@angriff36/manifest 2.18.0

package/dist/manifest/projections/mongoose/options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.d.ts","sourceRoot":"","sources":["../../../../src/manifest/projections/mongoose/options.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,yBAAyB;IACxC,mGAAmG;IACnG,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,wFAAwF;IACxF,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,4EAA4E;IAC5E,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,iBAAiB,EAAE,OAAO,CAAC;IAC3B,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,gBAAgB,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,yBAAyB,CAU1F"}

package/dist/manifest/projections/mongoose/options.js

@@ -0,0 +1,18 @@
+/**
+ * Mongoose projection options.
+ *
+ * ALL relational concepts (collection names, field names, types) come from
+ * projection options, NOT from IR. This keeps IR backend-neutral.
+ */
+export function normalizeOptions(opts) {
+    const o = (opts ?? {});
+    return {
+        collectionMappings: o.collectionMappings ?? {},
+        fieldMappings: o.fieldMappings ?? {},
+        typeMappings: o.typeMappings ?? {},
+        includeValidation: o.includeValidation ?? true,
+        timestamps: o.timestamps ?? false,
+        output: o.output ?? 'schema.ts',
+    };
+}
+//# sourceMappingURL=options.js.map

package/dist/manifest/projections/mongoose/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../../../src/manifest/projections/mongoose/options.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA0BH,MAAM,UAAU,gBAAgB,CAAC,IAA8B;IAC7D,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA8B,CAAC;IACpD,OAAO;QACL,kBAAkB,EAAE,CAAC,CAAC,kBAAkB,IAAI,EAAE;QAC9C,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE;QACpC,YAAY,EAAE,CAAC,CAAC,YAAY,IAAI,EAAE;QAClC,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;QAC9C,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,KAAK;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,WAAW;KAChC,CAAC;AACJ,CAAC"}

package/dist/manifest/projections/mongoose/type-mapping.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Default mapping from IR `type.name` strings to Mongoose schema type strings.
+ *
+ * This table is the projection's sole interpreter of Manifest's open type
+ * vocabulary for Mongoose. The projection knows what any given IR type name
+ * means for Mongoose; nothing upstream carries Mongoose knowledge.
+ *
+ * Consumers can override per-property via `typeMappings`. Anything not in
+ * this table and not overridden produces a hard diagnostic — no fallback,
+ * no guessing. That is the contract.
+ *
+ * IMPORTANT: `'number'` is INTENTIONALLY ABSENT from this table.
+ * Manifest's `number` is ambiguous between integers, real numbers, and
+ * money. Silently mapping it to `Number` is exactly the class of silent
+ * bug this project exists to prevent. Authors must pick a precise type:
+ *   - `int` / `bigint` for counts and ids
+ *   - `float` for measurements where rounding is acceptable
+ *   - `money` / `decimal` for currency and other exact-decimal values
+ * Bare `number` produces a hard MONGOOSE_AMBIGUOUS_NUMBER diagnostic.
+ */
+/**
+ * Mongoose schema type representation.
+ *
+ * `schemaType` is the string used in Mongoose schema definitions:
+ *   - Simple types: 'String', 'Number', 'Boolean', 'Date', 'Buffer'
+ *   - Special types: 'Schema.Types.ObjectId', 'Schema.Types.Mixed',
+ *     'Schema.Types.Decimal128', 'Schema.Types.BigInt'
+ */
+export interface MongooseSchemaType {
+    /** Mongoose SchemaType string (e.g. 'String', 'Number', 'Date') */
+    schemaType: string;
+}
+declare const DEFAULT_TYPE_MAPPING: Readonly<Record<string, MongooseSchemaType>>;
+export { DEFAULT_TYPE_MAPPING };
+/**
+ * Resolve a Mongoose schema type for an IR `type.name`, given optional
+ * per-property overrides from projection config. Returns `undefined` when
+ * the name is unknown and no override is supplied — the caller MUST emit
+ * a diagnostic.
+ */
+export declare function resolveMongooseType(irTypeName: string, overrides: Readonly<Record<string, string>> | undefined, propertyName: string): MongooseSchemaType | undefined;
+//# sourceMappingURL=type-mapping.d.ts.map

package/dist/manifest/projections/mongoose/type-mapping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-mapping.d.ts","sourceRoot":"","sources":["../../../../src/manifest/projections/mongoose/type-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,QAAA,MAAM,oBAAoB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAqCrE,CAAC;AAEH,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,EACvD,YAAY,EAAE,MAAM,GACnB,kBAAkB,GAAG,SAAS,CAKhC"}

package/dist/manifest/projections/mongoose/type-mapping.js

@@ -0,0 +1,64 @@
+/**
+ * Default mapping from IR `type.name` strings to Mongoose schema type strings.
+ *
+ * This table is the projection's sole interpreter of Manifest's open type
+ * vocabulary for Mongoose. The projection knows what any given IR type name
+ * means for Mongoose; nothing upstream carries Mongoose knowledge.
+ *
+ * Consumers can override per-property via `typeMappings`. Anything not in
+ * this table and not overridden produces a hard diagnostic — no fallback,
+ * no guessing. That is the contract.
+ *
+ * IMPORTANT: `'number'` is INTENTIONALLY ABSENT from this table.
+ * Manifest's `number` is ambiguous between integers, real numbers, and
+ * money. Silently mapping it to `Number` is exactly the class of silent
+ * bug this project exists to prevent. Authors must pick a precise type:
+ *   - `int` / `bigint` for counts and ids
+ *   - `float` for measurements where rounding is acceptable
+ *   - `money` / `decimal` for currency and other exact-decimal values
+ * Bare `number` produces a hard MONGOOSE_AMBIGUOUS_NUMBER diagnostic.
+ */
+const DEFAULT_TYPE_MAPPING = Object.freeze({
+    // String family
+    string: { schemaType: 'String' },
+    text: { schemaType: 'String' },
+    uuid: { schemaType: 'String' },
+    email: { schemaType: 'String' },
+    url: { schemaType: 'String' },
+    // Boolean
+    boolean: { schemaType: 'Boolean' },
+    bool: { schemaType: 'Boolean' },
+    // Integer family — MongoDB Number is IEEE 754 double; fine for int32 range
+    int: { schemaType: 'Number' },
+    integer: { schemaType: 'Number' },
+    // Real number family
+    float: { schemaType: 'Number' },
+    // Exact decimal family — use Decimal128 for financial accuracy
+    decimal: { schemaType: 'Schema.Types.Decimal128' },
+    money: { schemaType: 'Schema.Types.Decimal128' },
+    // BigInt — supported natively in MongoDB 6.0+ via BSON Long
+    bigint: { schemaType: 'Schema.Types.BigInt' },
+    // Temporal
+    date: { schemaType: 'Date' },
+    datetime: { schemaType: 'Date' },
+    // Structured
+    json: { schemaType: 'Schema.Types.Mixed' },
+    object: { schemaType: 'Schema.Types.Mixed' },
+    any: { schemaType: 'Schema.Types.Mixed' },
+    // Binary
+    bytes: { schemaType: 'Buffer' },
+});
+export { DEFAULT_TYPE_MAPPING };
+/**
+ * Resolve a Mongoose schema type for an IR `type.name`, given optional
+ * per-property overrides from projection config. Returns `undefined` when
+ * the name is unknown and no override is supplied — the caller MUST emit
+ * a diagnostic.
+ */
+export function resolveMongooseType(irTypeName, overrides, propertyName) {
+    if (overrides && Object.prototype.hasOwnProperty.call(overrides, propertyName)) {
+        return { schemaType: overrides[propertyName] };
+    }
+    return DEFAULT_TYPE_MAPPING[irTypeName];
+}
+//# sourceMappingURL=type-mapping.js.map

package/dist/manifest/projections/mongoose/type-mapping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"type-mapping.js","sourceRoot":"","sources":["../../../../src/manifest/projections/mongoose/type-mapping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAeH,MAAM,oBAAoB,GAAiD,MAAM,CAAC,MAAM,CAAC;IACvF,gBAAgB;IAChB,MAAM,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAChC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC9B,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC9B,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC/B,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAE7B,UAAU;IACV,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;IAClC,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;IAE/B,2EAA2E;IAC3E,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAC7B,OAAO,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAEjC,qBAAqB;IACrB,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;IAE/B,+DAA+D;IAC/D,OAAO,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;IAClD,KAAK,EAAE,EAAE,UAAU,EAAE,yBAAyB,EAAE;IAEhD,4DAA4D;IAC5D,MAAM,EAAE,EAAE,UAAU,EAAE,qBAAqB,EAAE;IAE7C,WAAW;IACX,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAC5B,QAAQ,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;IAEhC,aAAa;IACb,IAAI,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE;IAC1C,MAAM,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE;IAC5C,GAAG,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE;IAEzC,SAAS;IACT,KAAK,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,OAAO,EAAE,oBAAoB,EAAE,CAAC;AAEhC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAkB,EAClB,SAAuD,EACvD,YAAoB;IAEpB,IAAI,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,YAAY,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,oBAAoB,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC"}

package/dist/manifest/projections/nextjs/defaults.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Default values applied to every Next.js projection option.
+ *
+ * Every key here corresponds to a documented option in
+ * `docs/spec/config/manifest.config.md` and a schema entry in
+ * `docs/spec/config/manifest.config.schema.json`. Adding a default here
+ * without updating both is a documentation drift.
+ */
+export declare const NEXTJS_DEFAULTS: {
+    readonly authProvider: "none";
+    readonly authImportPath: "@/lib/auth";
+    readonly databaseImportPath: "@/lib/database";
+    readonly responseImportPath: "@/lib/manifest-response";
+    readonly runtimeImportPath: "@/lib/manifest-runtime";
+    readonly includeTenantFilter: false;
+    readonly includeSoftDeleteFilter: false;
+    readonly tenantIdProperty: "tenantId";
+    readonly deletedAtProperty: "deletedAt";
+    readonly appDir: "app/api";
+    readonly strictMode: true;
+    readonly includeComments: true;
+    readonly indentSize: 2;
+    /**
+     * HTTP status returned when the auth check fails OR when the auth helper
+     * itself throws (e.g. invalid/expired token). 401 by default; some apps
+     * standardise on 403 to avoid leaking "user exists but unauthorized".
+     * Configurable per goal step 4 — auth failures must NEVER surface as 500.
+     */
+    readonly unauthorizedStatus: 401;
+};
+/**
+ * Default tenant provider hook.
+ *
+ * The projection assumes a tenant lookup helper of shape
+ *   `(id: string) => Promise<string | null>`
+ * imported from `importPath`. The lookup key (`orgId` vs `userId`) selects
+ * which auth-context field is passed in. Override via
+ * `projections.nextjs.options.tenantProvider`.
+ */
+export declare const DEFAULT_TENANT_PROVIDER: {
+    readonly importPath: "@/app/lib/tenant";
+    readonly functionName: "getTenantIdForOrg";
+    readonly lookupKey: "orgId";
+};
+/**
+ * Default Next.js dispatcher configuration.
+ *
+ * The dispatcher is the canonical write path at
+ *   POST /api/manifest/[entity]/commands/[command]
+ *
+ * `executionMode` controls *how* the dispatcher invokes Manifest:
+ *   - `inline`            — emit `createManifestRuntime` + `runtime.runCommand`
+ *                           inline in the handler (default, preserves
+ *                           historical behaviour).
+ *   - `externalExecutor`  — import an app-owned executor function and
+ *                           delegate to it. The handler becomes a thin
+ *                           transport adapter. Required when downstream
+ *                           apps centralise runtime construction.
+ *
+ * `deriveInstanceId` injects an `instanceId` derived from the URL/body
+ * into the executor call when true. Off by default to avoid surprising
+ * non-instance command callers.
+ */
+export declare const DISPATCHER_DEFAULTS: {
+    readonly enabled: true;
+    readonly executionMode: "inline";
+    readonly executorImportPath: "@/lib/manifest-executor";
+    readonly executorImportName: "executeManifestCommand";
+    /**
+     * Whether the dispatcher extracts an `instanceId` from `body.instanceId`
+     * or `body.id` and forwards it to runCommand / the executor.
+     *
+     * Default: true. Non-create commands (release, archive, update, ...) are
+     * the common case and Manifest's `runCommand` accepts `instanceId` via
+     * its third-argument options bag. Extracting always — even for create
+     * commands that don't need it — is safe because runtime ignores it when
+     * the action is a create-only path.
+     */
+    readonly deriveInstanceId: true;
+    /**
+     * Canonical dispatcher path relative to `appDir`. Exposed so apps that
+     * want a different prefix (e.g. `/api/v1/manifest/...`) can override
+     * without forking the projection.
+     */
+    readonly path: "/manifest/[entity]/commands/[command]/route.ts";
+};
+/**
+ * Default policy for the deprecated per-command "concrete" routes.
+ *
+ * When `enabled` is false, `nextjs.command` artifacts are suppressed
+ * entirely. When `legacyAliasesOnly` is true (default), generated concrete
+ * routes carry the DEPRECATED ALIAS banner and delegate to the dispatcher
+ * — they exist only for back-compat. Set both to true to keep emitting
+ * them but signal they are not the canonical surface.
+ */
+/**
+ * Default policy for the deprecated per-command "concrete" routes.
+ *
+ * `enabled` is **false by default** so the canonical-only write surface
+ * (the dispatcher) is the single entry point. Apps that still need
+ * per-command routes for legacy callers must opt in explicitly with
+ * `enabled: true`. When `legacyAliasesOnly` is true (default), generated
+ * concrete routes carry the DEPRECATED ALIAS banner pointing at the
+ * dispatcher.
+ *
+ * This was reversed from the previous default (true) per the
+ * dispatcher-only-by-default goal.
+ */
+export declare const CONCRETE_COMMAND_ROUTES_DEFAULTS: {
+    readonly enabled: false;
+    readonly legacyAliasesOnly: true;
+};
+/**
+ * Default policy for direct database read routes (GET list, GET detail).
+ *
+ * Both `enabled` and `directDbReads` default to true to preserve the
+ * historical behaviour of the projection emitting Prisma-backed read
+ * routes. Apps that prefer to author reads by hand or route them through
+ * a separate query layer can set `enabled: false` (no read routes at all)
+ * or `directDbReads: false` (route stubs only; no Prisma call inlined).
+ *
+ * Direct read routes assume a Prisma-compatible client. Manifest cannot
+ * fully decouple from that assumption without emitting a different
+ * surface; see docs/spec/config/manifest.config.md.
+ */
+export declare const READ_ROUTES_DEFAULTS: {
+    readonly enabled: true;
+    readonly directDbReads: true;
+};
+/**
+ * Default options for the Canonical Routes projection.
+ *
+ * These mirror the inline defaults in `routes/generator.ts` so the routes
+ * projection and the `manifest config` CLI agree on a single source of
+ * truth.
+ */
+export declare const ROUTES_DEFAULTS: {
+    readonly basePath: "/api";
+    readonly includeAuth: true;
+    readonly includeTenant: true;
+};
+/**
+ * Snapshot type for `manifest config print-defaults` output. Captures
+ * everything a downstream repo would need to reason about Manifest's
+ * unforced behaviour without reading source.
+ */
+export interface ManifestDefaultsSnapshot {
+    nextjs: typeof NEXTJS_DEFAULTS;
+    tenantProvider: typeof DEFAULT_TENANT_PROVIDER;
+    dispatcher: typeof DISPATCHER_DEFAULTS;
+    concreteCommandRoutes: typeof CONCRETE_COMMAND_ROUTES_DEFAULTS;
+    readRoutes: typeof READ_ROUTES_DEFAULTS;
+    routes: typeof ROUTES_DEFAULTS;
+}
+/**
+ * Build the full defaults snapshot. Used by the CLI and tests to render
+ * a stable, schema-aligned view of what Manifest will do when no user
+ * config is present.
+ */
+export declare function getManifestDefaultsSnapshot(): ManifestDefaultsSnapshot;
+//# sourceMappingURL=defaults.d.ts.map

package/dist/manifest/projections/nextjs/defaults.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../../../src/manifest/projections/nextjs/defaults.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;IAc1B;;;;;OAKG;;CAaH,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;CAI1B,CAAC;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,mBAAmB;;;;;IAK9B;;;;;;;;;OASG;;IAEH;;;;OAIG;;CAEK,CAAC;AAEX;;;;;;;;GAQG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gCAAgC;;;CAGnC,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,oBAAoB;;;CAGvB,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAC;AAEX;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,OAAO,eAAe,CAAC;IAC/B,cAAc,EAAE,OAAO,uBAAuB,CAAC;IAC/C,UAAU,EAAE,OAAO,mBAAmB,CAAC;IACvC,qBAAqB,EAAE,OAAO,gCAAgC,CAAC;IAC/D,UAAU,EAAE,OAAO,oBAAoB,CAAC;IACxC,MAAM,EAAE,OAAO,eAAe,CAAC;CAChC;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,IAAI,wBAAwB,CAStE"}

package/dist/manifest/projections/nextjs/defaults.js

@@ -0,0 +1,157 @@
+/**
+ * Default values applied to every Next.js projection option.
+ *
+ * Every key here corresponds to a documented option in
+ * `docs/spec/config/manifest.config.md` and a schema entry in
+ * `docs/spec/config/manifest.config.schema.json`. Adding a default here
+ * without updating both is a documentation drift.
+ */
+export const NEXTJS_DEFAULTS = {
+    authProvider: 'none',
+    authImportPath: '@/lib/auth',
+    databaseImportPath: '@/lib/database',
+    responseImportPath: '@/lib/manifest-response',
+    runtimeImportPath: '@/lib/manifest-runtime',
+    includeTenantFilter: false,
+    includeSoftDeleteFilter: false,
+    tenantIdProperty: 'tenantId',
+    deletedAtProperty: 'deletedAt',
+    appDir: 'app/api',
+    strictMode: true,
+    includeComments: true,
+    indentSize: 2,
+    /**
+     * HTTP status returned when the auth check fails OR when the auth helper
+     * itself throws (e.g. invalid/expired token). 401 by default; some apps
+     * standardise on 403 to avoid leaking "user exists but unauthorized".
+     * Configurable per goal step 4 — auth failures must NEVER surface as 500.
+     */
+    unauthorizedStatus: 401,
+};
+/**
+ * Default tenant provider hook.
+ *
+ * The projection assumes a tenant lookup helper of shape
+ *   `(id: string) => Promise<string | null>`
+ * imported from `importPath`. The lookup key (`orgId` vs `userId`) selects
+ * which auth-context field is passed in. Override via
+ * `projections.nextjs.options.tenantProvider`.
+ */
+export const DEFAULT_TENANT_PROVIDER = {
+    importPath: '@/app/lib/tenant',
+    functionName: 'getTenantIdForOrg',
+    lookupKey: 'orgId',
+};
+/**
+ * Default Next.js dispatcher configuration.
+ *
+ * The dispatcher is the canonical write path at
+ *   POST /api/manifest/[entity]/commands/[command]
+ *
+ * `executionMode` controls *how* the dispatcher invokes Manifest:
+ *   - `inline`            — emit `createManifestRuntime` + `runtime.runCommand`
+ *                           inline in the handler (default, preserves
+ *                           historical behaviour).
+ *   - `externalExecutor`  — import an app-owned executor function and
+ *                           delegate to it. The handler becomes a thin
+ *                           transport adapter. Required when downstream
+ *                           apps centralise runtime construction.
+ *
+ * `deriveInstanceId` injects an `instanceId` derived from the URL/body
+ * into the executor call when true. Off by default to avoid surprising
+ * non-instance command callers.
+ */
+export const DISPATCHER_DEFAULTS = {
+    enabled: true,
+    executionMode: 'inline',
+    executorImportPath: '@/lib/manifest-executor',
+    executorImportName: 'executeManifestCommand',
+    /**
+     * Whether the dispatcher extracts an `instanceId` from `body.instanceId`
+     * or `body.id` and forwards it to runCommand / the executor.
+     *
+     * Default: true. Non-create commands (release, archive, update, ...) are
+     * the common case and Manifest's `runCommand` accepts `instanceId` via
+     * its third-argument options bag. Extracting always — even for create
+     * commands that don't need it — is safe because runtime ignores it when
+     * the action is a create-only path.
+     */
+    deriveInstanceId: true,
+    /**
+     * Canonical dispatcher path relative to `appDir`. Exposed so apps that
+     * want a different prefix (e.g. `/api/v1/manifest/...`) can override
+     * without forking the projection.
+     */
+    path: '/manifest/[entity]/commands/[command]/route.ts',
+};
+/**
+ * Default policy for the deprecated per-command "concrete" routes.
+ *
+ * When `enabled` is false, `nextjs.command` artifacts are suppressed
+ * entirely. When `legacyAliasesOnly` is true (default), generated concrete
+ * routes carry the DEPRECATED ALIAS banner and delegate to the dispatcher
+ * — they exist only for back-compat. Set both to true to keep emitting
+ * them but signal they are not the canonical surface.
+ */
+/**
+ * Default policy for the deprecated per-command "concrete" routes.
+ *
+ * `enabled` is **false by default** so the canonical-only write surface
+ * (the dispatcher) is the single entry point. Apps that still need
+ * per-command routes for legacy callers must opt in explicitly with
+ * `enabled: true`. When `legacyAliasesOnly` is true (default), generated
+ * concrete routes carry the DEPRECATED ALIAS banner pointing at the
+ * dispatcher.
+ *
+ * This was reversed from the previous default (true) per the
+ * dispatcher-only-by-default goal.
+ */
+export const CONCRETE_COMMAND_ROUTES_DEFAULTS = {
+    enabled: false,
+    legacyAliasesOnly: true,
+};
+/**
+ * Default policy for direct database read routes (GET list, GET detail).
+ *
+ * Both `enabled` and `directDbReads` default to true to preserve the
+ * historical behaviour of the projection emitting Prisma-backed read
+ * routes. Apps that prefer to author reads by hand or route them through
+ * a separate query layer can set `enabled: false` (no read routes at all)
+ * or `directDbReads: false` (route stubs only; no Prisma call inlined).
+ *
+ * Direct read routes assume a Prisma-compatible client. Manifest cannot
+ * fully decouple from that assumption without emitting a different
+ * surface; see docs/spec/config/manifest.config.md.
+ */
+export const READ_ROUTES_DEFAULTS = {
+    enabled: true,
+    directDbReads: true,
+};
+/**
+ * Default options for the Canonical Routes projection.
+ *
+ * These mirror the inline defaults in `routes/generator.ts` so the routes
+ * projection and the `manifest config` CLI agree on a single source of
+ * truth.
+ */
+export const ROUTES_DEFAULTS = {
+    basePath: '/api',
+    includeAuth: true,
+    includeTenant: true,
+};
+/**
+ * Build the full defaults snapshot. Used by the CLI and tests to render
+ * a stable, schema-aligned view of what Manifest will do when no user
+ * config is present.
+ */
+export function getManifestDefaultsSnapshot() {
+    return {
+        nextjs: NEXTJS_DEFAULTS,
+        tenantProvider: DEFAULT_TENANT_PROVIDER,
+        dispatcher: DISPATCHER_DEFAULTS,
+        concreteCommandRoutes: CONCRETE_COMMAND_ROUTES_DEFAULTS,
+        readRoutes: READ_ROUTES_DEFAULTS,
+        routes: ROUTES_DEFAULTS,
+    };
+}
+//# sourceMappingURL=defaults.js.map

package/dist/manifest/projections/nextjs/defaults.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../../../src/manifest/projections/nextjs/defaults.ts"],"names":[],"mappings":"AAiBA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,YAAY,EAAE,MAAM;IACpB,cAAc,EAAE,YAAY;IAC5B,kBAAkB,EAAE,gBAAgB;IACpC,kBAAkB,EAAE,yBAAyB;IAC7C,iBAAiB,EAAE,wBAAwB;IAC3C,mBAAmB,EAAE,KAAK;IAC1B,uBAAuB,EAAE,KAAK;IAC9B,gBAAgB,EAAE,UAAU;IAC5B,iBAAiB,EAAE,WAAW;IAC9B,MAAM,EAAE,SAAS;IACjB,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE,IAAI;IACrB,UAAU,EAAE,CAAC;IACb;;;;;OAKG;IACH,kBAAkB,EAAE,GAAG;CAYvB,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,UAAU,EAAE,kBAAkB;IAC9B,YAAY,EAAE,mBAAmB;IACjC,SAAS,EAAE,OAAO;CACV,CAAC;AAEX;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,QAAiB;IAChC,kBAAkB,EAAE,yBAAyB;IAC7C,kBAAkB,EAAE,wBAAwB;IAC5C;;;;;;;;;OASG;IACH,gBAAgB,EAAE,IAAI;IACtB;;;;OAIG;IACH,IAAI,EAAE,gDAAgD;CAC9C,CAAC;AAEX;;;;;;;;GAQG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG;IAC9C,OAAO,EAAE,KAAK;IACd,iBAAiB,EAAE,IAAI;CACf,CAAC;AAEX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,IAAI;CACX,CAAC;AAEX;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,QAAQ,EAAE,MAAM;IAChB,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,IAAI;CACX,CAAC;AAgBX;;;;GAIG;AACH,MAAM,UAAU,2BAA2B;IACzC,OAAO;QACL,MAAM,EAAE,eAAe;QACvB,cAAc,EAAE,uBAAuB;QACvC,UAAU,EAAE,mBAAmB;QAC/B,qBAAqB,EAAE,gCAAgC;QACvD,UAAU,EAAE,oBAAoB;QAChC,MAAM,EAAE,eAAe;KACxB,CAAC;AACJ,CAAC"}

package/dist/manifest/projections/nextjs/generator.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Next.js App Router projection for Manifest IR.
+ *
+ * Generates Next.js API route handlers using App Router conventions.
+ * Configurable for different auth providers and database setups.
+ */
+import type { IR } from '../../ir';
+import type { ProjectionTarget, ProjectionRequest, ProjectionResult } from '../interface';
+/**
+ * Re-export the canonical defaults so consumers of
+ * `@angriff36/manifest/projections/nextjs` get the defaults from the same
+ * entry point as the projection class. Anything that needs to render or
+ * snapshot the defaults (CLI inspect, tests, downstream tooling) must use
+ * these names, not redeclare them.
+ */
+export { NEXTJS_DEFAULTS, DEFAULT_TENANT_PROVIDER, DISPATCHER_DEFAULTS, CONCRETE_COMMAND_ROUTES_DEFAULTS, READ_ROUTES_DEFAULTS, ROUTES_DEFAULTS, getManifestDefaultsSnapshot, type ManifestDefaultsSnapshot, } from './defaults.js';
+export type { ProjectionRequest, ProjectionArtifact, ProjectionDiagnostic, ProjectionResult, ProjectionTarget, NextJsProjectionOptions, } from '../interface';
+/**
+ * Next.js projection implementation.
+ */
+export declare class NextJsProjection implements ProjectionTarget {
+    readonly name = "nextjs";
+    readonly description = "Next.js App Router API routes with configurable auth and database support";
+    readonly surfaces: readonly ["nextjs.route", "nextjs.detail", "nextjs.command", "nextjs.dispatcher", "nextjs.subscribe", "nextjs.subscriptionHook", "nextjs.sharedRuntime", "nextjs.schedule", "ts.types", "ts.client"];
+    generate(ir: IR, request: ProjectionRequest): ProjectionResult;
+    private _route;
+    private _types;
+    private _client;
+    private _command;
+    /**
+     * Generate POST command handler for an entity command.
+     * Writes MUST flow through runtime.runCommand() to enforce guards, policies, and constraints.
+     */
+    private _generatePostCommandHandler;
+    /**
+     * Generate the canonical dispatcher route. Single dynamic file at
+     *   <appDir>/manifest/[entity]/commands/[command]/route.ts
+     * Resolves entity+command at request time and delegates to
+     * RuntimeEngine.runCommand. Single canonical write path for governed
+     * mutations; downstream integrations may add aliases or CI gates.
+     */
+    private _dispatcher;
+    private _generateDispatcherHandler;
+    /**
+     * Generate the SSE subscription route for a realtime entity.
+     * GET <appDir>/<entity>/subscribe/route.ts — streams runtime events whose
+     * subject.entity matches, over the shared singleton engine.
+     */
+    private _subscribe;
+    /**
+     * Generate a typed client-side EventSource hook for a realtime entity,
+     * with exponential-backoff reconnect.
+     */
+    private _subscriptionHook;
+    /**
+     * Generate the module-scoped singleton runtime accessor. Emitted only when
+     * the IR contains at least one realtime entity — SSE routes and command
+     * routes must share ONE engine instance for subscriptions to observe
+     * command events (the event stream is per-engine and in-memory).
+     */
+    private _sharedRuntime;
+    /**
+     * Generate detail (getById) route handler for an entity.
+     * Uses direct Prisma findUnique (bypassing runtime) for efficiency.
+     */
+    private _detail;
+    /**
+     * Generate GET route for an entity.
+     * Uses direct Prisma query (bypassing runtime) for efficiency.
+     */
+    private _generateGetRoute;
+    /**
+     * Generate GET detail route for a single entity instance.
+     * Uses direct Prisma findUnique (bypassing runtime) for efficiency.
+     */
+    private _generateDetailRoute;
+}
+//# sourceMappingURL=generator.d.ts.map

package/dist/manifest/projections/nextjs/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../../../src/manifest/projections/nextjs/generator.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,EAAE,EAAuB,MAAM,UAAU,CAAC;AACxD,OAAO,KAAK,EACV,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAGjB,MAAM,cAAc,CAAC;AAWtB;;;;;;GAMG;AACH,OAAO,EACL,eAAe,EACf,uBAAuB,EACvB,mBAAmB,EACnB,gCAAgC,EAChC,oBAAoB,EACpB,eAAe,EACf,2BAA2B,EAC3B,KAAK,wBAAwB,GAC9B,MAAM,eAAe,CAAC;AAOvB,YAAY,EACV,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AAobtB;;GAEG;AACH,qBAAa,gBAAiB,YAAW,gBAAgB;IACvD,QAAQ,CAAC,IAAI,YAAY;IACzB,QAAQ,CAAC,WAAW,+EAA+E;IACnG,QAAQ,CAAC,QAAQ,uMAAwM;IAEzN,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB;IAwP9D,OAAO,CAAC,MAAM;IAwBd,OAAO,CAAC,MAAM;IAcd,OAAO,CAAC,OAAO;IAqCf,OAAO,CAAC,QAAQ;IAoChB;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAoInC;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,0BAA0B;IAqJlC;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAuFlB;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAsGzB;;;;;OAKG;IACH,OAAO,CAAC,cAAc;IA2CtB;;;OAGG;IACH,OAAO,CAAC,OAAO;IAuBf;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAqDzB;;;OAGG;IACH,OAAO,CAAC,oBAAoB;CAmF7B"}