@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/routes/artifacts.js

@@ -0,0 +1,265 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+/**
+ * Artifacts resource routes over the caller-plugged, tenant-scoped
+ * `BlobStorageBinding` (from `@kindgi/blob-binding`). Five routes:
+ * multipart upload (POST) / streaming GET / HEAD / LIST / DELETE.
+ *
+ * Storage implementations (filesystem-backed for dev + tests, object
+ * stores in production) plug in through the binding.
+ *
+ * Multipart is the ONLY upload wire format. JSON-body base64 would blow
+ * up memory on large blobs. Presigned upload URLs and chunked /
+ * resumable uploads are not supported.
+ *
+ * Scope filtering — indirect. Artifacts do NOT accept the
+ * `?scopeKind + ?scopeId + ?inherit` triplet that content-scoped
+ * resources accept. A blob carries its owning run (`ownerRunId`), and
+ * that run's project is the authoritative scope anchor, so scope
+ * filtering goes through runs rather than a field on the blob metadata.
+ * Callers who want scope-narrowed artifacts should first list runs at
+ * the desired scope, then list artifacts by `?ownerRunId=`.
+ */
+export function artifactsRouter(binding) {
+    const r = new Hono();
+    // ---------- GET / (list, cursor-paginated metadata) ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const filter = decodeListFilter(new URL(c.req.url).searchParams);
+        if (filter.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: filter.message }, requestId));
+        }
+        const cursorRaw = c.req.query('cursor');
+        const page = await binding.list(tenantId, filter.value, cursorRaw !== undefined && cursorRaw.length > 0 ? cursorRaw : undefined, limit);
+        if (page.kind === 'err') {
+            c.status(statusFor(page.error.code));
+            return c.json(toWireError(page.error, requestId));
+        }
+        return c.json({
+            data: page.value.data.map(serializeMeta),
+            hasMore: page.value.nextCursor !== undefined,
+            ...(page.value.nextCursor !== undefined && {
+                nextCursor: page.value.nextCursor,
+            }),
+        });
+    });
+    // ---------- POST / (multipart upload) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const contentType = c.req.header('content-type') ?? '';
+        if (!contentType.toLowerCase().startsWith('multipart/form-data')) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: 'POST /v1/artifacts requires `multipart/form-data`',
+            }, requestId));
+        }
+        let form;
+        try {
+            form = await c.req.raw.formData();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Malformed multipart body' }, requestId));
+        }
+        const validated = validateMultipart(form);
+        if (validated.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: validated.message }, requestId));
+        }
+        const input = validated.value;
+        const outcome = await binding.put(tenantId, input);
+        if (outcome.kind === 'err') {
+            c.status(statusFor(outcome.error.code));
+            return c.json(toWireError(outcome.error, requestId));
+        }
+        c.status(201);
+        return c.json(serializeMeta(outcome.value));
+    });
+    // ---------- GET /:blobId (stream download) ----------
+    r.get('/:blobId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const blobId = c.req.param('blobId');
+        const outcome = await binding.get(tenantId, blobId);
+        if (outcome.kind === 'err') {
+            c.status(statusFor(outcome.error.code));
+            return c.json(toWireError(outcome.error, requestId));
+        }
+        const { meta, stream } = outcome.value;
+        return new Response(stream, {
+            status: 200,
+            headers: downloadHeaders(meta, requestId),
+        });
+    });
+    // ---------- HEAD /:blobId (metadata-only) ----------
+    r.on('HEAD', '/:blobId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const blobId = c.req.param('blobId');
+        const meta = await binding.head(tenantId, blobId);
+        if (meta === null) {
+            return new Response(null, {
+                status: 404,
+                headers: { 'X-Request-Id': requestId },
+            });
+        }
+        return new Response(null, {
+            status: 200,
+            headers: downloadHeaders(meta, requestId),
+        });
+    });
+    // ---------- DELETE /:blobId ----------
+    r.delete('/:blobId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const blobId = c.req.param('blobId');
+        const outcome = await binding.delete(tenantId, blobId);
+        if (outcome.kind === 'err') {
+            c.status(statusFor(outcome.error.code));
+            return c.json(toWireError(outcome.error, requestId));
+        }
+        return c.json({
+            blobId: blobId,
+            deleted: outcome.value.deleted,
+        });
+    });
+    return r;
+}
+// -------------------- serialization --------------------
+function serializeMeta(m) {
+    return {
+        blobId: m.blobId,
+        tenantId: m.tenantId,
+        name: m.name,
+        contentType: m.contentType,
+        size: m.size,
+        hash: m.hash,
+        tags: m.tags,
+        ...(m.ownerRunId !== undefined && { ownerRunId: m.ownerRunId }),
+        createdAt: m.createdAt,
+        ...(m.bucket !== undefined && { bucket: m.bucket }),
+        ...(m.key !== undefined && { key: m.key }),
+    };
+}
+function downloadHeaders(meta, requestId) {
+    return {
+        'Content-Type': meta.contentType,
+        'Content-Length': String(meta.size),
+        'X-Kindgi-Blob-Hash': meta.hash,
+        'X-Kindgi-Blob-Name': encodeURIComponent(meta.name),
+        'X-Request-Id': requestId,
+    };
+}
+/**
+ * Parse the multipart form into a `BlobPutInput`. `file` is required —
+ * every other field is optional metadata. `tags` is a JSON-encoded
+ * object; `ownerRunId` is a plain string; `expectedHash` is
+ * `sha256`-hex; `contentType` overrides the file part's own MIME.
+ * `name` defaults to the file part's filename.
+ */
+function validateMultipart(form) {
+    const file = form.get('file');
+    if (file === null) {
+        return { kind: 'err', message: 'Multipart form must include a `file` part' };
+    }
+    if (typeof file === 'string') {
+        return { kind: 'err', message: '`file` part must be a file, not a string field' };
+    }
+    const nameField = form.get('name');
+    const name = typeof nameField === 'string' && nameField.length > 0
+        ? nameField
+        : file.name !== undefined && file.name.length > 0
+            ? file.name
+            : 'unnamed';
+    const contentTypeField = form.get('contentType');
+    const contentType = typeof contentTypeField === 'string' && contentTypeField.length > 0
+        ? contentTypeField
+        : file.type.length > 0
+            ? file.type
+            : 'application/octet-stream';
+    let tags;
+    const tagsField = form.get('tags');
+    if (typeof tagsField === 'string' && tagsField.length > 0) {
+        try {
+            const parsed = JSON.parse(tagsField);
+            if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+                return { kind: 'err', message: 'Field `tags` must be a JSON object' };
+            }
+            const flat = {};
+            for (const [k, v] of Object.entries(parsed)) {
+                if (typeof v !== 'string') {
+                    return { kind: 'err', message: `Field \`tags["${k}"]\` must be a string` };
+                }
+                flat[k] = v;
+            }
+            tags = flat;
+        }
+        catch {
+            return { kind: 'err', message: 'Field `tags` must be valid JSON' };
+        }
+    }
+    let ownerRunId;
+    const ownerField = form.get('ownerRunId');
+    if (typeof ownerField === 'string' && ownerField.length > 0) {
+        ownerRunId = ownerField;
+    }
+    let expectedHash;
+    const hashField = form.get('expectedHash');
+    if (typeof hashField === 'string' && hashField.length > 0) {
+        if (!/^[0-9a-f]{64}$/.test(hashField)) {
+            return {
+                kind: 'err',
+                message: 'Field `expectedHash` must be sha256, hex-encoded, lowercase (64 chars)',
+            };
+        }
+        expectedHash = hashField;
+    }
+    return {
+        kind: 'ok',
+        value: {
+            name,
+            contentType,
+            bytes: file.stream(),
+            size: file.size,
+            ...(tags !== undefined && { tags }),
+            ...(ownerRunId !== undefined && { ownerRunId }),
+            ...(expectedHash !== undefined && { expectedHash }),
+        },
+    };
+}
+function decodeListFilter(params) {
+    const filter = {};
+    const rawTags = {};
+    for (const [key, value] of params.entries()) {
+        if (value.length === 0)
+            continue;
+        if (key === 'ownerRunId') {
+            filter.ownerRunId = value;
+            continue;
+        }
+        if (key === 'contentType') {
+            filter.contentType = value;
+            continue;
+        }
+        if (key.startsWith('tag.')) {
+            const tagKey = key.slice('tag.'.length);
+            if (tagKey.length === 0) {
+                return { kind: 'err', message: 'Empty `tag.` filter key' };
+            }
+            rawTags[tagKey] = value;
+        }
+        // Ignore unrelated keys (limit, cursor, etc.).
+    }
+    if (Object.keys(rawTags).length > 0)
+        filter.tags = rawTags;
+    return { kind: 'ok', value: filter };
+}
+//# sourceMappingURL=artifacts.js.map

package/dist/routes/artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts.js","sourceRoot":"","sources":["../../src/routes/artifacts.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,OAA2B;IACzD,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,gEAAgE;IAChE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAExC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAC7B,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAE,SAAoB,CAAC,CAAC,CAAC,SAAS,EACnF,KAAK,CACN,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI;gBACzC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAA+B;aACvD,CAAC;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,kDAAkD;IAClD,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACjE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,mDAAmD;aAC7D,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAc,CAAC;QACnB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,SAAS,CAAC,CACnF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC;QAE9B,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;QAEnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QACvC,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE;YAC1B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;QAEnD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;gBACxB,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,SAAS,EAAE;aACvC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,eAAe,CAAC,IAAI,EAAE,SAAS,CAAC;SAC1C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,wCAAwC;IACxC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAe,CAAC;QAEnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,KAAc,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,MAA2B;YACnC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO;SAC/B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0DAA0D;AAE1D,SAAS,aAAa,CAAC,CAAW;IAChC,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,QAAQ,EAAE,CAAC,CAAC,QAA6B;QACzC,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAA+B,EAAE,CAAC;QACpF,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;KAC3C,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,IAAc,EAAE,SAAiB;IACxD,OAAO;QACL,cAAc,EAAE,IAAI,CAAC,WAAW;QAChC,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QACnC,oBAAoB,EAAE,IAAI,CAAC,IAAI;QAC/B,oBAAoB,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;QACnD,cAAc,EAAE,SAAS;KAC1B,CAAC;AACJ,CAAC;AAQD;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,IAAc;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC;IACpF,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,IAAI,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QACnD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YAC/C,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,SAAS,CAAC;IAElB,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,WAAW,GACf,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,CAAC,MAAM,GAAG,CAAC;QACjE,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACpB,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,0BAA0B,CAAC;IAEnC,IAAI,IAAwC,CAAC;IAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAY,CAAC;YAChD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,GAA2B,EAAE,CAAC;YACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;gBACvE,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;oBAC1B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iBAAiB,CAAC,uBAAuB,EAAE,CAAC;gBAC7E,CAAC;gBACD,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACd,CAAC;YACD,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,IAAI,UAA6B,CAAC;IAClC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,UAAU,GAAG,UAAmB,CAAC;IACnC,CAAC;IAED,IAAI,YAAgC,CAAC;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACtC,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,wEAAwE;aAClF,CAAC;QACJ,CAAC;QACD,YAAY,GAAG,SAAS,CAAC;IAC3B,CAAC;IAED,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI;YACJ,WAAW;YACX,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;YACpB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC;YACnC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;YAC/C,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;SACpD;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAuB;IAC/C,MAAM,MAAM,GAIR,EAAE,CAAC;IACP,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,UAAU,GAAG,KAAc,CAAC;YACnC,SAAS;QACX,CAAC;QACD,IAAI,GAAG,KAAK,aAAa,EAAE,CAAC;YAC1B,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YAC7D,CAAC;YACD,OAAO,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;QACD,+CAA+C;IACjD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;IAC3D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACvC,CAAC"}

package/dist/routes/audit.d.ts

@@ -0,0 +1,6 @@
+import { Hono } from 'hono';
+import type { AuditEventBinding } from '@kindgi/audit-events';
+import type { Authorizer } from '../middleware/authorize.js';
+import type { AppEnv } from '../types.js';
+export declare function auditRouter(binding: AuditEventBinding, authorizer?: Authorizer): Hono<AppEnv>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/routes/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAK1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AA0B1C,wBAAgB,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CA4H7F"}

package/dist/routes/audit.js

@@ -0,0 +1,162 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+//
+// GET /v1/audit/authz — authorization-decision query surface.
+//
+// Reads audit events via `AuditEventBinding`, filtered to
+// `kind='authz-decision'`.
+//
+// PEP: admin@tenant. Audit is sensitive by definition — only tenant
+// admins see it. Authorization checks (`check()`) in the API and the
+// runtime emit authz-decision audit events; this route pages through
+// the results with filters.
+//
+// Filter shape:
+//   ?actorSubject=user:xxx
+//   ?onBehalfOf=agent:yyy
+//   ?action=read|write|admin|...
+//   ?resource=agent:zzz
+//   ?outcome=allowed|denied
+//   ?from=<iso>&to=<iso>
+//   ?runId=<id>
+//   ?limit=<n>&cursor=<opaque>
+//
+import { Hono } from 'hono';
+import { ref } from '@kindgi/authz';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+export function auditRouter(binding, authorizer) {
+    const r = new Hono();
+    // PEP — admin@tenant on every route.
+    if (authorizer !== undefined) {
+        r.use('*', async (c, next) => {
+            const tenantId = c.get('tenantId');
+            const mw = authorizer.authorize('admin', () => ref('tenant', tenantId));
+            return mw(c, next);
+        });
+    }
+    r.get('/authz', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursor = c.req.query('cursor');
+        const actor = c.req.query('actorSubject');
+        const onBehalf = c.req.query('onBehalfOf');
+        const action = c.req.query('action');
+        const resource = c.req.query('resource');
+        const outcomeRaw = c.req.query('outcome');
+        const from = c.req.query('from');
+        const to = c.req.query('to');
+        const runId = c.req.query('runId');
+        let outcome;
+        if (outcomeRaw === 'allowed' || outcomeRaw === 'denied')
+            outcome = outcomeRaw;
+        else if (outcomeRaw !== undefined) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`outcome` must be "allowed" or "denied"' }, requestId));
+        }
+        if (from !== undefined && Number.isNaN(new Date(from).getTime())) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`from` must be an ISO timestamp' }, requestId));
+        }
+        if (to !== undefined && Number.isNaN(new Date(to).getTime())) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`to` must be an ISO timestamp' }, requestId));
+        }
+        // Every filter goes into the binding query — including `onBehalfOf`
+        // and the `payload.doc` fields `action` / `resource` — so the binding
+        // pages over matching events only: pages are full while matches
+        // remain, and `nextCursor` resumes exactly after the last one.
+        const docFilter = {
+            ...(action !== undefined && action.length > 0 && { action }),
+            ...(resource !== undefined && resource.length > 0 && { resource }),
+        };
+        const page = await binding.query({
+            tenantId,
+            filter: {
+                kind: 'authz-decision',
+                ...(actor !== undefined && actor.length > 0 && { actor }),
+                ...(onBehalf !== undefined && onBehalf.length > 0 && { onBehalfOf: onBehalf }),
+                ...(Object.keys(docFilter).length > 0 && { payloadDoc: docFilter }),
+                ...(runId !== undefined && runId.length > 0 && { runId }),
+                ...(outcome !== undefined && { outcome }),
+                ...(from !== undefined && from.length > 0 && { from }),
+                ...(to !== undefined && to.length > 0 && { to }),
+            },
+            ...(cursor !== undefined && cursor.length > 0 && { cursor }),
+            limit,
+        });
+        if (page.kind === 'err') {
+            if (page.error.code === 'invalid-cursor') {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: `Malformed cursor: ${page.error.message}` }, requestId));
+            }
+            c.status(statusFor('persistence-error'));
+            return c.json(toWireError({ code: 'persistence-error', message: `Audit query failed: ${page.error.message}` }, requestId));
+        }
+        // Re-check the same three filters on the returned page. A binding
+        // that implements them (the contract) makes this a no-op; one that
+        // predates `onBehalfOf` / `payloadDoc` still can't return
+        // non-matching events (its pages are then short).
+        const data = page.value.data
+            .filter((event) => {
+            if (onBehalf !== undefined && onBehalf.length > 0) {
+                if (event.onBehalfOf !== onBehalf)
+                    return false;
+            }
+            if (action !== undefined && action.length > 0) {
+                const doc = extractDoc(event.payload);
+                if (doc?.action !== action)
+                    return false;
+            }
+            if (resource !== undefined && resource.length > 0) {
+                const doc = extractDoc(event.payload);
+                if (doc?.resource !== resource)
+                    return false;
+            }
+            return true;
+        })
+            .map(rowToWire);
+        return c.json({
+            data,
+            hasMore: page.value.nextCursor !== undefined,
+            ...(page.value.nextCursor !== undefined && { nextCursor: page.value.nextCursor }),
+        });
+    });
+    return r;
+}
+function extractDoc(payload) {
+    const inner = payload.doc;
+    if (inner !== null && typeof inner === 'object' && !Array.isArray(inner)) {
+        return inner;
+    }
+    return undefined;
+}
+function rowToWire(event) {
+    const doc = extractDoc(event.payload) ?? {};
+    const out = {
+        id: event.id,
+        tenantId: event.tenantId,
+        timestamp: event.timestamp,
+        actorSubject: event.actor,
+        action: typeof doc.action === 'string' ? doc.action : '',
+        resource: typeof doc.resource === 'string' ? doc.resource : '',
+        outcome: event.outcome === 'denied' ? 'denied' : 'allowed',
+        reason: typeof doc.reason === 'string' ? doc.reason : '',
+    };
+    if (event.onBehalfOf !== undefined)
+        out.onBehalfSubject = event.onBehalfOf;
+    if (typeof doc.failing === 'string')
+        out.failing = doc.failing;
+    if (doc.evidence !== undefined && typeof doc.evidence === 'object' && doc.evidence !== null) {
+        out.evidence = doc.evidence;
+    }
+    if (event.correlationId !== undefined)
+        out.correlationId = event.correlationId;
+    if (event.runId !== undefined)
+        out.runId = event.runId;
+    if (typeof doc.latencyMs === 'number')
+        out.latencyMs = doc.latencyMs;
+    return out;
+}
+//# sourceMappingURL=audit.js.map

package/dist/routes/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../src/routes/audit.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,EAAE;AACF,8DAA8D;AAC9D,EAAE;AACF,0DAA0D;AAC1D,2BAA2B;AAC3B,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,qEAAqE;AACrE,4BAA4B;AAC5B,EAAE;AACF,gBAAgB;AAChB,2BAA2B;AAC3B,0BAA0B;AAC1B,iCAAiC;AACjC,wBAAwB;AACxB,4BAA4B;AAC5B,yBAAyB;AACzB,gBAAgB;AAChB,+BAA+B;AAC/B,EAAE;AAEF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAyB7C,MAAM,UAAU,WAAW,CAAC,OAA0B,EAAE,UAAuB;IAC7E,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,qCAAqC;IACrC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC,CAAC;YAC7F,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEnC,IAAI,OAAyC,CAAC;QAC9C,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ;YAAE,OAAO,GAAG,UAAU,CAAC;aACzE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yCAAyC,EAAE,EACzE,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACjE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,EAAE,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YAC7D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,SAAS,CAAC,CACxF,CAAC;QACJ,CAAC;QAED,oEAAoE;QACpE,sEAAsE;QACtE,gEAAgE;QAChE,+DAA+D;QAC/D,MAAM,SAAS,GAA2B;YACxC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC5D,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;SACnE,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC;YAC/B,QAAQ;YACR,MAAM,EAAE;gBACN,IAAI,EAAE,gBAAgB;gBACtB,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACzD,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;gBAC9E,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;gBACnE,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;gBACzD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;gBACzC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC;gBACtD,GAAG,CAAC,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;aACjD;YACD,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC5D,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACzC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EACzE,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,uBAAuB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,EACnF,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,mEAAmE;QACnE,0DAA0D;QAC1D,kDAAkD;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI;aACzB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YAChB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;YAClD,CAAC;YACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,GAAG,EAAE,MAAM,KAAK,MAAM;oBAAE,OAAO,KAAK,CAAC;YAC3C,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBACtC,IAAI,GAAG,EAAE,QAAQ,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;YAC/C,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;aACD,GAAG,CAAC,SAAS,CAAC,CAAC;QAElB,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI;YACJ,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS;YAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;SAClF,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU,CACjB,OAA0C;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;IAC1B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,KAA0C,CAAC;IACpD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAClC,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5C,MAAM,GAAG,GAEL;QACF,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,QAAQ,EAAE,KAAK,CAAC,QAA6B;QAC7C,SAAS,EAAE,KAAK,CAAC,SAA8B;QAC/C,YAAY,EAAE,KAAK,CAAC,KAAK;QACzB,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACxD,QAAQ,EAAE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAC9D,OAAO,EAAE,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QAC1D,MAAM,EAAE,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KACzD,CAAC;IACF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;QAAE,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,UAAU,CAAC;IAC3E,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC/D,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC5F,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAA6C,CAAC;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;QAAE,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IAC/E,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IACvD,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IACrE,OAAO,GAAwB,CAAC;AAClC,CAAC"}

package/dist/routes/auth.d.ts

@@ -0,0 +1,47 @@
+import { Hono } from 'hono';
+import type { ExchangeCodeFn, IdentityProviderBinding, RefreshTokenFn } from '../identity-provider-binding.js';
+import type { SessionStoreBinding } from '../session-store-binding.js';
+import type { OauthStateStore } from '../state-store-binding.js';
+import type { AppEnv } from '../types.js';
+/**
+ * Auth routes. Layer OAuth 2.0 / OIDC on top of the static
+ * bearer-token infrastructure. Bearer-token routes remain byte-shape-
+ * identical; auth flow is caller-plugged via `IdentityProviderBinding`
+ * (provider catalog) + `SessionStoreBinding` (session persistence) +
+ * `OauthStateStore` (short-lived CSRF/PKCE cache).
+ *
+ * Every route runs INSIDE the `/v1/*` auth chain and requires either a
+ * bearer or session token, EXCEPT `/v1/auth/callback/:providerId` which
+ * accepts the redirect from the provider carrying no framework token
+ * (that would be a chicken-and-egg — the caller hasn't obtained a
+ * session yet). `createApp` (`app.ts`) mounts the callback outside the
+ * auth chain so unauthenticated redirects reach it.
+ */
+export interface AuthRouterOptions {
+    readonly sessionStore: SessionStoreBinding;
+    readonly identityProvider: IdentityProviderBinding;
+    readonly stateStore: OauthStateStore;
+    readonly exchangeCode: ExchangeCodeFn;
+    readonly refreshToken?: RefreshTokenFn;
+    /**
+     * Default TTL for the CSRF/PKCE state cache entries. 10 minutes covers
+     * a normal browser hop with margin for slow provider consent screens
+     * without keeping a lost row around forever.
+     */
+    readonly stateTtlMs?: number;
+}
+/**
+ * Build the auth router. Two Hono routers are returned — one gated
+ * (mounted inside the `/v1/*` bearer chain: provider catalog CRUD,
+ * login initiation, refresh, logout) and one public-adjacent (mounted
+ * outside the bearer chain: callback endpoint the provider redirects
+ * to; still tenant-scoped via the state row's `tenantId`).
+ *
+ * `whoami` lives at `/v1/identity/whoami` and is unconditionally
+ * mounted from `identityRouter`.
+ */
+export declare function authRouters(options: AuthRouterOptions): {
+    readonly authed: Hono<AppEnv>;
+    readonly callback: Hono<AppEnv>;
+};
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,KAAK,EAGV,cAAc,EACd,uBAAuB,EAEvB,cAAc,EACf,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAW,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAID;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,iBAAiB,GAAG;IACvD,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;CACjC,CA6ZA"}