@appweaver/core 1.0.2 → 1.0.4

package/LICENSE

@@ -1 +1,21 @@
-UNLICENSED
+MIT License
+
+Copyright (c) 2026 Luka Matosevic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,7 +1,31 @@
 # Appweaver - Core
 
-> Simple, fast, and reliable web application builder tool.
+![npm](https://img.shields.io/npm/v/@appweaver/core)
+![NPM License](https://img.shields.io/npm/l/@appweaver/core)
+![npm](https://img.shields.io/npm/dw/@appweaver/core)
+![npm](https://img.shields.io/badge/build-passing-brightgreen)
+
+> The backend framework for AI-assisted development. Scaffold, extend, and ship APIs with any agent.
+
+Appweaver is a batteries-included framework built on top of **Fastify** and **Prisma**, designed from the ground up to
+be developed with AI agents. Instead of writing backend boilerplate from scratch, you describe resources using concise
+factory functions and let the framework handle routing, validation, database, auth, migrations, so you can focus
+on business logic instead of boilerplate.
+
+### Why Appweaver for agentic development?
+
+- **80% fewer tokens** → Appweaver's conventions and factory API eliminate the boilerplate that dominates most backend
+  codebases. Your agent reads and writes only the code that matters, not hundreds of lines of scaffolding.
+- **Zero-code configuration** → every framework behavior like server, database, auth, queues, mailer, storage is
+  controlled through `appweaver.json` config files or environment variables. No code changes are needed to reconfigure
+  the app for a different environment.
+- **Agent-first conventions** → a consistent, predictable project structure means agents always know where to find and
+  place code: models, services, routes, and policies each live in their own file under `src/resources/<name>/`.
+- **Built-in skill files** → every scaffolded project ships with agent-readable skill files that give your agent harness
+  a complete map of the framework's API, conventions, and CLI, which means no hallucination, and no trial-and-error.
+- **Works with any agent harness** → Claude Code, Cursor, Codex, Copilot Workspace, or any coding assistant that can
+  read project files. Point your agent at the skill files, and it has everything it needs.
 
 ## License
 
-UNLICENSED
+Appweaver is [MIT licensed](LICENSE).

package/factory/create-service.js

@@ -8,6 +8,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const common_1 = require("@appweaver/common");
 const context_1 = require("../context");
 const resource_1 = require("../resource");
+const security_1 = require("../security");
 function createService(config, override = false) {
     const name = (0, common_1.capitalize)(config.modelName || node_path_1.default.basename(node_path_1.default.dirname(__dirname)));
     class Service extends resource_1.ResourceService {
@@ -65,21 +66,24 @@ function createService(config, override = false) {
         async readRestrictions(action, data) {
             const policy = (0, context_1.injectPolicy)(name);
             if (policy.readRestrictions) {
-                return policy.readRestrictions(action, data) ?? {};
+                const user = (0, security_1.currentAuthUser)() ?? null;
+                return policy.readRestrictions(user, data, action) ?? {};
             }
             return super.readRestrictions(action, data);
         }
         async writeRestrictions(action, data) {
             const policy = (0, context_1.injectPolicy)(name);
             if (policy.writeRestrictions) {
-                return policy.writeRestrictions(action, data) ?? {};
+                const user = (0, security_1.currentAuthUser)() ?? null;
+                return policy.writeRestrictions(user, data, action) ?? {};
             }
             return super.writeRestrictions(action, data);
         }
         async checkAccess(action, resource) {
             const policy = (0, context_1.injectPolicy)(name);
             if (policy?.checkAccess) {
-                return policy.checkAccess(action, resource);
+                const user = (0, security_1.currentAuthUser)() ?? null;
+                return policy.checkAccess(user, resource, action);
             }
             return super.checkAccess(action, resource);
         }

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@appweaver/core",
-  "version": "1.0.2",
-  "description": "Appweaver - simple, fast, and reliable web application builder tool (@core)",
+  "version": "1.0.4",
+  "description": "Appweaver - the backend framework for AI-assisted development (@core)",
   "author": "Luka Matosevic",
-  "license": "UNLICENSED",
+  "license": "MIT",
   "main": "./index.js",
   "types": "./index.d.ts",
   "repository": {

package/security/resources/api-key/policy.js

@@ -1,17 +1,17 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const common_1 = require("@appweaver/common");
-const factory_1 = require("../../../factory");
 const helper_1 = require("../../helper");
+const factory_1 = require("../../../factory");
 function authModelField() {
     return (0, common_1.uncapitalize)((0, helper_1.resourceAuthModel)().name);
 }
 exports.default = common_1.config.SECURITY_API_KEY_ENABLED
     ? (0, factory_1.createPolicy)({
         modelName: 'ApiKey',
-        checkAccess: (action, resource) => {
+        checkAccess: (user, resource, action) => {
             const authFieldName = authModelField();
-            const currentAuthId = (0, helper_1.currentAuthUser)().id;
+            const currentAuthId = user.id;
             if (action === 'create') {
                 return resource[authFieldName].id === currentAuthId;
             }
@@ -19,8 +19,8 @@ exports.default = common_1.config.SECURITY_API_KEY_ENABLED
                 return resource[`${authFieldName}Id`] === currentAuthId;
             }
         },
-        readRestrictions: () => {
-            return { [authModelField()]: { id: (0, helper_1.currentAuthUser)().id } };
+        readRestrictions: (user) => {
+            return { [authModelField()]: { id: user.id } };
         }
     })
     : undefined;