@kindgi/api 0.0.0-bootstrap.0 → 0.1.1

package/dist/routes/provenance.js

@@ -0,0 +1,274 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+import { Hono } from 'hono';
+import { serializePublicKeyPem, signEd25519 } from '@kindgi/crypto';
+import { canonicalize } from '@kindgi/schema';
+import { statusFor, toWireError } from '../errors.js';
+import { clampLimit, decodeCursor, encodeCursor } from './pagination.js';
+/** Bundle schema version — bump when the wire shape of `bundle.body` changes. */
+const BUNDLE_SCHEMA_VERSION = '1.0.0';
+export function provenanceRouter(binding, options = {}) {
+    const r = new Hono();
+    const signingKey = options.signingKey;
+    // ---------- GET / (list metadata, cursor-paginated) ----------
+    r.get('/', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const limit = clampLimit(c.req.query('limit'));
+        const rawCursor = c.req.query('cursor');
+        let cursorFilter;
+        if (rawCursor !== undefined && rawCursor.length > 0) {
+            const decoded = decodeCursor(rawCursor);
+            if (decoded === null) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`cursor` is malformed' }, requestId));
+            }
+            cursorFilter = { createdAt: decoded.createdAt, id: decoded.id };
+        }
+        const runIdFilter = c.req.query('runId');
+        const agentIdFilter = c.req.query('agentId');
+        const createdAfterRaw = c.req.query('createdAfter');
+        let createdAfter;
+        if (createdAfterRaw !== undefined && createdAfterRaw.length > 0) {
+            const parsed = new Date(createdAfterRaw);
+            if (Number.isNaN(parsed.getTime())) {
+                c.status(statusFor('bad-input'));
+                return c.json(toWireError({ code: 'bad-input', message: '`createdAfter` must be an ISO 8601 timestamp' }, requestId));
+            }
+            createdAfter = parsed;
+        }
+        const result = await binding.listRecords({
+            tenantId,
+            limit,
+            ...(runIdFilter !== undefined && runIdFilter.length > 0 && { runId: runIdFilter }),
+            ...(agentIdFilter !== undefined && agentIdFilter.length > 0 && { agentId: agentIdFilter }),
+            ...(createdAfter !== undefined && { createdAfter }),
+            ...(cursorFilter !== undefined && { cursor: cursorFilter }),
+        });
+        if (result.kind === 'err') {
+            c.status(statusFor(result.error.code));
+            return c.json(toWireError({ code: result.error.code, message: result.error.message }, requestId));
+        }
+        const { records, nextCursor } = result.value;
+        const hasMore = nextCursor !== undefined;
+        return c.json({
+            data: records.map(serializeRecordMetadata),
+            hasMore,
+            ...(nextCursor !== undefined && {
+                nextCursor: encodeCursor({ createdAt: nextCursor.createdAt, id: nextCursor.id }),
+            }),
+        });
+    });
+    // ---------- GET /:runId (full DAG) ----------
+    r.get('/:runId', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const runId = c.req.param('runId');
+        const result = await binding.getByRunId(tenantId, runId);
+        if (result.kind === 'err') {
+            if (result.error.code === 'provenance-not-found') {
+                c.status(statusFor('not-found'));
+                return c.json(toWireError({
+                    code: 'provenance-not-found',
+                    message: result.error.message,
+                    runId: runId,
+                }, requestId));
+            }
+            c.status(statusFor(result.error.code));
+            return c.json(toWireError({ code: result.error.code, message: result.error.message }, requestId));
+        }
+        const provenance = result.value;
+        return c.json({
+            id: provenance.id,
+            runId: provenance.runId,
+            tenantId: provenance.tenantId,
+            version: provenance.version,
+            createdAt: provenance.createdAt,
+            ...(provenance.flowRef !== undefined && {
+                flowRef: {
+                    id: provenance.flowRef.id,
+                    version: provenance.flowRef.version,
+                },
+            }),
+            dag: {
+                nodes: provenance.nodes,
+                edges: provenance.edges,
+            },
+            ...(provenance.signature !== undefined && { signature: provenance.signature }),
+        });
+    });
+    // ---------- POST /:runId/export (signed bundle) ----------
+    r.post('/:runId/export', async (c) => {
+        const requestId = c.get('requestId');
+        const tenantId = c.get('tenantId');
+        const runId = c.req.param('runId');
+        if (signingKey === undefined) {
+            c.status(statusFor('signing-not-configured'));
+            return c.json(toWireError({
+                code: 'signing-not-configured',
+                message: 'This deployment does not have a `signingKey` binding mounted; signed provenance exports are unavailable.',
+            }, requestId));
+        }
+        let body;
+        try {
+            body = await c.req.json();
+        }
+        catch {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be valid JSON' }, requestId));
+        }
+        if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: 'Request body must be an object' }, requestId));
+        }
+        const parsed = parseExportBody(body);
+        if (parsed.kind === 'err') {
+            c.status(statusFor('bad-input'));
+            return c.json(toWireError({ code: 'bad-input', message: parsed.message }, requestId));
+        }
+        const { signingKeyId, includeMessages } = parsed.value;
+        // 1. Load the DAG.
+        const loaded = await binding.getByRunId(tenantId, runId);
+        if (loaded.kind === 'err') {
+            if (loaded.error.code === 'provenance-not-found') {
+                c.status(statusFor('not-found'));
+                return c.json(toWireError({
+                    code: 'provenance-not-found',
+                    message: loaded.error.message,
+                    runId: runId,
+                }, requestId));
+            }
+            c.status(statusFor(loaded.error.code));
+            return c.json(toWireError({ code: loaded.error.code, message: loaded.error.message }, requestId));
+        }
+        const provenance = loaded.value;
+        // 2. Optionally hydrate conversation messages. Agent turns use the
+        //    conversation id as the run id; for flow-only runs no
+        //    conversation exists and we return an empty `messages: []`
+        //    field so the shape stays stable.
+        let messages;
+        if (includeMessages) {
+            if (options.conversationBinding === undefined) {
+                // Reads require a ConversationBinding. When the route is wired
+                // without one, fall back to the same stable-empty-shape used
+                // for flow-only runs so response shape doesn't change.
+                messages = [];
+            }
+            else {
+                const msgResult = await options.conversationBinding.readMessages({
+                    tenantId,
+                    conversationId: runId,
+                });
+                messages = msgResult.kind === 'ok' ? msgResult.value : [];
+            }
+        }
+        // 3. Look up the private key material.
+        const privateKey = signingKey.getPrivateKey(signingKeyId);
+        if (privateKey === null) {
+            c.status(statusFor('signing-key-not-found'));
+            return c.json(toWireError({
+                code: 'signing-key-not-found',
+                message: `No signing key registered with id "${signingKeyId}"`,
+                signingKeyId: signingKeyId,
+            }, requestId));
+        }
+        const publicKeyRaw = signingKey.getPublicKey(signingKeyId);
+        if (publicKeyRaw === null) {
+            // Contract: `getPublicKey` never returns null for a key that
+            // `getPrivateKey` resolved. Treat mismatch as a binding bug.
+            c.status(statusFor('signing-key-not-found'));
+            return c.json(toWireError({
+                code: 'signing-key-not-found',
+                message: `Signing key "${signingKeyId}" resolved a private key but no public key`,
+                signingKeyId: signingKeyId,
+            }, requestId));
+        }
+        // 4. Build the canonical bundle body. Bundle shape is v1.0.0 —
+        //    ordering here is irrelevant for signing (canonicalize sorts
+        //    keys) but declared explicitly for reviewer scanability.
+        const bundleBody = {
+            bundleSchemaVersion: BUNDLE_SCHEMA_VERSION,
+            provenanceId: provenance.id,
+            runId: provenance.runId,
+            tenantId: provenance.tenantId,
+            version: provenance.version,
+            createdAt: provenance.createdAt,
+            ...(provenance.flowRef !== undefined && {
+                flowRef: {
+                    id: provenance.flowRef.id,
+                    version: provenance.flowRef.version,
+                },
+            }),
+            dag: {
+                nodes: provenance.nodes,
+                edges: provenance.edges,
+            },
+            ...(messages !== undefined && { messages }),
+        };
+        const canonicalBundleBytes = new TextEncoder().encode(canonicalize(bundleBody));
+        // 5. Sign the canonical bytes.
+        const signResult = signEd25519(privateKey, canonicalBundleBytes);
+        if (signResult.kind === 'err') {
+            c.status(statusFor('export-key-error'));
+            return c.json(toWireError({
+                code: 'export-key-error',
+                message: `Failed to sign provenance bundle: ${signResult.error.message}`,
+            }, requestId));
+        }
+        // 6. Emit the signed envelope. `bundle` is a base64 of the exact
+        //    bytes that were signed — verifiers decode + re-canonicalize
+        //    is unnecessary, they can verify against `atob(bundle)`
+        //    directly.
+        const exportedAt = new Date().toISOString();
+        return c.json({
+            runId: runId,
+            bundle: Buffer.from(canonicalBundleBytes).toString('base64'),
+            bundleSchemaVersion: BUNDLE_SCHEMA_VERSION,
+            algorithm: 'ed25519',
+            signingKeyId: signingKeyId,
+            signature: Buffer.from(signResult.value).toString('base64'),
+            publicKey: serializePublicKeyPem(publicKeyRaw),
+            canonicalization: 'sorted-key-json',
+            exportedAt: exportedAt,
+        });
+    });
+    return r;
+}
+function serializeRecordMetadata(row) {
+    return {
+        id: row.id,
+        runId: row.runId,
+        tenantId: row.tenantId,
+        version: row.version,
+        createdAt: row.createdAt,
+        ...(row.flowRef !== undefined && {
+            flowRef: {
+                id: row.flowRef.id,
+                version: row.flowRef.version,
+            },
+        }),
+        signed: row.signed,
+    };
+}
+function parseExportBody(body) {
+    const raw = body.signingKeyId;
+    if (typeof raw !== 'string' || raw.length === 0) {
+        return { kind: 'err', message: 'Field `signingKeyId` must be a non-empty string' };
+    }
+    let includeMessages = false;
+    if ('includeMessages' in body) {
+        const im = body.includeMessages;
+        if (typeof im !== 'boolean') {
+            return { kind: 'err', message: 'Field `includeMessages` must be a boolean when present' };
+        }
+        includeMessages = im;
+    }
+    return {
+        kind: 'ok',
+        value: {
+            signingKeyId: raw,
+            includeMessages,
+        },
+    };
+}
+//# sourceMappingURL=provenance.js.map

package/dist/routes/provenance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provenance.js","sourceRoot":"","sources":["../../src/routes/provenance.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAQtD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AA8BzE,iFAAiF;AACjF,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC,MAAM,UAAU,gBAAgB,CAC9B,OAA0B,EAC1B,UAAmC,EAAE;IAErC,MAAM,CAAC,GAAG,IAAI,IAAI,EAAU,CAAC;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAEtC,gEAAgE;IAChE,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrB,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,YAA8C,CAAC;QACnD,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAChF,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAClE,CAAC;QAED,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAEpD,IAAI,YAA8B,CAAC;QACnC,IAAI,eAAe,KAAK,SAAS,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChE,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;YACzC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACnC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAC9E,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,MAAM,CAAC;QACxB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;YACvC,QAAQ;YACR,KAAK;YACL,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,WAAoB,EAAE,CAAC;YAC3F,GAAG,CAAC,aAAa,KAAK,SAAS,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;YAC1F,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,YAAY,EAAE,CAAC;YACnD,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;SAC5D,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAC7C,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,CAAC;QACzC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;YAC1C,OAAO;YACP,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI;gBAC9B,UAAU,EAAE,YAAY,CAAC,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;aACjF,CAAC;SACH,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3B,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAU,CAAC;QAE5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBACjD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;oBAC7B,KAAK,EAAE,KAA0B;iBAClC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;QAChC,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,UAAU,CAAC,EAAuB;YACtC,KAAK,EAAE,UAAU,CAAC,KAA0B;YAC5C,QAAQ,EAAE,UAAU,CAAC,QAA6B;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAA8B;YACpD,GAAG,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI;gBACtC,OAAO,EAAE;oBACP,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,EAAuB;oBAC9C,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;iBACpC;aACF,CAAC;YACF,GAAG,EAAE;gBACH,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,KAAK,EAAE,UAAU,CAAC,KAAK;aACxB;YACD,GAAG,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;SAC/E,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,4DAA4D;IAC5D,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAU,CAAC;QAE5C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,wBAAwB,CAAU,CAAC,CAAC;YACvD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EACL,0GAA0G;aAC7G,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,iCAAiC,EAAE,EAAE,SAAS,CAAC,CAC1F,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,SAAS,CAAC,CACzF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAA+B,CAAC,CAAC;QAChE,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;YAC1C,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QAEvD,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;gBACjD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,CAAU,CAAC,CAAC;gBAC1C,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;oBACE,IAAI,EAAE,sBAAsB;oBAC5B,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO;oBAC7B,KAAK,EAAE,KAA0B;iBAClC,EACD,SAAS,CACV,CACF,CAAC;YACJ,CAAC;YACD,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAU,CAAC,CAAC;YAChD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;QAEhC,mEAAmE;QACnE,0DAA0D;QAC1D,+DAA+D;QAC/D,sCAAsC;QACtC,IAAI,QAAwC,CAAC;QAC7C,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,mBAAmB,KAAK,SAAS,EAAE,CAAC;gBAC9C,+DAA+D;gBAC/D,6DAA6D;gBAC7D,uDAAuD;gBACvD,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,YAAY,CAAC;oBAC/D,QAAQ;oBACR,cAAc,EAAE,KAAkC;iBACnD,CAAC,CAAC;gBACH,QAAQ,GAAG,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,uCAAuC;QACvC,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,sCAAsC,YAAiC,GAAG;gBACnF,YAAY,EAAE,YAAiC;aAChD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QACD,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;YAC1B,6DAA6D;YAC7D,6DAA6D;YAC7D,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,uBAAuB,CAAU,CAAC,CAAC;YACtD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,gBAAgB,YAAiC,4CAA4C;gBACtG,YAAY,EAAE,YAAiC;aAChD,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,+DAA+D;QAC/D,iEAAiE;QACjE,6DAA6D;QAC7D,MAAM,UAAU,GAAG;YACjB,mBAAmB,EAAE,qBAAqB;YAC1C,YAAY,EAAE,UAAU,CAAC,EAAuB;YAChD,KAAK,EAAE,UAAU,CAAC,KAA0B;YAC5C,QAAQ,EAAE,UAAU,CAAC,QAA6B;YAClD,OAAO,EAAE,UAAU,CAAC,OAAO;YAC3B,SAAS,EAAE,UAAU,CAAC,SAA8B;YACpD,GAAG,CAAC,UAAU,CAAC,OAAO,KAAK,SAAS,IAAI;gBACtC,OAAO,EAAE;oBACP,EAAE,EAAE,UAAU,CAAC,OAAO,CAAC,EAAuB;oBAC9C,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO;iBACpC;aACF,CAAC;YACF,GAAG,EAAE;gBACH,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,KAAK,EAAE,UAAU,CAAC,KAAK;aACxB;YACD,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;SAC5C,CAAC;QACF,MAAM,oBAAoB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;QAEhF,+BAA+B;QAC/B,MAAM,UAAU,GAAG,WAAW,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACjE,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,kBAAkB,CAAU,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC,IAAI,CACX,WAAW,CACT;gBACE,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,qCAAqC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE;aACzE,EACD,SAAS,CACV,CACF,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,iEAAiE;QACjE,4DAA4D;QAC5D,eAAe;QACf,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAe,CAAC;QACzD,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,KAA0B;YACjC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC5D,mBAAmB,EAAE,qBAAqB;YAC1C,SAAS,EAAE,SAAkB;YAC7B,YAAY,EAAE,YAAiC;YAC/C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC3D,SAAS,EAAE,qBAAqB,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,iBAA0B;YAC5C,UAAU,EAAE,UAA+B;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,CAAC;AACX,CAAC;AAcD,SAAS,uBAAuB,CAAC,GAA4B;IAC3D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAuB;QAC/B,KAAK,EAAE,GAAG,CAAC,KAA0B;QACrC,QAAQ,EAAE,GAAG,CAAC,QAA6B;QAC3C,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,SAAS,EAAE,GAAG,CAAC,SAA8B;QAC7C,GAAG,CAAC,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI;YAC/B,OAAO,EAAE;gBACP,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,EAAuB;gBACvC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO;aAC7B;SACF,CAAC;QACF,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC;AACJ,CAAC;AAWD,SAAS,eAAe,CAAC,IAA6B;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC;IAC9B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IACrF,CAAC;IACD,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,iBAAiB,IAAI,IAAI,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,CAAC;QAChC,IAAI,OAAO,EAAE,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,wDAAwD,EAAE,CAAC;QAC5F,CAAC;QACD,eAAe,GAAG,EAAE,CAAC;IACvB,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,YAAY,EAAE,GAAmB;YACjC,eAAe;SAChB;KACF,CAAC;AACJ,CAAC"}

package/dist/routes/providers.d.ts

@@ -0,0 +1,32 @@
+import { Hono } from 'hono';
+import type { TenantId } from '@kindgi/types';
+import type { ProviderRegistryBinding } from '../provider-binding.js';
+import type { AppEnv } from '../types.js';
+/**
+ * Providers resource routes — part of the admin control plane. Full
+ * CRUD. Model providers are tenant-owned: each tenant registers the
+ * endpoints they want the runtime's capability router to consider
+ * (hosted model APIs, self-hosted inference servers, embedding backends,
+ * sandbox-exec fleets, ...).
+ *
+ * Secrets do NOT cross the wire — `ProviderMetadata` is the wire shape.
+ * Deployments store the actual credential set inside the caller-plugged
+ * `ProviderRegistryBinding`; the API surface only returns routing-
+ * relevant metadata: provider-level `id` / `region` / `attributes` +
+ * `models[]` (each with `name`, `contextWindow`, `features`, `cost`,
+ * optional `p95LatencyMs` / `maxOutputTokens` / `description`).
+ */
+/**
+ * Optional side-effect callback fired after a successful write
+ * (register, unregister) to a provider. Lets an in-process runtime
+ * cache (e.g. a per-tenant provider cache) invalidate its
+ * per-tenant snapshot so the next agent run picks up the new
+ * provider without a process restart.
+ */
+export type ProviderWriteHook = (params: {
+    readonly tenantId: TenantId;
+    readonly providerId: string;
+    readonly kind: 'register' | 'unregister';
+}) => void | Promise<void>;
+export declare function providersRouter(binding: ProviderRegistryBinding, onWrite?: ProviderWriteHook): Hono<AppEnv>;
+//# sourceMappingURL=providers.d.ts.map

package/dist/routes/providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/routes/providers.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EAAU,QAAQ,EAAE,MAAM,eAAe,CAAC;AAItD,OAAO,KAAK,EAAE,uBAAuB,EAAqB,MAAM,wBAAwB,CAAC;AACzF,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1C;;;;;;;;;;;;;GAaG;AACH;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE;IACvC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,YAAY,CAAC;CAC1C,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE3B,wBAAgB,eAAe,CAC7B,OAAO,EAAE,uBAAuB,EAChC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,IAAI,CAAC,MAAM,CAAC,CAsPd"}