@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/src/core/security.js

@@ -1,88 +0,0 @@
-export function sameOrigin(request, allowedOrigins = []) {
-  const origin = request?.headers?.get("Origin");
-  if (!origin) return false;
-  const requestOrigin = (() => { try { return new URL(request.url).origin; } catch { return ""; } })();
-  const allowed = new Set((Array.isArray(allowedOrigins) ? allowedOrigins : [allowedOrigins]).filter(Boolean).map(String));
-  if (!allowed.size && requestOrigin) allowed.add(requestOrigin);
-  const fetchSite = request.headers.get("Sec-Fetch-Site");
-  return allowed.has(origin) && (!fetchSite || fetchSite === "same-origin");
-}
-
-export async function readJsonClone(request, maxBytes = 64 * 1024) {
-  if (!(request.headers.get("Content-Type") || "").toLowerCase().startsWith("application/json")) return { error: secureJson({ error: "JSON request required" }, 415) };
-  const declared = Number(request.headers.get("Content-Length"));
-  if (Number.isFinite(declared) && declared > maxBytes) return { error: secureJson({ error: "Request body is too large" }, 413) };
-  try {
-    const value = await readBoundedJson(request, maxBytes);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Object required");
-    return { value };
-  } catch (error) {
-    if (error?.status === 413) return { error: secureJson({ error: "Request body is too large" }, 413) };
-    return { error: secureJson({ error: "Invalid JSON object request" }, 400) };
-  }
-}
-
-export async function readJson(request, maxBytes = 64 * 1024) {
-  if (!(request.headers.get("Content-Type") || "").toLowerCase().startsWith("application/json")) throw Object.assign(new Error("JSON request required"), { status: 415 });
-  const declared = Number(request.headers.get("Content-Length"));
-  if (Number.isFinite(declared) && declared > maxBytes) throw Object.assign(new Error("Request body is too large"), { status: 413 });
-  if (!request.body) throw Object.assign(new Error("Request body required"), { status: 400 });
-  try {
-    const value = await readBoundedJson(request, maxBytes);
-    if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error("Object required");
-    return value;
-  } catch (error) {
-    if (error?.status) throw error;
-    throw Object.assign(new Error("Invalid JSON object request"), { status: 400 });
-  }
-}
-
-async function readBoundedJson(request, maxBytes) {
-  const reader = request.clone().body?.getReader();
-  if (!reader) throw new Error("Request body required");
-  const chunks = [];
-  let total = 0;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    total += value.byteLength;
-    if (total > maxBytes) { void reader.cancel(); throw Object.assign(new Error("Request body is too large"), { status: 413 }); }
-    chunks.push(value);
-  }
-  const body = new Uint8Array(total);
-  let offset = 0;
-  for (const chunk of chunks) { body.set(chunk, offset); offset += chunk.byteLength; }
-  return JSON.parse(new TextDecoder().decode(body));
-}
-
-export function secureJson(payload, status = 200, headers = {}) {
-  return secureResponse(Response.json(payload, { status, headers: { "Cache-Control": "no-store", ...headers } }));
-}
-
-export function json(payload, status = 200, cache = "no-store") {
-  return secureJson(payload, status, { "Cache-Control": cache });
-}
-
-export function secureText(text, status = 200, cache = "no-store") {
-  return secureResponse(new Response(text, { status, headers: { "Content-Type": "text/plain; charset=utf-8", "Cache-Control": cache } }));
-}
-
-export function secureResponse(response) {
-  const headers = new Headers(response.headers);
-  headers.set("Content-Security-Policy", "default-src 'self'; script-src 'self'; worker-src 'self' blob: data:; style-src 'self' 'unsafe-inline'; img-src 'self' https: data:; connect-src 'self'; font-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests");
-  headers.set("X-Content-Type-Options", "nosniff");
-  headers.set("X-Frame-Options", "DENY");
-  headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
-  headers.set("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
-  headers.set("Cross-Origin-Opener-Policy", "same-origin");
-  headers.set("Strict-Transport-Security", "max-age=31536000");
-  return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
-}
-
-export function requireUser(identity, response = secureJson({ error: "Authentication is required." }, 401)) {
-  return identity ? null : response;
-}
-
-export function requireAdmin(identity, response = secureJson({ error: "Administrator access is required." }, 403)) {
-  return identity?.is_admin || identity?.isAdmin ? null : response;
-}

package/src/data/context.js

@@ -1,16 +0,0 @@
-import { ensureUser, getAuthorizationUser, listUserGrants, listUserTenants, verifyImpersonationToken } from "../auth/index.js";
-
-export async function requestDataContext(env, { state = {}, request, publicTenantId = null } = {}) {
-  let authUser = state.authUser || (state.user ? await ensureUser(env, state.user, { who: `user:${state.user.sub || "unknown"}` }) : null);
-  const system = Boolean(state.user?.auth_strategy === "http_basic" || (authUser && authUser.is_admin));
-  if (!authUser) return { userId: null, tenantId: publicTenantId, publicTenantId, public: Boolean(publicTenantId), system: false };
-  const impersonation = system ? await verifyImpersonationToken(request?.headers?.get("X-CF-GenAI-Impersonation") || readCookie(request, "__Host-cfgenai_impersonation"), env) : null;
-  if (impersonation) { const targetUser = await getAuthorizationUser(env, impersonation.targetUserId, { who: `user:${impersonation.adminUserId}` }); if (targetUser) authUser = targetUser; }
-  const who = `user:${authUser.id}`;
-  const [tenants, grants] = await Promise.all([listUserTenants(env, authUser.id, { who }), listUserGrants(env, authUser.id, { who })]);
-  const requestedTenant = state.tenantId || request?.headers?.get("X-Tenant-ID") || null;
-  const tenant = requestedTenant ? tenants.find((item) => item.id === requestedTenant) : tenants.length === 1 ? tenants[0] : null;
-  return { userId: authUser.id, tenantId: tenant?.id || null, publicTenantId, public: false, system, scopes: grants.map((grant) => grant.scope_name), tenants, invalidTenant: Boolean(requestedTenant && !tenant), impersonated: Boolean(impersonation), impersonatedBy: impersonation?.adminUserId || null };
-}
-
-function readCookie(request, name) { const value = request?.headers?.get("Cookie") || ""; return value.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${name}=`))?.slice(name.length + 1) || ""; }

package/src/data/reader.js

@@ -1,63 +0,0 @@
-import { auditLog, createD1 } from "../core/index.js";
-import { DataScopeError, normalizeDataResources } from "./resources.js";
-
-export function createDataReader(env, { resources = [], context } = {}) {
-  const registry = new Map(normalizeDataResources(resources).map((resource) => [resource.name, resource]));
-  const getContext = typeof context === "function" ? context : async () => context || {};
-  const scope = (requestedScope) => ({
-    list: (name, options) => readList(name, requestedScope, options), page: (name, options) => readPage(name, requestedScope, options), count: (name, options) => readCount(name, requestedScope, options),
-    get: async (name, id) => (await readList(name, requestedScope, { where: { [registry.get(name)?.idColumn || "id"]: id }, limit: 1 }))[0] || null,
-    insert: (name, values) => writeInsert(name, requestedScope, values), update: (name, id, changes) => writeUpdate(name, requestedScope, id, changes), updateWhere: (name, where, changes) => writeUpdateWhere(name, requestedScope, where, changes), delete: (name, id) => writeDelete(name, requestedScope, id), deleteWhere: (name, where) => writeDeleteWhere(name, requestedScope, where),
-  });
-
-  async function readList(name, requestedScope, { where = {}, limit = 100, orderBy, offset = 0 } = {}) { return (await readPage(name, requestedScope, { where, limit, orderBy, offset })).rows; }
-
-  async function readPage(name, requestedScope, { where = {}, limit = 100, orderBy, cursor, offset = 0 } = {}) {
-    const resource = getResource(name); const actor = await getContext(); if (!isAllowed(resource, requestedScope, actor, "read")) return { rows: [], nextCursor: null };
-    const predicates = []; const bindings = []; addScopePredicate(resource, requestedScope, actor, predicates, bindings); addFilters(resource, where, predicates, bindings);
-    if (cursor !== undefined && cursor !== null) { predicates.push(`${quote(resource.idColumn)}>?`); bindings.push(cursor); }
-    const safeLimit = Math.min(Math.max(Number(limit) || 100, 1), 1000); const safeOffset = Math.max(Number(offset) || 0, 0);
-    let sql = `SELECT ${resource.readableColumns.map(quote).join(",")} FROM ${quote(resource.table)}${predicates.length ? ` WHERE ${predicates.join(" AND ")}` : ""} LIMIT ${safeLimit} OFFSET ${safeOffset}`;
-    if (orderBy) { const [column, direction = "ASC"] = String(orderBy).split(/\s+/, 2); if (!resource.orderableColumns.includes(column)) throw new TypeError(`Column ${column} cannot order ${resource.name}`); sql = sql.replace(` LIMIT ${safeLimit}`, ` ORDER BY ${quote(column)} ${direction.toUpperCase() === "DESC" ? "DESC" : "ASC"} LIMIT ${safeLimit}`); }
-    const result = await createD1(env, { who: actorLabel(actor) }).prepare(sql).bind(...bindings).all(); const rows = result.results || [];
-    return { rows, nextCursor: rows.length === safeLimit ? rows[rows.length - 1][resource.idColumn] : null };
-  }
-
-  async function readCount(name, requestedScope, { where = {} } = {}) {
-    const resource = getResource(name); const actor = await getContext(); if (!isAllowed(resource, requestedScope, actor, "read")) return 0;
-    const predicates = []; const bindings = []; addScopePredicate(resource, requestedScope, actor, predicates, bindings); addFilters(resource, where, predicates, bindings);
-    const result = await createD1(env, { who: actorLabel(actor) }).prepare(`SELECT COUNT(*) AS count FROM ${quote(resource.table)}${predicates.length ? ` WHERE ${predicates.join(" AND ")}` : ""}`).bind(...bindings).first(); return Number(result?.count || 0);
-  }
-
-  async function writeInsert(name, requestedScope, values = {}) {
-    const resource = getResource(name); const actor = await getContext(); assertWritable(resource, requestedScope, actor, "create"); const data = cleanWritableValues(resource, values, { includeId: true, includeOwnership: requestedScope === "system" }); assertColumnScopes(resource, actor, Object.keys(data)); addOwnedValue(resource, requestedScope, actor, data); const columns = Object.keys(data); if (!columns.length) throw new TypeError(`No writable values supplied for ${resource.name}`);
-    const result = await createD1(env, { who: actorLabel(actor) }).prepare(`INSERT INTO ${quote(resource.table)} (${columns.map(quote).join(",")}) VALUES (${columns.map(() => "?").join(",")})`).bind(...columns.map((column) => data[column])).run(); const insertedId = data[resource.idColumn] === undefined ? result?.meta?.last_row_id : data[resource.idColumn]; return insertedId === undefined ? data : (await readList(name, requestedScope, { where: { [resource.idColumn]: insertedId }, limit: 1 }))[0] || { ...data, [resource.idColumn]: insertedId };
-  }
-
-  async function writeUpdate(name, requestedScope, id, changes = {}) {
-    const resource = getResource(name); const actor = await getContext(); assertWritable(resource, requestedScope, actor, "update"); const data = cleanWritableValues(resource, changes, { includeOwnership: requestedScope === "system" }); assertColumnScopes(resource, actor, Object.keys(data)); const columns = Object.keys(data); if (!columns.length) throw new TypeError(`No writable values supplied for ${resource.name}`);
-    const predicates = [`${quote(resource.idColumn)}=?`]; const bindings = [id]; addScopePredicate(resource, requestedScope, actor, predicates, bindings); await createD1(env, { who: actorLabel(actor) }).prepare(`UPDATE ${quote(resource.table)} SET ${columns.map((column) => `${quote(column)}=?`).join(",")} WHERE ${predicates.join(" AND ")}`).bind(...columns.map((column) => data[column]), ...bindings).run(); return (await readList(name, requestedScope, { where: { [resource.idColumn]: id }, limit: 1 }))[0] || null;
-  }
-
-  async function writeDelete(name, requestedScope, id) { const resource = getResource(name); const actor = await getContext(); assertWritable(resource, requestedScope, actor, "delete"); const predicates = [`${quote(resource.idColumn)}=?`]; const bindings = [id]; addScopePredicate(resource, requestedScope, actor, predicates, bindings); return createD1(env, { who: actorLabel(actor) }).prepare(`DELETE FROM ${quote(resource.table)} WHERE ${predicates.join(" AND ")}`).bind(...bindings).run(); }
-
-  async function writeUpdateWhere(name, requestedScope, where, changes) { const resource = getResource(name); const actor = await getContext(); assertWritable(resource, requestedScope, actor, "update"); const data = cleanWritableValues(resource, changes, { includeOwnership: requestedScope === "system" }); assertColumnScopes(resource, actor, Object.keys(data)); const columns = Object.keys(data); if (!columns.length) throw new TypeError(`No writable values supplied for ${resource.name}`); const predicates = []; const bindings = []; addScopePredicate(resource, requestedScope, actor, predicates, bindings); addFilters(resource, where, predicates, bindings); await createD1(env, { who: actorLabel(actor) }).prepare(`UPDATE ${quote(resource.table)} SET ${columns.map((column) => `${quote(column)}=?`).join(",")} WHERE ${predicates.join(" AND ")}`).bind(...columns.map((column) => data[column]), ...bindings).run(); return readCount(name, requestedScope, { where }); }
-
-  async function writeDeleteWhere(name, requestedScope, where) { const resource = getResource(name); const actor = await getContext(); assertWritable(resource, requestedScope, actor, "delete"); const predicates = []; const bindings = []; addScopePredicate(resource, requestedScope, actor, predicates, bindings); addFilters(resource, where, predicates, bindings); return createD1(env, { who: actorLabel(actor) }).prepare(`DELETE FROM ${quote(resource.table)} WHERE ${predicates.join(" AND ")}`).bind(...bindings).run(); }
-  function getResource(name) { const resource = registry.get(String(name)); if (!resource) throw new TypeError(`Unknown data resource: ${name}`); return resource; }
-  return { user: scope("user"), tenant: scope("tenant"), public: scope("public"), system: scope("system"), context: getContext, resources: [...registry.values()] };
-}
-
-function isAllowed(resource, requestedScope, actor, operation) {
-  const allowed = requestedScope === "system" ? Boolean(actor.system) : requestedScope === resource.scope && (requestedScope === "user" ? Boolean(actor.userId) : requestedScope === "public" ? Boolean(actor.publicTenantId && operation === "read") : Boolean(actor.tenantId && (actor.userId || (actor.public && resource.publicRead))));
-  if (!allowed || !resource.operations.includes(operation)) { auditLog({ who: actorLabel(actor), operation: "deny", resource: `data:${resource.name}:${requestedScope}:${operation}` }); return false; }
-  return true;
-}
-function assertWritable(resource, requestedScope, actor, operation) { if (!isAllowed(resource, requestedScope, actor, operation)) throw new DataScopeError(`Data scope ${requestedScope} cannot ${operation} resource ${resource.name}`); }
-function assertColumnScopes(resource, actor, columns) { if (actor.system) return; for (const column of columns) { const required = resource.columnScopes[column] || []; if (required.some((scope) => !actor.scopes?.includes(scope))) throw new DataScopeError(`Missing scope to write ${resource.name}.${column}`); } }
-function addScopePredicate(resource, requestedScope, actor, predicates, bindings) { if (requestedScope === "user") { predicates.push(`${quote(resource.ownerColumn)}=?`); bindings.push(actor.userId); } if (requestedScope === "public") { predicates.push(`${quote(resource.tenantColumn)}=?`); bindings.push(actor.publicTenantId); } if (requestedScope === "tenant") { predicates.push(`${quote(resource.tenantColumn)}=?`); bindings.push(actor.tenantId); if (actor.public && resource.publicRead && typeof resource.publicRead === "object") { predicates.push(`${quote(resource.publicRead.column)}=?`); bindings.push(resource.publicRead.value); } } }
-function addFilters(resource, where, predicates, bindings) { for (const [column, value] of Object.entries(where || {})) { if (!resource.filterableColumns.includes(column)) throw new TypeError(`Column ${column} cannot filter ${resource.name}`); if (value === null) predicates.push(`${quote(column)} IS NULL`); else { predicates.push(`${quote(column)}=?`); bindings.push(value); } } }
-function cleanWritableValues(resource, values, { includeId = false, includeOwnership = false } = {}) { return Object.fromEntries(Object.entries(values || {}).filter(([column]) => (resource.writableColumns.includes(column) || (includeOwnership && [resource.ownerColumn, resource.tenantColumn].includes(column))) && (includeId || column !== resource.idColumn))); }
-function addOwnedValue(resource, requestedScope, actor, data) { if (requestedScope === "user") data[resource.ownerColumn] = actor.userId; if (requestedScope === "tenant") data[resource.tenantColumn] = actor.tenantId; }
-function actorLabel(actor) { return actor.system ? "system:data" : `user:${actor.userId || "unknown"}`; }
-function quote(identifier) { return `"${identifier}"`; }

package/src/data/resources.js

@@ -1,42 +0,0 @@
-export const DATA_SCOPES = ["user", "tenant", "public", "system"];
-export const DATA_OPERATIONS = ["read", "create", "update", "delete"];
-
-export class DataScopeError extends Error {
-  constructor(message) { super(message); this.name = "DataScopeError"; }
-}
-
-export function normalizeDataResources(resources = []) {
-  const names = new Set();
-  return resources.map((resource) => {
-    if (!resource || !/^[a-z][a-z0-9_-]*$/.test(String(resource.name || ""))) throw new TypeError("Data resources require a safe name");
-    if (!/^[a-z][a-z0-9_]*$/.test(String(resource.table || ""))) throw new TypeError(`Data resource ${resource.name} requires a safe table name`);
-    const name = String(resource.name);
-    if (names.has(name)) throw new TypeError(`Duplicate data resource: ${name}`);
-    names.add(name);
-    const scope = String(resource.scope || "").toLowerCase();
-    if (!DATA_SCOPES.includes(scope)) throw new TypeError(`Data resource ${resource.name} requires scope user, tenant, public, or system`);
-    const columns = [...new Set((resource.columns || []).map(String))];
-    if (!columns.length || columns.some((column) => !/^[a-z][a-z0-9_]*$/.test(column))) throw new TypeError(`Data resource ${resource.name} requires safe columns`);
-    const idColumn = String(resource.idColumn || "id");
-    if (!columns.includes(idColumn)) throw new TypeError(`Data resource ${resource.name} must include ${idColumn}`);
-    const ownerColumn = resource.ownerColumn ? String(resource.ownerColumn) : "user_id";
-    const tenantColumn = resource.tenantColumn ? String(resource.tenantColumn) : "tenant_id";
-    if (scope === "user" && !columns.includes(ownerColumn)) throw new TypeError(`User resource ${resource.name} must include ${ownerColumn}`);
-    if (["tenant", "public"].includes(scope) && !columns.includes(tenantColumn)) throw new TypeError(`${scope} resource ${resource.name} must include ${tenantColumn}`);
-    const filterableColumns = [...new Set((resource.filterableColumns || columns).map(String))];
-    const orderableColumns = [...new Set((resource.orderableColumns || columns).map(String))];
-    for (const column of [...filterableColumns, ...orderableColumns]) if (!columns.includes(column)) throw new TypeError(`Data resource ${resource.name} references an unselected column`);
-    const writableColumns = [...new Set((resource.writableColumns || []).map(String))].filter((column) => column !== ownerColumn && column !== tenantColumn);
-    if (writableColumns.some((column) => !columns.includes(column))) throw new TypeError(`Data resource ${resource.name} references an unwritable column`);
-    const columnScopes = Object.fromEntries(Object.entries(resource.columnScopes || {}).map(([column, scopes]) => [String(column), Array.isArray(scopes) ? scopes.map(String) : [String(scopes)]]));
-    if (Object.keys(columnScopes).some((column) => !columns.includes(column) || columnScopes[column].some((scope) => !/^[a-z0-9]+(?::[a-z0-9-]+)+$/.test(scope)))) throw new TypeError(`Data resource ${resource.name} has invalid column scopes`);
-    if (!Array.isArray(resource.readableColumns) || !resource.readableColumns.length) throw new TypeError(`Data resource ${resource.name} requires explicit readableColumns`);
-    const readableColumns = [...new Set(resource.readableColumns.map(String))];
-    if (readableColumns.some((column) => !columns.includes(column))) throw new TypeError(`Data resource ${resource.name} references an unreadable column`);
-    const operations = [...new Set((resource.operations || ["read", ...(writableColumns.length ? ["create", "update", "delete"] : [])]).map((operation) => String(operation).toLowerCase()))];
-    if (!operations.length || operations.some((operation) => !DATA_OPERATIONS.includes(operation)) || !operations.includes("read")) throw new TypeError(`Data resource ${name} has invalid operations`);
-    const publicRead = resource.publicRead && typeof resource.publicRead === "object" ? { column: String(resource.publicRead.column || ""), value: resource.publicRead.value } : Boolean(resource.publicRead);
-    if (publicRead && typeof publicRead === "object" && (!/^[a-z][a-z0-9_]*$/.test(publicRead.column) || !columns.includes(publicRead.column))) throw new TypeError(`Public resource ${resource.name} requires a selected visibility column`);
-    return { ...resource, name, table: String(resource.table), scope, columns, readableColumns, idColumn, ownerColumn, tenantColumn, filterableColumns, orderableColumns, writableColumns, columnScopes, operations, publicRead };
-  });
-}

package/src/repository.js

@@ -1,63 +0,0 @@
-import { auditLog } from "./core/events.js";
-
-export class RepositoryError extends Error {
-  constructor(message, status = 500) { super(message); this.name = "RepositoryError"; this.status = status; }
-}
-
-export function defineRepository({ name, resource, scope = "tenant", relations = {}, hooks = {}, resourceDefinition = null } = {}) {
-  if (!/^[a-z][a-z0-9_-]*$/.test(String(name || ""))) throw new TypeError("Repositories require a safe name");
-  if (!resource) throw new TypeError(`Repository ${name} requires a data resource`);
-  return { name: String(name), resource: String(resource), scope, relations: { ...relations }, hooks: { ...hooks }, resourceDefinition };
-}
-
-export function createRepositories(env, definitions = [], { context } = {}) {
-  const specs = new Map(definitions.map((definition) => {
-    const spec = defineRepository(definition);
-    return [spec.name, spec];
-  }));
-  const repositories = new Map();
-  const get = (name) => {
-    const repository = repositories.get(String(name));
-    if (!repository) throw new RepositoryError(`Unknown repository: ${name}`, 500);
-    return repository;
-  };
-  for (const spec of specs.values()) repositories.set(spec.name, repository(spec));
-  return Object.fromEntries([...repositories].map(([name, value]) => [name, value]));
-
-  function repository(spec) {
-    const reader = () => {
-      const data = env?.data;
-      if (!data?.[spec.scope]) throw new RepositoryError(`Data scope ${spec.scope} is unavailable`, 500);
-      return data[spec.scope];
-    };
-    const invoke = async (operation, value) => {
-      const hook = spec.hooks[operation];
-      return typeof hook === "function" ? hook(value, { env, context, repository: api }) : value;
-    };
-    const api = {
-      name: spec.name,
-      resource: spec.resource,
-      async list(options) { return invoke("list", await reader().list(spec.resource, options)); },
-      async page(options) { return invoke("page", await reader().page(spec.resource, options)); },
-      async count(options) { return reader().count(spec.resource, options); },
-      async find(id) { return invoke("find", await reader().get(spec.resource, id)); },
-      async findOne(where, options = {}) { return invoke("findOne", (await reader().list(spec.resource, { ...options, where, limit: 1 }))[0] || null); },
-      async insert(values) { const result = await reader().insert(spec.resource, await invoke("beforeInsert", values)); auditLog({ who: "repository", operation: "create", resource: spec.name }); return invoke("afterInsert", result); },
-      async update(id, changes) { const result = await reader().update(spec.resource, id, await invoke("beforeUpdate", changes)); auditLog({ who: "repository", operation: "update", resource: spec.name }); return invoke("afterUpdate", result); },
-      async updateWhere(where, changes) { return reader().updateWhere(spec.resource, where, await invoke("beforeUpdate", changes)); },
-      async delete(id) { const result = await reader().delete(spec.resource, id); auditLog({ who: "repository", operation: "delete", resource: spec.name }); return result; },
-      async deleteWhere(where) { return reader().deleteWhere(spec.resource, where); },
-      async link(relation, record) {
-        const relationSpec = spec.relations[relation];
-        if (!relationSpec) throw new RepositoryError(`Unknown relation ${spec.name}.${relation}`, 500);
-        const target = get(relationSpec.repository);
-        const localKey = relationSpec.localKey || "id";
-        const foreignKey = relationSpec.foreignKey || `${spec.name}_id`;
-        const value = record?.[localKey];
-        if (value === undefined || value === null) return relationSpec.many === false ? null : [];
-        return relationSpec.many === false ? target.findOne({ [foreignKey]: value }) : target.list({ where: { [foreignKey]: value, ...(relationSpec.where || {}) }, ...(relationSpec.options || {}) });
-      },
-    };
-    return api;
-  }
-}

package/src/runtime/features.js

@@ -1,17 +0,0 @@
-import { evaluateCircuitBreaker, listCircuitBreakers, registerFeatureManifests } from "../core/circuits.js";
-
-const featureRegistrationPromises = new WeakMap();
-
-export function ensureFeatureManifests(env, features = [], { who = "system:update" } = {}) {
-  if (!env || typeof env !== "object" || !env.DB) return Promise.resolve();
-  const key = features.map((feature) => String(feature?.name || feature?.id || "feature")).join("|");
-  let registrations = featureRegistrationPromises.get(env.DB);
-  if (!registrations) { registrations = new Map(); featureRegistrationPromises.set(env.DB, registrations); }
-  let promise = registrations.get(key);
-  if (!promise) {
-    promise = (async () => { await registerFeatureManifests(env, features, { who }); const breakers = await listCircuitBreakers(env, { who }); await Promise.all(breakers.filter(Boolean).map((breaker) => evaluateCircuitBreaker(env, breaker.id, { who }))); })();
-    registrations.set(key, promise);
-    promise.catch(() => registrations.delete(key));
-  }
-  return promise;
-}

package/src/runtime/health.js

@@ -1,17 +0,0 @@
-export function validateBoot(env, { bindings = [], required = [] } = {}) {
-  const missingBindings = bindings.filter((name) => !env?.[name]);
-  const missingValues = required.filter((name) => !env?.[name] || String(env[name]).startsWith("replace-with-"));
-  return { ok: missingBindings.length === 0 && missingValues.length === 0, missingBindings, missingValues };
-}
-
-export function assertBoot(env, spec = {}) {
-  const result = validateBoot(env, spec);
-  if (!result.ok) throw new Error(`Worker boot validation failed: ${[...result.missingBindings, ...result.missingValues].join(", ")}`);
-  return result;
-}
-
-export function methodNotAllowed(allow = "GET") { return new Response("Method Not Allowed", { status: 405, headers: { Allow: allow } }); }
-
-export function healthResponse(env, details = {}) {
-  return Response.json({ ok: true, version: String(env.BUILD_SHA || "unknown").slice(0, 7), build_number: env.BUILD_NUMBER ? String(env.BUILD_NUMBER) : null, ...details }, { headers: { "Cache-Control": "no-store" } });
-}

package/src/runtime/worker.js

@@ -1,58 +0,0 @@
-import { ensureScopes, ensureSubscriptionManifest, SubscriptionError } from "../auth/index.js";
-import { auditedD1, createEventHandler, listFeatureHealth, requestActor, requestContext, secureResponse } from "../core/index.js";
-import { jobResponse, liveEventsResponse } from "../api/jobs.js";
-import { createRepositories } from "../repository.js";
-import { dispatchRoutes } from "../api/contracts.js";
-import { defineApp } from "../app.js";
-import { createDataReader } from "../data/reader.js";
-import { DataScopeError, normalizeDataResources } from "../data/resources.js";
-import { requestDataContext } from "../data/context.js";
-import { adminBoundary } from "../admin/routes.js";
-import { ensureFeatureManifests } from "./features.js";
-import { healthResponse } from "./health.js";
-
-const scopeManifestPromises = new WeakMap();
-
-export function createWorker({ fetch, scheduled, app = { name: "worker" }, auth, authorize, scopes = [], subscriptionManifest = [], scopeRoutes = [], apiRoutes = [], middleware = [], features = [], dataResources = [], repositories = [], publicTenantId = null, health, boot, security = true, eventHubBinding = "EVENT_HUB" }) {
-  if (typeof fetch !== "function") throw new TypeError("createWorker requires a fetch handler");
-  const application = defineApp(app); const provider = auth || features.find((feature) => typeof feature?.getUser === "function"); const eventHandler = createEventHandler(features, { eventHubBinding });
-  const repositoryDefinitions = [...repositories, ...features.flatMap((feature) => Array.isArray(feature?.repositories) ? feature.repositories : [])];
-  const registeredDataResources = normalizeDataResources([...dataResources, ...features.flatMap((feature) => Array.isArray(feature?.dataResources) ? feature.dataResources : []), ...repositoryDefinitions.filter((definition) => definition.resourceDefinition).map((definition) => definition.resourceDefinition)]);
-  const featureRoutes = features.flatMap((feature) => Array.isArray(feature?.routes) ? [async (request, env, ctx, next, state) => { for (const route of feature.routes) { const matches = typeof route?.match === "function" ? await route.match(request, env, state) : route?.path === new URL(request.url).pathname; if (matches && typeof route.handle === "function") return route.handle({ request, env, ctx, state, next }); } return next(); }] : []);
-  const chain = [(request, env, ctx, next, state) => adminBoundary(request, env, ctx, next, state, { provider, authorize, scopes: [], scopeRoutes, features }), ...(apiRoutes.length ? [(request, env, ctx, next, state) => dispatchRoutes(request, env, ctx, state, apiRoutes).then((response) => response || next(request))] : []), ...features.flatMap((feature) => feature?.middleware ? [feature.middleware.bind(feature)] : []), ...featureRoutes, ...middleware, ...(auth ? [(request, env, ctx, next) => auth(request, env, ctx, next)] : [])].filter(Boolean);
-  return {
-    async fetch(request, env, ctx) {
-      try {
-        if (boot) await boot(env, { request, ctx });
-        if (subscriptionManifest.length) await ensureSubscriptionManifest(env, subscriptionManifest, { who: "system:update" });
-        const url = new URL(request.url); const state = Object.create(null); state.requestId = crypto.randomUUID();
-        if (env?.DB && scopes.length && isAdminPath(url.pathname)) await ensureScopeManifest(env, scopes);
-        if (provider?.getUser) state.user = await provider.getUser(request, env).catch(() => null); if (state.user?.authUser) state.authUser = state.user.authUser;
-        let dataContext;
-        state.data = createDataReader(env, { resources: registeredDataResources, context: () => dataContext ||= requestDataContext(env, { state, request, publicTenantId }) });
-        const requestEnv = Object.create(env || null);
-        Object.assign(requestEnv, { app: application, DB: env?.DB ? auditedD1(env.DB, requestActor(state)) : env?.DB, data: state.data, repositories: createRepositories(requestEnv, repositoryDefinitions), user: state.user || null, authUser: state.authUser || null, userId: state.authUser?.id || null, eventHandler: (event, eventEnv, eventCtx) => eventHandler(event, eventEnv || requestEnv, eventCtx || ctx) });
-        requestEnv.requestId = state.requestId; state.context = requestContext({ request, env: requestEnv, ctx, state, data: state.data }); requestEnv.context = state.context; requestEnv.event = state.context.event;
-        if (env?.DB && features.some((feature) => typeof feature?.healthcheck === "function" || feature?.healthchecks?.length || feature?.healthChecks?.length || feature?.circuitBreakers?.length || feature?.circuit_breakers?.length)) ctx?.waitUntil?.(ensureFeatureManifests(env, features).catch((error) => console.error("[EventLog] feature manifest registration failed", error)));
-        const dispatch = async (index, currentRequest = request) => { const layer = chain[index]; if (!layer) { if (url.pathname === "/health" || url.pathname === "/api/health") { const details = health ? await health(requestEnv, { request: currentRequest, ctx, state }) : {}; const featureHealth = requestEnv?.DB ? await listFeatureHealth(requestEnv, { who: "system:read" }).catch(() => []) : []; return healthResponse(requestEnv, featureHealth.length ? { ...details, features: featureHealth } : details); } if (url.pathname === "/api/tenant" && currentRequest.method === "GET") { const context = await state.data.context(); if (!context.userId) return Response.json({ error: "Authentication is required." }, { status: 401 }); if (context.invalidTenant) return Response.json({ error: "The requested tenant is not available." }, { status: 400 }); return Response.json({ tenant: context.tenantId ? { id: context.tenantId, name: context.tenants?.find((tenant) => tenant.id === context.tenantId)?.name || null } : null, tenants: context.tenants || [] }); } return fetch(currentRequest, requestEnv, ctx, state); } if (typeof layer !== "function") throw new TypeError("Worker middleware must be a function"); return layer(currentRequest, requestEnv, ctx, (nextRequest = currentRequest) => dispatch(index + 1, nextRequest), state); };
-        const liveResponse = await liveEventsResponse(request, requestEnv, state, eventHubBinding);
-        if (liveResponse) return liveResponse;
-        const response = await jobResponse(request, requestEnv, state) || await dispatch(0); return withRequestId(security ? secureResponse(response) : response, state.requestId);
-      } catch (error) {
-        console.error("[worker] request failed", error); const errorResponse = error instanceof DataScopeError || error instanceof SubscriptionError ? Response.json({ error: error.message }, { status: 403, headers: { "Cache-Control": "no-store" } }) : Response.json({ error: "Internal server error" }, { status: 500, headers: { "Cache-Control": "no-store" } }); return withRequestId(security ? secureResponse(errorResponse) : errorResponse, error?.requestId || crypto.randomUUID());
-      }
-    },
-    ...(scheduled ? { scheduled } : {}),
-  };
-}
-
-function withRequestId(response, requestId) { const headers = new Headers(response.headers); headers.set("X-Request-ID", String(requestId)); return new Response(response.body, { status: response.status, statusText: response.statusText, headers }); }
-function isAdminPath(pathname) { return pathname === "/admin" || pathname.startsWith("/admin/") || pathname === "/api/admin" || pathname.startsWith("/api/admin/"); }
-function ensureScopeManifest(env, scopes) {
-  let registrations = scopeManifestPromises.get(env.DB);
-  if (!registrations) { registrations = new Map(); scopeManifestPromises.set(env.DB, registrations); }
-  const key = JSON.stringify(scopes);
-  let promise = registrations.get(key);
-  if (!promise) { promise = ensureScopes(env, scopes, { who: "system:update" }); registrations.set(key, promise); promise.catch(() => registrations.delete(key)); }
-  return promise;
-}

package/src/ui/index.js

@@ -1 +0,0 @@
-export * from "./react/index.jsx";

package/src/ui/react/admin-access.jsx

@@ -1,29 +0,0 @@
-import { useState } from "react";
-import { apiJson } from "../../api/client.js";
-import { ResourceState, useApiResource } from "./foundation.jsx";
-
-export function UserManagement() {
-  const users = useApiResource("/api/admin/users");
-  const scopes = useApiResource("/api/admin/scopes");
-  const tenants = useApiResource("/api/admin/tenants");
-  const reload = () => Promise.all([users.reload(), scopes.reload(), tenants.reload()]);
-  const options = { scopes: scopes.value?.scopes || [], tenants: tenants.value?.tenants || [] };
-  return <section className="cf-ui-card"><h1>User access</h1><ResourceState loading={users.loading || scopes.loading || tenants.loading} error={users.error || scopes.error || tenants.error} empty="No users registered.">{(users.value?.users || []).length ? <div className="cf-ui-table-wrap"><table><thead><tr><th>User</th><th>Tenants</th><th>Scopes</th><th>Save</th></tr></thead><tbody>{users.value.users.map((user) => <UserRow key={user.id} user={user} options={options} onSaved={reload} />)}</tbody></table></div> : null}</ResourceState></section>;
-}
-
-function UserRow({ user, options, onSaved }) {
-  const [selectedScopes, setSelectedScopes] = useStateSet(user.scopes);
-  const [selectedTenants, setSelectedTenants] = useStateSet((user.tenants || []).map((tenant) => tenant.id));
-  const [saving, setSaving] = useState(false);
-  const save = async () => { setSaving(true); try { await Promise.all([apiJson(`/api/admin/users/${encodeURIComponent(user.id)}/scopes`, { scopes: [...selectedScopes] }, { method: "PUT" }), apiJson(`/api/admin/users/${encodeURIComponent(user.id)}/tenants`, { tenants: [...selectedTenants] }, { method: "PUT" })]); await onSaved(); } finally { setSaving(false); } };
-  return <tr><th scope="row">{user.display_name || user.email || "Unnamed user"}<small>{user.email || "No email"}</small></th><td><CheckList items={options.tenants} selected={selectedTenants} onChange={setSelectedTenants} valueKey="id" labelKey="name" /></td><td><CheckList items={options.scopes} selected={selectedScopes} onChange={setSelectedScopes} valueKey="name" labelKey="label" /></td><td><button type="button" disabled={saving} onClick={save}>{saving ? "Saving…" : "Save"}</button></td></tr>;
-}
-
-function CheckList({ items, selected, onChange, valueKey, labelKey }) {
-  return <div className="cf-ui-check-list">{items.map((item) => { const value = item[valueKey]; return <label key={value}><input type="checkbox" checked={selected.has(value)} onChange={(event) => { const next = new Set(selected); if (event.target.checked) next.add(value); else next.delete(value); onChange(next); }} />{item[labelKey] || value}</label>; })}</div>;
-}
-
-function useStateSet(initial = []) {
-  const [value, setValue] = useState(() => new Set(initial || []));
-  return [value, setValue];
-}

package/src/ui/react/admin-catalogs.jsx

@@ -1,39 +0,0 @@
-import { apiJson } from "../../api/client.js";
-import { useLiveEvent } from "./live-events.jsx";
-import { ResourceState, StatusBadge, useApiResource, useMutation } from "./foundation.jsx";
-
-export function FeatureCatalog() {
-  const resource = useApiResource("/api/admin/features");
-  useLiveEvent((event) => ["healthcheck", "circuit"].some((word) => String(event.what || "").includes(word)), resource.reload);
-  const features = resource.value?.features || [];
-  return <section className="cf-ui-card"><header><h1>Installed features</h1><p>Runtime modules, package versions, healthchecks, and circuit breakers.</p></header><ResourceState {...resource} empty="No features registered.">{features.length ? <div className="cf-ui-table-wrap"><table><thead><tr><th>Feature</th><th>Package/version</th><th>Health</th><th>Roll-up</th><th>Healthchecks</th><th>Breakers</th></tr></thead><tbody>{features.map((item) => <tr key={item.feature}><th scope="row">{item.display_name || item.feature}<small>{item.feature}</small></th><td>{item.package_name || "Unknown package"}<br />{item.version || "Unknown version"}</td><td><StatusBadge state={item.health} /></td><td>{item.circuit_breaker ? <StatusBadge state={item.circuit_breaker.state} /> : "None"}</td><td><CatalogList items={item.healthchecks} /></td><td><CatalogList items={item.circuit_breakers} /></td></tr>)}</tbody></table></div> : null}</ResourceState></section>;
-}
-
-export function HealthcheckCatalog() {
-  const resource = useApiResource("/api/admin/healthchecks");
-  const items = resource.value?.healthchecks || [];
-  return <section className="cf-ui-card"><h1>Healthchecks</h1><ResourceState {...resource} empty="No healthchecks registered.">{items.length ? <div className="cf-ui-card-grid">{items.map((item) => <article className="cf-ui-card" key={item.id}><h2>{item.display_name}</h2><StatusBadge state={item.state} /><p>{item.feature} / {item.component}</p></article>)}</div> : null}</ResourceState></section>;
-}
-
-export function CircuitBreakerCatalog() {
-  const resource = useApiResource("/api/admin/circuit-breakers");
-  const items = resource.value?.circuit_breakers || [];
-  const update = async (item, state) => { await apiJson(`/api/admin/circuit-breakers/${encodeURIComponent(item.id)}`, { state }, { method: "PUT" }); await resource.reload(); };
-  return <section className="cf-ui-card"><h1>Circuit breakers</h1><ResourceState {...resource} empty="No circuit breakers registered.">{items.length ? <div className="cf-ui-list">{items.map((item) => <article className="cf-ui-breaker" key={item.id}><div><h2>{item.display_name}</h2><small>{item.feature}/{item.name}</small></div><StatusBadge state={item.state} /><div className="cf-ui-actions">{["off", "tripped", "on"].map((state) => <button type="button" key={state} disabled={item.state === state} onClick={() => update(item, state)}>{state}</button>)}</div></article>)}</div> : null}</ResourceState></section>;
-}
-
-export function ScopeCatalog() {
-  const resource = useApiResource("/api/admin/scopes");
-  const scopes = resource.value?.scopes || [];
-  return <section className="cf-ui-card"><h1>Scopes</h1><ResourceState {...resource} empty="No scopes registered.">{scopes.length ? <ul className="cf-ui-list">{scopes.map((scope) => <li key={scope.name}><strong>{scope.label || scope.name}</strong><small>{scope.name}</small><p>{scope.description}</p></li>)}</ul> : null}</ResourceState></section>;
-}
-
-export function GroupCatalog() {
-  const resource = useApiResource("/api/admin/groups");
-  const groups = resource.value?.groups || [];
-  return <section className="cf-ui-card"><h1>Groups</h1><ResourceState {...resource} empty="No groups registered.">{groups.length ? <ul className="cf-ui-list">{groups.map((group) => <li key={group.id || group.name}><strong>{group.display_name || group.name}</strong><small>{group.name}</small></li>)}</ul> : null}</ResourceState></section>;
-}
-
-function CatalogList({ items = [] }) {
-  return items.length ? <ul className="cf-ui-inline-list">{items.map((item) => <li key={item.id || item.name}><strong>{item.display_name || item.name}</strong>: <StatusBadge state={item.state} /></li>)}</ul> : <span>None registered</span>;
-}

package/src/ui/react/admin-shell.jsx

@@ -1,17 +0,0 @@
-const SYSTEM_LINKS = [
-  ["Overview", "/admin", "home"],
-  ["Users", "/admin/users", "users"],
-  ["Scopes", "/admin/scopes", "scopes"],
-  ["Groups", "/admin/groups", "groups"],
-  ["Features", "/admin/features", "features"],
-  ["Healthchecks", "/admin/healthchecks", "healthchecks"],
-  ["Circuit breakers", "/admin/circuit-breakers", "circuit-breakers"],
-];
-
-export function AdminShell({ children, active = "", applicationLinks = [], title = "Administration" }) {
-  return <div className="cf-ui-admin-shell"><aside className="cf-ui-admin-nav"><p className="cf-ui-admin-title">{title}</p><nav aria-label="Administration"><section><p className="cf-ui-nav-label">Application</p>{applicationLinks.map((link) => <AdminLink key={link.href} link={link} active={active} />)}</section><section><p className="cf-ui-nav-label">System</p>{SYSTEM_LINKS.map(([label, href, key]) => <AdminLink key={href} link={{ label, href, key }} active={active} />)}</section></nav></aside><main className="cf-ui-admin-content">{children}</main></div>;
-}
-
-export function AdminLink({ link, active }) {
-  return <a href={link.href} aria-current={link.key === active ? "page" : undefined}>{link.label}</a>;
-}

package/src/ui/react/foundation.jsx

@@ -1,40 +0,0 @@
-import { useCallback, useEffect, useState } from "react";
-import { apiFetch, apiJson } from "../../api/client.js";
-
-export function useApiResource(path, { enabled = true, initialValue = null } = {}) {
-  const [value, setValue] = useState(initialValue);
-  const [loading, setLoading] = useState(Boolean(enabled));
-  const [error, setError] = useState(null);
-  const reload = useCallback(async () => {
-    if (!enabled) return null;
-    setLoading(true);
-    try { const next = await apiFetch(path); setValue(next); setError(null); return next; }
-    catch (cause) { setError(cause); throw cause; }
-    finally { setLoading(false); }
-  }, [enabled, path]);
-  useEffect(() => { reload().catch(() => {}); }, [reload]);
-  return { value, setValue, loading, error, reload };
-}
-
-export function useMutation(path, { method = "POST" } = {}) {
-  const [loading, setLoading] = useState(false);
-  const [error, setError] = useState(null);
-  const mutate = useCallback(async (payload = {}) => {
-    setLoading(true);
-    try { const result = await apiJson(path, payload, { method }); setError(null); return result; }
-    catch (cause) { setError(cause); throw cause; }
-    finally { setLoading(false); }
-  }, [method, path]);
-  return { mutate, loading, error };
-}
-
-export function ResourceState({ loading, error, empty = "Nothing to show.", children }) {
-  if (loading) return <p className="cf-ui-status" role="status">Loading…</p>;
-  if (error) return <p className="cf-ui-error" role="alert">{error.message || "Unable to load data."}</p>;
-  return children || <p className="cf-ui-status">{empty}</p>;
-}
-
-export function StatusBadge({ state }) {
-  const value = String(state || "unknown").toLowerCase();
-  return <span className={`cf-ui-status-badge cf-ui-status-${value}`}>{value}</span>;
-}

package/src/ui/react/index.jsx

@@ -1,6 +0,0 @@
-export * from "./foundation.jsx";
-export * from "./live-events.jsx";
-export * from "./jobs.jsx";
-export * from "./admin-shell.jsx";
-export * from "./admin-catalogs.jsx";
-export * from "./admin-access.jsx";

package/src/ui/react/jobs.jsx

@@ -1,63 +0,0 @@
-import { useCallback, useEffect, useMemo, useState } from "react";
-import { apiFetch } from "../../api/client.js";
-import { useLiveEvent, useLiveEvents } from "./live-events.jsx";
-
-function jobQuery(filters) {
-  const query = new URLSearchParams();
-  for (const [key, value] of Object.entries(filters || {})) if (value !== undefined && value !== null && value !== "") query.set(key, value);
-  return query.toString() ? `/api/jobs?${query}` : "/api/jobs";
-}
-
-export function useJobs(filters = {}) {
-  const key = useMemo(() => JSON.stringify(filters), [filters]);
-  const path = useMemo(() => jobQuery(JSON.parse(key)), [key]);
-  const [jobs, setJobs] = useState([]);
-  const [loading, setLoading] = useState(true);
-  const [error, setError] = useState(null);
-  const { connection } = useLiveEvents();
-  const reload = useCallback(async () => {
-    setLoading(true);
-    try { const result = await apiFetch(path); setJobs(result.jobs || []); setError(null); }
-    catch (cause) { setError(cause); }
-    finally { setLoading(false); }
-  }, [path]);
-  useEffect(() => { reload(); }, [reload]);
-  useEffect(() => { if (connection === "open") reload(); }, [connection, reload]);
-  useLiveEvent((event) => String(event.what || "").startsWith("job."), reload);
-  return { jobs, loading, error, reload };
-}
-
-export function useJob(jobId) {
-  const [job, setJob] = useState(null);
-  const [loading, setLoading] = useState(Boolean(jobId));
-  const [error, setError] = useState(null);
-  const reload = useCallback(async () => {
-    if (!jobId) return null;
-    setLoading(true);
-    try { const result = await apiFetch(`/api/jobs/${encodeURIComponent(jobId)}`); setJob(result.job); setError(null); return result.job; }
-    catch (cause) { setError(cause); throw cause; }
-    finally { setLoading(false); }
-  }, [jobId]);
-  useEffect(() => { reload().catch(() => {}); }, [reload]);
-  useLiveEvent((event) => event.details?.jobId === jobId, () => { reload().catch(() => {}); });
-  return { job, loading, error, reload };
-}
-
-export function useJobNotifications({ limit = 20 } = {}) {
-  const { jobs, loading, error, reload } = useJobs({ limit });
-  const [dismissed, setDismissed] = useState(() => new Set());
-  const notifications = jobs.filter((job) => ["succeeded", "failed", "cancelled"].includes(job.status) && !dismissed.has(job.id));
-  const dismiss = useCallback((jobId) => setDismissed((current) => new Set([...current, jobId])), []);
-  return { notifications, loading, error, dismiss, reload };
-}
-
-export function JobNotificationBanner({ job, onDismiss }) {
-  const failed = job.status === "failed";
-  const cancelled = job.status === "cancelled";
-  const message = failed ? `${job.type} failed.` : cancelled ? `${job.type} was cancelled.` : `${job.type} finished.`;
-  return <aside className={`cf-ui-job-banner cf-ui-job-${job.status}`} role="status" aria-live="polite"><span>{message}</span><button type="button" onClick={() => onDismiss?.(job.id)} aria-label="Dismiss notification">Dismiss</button></aside>;
-}
-
-export function JobNotificationList({ notifications, onDismiss }) {
-  return <>{notifications.map((job) => <JobNotificationBanner key={job.id} job={job} onDismiss={onDismiss} />)}</>;
-}