@kindgi/api 0.0.0-bootstrap.0 → 0.1.0

package/dist/routes/guardrails.js

@@ -0,0 +1,236 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { ref, tuplesForCreate } from '@kindgi/authz';
+import { validateGuardrailSpec } from '@kindgi/guardrails';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+import { parseScopeParams } from './scope-params.js';
+export function guardrailsRouter(binding, authorizer, onWrite) {
+    const r = new Hono();
+    // Authorization (PEP) — mirrors agents. Cascade via `guardrail#parent@project`
+    // written in-tx by register; direct check via `ref('guardrail', id)`.
+    if (authorizer !== undefined) {
+        r.use('/', async (c, next) => {
+            if (c.req.method !== 'POST')
+                return next();
+            const tenantId = c.get('tenantId');
+            const mw = authorizer.authorize('admin', async () => {
+                try {
+                    const body = await c.req.json();
+                    const pid = body !== null && typeof body === 'object'
+                        ? body.projectId
+                        : undefined;
+                    if (typeof pid === 'string' && pid.length > 0)
+                        return ref('project', pid);
+                }
+                catch {
+                    // POST handler validates + returns 400
+                }
+                return ref('tenant', tenantId);
+            });
+            return mw(c, next);
+        });
+        r.use('/', async (c, next) => {
+            if (c.req.method !== 'GET')
+                return next();
+            // A project filter needs read on that project. Parse it as the
+            // handler does (`?scopeKind=project&scopeId=`).
+            const s = parseScopeParams((n) => c.req.query(n), {
+                tenantId: c.get('tenantId'),
+            });
+            if (s.kind !== 'ok' || s.scope?.kind !== 'project')
+                return next();
+            const scopeProjectId = s.scope.projectId;
+            const mw = authorizer.authorize('read', () => ref('project', scopeProjectId));
+            return mw(c, next);
+        });
+        r.use('/:guardrailId/*', async (c, next) => {
+            const action = c.req.method === 'GET' ? 'read' : 'admin';
+            const guardrailId = c.req.param('guardrailId') ?? '';
+            const mw = authorizer.authorize(action, () => ref('guardrail', guardrailId));
+            return mw(c, next);
+        });
+        r.use('/:guardrailId', async (c, next) => {
+            if (c.req.method !== 'GET')
+                return next();
+            const guardrailId = c.req.param('guardrailId') ?? '';
+            const mw = authorizer.authorize('read', () => ref('guardrail', guardrailId));
+            return mw(c, next);
+        });
+    }
+    // ---------- GET / (list, cursor-paginated) ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const nameRaw = c.req.query('name');
+        const scopeParsed = parseScopeParams(c.req.query(), { tenantId });
+        if (scopeParsed.kind === 'err') {
+            c.status(statusFor('scope-invalid'));
+            return c.json(toWireError({ code: 'scope-invalid', message: scopeParsed.message }, requestId));
+        }
+        const page = await binding.list({
+            tenantId,
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(nameRaw !== undefined && nameRaw.length > 0 && { nameFilter: nameRaw }),
+            ...(scopeParsed.scope !== undefined && { scope: scopeParsed.scope }),
+            ...(scopeParsed.inherit !== undefined && { inherit: scopeParsed.inherit }),
+        });
+        return c.json({
+            data: page.data.map(serializeGuardrail),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /:guardrailId ----------
+    r.get('/:guardrailId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const guardrailId = c.req.param('guardrailId');
+        const guardrail = await binding.get({ tenantId, guardrailId });
+        if (guardrail === null) {
+            c.status(statusFor('guardrail-not-found'));
+            return c.json(toWireError({
+                code: 'guardrail-not-found',
+                message: `No guardrail registered with id "${guardrailId}"`,
+                guardrailId: guardrailId,
+            }, requestId));
+        }
+        return c.json(serializeGuardrail(guardrail));
+    });
+    // ---------- POST / (register) ----------
+    r.post('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        // `projectId` is REQUIRED on the POST body.
+        // Missing / empty / non-string → 400 bad-input. Stripped from the
+        // spec before `validateGuardrailSpec` because the spec schema
+        // rejects unknown top-level keys (the guardrail definition itself
+        // is project-agnostic — the caller controls what project the
+        // guardrail lands in).
+        const bodyObj = body;
+        const projectIdRaw = bodyObj.projectId;
+        if (typeof projectIdRaw !== 'string' || projectIdRaw.length === 0) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: '`projectId` is required' }, requestId));
+        }
+        const projectId = projectIdRaw;
+        const { projectId: _pid, ...bodyWithoutProjectId } = bodyObj;
+        const validated = validateGuardrailSpec(bodyWithoutProjectId);
+        if (validated.kind === 'err') {
+            c.status(statusFor('validation-failed'));
+            return c.json(toWireError({
+                code: 'validation-failed',
+                message: validated.error.message,
+                issues: validated.error.issues,
+            }, requestId));
+        }
+        const principal = c.get('principal');
+        const creatorUserId = principal?.actor.kind === 'user' ? principal.actor.id : undefined;
+        const outcome = await binding.register({
+            tenantId,
+            projectId,
+            guardrail: validated.value,
+            enqueueTuples: (guardrailId) => tuplesForCreate({ kind: 'guardrail', id: guardrailId, tenantId, projectId }, creatorUserId),
+        });
+        if (outcome.kind === 'already-registered') {
+            c.status(statusFor('guardrail-already-registered'));
+            return c.json(toWireError({
+                code: 'guardrail-already-registered',
+                message: `Guardrail "${outcome.guardrailId}" is already registered`,
+                guardrailId: outcome.guardrailId,
+            }, requestId));
+        }
+        if (outcome.kind === 'project-not-found') {
+            // Caller supplied a `projectId` that does not resolve within
+            // this tenant. Distinct signal from `already-registered` so the
+            // client can prompt for a valid project rather than assume the
+            // id was already used. `bad-input` is the closest existing
+            // error code — the shape (400 + code) is stable; the caller
+            // learns from the message which field was invalid.
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({
+                code: 'bad-input',
+                message: `\`projectId\` "${outcome.projectId}" does not resolve to a project in this tenant`,
+            }, requestId));
+        }
+        if (onWrite !== undefined) {
+            try {
+                await onWrite({
+                    tenantId,
+                    guardrailId: outcome.guardrailId,
+                    kind: 'register',
+                });
+            }
+            catch {
+                // Post-write hooks are advisory (cache invalidation etc.).
+                // A hook failure does NOT roll back the register — the row
+                // is durably stored; a stale in-memory cache will self-heal
+                // on the next boot.
+            }
+        }
+        c.status(201);
+        return c.json({
+            guardrailId: outcome.guardrailId,
+        });
+    });
+    // ---------- POST /:guardrailId/unregister ----------
+    r.post('/:guardrailId/unregister', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const guardrailId = c.req.param('guardrailId');
+        const outcome = await binding.unregister({ tenantId, guardrailId });
+        if (!outcome.unregistered) {
+            c.status(statusFor('guardrail-not-found'));
+            return c.json(toWireError({
+                code: 'guardrail-not-found',
+                message: `No guardrail "${guardrailId}" to unregister`,
+                guardrailId: guardrailId,
+            }, requestId));
+        }
+        if (onWrite !== undefined) {
+            try {
+                await onWrite({ tenantId, guardrailId, kind: 'unregister' });
+            }
+            catch {
+                // See register path — hooks are advisory.
+            }
+        }
+        return c.json({
+            guardrailId: guardrailId,
+            unregistered: true,
+        });
+    });
+    return r;
+}
+function serializeGuardrail(i) {
+    return {
+        id: i.id,
+        ...(i.name !== undefined && { name: i.name }),
+        ...(i.description !== undefined && { description: i.description }),
+        kind: i.kind,
+        ...(i.check !== undefined && { check: i.check }),
+        ...(i.config !== undefined && { config: i.config }),
+        action: i.action,
+        ...(i.severity !== undefined && { severity: i.severity }),
+        ...(i.scope !== undefined && { scope: i.scope }),
+        ...(i.budget !== undefined && { budget: i.budget }),
+        ...(i.judgeCapabilities !== undefined && { judgeCapabilities: i.judgeCapabilities }),
+    };
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/routes/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/routes/guardrails.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAkB,GAAG,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAkB,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAG3E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AA6BrD,MAAM,UAAU,gBAAgB,CAC9B,OAAiC,EACjC,UAAuB,EACvB,OAA4B;IAE5B,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,+EAA+E;IAC/E,sEAAsE;IACtE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;YAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE;gBAClD,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAChC,MAAM,GAAG,GACP,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;wBACvC,CAAC,CAAE,IAAgC,CAAC,SAAS;wBAC7C,CAAC,CAAC,SAAS,CAAC;oBAChB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;wBAAE,OAAO,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBAC5E,CAAC;gBAAC,MAAM,CAAC;oBACP,uCAAuC;gBACzC,CAAC;gBACD,OAAO,GAAG,CAAC,QAAQ,EAAE,QAA6B,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;YACH,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,+DAA+D;YAC/D,gDAAgD;YAChD,MAAM,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;gBAChD,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,SAAS;gBAAE,OAAO,IAAI,EAAE,CAAC;YAClE,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,SAA8B,CAAC;YAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;YAC9E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACzD,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;QACH,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;YACvC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,KAAK;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC1C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;YAC7E,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,uDAAuD;IACvD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClE,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAU,CAAC,CAAC;YAC9C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;YAC3E,GAAG,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;YACpE,GAAG,CAAC,WAAW,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACvC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,oCAAoC,WAAgC,GAAG;gBAChF,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,0CAA0C;IAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAE/C,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QAED,4CAA4C;QAC5C,kEAAkE;QAClE,8DAA8D;QAC9D,kEAAkE;QAClE,6DAA6D;QAC7D,uBAAuB;QACvB,MAAM,OAAO,GAAG,IAA+B,CAAC;QAChD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC;QACvC,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,SAAS,CAAC,CAClF,CAAC;QACJ,CAAC;QACD,MAAM,SAAS,GAAG,YAAyB,CAAC;QAC5C,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC;QAE7D,MAAM,SAAS,GAAG,qBAAqB,CAAC,oBAAoB,CAAC,CAAC;QAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,mBAAmB,CAAU,CAAC,CAAC;YAClD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO;gBAChC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,MAA8C;aACvE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,MAAM,aAAa,GACjB,SAAS,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,SAAS,CAAC,KAAK,CAAC,EAAa,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC;YACrC,QAAQ;YACR,SAAS;YACT,SAAS,EAAE,SAAS,CAAC,KAAK;YAC1B,aAAa,EAAE,CAAC,WAAW,EAAE,EAAE,CAC7B,eAAe,CACb,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,WAA0B,EAAE,QAAQ,EAAE,SAAS,EAAE,EAC1E,aAAa,CACd;SACJ,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC1C,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,8BAA8B,CAAU,CAAC,CAAC;YAC7D,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,8BAA8B;gBACpC,OAAO,EAAE,cAAc,OAAO,CAAC,WAAgC,yBAAyB;gBACxF,WAAW,EAAE,OAAO,CAAC,WAAgC;aACtD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,6DAA6D;YAC7D,gEAAgE;YAChE,+DAA+D;YAC/D,2DAA2D;YAC3D,4DAA4D;YAC5D,mDAAmD;YACnD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,kBAAkB,OAAO,CAAC,SAA8B,gDAAgD;aAClH,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC;oBACZ,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,IAAI,EAAE,UAAU;iBACjB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;gBAC3D,2DAA2D;gBAC3D,4DAA4D;gBAC5D,oBAAoB;YACtB,CAAC;QACH,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,OAAO,CAAC,WAAgC;SACtD,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,sDAAsD;IACtD,CAAC,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAgB,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,qBAAqB,CAAU,CAAC,CAAC;YACpD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,OAAO,EAAE,iBAAiB,WAAgC,iBAAiB;gBAC3E,WAAW,EAAE,WAAgC;aAC9C,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,0CAA0C;YAC5C,CAAC;QACH,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,WAAgC;YAC7C,YAAY,EAAE,IAAI;SACnB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAY;IACtC,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAuB;QAC7B,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,IAAI,EAAE,CAAC,CAAC,IAAI;QACZ,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QACzD,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QACnD,GAAG,CAAC,CAAC,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,EAAE,CAAC;KACrF,CAAC;AACJ,CAAC"}

package/dist/routes/identity.d.ts

@@ -0,0 +1,39 @@
+import { Hono } from 'hono';
+import type { IdentityDirectoryBinding } from '../identity-directory-binding.js';
+import type { SessionStoreBinding } from '../session-store-binding.js';
+import type { AppEnv } from '../types.js';
+/**
+ * Identity routes — the canonical caller-identity surface.
+ *
+ * Hosts the user directory (`/users/*`) and the single canonical
+ * `whoami` endpoint, so clients have exactly one whoami endpoint to
+ * consume.
+ *
+ * Five routes:
+ *   - `GET  /v1/identity/whoami`                        (self — always mounted)
+ *   - `GET  /v1/identity/users`                         (cursor-paginated list)
+ *   - `GET  /v1/identity/users/:userId`                 (get)
+ *   - `GET  /v1/identity/users/:userId/sessions`        (active sessions)
+ *   - `POST /v1/identity/users/:userId/revoke-sessions` (admin op)
+ *
+ * `directory` is optional: deployments without an `IdentityDirectoryBinding`
+ * still get `whoami` (returning the minimal `{ tenantId, scopes, ... }` shape
+ * plus `sessionId`/`providerId` if the middleware attached them). When the
+ * directory is wired, `whoami` enriches the response with the fuller
+ * `UserRecord` and the four `/users/*` routes mount too.
+ */
+export interface IdentityRouterOptions {
+    /**
+     * Optional. When present, the `/users/*` routes mount and `whoami`
+     * enriches with `UserRecord`. When absent, only `whoami` mounts.
+     */
+    readonly directory?: IdentityDirectoryBinding;
+    /**
+     * Optional. When present, `GET /v1/identity/whoami` also returns
+     * `expiresAt` for callers on a session token. Absent for
+     * deployments that don't wire an OAuth surface.
+     */
+    readonly sessionStore?: SessionStoreBinding;
+}
+export declare function identityRouter(options?: IdentityRouterOptions): Hono<AppEnv>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/routes/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/routes/identity.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAK5B,OAAO,KAAK,EACV,wBAAwB,EAGzB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,wBAAwB,CAAC;IAC9C;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;CAC7C;AAED,wBAAgB,cAAc,CAAC,OAAO,GAAE,qBAA0B,GAAG,IAAI,CAAC,MAAM,CAAC,CA+HhF"}

package/dist/routes/identity.js

@@ -0,0 +1,138 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit } from './pagination.js';
+export function identityRouter(options = {}) {
+    const { directory, sessionStore } = options;
+    const r = new Hono();
+    // ---------- GET / whoami ----------
+    // Mounted first so `/v1/identity/whoami` resolves here rather than
+    // being captured by the `:userId` param on subsequent routes.
+    r.get('/whoami', async (c) => {
+        const tenantId = c.get('tenantId');
+        const sessionId = c.get('sessionId');
+        const userId = c.get('userId');
+        const providerId = c.get('providerId');
+        const scopes = c.get('scopes') ?? [];
+        const reviewerRole = c.get('reviewerRole');
+        const body = { tenantId };
+        if (sessionId !== undefined)
+            body.sessionId = sessionId;
+        if (providerId !== undefined)
+            body.providerId = providerId;
+        body.scopes = scopes;
+        if (reviewerRole !== undefined)
+            body.reviewerRole = reviewerRole;
+        if (userId !== undefined) {
+            body.userId = userId;
+            if (directory !== undefined) {
+                const user = await directory.getUser({ tenantId, userId });
+                if (user !== null)
+                    body.user = serializeUser(user);
+            }
+        }
+        if (sessionId !== undefined && sessionStore !== undefined) {
+            const session = await sessionStore.get({ tenantId, sessionId });
+            if (session !== null)
+                body.expiresAt = session.expiresAt;
+        }
+        return c.json(body);
+    });
+    if (directory === undefined) {
+        // Deployments without a directory binding get whoami only.
+        // `/users/*` routes fall through to the app-level 404.
+        return r;
+    }
+    // ---------- GET /users (list) ----------
+    r.get('/users', async (c) => {
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const cursorRaw = c.req.query('cursor');
+        const queryRaw = c.req.query('query');
+        const page = await directory.listUsers({
+            tenantId,
+            limit,
+            ...(cursorRaw !== undefined && cursorRaw.length > 0 && { cursor: cursorRaw }),
+            ...(queryRaw !== undefined && queryRaw.length > 0 && { query: queryRaw }),
+        });
+        return c.json({
+            data: page.data.map(serializeUser),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- GET /users/:userId (get) ----------
+    r.get('/users/:userId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const userId = c.req.param('userId');
+        const user = await directory.getUser({ tenantId, userId });
+        if (user === null) {
+            c.status(statusFor('identity-user-not-found'));
+            return c.json(toWireError({
+                code: 'identity-user-not-found',
+                message: `No user with id "${userId}" under this tenant`,
+                userId: userId,
+            }, requestId));
+        }
+        return c.json(serializeUser(user));
+    });
+    // ---------- GET /users/:userId/sessions (list active sessions) ----------
+    r.get('/users/:userId/sessions', async (c) => {
+        const tenantId = c.get('tenantId');
+        const userId = c.req.param('userId');
+        const page = await directory.listSessions({ tenantId, userId });
+        return c.json({
+            data: page.data.map(serializeSession),
+            hasMore: page.nextCursor !== undefined,
+            ...(page.nextCursor !== undefined && { nextCursor: page.nextCursor }),
+        });
+    });
+    // ---------- POST /users/:userId/revoke-sessions (admin) ----------
+    r.post('/users/:userId/revoke-sessions', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const userId = c.req.param('userId');
+        let outcome;
+        try {
+            outcome = await directory.revokeAllSessions({ tenantId, userId });
+        }
+        catch (err) {
+            c.status(statusFor('identity-revoke-failed'));
+            return c.json(toWireError({
+                code: 'identity-revoke-failed',
+                message: err instanceof Error ? err.message : 'session revocation failed',
+                userId: userId,
+            }, requestId));
+        }
+        return c.json({
+            userId: outcome.userId,
+            revokedCount: outcome.revokedCount,
+        });
+    });
+    return r;
+}
+function serializeUser(u) {
+    return {
+        userId: u.userId,
+        tenantId: u.tenantId,
+        ...(u.primaryEmail !== undefined && { primaryEmail: u.primaryEmail }),
+        ...(u.displayName !== undefined && { displayName: u.displayName }),
+        createdAt: u.createdAt,
+        ...(u.lastActiveAt !== undefined && { lastActiveAt: u.lastActiveAt }),
+        ...(u.metadata !== undefined && { metadata: u.metadata }),
+    };
+}
+function serializeSession(s) {
+    return {
+        sessionId: s.sessionId,
+        userId: s.userId,
+        providerId: s.providerId,
+        createdAt: s.createdAt,
+        expiresAt: s.expiresAt,
+        scopes: s.scopes,
+        ...(s.revokedAt !== undefined && { revokedAt: s.revokedAt }),
+    };
+}
+//# sourceMappingURL=identity.js.map

package/dist/routes/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/routes/identity.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAQtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAoC7C,MAAM,UAAU,cAAc,CAAC,UAAiC,EAAE;IAChE,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC;IAC5C,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAE7B,qCAAqC;IACrC,mEAAmE;IACnE,8DAA8D;IAC9D,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAA0B,CAAC;QAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAuB,CAAC;QACrD,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,CAAuB,CAAC;QAC7D,MAAM,MAAM,GAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAmC,IAAI,EAAE,CAAC;QACxE,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAuB,CAAC;QAEjE,MAAM,IAAI,GAA4B,EAAE,QAAQ,EAAE,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QACxD,IAAI,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,YAAY,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QAEjE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YACrB,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC3D,IAAI,IAAI,KAAK,IAAI;oBAAE,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,IAAI,OAAO,KAAK,IAAI;gBAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,2DAA2D;QAC3D,uDAAuD;QACvD,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0CAA0C;IAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC;YACrC,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAmB,EAAE,CAAC;YACvF,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;SAC1E,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC;YAClC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,iDAAiD;IACjD,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,yBAAyB,CAAU,CAAC,CAAC;YACxD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,oBAAoB,MAA2B,qBAAqB;gBAC7E,MAAM,EAAE,MAA2B;aACpC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,CAAC,CAAC,GAAG,CAAC,yBAAyB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YACrC,OAAO,EAAE,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAA+B,EAAE,CAAC;SAC3F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,CAAC,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAW,CAAC;QAE/C,IAAI,OAA2E,CAAC;QAChF,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,SAAS,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACpE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAU,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,2BAA2B;gBACzE,MAAM,EAAE,MAA2B;aACpC,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,OAAO,CAAC,MAA2B;YAC3C,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,CAAa;IAClC,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,QAAQ,EAAE,CAAC,CAAC,QAA6B;QACzC,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC;QACrE,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,YAAiC,EAAE,CAAC;QAC1F,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAiB;IACzC,OAAO;QACL,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAA2B;QACrC,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,SAAS,EAAE,CAAC,CAAC,SAA8B;QAC3C,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAA8B,EAAE,CAAC;KAClF,CAAC;AACJ,CAAC"}

package/dist/routes/mcp.d.ts

@@ -0,0 +1,23 @@
+import { Hono } from 'hono';
+import { type MCPClientProbeBinding, type MCPEndpointRegistryBinding } from '../mcp-endpoint-binding.js';
+import type { Authorizer } from '../middleware/authorize.js';
+import { type TenantHostAccess } from '../tenant-host-access.js';
+import type { AppEnv } from '../types.js';
+/**
+ * MCP-endpoint routes (mounted at `/v1/mcp`). Tenants declare the
+ * remote MCP servers they want the runtime to consume; at boot the
+ * runtime discovers each endpoint's tools and registers them into
+ * `ToolRegistryBinding` under the same tenant.
+ *
+ * Secrets do NOT cross the wire — `MCPEndpoint.secretRef` names a
+ * secret in the deployment's store, never a plaintext credential. The
+ * API surface accepts, stores, and returns only the reference.
+ *
+ * `hostAccess` (`KINDGI_TENANT_HOST_ACCESS`): under `deployed`, a stdio
+ * endpoint — a command the server would run on its own host — is
+ * refused with `403 host-access-denied`.
+ */
+export declare function mcpRouter(binding: MCPEndpointRegistryBinding, clientProbe: MCPClientProbeBinding | undefined, authorizer: Authorizer | undefined, options: {
+    readonly hostAccess: TenantHostAccess;
+}): Hono<AppEnv>;
+//# sourceMappingURL=mcp.d.ts.map

package/dist/routes/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../../src/routes/mcp.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,OAAO,EACL,KAAK,qBAAqB,EAG1B,KAAK,0BAA0B,EAOhC,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,KAAK,gBAAgB,EAAiC,MAAM,0BAA0B,CAAC;AAChG,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAK1C;;;;;;;;;;;;;GAaG;AACH,wBAAgB,SAAS,CACvB,OAAO,EAAE,0BAA0B,EACnC,WAAW,EAAE,qBAAqB,GAAG,SAAS,EAC9C,UAAU,EAAE,UAAU,GAAG,SAAS,EAClC,OAAO,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,GACjD,IAAI,CAAC,MAAM,CAAC,CAmhBd"}