@kindgi/api 0.1.4-rc.4 → 0.1.4-rc.5

package/src/openapi/schemas.ts

@@ -637,6 +637,12 @@ export const RunSchema: JsonSchema = {
       description:
         "The segment path the run was started with (coarse to fine), which picks live agent versions. A child run has its parent's. Absent when there was none.",
     },
+    traceId: {
+      type: 'string',
+      pattern: '^[0-9a-f]{32}$',
+      description:
+        "The W3C trace id of the request that started the run: the caller's (from its `traceparent`) or one the API minted. The runtime's records about the run carry it; `GET` responses answer `traceresponse` with each request's own. Absent for a run no request started, and on runs from before runs recorded it.",
+    },
     publicAccessToken: {
       type: 'string',
       description:

package/src/routes/runs.ts

@@ -23,6 +23,7 @@ import type {
   RunHandlerBinding,
   RunHandlerFailure,
   RunHandlerOutcome,
+  RunTrace,
 } from '../handler-binding.js';
 import type { Authorizer } from '../middleware/authorize.js';
 import type { MintPublicRunTokenResult } from '../public-run-token.js';
@@ -161,7 +162,13 @@ export function runsRouter(
       return c.json(toWireError(parsed.error, requestId));
     }
 
-    const invocation = await invokeFromBody(binding, tenantId, parsed.value);
+    const trace = c.get('trace');
+    const invocation = await invokeFromBody(
+      binding,
+      tenantId,
+      parsed.value,
+      trace !== undefined ? { traceId: trace.traceId, spanId: trace.spanId } : undefined,
+    );
 
     if (invocation.kind === 'err') {
       c.status(statusFor(invocation.error.code) as never);
@@ -624,9 +631,11 @@ function invokeFromBody(
   binding: RunHandlerBinding,
   tenantId: TenantId,
   body: ParsedStartRunBody,
+  trace?: RunTrace,
 ): Promise<RunHandlerOutcome> {
   const common = {
     tenantId,
+    ...(trace !== undefined && { trace }),
     ...(body.projectId !== undefined && { projectId: body.projectId }),
     input: body.input,
     ...(body.segments !== undefined && { segments: body.segments }),
@@ -690,6 +699,7 @@ function serializeRun(
       row.segments.length > 0 && {
         segments: row.segments.map(({ key, value }) => ({ key, value })),
       }),
+    ...(row.traceId != null && { traceId: row.traceId }),
   };
 }
 

package/src/secrets-binding.ts

@@ -305,4 +305,9 @@ export type SecretError =
       readonly message: string;
       readonly currentVersion: number;
     }
+  /**
+   * The store doesn't do this by design (the dev store keeps no versions to
+   * rotate and no revocation): the message says what to do instead.
+   */
+  | { readonly code: 'secret-operation-unsupported'; readonly message: string }
   | { readonly code: 'secret-store-error'; readonly message: string; readonly cause?: unknown };

package/src/types.ts

@@ -2,6 +2,7 @@
 // Copyright (C) 2026 Kindgi Inc.
 
 import type { Principal, ReviewerRole } from '@kindgi/authz';
+import type { Logger, TraceContext } from '@kindgi/log';
 import type { ApiTokenId, RunId, SessionId, TenantId, UserId } from '@kindgi/types';
 
 /**
@@ -11,6 +12,14 @@ import type { ApiTokenId, RunId, SessionId, TenantId, UserId } from '@kindgi/typ
 export interface AppEnv {
   Variables: {
     requestId: string;
+    /**
+     * The request's logger (`requestLogMiddleware`): the app's, with the
+     * request's `requestId`, `traceId` and `spanId`, and its `tenantId`
+     * once authenticated. Routes log through it.
+     */
+    log: Logger;
+    /** The request's W3C trace context: the caller's trace when it sent a valid `traceparent`. */
+    trace: TraceContext;
     /** Set by `bearerAuthMiddleware` on authenticated routes. */
     tenantId: TenantId;
     /**