@oomol-lab/open-connector 1.9.0 → 1.9.1

package/src/server/api/console-oauth-routes.js

@@ -0,0 +1,298 @@
+import { Hono } from "hono";
+import { ConnectionError } from "../../connection-service.js";
+import { optionalBoolean, optionalRecord, optionalString, requiredRawString, requiredString, requiredStringArray, } from "../../core/cast.js";
+import { OAuthClientConfigError } from "../../oauth/oauth-client-config-service.js";
+import { OAuthCallbackError, OAuthFlowError } from "../../oauth/oauth-flow-service.js";
+import { HttpRequestError, jsonError, readConnectionName as defaultReadConnectionName, readJsonBody, } from "./http-utils.js";
+import { renderOAuthCompletionPage } from "./oauth-completion-page.js";
+function readOAuthClientConfigInput(body) {
+    const keys = ["clientId", "clientSecret", "requestedScopes", "redirectUri", "extra", "secretExtra"];
+    if (!keys.some((key) => key in body)) {
+        return undefined;
+    }
+    return {
+        clientId: optionalString(body.clientId) ?? "",
+        clientSecret: optionalString(body.clientSecret) ?? "",
+        requestedScopes: readOptionalStringArray(body, "requestedScopes"),
+        redirectUri: readOptionalRawString(body, "redirectUri"),
+        extra: optionalRecord(body.extra),
+        secretExtra: optionalRecord(body.secretExtra),
+    };
+}
+/** An absent field is undefined; a present one, null included, must be a string (blank is kept for the caller to read as unset). */
+function readOptionalRawString(body, fieldName) {
+    if (!(fieldName in body))
+        return undefined;
+    return requiredRawString(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
+}
+function readOptionalStringArray(body, fieldName) {
+    if (!(fieldName in body))
+        return undefined;
+    return requiredStringArray(body[fieldName], fieldName, (message) => new HttpRequestError("invalid_input", `${message}.`));
+}
+/** Console connection management and OAuth client configuration / authorization routes. */
+export function createConsoleOAuthRoutes({ connections, oauthFlow, oauthClientConfigs, saasProject, logger, oauthCloseDelaySeconds, readConnectionName = defaultReadConnectionName, }) {
+    const app = new Hono();
+    const writeConnectionResult = async (context, operation, logContext) => {
+        try {
+            const result = await operation;
+            if (logContext) {
+                logger?.info(logContext, logContext.operation === "disconnect" ? "connection disconnect completed" : "connection completed");
+            }
+            return context.json(result);
+        }
+        catch (error) {
+            if (error instanceof ConnectionError) {
+                if (logContext) {
+                    const cancelled = error.code === "connection_cancelled";
+                    logger?.[cancelled ? "info" : "warn"]({
+                        ...logContext,
+                        errorCode: error.code,
+                    }, cancelled
+                        ? "connection cancelled"
+                        : logContext.operation === "disconnect"
+                            ? "connection disconnect failed"
+                            : "connection failed");
+                }
+                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
+            }
+            throw error;
+        }
+    };
+    const writeOAuthResult = async (context, operation) => {
+        try {
+            return context.json(await operation);
+        }
+        catch (error) {
+            if (error instanceof OAuthClientConfigError || error instanceof OAuthFlowError) {
+                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
+            }
+            if (error instanceof HttpRequestError) {
+                return jsonError(context, 400, error.code, error.message);
+            }
+            throw error;
+        }
+    };
+    app.get("/api/connections", async (context) => context.json(await connections.listConnections()));
+    app.put("/api/connections/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        const authType = optionalString(body.authType);
+        if (!authType) {
+            logger?.warn({
+                errorCode: "invalid_input",
+                path: context.req.path,
+                service,
+            }, "connection rejected");
+            return jsonError(context, 400, "invalid_input", "authType is required.");
+        }
+        const values = body.values ?? body;
+        const connectionName = readConnectionName(context, body);
+        const logContext = {
+            operation: "connect",
+            path: context.req.path,
+            service,
+            authType,
+            connectionName,
+        };
+        if (authType === "no_auth") {
+            logger?.info(logContext, "connection started");
+            return writeConnectionResult(context, connections.connectWithoutAuth(service, { connectionName }), logContext);
+        }
+        if (authType === "api_key") {
+            logger?.info(logContext, "connection started");
+            return writeConnectionResult(context, connections.connectWithApiKey(service, {
+                values,
+                connectionName,
+                signal: context.req.raw.signal,
+            }), logContext);
+        }
+        if (authType === "custom_credential") {
+            logger?.info(logContext, "connection started");
+            return writeConnectionResult(context, connections.connectWithCustomCredential(service, {
+                values,
+                connectionName,
+                signal: context.req.raw.signal,
+            }), logContext);
+        }
+        logger?.warn({
+            ...logContext,
+            errorCode: "unsupported_auth_type",
+        }, "connection rejected");
+        return jsonError(context, 400, "unsupported_auth_type", `${service} does not support ${authType}.`);
+    });
+    app.delete("/api/connections/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        const connectionName = readConnectionName(context, body);
+        const logContext = {
+            operation: "disconnect",
+            path: context.req.path,
+            service,
+            connectionName,
+        };
+        logger?.info(logContext, "connection disconnect started");
+        return writeConnectionResult(context, connections.disconnect(service, connectionName, { revoke: optionalBoolean(body.revoke) }), logContext);
+    });
+    app.get("/api/oauth/configs", async (context) => {
+        const configs = await oauthClientConfigs.listConfigs();
+        const sources = await saasProject?.listSources();
+        return context.json(configs.map((config) => ({
+            ...config,
+            oauthSource: sources?.get(config.service) ?? { mode: "local" },
+            customClientAvailable: sources?.has(config.service) ? false : config.customClientAvailable,
+        })));
+    });
+    app.put("/api/oauth/configs/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        return writeOAuthResult(context, oauthClientConfigs.upsertConfig({
+            service,
+            clientId: optionalString(body.clientId) ?? "",
+            clientSecret: optionalString(body.clientSecret) ?? "",
+            requestedScopes: readOptionalStringArray(body, "requestedScopes"),
+            redirectUri: readOptionalRawString(body, "redirectUri"),
+            extra: optionalRecord(body.extra),
+            secretExtra: optionalRecord(body.secretExtra),
+        }));
+    });
+    app.delete("/api/oauth/configs/:service", async (context) => {
+        const service = context.req.param("service");
+        return writeOAuthResult(context, oauthClientConfigs.deleteConfig(service));
+    });
+    app.post("/api/oauth/connection-requests", async (context) => {
+        try {
+            const { consoleOAuthConnectionInput } = await import("./connection-input.js");
+            const parsed = consoleOAuthConnectionInput.safeParse(await readJsonBody(context));
+            if (!parsed.success)
+                return jsonError(context, 400, "invalid_input", "Invalid OAuth connection request.");
+            const { appId, ...input } = parsed.data;
+            const target = appId ? await connections.getStoredConnection(appId) : undefined;
+            if (target && (target.service !== input.service || target.connectionName !== input.connectionName))
+                return jsonError(context, 400, "invalid_input", "The selected connection no longer matches.");
+            return context.json(await oauthFlow.startConnectionRequest({
+                ...input,
+                target,
+                owner: "local-admin",
+                signal: context.req.raw.signal,
+            }));
+        }
+        catch (error) {
+            if (error instanceof OAuthClientConfigError ||
+                error instanceof OAuthFlowError ||
+                error instanceof ConnectionError)
+                return jsonError(context, error.code === "unknown_service" || error.code === "app_not_found" ? 404 : 400, error.code, error.message);
+            throw error;
+        }
+    });
+    app.post("/api/oauth/authorizations", async (context) => {
+        const body = await readJsonBody(context);
+        const requestedService = optionalString(body.service);
+        const connectionName = readConnectionName(context, body);
+        try {
+            const service = requiredString(body.service, "service", (message) => new OAuthFlowError("invalid_input", message));
+            const logContext = {
+                path: context.req.path,
+                service,
+                connectionName,
+            };
+            logger?.info(logContext, "oauth authorization started");
+            const authorization = await oauthFlow.startAuthorization({
+                service,
+                connectionName,
+                clientConfig: readOAuthClientConfigInput(body),
+                authorizationOptionIds: readOptionalStringArray(body, "authorizationOptionIds"),
+            });
+            const authorizationUrl = new URL(authorization.authorizationUrl);
+            logger?.info({
+                ...logContext,
+                authorizationHost: authorizationUrl.host,
+                redirectUri: authorizationUrl.searchParams.get("redirect_uri") ?? undefined,
+            }, "oauth authorization created");
+            return context.json(authorization);
+        }
+        catch (error) {
+            if (error instanceof OAuthClientConfigError ||
+                error instanceof OAuthFlowError ||
+                error instanceof ConnectionError) {
+                logger?.warn({
+                    errorCode: error.code,
+                    path: context.req.path,
+                    service: requestedService,
+                    connectionName,
+                }, "oauth authorization failed");
+                const status = error.code === "unknown_service" ? 404 : 400;
+                return jsonError(context, status, error.code, error.message);
+            }
+            throw error;
+        }
+    });
+    app.get("/oauth/callback", async (context) => {
+        const state = context.req.query("state");
+        const code = context.req.query("code");
+        const logContext = {
+            path: context.req.path,
+            hasState: Boolean(state),
+            hasCode: Boolean(code),
+        };
+        logger?.info(logContext, "oauth callback received");
+        const providerError = context.req.query("error");
+        if (providerError) {
+            const returnUri = state
+                ? await oauthFlow.rejectAuthorization(state, providerError === "access_denied")
+                : undefined;
+            if (returnUri)
+                return context.redirect(returnUri);
+            const providerErrorDescription = context.req.query("error_description");
+            logger?.warn({
+                ...logContext,
+                errorCode: "oauth_provider_error",
+                providerError,
+                providerErrorDescription,
+            }, "oauth callback failed");
+            return jsonError(context, 400, "oauth_provider_error", `OAuth provider returned error "${providerError}"${providerErrorDescription ? `: ${providerErrorDescription}` : "."}`);
+        }
+        if (!state || !code) {
+            if (state)
+                await oauthFlow.rejectAuthorization(state, false);
+            logger?.warn({
+                ...logContext,
+                errorCode: "invalid_oauth_callback",
+            }, "oauth callback failed");
+            return jsonError(context, 400, "invalid_oauth_callback", "OAuth callback requires state and code.");
+        }
+        let service;
+        try {
+            const callbackUrl = new URL(context.req.url);
+            const completed = await oauthFlow.completeAuthorization({
+                state,
+                code,
+                callbackParameters: Object.fromEntries(callbackUrl.searchParams),
+                callbackQuery: callbackUrl.search,
+                signal: context.req.raw.signal,
+            });
+            service = completed.service;
+            if (completed.returnUri)
+                return context.redirect(completed.returnUri);
+            logger?.info({
+                ...logContext,
+                service,
+            }, "oauth callback completed");
+        }
+        catch (error) {
+            if (error instanceof OAuthCallbackError && error.returnUri)
+                return context.redirect(error.returnUri);
+            if (error instanceof OAuthFlowError || error instanceof ConnectionError) {
+                const cancelled = error instanceof ConnectionError && error.code === "connection_cancelled";
+                logger?.[cancelled ? "info" : "warn"]({
+                    ...logContext,
+                    errorCode: error.code,
+                }, cancelled ? "oauth callback cancelled" : "oauth callback failed");
+                return jsonError(context, error.code === "unknown_service" ? 404 : 400, error.code, error.message);
+            }
+            throw error;
+        }
+        return context.html(renderOAuthCompletionPage(service, oauthCloseDelaySeconds));
+    });
+    return app;
+}

package/src/server/api/docs-routes.d.ts

@@ -0,0 +1,12 @@
+import type { ProviderDefinition } from "../../core/types.ts";
+import type { MiddlewareHandler } from "hono";
+import { Hono } from "hono";
+/** The Scalar API reference is only rendered for /docs, so its package is loaded on demand. */
+export declare function loadDocsHandler(openapiUrl?: string): Promise<MiddlewareHandler>;
+export interface DocsRoutesOptions {
+    providers: ProviderDefinition[];
+    publicOrigin: string;
+    serveDocumentation?: boolean;
+}
+/** OpenAPI 3.1 schema and interactive documentation routes. */
+export declare function createDocsRoutes({ providers, publicOrigin, serveDocumentation }: DocsRoutesOptions): Hono;

package/src/server/api/docs-routes.js

@@ -0,0 +1,38 @@
+import { Hono } from "hono";
+import { optionalString } from "../../core/cast.js";
+import { PromiseCache } from "../../core/promise-cache.js";
+const docsHandler = new PromiseCache();
+/** The Scalar API reference is only rendered for /docs, so its package is loaded on demand. */
+export function loadDocsHandler(openapiUrl = "/openapi.json") {
+    return docsHandler.get(openapiUrl, async () => {
+        const { Scalar } = await import("@scalar/hono-api-reference");
+        return Scalar({
+            pageTitle: "OOMOL Connect API Reference",
+            url: openapiUrl,
+            theme: "default",
+            darkMode: false,
+            forceDarkModeState: "light",
+            customCss: `
+          :root {
+            --scalar-color-accent: rgb(59, 99, 251);
+            --scalar-background-accent: rgba(59, 99, 251, 0.12);
+          }
+        `,
+        });
+    });
+}
+/** OpenAPI 3.1 schema and interactive documentation routes. */
+export function createDocsRoutes({ providers, publicOrigin, serveDocumentation }) {
+    const app = new Hono();
+    app.get("/openapi.json", async (context) => {
+        const { createOpenApiDocument } = await import("./openapi.js");
+        return context.json(createOpenApiDocument(providers, {
+            actionId: optionalString(context.req.query("actionId")),
+        }));
+    });
+    if (serveDocumentation !== false) {
+        const openapiUrl = `${new URL(publicOrigin).pathname.replace(/\/+$/, "")}/openapi.json`;
+        app.get("/docs", async (context, next) => (await loadDocsHandler(openapiUrl))(context, next));
+    }
+    return app;
+}

package/src/server/api/http-utils.d.ts

@@ -37,3 +37,4 @@ export declare class HttpRequestError extends Error {
     readonly status: RuntimeStatus;
     constructor(code: string, message: string, status?: RuntimeStatus);
 }
+export declare function readConnectionName(context: Context, body?: Record<string, unknown>): string | undefined;

package/src/server/api/http-utils.js

@@ -1,3 +1,4 @@
+import { optionalString } from "../../core/cast.js";
 /**
  * Read an optional JSON object request body.
  *
@@ -91,3 +92,10 @@ export class HttpRequestError extends Error {
         this.status = status;
     }
 }
+export function readConnectionName(context, body) {
+    return (optionalString(body?.connectionName) ??
+        optionalString(body?.alias) ??
+        optionalString(context.req.header("x-oo-connector-alias")) ??
+        optionalString(context.req.query("connectionName")) ??
+        optionalString(context.req.query("alias")));
+}

package/src/server/api/marketplace-routes.d.ts

@@ -0,0 +1,7 @@
+import type { MarketplaceService } from "../../marketplace/marketplace-service.ts";
+import { Hono } from "hono";
+export interface MarketplaceRoutesOptions {
+    marketplace: MarketplaceService;
+}
+/** Marketplace configuration and provider preference routes. */
+export declare function createMarketplaceRoutes({ marketplace }: MarketplaceRoutesOptions): Hono;

package/src/server/api/marketplace-routes.js

@@ -0,0 +1,62 @@
+import { Hono } from "hono";
+import { optionalString } from "../../core/cast.js";
+import { MarketplaceError } from "../../marketplace/marketplace-service.js";
+import { jsonError, readJsonBody } from "./http-utils.js";
+function writeMarketplaceError(context, error) {
+    const status = error.status;
+    return jsonError(context, status === 401 || status === 403 || status === 404 || status === 502 || status === 504 ? status : 400, error.code, error.message);
+}
+/** Marketplace configuration and provider preference routes. */
+export function createMarketplaceRoutes({ marketplace }) {
+    const app = new Hono();
+    app.get("/marketplace", (context) => context.json(marketplace.getState()));
+    app.get("/marketplace/discovery", async (context) => {
+        try {
+            return context.json(await marketplace.getDefaultDiscovery(context.req.raw.signal));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return writeMarketplaceError(context, error);
+            throw error;
+        }
+    });
+    const configureMarketplace = async (context) => {
+        const body = await readJsonBody(context);
+        const input = {
+            discoveryUrl: optionalString(body.discoveryUrl),
+            apiKey: optionalString(body.apiKey),
+            enabled: typeof body.enabled === "boolean" ? body.enabled : undefined,
+        };
+        try {
+            return context.json(await marketplace.configure(input));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return writeMarketplaceError(context, error);
+            throw error;
+        }
+    };
+    app.put("/marketplace", configureMarketplace);
+    app.patch("/marketplace", configureMarketplace);
+    app.delete("/marketplace", async (context) => {
+        await marketplace.remove();
+        return context.json(marketplace.getState());
+    });
+    app.get("/provider-preferences", async (context) => context.json(await marketplace.listProviderPreferences()));
+    app.patch("/provider-preferences/:service", async (context) => {
+        const service = context.req.param("service");
+        const body = await readJsonBody(context);
+        if (typeof body.enabled !== "boolean") {
+            return jsonError(context, 400, "invalid_input", "enabled must be a boolean.");
+        }
+        try {
+            return context.json(await marketplace.setProviderEnabled(service, body.enabled));
+        }
+        catch (error) {
+            if (error instanceof MarketplaceError)
+                return jsonError(context, 404, error.code, error.message);
+            throw error;
+        }
+    });
+    return app;
+}

package/src/server/api/mcp-routes.d.ts

@@ -0,0 +1,18 @@
+import type { CatalogStore } from "../../catalog-store.ts";
+import type { ConnectionService } from "../../connection-service.ts";
+import type { ActionPolicySnapshot } from "../../core/action-policy.ts";
+import type { ActionSearchIndexProvider } from "../../core/action-search.ts";
+import type { ActionRunner } from "../actions/action-runner.ts";
+import type { Context } from "hono";
+import { Hono } from "hono";
+export type McpModule = typeof import("../../mcp.ts");
+export declare function loadMcpModule(): Promise<McpModule>;
+export interface McpRoutesOptions {
+    catalog: CatalogStore;
+    connections: ConnectionService;
+    actions: ActionRunner;
+    actionSearch: ActionSearchIndexProvider;
+    getPolicySnapshot: (context: Context) => Promise<ActionPolicySnapshot>;
+}
+/** MCP transport and tool discovery routes. */
+export declare function createMcpRoutes({ catalog, connections, actions, actionSearch, getPolicySnapshot, }: McpRoutesOptions): Hono;

package/src/server/api/mcp-routes.js

@@ -0,0 +1,37 @@
+import { Hono } from "hono";
+import { PromiseCache } from "../../core/promise-cache.js";
+import { readRuntimeGrant } from "./auth.js";
+const mcpModule = new PromiseCache();
+export function loadMcpModule() {
+    return mcpModule.get("", () => import("../../mcp.js"));
+}
+function rejectMcpMethod(context) {
+    return context.json({
+        jsonrpc: "2.0",
+        error: {
+            code: -32000,
+            message: "Method not allowed.",
+        },
+        id: null,
+    }, 405);
+}
+/** MCP transport and tool discovery routes. */
+export function createMcpRoutes({ catalog, connections, actions, actionSearch, getPolicySnapshot, }) {
+    const app = new Hono();
+    app.post("/mcp", async (context) => {
+        const { handleMcpRequest } = await loadMcpModule();
+        return await handleMcpRequest(context.req.raw, {
+            catalog,
+            connections,
+            actions,
+            actionSearch,
+            getPolicySnapshot: () => getPolicySnapshot(context),
+            runtimeGrant: readRuntimeGrant(context),
+            signal: context.req.raw.signal,
+        });
+    });
+    app.get("/mcp", (context) => rejectMcpMethod(context));
+    app.delete("/mcp", (context) => rejectMcpMethod(context));
+    app.get("/mcp/tools", async (context) => context.json({ tools: (await loadMcpModule()).listMcpToolSummaries() }));
+    return app;
+}

package/src/server/api/policy-routes.d.ts

@@ -0,0 +1,13 @@
+import type { ActionPolicySnapshot } from "../../core/action-policy.ts";
+import type { IRuntimePolicyStore } from "../storage/runtime-policy-store.ts";
+import type { RuntimeTokenService } from "../storage/runtime-token-service.ts";
+import type { Context } from "hono";
+import { Hono } from "hono";
+export interface PolicyRoutesOptions {
+    runtimeTokens: RuntimeTokenService;
+    runtimePolicyStore: IRuntimePolicyStore;
+    deploymentPolicyRules: unknown;
+    getPolicySnapshot: (context: Context) => Promise<ActionPolicySnapshot>;
+}
+/** Runtime token management and runtime policy administration routes. */
+export declare function createPolicyRoutes({ runtimeTokens, runtimePolicyStore, deploymentPolicyRules, getPolicySnapshot, }: PolicyRoutesOptions): Hono;

package/src/server/api/policy-routes.js

@@ -0,0 +1,50 @@
+import { Hono } from "hono";
+import { optionalString } from "../../core/cast.js";
+import { summarizeRuntimeToken } from "../storage/runtime-token-service.js";
+import { jsonError, readJsonBody } from "./http-utils.js";
+import { policyRequestMaxBytes, readRuntimePolicyRules, readTokenPolicy } from "./policy-input.js";
+/** Runtime token management and runtime policy administration routes. */
+export function createPolicyRoutes({ runtimeTokens, runtimePolicyStore, deploymentPolicyRules, getPolicySnapshot, }) {
+    const app = new Hono();
+    app.get("/runtime-tokens", async (context) => context.json(await runtimeTokens.listTokens()));
+    app.post("/runtime-tokens", async (context) => {
+        const body = await readJsonBody(context, policyRequestMaxBytes);
+        const name = optionalString(body.name);
+        if (!name) {
+            return jsonError(context, 400, "invalid_input", "name is required.");
+        }
+        const created = await runtimeTokens.createToken(name, readTokenPolicy(body, true));
+        return context.json({
+            token: created.token,
+            record: summarizeRuntimeToken(created.record),
+        });
+    });
+    app.put("/runtime-tokens/:id", async (context) => {
+        const id = context.req.param("id");
+        const body = await readJsonBody(context, policyRequestMaxBytes);
+        const token = await runtimeTokens.updateTokenPolicy(id, readTokenPolicy(body));
+        return token
+            ? context.json(token)
+            : jsonError(context, 404, "runtime_token_not_found", `Runtime token not found: ${id}.`);
+    });
+    app.delete("/runtime-tokens/:id", async (context) => {
+        const id = context.req.param("id");
+        if (!(await runtimeTokens.revokeToken(id))) {
+            return jsonError(context, 404, "runtime_token_not_found", `Runtime token not found: ${id}.`);
+        }
+        return context.json({ id, revoked: true });
+    });
+    app.get("/runtime-policy", async (context) => context.json((await getPolicySnapshot(context)).state));
+    app.put("/runtime-policy", async (context) => {
+        const body = await readJsonBody(context, policyRequestMaxBytes);
+        const rules = readRuntimePolicyRules(body);
+        const updatedAt = new Date().toISOString();
+        await runtimePolicyStore.set({ rules, updatedAt });
+        return context.json({
+            deployment: deploymentPolicyRules,
+            runtime: rules,
+            updatedAt,
+        });
+    });
+    return app;
+}

package/src/server/api/policy-snapshot.d.ts

@@ -0,0 +1,14 @@
+import type { ActionPolicyService, ActionPolicySnapshot } from "../../core/action-policy.ts";
+import type { RuntimeLogger } from "../../core/types.ts";
+import type { IRuntimePolicyStore } from "../storage/runtime-policy-store.ts";
+import type { Context } from "hono";
+export interface PolicySnapshotProviderOptions {
+    actionPolicy: ActionPolicyService;
+    runtimePolicyStore: IRuntimePolicyStore;
+    logger?: RuntimeLogger;
+}
+export type PolicySnapshotProvider = (context: Context) => Promise<ActionPolicySnapshot>;
+/**
+ * Creates a request-scoped cached ActionPolicySnapshot provider backed by a WeakMap.
+ */
+export declare function createPolicySnapshotProvider({ actionPolicy, runtimePolicyStore, logger, }: PolicySnapshotProviderOptions): PolicySnapshotProvider;

package/src/server/api/policy-snapshot.js

@@ -0,0 +1,30 @@
+import { emptyPolicyRules } from "../../core/action-policy.js";
+import { readRuntimeGrant } from "./auth.js";
+/**
+ * Creates a request-scoped cached ActionPolicySnapshot provider backed by a WeakMap.
+ */
+export function createPolicySnapshotProvider({ actionPolicy, runtimePolicyStore, logger, }) {
+    const policySnapshots = new WeakMap();
+    async function loadPolicySnapshot(context) {
+        try {
+            const record = await runtimePolicyStore.get();
+            return actionPolicy.createSnapshot(record?.rules ?? emptyPolicyRules(), readRuntimeGrant(context), record?.updatedAt);
+        }
+        catch {
+            logger?.error({
+                method: context.req.method,
+                path: context.req.path,
+            }, "runtime policy load failed");
+            throw new Error("Runtime policy is unavailable.");
+        }
+    }
+    return (context) => {
+        const request = context.req.raw;
+        let snapshot = policySnapshots.get(request);
+        if (!snapshot) {
+            snapshot = loadPolicySnapshot(context);
+            policySnapshots.set(request, snapshot);
+        }
+        return snapshot;
+    };
+}

package/src/server/api/run-log-routes.d.ts

@@ -0,0 +1,7 @@
+import type { ActionRunner } from "../actions/action-runner.ts";
+import { Hono } from "hono";
+export interface RunLogRoutesOptions {
+    actions: ActionRunner;
+}
+/** Action execution run log query and inspection routes. */
+export declare function createRunLogRoutes({ actions }: RunLogRoutesOptions): Hono;