@kindgi/api 0.1.4 → 0.1.5-rc.0

package/src/app.ts

@@ -10,7 +10,8 @@ import type { AuditEventBinding } from '@kindgi/audit-events';
 import type { AuthzCheckBinding } from '@kindgi/authz';
 import type { AdapterFactoryRegistry } from '@kindgi/capabilities';
 import type { ComplianceEvidenceGenerator, LoadedClassifier } from '@kindgi/compliance';
-import type { SigningKeyBinding } from '@kindgi/crypto';
+import { exportSignerFromSigningKeyBinding } from '@kindgi/crypto';
+import type { ExportSigningBinding, SigningKeyBinding } from '@kindgi/crypto';
 import type { TenantHierarchyBinding } from '@kindgi/platform';
 import type {
   OrgBinding,
@@ -48,11 +49,18 @@ import type {
   RefreshTokenFn,
 } from './identity-provider-binding.js';
 import type { ImageRegistryBinding } from './image-registry-binding.js';
+import type { ImprovementPassBinding } from './improvement-pass-binding.js';
 import type { JudgmentRegistryBinding } from './judgment-binding.js';
 import type { AgentReleaseBindings } from './live-version-binding.js';
 import type { MCPClientProbeBinding, MCPEndpointRegistryBinding } from './mcp-endpoint-binding.js';
 import type { MemoryBinding } from './memory-binding.js';
-import { type TokenResolver, bearerAuthMiddleware } from './middleware/auth.js';
+import type { MemoryErasureBinding } from './memory-erasure-binding.js';
+import {
+  SESSION_COOKIE_NAME,
+  type SessionCookieOptions,
+  type TokenResolver,
+  bearerAuthMiddleware,
+} from './middleware/auth.js';
 import { type Authorizer, createAuthorizer } from './middleware/authorize.js';
 import { mapThrownError } from './middleware/error-mapper.js';
 import {
@@ -60,6 +68,7 @@ import {
   createInMemoryIdempotencyStore,
   idempotencyMiddleware,
 } from './middleware/idempotency.js';
+import { refuseOtherProjectForKey } from './middleware/key-project.js';
 import { principalMiddleware } from './middleware/principal.js';
 import { PROJECT_REF_ROUTES, refuseBadProjectId } from './middleware/project-ref.js';
 import { publicRunCorsMiddleware, publicRunRouteMatcher } from './middleware/public-run-routes.js';
@@ -67,6 +76,7 @@ import { requestIdMiddleware } from './middleware/request-id.js';
 import { requestLogMiddleware } from './middleware/request-log.js';
 import { sigv4Middleware } from './middleware/sigv4.js';
 import { type GenerateOptions, generateOpenApiDocument } from './openapi/generate.js';
+import type { PersonGrantsBinding } from './person-grants-binding.js';
 import type { ProvenanceBinding } from './provenance-binding.js';
 import type { ProviderRegistryBinding } from './provider-binding.js';
 import {
@@ -85,7 +95,7 @@ import { agentsRouter } from './routes/agents.js';
 import { approvalsRouter } from './routes/approvals.js';
 import { artifactsRouter } from './routes/artifacts.js';
 import { auditRouter } from './routes/audit.js';
-import { authRouters } from './routes/auth.js';
+import { authRouters, logoutHandler } from './routes/auth.js';
 import { blocksRouter } from './routes/blocks.js';
 import { capabilitiesRouter } from './routes/capabilities.js';
 import { complianceRouter } from './routes/compliance.js';
@@ -96,13 +106,16 @@ import { envRouter } from './routes/env.js';
 import { evalRunsRouters } from './routes/eval-runs.js';
 import { evalSuitesRouter } from './routes/eval-suites.js';
 import { eventTriggersRouter } from './routes/event-triggers.js';
+import { exportSigningKeysRouter } from './routes/export-signing-keys.js';
 import { flowsRouter } from './routes/flows.js';
 import { gatePoliciesRouter } from './routes/gate-policies.js';
 import { guardrailsRouter } from './routes/guardrails.js';
 import { identityRouter } from './routes/identity.js';
+import { improvementPassesRouter, mountImproveRoute } from './routes/improvement-passes.js';
 import { judgedSuitesRouter } from './routes/judged-suites.js';
 import { judgeClassesRouter, judgmentsRouter } from './routes/judgments.js';
 import { mcpRouter } from './routes/mcp.js';
+import { memoryErasuresRouter } from './routes/memory-erasures.js';
 import { memoryRouter } from './routes/memory.js';
 import { observationsRouter } from './routes/observations.js';
 import { orgsRouter } from './routes/orgs.js';
@@ -118,15 +131,19 @@ import { runsRouter } from './routes/runs.js';
 import { s3Router } from './routes/s3.js';
 import { schedulesRouter } from './routes/schedules.js';
 import { secretsRouter } from './routes/secrets.js';
+import { serviceAccountsRouter } from './routes/service-accounts.js';
+import { type SignInOptionsRateLimit, signInOptionsRouter } from './routes/sign-in-options.js';
 import { signingKeysRouter } from './routes/signing-keys.js';
 import { teamsRouter } from './routes/teams.js';
 import { tenantRouter } from './routes/tenant.js';
+import { tokenSignInRouter } from './routes/token-sign-in.js';
 import { tokensRouter } from './routes/tokens.js';
 import { toolsRouter } from './routes/tools.js';
 import { webhookEndpointsRouter } from './routes/webhook-endpoints.js';
 import { webhooksRouter } from './routes/webhooks.js';
 import type { S3CredentialBinding } from './s3-credential-binding.js';
 import type { SecretBinding } from './secrets-binding.js';
+import type { ServiceAccountBinding } from './service-account-binding.js';
 import type { SessionStoreBinding } from './session-store-binding.js';
 import type { SigningKeyBinding as SigningKeyRegistryBinding } from './signing-key-binding.js';
 import { type OauthStateStore, createInMemoryOauthStateStore } from './state-store-binding.js';
@@ -134,7 +151,7 @@ import type { SupervisorBinding } from './supervisor-binding.js';
 import type { TenantHostAccess } from './tenant-host-access.js';
 import type { TokenAdmin } from './token-admin.js';
 import type { ToolRegistryBinding } from './tool-binding.js';
-import type { TriggerRegistryBinding } from './trigger-binding.js';
+import { TRIGGER_KINDS, type TriggerKind, type TriggerRegistryBinding } from './trigger-binding.js';
 import type { AppEnv } from './types.js';
 import type { WebhookEndpointBinding } from './webhook-endpoint-binding.js';
 
@@ -285,6 +302,19 @@ export interface CreateAppInput {
    * keys out-of-band (e.g. via a separate admin console).
    */
   readonly tokenAdmin?: TokenAdmin;
+  /**
+   * Optional. When present, mounts `/v1/service-accounts` (tenant admins):
+   * create with grants, list, get, grant, ungrant, unregister. Keys for an
+   * account are minted at `POST /v1/tokens` with `for`.
+   */
+  readonly serviceAccountBinding?: ServiceAccountBinding;
+  /**
+   * Optional. A person's grants under `/v1/identity/users/:userId`:
+   * `GET grants` (tenant admins, or the person) and `POST grant|ungrant`
+   * (tenant admin; tenant admins only). Without it they answer
+   * `501 person-grants-unsupported`. Needs `identityDirectory`.
+   */
+  readonly personGrants?: PersonGrantsBinding;
   /**
    * Optional. When present, mounts the HITL surface:
    *   - `GET /v1/approvals` (list, role-scoped)
@@ -379,6 +409,13 @@ export interface CreateAppInput {
    * cache-invalidation concern as `onToolWrite` / `onProviderWrite`.
    */
   readonly onGuardrailWrite?: import('./routes/guardrails.js').GuardrailWriteHook;
+  /**
+   * Checks a guardrail being registered (`POST /v1/guardrails`) against
+   * the `configSchema` of the check it names; a problem refuses it with
+   * `422 guardrail-config-invalid`. A runtime passes it with the pack
+   * checks' schemas from their deployments. Absent: no check.
+   */
+  readonly checkGuardrailConfig?: import('./routes/guardrails.js').GuardrailConfigCheck;
   /**
    * Optional. When present, mounts the retention surface
    * (`/v1/retention/scheduled`, `/v1/retention/sweep`,
@@ -395,6 +432,13 @@ export interface CreateAppInput {
    * the memory subsystem runtime + their embedding registry.
    */
   readonly memory?: MemoryBinding;
+  /**
+   * Optional. When present, mounts erasing a person's words
+   * (`/v1/memory/erasures`: create, get, list, export, replay), for a
+   * tenant admin only. The Kindgi runtime supplies an implementation over
+   * its erasure jobs and ledger.
+   */
+  readonly memoryErasures?: MemoryErasureBinding;
   /**
    * Optional. When present, mounts the supervisor proposals surface
    * (`/v1/proposals` list/get/draft, plus lifecycle actions
@@ -409,17 +453,31 @@ export interface CreateAppInput {
    */
   readonly supervisor?: SupervisorBinding;
   /**
-   * Optional. Caller-plugged key store for signed provenance exports
-   * (`POST /v1/provenance/:runId/export`). When omitted, the export
-   * route responds `404 signing-not-configured` — the read routes
-   * (`GET /v1/provenance`, `GET /v1/provenance/:runId`) remain mounted
-   * either way because they read through `provenanceBinding` and do not
-   * need signing material.
+   * Optional. Improvement passes (`POST /v1/proposals/improve`,
+   * `/v1/improvement-passes`): the runtime's search for better settings
+   * values, written as an improvement proposal. Without it, both answer
+   * `501 improve-unsupported`. Mounted with `/v1/proposals`.
+   */
+  readonly improvementPasses?: ImprovementPassBinding;
+  /**
+   * Optional. The key the deployment signs its exports with: an
+   * approval's audit bundle (`POST /v1/approvals/:approvalId/audit-bundle`),
+   * a run's provenance (`POST /v1/provenance/:runId/export`) and
+   * compliance evidence (`POST /v1/compliance/evidence/export`). Its
+   * public keys are `GET /v1/export-signing-keys`. Each signed export is
+   * recorded as an `export-signed` audit event when `auditEvents` is
+   * given.
    *
-   * Same caller-plugged pattern as the other bindings — the API package
-   * does NOT own key persistence. Deployments plug in a binding that
-   * wraps their KMS / HSM / env-var store; see `SigningKeyBinding` in
-   * `@kindgi/crypto`.
+   * Without it (and without `signingKey`), the three exports answer
+   * `404 signing-not-configured`; the read routes stay mounted. The API
+   * doesn't own key material: a deployment plugs a file key
+   * (`createEd25519ExportSigner` in `@kindgi/crypto`) or a KMS-backed
+   * binding.
+   */
+  readonly exportSigning?: ExportSigningBinding;
+  /**
+   * @deprecated Use `exportSigning`. Still read, as its Ed25519 keys
+   * (`exportSignerFromSigningKeyBinding`), when `exportSigning` isn't given.
    */
   readonly signingKey?: SigningKeyBinding;
   /**
@@ -442,6 +500,11 @@ export interface CreateAppInput {
    * production.
    */
   readonly blobStorage?: BlobStorageBinding;
+  /**
+   * The most bytes one artifact upload may carry (`POST /v1/artifacts`);
+   * more is `413 artifact-too-large`. Default 100 MB.
+   */
+  readonly artifactMaxBytes?: number;
   /**
    * Optional. When present, mounts the read-only capabilities catalog
    * surface (`/v1/capabilities` list, `/v1/capabilities/:capabilityId`
@@ -557,6 +620,13 @@ export interface CreateAppInput {
    * want bespoke persistence substitute their own binding.
    */
   readonly triggerRegistry?: TriggerRegistryBinding;
+  /**
+   * The trigger kinds whose admin surface mounts with `triggerRegistry`:
+   * `cron` → `/v1/schedules`, `event` → `/v1/event-triggers`, `webhook` →
+   * `/v1/webhooks`. Absent: all three. A runtime that fires only some kinds
+   * lists those, so nobody registers a trigger that would never fire.
+   */
+  readonly triggerKinds?: readonly TriggerKind[];
   /**
    * Optional. When present, mounts the outbound webhook surface at
    * `/v1/webhook-endpoints/*`: endpoints the platform sends signed
@@ -677,8 +747,10 @@ export interface CreateAppInput {
    */
   readonly session?: SessionConfig;
   /**
-   * Optional. When present alongside `sessionStore` + `exchangeCode`,
-   * mounts the identity-provider catalog + auth flow at `/v1/auth/*`.
+   * Optional. When present alongside `sessionStore`, mounts the
+   * identity-provider catalog, refresh and logout at `/v1/auth/*`; with
+   * `exchangeCode` too, also this package's own OAuth flow
+   * (`/login/:providerId` and the callback).
    *
    * Deployments register their OAuth/OIDC providers at boot (or via
    * `POST /v1/auth/providers`); the framework does NOT bake in a
@@ -686,8 +758,11 @@ export interface CreateAppInput {
    */
   readonly identityProvider?: IdentityProviderBinding;
   /**
-   * Required alongside `identityProvider`. Called by
-   * `POST /v1/auth/callback/:providerId` to exchange the authorization
+   * Optional: the deployment's own code exchange. With it (and
+   * `identityProvider` + `sessionStore`), `POST /v1/auth/login/:providerId`
+   * and `POST /v1/auth/callback/:providerId` mount; a deployment whose
+   * sign-in runs elsewhere (a browser flow of its own) leaves it out.
+   * Called by `POST /v1/auth/callback/:providerId` to exchange the authorization
    * code for provider tokens + userinfo. Deployments implementing
    * `IdentityProviderBinding` typically pair it with their own
    * `exchangeCode` that speaks OAuth 2.0 + PKCE against the provider's
@@ -711,6 +786,21 @@ export interface CreateAppInput {
    * login. Mirror of the `idempotencyStore` caller-plugged pattern.
    */
   readonly oauthStateStore?: OauthStateStore;
+  /**
+   * The rate limit on `GET /v1/auth/sign-in-options` (unauthenticated):
+   * requests per client per window, and how to tell clients apart.
+   * Default: 30 a minute, per nearest (rightmost) `X-Forwarded-For` hop.
+   */
+  readonly signInOptionsRateLimit?: SignInOptionsRateLimit;
+  /**
+   * The emailed sign-in link, when the deployment offers it (it serves the
+   * link itself): sign-in options say so, with the captcha's site key.
+   */
+  readonly signInEmailLink?: {
+    readonly captchaSiteKey?: string;
+    /** Whether the link is offered for an email's domain. Absent: every domain. */
+    readonly allowedFor?: (emailDomain: string) => Promise<boolean>;
+  };
   /**
    * Optional. Signed-deployment ledger — the audit anchor for every
    * `POST /v1/deployments` landing. Caller-plugged per the pattern
@@ -875,6 +965,21 @@ export interface SessionConfig {
    * but coarser inactivity enforcement.
    */
   readonly touchThrottle?: number;
+  /**
+   * Browser sessions in a cookie: the middleware reads the session token
+   * from it when a request has no `Authorization` header, and refuses a
+   * cookie-authenticated unsafe request whose `Origin` isn't allowed
+   * (403 `csrf-origin-mismatch`). Absent → session tokens come only in
+   * the `Authorization` header.
+   */
+  readonly cookie?: SessionCookieOptions;
+  /**
+   * Whether a person may sign in to the console with an API token
+   * (`POST /v1/auth/token-sign-in`): a person's full key is exchanged once
+   * for a browser session in `cookie`. Needs `cookie` and a session store.
+   * Absent or `false`: the route answers 403 `token-sign-in-off`.
+   */
+  readonly tokenSignIn?: boolean;
 }
 
 /**
@@ -894,10 +999,34 @@ export interface ScalarDocsConfig {
   readonly theme?: string;
 }
 
+/** A token sign-in's session lifetime when `SessionConfig.ttl` is unset: 12 hours. */
+const DEFAULT_TOKEN_SIGN_IN_TTL_MS = 12 * 60 * 60 * 1000;
+
 export function createApp(input: CreateAppInput): Hono<AppEnv> {
+  // A cookie session's value is the token the store minted. A store that
+  // can't resolve its own tokens would put the session id there instead,
+  // and the id is no secret (whoami and the audit trail show it).
+  if (
+    input.session?.cookie !== undefined &&
+    input.sessionStore !== undefined &&
+    input.sessionStore.resolveToken === undefined
+  ) {
+    throw new Error(
+      'Cookie sessions need a session store that resolves its own tokens (`resolveToken`): without it, the session id would be the credential.',
+    );
+  }
   const app = new Hono<AppEnv>();
 
   const runBinding = input.kernelBinding.run;
+  const exportSigning =
+    input.exportSigning ??
+    (input.signingKey !== undefined
+      ? exportSignerFromSigningKeyBinding(input.signingKey)
+      : undefined);
+  const exportOptions = {
+    ...(exportSigning !== undefined && { exportSigning }),
+    ...(input.auditEvents !== undefined && { auditEvents: input.auditEvents }),
+  };
 
   // ---------- global middleware ----------
   app.use('*', requestIdMiddleware());
@@ -971,6 +1100,7 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
       ...(sessionCfg?.touchThrottle !== undefined && {
         touchThrottleMs: sessionCfg.touchThrottle,
       }),
+      ...(sessionCfg?.cookie !== undefined && { sessionCookie: sessionCfg.cookie }),
     }),
   );
   // Principal construction — runs after bearer so it can read the
@@ -984,6 +1114,8 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
     if (tenantId !== undefined) c.set('log', c.get('log').child({ tenantId }));
     await next();
   });
+  // A key limited to a project names no other one.
+  v1.use('*', refuseOtherProjectForKey());
   const authorizer: Authorizer | undefined =
     input.authz !== undefined ? createAuthorizer(input.authz.authzCheckBinding) : undefined;
 
@@ -1001,6 +1133,15 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
       runBinding,
       {
         ...(input.eventBus !== undefined && { eventBus: input.eventBus }),
+        ...(input.agentRegistry !== undefined &&
+          input.flowRegistry !== undefined && {
+            targetExists: async (tenantId, target) =>
+              target.kind === 'agent'
+                ? (await input.agentRegistry?.get({ tenantId, agentId: target.id as never })) !==
+                  null
+                : (await input.flowRegistry?.get({ tenantId, flowId: target.id as never })) !==
+                  null,
+          }),
         ...(publicRunTokenLimits !== undefined && {
           publicRunTokens: {
             mint: (tenantId, runIds) =>
@@ -1013,7 +1154,7 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
   );
   v1.route(
     '/conversations',
-    conversationsRouter(input.conversationBinding, runBinding, input.projectBinding),
+    conversationsRouter(input.conversationBinding, runBinding, input.projectBinding, authorizer),
   );
   if (publicRunTokenLimits !== undefined) {
     v1.route(
@@ -1028,6 +1169,9 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
   if (input.tokenAdmin !== undefined) {
     v1.route('/tokens', tokensRouter(input.tokenAdmin, authorizer));
   }
+  if (input.serviceAccountBinding !== undefined) {
+    v1.route('/service-accounts', serviceAccountsRouter(input.serviceAccountBinding, authorizer));
+  }
   // Mount the reviewer roster sub-resource BEFORE the approvals router
   // so `/v1/approvals/reviewers/*` resolves here rather than being
   // captured by the `:approvalId` param on the approvals router.
@@ -1043,7 +1187,7 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
         input.hitlBinding,
         runBinding,
         {
-          ...(input.signingKey !== undefined && { signingKey: input.signingKey }),
+          ...exportOptions,
           // Inline resume after approval-complete drives
           // completeToken. Passing the runHandler here means the route
           // calls `runHandler.resumeRun(...)` synchronously in the same
@@ -1051,11 +1195,12 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
           // new state (running / completed / re-suspended).
           runHandler: input.runHandler,
         },
+        authorizer,
       ),
     );
   }
   if (input.enableObservations === true && input.supervisor !== undefined) {
-    v1.route('/observations', observationsRouter(input.supervisor));
+    v1.route('/observations', observationsRouter(input.supervisor, authorizer));
   }
   if (input.agentRegistry !== undefined) {
     v1.route(
@@ -1070,6 +1215,17 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
           ...(input.evalRunBinding !== undefined && { evalRuns: input.evalRunBinding }),
           ...(input.projectBinding !== undefined && { projects: input.projectBinding }),
         },
+        {
+          ...(input.memory?.semanticSearch !== undefined && {
+            semanticSearch: input.memory.semanticSearch,
+          }),
+          ...(input.memory?.agentRemember !== undefined && {
+            remember: input.memory.agentRemember,
+          }),
+          ...(input.memory?.conversationRecall !== undefined && {
+            conversationRecall: input.memory.conversationRecall,
+          }),
+        },
       ),
     );
   }
@@ -1098,24 +1254,72 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
   if (input.guardrailRegistry !== undefined) {
     v1.route(
       '/guardrails',
-      guardrailsRouter(input.guardrailRegistry, authorizer, input.onGuardrailWrite),
+      guardrailsRouter(
+        input.guardrailRegistry,
+        authorizer,
+        input.onGuardrailWrite,
+        input.checkGuardrailConfig,
+      ),
     );
   }
   if (input.retention !== undefined) {
     v1.route('/retention', retentionRouter(input.retention, authorizer));
   }
+  // Before `/memory`, so its routes answer first.
+  if (input.memoryErasures !== undefined) {
+    v1.route('/memory/erasures', memoryErasuresRouter(input.memoryErasures, authorizer));
+  }
   if (input.memory !== undefined) {
-    v1.route('/memory', memoryRouter(input.memory));
+    v1.route(
+      '/memory',
+      memoryRouter(input.memory, {
+        ...(authorizer !== undefined && { authorizer }),
+        ...(input.projectBinding !== undefined && { projects: input.projectBinding }),
+      }),
+    );
   }
-  if (input.supervisor !== undefined) {
-    v1.route('/proposals', proposalsRouter(input.supervisor));
+  if (
+    input.supervisor !== undefined &&
+    input.agentRegistry !== undefined &&
+    input.blockRegistry !== undefined &&
+    input.evalRunBinding !== undefined &&
+    input.agentReleases !== undefined
+  ) {
+    const improveDeps = {
+      ...(input.improvementPasses !== undefined && { passes: input.improvementPasses }),
+      agents: input.agentRegistry,
+      blocks: input.blockRegistry,
+      releases: input.agentReleases,
+    };
+    v1.route(
+      '/proposals',
+      proposalsRouter(
+        input.supervisor,
+        {
+          agents: input.agentRegistry,
+          blocks: input.blockRegistry,
+          evalRuns: input.evalRunBinding,
+          releases: input.agentReleases,
+          ...(input.projectBinding !== undefined && { projects: input.projectBinding }),
+        },
+        authorizer,
+        (r) => mountImproveRoute(r, improveDeps, authorizer),
+      ),
+    );
+    v1.route('/improvement-passes', improvementPassesRouter(input.improvementPasses, authorizer));
   }
+  v1.route('/export-signing-keys', exportSigningKeysRouter(exportSigning));
   v1.route(
     '/provenance',
-    provenanceRouter(input.provenanceBinding, {
-      conversationBinding: input.conversationBinding,
-      ...(input.signingKey !== undefined && { signingKey: input.signingKey }),
-    }),
+    provenanceRouter(
+      input.provenanceBinding,
+      {
+        conversationBinding: input.conversationBinding,
+        runBinding,
+        ...exportOptions,
+      },
+      authorizer,
+    ),
   );
   if (
     input.auditEvents !== undefined &&
@@ -1124,22 +1328,40 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
   ) {
     v1.route(
       '/compliance',
-      complianceRouter({
-        auditEvents: input.auditEvents,
-        classifier: input.complianceClassifier,
-        complianceGenerator: input.complianceGenerator,
-        ...(input.signingKey !== undefined && { signingKey: input.signingKey }),
-      }),
+      complianceRouter(
+        {
+          auditEvents: input.auditEvents,
+          classifier: input.complianceClassifier,
+          ...(exportSigning !== undefined && { exportSigning }),
+        },
+        authorizer,
+      ),
     );
   }
   if (input.blobStorage !== undefined) {
-    v1.route('/artifacts', artifactsRouter(input.blobStorage));
+    v1.route(
+      '/artifacts',
+      artifactsRouter(input.blobStorage, {
+        runBinding,
+        ...(input.projectBinding !== undefined && { projectBinding: input.projectBinding }),
+        ...(authorizer !== undefined && { authorizer }),
+        ...(input.artifactMaxBytes !== undefined && { maxBytes: input.artifactMaxBytes }),
+      }),
+    );
   }
   if (input.capabilityRegistry !== undefined) {
-    v1.route('/capabilities', capabilitiesRouter(input.capabilityRegistry));
+    v1.route('/capabilities', capabilitiesRouter(input.capabilityRegistry, authorizer));
   }
   if (input.providerRegistry !== undefined) {
-    v1.route('/providers', providersRouter(input.providerRegistry, input.onProviderWrite));
+    v1.route(
+      '/providers',
+      providersRouter(
+        input.providerRegistry,
+        input.onProviderWrite,
+        input.adapterFactories,
+        authorizer,
+      ),
+    );
   }
   if (input.mcpEndpointRegistry !== undefined) {
     v1.route(
@@ -1159,28 +1381,43 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
       ...(input.identityDirectory !== undefined && { directory: input.identityDirectory }),
       ...(input.sessionStore !== undefined && { sessionStore: input.sessionStore }),
       ...(input.reviewerBinding !== undefined && { reviewerBinding: input.reviewerBinding }),
+      ...(authorizer !== undefined && { authorizer }),
+      ...(input.personGrants !== undefined && { personGrants: input.personGrants }),
     }),
   );
   if (input.cost !== undefined) {
-    v1.route('/cost', costRouter(input.cost));
+    v1.route('/cost', costRouter(input.cost, authorizer));
   }
   if (input.adapterRegistry !== undefined) {
-    v1.route('/adapters', adaptersRouter(input.adapterRegistry, input.adapterFactories));
+    v1.route(
+      '/adapters',
+      adaptersRouter(input.adapterRegistry, input.adapterFactories, authorizer),
+    );
   }
   // Trigger admin surfaces. Three sibling routers over the same
   // `TriggerRegistryBinding` — each pins its own kind. There is no
   // external webhook receiver route here (it would need
   // unauthenticated tenant resolution).
   if (input.triggerRegistry !== undefined) {
-    v1.route('/schedules', schedulesRouter(input.triggerRegistry));
-    v1.route('/event-triggers', eventTriggersRouter(input.triggerRegistry));
-    v1.route('/webhooks', webhooksRouter(input.triggerRegistry));
+    const kinds = new Set<TriggerKind>(input.triggerKinds ?? TRIGGER_KINDS);
+    if (kinds.has('cron')) {
+      v1.route(
+        '/schedules',
+        schedulesRouter(input.triggerRegistry, authorizer, input.projectBinding),
+      );
+    }
+    if (kinds.has('event')) {
+      v1.route('/event-triggers', eventTriggersRouter(input.triggerRegistry, authorizer));
+    }
+    if (kinds.has('webhook')) {
+      v1.route('/webhooks', webhooksRouter(input.triggerRegistry, authorizer));
+    }
   }
   if (input.webhookEndpoints !== undefined) {
-    v1.route('/webhook-endpoints', webhookEndpointsRouter(input.webhookEndpoints));
+    v1.route('/webhook-endpoints', webhookEndpointsRouter(input.webhookEndpoints, authorizer));
   }
   if (input.policyRegistry !== undefined) {
-    v1.route('/policies', policiesRouter(input.policyRegistry));
+    v1.route('/policies', policiesRouter(input.policyRegistry, authorizer));
   }
   if (input.evalSuiteRegistry !== undefined) {
     v1.route('/eval-suites', evalSuitesRouter(input.evalSuiteRegistry, authorizer));
@@ -1243,6 +1480,7 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
         input.projectMembershipBinding,
         tenantHierarchyBinding,
         authorizer,
+        input.identityDirectory,
       ),
     );
   }
@@ -1294,7 +1532,7 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
   // Mounted on its own: a deployment can trust keys before it accepts
   // deployments.
   if (input.signingKeyRegistry !== undefined) {
-    v1.route('/signing-keys', signingKeysRouter(input.signingKeyRegistry));
+    v1.route('/signing-keys', signingKeysRouter(input.signingKeyRegistry, authorizer));
   }
   if (
     input.deploymentRegistry !== undefined &&
@@ -1303,33 +1541,36 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
   ) {
     v1.route(
       '/deployments',
-      deploymentsRouter({
-        deploymentRegistry: input.deploymentRegistry,
-        signingKeyRegistry: input.signingKeyRegistry,
-        imageRegistry: input.imageRegistry,
-        ...(input.toolRegistry !== undefined && { toolRegistry: input.toolRegistry }),
-        ...(input.blockRegistry !== undefined && { blockRegistry: input.blockRegistry }),
-        ...(input.guardrailRegistry !== undefined && {
-          guardrailRegistry: input.guardrailRegistry,
-        }),
-        ...(input.agentRegistry !== undefined && { agentRegistry: input.agentRegistry }),
-        ...(input.flowRegistry !== undefined && { flowRegistry: input.flowRegistry }),
-        ...(input.agentReleases !== undefined && { liveVersions: input.agentReleases.live }),
-        // The deployments router's agents publish loop resolves the
-        // Default project through this binding. Optional at wiring so
-        // app compositions without a project binding still boot; the loop
-        // fails fast at runtime if agents are in the deployment index
-        // but the binding is absent.
-        ...(input.projectBinding !== undefined && { projectBinding: input.projectBinding }),
-        // POST /v1/deployments/:deploymentId/secrets needs the
-        // secretsBinding. Absent binding → the route answers 500 with an
-        // operator-actionable message.
-        ...(input.secretsBinding !== undefined && { secretsBinding: input.secretsBinding }),
-        // A deploy registers tools and guardrails: the same cache hooks
-        // `POST /v1/tools` / `POST /v1/guardrails` call.
-        ...(input.onToolWrite !== undefined && { onToolWrite: input.onToolWrite }),
-        ...(input.onGuardrailWrite !== undefined && { onGuardrailWrite: input.onGuardrailWrite }),
-      }),
+      deploymentsRouter(
+        {
+          deploymentRegistry: input.deploymentRegistry,
+          signingKeyRegistry: input.signingKeyRegistry,
+          imageRegistry: input.imageRegistry,
+          ...(input.toolRegistry !== undefined && { toolRegistry: input.toolRegistry }),
+          ...(input.blockRegistry !== undefined && { blockRegistry: input.blockRegistry }),
+          ...(input.guardrailRegistry !== undefined && {
+            guardrailRegistry: input.guardrailRegistry,
+          }),
+          ...(input.agentRegistry !== undefined && { agentRegistry: input.agentRegistry }),
+          ...(input.flowRegistry !== undefined && { flowRegistry: input.flowRegistry }),
+          ...(input.agentReleases !== undefined && { liveVersions: input.agentReleases.live }),
+          // The deployments router's agents publish loop resolves the
+          // Default project through this binding. Optional at wiring so
+          // app compositions without a project binding still boot; the loop
+          // fails fast at runtime if agents are in the deployment index
+          // but the binding is absent.
+          ...(input.projectBinding !== undefined && { projectBinding: input.projectBinding }),
+          // POST /v1/deployments/:deploymentId/secrets needs the
+          // secretsBinding. Absent binding → the route answers 500 with an
+          // operator-actionable message.
+          ...(input.secretsBinding !== undefined && { secretsBinding: input.secretsBinding }),
+          // A deploy registers tools and guardrails: the same cache hooks
+          // `POST /v1/tools` / `POST /v1/guardrails` call.
+          ...(input.onToolWrite !== undefined && { onToolWrite: input.onToolWrite }),
+          ...(input.onGuardrailWrite !== undefined && { onGuardrailWrite: input.onGuardrailWrite }),
+        },
+        authorizer,
+      ),
     );
   }
   if (input.evalRunBinding !== undefined) {
@@ -1348,6 +1589,10 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
             ...(input.toolRegistry !== undefined && { tools: input.toolRegistry }),
           }
         : undefined,
+      input.agentRegistry !== undefined && input.blockRegistry !== undefined
+        ? { agents: input.agentRegistry, blocks: input.blockRegistry }
+        : undefined,
+      authorizer,
     );
     v1.route('/eval-suites', evalRuns.start);
     v1.route('/eval-runs', evalRuns.readback);
@@ -1360,24 +1605,65 @@ export function createApp(input: CreateAppInput): Hono<AppEnv> {
   // reach it), and the callback sub-router mounts OUTSIDE the bearer
   // chain at `/v1/auth/callback/*` because the redirect from the
   // provider carries no framework token yet.
-  if (
-    input.sessionStore !== undefined &&
-    input.identityProvider !== undefined &&
-    input.exchangeCode !== undefined
-  ) {
+  if (input.sessionStore !== undefined && input.identityProvider !== undefined) {
     const routers = authRouters({
       sessionStore: input.sessionStore,
       identityProvider: input.identityProvider,
-      exchangeCode: input.exchangeCode,
+      ...(input.exchangeCode !== undefined && { exchangeCode: input.exchangeCode }),
       ...(input.refreshToken !== undefined && { refreshToken: input.refreshToken }),
       stateStore: input.oauthStateStore ?? createInMemoryOauthStateStore(),
+      ...(authorizer !== undefined && { authorizer }),
+      ...(input.auditEvents !== undefined && { auditEvents: input.auditEvents }),
     });
     v1.route('/auth', routers.authed);
     // Callback mounts on the parent `app` under /v1/auth/callback so it
     // bypasses the bearer chain. The v1 router's use('*', bearer) has
     // already been installed above, so we mount at the parent scope.
-    app.route('/v1/auth/callback', routers.callback);
+    // Only the deployment's own code exchange serves it.
+    if (input.exchangeCode !== undefined) app.route('/v1/auth/callback', routers.callback);
+  }
+  // How a person can sign in, before anyone is: outside the bearer chain
+  // too (mounted ahead of `/v1`, like the callback). Always mounted, so the
+  // console and `kindgi doctor` get a definite answer even when there is no
+  // way in at all: the case an operator most needs to hear about.
+  const cookieSessions = input.sessionStore !== undefined && input.session?.cookie !== undefined;
+  const tokenSignIn = cookieSessions && input.session?.tokenSignIn === true;
+  app.route(
+    '/v1/auth/sign-in-options',
+    signInOptionsRouter({
+      ...(input.identityProvider !== undefined && { identityProvider: input.identityProvider }),
+      tokenSignIn,
+      ...(input.signInOptionsRateLimit !== undefined && {
+        rateLimit: input.signInOptionsRateLimit,
+      }),
+      ...(input.signInEmailLink !== undefined && { emailLink: input.signInEmailLink }),
+    }),
+  );
+  // Browser sessions need a way out even without identity providers
+  // (which bring their own `/auth` routes, logout included).
+  if (cookieSessions && input.identityProvider === undefined && input.sessionStore !== undefined) {
+    v1.post('/auth/logout', logoutHandler(input.sessionStore, input.auditEvents));
   }
+  // A person signs in to the console with an API token: inside the bearer
+  // chain (the token arrives in `Authorization`). Always mounted: without
+  // browser sessions, or unless the deployment allows it, it refuses with
+  // 403 token-sign-in-off.
+  v1.route(
+    '/auth/token-sign-in',
+    tokenSignInRouter(
+      input.sessionStore !== undefined &&
+        input.session?.cookie !== undefined &&
+        input.session.tokenSignIn === true
+        ? {
+            enabled: true,
+            sessionStore: input.sessionStore,
+            ttlMs: input.session.ttl ?? DEFAULT_TOKEN_SIGN_IN_TTL_MS,
+            cookieName: input.session.cookie.name ?? SESSION_COOKIE_NAME,
+            ...(input.auditEvents !== undefined && { auditEvents: input.auditEvents }),
+          }
+        : { enabled: false },
+    ),
+  );
   app.route('/v1', v1);
 
   // ---------- S3-compat surface (/s3/*, SigV4 auth) ----------