadata = mcp.getMetadata();\n\t\treturn c.newResponse(mcpOk(metadata).body, mcpOk(metadata));\n\t});\n\n\t// GET /.well-known/oauth-protected-resource\n\tapp.get(\"/.well-known/oauth-protected-resource\", (c) => {\n\t\tif (!mcp) {\n\t\t\tconst res = notFound(\"MCP module not configured\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tconst metadata = mcp.getProtectedResourceMetadata();\n\t\treturn c.newResponse(mcpOk(metadata).body, mcpOk(metadata));\n\t});\n\n\t// POST /mcp/register - dynamic client registration\n\tapp.post(\"/mcp/register\", async (c) => {\n\t\tif (!mcp) {\n\t\t\tconst res = notFound(\"MCP module not configured\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\tlet body: unknown;\n\t\ttry {\n\t\t\tbody = await c.req.json();\n\t\t} catch {\n\t\t\tconst res = mcpError(\"invalid_request\", \"Invalid JSON body\", 400);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst result = await mcp.registerClient(body as Parameters<typeof mcp.registerClient>[0]);\n\t\t\tif (!result.success) {\n\t\t\t\tconst res = mcpError(\"invalid_client_metadata\", result.error.message, 400);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst res = mcpNoStore(result.data, 201);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Registration failed\";\n\t\t\tconst res = mcpError(\"server_error\", message, 500);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// GET /mcp/authorize - authorization endpoint\n\tapp.get(\"/mcp/authorize\", async (c) => {\n\t\tif (!mcp) {\n\t\t\tconst res = notFound(\"MCP module not configured\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst result = await mcp.authorize(c.req.raw);\n\t\t\tif (!result.success) {\n\t\t\t\tif (result.error.code === \"LOGIN_REQUIRED\") {\n\t\t\t\t\tconst details = result.error.details as\n\t\t\t\t\t\t| { loginPage?: string; returnTo?: string }\n\t\t\t\t\t\t| undefined;\n\t\t\t\t\tif (details?.loginPage) {\n\t\t\t\t\t\tconst loginUrl = new URL(details.loginPage);\n\t\t\t\t\t\tif (details.returnTo) {\n\t\t\t\t\t\t\tloginUrl.searchParams.set(\"returnTo\", details.returnTo);\n\t\t\t\t\t\t}\n\t\t\t\t\t\treturn c.redirect(loginUrl.toString(), 302);\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tconst res = mcpError(result.error.code.toLowerCase(), result.error.message, 400);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\treturn c.redirect(result.data.redirectUri, 302);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Authorization failed\";\n\t\t\tconst res = mcpError(\"server_error\", message, 500);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// POST /mcp/token - token endpoint\n\tapp.post(\"/mcp/token\", async (c) => {\n\t\tif (!mcp) {\n\t\t\tconst res = notFound(\"MCP module not configured\");\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t\ttry {\n\t\t\tconst result = await mcp.token(c.req.raw);\n\t\t\tif (!result.success) {\n\t\t\t\tconst status = result.error.code === \"INVALID_CLIENT\" ? 401 : 400;\n\t\t\t\tconst res = mcpNoStore(\n\t\t\t\t\t{\n\t\t\t\t\t\terror: result.error.code.toLowerCase(),\n\t\t\t\t\t\terror_description: result.error.message,\n\t\t\t\t\t},\n\t\t\t\t\tstatus,\n\t\t\t\t);\n\t\t\t\treturn c.newResponse(res.body, res);\n\t\t\t}\n\t\t\tconst successRes = mcpNoStore(result.data);\n\t\t\treturn c.newResponse(successRes.body, successRes);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Token exchange failed\";\n\t\t\tconst res = mcpNoStore({ error: \"server_error\", error_description: message }, 500);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// ── Dashboard API ───────────────────────────────────────────────\n\n\t// GET /dashboard/stats\n\tapp.get(\"/dashboard/stats\", async (c) => {\n\t\ttry {\n\t\t\tconst [agents, recentAudit] = await Promise.all([\n\t\t\t\tkavach.agent.list(),\n\t\t\t\tkavach.audit.query({\n\t\t\t\t\tsince: new Date(Date.now() - 24 * 60 * 60 * 1000),\n\t\t\t\t\tlimit: 1000,\n\t\t\t\t}),\n\t\t\t]);\n\n\t\t\tconst ownerIds = new Set(agents.map((a) => a.ownerId));\n\t\t\tconst activeAgents = agents.filter((a) => a.status === \"active\");\n\t\t\tconst revokedAgents = agents.filter((a) => a.status === \"revoked\");\n\t\t\tconst expiredAgents = agents.filter((a) => a.status === \"expired\");\n\n\t\t\tconst stats = {\n\t\t\t\tagents: {\n\t\t\t\t\ttotal: agents.length,\n\t\t\t\t\tactive: activeAgents.length,\n\t\t\t\t\trevoked: revokedAgents.length,\n\t\t\t\t\texpired: expiredAgents.length,\n\t\t\t\t},\n\t\t\t\tusers: {\n\t\t\t\t\ttotal: ownerIds.size,\n\t\t\t\t},\n\t\t\t\taudit: {\n\t\t\t\t\tlast24h: recentAudit.length,\n\t\t\t\t\tallowed: recentAudit.filter((e) => e.result === \"allowed\").length,\n\t\t\t\t\tdenied: recentAudit.filter((e) => e.result === \"denied\").length,\n\t\t\t\t\trateLimited: recentAudit.filter((e) => e.result === \"rate_limited\").length,\n\t\t\t\t},\n\t\t\t};\n\t\t\tconst res = ok(stats);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to fetch dashboard stats\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// GET /dashboard/agents - agents with stats\n\tapp.get(\"/dashboard/agents\", async (c) => {\n\t\tconst userId = c.req.query(\"userId\");\n\t\tconst statusRaw = c.req.query(\"status\");\n\t\tconst typeRaw = c.req.query(\"type\");\n\n\t\tconst filter: AgentFilter = {};\n\t\tif (userId) filter.userId = userId;\n\t\tif (statusRaw === \"active\" || statusRaw === \"revoked\" || statusRaw === \"expired\") {\n\t\t\tfilter.status = statusRaw;\n\t\t}\n\t\tif (typeRaw === \"autonomous\" || typeRaw === \"delegated\" || typeRaw === \"service\") {\n\t\t\tfilter.type = typeRaw;\n\t\t}\n\n\t\ttry {\n\t\t\tconst agents = await kavach.agent.list(filter);\n\t\t\tconst res = ok(agents);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to list agents\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\t// GET /dashboard/audit - same as GET /audit\n\tapp.get(\"/dashboard/audit\", async (c) => {\n\t\tconst filter: AuditFilter = {};\n\n\t\tconst agentId = c.req.query(\"agentId\");\n\t\tconst userId = c.req.query(\"userId\");\n\t\tconst since = c.req.query(\"since\");\n\t\tconst until = c.req.query(\"until\");\n\t\tconst actions = c.req.query(\"actions\");\n\t\tconst resultRaw = c.req.query(\"result\");\n\t\tconst limit = c.req.query(\"limit\");\n\t\tconst offset = c.req.query(\"offset\");\n\n\t\tif (agentId) filter.agentId = agentId;\n\t\tif (userId) filter.userId = userId;\n\t\tif (since) {\n\t\t\tconst d = new Date(since);\n\t\t\tif (!Number.isNaN(d.getTime())) filter.since = d;\n\t\t}\n\t\tif (until) {\n\t\t\tconst d = new Date(until);\n\t\t\tif (!Number.isNaN(d.getTime())) filter.until = d;\n\t\t}\n\t\tif (actions) filter.actions = actions.split(\",\").map((a) => a.trim());\n\t\tif (resultRaw === \"allowed\" || resultRaw === \"denied\" || resultRaw === \"rate_limited\") {\n\t\t\tfilter.result = resultRaw;\n\t\t}\n\t\tif (limit) {\n\t\t\tconst n = Number.parseInt(limit, 10);\n\t\t\tif (!Number.isNaN(n) && n > 0) filter.limit = n;\n\t\t}\n\t\tif (offset) {\n\t\t\tconst n = Number.parseInt(offset, 10);\n\t\t\tif (!Number.isNaN(n) && n >= 0) filter.offset = n;\n\t\t}\n\n\t\ttry {\n\t\t\tconst entries = await kavach.audit.query(filter);\n\t\t\tconst res = ok(entries);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t} catch (err) {\n\t\t\tconst message = err instanceof Error ? err.message : \"Failed to query audit logs\";\n\t\t\tconst res = internalError(message);\n\t\t\treturn c.newResponse(res.body, res);\n\t\t}\n\t});\n\n\treturn app;\n}\n"]}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "@kavachos/hono",
+  "version": "0.0.2",
+  "description": "Hono adapter for KavachOS - exposes agent auth as HTTP REST endpoints",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "keywords": [
+    "kavachos",
+    "hono",
+    "auth",
+    "agent",
+    "mcp"
+  ],
+  "author": "KavachOS <hello@kavachos.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/kavachos/kavachos.git",
+    "directory": "packages/adapters/hono"
+  },
+  "peerDependencies": {
+    "hono": ">=4.0.0",
+    "zod": ">=3.0.0",
+    "kavachos": "0.0.2"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.13",
+    "better-sqlite3": "^11.0.0",
+    "hono": "^4.7.0",
+    "tsup": "^8.4.0",
+    "typescript": "^5.8.0",
+    "vitest": "^3.0.0",
+    "zod": "^3.24.0",
+    "kavachos": "0.0.2"
+  },
+  "scripts": {
+    "build": "tsup",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest watch"
+  }
+}