@zauso-ai/capstan-core 0.1.2

package/dist/server.js

@@ -0,0 +1,276 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { toJSONSchema } from "zod";
+import { createContext } from "./context.js";
+import { enforcePolicies } from "./policy.js";
+import { createApproval, getApproval, listApprovals, resolveApproval, } from "./approval.js";
+/**
+ * Build a RouteMetadata entry, omitting keys whose value would be undefined
+ * (required by exactOptionalPropertyTypes).
+ */
+function buildRouteMetadata(method, path, apiDef, inputSchema, outputSchema) {
+    const meta = { method, path };
+    if (apiDef.description !== undefined)
+        meta.description = apiDef.description;
+    if (apiDef.capability !== undefined)
+        meta.capability = apiDef.capability;
+    if (apiDef.resource !== undefined)
+        meta.resource = apiDef.resource;
+    if (apiDef.policy !== undefined)
+        meta.policy = apiDef.policy;
+    if (inputSchema !== undefined)
+        meta.inputSchema = inputSchema;
+    if (outputSchema !== undefined)
+        meta.outputSchema = outputSchema;
+    return meta;
+}
+/**
+ * Create a fully-wired Capstan application backed by a Hono server.
+ *
+ * The returned object contains:
+ * - `app`           -- Hono instance ready to handle requests
+ * - `routeRegistry` -- array of route metadata for the agent manifest
+ * - `registerAPI()` -- helper to register an API definition as an HTTP route
+ */
+export function createCapstanApp(config) {
+    const app = new Hono();
+    const routeRegistry = [];
+    /**
+     * Handler registry keyed by "METHOD /path" so that approved requests can
+     * re-execute the original handler without going through the HTTP stack.
+     */
+    const handlerRegistry = new Map();
+    // ------------------------------------------------------------------
+    // Global middleware
+    // ------------------------------------------------------------------
+    // CORS -- allow all origins by default (production apps override via config).
+    app.use("*", cors());
+    // Inject CapstanContext into every request so handlers can retrieve it.
+    app.use("*", async (c, next) => {
+        const ctx = createContext(c);
+        c.set("capstanCtx", ctx);
+        await next();
+    });
+    // ------------------------------------------------------------------
+    // registerAPI -- mount a route + track metadata
+    // ------------------------------------------------------------------
+    const registerAPI = (method, path, apiDef, policies) => {
+        // --- record metadata ------------------------------------------------
+        let inputSchema;
+        let outputSchema;
+        try {
+            if (apiDef.input) {
+                inputSchema = toJSONSchema(apiDef.input);
+            }
+        }
+        catch {
+            // Schema conversion is best-effort; silently ignore failures.
+        }
+        try {
+            if (apiDef.output) {
+                outputSchema = toJSONSchema(apiDef.output);
+            }
+        }
+        catch {
+            // Best-effort.
+        }
+        routeRegistry.push(buildRouteMetadata(method, path, apiDef, inputSchema, outputSchema));
+        // Store the handler so approved requests can re-execute it.
+        const routeKey = `${method} ${path}`;
+        handlerRegistry.set(routeKey, async (input, ctx) => {
+            return apiDef.handler({ input, ctx });
+        });
+        // --- mount on Hono --------------------------------------------------
+        const honoHandler = async (c) => {
+            const ctx = createContext(c);
+            // Policy enforcement
+            if (policies && policies.length > 0) {
+                let rawInput;
+                try {
+                    rawInput =
+                        method === "GET"
+                            ? Object.fromEntries(new URL(c.req.url).searchParams)
+                            : await c.req.json();
+                }
+                catch {
+                    rawInput = undefined;
+                }
+                const policyResult = await enforcePolicies(policies, ctx, rawInput);
+                if (policyResult.effect === "deny") {
+                    return c.json({ error: "Forbidden", reason: policyResult.reason ?? "Policy denied" }, 403);
+                }
+                if (policyResult.effect === "approve") {
+                    const reason = policyResult.reason ?? "This action requires approval";
+                    const approval = createApproval({
+                        method,
+                        path,
+                        input: rawInput,
+                        policy: policies.map((p) => p.key).join(", "),
+                        reason,
+                    });
+                    return c.json({
+                        status: "approval_required",
+                        approvalId: approval.id,
+                        reason,
+                        pollUrl: `/capstan/approvals/${approval.id}`,
+                    }, 202);
+                }
+            }
+            // Parse input
+            let input;
+            try {
+                if (method === "GET") {
+                    input = Object.fromEntries(new URL(c.req.url).searchParams);
+                }
+                else {
+                    const contentType = c.req.header("content-type") ?? "";
+                    if (contentType.includes("application/json")) {
+                        input = await c.req.json();
+                    }
+                    else {
+                        input = {};
+                    }
+                }
+            }
+            catch {
+                input = {};
+            }
+            // Run handler (which already includes input/output validation)
+            try {
+                const result = await apiDef.handler({ input, ctx });
+                return c.json(result);
+            }
+            catch (err) {
+                // Zod validation errors
+                if (err != null &&
+                    typeof err === "object" &&
+                    "issues" in err &&
+                    Array.isArray(err.issues)) {
+                    return c.json({
+                        error: "Validation Error",
+                        issues: err.issues,
+                    }, 400);
+                }
+                // Generic errors
+                const message = err instanceof Error ? err.message : "Internal Server Error";
+                return c.json({ error: message }, 500);
+            }
+        };
+        // Register the handler on the correct HTTP method.
+        const lowerMethod = method.toLowerCase();
+        app[lowerMethod](path, honoHandler);
+    };
+    // ------------------------------------------------------------------
+    // Approval management endpoints
+    // ------------------------------------------------------------------
+    /** List all approvals, optionally filtered by ?status=pending|approved|denied */
+    app.get("/capstan/approvals", (c) => {
+        const statusParam = new URL(c.req.url).searchParams.get("status");
+        const items = listApprovals(statusParam ?? undefined);
+        return c.json({ approvals: items });
+    });
+    /** Get a single approval by ID */
+    app.get("/capstan/approvals/:id", (c) => {
+        const id = c.req.param("id");
+        const approval = getApproval(id);
+        if (!approval) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        return c.json(approval);
+    });
+    /** Approve a pending approval — re-executes the original handler */
+    app.post("/capstan/approvals/:id/approve", async (c) => {
+        const id = c.req.param("id");
+        const existing = getApproval(id);
+        if (!existing) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        if (existing.status !== "pending") {
+            return c.json({ error: "Approval already resolved", status: existing.status }, 409);
+        }
+        // Parse optional body for resolvedBy
+        let resolvedBy;
+        try {
+            const body = await c.req.json();
+            if (typeof body.resolvedBy === "string") {
+                resolvedBy = body.resolvedBy;
+            }
+        }
+        catch {
+            // No body or invalid JSON — that's fine.
+        }
+        const approval = resolveApproval(id, "approved", resolvedBy);
+        if (!approval) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        // Re-execute the original handler with the stored input.
+        const routeKey = `${approval.method} ${approval.path}`;
+        const handler = handlerRegistry.get(routeKey);
+        if (!handler) {
+            return c.json({ error: "Handler not found for route", route: routeKey }, 500);
+        }
+        try {
+            // Build a synthetic context for the approver.
+            const ctx = createContext(c);
+            const result = await handler(approval.input, ctx);
+            approval.result = result;
+            return c.json({
+                status: "approved",
+                approvalId: approval.id,
+                result,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Handler execution failed";
+            return c.json({ error: message, approvalId: approval.id }, 500);
+        }
+    });
+    /** Deny a pending approval */
+    app.post("/capstan/approvals/:id/deny", async (c) => {
+        const id = c.req.param("id");
+        const existing = getApproval(id);
+        if (!existing) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        if (existing.status !== "pending") {
+            return c.json({ error: "Approval already resolved", status: existing.status }, 409);
+        }
+        let resolvedBy;
+        let reason;
+        try {
+            const body = await c.req.json();
+            if (typeof body.resolvedBy === "string") {
+                resolvedBy = body.resolvedBy;
+            }
+            if (typeof body.reason === "string") {
+                reason = body.reason;
+            }
+        }
+        catch {
+            // No body or invalid JSON — that's fine.
+        }
+        const approval = resolveApproval(id, "denied", resolvedBy);
+        if (!approval) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        return c.json({
+            status: "denied",
+            approvalId: approval.id,
+            ...(reason !== undefined ? { reason } : {}),
+        });
+    });
+    // ------------------------------------------------------------------
+    // Agent manifest endpoint
+    // ------------------------------------------------------------------
+    app.get("/.well-known/capstan.json", (c) => {
+        const manifest = {
+            name: config.app?.name ?? "capstan-app",
+            title: config.app?.title ?? config.app?.name ?? "Capstan App",
+            description: config.app?.description ?? "",
+            routes: routeRegistry,
+        };
+        return c.json(manifest);
+    });
+    return { app, routeRegistry, registerAPI };
+}
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAC;AAoCvB;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAkB,EAClB,IAAY,EACZ,MAAqB,EACrB,WAAgD,EAChD,YAAiD;IAEjD,MAAM,IAAI,GAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,IAAI,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAc,CAAC;IACnC,MAAM,aAAa,GAAoB,EAAE,CAAC;IAE1C;;;OAGG;IACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAG5B,CAAC;IAEJ,qEAAqE;IACrE,oBAAoB;IACpB,qEAAqE;IAErE,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAErB,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,gDAAgD;IAChD,qEAAqE;IAErE,MAAM,WAAW,GAA8B,CAC7C,MAAM,EACN,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,EAAE;QACF,uEAAuE;QACvE,IAAI,WAAgD,CAAC;QACrD,IAAI,YAAiD,CAAC;QAEtD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;YACtE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,aAAa,CAAC,IAAI,CAChB,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CACpE,CAAC;QAEF,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QACrC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAc,EAAE,GAAmB,EAAE,EAAE;YAC1E,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,MAAM,WAAW,GAAG,KAAK,EAAE,CAA0B,EAAE,EAAE;YACvD,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;YAEvD,qBAAqB;YACrB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,IAAI,QAAiB,CAAC;gBACtB,IAAI,CAAC;oBACH,QAAQ;wBACN,MAAM,KAAK,KAAK;4BACd,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;4BACrD,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACpE,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EACtE,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACtC,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,IAAI,+BAA+B,CAAC;oBACzD,MAAM,QAAQ,GAAG,cAAc,CAAC;wBAC9B,MAAM;wBACN,IAAI;wBACJ,KAAK,EAAE,QAAQ;wBACf,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC7C,MAAM;qBACP,CAAC,CAAC;oBACH,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,UAAU,EAAE,QAAQ,CAAC,EAAE;wBACvB,MAAM;wBACN,OAAO,EAAE,sBAAsB,QAAQ,CAAC,EAAE,EAAE;qBAC7C,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,cAAc;YACd,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;oBACvD,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;wBAC7C,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC7B,CAAC;yBAAM,CAAC;wBACN,KAAK,GAAG,EAAE,CAAC;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;YAED,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,wBAAwB;gBACxB,IACE,GAAG,IAAI,IAAI;oBACX,OAAO,GAAG,KAAK,QAAQ;oBACvB,QAAQ,IAAI,GAAG;oBACf,KAAK,CAAC,OAAO,CAAE,GAA6B,CAAC,MAAM,CAAC,EACpD,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE,kBAAkB;wBACzB,MAAM,EAAG,GAA6B,CAAC,MAAM;qBAC9C,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC;QAEF,mDAAmD;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAK3B,CAAC;QACX,GAAG,CAAC,WAAW,CAAyD,CACvE,IAAI,EACJ,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC;IAEF,qEAAqE;IACrE,gCAAgC;IAChC,qEAAqE;IAErE,iFAAiF;IACjF,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAIxD,CAAC;QACT,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAA6B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACxC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,yDAAyD;QACzD,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,EACzD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,8CAA8C;YAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClD,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,UAA8B,CAAC;QACnC,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAA6B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACxC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,0BAA0B;IAC1B,qEAAqE;IAErE,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa;YACvC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa;YAC7D,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE;YAC1C,MAAM,EAAE,aAAa;SACtB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,112 @@
+import type { Context as HonoContext } from "hono";
+import type { z } from "zod";
+/** Authentication context attached to every request. */
+export interface CapstanAuthContext {
+    isAuthenticated: boolean;
+    type: "human" | "agent" | "anonymous";
+    userId?: string;
+    role?: string;
+    email?: string;
+    agentId?: string;
+    agentName?: string;
+    permissions?: string[];
+}
+/** Per-request context threaded through handlers, middleware, and policies. */
+export interface CapstanContext {
+    auth: CapstanAuthContext;
+    request: Request;
+    env: Record<string, string | undefined>;
+    honoCtx: HonoContext;
+}
+export type HttpMethod = "GET" | "POST" | "PUT" | "DELETE" | "PATCH";
+/** The argument bag passed to an API handler. */
+export interface APIHandlerInput<T = unknown> {
+    input: T;
+    ctx: CapstanContext;
+}
+/** Full definition object for a single API route. */
+export interface APIDefinition<TInput = unknown, TOutput = unknown> {
+    input?: z.ZodType<TInput>;
+    output?: z.ZodType<TOutput>;
+    description?: string;
+    capability?: "read" | "write" | "external";
+    resource?: string;
+    policy?: string;
+    handler: (args: APIHandlerInput<TInput>) => Promise<TOutput>;
+}
+/** Definition object for middleware. */
+export interface MiddlewareDefinition {
+    name?: string;
+    handler: (args: {
+        request: Request;
+        ctx: CapstanContext;
+        next: () => Promise<Response>;
+    }) => Promise<Response>;
+}
+export type PolicyEffect = "allow" | "deny" | "approve" | "redact";
+/** Result of evaluating a single policy. */
+export interface PolicyCheckResult {
+    effect: PolicyEffect;
+    reason?: string;
+}
+/** Definition object for a named permission policy. */
+export interface PolicyDefinition {
+    key: string;
+    title: string;
+    effect: PolicyEffect;
+    check: (args: {
+        ctx: CapstanContext;
+        input?: unknown;
+    }) => Promise<PolicyCheckResult>;
+}
+/** App-level configuration for a Capstan application. */
+export interface CapstanConfig {
+    app?: {
+        name?: string;
+        title?: string;
+        description?: string;
+    };
+    database?: {
+        provider?: "sqlite" | "postgres" | "mysql";
+        url?: string;
+    };
+    auth?: {
+        providers?: Array<{
+            type: string;
+            [key: string]: unknown;
+        }>;
+        session?: {
+            strategy?: "jwt" | "database";
+            secret?: string;
+            maxAge?: string;
+        };
+    };
+    agent?: {
+        manifest?: boolean;
+        mcp?: boolean;
+        openapi?: boolean;
+        rateLimit?: {
+            default?: {
+                requests: number;
+                window: string;
+            };
+            perAgent?: boolean;
+        };
+    };
+    server?: {
+        port?: number;
+        host?: string;
+    };
+}
+/** Route metadata for the agent manifest system. */
+export interface RouteMetadata {
+    method: HttpMethod;
+    path: string;
+    description?: string;
+    capability?: "read" | "write" | "external";
+    resource?: string;
+    policy?: string;
+    inputSchema?: Record<string, unknown>;
+    outputSchema?: Record<string, unknown>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,MAAM,CAAC;AACnD,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B,wDAAwD;AACxD,MAAM,WAAW,kBAAkB;IACjC,eAAe,EAAE,OAAO,CAAC;IACzB,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACxC,OAAO,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAErE,iDAAiD;AACjD,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,KAAK,EAAE,CAAC,CAAC;IACT,GAAG,EAAE,cAAc,CAAC;CACrB;AAED,qDAAqD;AACrD,MAAM,WAAW,aAAa,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO;IAChE,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,CAAC,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9D;AAED,wCAAwC;AACxC,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,IAAI,EAAE;QACd,OAAO,EAAE,OAAO,CAAC;QACjB,GAAG,EAAE,cAAc,CAAC;QACpB,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;KAC/B,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACzB;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEnE,4CAA4C;AAC5C,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,CAAC,IAAI,EAAE;QACZ,GAAG,EAAE,cAAc,CAAC;QACpB,KAAK,CAAC,EAAE,OAAO,CAAC;KACjB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAClC;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,EAAE;QACJ,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,OAAO,CAAC;QAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;SAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,EAAE;YACR,QAAQ,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;YAC9B,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;KACH,CAAC;IACF,KAAK,CAAC,EAAE;QACN,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,GAAG,CAAC,EAAE,OAAO,CAAC;QACd,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,SAAS,CAAC,EAAE;YACV,OAAO,CAAC,EAAE;gBAAE,QAAQ,EAAE,MAAM,CAAC;gBAAC,MAAM,EAAE,MAAM,CAAA;aAAE,CAAC;YAC/C,QAAQ,CAAC,EAAE,OAAO,CAAC;SACpB,CAAC;KACH,CAAC;IACF,MAAM,CAAC,EAAE;QACP,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,oDAAoD;AACpD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,UAAU,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,UAAU,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/verify.d.ts

@@ -0,0 +1,57 @@
+export interface VerifyDiagnostic {
+    code: string;
+    severity: "error" | "warning" | "info";
+    message: string;
+    hint?: string;
+    file?: string;
+    line?: number;
+    column?: number;
+    fixCategory?: "type_error" | "schema_mismatch" | "missing_file" | "policy_violation" | "contract_drift" | "missing_export";
+    autoFixable?: boolean;
+}
+export interface VerifyStep {
+    name: string;
+    status: "passed" | "failed" | "skipped";
+    durationMs: number;
+    diagnostics: VerifyDiagnostic[];
+}
+export interface VerifyReport {
+    status: "passed" | "failed";
+    appRoot: string;
+    timestamp: string;
+    steps: VerifyStep[];
+    repairChecklist: Array<{
+        index: number;
+        step: string;
+        message: string;
+        file?: string;
+        line?: number;
+        hint?: string;
+        fixCategory?: string;
+        autoFixable?: boolean;
+    }>;
+    summary: {
+        totalSteps: number;
+        passedSteps: number;
+        failedSteps: number;
+        skippedSteps: number;
+        errorCount: number;
+        warningCount: number;
+    };
+}
+/**
+ * Verify a Capstan runtime application.
+ *
+ * Runs a cascade of checks: structure -> config -> routes -> models ->
+ * typecheck -> contracts -> manifest. If an early step fails, dependent
+ * steps are skipped. Returns a structured VerifyReport suitable for both
+ * human display and AI agent consumption.
+ */
+export declare function verifyCapstanApp(appRoot: string): Promise<VerifyReport>;
+/**
+ * Render a VerifyReport as human-readable text output.
+ *
+ * Uses simple ASCII indicators: check mark for pass, x for fail, dash for skip.
+ */
+export declare function renderRuntimeVerifyText(report: VerifyReport): string;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EACR,YAAY,GACZ,iBAAiB,GACjB,cAAc,GACd,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,gBAAgB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,eAAe,EAAE,KAAK,CAAC;QACrB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,CAAC,CAAC;IACH,OAAO,EAAE;QACP,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;KACtB,CAAC;CACH;AAuyBD;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAuE7E;AAMD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CA4CpE"}