@kindgi/api 0.0.0-bootstrap.0 → 0.1.1

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,KAAK,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,wBAAwB,EACxB,WAAW,EACX,qBAAqB,EACrB,uBAAuB,EACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACvB,cAAc,EACf,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACnG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,KAAK,aAAa,EAAwB,MAAM,sBAAsB,CAAC;AAGhF,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,6BAA6B,CAAC;AAKrC,OAAO,EAAE,KAAK,eAAe,EAA2B,MAAM,uBAAuB,CAAC;AACtF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,4BAA4B,CAAC;AA0CpC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACtE,OAAO,KAAK,EAAE,iBAAiB,IAAI,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,KAAK,eAAe,EAAiC,MAAM,0BAA0B,CAAC;AAC/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAE5E;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAClD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,EAAE,kBAAkB,CAAC;IAChD;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IAEtC;;;;;;;;OAQG;IACH,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,CAAC;IAExD;;;;;;;;;OASG;IACH,QAAQ,CAAC,aAAa,EAAE,kBAAkB,CAAC;IAE3C;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;IAC9C;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B;;;;WAIG;QACH,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;KAC/C,CAAC;IACF;;;;;;;;;;;;;;;OAeG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IACzC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,gBAAgB,CAAC;IACjD;;;;;;;OAOG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,2BAA2B,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C;;;;;;;;OAQG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,mBAAmB,EAAE,aAAa,CAAC;IACjE;;;;;;OAMG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,wBAAwB,EAAE,kBAAkB,CAAC;IAChF;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,gBAAgB,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC;;;;;;;;OAQG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IAChD;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IACxD;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IACpD;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,uBAAuB,EAAE,iBAAiB,CAAC;IAC7E;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,0BAA0B,CAAC;IAC1D;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IAC7C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAClD;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;OASG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,sBAAsB,CAAC;IAClD;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IACnD;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,qBAAqB,CAAC;IAChD;;;;;;;;;OASG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAC7C;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,mBAAmB,CAAC;IAC5C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IACpD;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,cAAc,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,eAAe,CAAC;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,iBAAiB,CAAC;IAChD;;;;;;;OAOG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,yBAAyB,CAAC;IACxD;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C;;;;;;;;;;;;OAYG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,wBAAwB,CAAC;IACtD;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IAEjC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;IACnC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IACvD;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;IACzC,QAAQ,CAAC,wBAAwB,CAAC,EAAE,wBAAwB,CAAC;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,uBAAuB,CAAC;IAC3D;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;IACjC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;IACxC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;CACpD;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAC,MAAM,CAAC,CAgb7D"}

package/dist/app.js

@@ -0,0 +1,397 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Scalar } from '@scalar/hono-api-reference';
+import { Hono } from 'hono';
+import { bearerAuthMiddleware } from './middleware/auth.js';
+import { createAuthorizer } from './middleware/authorize.js';
+import { mapThrownError } from './middleware/error-mapper.js';
+import { createInMemoryIdempotencyStore, idempotencyMiddleware, } from './middleware/idempotency.js';
+import { principalMiddleware } from './middleware/principal.js';
+import { publicRunCorsMiddleware, publicRunRouteMatcher } from './middleware/public-run-routes.js';
+import { requestIdMiddleware } from './middleware/request-id.js';
+import { sigv4Middleware } from './middleware/sigv4.js';
+import { generateOpenApiDocument } from './openapi/generate.js';
+import { mintPublicRunToken, resolvePublicRunTokenConfig, } from './public-run-token.js';
+import { createInMemoryRotationStatusStore, } from './rotation-status-store.js';
+import { adaptersRouter } from './routes/adapters.js';
+import { agentsRouter } from './routes/agents.js';
+import { approvalsRouter } from './routes/approvals.js';
+import { artifactsRouter } from './routes/artifacts.js';
+import { auditRouter } from './routes/audit.js';
+import { authRouters } from './routes/auth.js';
+import { capabilitiesRouter } from './routes/capabilities.js';
+import { complianceRouter } from './routes/compliance.js';
+import { conversationsRouter } from './routes/conversations.js';
+import { costRouter } from './routes/cost.js';
+import { deploymentsRouter } from './routes/deployments.js';
+import { envRouter } from './routes/env.js';
+import { evalRunsRouters } from './routes/eval-runs.js';
+import { evalSuitesRouter } from './routes/eval-suites.js';
+import { eventTriggersRouter } from './routes/event-triggers.js';
+import { flowsRouter } from './routes/flows.js';
+import { guardrailsRouter } from './routes/guardrails.js';
+import { identityRouter } from './routes/identity.js';
+import { mcpRouter } from './routes/mcp.js';
+import { memoryRouter } from './routes/memory.js';
+import { observationsRouter } from './routes/observations.js';
+import { orgsRouter } from './routes/orgs.js';
+import { policiesRouter } from './routes/policies.js';
+import { projectsRouter } from './routes/projects.js';
+import { proposalsRouter } from './routes/proposals.js';
+import { provenanceRouter } from './routes/provenance.js';
+import { providersRouter } from './routes/providers.js';
+import { publicRunTokensRouter } from './routes/public-run-tokens.js';
+import { retentionRouter } from './routes/retention.js';
+import { reviewersRouter } from './routes/reviewers.js';
+import { runsRouter } from './routes/runs.js';
+import { s3Router } from './routes/s3.js';
+import { schedulesRouter } from './routes/schedules.js';
+import { secretsRouter } from './routes/secrets.js';
+import { signingKeysRouter } from './routes/signing-keys.js';
+import { teamsRouter } from './routes/teams.js';
+import { tenantRouter } from './routes/tenant.js';
+import { tokensRouter } from './routes/tokens.js';
+import { toolsRouter } from './routes/tools.js';
+import { webhookEndpointsRouter } from './routes/webhook-endpoints.js';
+import { webhooksRouter } from './routes/webhooks.js';
+import { createInMemoryOauthStateStore } from './state-store-binding.js';
+export function createApp(input) {
+    const app = new Hono();
+    const runBinding = input.kernelBinding.run;
+    // ---------- global middleware ----------
+    app.use('*', requestIdMiddleware());
+    // A thrown exception: a 500 wire error with its message and request id.
+    app.onError(mapThrownError);
+    // Public run tokens: checked once at startup; CORS for the two routes
+    // they can call, ahead of authentication so preflights pass.
+    const publicRunTokens = input.publicRunTokens;
+    const publicRunTokenLimits = publicRunTokens !== undefined ? resolvePublicRunTokenConfig(publicRunTokens) : undefined;
+    const mintPublicRunTokenFor = (tenantId, runIds, ttlSeconds) => mintPublicRunToken({
+        signingKey: publicRunTokens.signingKey,
+        keyId: publicRunTokens.keyId,
+        tenantId,
+        runIds,
+        ttlSeconds,
+    });
+    if (publicRunTokens?.allowedOrigins !== undefined && publicRunTokens.allowedOrigins.length > 0) {
+        app.use('/v1/*', publicRunCorsMiddleware(publicRunTokens.allowedOrigins));
+    }
+    // ---------- public routes ----------
+    app.get('/health', (c) => c.json({ ok: true }));
+    // The spec document is public (per API-ROUTE-CONVENTIONS.md §2.2) so
+    // it's mounted before the /v1/* auth chain rather than inside it.
+    const openApiDoc = generateOpenApiDocument(input.openapi ?? {});
+    app.get('/v1/openapi.json', (c) => c.json(openApiDoc));
+    // Optional Scalar-rendered interactive API reference UI. Opt-in via
+    // `openapi.docs`; when absent the docs path is unmounted (404). Also
+    // public — the reference reads the (already-public) `/v1/openapi.json`
+    // in the browser, so it doesn't need to sit inside the bearer chain.
+    if (input.openapi?.docs !== undefined && input.openapi.docs !== false) {
+        const docsConfig = input.openapi.docs === true ? {} : input.openapi.docs;
+        const docsPath = docsConfig.path ?? '/docs';
+        app.get(docsPath, Scalar({
+            url: '/v1/openapi.json',
+            pageTitle: docsConfig.title ?? 'Kindgi API',
+            ...(docsConfig.theme !== undefined && {
+                theme: docsConfig.theme,
+            }),
+        }));
+    }
+    // ---------- authenticated `/v1/*` routes ----------
+    const v1 = new Hono();
+    const sessionCfg = input.session;
+    const inactivityTimeoutMs = sessionCfg?.inactivityTimeout;
+    v1.use('*', bearerAuthMiddleware(input.resolveToken, {
+        ...(publicRunTokens !== undefined && {
+            publicRunTokens: {
+                signingKey: publicRunTokens.signingKey,
+                isAllowed: publicRunRouteMatcher(),
+            },
+        }),
+        ...(input.sessionStore !== undefined && { sessionStore: input.sessionStore }),
+        ...(inactivityTimeoutMs !== undefined && { inactivityTimeoutMs }),
+        ...(sessionCfg?.touchThrottle !== undefined && {
+            touchThrottleMs: sessionCfg.touchThrottle,
+        }),
+    }));
+    // Principal construction — runs after bearer so it can read the
+    // resolved tenantId/userId/sessionId. If `authz` is not configured,
+    // still populate the principal (cheap, and lets `can`/`check` work
+    // as inspection helpers even when authorize() enforcement is off).
+    v1.use('*', principalMiddleware());
+    const authorizer = input.authz !== undefined ? createAuthorizer(input.authz.authzCheckBinding) : undefined;
+    const tenantHierarchyBinding = input.tenantHierarchyBinding;
+    v1.use('*', idempotencyMiddleware(input.idempotencyStore ?? createInMemoryIdempotencyStore()));
+    v1.route('/runs', runsRouter(input.runHandler, runBinding, {
+        ...(input.eventBus !== undefined && { eventBus: input.eventBus }),
+        ...(publicRunTokenLimits !== undefined && {
+            publicRunTokens: {
+                mint: (tenantId, runIds) => mintPublicRunTokenFor(tenantId, runIds, publicRunTokenLimits.defaultTtlSeconds),
+            },
+        }),
+    }, authorizer));
+    v1.route('/conversations', conversationsRouter(input.conversationBinding, runBinding));
+    if (publicRunTokenLimits !== undefined) {
+        v1.route('/tokens/public', publicRunTokensRouter(runBinding, { mint: mintPublicRunTokenFor, ...publicRunTokenLimits }, authorizer));
+    }
+    if (input.tokenAdmin !== undefined) {
+        v1.route('/tokens', tokensRouter(input.tokenAdmin, authorizer));
+    }
+    // Mount the reviewer roster sub-resource BEFORE the approvals router
+    // so `/v1/approvals/reviewers/*` resolves here rather than being
+    // captured by the `:approvalId` param on the approvals router.
+    if (input.reviewerRegistry !== undefined) {
+        v1.route('/approvals/reviewers', reviewersRouter(input.reviewerRegistry));
+    }
+    if (input.reviewerBinding !== undefined && input.hitlBinding !== undefined) {
+        v1.route('/approvals', approvalsRouter(input.conversationBinding, input.reviewerBinding, input.hitlBinding, runBinding, {
+            ...(input.signingKey !== undefined && { signingKey: input.signingKey }),
+            // Inline resume after approval-complete drives
+            // completeToken. Passing the runHandler here means the route
+            // calls `runHandler.resumeRun(...)` synchronously in the same
+            // request so the reviewer's response reflects the resumed run's
+            // new state (running / completed / re-suspended).
+            runHandler: input.runHandler,
+        }));
+    }
+    if (input.enableObservations === true && input.supervisor !== undefined) {
+        v1.route('/observations', observationsRouter(input.supervisor));
+    }
+    if (input.agentRegistry !== undefined) {
+        v1.route('/agents', agentsRouter(input.agentRegistry, authorizer));
+    }
+    if (input.flowRegistry !== undefined) {
+        v1.route('/flows', flowsRouter(input.flowRegistry, authorizer));
+    }
+    if (input.toolRegistry !== undefined) {
+        v1.route('/tools', toolsRouter(input.toolRegistry, authorizer, input.onToolWrite));
+    }
+    if (input.guardrailRegistry !== undefined) {
+        v1.route('/guardrails', guardrailsRouter(input.guardrailRegistry, authorizer, input.onGuardrailWrite));
+    }
+    if (input.retention !== undefined) {
+        v1.route('/retention', retentionRouter(input.retention, authorizer));
+    }
+    if (input.memory !== undefined) {
+        v1.route('/memory', memoryRouter(input.memory));
+    }
+    if (input.supervisor !== undefined) {
+        v1.route('/proposals', proposalsRouter(input.supervisor));
+    }
+    v1.route('/provenance', provenanceRouter(input.provenanceBinding, {
+        conversationBinding: input.conversationBinding,
+        ...(input.signingKey !== undefined && { signingKey: input.signingKey }),
+    }));
+    if (input.auditEvents !== undefined &&
+        input.complianceClassifier !== undefined &&
+        input.complianceGenerator !== undefined) {
+        v1.route('/compliance', complianceRouter({
+            auditEvents: input.auditEvents,
+            classifier: input.complianceClassifier,
+            complianceGenerator: input.complianceGenerator,
+            ...(input.signingKey !== undefined && { signingKey: input.signingKey }),
+        }));
+    }
+    if (input.blobStorage !== undefined) {
+        v1.route('/artifacts', artifactsRouter(input.blobStorage));
+    }
+    if (input.capabilityRegistry !== undefined) {
+        v1.route('/capabilities', capabilitiesRouter(input.capabilityRegistry));
+    }
+    if (input.providerRegistry !== undefined) {
+        v1.route('/providers', providersRouter(input.providerRegistry, input.onProviderWrite));
+    }
+    if (input.mcpEndpointRegistry !== undefined) {
+        v1.route('/mcp', mcpRouter(input.mcpEndpointRegistry, input.mcpClientProbe, authorizer, {
+            hostAccess: input.tenantHostAccess ?? 'deployed',
+        }));
+    }
+    // Identity mounts unconditionally so `/v1/identity/whoami` is always
+    // reachable. `/users/*` routes register only when an
+    // `identityDirectory` binding is provided (deployments without a
+    // directory adapter still get whoami).
+    v1.route('/identity', identityRouter({
+        ...(input.identityDirectory !== undefined && { directory: input.identityDirectory }),
+        ...(input.sessionStore !== undefined && { sessionStore: input.sessionStore }),
+    }));
+    if (input.cost !== undefined) {
+        v1.route('/cost', costRouter(input.cost));
+    }
+    if (input.adapterRegistry !== undefined) {
+        v1.route('/adapters', adaptersRouter(input.adapterRegistry, input.adapterFactories));
+    }
+    // Trigger admin surfaces. Three sibling routers over the same
+    // `TriggerRegistryBinding` — each pins its own kind. There is no
+    // external webhook receiver route here (it would need
+    // unauthenticated tenant resolution).
+    if (input.triggerRegistry !== undefined) {
+        v1.route('/schedules', schedulesRouter(input.triggerRegistry));
+        v1.route('/event-triggers', eventTriggersRouter(input.triggerRegistry));
+        v1.route('/webhooks', webhooksRouter(input.triggerRegistry));
+    }
+    if (input.webhookEndpoints !== undefined) {
+        v1.route('/webhook-endpoints', webhookEndpointsRouter(input.webhookEndpoints));
+    }
+    if (input.policyRegistry !== undefined) {
+        v1.route('/policies', policiesRouter(input.policyRegistry));
+    }
+    if (input.evalSuiteRegistry !== undefined) {
+        v1.route('/eval-suites', evalSuitesRouter(input.evalSuiteRegistry, authorizer));
+    }
+    // ---------- platform hierarchy ----------
+    // Mounts are independent: `/v1/orgs`, `/v1/teams`, `/v1/projects`,
+    // `/v1/tenant`. Each requires its own binding. Team + Project
+    // sub-resources (`/memberships`) require both bindings supplied.
+    if (input.orgBinding !== undefined) {
+        v1.route('/orgs', orgsRouter(input.orgBinding, tenantHierarchyBinding, authorizer));
+    }
+    if (input.teamBinding !== undefined && input.teamMembershipBinding !== undefined) {
+        v1.route('/teams', teamsRouter(input.teamBinding, input.teamMembershipBinding, tenantHierarchyBinding, authorizer));
+    }
+    if (input.projectBinding !== undefined && input.projectMembershipBinding !== undefined) {
+        v1.route('/projects', projectsRouter(input.projectBinding, input.projectMembershipBinding, tenantHierarchyBinding, authorizer));
+    }
+    // `/v1/tenant` is always mounted (reads the tenant through the
+    // tenant-hierarchy binding);
+    // `/config` sub-routes are gated on the presence of at least one of
+    // `envBinding` / `secretsBinding`.
+    v1.route('/tenant', tenantRouter({
+        tenantHierarchyBinding: input.tenantHierarchyBinding,
+        ...(input.envBinding !== undefined && { envBinding: input.envBinding }),
+        ...(input.secretsBinding !== undefined && { secretsBinding: input.secretsBinding }),
+        ...(authorizer !== undefined && { authorizer }),
+    }));
+    // ---------- env + secrets ----------
+    // Dedicated env/secrets HTTP surface. `/v1/env/*` mounts iff
+    // `envBinding` is wired; `/v1/secrets/*` iff `secretsBinding` is
+    // wired. `secretsBinding` also drives the async-rotation status
+    // store — an in-memory reference is used when the caller doesn't
+    // plug in a durable one.
+    if (input.envBinding !== undefined) {
+        v1.route('/env', envRouter(input.envBinding, authorizer));
+    }
+    // Audit query surface. Admin-only PEP applied inside the router
+    // (self-contained; no plumbing here).
+    if (input.auditEvents !== undefined) {
+        v1.route('/audit', auditRouter(input.auditEvents, authorizer));
+    }
+    if (input.secretsBinding !== undefined) {
+        v1.route('/secrets', secretsRouter({
+            secretsBinding: input.secretsBinding,
+            rotationStatusStore: input.rotationStatusStore ?? createInMemoryRotationStatusStore(),
+            ...(authorizer !== undefined && { authorizer }),
+        }));
+    }
+    // ---------- deployments ----------
+    // Requires all three of: DeploymentBinding + SigningKeyRegistryBinding +
+    // ImageRegistryBinding. Optional tool/guardrail/agent/flow registries
+    // are threaded through so the atomic transaction upserts primitives
+    // from the deployment's index.json into the same catalogs the SDK
+    // publish surfaces consume — a deploy is just a bulk publish + ledger
+    // record, signed end-to-end.
+    // The trust list `POST /v1/deployments` verifies signers against.
+    // Mounted on its own: a deployment can trust keys before it accepts
+    // deployments.
+    if (input.signingKeyRegistry !== undefined) {
+        v1.route('/signing-keys', signingKeysRouter(input.signingKeyRegistry));
+    }
+    if (input.deploymentRegistry !== undefined &&
+        input.signingKeyRegistry !== undefined &&
+        input.imageRegistry !== undefined) {
+        v1.route('/deployments', deploymentsRouter({
+            deploymentRegistry: input.deploymentRegistry,
+            signingKeyRegistry: input.signingKeyRegistry,
+            imageRegistry: input.imageRegistry,
+            ...(input.toolRegistry !== undefined && { toolRegistry: input.toolRegistry }),
+            ...(input.guardrailRegistry !== undefined && {
+                guardrailRegistry: input.guardrailRegistry,
+            }),
+            ...(input.agentRegistry !== undefined && { agentRegistry: input.agentRegistry }),
+            ...(input.flowRegistry !== undefined && { flowRegistry: input.flowRegistry }),
+            // The deployments router's agents publish loop resolves the
+            // Default project through this binding. Optional at wiring so
+            // app compositions without a project binding still boot; the loop
+            // fails fast at runtime if agents are in the deployment index
+            // but the binding is absent.
+            ...(input.projectBinding !== undefined && { projectBinding: input.projectBinding }),
+            // POST /v1/deployments/:deploymentId/secrets needs the
+            // secretsBinding. Absent binding → the route answers 500 with an
+            // operator-actionable message.
+            ...(input.secretsBinding !== undefined && { secretsBinding: input.secretsBinding }),
+            // A deploy registers tools and guardrails: the same cache hooks
+            // `POST /v1/tools` / `POST /v1/guardrails` call.
+            ...(input.onToolWrite !== undefined && { onToolWrite: input.onToolWrite }),
+            ...(input.onGuardrailWrite !== undefined && { onGuardrailWrite: input.onGuardrailWrite }),
+        }));
+    }
+    if (input.evalRunBinding !== undefined) {
+        // Mount the start route under `/v1/eval-suites/:suiteId/runs` and
+        // the readback surface under `/v1/eval-runs/*`. Both share one
+        // binding — the start-route registration happens even without an
+        // `evalSuiteRegistry` binding: the dispatcher itself surfaces
+        // `suite-not-found` when the caller-plugged binding can't resolve
+        // the suite id, so the API layer stays consumer-neutral.
+        const evalRuns = evalRunsRouters(input.evalRunBinding);
+        v1.route('/eval-suites', evalRuns.start);
+        v1.route('/eval-runs', evalRuns.readback);
+    }
+    // ---------- auth routes ----------
+    // Requires all three bindings: session store + identity-provider
+    // catalog + code exchange. When wired, the authed sub-router mounts
+    // under `/v1/auth/*` (protected by the same bearer chain, so callers
+    // authenticate with either a static bearer or a session token to
+    // reach it), and the callback sub-router mounts OUTSIDE the bearer
+    // chain at `/v1/auth/callback/*` because the redirect from the
+    // provider carries no framework token yet.
+    if (input.sessionStore !== undefined &&
+        input.identityProvider !== undefined &&
+        input.exchangeCode !== undefined) {
+        const routers = authRouters({
+            sessionStore: input.sessionStore,
+            identityProvider: input.identityProvider,
+            exchangeCode: input.exchangeCode,
+            ...(input.refreshToken !== undefined && { refreshToken: input.refreshToken }),
+            stateStore: input.oauthStateStore ?? createInMemoryOauthStateStore(),
+        });
+        v1.route('/auth', routers.authed);
+        // Callback mounts on the parent `app` under /v1/auth/callback so it
+        // bypasses the bearer chain. The v1 router's use('*', bearer) has
+        // already been installed above, so we mount at the parent scope.
+        app.route('/v1/auth/callback', routers.callback);
+    }
+    app.route('/v1', v1);
+    // ---------- S3-compat surface (/s3/*, SigV4 auth) ----------
+    // Mounted OUTSIDE the /v1/* Bearer chain — S3 clients authenticate
+    // with SigV4, not bearer tokens. Requires both a resolved
+    // `blobStorage` binding (storage) and an `s3Credentials` binding
+    // (auth); omitting either leaves /s3/* unmounted (Hono 404).
+    if (input.blobStorage !== undefined && input.s3Credentials !== undefined) {
+        const s3 = new Hono();
+        s3.use('*', sigv4Middleware(input.s3Credentials));
+        s3.route('/', s3Router(input.blobStorage));
+        app.route('/s3', s3);
+    }
+    // Terminal 404 handler — every unmatched route returns the standard
+    // `{ error: { code, message, requestId } }` envelope instead of Hono's
+    // plaintext default. Rationale: routes mount conditionally on optional
+    // bindings (e.g. `secretsBinding`, `blobStorage`), so "route not
+    // registered" is a routine caller-facing outcome, not a bug. Serving a
+    // naked 404 makes SDKs report "HTTP 404 without recognizable error
+    // envelope", which reads as a bug at the SDK layer when the real
+    // signal is "this deployment didn't wire that binding." The
+    // `requestIdMiddleware` above runs for unmatched paths too, so the
+    // id is always available.
+    app.notFound((c) => {
+        const requestId = c.get('requestId') ?? 'req-unknown';
+        const body = {
+            error: {
+                code: 'route-not-found',
+                message: `No route registered for ${c.req.method} ${c.req.path}. If this endpoint is expected, verify the deployment wired the required binding.`,
+                requestId,
+            },
+        };
+        return c.json(body, 404);
+    });
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6C5B,OAAO,EAAsB,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAmB,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAEL,8BAA8B,EAC9B,qBAAqB,GACtB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,mCAAmC,CAAC;AACnG,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAwB,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGtF,OAAO,EAEL,kBAAkB,EAClB,2BAA2B,GAC5B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAEL,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAKtD,OAAO,EAAwB,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AA6tB/F,MAAM,UAAU,SAAS,CAAC,KAAqB;IAC7C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAU,CAAC;IAE/B,MAAM,UAAU,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC;IAE3C,0CAA0C;IAC1C,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACpC,wEAAwE;IACxE,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAE5B,sEAAsE;IACtE,6DAA6D;IAC7D,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,CAAC;IAC9C,MAAM,oBAAoB,GACxB,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,2BAA2B,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,MAAM,qBAAqB,GAAG,CAC5B,QAA0C,EAC1C,MAAgD,EAChD,UAAkB,EAClB,EAAE,CACF,kBAAkB,CAAC;QACjB,UAAU,EAAG,eAAwC,CAAC,UAAU;QAChE,KAAK,EAAG,eAAwC,CAAC,KAAK;QACtD,QAAQ;QACR,MAAM;QACN,UAAU;KACX,CAAC,CAAC;IACL,IAAI,eAAe,EAAE,cAAc,KAAK,SAAS,IAAI,eAAe,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/F,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED,sCAAsC;IACtC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAChD,qEAAqE;IACrE,kEAAkE;IAClE,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAChE,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAEvD,oEAAoE;IACpE,qEAAqE;IACrE,uEAAuE;IACvE,qEAAqE;IACrE,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QACtE,MAAM,UAAU,GAAqB,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAC3F,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC;QAC5C,GAAG,CAAC,GAAG,CACL,QAAQ,EACR,MAAM,CAAC;YACL,GAAG,EAAE,kBAAkB;YACvB,SAAS,EAAE,UAAU,CAAC,KAAK,IAAI,YAAY;YAC3C,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,IAAI;gBACpC,KAAK,EAAE,UAAU,CAAC,KAAc;aACjC,CAAC;SACH,CAAC,CACH,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,MAAM,EAAE,GAAG,IAAI,IAAI,EAAU,CAAC;IAC9B,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC;IACjC,MAAM,mBAAmB,GAAG,UAAU,EAAE,iBAAiB,CAAC;IAC1D,EAAE,CAAC,GAAG,CACJ,GAAG,EACH,oBAAoB,CAAC,KAAK,CAAC,YAAY,EAAE;QACvC,GAAG,CAAC,eAAe,KAAK,SAAS,IAAI;YACnC,eAAe,EAAE;gBACf,UAAU,EAAE,eAAe,CAAC,UAAU;gBACtC,SAAS,EAAE,qBAAqB,EAAE;aACnC;SACF,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;QAC7E,GAAG,CAAC,mBAAmB,KAAK,SAAS,IAAI,EAAE,mBAAmB,EAAE,CAAC;QACjE,GAAG,CAAC,UAAU,EAAE,aAAa,KAAK,SAAS,IAAI;YAC7C,eAAe,EAAE,UAAU,CAAC,aAAa;SAC1C,CAAC;KACH,CAAC,CACH,CAAC;IACF,gEAAgE;IAChE,oEAAoE;IACpE,mEAAmE;IACnE,mEAAmE;IACnE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;IACnC,MAAM,UAAU,GACd,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAE1F,MAAM,sBAAsB,GAA2B,KAAK,CAAC,sBAAsB,CAAC;IACpF,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,IAAI,8BAA8B,EAAE,CAAC,CAAC,CAAC;IAC/F,EAAE,CAAC,KAAK,CACN,OAAO,EACP,UAAU,CACR,KAAK,CAAC,UAAU,EAChB,UAAU,EACV;QACE,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACjE,GAAG,CAAC,oBAAoB,KAAK,SAAS,IAAI;YACxC,eAAe,EAAE;gBACf,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CACzB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,oBAAoB,CAAC,iBAAiB,CAAC;aAClF;SACF,CAAC;KACH,EACD,UAAU,CACX,CACF,CAAC;IACF,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,mBAAmB,CAAC,KAAK,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC;IACvF,IAAI,oBAAoB,KAAK,SAAS,EAAE,CAAC;QACvC,EAAE,CAAC,KAAK,CACN,gBAAgB,EAChB,qBAAqB,CACnB,UAAU,EACV,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,oBAAoB,EAAE,EACxD,UAAU,CACX,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,qEAAqE;IACrE,iEAAiE;IACjE,+DAA+D;IAC/D,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,EAAE,CAAC,KAAK,CAAC,sBAAsB,EAAE,eAAe,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC3E,EAAE,CAAC,KAAK,CACN,YAAY,EACZ,eAAe,CACb,KAAK,CAAC,mBAAmB,EACzB,KAAK,CAAC,eAAe,EACrB,KAAK,CAAC,WAAW,EACjB,UAAU,EACV;YACE,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;YACvE,+CAA+C;YAC/C,6DAA6D;YAC7D,8DAA8D;YAC9D,gEAAgE;YAChE,kDAAkD;YAClD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CACF,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACxE,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACtC,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,EAAE,CAAC,KAAK,CACN,aAAa,EACb,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,UAAU,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAClC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,EAAE,CAAC,KAAK,CACN,aAAa,EACb,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE;QACxC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;QAC9C,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;KACxE,CAAC,CACH,CAAC;IACF,IACE,KAAK,CAAC,WAAW,KAAK,SAAS;QAC/B,KAAK,CAAC,oBAAoB,KAAK,SAAS;QACxC,KAAK,CAAC,mBAAmB,KAAK,SAAS,EACvC,CAAC;QACD,EAAE,CAAC,KAAK,CACN,aAAa,EACb,gBAAgB,CAAC;YACf,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,UAAU,EAAE,KAAK,CAAC,oBAAoB;YACtC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB;YAC9C,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;SACxE,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,KAAK,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CACN,MAAM,EACN,SAAS,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE;YACrE,UAAU,EAAE,KAAK,CAAC,gBAAgB,IAAI,UAAU;SACjD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,qDAAqD;IACrD,iEAAiE;IACjE,uCAAuC;IACvC,EAAE,CAAC,KAAK,CACN,WAAW,EACX,cAAc,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;KAC9E,CAAC,CACH,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACvF,CAAC;IACD,8DAA8D;IAC9D,iEAAiE;IACjE,sDAAsD;IACtD,sCAAsC;IACtC,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QACxC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QAC/D,EAAE,CAAC,KAAK,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;QACxE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACzC,EAAE,CAAC,KAAK,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC1C,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,gBAAgB,CAAC,KAAK,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,2CAA2C;IAC3C,mEAAmE;IACnE,8DAA8D;IAC9D,iEAAiE;IACjE,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,EAAE,sBAAsB,EAAE,UAAU,CAAC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QACjF,EAAE,CAAC,KAAK,CACN,QAAQ,EACR,WAAW,CACT,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,qBAAqB,EAC3B,sBAAsB,EACtB,UAAU,CACX,CACF,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,wBAAwB,KAAK,SAAS,EAAE,CAAC;QACvF,EAAE,CAAC,KAAK,CACN,WAAW,EACX,cAAc,CACZ,KAAK,CAAC,cAAc,EACpB,KAAK,CAAC,wBAAwB,EAC9B,sBAAsB,EACtB,UAAU,CACX,CACF,CAAC;IACJ,CAAC;IACD,+DAA+D;IAC/D,6BAA6B;IAC7B,oEAAoE;IACpE,mCAAmC;IACnC,EAAE,CAAC,KAAK,CACN,SAAS,EACT,YAAY,CAAC;QACX,sBAAsB,EAAE,KAAK,CAAC,sBAAsB;QACpD,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC;QACvE,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;QACnF,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;KAChD,CAAC,CACH,CAAC;IACF,sCAAsC;IACtC,6DAA6D;IAC7D,iEAAiE;IACjE,gEAAgE;IAChE,iEAAiE;IACjE,yBAAyB;IACzB,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACnC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,gEAAgE;IAChE,sCAAsC;IACtC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACpC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,EAAE,CAAC,KAAK,CACN,UAAU,EACV,aAAa,CAAC;YACZ,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,mBAAmB,EAAE,KAAK,CAAC,mBAAmB,IAAI,iCAAiC,EAAE;YACrF,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,CAAC;SAChD,CAAC,CACH,CAAC;IACJ,CAAC;IACD,oCAAoC;IACpC,yEAAyE;IACzE,sEAAsE;IACtE,oEAAoE;IACpE,kEAAkE;IAClE,sEAAsE;IACtE,6BAA6B;IAC7B,kEAAkE;IAClE,oEAAoE;IACpE,eAAe;IACf,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;QAC3C,EAAE,CAAC,KAAK,CAAC,eAAe,EAAE,iBAAiB,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IACE,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,kBAAkB,KAAK,SAAS;QACtC,KAAK,CAAC,aAAa,KAAK,SAAS,EACjC,CAAC;QACD,EAAE,CAAC,KAAK,CACN,cAAc,EACd,iBAAiB,CAAC;YAChB,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;YAC5C,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7E,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,IAAI;gBAC3C,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAC;YACF,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC;YAChF,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7E,4DAA4D;YAC5D,8DAA8D;YAC9D,kEAAkE;YAClE,8DAA8D;YAC9D,6BAA6B;YAC7B,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;YACnF,uDAAuD;YACvD,iEAAiE;YACjE,+BAA+B;YAC/B,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC;YACnF,gEAAgE;YAChE,iDAAiD;YACjD,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1E,GAAG,CAAC,KAAK,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC;SAC1F,CAAC,CACH,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACvC,kEAAkE;QAClE,+DAA+D;QAC/D,iEAAiE;QACjE,8DAA8D;QAC9D,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACvD,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzC,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IACD,oCAAoC;IACpC,iEAAiE;IACjE,oEAAoE;IACpE,qEAAqE;IACrE,iEAAiE;IACjE,mEAAmE;IACnE,+DAA+D;IAC/D,2CAA2C;IAC3C,IACE,KAAK,CAAC,YAAY,KAAK,SAAS;QAChC,KAAK,CAAC,gBAAgB,KAAK,SAAS;QACpC,KAAK,CAAC,YAAY,KAAK,SAAS,EAChC,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,CAAC;YAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;YACxC,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,GAAG,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC;YAC7E,UAAU,EAAE,KAAK,CAAC,eAAe,IAAI,6BAA6B,EAAE;SACrE,CAAC,CAAC;QACH,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAClC,oEAAoE;QACpE,kEAAkE;QAClE,iEAAiE;QACjE,GAAG,CAAC,KAAK,CAAC,mBAAmB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAErB,8DAA8D;IAC9D,mEAAmE;IACnE,0DAA0D;IAC1D,iEAAiE;IACjE,6DAA6D;IAC7D,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACzE,MAAM,EAAE,GAAG,IAAI,IAAI,EAAU,CAAC;QAC9B,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QAClD,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAC3C,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,oEAAoE;IACpE,uEAAuE;IACvE,uEAAuE;IACvE,iEAAiE;IACjE,uEAAuE;IACvE,mEAAmE;IACnE,iEAAiE;IACjE,4DAA4D;IAC5D,mEAAmE;IACnE,0BAA0B;IAC1B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,MAAM,SAAS,GAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAwB,IAAI,aAAa,CAAC;QAC9E,MAAM,IAAI,GAAkB;YAC1B,KAAK,EAAE;gBACL,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,2BAA2B,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,mFAAmF;gBACjJ,SAAS;aACV;SACF,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/capability-binding.d.ts

@@ -0,0 +1,76 @@
+import type { CapabilityKind, Feature } from '@kindgi/capabilities';
+import type { Cursor, TenantId } from '@kindgi/types';
+/**
+ * Caller-plugged surface for the capability catalog — part of the admin
+ * control plane.
+ *
+ * Capabilities are **read-only** over HTTP. They are framework-declared
+ * (see `@kindgi/specs/capability.schema.json` + the `FEATURES` enum from
+ * `@kindgi/capabilities`) and deployment-extensible at boot time via
+ * this binding — never tenant-created via the API. Deployments that
+ * expose custom capability kinds (embedding, gpu-compute, sandbox-exec,
+ * browser-session, ...) plug a binding that also lists their extensions.
+ *
+ * Cursors are opaque — the binding chooses its encoding. The API layer
+ * only validates round-trip as a string; it never inspects the payload.
+ */
+export interface CapabilityRegistryBinding {
+    /**
+     * Cursor-paginated list of capability descriptors. Optional
+     * `featureFilter` is a prefix match on `descriptor.feature` — matches
+     * the `?feature=` filter shape on the route.
+     */
+    list(input: CapabilityListInput): Promise<CapabilityPage>;
+    /**
+     * Fetch a capability descriptor by its id, or `null` when unknown.
+     * The route surfaces `null` as `404 capability-not-found`.
+     */
+    get(input: CapabilityGetInput): Promise<CapabilityDescriptor | null>;
+}
+/**
+ * Wire shape returned by the capability routes. Lean by design — the
+ * runtime `Capability` (`@kindgi/capabilities.Capability`) is a
+ * declarative query shape (needs / prefer / budget) that agents attach
+ * to their spec; that's a different concept from a descriptor entry in
+ * the *catalog* of features a deployment supports. The catalog entry
+ * carries the identifier + human description + the optional params
+ * schema pointer.
+ *
+ * `id` is caller-chosen — for example `feature:<feature>`
+ * (e.g. `feature:tool-use`); deployments that extend
+ * the catalog with non-LLM capability kinds may pick other conventions
+ * (`kind:embedding`, `kind:sandbox-exec`, ...).
+ */
+export interface CapabilityDescriptor {
+    readonly id: string;
+    readonly feature: Feature | string;
+    readonly description: string;
+    /**
+     * Kind of resource the capability targets. Optional — absent value
+     * defaults to `'llm-inference'`. Adapters for non-LLM kinds set this
+     * explicitly so the catalog can be filtered by kind downstream.
+     */
+    readonly kind?: CapabilityKind;
+    /**
+     * Optional JSON Schema shape describing the parameters an agent may
+     * carry alongside `{ feature }` in a `Requirement`. Opaque to the API
+     * layer — the SDK surfaces it for tooling / doc generation.
+     */
+    readonly paramsSchema?: Readonly<Record<string, unknown>>;
+}
+export interface CapabilityListInput {
+    readonly tenantId: TenantId;
+    readonly limit: number;
+    readonly cursor?: Cursor;
+    /** Prefix match on `CapabilityDescriptor.feature`. */
+    readonly featureFilter?: string;
+}
+export interface CapabilityGetInput {
+    readonly tenantId: TenantId;
+    readonly capabilityId: string;
+}
+export interface CapabilityPage {
+    readonly data: readonly CapabilityDescriptor[];
+    readonly nextCursor?: Cursor;
+}
+//# sourceMappingURL=capability-binding.d.ts.map

package/dist/capability-binding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-binding.d.ts","sourceRoot":"","sources":["../src/capability-binding.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEtD;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;;OAIG;IACH,IAAI,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC1D;;;OAGG;IACH,GAAG,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CACtE;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC;IAC/B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B"}

package/dist/capability-binding.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export {};
+//# sourceMappingURL=capability-binding.js.map

package/dist/capability-binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-binding.js","sourceRoot":"","sources":["../src/capability-binding.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC"}