@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,72 @@
+export { createApp } from './app.js';
+export type { CreateAppInput, OpenApiConfig, ScalarDocsConfig, SessionConfig, } from './app.js';
+export type { AppEnv } from './types.js';
+export { SESSION_TOKEN_PREFIX, encodeSessionToken, MULTI_TENANT_LOOKUP, } from './middleware/auth.js';
+export type { TokenResolution, TokenResolver } from './middleware/auth.js';
+export type { ClaimMappingScopesSpec, ClaimMappingSpec, IdentityProviderBinding, IdentityProviderGetInput, IdentityProviderKind, IdentityProviderListInput, IdentityProviderPage, IdentityProviderRegisterInput, IdentityProviderRegisterOutcome, IdentityProviderUnregisterInput, IdentityProviderUnregisterOutcome, ProviderConfig, ExchangeCodeFn, ExchangeCodeInput, ExchangeCodeOutcome, RefreshTokenFn, RefreshTokenInput, } from './identity-provider-binding.js';
+export type { Session, SessionCreateInput, SessionCreateOutput, SessionGetInput, SessionListInput, SessionPage, SessionRevokeAllForUserInput, SessionRevokeAllForUserOutcome, SessionRevokeInput, SessionRevokeOutcome, SessionStoreBinding, SessionTouchInput, SessionTouchOutcome, } from './session-store-binding.js';
+export type { IdentityDirectoryBinding, IdentityGetUserInput, IdentityListSessionsInput, IdentityListUsersInput, IdentityRevokeSessionsInput, RevokeSessionsResult, SessionSummary, SessionSummaryPage, UserCollectionPage, UserRecord, } from './identity-directory-binding.js';
+export { createInMemoryOauthStateStore } from './state-store-binding.js';
+export type { OauthStateEntry, OauthStateStore, OauthStateTakeInput, } from './state-store-binding.js';
+export { createInMemoryIdempotencyStore, idempotencyMiddleware, } from './middleware/idempotency.js';
+export type { IdempotencyStore, StoredIdempotencyEntry } from './middleware/idempotency.js';
+export { CURRENT_EVENT_BUS_ENVELOPE_VERSION } from './event-bus-binding.js';
+export type { EventBusBinding, EventBusError, EventPayload, SubscribeOptions, Subscription, } from './event-bus-binding.js';
+export { API_TOKEN_ROLES, type ApiTokenRecord, type ApiTokenRole, type TokenAdmin, type TokenGetInput, type TokenListInput, type TokenMintInput, type TokenMintOutput, type TokenRevokeInput, type TokenRevokeOutcome, } from './token-admin.js';
+export type { InvokeAgentBindingInput, InvokeFlowBindingInput, RunHandlerBinding, RunHandlerFailure, RunHandlerOutcome, } from './handler-binding.js';
+export type { ReviewerBinding, ReviewerGetInput, ReviewerListInput, ReviewerLookupInput, ReviewerPage, ReviewerRecord, ReviewerRegisterInput, ReviewerRegisterOutcome, ReviewerRegistryBinding, ReviewerUnregisterInput, ReviewerUnregisterOutcome, } from './reviewer-binding.js';
+export type { Approval, ApprovalStatus, HitlBinding, HitlBindingError, ListApprovalsBindingInput, ListApprovalsBindingResult, ReviewDecision, ReviewDecisionKind, ReviewDecisionRecord, SubmitReviewBindingInput, SubmitReviewBindingResult, } from './hitl-binding.js';
+export type { BlobDeleteOutcome, BlobError, BlobFilter, BlobListPage, BlobMeta, BlobPutInput, BlobRead, BlobStorageBinding, MultipartInitiateInput, MultipartListPartsPage, S3ListPage, } from '@kindgi/blob-binding';
+export type { S3Credential, S3CredentialBinding } from './s3-credential-binding.js';
+export { ADAPTER_KINDS, ADAPTER_STATUSES, } from './adapter-binding.js';
+export type { AdapterGetInput, AdapterInfo, AdapterKind, AdapterListFilter, AdapterListInput, AdapterPage, AdapterRegistryBinding, AdapterStatus, AdapterTestInput, AdapterTestOutcome, } from './adapter-binding.js';
+export { TRIGGER_KINDS } from './trigger-binding.js';
+export { DEFAULT_PUBLIC_RUN_TOKEN_TTL_SECONDS, MAX_PUBLIC_RUN_TOKEN_RUNS, MAX_PUBLIC_RUN_TOKEN_TTL_SECONDS, PUBLIC_RUN_TOKEN_PREFIX, mintPublicRunToken, verifyPublicRunToken, } from './public-run-token.js';
+export type { MintPublicRunTokenInput, MintPublicRunTokenResult, PublicRunTokenClaims, PublicRunTokenConfig, VerifyPublicRunTokenFailure, VerifyPublicRunTokenResult, } from './public-run-token.js';
+export { WEBHOOK_DELIVERY_STATUSES, WEBHOOK_EVENT_TYPES, } from './webhook-endpoint-binding.js';
+export type { FinishedRun, RunFinishedEvent, WebhookDelivery, WebhookDeliveryListInput, WebhookDeliveryListOutcome, WebhookDeliveryOutcome, WebhookDeliveryRef, WebhookDeliveryStatus, WebhookEndpoint, WebhookEndpointBinding, WebhookEndpointCreateInput, WebhookEndpointCreateOutcome, WebhookEndpointFilter, WebhookEndpointListInput, WebhookEndpointPage, WebhookEndpointRef, WebhookEndpointRefusal, WebhookEndpointUpdateInput, WebhookEndpointUpdateOutcome, WebhookEvent, WebhookEventType, WebhookSecretRef, WebhookTestEvent, } from './webhook-endpoint-binding.js';
+export type { CronTriggerRecord, EventTriggerRecord, GetTriggerInput, ListTriggersInput, RegisterCronTriggerInput, RegisterEventTriggerInput, RegisterTriggerError, RegisterTriggerInput, RegisterWebhookTriggerInput, TriggerKind, TriggerLifecycleError, TriggerLifecycleInput, TriggerListPage, TriggerRecord, TriggerRegistryBinding, UpdateCronTriggerInput, UpdateEventTriggerInput, UpdateTriggerError, UpdateTriggerInput, UpdateWebhookTriggerInput, WebhookTriggerRecord, } from './trigger-binding.js';
+export type { AgentGetInput, AgentGetVersionInput, AgentListInput, AgentListVersionsInput, AgentPage, AgentPublishInput, AgentPublishOutcome, AgentRegistryBinding, AgentReinstateVersionInput, AgentReinstateVersionOutcome, AgentUnregisterInput, AgentUnregisterOutcome, } from './agent-binding.js';
+export type { FlowGetInput, FlowGetVersionInput, FlowListInput, FlowListVersionsInput, FlowPage, FlowPublishInput, FlowPublishOutcome, FlowRegistryBinding, FlowReinstateVersionInput, FlowReinstateVersionOutcome, FlowUnregisterInput, FlowUnregisterOutcome, } from './flow-binding.js';
+export type { CapabilityDescriptor, CapabilityGetInput, CapabilityListInput, CapabilityPage, CapabilityRegistryBinding, } from './capability-binding.js';
+export type { ProviderCapabilitiesForInput, ProviderGetInput, ProviderListInput, ProviderPage, ProviderRegisterInput, ProviderRegisterOutcome, ProviderRegistryBinding, ProviderResolveForRuntimeInput, ProviderRuntimeEntry, ProviderSecretRef, ProviderUnregisterInput, ProviderUnregisterOutcome, } from './provider-binding.js';
+export { MCP_TRANSPORTS } from './mcp-endpoint-binding.js';
+export type { MCPClientProbeBinding, MCPClientProbeInput, MCPEndpoint, MCPEndpointConfig, MCPEndpointGetInput, MCPEndpointListInput, MCPEndpointPage, MCPEndpointRegisterInput, MCPEndpointRegisterOutcome, MCPEndpointRegistryBinding, MCPEndpointUnregisterInput, MCPEndpointUnregisterOutcome, MCPGetPromptOutcome, MCPHttpSseConfig, MCPListPromptsOutcome, MCPListResourcesOutcome, MCPPromptArgument, MCPPromptDescriptor, MCPPromptMessage, MCPReadResourceOutcome, MCPResourceContent, MCPResourceDescriptor, MCPEndpointSecretRef, MCPStdioConfig, MCPStreamableHttpConfig, MCPTransport, } from './mcp-endpoint-binding.js';
+export { TENANT_HOST_ACCESS_LEVELS, deniesHostReach, parseTenantHostAccess, stdioRefusal, } from './tenant-host-access.js';
+export type { HostReach, TenantHostAccess } from './tenant-host-access.js';
+export { POLICY_KINDS } from '@kindgi/policy-contract';
+export type { Policy, PolicyGetInput, PolicyGetVersionInput, PolicyKind, PolicyListInput, PolicyListVersionsInput, PolicyPage, PolicyPublishInput, PolicyPublishOutcome, PolicyRegistryBinding, PolicyReinstateVersionInput, PolicyReinstateVersionOutcome, PolicyUnregisterInput, PolicyUnregisterOutcome, PolicyVersionPage, PolicyVersionRow, } from '@kindgi/policy-contract';
+export { EVAL_KINDS } from './eval-suite-binding.js';
+export type { EvalKind, EvalSuite, EvalSuiteGetInput, EvalSuiteGetVersionInput, EvalSuiteListInput, EvalSuiteListVersionsInput, EvalSuitePage, EvalSuitePublishInput, EvalSuitePublishOutcome, EvalSuiteRegistryBinding, EvalSuiteReinstateVersionInput, EvalSuiteReinstateVersionOutcome, EvalSuiteUnregisterInput, EvalSuiteUnregisterOutcome, } from './eval-suite-binding.js';
+export { EVAL_RUN_STATUSES } from './eval-run-binding.js';
+export type { AgentRef, EvalRun, EvalRunBinding, EvalRunCancelInput, EvalRunCancelOutcome, EvalRunFilter, EvalRunGetInput, EvalRunListInput, EvalRunPage, EvalRunStartInput, EvalRunStartOutcome, EvalRunStatus, FlowRef, } from './eval-run-binding.js';
+export { createAccuracyDispatcher, createInProcessEvalRunBinding, } from './eval-run-dispatcher.js';
+export type { AccuracyDispatcherOptions, DispatchContext, DispatchResult, EvalCase, EvalGrader, EvalGraderInput, EvalGraderOutcome, EvalRunDispatcher, EvalRunSubjectInvokeInput, EvalRunSubjectInvokeOutcome, EvalSubjectInvoker, InProcessEvalRunBindingOptions, } from './eval-run-dispatcher.js';
+export { COST_GROUP_DIMENSIONS } from './cost-binding.js';
+export type { CostAggregateGroup, CostAggregateInput, CostAggregateResult, CostBinding, CostGetRecordInput, CostGroupDimension, CostListRecordsInput, CostRecord, CostRecordFilter, CostRecordPage, } from './cost-binding.js';
+export type { ToolGetInput, ToolGetVersionInput, ToolListInput, ToolListVersionsInput, ToolPage, ToolPublishInput, ToolPublishOutcome, ToolRegistryBinding, ToolReinstateVersionInput, ToolReinstateVersionOutcome, ToolResolveInput, ToolResolveOutcome, ToolUnregisterInput, ToolUnregisterOutcome, ToolVersionPage, } from './tool-binding.js';
+export type { GuardrailGetInput, GuardrailListInput, GuardrailPage, GuardrailRegisterInput, GuardrailRegisterOutcome, GuardrailRegistryBinding, GuardrailUnregisterInput, GuardrailUnregisterOutcome, } from './guardrail-binding.js';
+export type { MemoryBinding, MemoryFactPage, MemoryGetFactInput, MemoryListFactsInput, MemoryRetrievalHit, MemoryRetrieveInput, MemoryRetrieveIntent, MemoryRetrieveOutcome, MemorySupersedeFactInput, MemorySupersedeFactOutcome, MemoryWriteFactInput, MemoryWriteFactOutcome, } from './memory-binding.js';
+export type { SupervisorApplyOutcome, SupervisorApplyProposalInput, SupervisorBinding, SupervisorDraftOutcome, SupervisorDraftProposalInput, SupervisorDryRunOutcome, SupervisorDryRunProposalInput, SupervisorGetProposalInput, SupervisorListProposalsInput, SupervisorProposalPage, SupervisorRollbackOutcome, SupervisorRollbackProposalInput, SupervisorSubmitReviewInput, SupervisorSubmitReviewOutcome, SupervisorWithdrawOutcome, SupervisorWithdrawProposalInput, } from './supervisor-binding.js';
+export type { FixProposal, FixProposalStatus, Observation, ObservationStatus, ObservedViolation, PassCriterion, PatternKind, PatternRef, PromptChange, ProposedChange, RetrievalChange, RetrievalIntentShape, SupervisorObservationPage, SupervisorQueryObservationsInput, SupervisorQueryObservationsOutcome, ToolConfigChange, } from './supervisor-binding.js';
+export type { Deployment, DeploymentBinding, DeploymentGetByImageDigestInput, DeploymentGetInput, DeploymentListInput, DeploymentPage, DeployedPrimitive, DeploymentContents, DeploymentPrimitiveCounts, DeploymentRegisterInput, DeploymentRegisterOutcome, } from './deployment-binding.js';
+export type { ImageBlobDescriptor, ImageDescriptor, ImageExtractFileInput, ImageFile, ImageHeadInput, ImageLayerDescriptor, ImagePlatform, ImagePushInput, ImagePushOutcome, ImageRegistryBinding, ImageRegistryError, } from './image-registry-binding.js';
+export type { AddTrustedInput, AddTrustedOutcome, GetTrustedInput, IsTrustedInput, ListTrustedInput, RevokeTrustedInput, RevokeTrustedOutcome, SigningKeyBinding, SigningKeyError, TrustedKey, TrustedKeyPage, VerifyInput, VerifyOutcome, } from './signing-key-binding.js';
+export type { EnvBinding, EnvDeleteInput, EnvDeleteOutcome, EnvError, EnvGetInput, EnvListInput, EnvListPage, EnvRecord, EnvResolveInput, EnvResolveOutcome, EnvSetInput, EnvSetOutcome, ResolveContext, } from './env-binding.js';
+export type { SecretBinding, SecretError, SecretGetInput, SecretGetVersionInput, SecretListInput, SecretListPage, SecretListVersionsInput, SecretRecord, SecretResolveInput, SecretResolveOutcome, SecretRevokeInput, SecretRevokeOutcome, SecretRotateInput, SecretRotateOutcome, SecretSetInput, SecretSetOutcome, SecretVersionPage, SecretVersionRecord, } from './secrets-binding.js';
+export { RESERVED_SECRET_NAME_PREFIX } from './secrets-binding.js';
+export type { ListProvenanceRecordsInput, ListProvenanceRecordsResult, ProvenanceBinding, ProvenanceBindingError, ProvenanceListCursor, ProvenanceRecordSummary, } from './provenance-binding.js';
+export type { KeyManagementBinding, KmsError } from './key-management-binding.js';
+export { createInMemoryRotationStatusStore } from './rotation-status-store.js';
+export type { RotationStatus, RotationStatusCreateInput, RotationStatusGetInput, RotationStatusStore, RotationStatusSubscribeInput, RotationStatusUpdateInput, } from './rotation-status-store.js';
+export type { SecretProviderBinding, SecretProviderDeleteInput, SecretProviderDeleteOutput, SecretProviderError, SecretProviderGetInput, SecretProviderGetVersionInput, SecretProviderListInput, SecretProviderListOutput, SecretProviderMetadata, SecretProviderPayload, SecretProviderProbeOutput, SecretProviderPutInput, SecretProviderPutOutput, SecretProviderRotateInput, SecretProviderRotateOutput, SecretProviderScope, } from './secrets-provider-binding.js';
+export { statusFor, toWireError, ERROR_CODE_TO_STATUS } from './errors.js';
+export type { WireError, WireErrorBody } from './errors.js';
+export { generateOpenApiDocument } from './openapi/generate.js';
+export type { GenerateOptions, OpenApiInfo, OpenApiServer } from './openapi/generate.js';
+export { OPERATIONS, honoToOpenapiPath } from './openapi/operations.js';
+export type { OperationSpec, ParameterSpec, ResponseSpec, HttpMethod, } from './openapi/operations.js';
+export { COMPONENT_SCHEMAS } from './openapi/schemas.js';
+export type { JsonSchema } from './openapi/schemas.js';
+export type { RetentionBinding, RetentionScheduledInput, RetentionScheduledItem, RetentionScheduledPage, RetentionSweepInput, RetentionSweepResult, } from './retention-binding.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrC,YAAY,EACV,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,aAAa,GACd,MAAM,UAAU,CAAC;AAClB,YAAY,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC3E,YAAY,EACV,sBAAsB,EACtB,gBAAgB,EAChB,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,oBAAoB,EACpB,6BAA6B,EAC7B,+BAA+B,EAC/B,+BAA+B,EAC/B,iCAAiC,EACjC,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,GAClB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,OAAO,EACP,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,4BAA4B,EAC5B,8BAA8B,EAC9B,kBAAkB,EAClB,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,wBAAwB,EACxB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,cAAc,EACd,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,GACX,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AACzE,YAAY,EACV,eAAe,EACf,eAAe,EACf,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AAC5E,YAAY,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,eAAe,EACf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,uBAAuB,EACvB,sBAAsB,EACtB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,cAAc,EACd,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,QAAQ,EACR,cAAc,EACd,WAAW,EACX,gBAAgB,EAChB,yBAAyB,EACzB,0BAA0B,EAC1B,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,SAAS,EACT,UAAU,EACV,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACpF,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,eAAe,EACf,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,oCAAoC,EACpC,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,uBAAuB,EACvB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,4BAA4B,EAC5B,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,wBAAwB,EACxB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,2BAA2B,EAC3B,WAAW,EACX,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,yBAAyB,EACzB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,sBAAsB,EACtB,SAAS,EACT,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,4BAA4B,EAC5B,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,EACZ,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,8BAA8B,EAC9B,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,YAAY,EACV,qBAAqB,EACrB,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,eAAe,EACf,wBAAwB,EACxB,0BAA0B,EAC1B,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,kBAAkB,EAClB,qBAAqB,EACrB,oBAAoB,EACpB,cAAc,EACd,uBAAuB,EACvB,YAAY,GACb,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,YAAY,EACV,MAAM,EACN,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,eAAe,EACf,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,2BAA2B,EAC3B,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,YAAY,EACV,QAAQ,EACR,SAAS,EACT,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,aAAa,EACb,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,EACxB,8BAA8B,EAC9B,gCAAgC,EAChC,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,YAAY,EACV,QAAQ,EACR,OAAO,EACP,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,OAAO,GACR,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,yBAAyB,EACzB,eAAe,EACf,cAAc,EACd,QAAQ,EACR,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,yBAAyB,EACzB,2BAA2B,EAC3B,kBAAkB,EAClB,8BAA8B,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,EACpB,UAAU,EACV,gBAAgB,EAChB,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,QAAQ,EACR,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,2BAA2B,EAC3B,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,qBAAqB,EACrB,wBAAwB,EACxB,0BAA0B,EAC1B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,sBAAsB,EACtB,4BAA4B,EAC5B,iBAAiB,EACjB,sBAAsB,EACtB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,sBAAsB,EACtB,yBAAyB,EACzB,+BAA+B,EAC/B,2BAA2B,EAC3B,6BAA6B,EAC7B,yBAAyB,EACzB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,UAAU,EACV,YAAY,EACZ,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,yBAAyB,EACzB,gCAAgC,EAChC,kCAAkC,EAClC,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,+BAA+B,EAC/B,kBAAkB,EAClB,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,UAAU,EACV,cAAc,EACd,WAAW,EACX,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,UAAU,EACV,cAAc,EACd,gBAAgB,EAChB,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,WAAW,EACX,SAAS,EACT,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,WAAW,EACX,cAAc,EACd,qBAAqB,EACrB,eAAe,EACf,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,cAAc,EACd,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AAClF,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AAC/E,YAAY,EACV,cAAc,EACd,yBAAyB,EACzB,sBAAsB,EACtB,mBAAmB,EACnB,4BAA4B,EAC5B,yBAAyB,GAC1B,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,qBAAqB,EACrB,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,EACnB,sBAAsB,EACtB,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAC3E,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACxE,YAAY,EACV,aAAa,EACb,aAAa,EACb,YAAY,EACZ,UAAU,GACX,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,YAAY,EACV,gBAAgB,EAChB,uBAAuB,EACvB,sBAAsB,EACtB,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -0,0 +1,26 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export { createApp } from './app.js';
+export { SESSION_TOKEN_PREFIX, encodeSessionToken, MULTI_TENANT_LOOKUP, } from './middleware/auth.js';
+export { createInMemoryOauthStateStore } from './state-store-binding.js';
+export { createInMemoryIdempotencyStore, idempotencyMiddleware, } from './middleware/idempotency.js';
+export { CURRENT_EVENT_BUS_ENVELOPE_VERSION } from './event-bus-binding.js';
+export { API_TOKEN_ROLES, } from './token-admin.js';
+export { ADAPTER_KINDS, ADAPTER_STATUSES, } from './adapter-binding.js';
+export { TRIGGER_KINDS } from './trigger-binding.js';
+export { DEFAULT_PUBLIC_RUN_TOKEN_TTL_SECONDS, MAX_PUBLIC_RUN_TOKEN_RUNS, MAX_PUBLIC_RUN_TOKEN_TTL_SECONDS, PUBLIC_RUN_TOKEN_PREFIX, mintPublicRunToken, verifyPublicRunToken, } from './public-run-token.js';
+export { WEBHOOK_DELIVERY_STATUSES, WEBHOOK_EVENT_TYPES, } from './webhook-endpoint-binding.js';
+export { MCP_TRANSPORTS } from './mcp-endpoint-binding.js';
+export { TENANT_HOST_ACCESS_LEVELS, deniesHostReach, parseTenantHostAccess, stdioRefusal, } from './tenant-host-access.js';
+export { POLICY_KINDS } from '@kindgi/policy-contract';
+export { EVAL_KINDS } from './eval-suite-binding.js';
+export { EVAL_RUN_STATUSES } from './eval-run-binding.js';
+export { createAccuracyDispatcher, createInProcessEvalRunBinding, } from './eval-run-dispatcher.js';
+export { COST_GROUP_DIMENSIONS } from './cost-binding.js';
+export { RESERVED_SECRET_NAME_PREFIX } from './secrets-binding.js';
+export { createInMemoryRotationStatusStore } from './rotation-status-store.js';
+export { statusFor, toWireError, ERROR_CODE_TO_STATUS } from './errors.js';
+export { generateOpenApiDocument } from './openapi/generate.js';
+export { OPERATIONS, honoToOpenapiPath } from './openapi/operations.js';
+export { COMPONENT_SCHEMAS } from './openapi/schemas.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAQrC,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,sBAAsB,CAAC;AAgD9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAMzE,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,kCAAkC,EAAE,MAAM,wBAAwB,CAAC;AAQ5E,OAAO,EACL,eAAe,GAUhB,MAAM,kBAAkB,CAAC;AAgD1B,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,sBAAsB,CAAC;AAa9B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,oCAAoC,EACpC,yBAAyB,EACzB,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAS/B,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AAkGvC,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AA6B3D,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,qBAAqB,EACrB,YAAY,GACb,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAmBvD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAiBrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAgB1D,OAAO,EACL,wBAAwB,EACxB,6BAA6B,GAC9B,MAAM,0BAA0B,CAAC;AAelC,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAsK1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAUnE,OAAO,EAAE,iCAAiC,EAAE,MAAM,4BAA4B,CAAC;AA2B/E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAOxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/key-management-binding.d.ts

@@ -0,0 +1,101 @@
+import type { Result } from '@kindgi/types';
+/**
+ * Caller-plugged Key Management surface consumed by envelope-encryption
+ * secret stores. The framework never talks to a KMS directly — every
+ * wrap / unwrap / rewrap / destroy flows through this interface so a
+ * deployment can choose a local key (dev + CI) or a managed KMS without
+ * changing any framework code.
+ *
+ * The four load-bearing operations are `generateDek` (write path),
+ * `unwrap` (read path), `rewrap` (KEK rotation batch job), and
+ * `destroyDek` (cryptographic-erasure primitive backing
+ * `SecretBinding.revoke({ hard: true })`). `probe` is a boot-time
+ * reachability check the runtime runs before serving requests; a
+ * failing probe fails boot fast so a mis-configured KMS never manifests
+ * as a `secret-decryption-failed` at request time.
+ */
+export interface KeyManagementBinding {
+    /**
+     * Diagnostic identifier for the concrete KMS adapter. Emitted as
+     * `kms-provider` on every compliance-evidence event so auditors can
+     * filter `kms-provider = 'libsodium'` to find dev-shape leakage into
+     * regulated deployments.
+     */
+    readonly providerName: string;
+    /**
+     * Generate a fresh Data Encryption Key + wrap it with the current KEK.
+     * Returns the raw DEK (for immediate use in AES-GCM encryption; caller
+     * MUST discard after encrypting), the wrapped bytes (persisted
+     * alongside ciphertext), and the KEK id used (persisted for later
+     * unwrap even after rotation).
+     */
+    generateDek(): Promise<Result<{
+        dek: Uint8Array;
+        wrapped: Uint8Array;
+        kekId: string;
+    }, KmsError>>;
+    /** Unwrap a previously-wrapped DEK using the KEK it was wrapped with. */
+    unwrap(input: {
+        readonly kekId: string;
+        readonly wrapped: Uint8Array;
+    }): Promise<Result<Uint8Array, KmsError>>;
+    /**
+     * Rewrap a DEK from an old KEK to a new one. Used by the KEK-rotation
+     * batch job — the DEK itself does NOT change (no ciphertext rewrite),
+     * only its wrapping.
+     */
+    rewrap(input: {
+        readonly oldKekId: string;
+        readonly newKekId: string;
+        readonly wrapped: Uint8Array;
+    }): Promise<Result<Uint8Array, KmsError>>;
+    /**
+     * Destroy a specific DEK — cryptographic-erasure primitive backing
+     * `SecretBinding.revoke({ hard: true })`. Semantics vary by provider
+     * (scheduled key deletion, key-version destruction, ...). An adapter
+     * that wraps with a local key cannot destroy an already-wrapped DEK in
+     * isolation (the KEK is what would need destruction); it returns
+     * `{ destroyed: true }` and relies on the caller having dropped the
+     * ciphertext + wrapped bytes. Idempotent —
+     * returns `{ destroyed: false }` if the KMS reports the DEK is
+     * already gone.
+     */
+    destroyDek(input: {
+        readonly kekId: string;
+        readonly wrapped: Uint8Array;
+    }): Promise<Result<{
+        destroyed: boolean;
+    }, KmsError>>;
+    /**
+     * Health check called at boot. Returns latency for observability.
+     * A failing probe fails boot fast so a KMS
+     * misconfiguration surfaces at deploy time, not at request time.
+     */
+    probe(): Promise<Result<{
+        reachable: true;
+        providerVersion: string;
+        latencyMs: number;
+    }, KmsError>>;
+}
+export type KmsError = {
+    readonly code: 'kms-unreachable';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'kms-unauthorized';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'kms-key-not-found';
+    readonly message: string;
+    readonly kekId: string;
+} | {
+    readonly code: 'kms-wrap-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+} | {
+    readonly code: 'kms-unwrap-failed';
+    readonly message: string;
+    readonly cause?: unknown;
+};
+//# sourceMappingURL=key-management-binding.d.ts.map

package/dist/key-management-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-management-binding.d.ts","sourceRoot":"","sources":["../src/key-management-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B;;;;;;OAMG;IACH,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAElG,yEAAyE;IACzE,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;KAC9B,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1C;;;;OAIG;IACH,MAAM,CAAC,KAAK,EAAE;QACZ,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;KAC9B,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE1C;;;;;;;;;;OAUG;IACH,UAAU,CAAC,KAAK,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;KAC9B,GAAG,OAAO,CAAC,MAAM,CAAC;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;IAEtD;;;;OAIG;IACH,KAAK,IAAI,OAAO,CACd,MAAM,CAAC;QAAE,SAAS,EAAE,IAAI,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE,QAAQ,CAAC,CAClF,CAAC;CACH;AAED,MAAM,MAAM,QAAQ,GAChB;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzF;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC"}

package/dist/key-management-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=key-management-binding.js.map

package/dist/key-management-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-management-binding.js","sourceRoot":"","sources":["../src/key-management-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}

package/dist/mcp-endpoint-binding.d.ts

@@ -0,0 +1,312 @@
+import type { TupleEnqueueHook } from '@kindgi/authz';
+import type { Scope } from '@kindgi/platform';
+import type { Cursor, EnvName, TenantId } from '@kindgi/types';
+/**
+ * Caller-plugged surface for the MCP-endpoint catalog. Tenants register
+ * the remote MCP servers they want the runtime to consume. At boot the
+ * runtime discovers each endpoint's tools (MCP `tools/list`) and
+ * registers them into the `ToolRegistryBinding` under the same tenant —
+ * remote tools become native `Tool`s without a TypeScript recompile.
+ *
+ * Contract shape: 4-method non-versioned, mirroring
+ * `ProviderRegistryBinding` (`list` / `get` / `register` / `unregister`)
+ * minus `capabilitiesFor` — an MCP endpoint doesn't advertise a static
+ * capability list up-front (tools come from the live server at boot).
+ *
+ * Every method is tenant-scoped: callers pass `tenantId` explicitly so
+ * multi-tenant deployments can partition storage without exposing the
+ * scoping inside the API package.
+ *
+ * **Wire-safety of secrets.** `authRef` is a REFERENCE (e.g.
+ * `env:MY_MCP_KEY`), never a plaintext credential. The API surface
+ * accepts, stores, and returns only the reference; the runtime resolves
+ * it inside the deployment (e.g. against env vars) before constructing
+ * the transport. This mirrors the "no secrets on
+ * the wire" guardrail `ProviderRegistryBinding` enforces for LLM keys.
+ */
+export interface MCPEndpointRegistryBinding {
+    /** Cursor-paginated list. Optional `transportFilter` narrows to one variant. */
+    list(input: MCPEndpointListInput): Promise<MCPEndpointPage>;
+    /** Fetch a single endpoint, or `null` when unknown. Route flips `null` → 404. */
+    get(input: MCPEndpointGetInput): Promise<MCPEndpoint | null>;
+    /**
+     * Register an endpoint. Route validates the closed transport enum and
+     * the config-transport ↔ top-level-transport match before calling.
+     * Bindings MAY reject with `already-registered`; the route maps that
+     * to `409 mcp-endpoint-already-registered`.
+     */
+    register(input: MCPEndpointRegisterInput): Promise<MCPEndpointRegisterOutcome>;
+    /**
+     * Remove an endpoint. `{ unregistered: false }` maps to
+     * `404 mcp-endpoint-not-found` at the route.
+     */
+    unregister(input: MCPEndpointUnregisterInput): Promise<MCPEndpointUnregisterOutcome>;
+}
+/**
+ * Closed transport enum. `stdio` for local subprocess servers,
+ * `http-sse` for the older MCP HTTP+SSE transport (separate SSE stream
+ * + POST endpoint), `streamable-http` for the Streamable HTTP transport
+ * (single HTTP endpoint, SSE for server → client, POST for
+ * client → server, session-id via header). Additive: extend the
+ * union when a new SDK transport lands.
+ */
+export declare const MCP_TRANSPORTS: readonly ["stdio", "http-sse", "streamable-http"];
+export type MCPTransport = (typeof MCP_TRANSPORTS)[number];
+/** stdio transport config — subprocess command + args. */
+export interface MCPStdioConfig {
+    readonly transport: 'stdio';
+    readonly command: string;
+    readonly args?: readonly string[];
+    readonly env?: Readonly<Record<string, string>>;
+}
+/** http-sse transport config — HTTP+SSE transport (separate SSE + POST). */
+export interface MCPHttpSseConfig {
+    readonly transport: 'http-sse';
+    readonly url: string;
+    /** Optional distinct SSE endpoint if the server splits them. */
+    readonly sseUrl?: string;
+    /** Optional header overrides. `secretRef` is applied separately by the runtime. */
+    readonly headers?: Readonly<Record<string, string>>;
+}
+/** streamable-http transport config — single endpoint. */
+export interface MCPStreamableHttpConfig {
+    readonly transport: 'streamable-http';
+    readonly url: string;
+    /** Optional header overrides. `secretRef` is applied separately by the runtime. */
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export type MCPEndpointConfig = MCPStdioConfig | MCPHttpSseConfig | MCPStreamableHttpConfig;
+/**
+ * The secret an endpoint authenticates with: a name in the deployment's
+ * secrets store, resolved at the endpoint's tenant scope (the shape
+ * webhooks and providers use). Never the secret itself.
+ */
+export interface MCPEndpointSecretRef {
+    readonly envName: EnvName;
+    readonly name: string;
+}
+/**
+ * Wire shape for a registered MCP endpoint. Secrets never appear —
+ * `secretRef` names a secret the runtime resolves inside the
+ * deployment. Callers who inspect this object over the wire never see
+ * the plaintext credential.
+ */
+export interface MCPEndpoint {
+    /** Deployment-stable endpoint id. Route param + registration key. */
+    readonly endpointId: string;
+    /** Human-readable display name. */
+    readonly name: string;
+    /**
+     * Redundant with `config.transport` — kept at the top for cheap
+     * filtering (`?transport=stdio`) without unwrapping `config`. Route
+     * enforces `config.transport === transport` at registration.
+     */
+    readonly transport: MCPTransport;
+    readonly config: MCPEndpointConfig;
+    /**
+     * The secret sent as the endpoint's bearer (`Authorization` by default),
+     * resolved through the tenant's secrets store when the runtime connects.
+     */
+    readonly secretRef?: MCPEndpointSecretRef;
+    /**
+     * Optional pass-through to the MCP client's server-info instructions
+     * slot. Purely informational.
+     */
+    readonly instructions?: string;
+    /** Optional caller-defined metadata bag. */
+    readonly metadata?: Readonly<Record<string, unknown>>;
+}
+export interface MCPEndpointListInput {
+    readonly tenantId: TenantId;
+    readonly limit: number;
+    readonly cursor?: Cursor;
+    /** Exact match on `transport`. */
+    readonly transportFilter?: MCPTransport;
+    /**
+     * Narrow the list to a specific scope. Absent = no narrow (return
+     * every row in the tenant regardless of scope kind).
+     *
+     * Policy/config-scoped semantics (this binding):
+     * - `{ kind: 'project', projectId }` — with `inherit=true` (default):
+     *   rows literally at this project + rows at the project's org +
+     *   tenant-wide rows (upward walk). With `inherit=false`: only rows
+     *   registered at exactly this project.
+     * - `{ kind: 'org', orgId }` — with `inherit=true`: org-scoped +
+     *   tenant-scoped. With `inherit=false`: only rows registered at
+     *   exactly this org.
+     * - `{ kind: 'tenant', tenantId }` — `inherit` has no effect (already
+     *   the top of the hierarchy).
+     */
+    readonly scope?: Scope;
+    /**
+     * `true` (default) = inheritance walk. Matches the common
+     * user-facing case ("what endpoints does this project see").
+     * `false` = literal-at-this-scope only. Matches the admin/audit case
+     * ("what's explicitly configured at this scope").
+     */
+    readonly inherit?: boolean;
+}
+export interface MCPEndpointGetInput {
+    readonly tenantId: TenantId;
+    readonly endpointId: string;
+}
+export interface MCPEndpointRegisterInput {
+    readonly tenantId: TenantId;
+    readonly endpoint: MCPEndpoint;
+    /**
+     * Scope at which the endpoint is registered (policy/config anchor).
+     * Required — no silent tenant-scope fallback at the binding layer.
+     * Callers without a natural scope resolve via
+     * `bindings.projectBinding.getDefault(...)` at the caller layer (route
+     * body, runtime).
+     *
+     * Policy/config-scoped semantics (this binding):
+     * - `{ kind: 'project', projectId }` — endpoint visible only to that
+     *   project and its descendants under inherit=true reads.
+     * - `{ kind: 'org', orgId }` — visible to every project inside that org
+     *   under inherit=true reads.
+     * - `{ kind: 'tenant', tenantId }` — visible to every project + org
+     *   inside the tenant (top of hierarchy).
+     */
+    readonly scope: Scope;
+    /**
+     * REQUIRED. Called inside the binding's write tx after insert,
+     * receiving the business `endpointId`. Returns tuples for the tx —
+     * `mcp_endpoint#scope@{tenant|org|project}:X` per the model.
+     * See `AgentPublishInput.enqueueTuples` for the design rationale.
+     */
+    readonly enqueueTuples: TupleEnqueueHook;
+}
+export interface MCPEndpointUnregisterInput {
+    readonly tenantId: TenantId;
+    readonly endpointId: string;
+}
+export interface MCPEndpointPage {
+    readonly data: readonly MCPEndpoint[];
+    readonly nextCursor?: Cursor;
+}
+export type MCPEndpointRegisterOutcome = {
+    readonly kind: 'ok';
+    readonly endpointId: string;
+} | {
+    readonly kind: 'already-registered';
+    readonly endpointId: string;
+} | {
+    readonly kind: 'project-not-found';
+    readonly endpointId: string;
+    readonly projectId: import('@kindgi/types').ProjectId;
+} | {
+    readonly kind: 'org-not-found';
+    readonly endpointId: string;
+    readonly orgId: import('@kindgi/types').OrgId;
+};
+export type MCPEndpointUnregisterOutcome = {
+    readonly unregistered: boolean;
+};
+/**
+ * Caller-plugged probe for remote MCP endpoints' resources + prompts
+ * primitives. The runtime supplies an implementation that opens a live
+ * MCP client against the endpoint's declared transport, runs the
+ * operation, and closes it — typically a fresh client per call to
+ * `listResources` / `readResource` / `listPrompts` / `getPrompt`.
+ *
+ * Duck-typed at the wire boundary: return shapes mirror the MCP spec so
+ * this file doesn't have to depend on an MCP client library. The
+ * implementation maps its client's types into these shapes.
+ */
+export interface MCPClientProbeBinding {
+    listResources(input: MCPClientProbeInput): Promise<MCPListResourcesOutcome>;
+    readResource(input: MCPClientProbeInput & {
+        readonly uri: string;
+    }): Promise<MCPReadResourceOutcome>;
+    listPrompts(input: MCPClientProbeInput): Promise<MCPListPromptsOutcome>;
+    getPrompt(input: MCPClientProbeInput & {
+        readonly name: string;
+        readonly args?: Readonly<Record<string, string>>;
+    }): Promise<MCPGetPromptOutcome>;
+}
+export interface MCPClientProbeInput {
+    readonly tenantId: TenantId;
+    readonly endpointId: string;
+}
+/** MCP-spec resource descriptor. */
+export interface MCPResourceDescriptor {
+    readonly uri: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly mimeType?: string;
+}
+/** MCP-spec resource content payload — exactly one of `text` or `blob`. */
+export interface MCPResourceContent {
+    readonly uri: string;
+    readonly mimeType?: string;
+    readonly text?: string;
+    readonly blob?: string;
+}
+/** MCP-spec prompt argument spec. */
+export interface MCPPromptArgument {
+    readonly name: string;
+    readonly description?: string;
+    readonly required?: boolean;
+}
+/** MCP-spec prompt descriptor. */
+export interface MCPPromptDescriptor {
+    readonly name: string;
+    readonly description?: string;
+    readonly arguments?: readonly MCPPromptArgument[];
+}
+/** MCP-spec prompt message. */
+export interface MCPPromptMessage {
+    readonly role: 'user' | 'assistant';
+    readonly content: {
+        readonly type: 'text';
+        readonly text: string;
+    } | {
+        readonly type: 'image';
+        readonly data: string;
+        readonly mimeType: string;
+    };
+}
+export type MCPListResourcesOutcome = {
+    readonly kind: 'ok';
+    readonly resources: readonly MCPResourceDescriptor[];
+} | {
+    readonly kind: 'endpoint-not-found';
+} | {
+    readonly kind: 'protocol-error';
+    readonly message: string;
+};
+export type MCPReadResourceOutcome = {
+    readonly kind: 'ok';
+    readonly content: MCPResourceContent;
+} | {
+    readonly kind: 'endpoint-not-found';
+} | {
+    readonly kind: 'resource-not-found';
+    readonly uri: string;
+} | {
+    readonly kind: 'read-failed';
+    readonly message: string;
+};
+export type MCPListPromptsOutcome = {
+    readonly kind: 'ok';
+    readonly prompts: readonly MCPPromptDescriptor[];
+} | {
+    readonly kind: 'endpoint-not-found';
+} | {
+    readonly kind: 'protocol-error';
+    readonly message: string;
+};
+export type MCPGetPromptOutcome = {
+    readonly kind: 'ok';
+    readonly messages: readonly MCPPromptMessage[];
+} | {
+    readonly kind: 'endpoint-not-found';
+} | {
+    readonly kind: 'prompt-not-found';
+    readonly name: string;
+} | {
+    readonly kind: 'get-failed';
+    readonly message: string;
+};
+//# sourceMappingURL=mcp-endpoint-binding.d.ts.map

package/dist/mcp-endpoint-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-endpoint-binding.d.ts","sourceRoot":"","sources":["../src/mcp-endpoint-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,0BAA0B;IACzC,gFAAgF;IAChF,IAAI,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5D,iFAAiF;IACjF,GAAG,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAC7D;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,wBAAwB,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC;IAC/E;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,0BAA0B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;CACtF;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,mDAAoD,CAAC;AAChF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,0DAA0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED,4EAA4E;AAC5E,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED,0DAA0D;AAC1D,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,mFAAmF;IACnF,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACrD;AAED,MAAM,MAAM,iBAAiB,GAAG,cAAc,GAAG,gBAAgB,GAAG,uBAAuB,CAAC;AAE5F;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,mCAAmC;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC;IAC1C;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,kCAAkC;IAClC,QAAQ,CAAC,eAAe,CAAC,EAAE,YAAY,CAAC;IACxC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,gBAAgB,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,WAAW,EAAE,CAAC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,0BAA0B,GAClC;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpE;IACE,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,OAAO,eAAe,EAAE,SAAS,CAAC;CACvD,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,OAAO,eAAe,EAAE,KAAK,CAAC;CAC/C,CAAC;AAEN,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,aAAa,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC5E,YAAY,CACV,KAAK,EAAE,mBAAmB,GAAG;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GACpD,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACnC,WAAW,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxE,SAAS,CACP,KAAK,EAAE,mBAAmB,GAAG;QAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;KAClD,GACA,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,oCAAoC;AACpC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,2EAA2E;AAC3E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,qCAAqC;AACrC,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;CACnD;AAED,+BAA+B;AAC/B,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;IACpC,QAAQ,CAAC,OAAO,EACZ;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAChD;QAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED,MAAM,MAAM,uBAAuB,GAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,qBAAqB,EAAE,CAAA;CAAE,GAC7E;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,sBAAsB,GAC9B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC7D;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAA;CAAE,GACzE;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAElE,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAAE,GACvE;IAAE,QAAQ,CAAC,IAAI,EAAE,oBAAoB,CAAA;CAAE,GACvC;IAAE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5D;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC"}

package/dist/mcp-endpoint-binding.js

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Closed transport enum. `stdio` for local subprocess servers,
+ * `http-sse` for the older MCP HTTP+SSE transport (separate SSE stream
+ * + POST endpoint), `streamable-http` for the Streamable HTTP transport
+ * (single HTTP endpoint, SSE for server → client, POST for
+ * client → server, session-id via header). Additive: extend the
+ * union when a new SDK transport lands.
+ */
+export const MCP_TRANSPORTS = ['stdio', 'http-sse', 'streamable-http'];
+//# sourceMappingURL=mcp-endpoint-binding.js.map

package/dist/mcp-endpoint-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-endpoint-binding.js","sourceRoot":"","sources":["../src/mcp-endpoint-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAgDjC;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,UAAU,EAAE,iBAAiB,CAAU,CAAC"}