@zauso-ai/capstan-core 0.2.0 → 1.0.0-beta.2

package/dist/api.d.ts

@@ -16,4 +16,12 @@ export declare function defineAPI<TInput = unknown, TOutput = unknown>(def: APID
  * Primarily consumed by `createCapstanApp` when building route metadata.
  */
 export declare function getAPIRegistry(): ReadonlyArray<APIDefinition>;
+/**
+ * Clear all entries from the global API registry.
+ *
+ * This should be called at the start of `createCapstanApp` or between test
+ * cases to prevent stale definitions from leaking across app instances,
+ * hot-reload cycles, or test runs.
+ */
+export declare function clearAPIRegistry(): void;
 //# sourceMappingURL=api.d.ts.map

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAGd,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EAC3D,GAAG,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAiChC;AAQD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,aAAa,CAAC,aAAa,CAAC,CAE7D"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAGd,MAAM,YAAY,CAAC;AAEpB;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,MAAM,GAAG,OAAO,EAAE,OAAO,GAAG,OAAO,EAC3D,GAAG,EAAE,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,GAClC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAiChC;AAQD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,aAAa,CAAC,aAAa,CAAC,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC"}

package/dist/api.js

@@ -46,4 +46,14 @@ const apiRegistry = [];
 export function getAPIRegistry() {
     return apiRegistry;
 }
+/**
+ * Clear all entries from the global API registry.
+ *
+ * This should be called at the start of `createCapstanApp` or between test
+ * cases to prevent stale definitions from leaking across app instances,
+ * hot-reload cycles, or test runs.
+ */
+export function clearAPIRegistry() {
+    apiRegistry.length = 0;
+}
 //# sourceMappingURL=api.js.map

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CACvB,GAAmC;IAEnC,MAAM,cAAc,GAAG,KAAK,EAC1B,IAA6B,EACX,EAAE;QACpB,yEAAyE;QACzE,IAAI,cAAc,GAAW,IAAI,CAAC,KAAK,CAAC;QACxC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAW,CAAC;QACzD,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;YAC/B,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QAEH,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;QAC7C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAmC;QAC9C,GAAG,GAAG;QACN,OAAO,EAAE,cAAc;KACxB,CAAC;IAEF,8BAA8B;IAC9B,WAAW,CAAC,IAAI,CAAC,OAAwB,CAAC,CAAC;IAE3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAE9E,MAAM,WAAW,GAAoB,EAAE,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;GAUG;AACH,MAAM,UAAU,SAAS,CACvB,GAAmC;IAEnC,MAAM,cAAc,GAAG,KAAK,EAC1B,IAA6B,EACX,EAAE;QACpB,yEAAyE;QACzE,IAAI,cAAc,GAAW,IAAI,CAAC,KAAK,CAAC;QACxC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,cAAc,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAW,CAAC;QACzD,CAAC;QAED,yEAAyE;QACzE,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC;YAC/B,KAAK,EAAE,cAAc;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC,CAAC;QAEH,yEAAyE;QACzE,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAY,CAAC;QAC7C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,OAAO,GAAmC;QAC9C,GAAG,GAAG;QACN,OAAO,EAAE,cAAc;KACxB,CAAC;IAEF,8BAA8B;IAC9B,WAAW,CAAC,IAAI,CAAC,OAAwB,CAAC,CAAC;IAE3C,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAE9E,MAAM,WAAW,GAAoB,EAAE,CAAC;AAExC;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;AACzB,CAAC"}

package/dist/approval-routes.d.ts

@@ -0,0 +1,21 @@
+import type { Hono } from "hono";
+import type { CapstanContext } from "./types.js";
+/**
+ * Handler registry type shared between the production and dev servers.
+ * Maps "METHOD /path" keys to functions that re-execute a route handler
+ * with the stored approval input.
+ */
+export type HandlerRegistry = Map<string, (input: unknown, ctx: CapstanContext) => Promise<unknown>>;
+/**
+ * Mount the approval management endpoints on a Hono app.
+ *
+ * These routes allow agents and humans to list, approve, and deny pending
+ * approvals created by policy enforcement.  The `handlerRegistry` is used
+ * by the "approve" endpoint to re-execute the original handler once an
+ * approval has been granted.
+ *
+ * Both `createCapstanApp` (production) and the dev server call this
+ * function so the logic lives in one place.
+ */
+export declare function mountApprovalRoutes(app: Hono<any>, handlerRegistry: HandlerRegistry): void;
+//# sourceMappingURL=approval-routes.d.ts.map

package/dist/approval-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-routes.d.ts","sourceRoot":"","sources":["../src/approval-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAA0B,MAAM,MAAM,CAAC;AAOzD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,GAAG,CAC/B,MAAM,EACN,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAC1D,CAAC;AAEF;;;;;;;;;;GAUG;AAEH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,eAAe,EAAE,eAAe,GAAG,IAAI,CAqH1F"}

package/dist/approval-routes.js

@@ -0,0 +1,112 @@
+import { createContext } from "./context.js";
+import { getApproval, listApprovals, resolveApproval, } from "./approval.js";
+/**
+ * Mount the approval management endpoints on a Hono app.
+ *
+ * These routes allow agents and humans to list, approve, and deny pending
+ * approvals created by policy enforcement.  The `handlerRegistry` is used
+ * by the "approve" endpoint to re-execute the original handler once an
+ * approval has been granted.
+ *
+ * Both `createCapstanApp` (production) and the dev server call this
+ * function so the logic lives in one place.
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function mountApprovalRoutes(app, handlerRegistry) {
+    /** List all approvals, optionally filtered by ?status=pending|approved|denied */
+    app.get("/capstan/approvals", (c) => {
+        const statusParam = new URL(c.req.url).searchParams.get("status");
+        const items = listApprovals(statusParam ?? undefined);
+        return c.json({ approvals: items });
+    });
+    /** Get a single approval by ID */
+    app.get("/capstan/approvals/:id", (c) => {
+        const id = c.req.param("id");
+        const approval = getApproval(id);
+        if (!approval) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        return c.json(approval);
+    });
+    /** Approve a pending approval -- re-executes the original handler */
+    app.post("/capstan/approvals/:id/approve", async (c) => {
+        const id = c.req.param("id");
+        const existing = getApproval(id);
+        if (!existing) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        if (existing.status !== "pending") {
+            return c.json({ error: "Approval already resolved", status: existing.status }, 409);
+        }
+        // Parse optional body for resolvedBy
+        let resolvedBy;
+        try {
+            const body = await c.req.json();
+            if (typeof body.resolvedBy === "string") {
+                resolvedBy = body.resolvedBy;
+            }
+        }
+        catch {
+            // No body or invalid JSON -- that's fine.
+        }
+        const approval = resolveApproval(id, "approved", resolvedBy);
+        if (!approval) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        // Re-execute the original handler with the stored input.
+        const routeKey = `${approval.method} ${approval.path}`;
+        const handler = handlerRegistry.get(routeKey);
+        if (!handler) {
+            return c.json({ error: "Handler not found for route", route: routeKey }, 500);
+        }
+        try {
+            const ctx = createContext(c);
+            const result = await handler(approval.input, ctx);
+            approval.result = result;
+            return c.json({
+                status: "approved",
+                approvalId: approval.id,
+                result,
+            });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Handler execution failed";
+            return c.json({ error: message, approvalId: approval.id }, 500);
+        }
+    });
+    /** Deny a pending approval */
+    app.post("/capstan/approvals/:id/deny", async (c) => {
+        const id = c.req.param("id");
+        const existing = getApproval(id);
+        if (!existing) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        if (existing.status !== "pending") {
+            return c.json({ error: "Approval already resolved", status: existing.status }, 409);
+        }
+        let resolvedBy;
+        let reason;
+        try {
+            const body = await c.req.json();
+            if (typeof body.resolvedBy === "string") {
+                resolvedBy = body.resolvedBy;
+            }
+            if (typeof body.reason === "string") {
+                reason = body.reason;
+            }
+        }
+        catch {
+            // No body or invalid JSON -- that's fine.
+        }
+        const approval = resolveApproval(id, "denied", resolvedBy);
+        if (!approval) {
+            return c.json({ error: "Approval not found" }, 404);
+        }
+        return c.json({
+            status: "denied",
+            approvalId: approval.id,
+            ...(reason !== undefined ? { reason } : {}),
+        });
+    });
+}
+//# sourceMappingURL=approval-routes.js.map

package/dist/approval-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval-routes.js","sourceRoot":"","sources":["../src/approval-routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAC;AAavB;;;;;;;;;;GAUG;AACH,8DAA8D;AAC9D,MAAM,UAAU,mBAAmB,CAAC,GAAc,EAAE,eAAgC;IAClF,iFAAiF;IACjF,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAc,EAAE,EAAE;QAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAIxD,CAAC;QACT,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAc,EAAE,EAAE;QACnD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAc,EAAE,EAAE;QAClE,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAA6B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACxC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,yDAAyD;QACzD,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,EACzD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClD,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAc,EAAE,EAAE;QAC/D,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,UAA8B,CAAC;QACnC,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAA6B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACxC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,18 @@
+import type { Context, Next } from "hono";
+/**
+ * Create a Hono middleware that enforces Double Submit Cookie CSRF protection.
+ *
+ * **GET / HEAD / OPTIONS** requests:
+ * - A fresh CSRF token is generated, set as the `__csrf` cookie
+ *   (`HttpOnly=false` so client-side JS can read it), and echoed in the
+ *   `X-CSRF-Token` response header.
+ *
+ * **POST / PUT / DELETE / PATCH** requests:
+ * - The middleware verifies that the `X-CSRF-Token` request header matches
+ *   the `__csrf` cookie. On mismatch (or either value missing) the request
+ *   is rejected with a `403` response.
+ * - Requests that carry a `Bearer` token in the `Authorization` header are
+ *   **exempt** from CSRF checks because they are not cookie-based.
+ */
+export declare function csrfProtection(): (c: Context, next: Next) => Promise<Response | void>;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAoC1C;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,cAAc,KACd,GAAG,OAAO,EAAE,MAAM,IAAI,KAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CA4ChE"}

package/dist/csrf.js

@@ -0,0 +1,80 @@
+import { randomBytes } from "node:crypto";
+// ---------------------------------------------------------------------------
+// CSRF Protection Middleware (Double Submit Cookie)
+// ---------------------------------------------------------------------------
+const CSRF_COOKIE_NAME = "__csrf";
+const CSRF_HEADER_NAME = "X-CSRF-Token";
+const STATE_CHANGING_METHODS = new Set(["POST", "PUT", "DELETE", "PATCH"]);
+/**
+ * Generate a cryptographically random CSRF token (32 hex characters).
+ */
+function generateCsrfToken() {
+    return randomBytes(16).toString("hex");
+}
+/**
+ * Parse cookies from a `Cookie` header string and return the value for the
+ * given cookie name, or `undefined` if not found.
+ */
+function getCookieValue(cookieHeader, name) {
+    if (!cookieHeader)
+        return undefined;
+    for (const pair of cookieHeader.split(";")) {
+        const eqIndex = pair.indexOf("=");
+        if (eqIndex === -1)
+            continue;
+        const key = pair.slice(0, eqIndex).trim();
+        const value = pair.slice(eqIndex + 1).trim();
+        if (key === name)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Create a Hono middleware that enforces Double Submit Cookie CSRF protection.
+ *
+ * **GET / HEAD / OPTIONS** requests:
+ * - A fresh CSRF token is generated, set as the `__csrf` cookie
+ *   (`HttpOnly=false` so client-side JS can read it), and echoed in the
+ *   `X-CSRF-Token` response header.
+ *
+ * **POST / PUT / DELETE / PATCH** requests:
+ * - The middleware verifies that the `X-CSRF-Token` request header matches
+ *   the `__csrf` cookie. On mismatch (or either value missing) the request
+ *   is rejected with a `403` response.
+ * - Requests that carry a `Bearer` token in the `Authorization` header are
+ *   **exempt** from CSRF checks because they are not cookie-based.
+ */
+export function csrfProtection() {
+    return async (c, next) => {
+        const method = c.req.method.toUpperCase();
+        // Requests authenticated via Bearer token skip CSRF — they are not
+        // vulnerable to cross-site request forgery because the token is not
+        // sent automatically by the browser.
+        const authHeader = c.req.header("authorization");
+        if (authHeader && authHeader.startsWith("Bearer ")) {
+            await next();
+            return;
+        }
+        if (STATE_CHANGING_METHODS.has(method)) {
+            // --- Validate CSRF token on state-changing requests ---
+            const cookieToken = getCookieValue(c.req.header("cookie"), CSRF_COOKIE_NAME);
+            const headerToken = c.req.header(CSRF_HEADER_NAME);
+            if (!cookieToken ||
+                !headerToken ||
+                cookieToken !== headerToken) {
+                return c.json({ error: "CSRF token mismatch" }, 403);
+            }
+            await next();
+        }
+        else {
+            // --- Issue a fresh token on safe requests ---
+            const token = generateCsrfToken();
+            await next();
+            // Set the cookie and header after downstream handlers have run so that
+            // the response object already exists.
+            c.header(CSRF_HEADER_NAME, token);
+            c.header("Set-Cookie", `${CSRF_COOKIE_NAME}=${token}; Path=/; SameSite=Lax`);
+        }
+    };
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,8EAA8E;AAC9E,oDAAoD;AACpD,8EAA8E;AAE9E,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAClC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AACxC,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAE3E;;GAEG;AACH,SAAS,iBAAiB;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CACrB,YAAuC,EACvC,IAAY;IAEZ,IAAI,CAAC,YAAY;QAAE,OAAO,SAAS,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAA4B,EAAE;QAChE,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAE1C,mEAAmE;QACnE,oEAAoE;QACpE,qCAAqC;QACrC,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,yDAAyD;YACzD,MAAM,WAAW,GAAG,cAAc,CAChC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EACtB,gBAAgB,CACjB,CAAC;YACF,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAEnD,IACE,CAAC,WAAW;gBACZ,CAAC,WAAW;gBACZ,WAAW,KAAK,WAAW,EAC3B,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,EAAE,GAAG,CAAC,CAAC;YACvD,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;YAElC,MAAM,IAAI,EAAE,CAAC;YAEb,uEAAuE;YACvE,sCAAsC;YACtC,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC,CAAC,MAAM,CACN,YAAY,EACZ,GAAG,gBAAgB,IAAI,KAAK,wBAAwB,CACrD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,13 +1,17 @@
-export { defineAPI, getAPIRegistry } from "./api.js";
+export { defineAPI, getAPIRegistry, clearAPIRegistry } from "./api.js";
 export { defineMiddleware } from "./middleware.js";
+export { csrfProtection } from "./csrf.js";
 export { definePolicy, enforcePolicies } from "./policy.js";
 export { defineConfig, env } from "./config.js";
 export { createCapstanApp } from "./server.js";
 export { createContext } from "./context.js";
 export { createApproval, getApproval, listApprovals, resolveApproval, clearApprovals, } from "./approval.js";
+export { mountApprovalRoutes } from "./approval-routes.js";
+export type { HandlerRegistry } from "./approval-routes.js";
 export type { PendingApproval } from "./approval.js";
 export type { CapstanApp } from "./server.js";
 export type { APIDefinition, APIHandlerInput, CapstanAuthContext, CapstanConfig, CapstanContext, HttpMethod, MiddlewareDefinition, PolicyCheckResult, PolicyDefinition, PolicyEffect, RouteMetadata, } from "./types.js";
+export { createRequestLogger } from "./logger.js";
 export { verifyCapstanApp, renderRuntimeVerifyText } from "./verify.js";
 export type { VerifyReport, VerifyDiagnostic, VerifyStep } from "./verify.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AAEvB,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACxE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE5D,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,YAAY,EACV,aAAa,EACb,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,UAAU,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,YAAY,EACZ,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACxE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -1,10 +1,13 @@
 // Public API ----------------------------------------------------------------
-export { defineAPI, getAPIRegistry } from "./api.js";
+export { defineAPI, getAPIRegistry, clearAPIRegistry } from "./api.js";
 export { defineMiddleware } from "./middleware.js";
+export { csrfProtection } from "./csrf.js";
 export { definePolicy, enforcePolicies } from "./policy.js";
 export { defineConfig, env } from "./config.js";
 export { createCapstanApp } from "./server.js";
 export { createContext } from "./context.js";
 export { createApproval, getApproval, listApprovals, resolveApproval, clearApprovals, } from "./approval.js";
+export { mountApprovalRoutes } from "./approval-routes.js";
+export { createRequestLogger } from "./logger.js";
 export { verifyCapstanApp, renderRuntimeVerifyText } from "./verify.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AAoBvB,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAqB3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,14 @@
+import type { MiddlewareHandler } from "hono";
+/**
+ * Create Hono middleware that logs structured JSON lines for every HTTP
+ * request.  Each request receives a unique ID set as the `X-Request-Id`
+ * response header.
+ *
+ * The logger respects the `LOG_LEVEL` environment variable:
+ * - `debug`  -- log request start + completion
+ * - `info`   -- log request completion only (default)
+ * - `warn`   -- only log 4xx/5xx responses
+ * - `error`  -- only log 5xx responses
+ */
+export declare function createRequestLogger(): MiddlewareHandler;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAuEvD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,iBAAiB,CAwCvD"}

package/dist/logger.js

@@ -0,0 +1,81 @@
+const LOG_LEVEL_RANK = {
+    debug: 0,
+    info: 1,
+    warn: 2,
+    error: 3,
+};
+function resolveLogLevel() {
+    const raw = (process.env["LOG_LEVEL"] ?? "info").toLowerCase();
+    if (raw in LOG_LEVEL_RANK) {
+        return raw;
+    }
+    return "info";
+}
+// ---------------------------------------------------------------------------
+// Request ID
+// ---------------------------------------------------------------------------
+function generateRequestId() {
+    return crypto.randomUUID();
+}
+function shouldLogCompletion(level, status) {
+    switch (level) {
+        case "debug":
+        case "info":
+            return true;
+        case "warn":
+            return status >= 400;
+        case "error":
+            return status >= 500;
+    }
+}
+// ---------------------------------------------------------------------------
+// createRequestLogger
+// ---------------------------------------------------------------------------
+/**
+ * Create Hono middleware that logs structured JSON lines for every HTTP
+ * request.  Each request receives a unique ID set as the `X-Request-Id`
+ * response header.
+ *
+ * The logger respects the `LOG_LEVEL` environment variable:
+ * - `debug`  -- log request start + completion
+ * - `info`   -- log request completion only (default)
+ * - `warn`   -- only log 4xx/5xx responses
+ * - `error`  -- only log 5xx responses
+ */
+export function createRequestLogger() {
+    return async (c, next) => {
+        const level = resolveLogLevel();
+        const reqId = generateRequestId();
+        const method = c.req.method;
+        const path = c.req.path;
+        const start = performance.now();
+        // Set the request ID header early so downstream middleware can read it.
+        c.header("X-Request-Id", reqId);
+        // debug: log request start
+        if (level === "debug") {
+            const entry = {
+                ts: new Date().toISOString(),
+                reqId,
+                method,
+                path,
+                event: "start",
+            };
+            console.log(JSON.stringify(entry));
+        }
+        await next();
+        const ms = Math.round(performance.now() - start);
+        const status = c.res.status;
+        if (shouldLogCompletion(level, status)) {
+            const entry = {
+                ts: new Date().toISOString(),
+                reqId,
+                method,
+                path,
+                status,
+                ms,
+            };
+            console.log(JSON.stringify(entry));
+        }
+    };
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAQA,MAAM,cAAc,GAA6B;IAC/C,KAAK,EAAE,CAAC;IACR,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;CACT,CAAC;AAEF,SAAS,eAAe;IACtB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/D,IAAI,GAAG,IAAI,cAAc,EAAE,CAAC;QAC1B,OAAO,GAAe,CAAC;IACzB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E,SAAS,iBAAiB;IACxB,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;AAC7B,CAAC;AAuBD,SAAS,mBAAmB,CAC1B,KAAe,EACf,MAAc;IAEd,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,IAAI,CAAC;QACd,KAAK,MAAM;YACT,OAAO,MAAM,IAAI,GAAG,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,MAAM,IAAI,GAAG,CAAC;IACzB,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAyB,EAAE,EAAE;QACrD,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEhC,wEAAwE;QACxE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAEhC,2BAA2B;QAC3B,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,MAAM,KAAK,GAAyB;gBAClC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,KAAK;gBACL,MAAM;gBACN,IAAI;gBACJ,KAAK,EAAE,OAAO;aACf,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;QAEb,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;QAE5B,IAAI,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;YACvC,MAAM,KAAK,GAAoB;gBAC7B,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAC5B,KAAK;gBACL,MAAM;gBACN,IAAI;gBACJ,MAAM;gBACN,EAAE;aACH,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAY5B,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,2EAA2E;AAC3E,UAAU,UAAU;IAClB,SAAS,EAAE;QACT,UAAU,EAAE,cAAc,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,2EAA2E;IAC3E,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,CACX,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAAE,KAC1B,IAAI,CAAC;CACX;AAuBD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAmTlE"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAS5B,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EACb,cAAc,EACd,UAAU,EACV,gBAAgB,EAChB,aAAa,EACd,MAAM,YAAY,CAAC;AAEpB,2EAA2E;AAC3E,UAAU,UAAU;IAClB,SAAS,EAAE;QACT,UAAU,EAAE,cAAc,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,UAAU;IACzB,gDAAgD;IAChD,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACtB,2EAA2E;IAC3E,aAAa,EAAE,aAAa,EAAE,CAAC;IAC/B;;;;;OAKG;IACH,WAAW,EAAE,CACX,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,EACrB,QAAQ,CAAC,EAAE,gBAAgB,EAAE,KAC1B,IAAI,CAAC;CACX;AAuBD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,UAAU,CAmMlE"}

package/dist/server.js

@@ -1,9 +1,11 @@
 import { Hono } from "hono";
 import { cors } from "hono/cors";
 import { toJSONSchema } from "zod";
+import { clearAPIRegistry } from "./api.js";
 import { createContext } from "./context.js";
 import { enforcePolicies } from "./policy.js";
-import { createApproval, getApproval, listApprovals, resolveApproval, } from "./approval.js";
+import { createApproval } from "./approval.js";
+import { mountApprovalRoutes } from "./approval-routes.js";
 /**
  * Build a RouteMetadata entry, omitting keys whose value would be undefined
  * (required by exactOptionalPropertyTypes).
@@ -33,6 +35,9 @@ function buildRouteMetadata(method, path, apiDef, inputSchema, outputSchema) {
  * - `registerAPI()` -- helper to register an API definition as an HTTP route
  */
 export function createCapstanApp(config) {
+    // Reset the global API registry so that previous app instances (e.g. from
+    // hot reload or prior test cases) don't leak stale definitions.
+    clearAPIRegistry();
     const app = new Hono();
     const routeRegistry = [];
     /**
@@ -163,102 +168,7 @@ export function createCapstanApp(config) {
     // ------------------------------------------------------------------
     // Approval management endpoints
     // ------------------------------------------------------------------
-    /** List all approvals, optionally filtered by ?status=pending|approved|denied */
-    app.get("/capstan/approvals", (c) => {
-        const statusParam = new URL(c.req.url).searchParams.get("status");
-        const items = listApprovals(statusParam ?? undefined);
-        return c.json({ approvals: items });
-    });
-    /** Get a single approval by ID */
-    app.get("/capstan/approvals/:id", (c) => {
-        const id = c.req.param("id");
-        const approval = getApproval(id);
-        if (!approval) {
-            return c.json({ error: "Approval not found" }, 404);
-        }
-        return c.json(approval);
-    });
-    /** Approve a pending approval — re-executes the original handler */
-    app.post("/capstan/approvals/:id/approve", async (c) => {
-        const id = c.req.param("id");
-        const existing = getApproval(id);
-        if (!existing) {
-            return c.json({ error: "Approval not found" }, 404);
-        }
-        if (existing.status !== "pending") {
-            return c.json({ error: "Approval already resolved", status: existing.status }, 409);
-        }
-        // Parse optional body for resolvedBy
-        let resolvedBy;
-        try {
-            const body = await c.req.json();
-            if (typeof body.resolvedBy === "string") {
-                resolvedBy = body.resolvedBy;
-            }
-        }
-        catch {
-            // No body or invalid JSON — that's fine.
-        }
-        const approval = resolveApproval(id, "approved", resolvedBy);
-        if (!approval) {
-            return c.json({ error: "Approval not found" }, 404);
-        }
-        // Re-execute the original handler with the stored input.
-        const routeKey = `${approval.method} ${approval.path}`;
-        const handler = handlerRegistry.get(routeKey);
-        if (!handler) {
-            return c.json({ error: "Handler not found for route", route: routeKey }, 500);
-        }
-        try {
-            // Build a synthetic context for the approver.
-            const ctx = createContext(c);
-            const result = await handler(approval.input, ctx);
-            approval.result = result;
-            return c.json({
-                status: "approved",
-                approvalId: approval.id,
-                result,
-            });
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : "Handler execution failed";
-            return c.json({ error: message, approvalId: approval.id }, 500);
-        }
-    });
-    /** Deny a pending approval */
-    app.post("/capstan/approvals/:id/deny", async (c) => {
-        const id = c.req.param("id");
-        const existing = getApproval(id);
-        if (!existing) {
-            return c.json({ error: "Approval not found" }, 404);
-        }
-        if (existing.status !== "pending") {
-            return c.json({ error: "Approval already resolved", status: existing.status }, 409);
-        }
-        let resolvedBy;
-        let reason;
-        try {
-            const body = await c.req.json();
-            if (typeof body.resolvedBy === "string") {
-                resolvedBy = body.resolvedBy;
-            }
-            if (typeof body.reason === "string") {
-                reason = body.reason;
-            }
-        }
-        catch {
-            // No body or invalid JSON — that's fine.
-        }
-        const approval = resolveApproval(id, "denied", resolvedBy);
-        if (!approval) {
-            return c.json({ error: "Approval not found" }, 404);
-        }
-        return c.json({
-            status: "denied",
-            approvalId: approval.id,
-            ...(reason !== undefined ? { reason } : {}),
-        });
-    });
+    mountApprovalRoutes(app, handlerRegistry);
     // ------------------------------------------------------------------
     // Agent manifest endpoint
     // ------------------------------------------------------------------

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,eAAe,GAChB,MAAM,eAAe,CAAC;AAoCvB;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAkB,EAClB,IAAY,EACZ,MAAqB,EACrB,WAAgD,EAChD,YAAiD;IAEjD,MAAM,IAAI,GAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,IAAI,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAc,CAAC;IACnC,MAAM,aAAa,GAAoB,EAAE,CAAC;IAE1C;;;OAGG;IACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAG5B,CAAC;IAEJ,qEAAqE;IACrE,oBAAoB;IACpB,qEAAqE;IAErE,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAErB,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,gDAAgD;IAChD,qEAAqE;IAErE,MAAM,WAAW,GAA8B,CAC7C,MAAM,EACN,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,EAAE;QACF,uEAAuE;QACvE,IAAI,WAAgD,CAAC;QACrD,IAAI,YAAiD,CAAC;QAEtD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;YACtE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,aAAa,CAAC,IAAI,CAChB,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CACpE,CAAC;QAEF,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QACrC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAc,EAAE,GAAmB,EAAE,EAAE;YAC1E,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,MAAM,WAAW,GAAG,KAAK,EAAE,CAA0B,EAAE,EAAE;YACvD,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;YAEvD,qBAAqB;YACrB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,IAAI,QAAiB,CAAC;gBACtB,IAAI,CAAC;oBACH,QAAQ;wBACN,MAAM,KAAK,KAAK;4BACd,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;4BACrD,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACpE,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EACtE,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACtC,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,IAAI,+BAA+B,CAAC;oBACzD,MAAM,QAAQ,GAAG,cAAc,CAAC;wBAC9B,MAAM;wBACN,IAAI;wBACJ,KAAK,EAAE,QAAQ;wBACf,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC7C,MAAM;qBACP,CAAC,CAAC;oBACH,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,UAAU,EAAE,QAAQ,CAAC,EAAE;wBACvB,MAAM;wBACN,OAAO,EAAE,sBAAsB,QAAQ,CAAC,EAAE,EAAE;qBAC7C,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,cAAc;YACd,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;oBACvD,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;wBAC7C,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC7B,CAAC;yBAAM,CAAC;wBACN,KAAK,GAAG,EAAE,CAAC;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;YAED,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,wBAAwB;gBACxB,IACE,GAAG,IAAI,IAAI;oBACX,OAAO,GAAG,KAAK,QAAQ;oBACvB,QAAQ,IAAI,GAAG;oBACf,KAAK,CAAC,OAAO,CAAE,GAA6B,CAAC,MAAM,CAAC,EACpD,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE,kBAAkB;wBACzB,MAAM,EAAG,GAA6B,CAAC,MAAM;qBAC9C,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC;QAEF,mDAAmD;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAK3B,CAAC;QACX,GAAG,CAAC,WAAW,CAAyD,CACvE,IAAI,EACJ,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC;IAEF,qEAAqE;IACrE,gCAAgC;IAChC,qEAAqE;IAErE,iFAAiF;IACjF,GAAG,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,EAAE,EAAE;QAClC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAIxD,CAAC;QACT,MAAM,KAAK,GAAG,aAAa,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC;QACtD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,kCAAkC;IAClC,GAAG,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,GAAG,CAAC,IAAI,CAAC,gCAAgC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,qCAAqC;QACrC,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAA6B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACxC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,yDAAyD;QACzD,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;QACvD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,6BAA6B,EAAE,KAAK,EAAE,QAAQ,EAAE,EACzD,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,8CAA8C;YAC9C,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YAClD,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC;YACzB,OAAO,CAAC,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,UAAU;gBAClB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC;YAClE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,8BAA8B;IAC9B,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClD,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAClC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,EAC/D,GAAG,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,UAA8B,CAAC;QACnC,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAA6B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACxC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;YAC/B,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YACvB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,yCAAyC;QAC3C,CAAC;QAED,MAAM,QAAQ,GAAG,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oBAAoB,EAAE,EAAE,GAAG,CAAC,CAAC;QACtD,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,QAAQ;YAChB,UAAU,EAAE,QAAQ,CAAC,EAAE;YACvB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,0BAA0B;IAC1B,qEAAqE;IAErE,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa;YACvC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa;YAC7D,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE;YAC1C,MAAM,EAAE,aAAa;SACtB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAoC3D;;;GAGG;AACH,SAAS,kBAAkB,CACzB,MAAkB,EAClB,IAAY,EACZ,MAAqB,EACrB,WAAgD,EAChD,YAAiD;IAEjD,MAAM,IAAI,GAAkB,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAC5E,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS;QAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7D,IAAI,WAAW,KAAK,SAAS;QAAE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IAC9D,IAAI,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,0EAA0E;IAC1E,gEAAgE;IAChE,gBAAgB,EAAE,CAAC;IAEnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAc,CAAC;IACnC,MAAM,aAAa,GAAoB,EAAE,CAAC;IAE1C;;;OAGG;IACH,MAAM,eAAe,GAAG,IAAI,GAAG,EAG5B,CAAC;IAEJ,qEAAqE;IACrE,oBAAoB;IACpB,qEAAqE;IAErE,8EAA8E;IAC9E,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAErB,wEAAwE;IACxE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,gDAAgD;IAChD,qEAAqE;IAErE,MAAM,WAAW,GAA8B,CAC7C,MAAM,EACN,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,EAAE;QACF,uEAAuE;QACvE,IAAI,WAAgD,CAAC;QACrD,IAAI,YAAiD,CAAC;QAEtD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,WAAW,GAAG,YAAY,CAAC,MAAM,CAAC,KAAK,CAA4B,CAAC;YACtE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,8DAA8D;QAChE,CAAC;QAED,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClB,YAAY,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAA4B,CAAC;YACxE,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QAED,aAAa,CAAC,IAAI,CAChB,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,CAAC,CACpE,CAAC;QAEF,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;QACrC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAc,EAAE,GAAmB,EAAE,EAAE;YAC1E,OAAO,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;QAEH,uEAAuE;QACvE,MAAM,WAAW,GAAG,KAAK,EAAE,CAA0B,EAAE,EAAE;YACvD,MAAM,GAAG,GAAG,aAAa,CAAC,CAA2B,CAAC,CAAC;YAEvD,qBAAqB;YACrB,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,IAAI,QAAiB,CAAC;gBACtB,IAAI,CAAC;oBACH,QAAQ;wBACN,MAAM,KAAK,KAAK;4BACd,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;4BACrD,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC;gBAAC,MAAM,CAAC;oBACP,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;gBACpE,IAAI,YAAY,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBACnC,OAAO,CAAC,CAAC,IAAI,CACX,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,IAAI,eAAe,EAAE,EACtE,GAAG,CACJ,CAAC;gBACJ,CAAC;gBACD,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBACtC,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,IAAI,+BAA+B,CAAC;oBACzD,MAAM,QAAQ,GAAG,cAAc,CAAC;wBAC9B,MAAM;wBACN,IAAI;wBACJ,KAAK,EAAE,QAAQ;wBACf,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;wBAC7C,MAAM;qBACP,CAAC,CAAC;oBACH,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,MAAM,EAAE,mBAAmB;wBAC3B,UAAU,EAAE,QAAQ,CAAC,EAAE;wBACvB,MAAM;wBACN,OAAO,EAAE,sBAAsB,QAAQ,CAAC,EAAE,EAAE;qBAC7C,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,cAAc;YACd,IAAI,KAAc,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;oBACrB,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC;gBAC9D,CAAC;qBAAM,CAAC;oBACN,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;oBACvD,IAAI,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;wBAC7C,KAAK,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;oBAC7B,CAAC;yBAAM,CAAC;wBACN,KAAK,GAAG,EAAE,CAAC;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,KAAK,GAAG,EAAE,CAAC;YACb,CAAC;YAED,+DAA+D;YAC/D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpD,OAAO,CAAC,CAAC,IAAI,CAAC,MAAgB,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,wBAAwB;gBACxB,IACE,GAAG,IAAI,IAAI;oBACX,OAAO,GAAG,KAAK,QAAQ;oBACvB,QAAQ,IAAI,GAAG;oBACf,KAAK,CAAC,OAAO,CAAE,GAA6B,CAAC,MAAM,CAAC,EACpD,CAAC;oBACD,OAAO,CAAC,CAAC,IAAI,CACX;wBACE,KAAK,EAAE,kBAAkB;wBACzB,MAAM,EAAG,GAA6B,CAAC,MAAM;qBAC9C,EACD,GAAG,CACJ,CAAC;gBACJ,CAAC;gBAED,iBAAiB;gBACjB,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC;gBAC/D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;QACH,CAAC,CAAC;QAEF,mDAAmD;QACnD,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,EAK3B,CAAC;QACX,GAAG,CAAC,WAAW,CAAyD,CACvE,IAAI,EACJ,WAAW,CACZ,CAAC;IACJ,CAAC,CAAC;IAEF,qEAAqE;IACrE,gCAAgC;IAChC,qEAAqE;IAErE,mBAAmB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAE1C,qEAAqE;IACrE,0BAA0B;IAC1B,qEAAqE;IAErE,GAAG,CAAC,GAAG,CAAC,2BAA2B,EAAE,CAAC,CAAC,EAAE,EAAE;QACzC,MAAM,QAAQ,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa;YACvC,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,IAAI,aAAa;YAC7D,WAAW,EAAE,MAAM,CAAC,GAAG,EAAE,WAAW,IAAI,EAAE;YAC1C,MAAM,EAAE,aAAa;SACtB,CAAC;QACF,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;AAC7C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zauso-ai/capstan-core",
-  "version": "0.2.0",
+  "version": "1.0.0-beta.2",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",