@better-forge/config-as-code 0.0.0-stage → 0.1.0

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { backfillKeys, ENTITY_KEY_ERROR, ENTITY_KEY_PATTERN, isValidEntityKey, keyForNew, randomEntityKey, slugifyKey, type KeyOwner, type KeyResult, } from './keys.js';
+export { MAX_DOCUMENTS, readDocuments, toYaml, toYamlStream } from './yaml.js';
+export { byKey, canonical, clip, ConfigExportError, ConfigInvalidError, createVaultExporter, createVaultResolver, documentKey, findCycle, forbiddenNameAt, isObject, keyList, nestedDeeperThan, Problems, unknownFields, type ConfigProblem, type ConfigVaultRef, type Json, type VaultRows, } from './document.js';
+export { createConfigEngine, type ApplyContext, type AuditEntry, type ChangeAction, type ConfigChange, type ConfigEngine, type ConfigEngineOptions, type ConfigKind, type ExportContext, type ImportOptions, type ImportResult, type PlanContext, } from './engine.js';
+export { createConfigRoutes, type ConfigCaller, type ConfigRoutesOptions, type KindAccess } from './routes.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAC5G,KAAK,QAAQ,EAAE,KAAK,SAAS,GAC9B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC9E,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAChJ,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,EAC5D,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,IAAI,EAAE,KAAK,SAAS,GACnE,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,YAAY,EAAE,KAAK,mBAAmB,EAAE,KAAK,UAAU,EACtI,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,GAC5E,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,mBAAmB,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -0,0 +1,6 @@
+export { backfillKeys, ENTITY_KEY_ERROR, ENTITY_KEY_PATTERN, isValidEntityKey, keyForNew, randomEntityKey, slugifyKey, } from './keys.js';
+export { MAX_DOCUMENTS, readDocuments, toYaml, toYamlStream } from './yaml.js';
+export { byKey, canonical, clip, ConfigExportError, ConfigInvalidError, createVaultExporter, createVaultResolver, documentKey, findCycle, forbiddenNameAt, isObject, keyList, nestedDeeperThan, Problems, unknownFields, } from './document.js';
+export { createConfigEngine, } from './engine.js';
+export { createConfigRoutes } from './routes.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,GAE7G,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAC9E,OAAO,EACL,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAChJ,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,aAAa,GAE7D,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,kBAAkB,GAGnB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,kBAAkB,EAAgE,MAAM,aAAa,CAAA"}

package/dist/keys.d.ts

@@ -0,0 +1,24 @@
+import type { DatabaseSync } from 'node:sqlite';
+/** Keys appear in config files and URLs: lowercase, digits, `-` and `_`, starting with a letter or digit. */
+export declare const ENTITY_KEY_PATTERN: RegExp;
+export declare const ENTITY_KEY_ERROR = "Key must be 1-64 characters: lowercase letters, digits, \"-\" or \"_\", starting with a letter or digit";
+/** Fallback for rows inserted without a key (the routes derive one from the name instead). */
+export declare function randomEntityKey(): string;
+export declare function isValidEntityKey(value: unknown): value is string;
+export declare function slugifyKey(name: string): string;
+/** Resolves the id of the row holding `key`, if any. */
+export type KeyOwner = (key: string) => Promise<number | undefined>;
+export type KeyResult = {
+    key: string;
+} | {
+    status: 400 | 409;
+    error: string;
+};
+/** Key for a new row: the requested one when given (validated, must be free), else the first free slug of `name`. */
+export declare function keyForNew(name: string, requested: unknown, ownerOf: KeyOwner): Promise<KeyResult>;
+/**
+ * Gives every row of `tables` that has no key yet one made from its name, in id order, the same way `keyForNew` does
+ * for a new row (`name`, then `name-2`, `name-3`, ...). The tables need `id`, `name` and `key` columns.
+ */
+export declare function backfillKeys(sqlite: DatabaseSync, tables: readonly string[]): void;
+//# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAG/C,6GAA6G;AAC7G,eAAO,MAAM,kBAAkB,QAA+B,CAAA;AAC9D,eAAO,MAAM,gBAAgB,4GAAwG,CAAA;AAErI,8FAA8F;AAC9F,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAEhE;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW/C;AAED,wDAAwD;AACxD,MAAM,MAAM,QAAQ,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;AAEnE,MAAM,MAAM,SAAS,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAE9E,qHAAqH;AACrH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CASvG;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAalF"}

package/dist/keys.js

@@ -0,0 +1,56 @@
+import { randomBytes } from 'node:crypto';
+/** Keys appear in config files and URLs: lowercase, digits, `-` and `_`, starting with a letter or digit. */
+export const ENTITY_KEY_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
+export const ENTITY_KEY_ERROR = 'Key must be 1-64 characters: lowercase letters, digits, "-" or "_", starting with a letter or digit';
+/** Fallback for rows inserted without a key (the routes derive one from the name instead). */
+export function randomEntityKey() {
+    return `k-${randomBytes(5).toString('hex')}`;
+}
+export function isValidEntityKey(value) {
+    return typeof value === 'string' && ENTITY_KEY_PATTERN.test(value);
+}
+export function slugifyKey(name) {
+    const slug = name
+        .normalize('NFKD')
+        .replace(/[̀-ͯ]/g, '')
+        .replace(/[łŁ]/g, 'l') // does not decompose into l + diacritic
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48)
+        .replace(/-+$/, '');
+    return slug || 'item';
+}
+/** Key for a new row: the requested one when given (validated, must be free), else the first free slug of `name`. */
+export async function keyForNew(name, requested, ownerOf) {
+    if (requested !== undefined) {
+        if (!isValidEntityKey(requested))
+            return { status: 400, error: ENTITY_KEY_ERROR };
+        return (await ownerOf(requested)) === undefined ? { key: requested } : { status: 409, error: `Key "${requested}" is already in use` };
+    }
+    const base = slugifyKey(name);
+    let candidate = base;
+    for (let n = 2; (await ownerOf(candidate)) !== undefined; n++)
+        candidate = `${base}-${n}`;
+    return { key: candidate };
+}
+/**
+ * Gives every row of `tables` that has no key yet one made from its name, in id order, the same way `keyForNew` does
+ * for a new row (`name`, then `name-2`, `name-3`, ...). The tables need `id`, `name` and `key` columns.
+ */
+export function backfillKeys(sqlite, tables) {
+    for (const table of tables) {
+        const rows = sqlite.prepare(`SELECT id, name FROM ${table} WHERE key = '' ORDER BY id`).all();
+        const taken = new Set(sqlite.prepare(`SELECT key FROM ${table} WHERE key <> ''`).all().map((row) => row.key));
+        const assign = sqlite.prepare(`UPDATE ${table} SET key = ? WHERE id = ?`);
+        for (const { id, name } of rows) {
+            const base = slugifyKey(name);
+            let key = base;
+            for (let n = 2; taken.has(key); n++)
+                key = `${base}-${n}`;
+            taken.add(key);
+            assign.run(key, id);
+        }
+    }
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,6GAA6G;AAC7G,MAAM,CAAC,MAAM,kBAAkB,GAAG,4BAA4B,CAAA;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,qGAAqG,CAAA;AAErI,8FAA8F;AAC9F,MAAM,UAAU,eAAe;IAC7B,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAA;AAC9C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI;SACd,SAAS,CAAC,MAAM,CAAC;SACjB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,wCAAwC;SAC9D,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACrB,OAAO,IAAI,IAAI,MAAM,CAAA;AACvB,CAAC;AAOD,qHAAqH;AACrH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,SAAkB,EAAE,OAAiB;IACjF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAA;QACjF,OAAO,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,SAAS,qBAAqB,EAAE,CAAA;IACvI,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC7B,IAAI,SAAS,GAAG,IAAI,CAAA;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,EAAE;QAAE,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAA;IACzF,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAoB,EAAE,MAAyB;IAC1E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,wBAAwB,KAAK,6BAA6B,CAAC,CAAC,GAAG,EAAyC,CAAA;QACpI,MAAM,KAAK,GAAG,IAAI,GAAG,CAAE,MAAM,CAAC,OAAO,CAAC,mBAAmB,KAAK,kBAAkB,CAAC,CAAC,GAAG,EAA6B,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QACzI,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,KAAK,2BAA2B,CAAC,CAAA;QACzE,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;YAC7B,IAAI,GAAG,GAAG,IAAI,CAAA;YACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAA;YACzD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACd,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/routes.d.ts

@@ -0,0 +1,34 @@
+import type { FastifyInstance, FastifyRequest, onRequestAsyncHookHandler } from 'fastify';
+import type { ConfigEngine } from './engine.js';
+/** Who may export and import one kind of document. */
+export interface KindAccess {
+    /** The API token permission prefix: `<resource>:read` to export, `<resource>:write` to import. */
+    tokenResource: string;
+    /** The roles of a signed-in user who may export and import it. */
+    roles: readonly string[];
+    /** The role named in the message when a user may not. */
+    roleLabel: string;
+    /** Left out of a full export for a reader who may not see it, instead of refusing the whole export. */
+    optional?: boolean;
+}
+/** The caller of a request, as far as the routes need to know. */
+export interface ConfigCaller {
+    role: string;
+    apiToken?: {
+        scopes: readonly string[];
+    } | undefined;
+}
+export interface ConfigRoutesOptions<Actor> {
+    engine: ConfigEngine<any, any, Actor>;
+    access: Readonly<Record<string, KindAccess>>;
+    identity: (req: FastifyRequest) => ConfigCaller;
+    /** What the caller is recorded as in the audit log. */
+    actor: (req: FastifyRequest) => Actor;
+    /** Hooks that run before a file is read (the application's own role check). */
+    guards: readonly onRequestAsyncHookHandler[];
+    /** Kinds a file needs permission for beyond the kinds of its documents (for example the kind a document links to). */
+    linkedKinds?: (documents: unknown[]) => readonly string[];
+}
+/** The routes to export the configuration as YAML and to validate or apply a YAML file. A plugin to register with `app.register`. */
+export declare function createConfigRoutes<Actor>(options: ConfigRoutesOptions<Actor>): (app: FastifyInstance) => Promise<void>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgB,cAAc,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAA;AAGvG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO/C,sDAAsD;AACtD,MAAM,WAAW,UAAU;IACzB,kGAAkG;IAClG,aAAa,EAAE,MAAM,CAAA;IACrB,kEAAkE;IAClE,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,yDAAyD;IACzD,SAAS,EAAE,MAAM,CAAA;IACjB,uGAAuG;IACvG,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE;QAAE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE,GAAG,SAAS,CAAA;CACrD;AAED,MAAM,WAAW,mBAAmB,CAAC,KAAK;IAExC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;IACrC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5C,QAAQ,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,YAAY,CAAA;IAC/C,uDAAuD;IACvD,KAAK,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAA;IACrC,+EAA+E;IAC/E,MAAM,EAAE,SAAS,yBAAyB,EAAE,CAAA;IAC5C,sHAAsH;IACtH,WAAW,CAAC,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,SAAS,MAAM,EAAE,CAAA;CAC1D;AAED,qIAAqI;AACrI,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,KAAK,CAAC,IA6BxC,KAAK,eAAe,mBAuExD"}

package/dist/routes.js

@@ -0,0 +1,114 @@
+import { tokenAllows } from '@better-forge/contracts';
+import { clip, ConfigExportError, ConfigInvalidError } from './document.js';
+import { readDocuments, toYaml, toYamlStream } from './yaml.js';
+/** A configuration is a few hundred kilobytes at most; this leaves room without letting a request tie up the parser. */
+const BODY_LIMIT = 2 * 1024 * 1024;
+const YAML_TYPES = ['application/yaml', 'application/x-yaml', 'text/yaml'];
+/** The routes to export the configuration as YAML and to validate or apply a YAML file. A plugin to register with `app.register`. */
+export function createConfigRoutes(options) {
+    const { engine, access, identity } = options;
+    const kindNames = engine.kinds;
+    const tokenResources = kindNames.map((kind) => access[kind].tokenResource);
+    /** The kinds `caller` may not read (or write), with the reason, or null when it may do all of them. */
+    function refusal(caller, kinds, mode) {
+        const refused = [];
+        for (const kind of kinds) {
+            const rule = access[kind];
+            if (caller.apiToken) {
+                const needed = `${rule.tokenResource}:${mode}`;
+                if (!tokenAllows(caller.apiToken.scopes, needed))
+                    refused.push(`${kind} (the token needs "${needed}")`);
+            }
+            else if (!rule.roles.includes(caller.role)) {
+                refused.push(`${kind} (needs the ${rule.roleLabel} role)`);
+            }
+        }
+        return refused.length ? `You may not ${mode === 'read' ? 'export' : 'import'}: ${refused.join(', ')}` : null;
+    }
+    /** The kinds a file needs permission for: its own, and those its documents link to. */
+    function kindsNeeded(documents) {
+        const kinds = engine.kindsIn(documents);
+        for (const linked of options.linkedKinds?.(documents) ?? [])
+            kinds.add(linked);
+        return kinds;
+    }
+    const optionalKinds = kindNames.filter((kind) => access[kind].optional);
+    return async function configRoutes(app) {
+        // A YAML body is handed to the handler as text and parsed there, after the request has been authenticated.
+        app.addContentTypeParser(YAML_TYPES, { parseAs: 'string', bodyLimit: BODY_LIMIT }, (_req, body, done) => done(null, body));
+        // One document (`?kind=Note&key=first`), or all of them, as YAML.
+        app.get('/export', async (req, reply) => {
+            const { kind, key } = req.query;
+            if (kind !== undefined && !kindNames.includes(kind)) {
+                return reply.code(400).send({ error: `kind must be one of: ${kindNames.join(', ')}` });
+            }
+            if (kind !== undefined && !key)
+                return reply.code(400).send({ error: `key is required to export a ${kind}` });
+            const caller = identity(req);
+            const denied = refusal(caller, kind ? [kind] : kindNames.filter((each) => !optionalKinds.includes(each)), 'read');
+            if (denied)
+                return reply.code(403).send({ error: denied });
+            // Without a key a full export holds the optional kinds only for who may read them.
+            const included = new Set(kindNames.filter((each) => !optionalKinds.includes(each) || refusal(caller, [each], 'read') === null));
+            let documents;
+            try {
+                documents = await engine.exportDocuments(kind ? { kind, key: key } : undefined, { included });
+            }
+            catch (error) {
+                if (error instanceof ConfigExportError)
+                    return reply.code(409).send({ error: error.message });
+                throw error;
+            }
+            if (kind) {
+                const found = engine.pickDocument(documents, kind, key);
+                if (!found)
+                    return reply.code(404).send({ error: `There is no ${kind} with the key "${clip(String(key))}"` });
+                return reply.type('application/yaml; charset=utf-8').send(toYaml(found));
+            }
+            return reply.type('application/yaml; charset=utf-8').send(toYamlStream(documents));
+        });
+        async function run(req, reply, dryRun) {
+            const { prune } = req.query;
+            if (prune !== undefined && prune !== 'true' && prune !== 'false')
+                return reply.code(400).send({ error: 'prune must be true or false' });
+            const read = readDocuments(req.body);
+            if ('error' in read)
+                return reply.code(400).send({ error: read.error });
+            if (read.documents.length === 0)
+                return reply.code(400).send({ error: 'The file contains no documents' });
+            const caller = identity(req);
+            const denied = refusal(caller, kindsNeeded(read.documents), 'write');
+            if (denied)
+                return reply.code(403).send({ error: denied });
+            try {
+                return await engine.importDocuments(read.documents, { dryRun, actor: options.actor(req), token: caller.apiToken, prune: prune === 'true' });
+            }
+            catch (error) {
+                if (error instanceof ConfigInvalidError)
+                    return reply.code(400).send({ error: error.message, problems: error.problems });
+                throw error;
+            }
+        }
+        // Both check the caller before the body is read: parsing a 2 MiB file is work only someone who may import it may ask for.
+        // What the caller may import is decided per kind of document once the file is read.
+        const mayWriteSomething = async (req, reply) => {
+            const token = identity(req).apiToken;
+            if (token && !tokenResources.some((resource) => tokenAllows(token.scopes, `${resource}:write`))) {
+                const needs = tokenResources.map((resource) => `"${resource}:write"`);
+                return reply.code(403).send({ error: `This token has no permission to import: it needs ${needs.slice(0, -1).join(', ')} or ${needs.at(-1)}` });
+            }
+        };
+        // Only YAML is read, and this is checked before the body is, so a JSON body is never parsed.
+        const onlyYaml = async (req, reply) => {
+            const type = (req.headers['content-type'] ?? '').split(';')[0].trim().toLowerCase();
+            if (!YAML_TYPES.includes(type))
+                return reply.code(415).send({ error: 'Send the documents as YAML, with Content-Type: application/yaml' });
+        };
+        const routeOptions = { onRequest: [...options.guards, mayWriteSomething, onlyYaml], bodyLimit: BODY_LIMIT };
+        // What importing the documents would change, without changing anything.
+        app.post('/validate', routeOptions, (req, reply) => run(req, reply, true));
+        // Makes the installation match the documents, completely or not at all.
+        app.post('/apply', routeOptions, (req, reply) => run(req, reply, false));
+    };
+}
+//# sourceMappingURL=routes.js.map

package/dist/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,kBAAkB,EAAa,MAAM,eAAe,CAAA;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAE/D,wHAAwH;AACxH,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAClC,MAAM,UAAU,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,EAAE,WAAW,CAAC,CAAA;AAiC1E,qIAAqI;AACrI,MAAM,UAAU,kBAAkB,CAAQ,OAAmC;IAC3E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAA;IAC5C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAA;IAC9B,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,aAAa,CAAC,CAAA;IAE3E,uGAAuG;IACvG,SAAS,OAAO,CAAC,MAAoB,EAAE,KAAuB,EAAE,IAAsB;QACpF,MAAM,OAAO,GAAa,EAAE,CAAA;QAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAE,CAAA;YAC1B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAA;gBAC9C,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,sBAAsB,MAAM,IAAI,CAAC,CAAA;YACzG,CAAC;iBAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7C,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,eAAe,IAAI,CAAC,SAAS,QAAQ,CAAC,CAAA;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9G,CAAC;IAED,uFAAuF;IACvF,SAAS,WAAW,CAAC,SAAoB;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACvC,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC9E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAE,CAAC,QAAQ,CAAC,CAAA;IAExE,OAAO,KAAK,UAAU,YAAY,CAAC,GAAoB;QACrD,2GAA2G;QAC3G,GAAG,CAAC,oBAAoB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAE1H,kEAAkE;QAClE,GAAG,CAAC,GAAG,CAAmD,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxF,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,CAAA;YAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAA;YACxF,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,IAAI,EAAE,EAAE,CAAC,CAAA;YAE7G,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YACjH,IAAI,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAC1D,mFAAmF;YACnF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;YAE/H,IAAI,SAAiB,CAAA;YACrB,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAI,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,iBAAiB;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAA;gBAC7F,MAAM,KAAK,CAAA;YACb,CAAC;YACD,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;gBACvD,IAAI,CAAC,KAAK;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,eAAe,IAAI,kBAAkB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAA;gBAC7G,OAAO,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;YAC1E,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAA;QACpF,CAAC,CAAC,CAAA;QAEF,KAAK,UAAU,GAAG,CAAC,GAAuE,EAAE,KAAmB,EAAE,MAAe;YAC9H,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAAK,CAAA;YAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC,CAAA;YACvI,MAAM,IAAI,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACpC,IAAI,OAAO,IAAI,IAAI;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;YACvE,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC,CAAA;YACzG,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAA;YACpE,IAAI,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;YAE1D,IAAI,CAAC;gBACH,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,EAAE,CAAC,CAAA;YAC7I,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,kBAAkB;oBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAA;gBACxH,MAAM,KAAK,CAAA;YACb,CAAC;QACH,CAAC;QAED,0HAA0H;QAC1H,oFAAoF;QACpF,MAAM,iBAAiB,GAA8B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACxE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;YACpC,IAAI,KAAK,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,QAAQ,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAChG,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,QAAQ,SAAS,CAAC,CAAA;gBACrE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,oDAAoD,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAChJ,CAAC;QACH,CAAC,CAAA;QACD,6FAA6F;QAC7F,MAAM,QAAQ,GAA8B,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/D,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YACpF,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iEAAiE,EAAE,CAAC,CAAA;QAC3I,CAAC,CAAA;QACD,MAAM,YAAY,GAAG,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAA;QAC3G,wEAAwE;QACxE,GAAG,CAAC,IAAI,CAAqD,WAAW,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;QAC9H,wEAAwE;QACxE,GAAG,CAAC,IAAI,CAAqD,QAAQ,EAAE,YAAY,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;IAC9H,CAAC,CAAA;AACH,CAAC"}

package/dist/yaml.d.ts

@@ -0,0 +1,21 @@
+/** Documents one file may hold. */
+export declare const MAX_DOCUMENTS = 2000;
+/**
+ * No line folding: URLs and templates must stay on one line to be readable and diff well. Version 1.1 makes the
+ * writer quote what an older parser would misread ("22:00" is a number there, "yes" and "on" are booleans), so the
+ * file means the same to every YAML tool, Terraform's included.
+ */
+export declare function toYaml(value: unknown): string;
+/** Several documents in one YAML file, separated the usual way. */
+export declare const toYamlStream: (documents: unknown[]) => string;
+/**
+ * The documents of a YAML text, in the order they are written (empty ones left out), or the reason it was refused.
+ * The text is parsed with the YAML 1.2 core schema; a `%YAML` line would switch to rules under which `yes` is a
+ * boolean and `22:00` a number, so it is refused.
+ */
+export declare function readDocuments(body: unknown): {
+    documents: unknown[];
+} | {
+    error: string;
+};
+//# sourceMappingURL=yaml.d.ts.map

package/dist/yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.d.ts","sourceRoot":"","sources":["../src/yaml.ts"],"names":[],"mappings":"AAIA,mCAAmC;AACnC,eAAO,MAAM,aAAa,OAAQ,CAAA;AAUlC;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAY7C;AAED,mEAAmE;AACnE,eAAO,MAAM,YAAY,GAAI,WAAW,OAAO,EAAE,KAAG,MAA6C,CAAA;AAIjG;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,OAAO,GAAG;IAAE,SAAS,EAAE,OAAO,EAAE,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAmBzF"}

package/dist/yaml.js

@@ -0,0 +1,67 @@
+import { Document, parseAllDocuments, visit } from 'yaml';
+/** Anchors are legitimate in a hand-written file, but a few are plenty and unbounded aliases are a decompression bomb. */
+const MAX_YAML_ALIASES = 20;
+/** Documents one file may hold. */
+export const MAX_DOCUMENTS = 2_000;
+/** Longest part of a parser error that is repeated to the caller. */
+const MAX_ERROR_LENGTH = 300;
+/**
+ * Strings the library leaves bare although a parser reads them as something else: `<<` is the YAML 1.1 merge key (as a
+ * key it merges, or fails), and `0o17` is a number in YAML 1.2 but a string in 1.1.
+ */
+const NEEDS_QUOTES = /^(<<|=|0o[0-7]+)$/;
+/**
+ * No line folding: URLs and templates must stay on one line to be readable and diff well. Version 1.1 makes the
+ * writer quote what an older parser would misread ("22:00" is a number there, "yes" and "on" are booleans), so the
+ * file means the same to every YAML tool, Terraform's included.
+ */
+export function toYaml(value) {
+    const document = new Document(value, { version: '1.1' });
+    visit(document, {
+        Scalar(position, node) {
+            if (typeof node.value !== 'string' || !NEEDS_QUOTES.test(node.value))
+                return;
+            node.type = 'QUOTE_DOUBLE';
+            // The 1.1 schema recognises the string `<<` as the merge key and would write it bare whatever the style; as a
+            // key it needs an explicit string tag. As a value it is plain text and quoting is enough.
+            if (position === 'key' && node.value === '<<')
+                node.tag = 'tag:yaml.org,2002:str';
+        },
+    });
+    return document.toString({ lineWidth: 0 });
+}
+/** Several documents in one YAML file, separated the usual way. */
+export const toYamlStream = (documents) => documents.map(toYaml).join('---\n');
+const clip = (value, max) => value.length > max ? `${value.slice(0, max)}…` : value;
+/**
+ * The documents of a YAML text, in the order they are written (empty ones left out), or the reason it was refused.
+ * The text is parsed with the YAML 1.2 core schema; a `%YAML` line would switch to rules under which `yes` is a
+ * boolean and `22:00` a number, so it is refused.
+ */
+export function readDocuments(body) {
+    if (typeof body !== 'string')
+        return { error: 'Send the documents as YAML' };
+    if (/^%YAML/m.test(body))
+        return { error: 'Invalid YAML: %YAML directives are not supported' };
+    try {
+        const documents = [];
+        for (const document of parseAllDocuments(body)) {
+            if (document.errors.length)
+                throw document.errors[0];
+            const value = document.toJS({ maxAliasCount: MAX_YAML_ALIASES });
+            // An alias inside the thing it is an alias of (`a: &x { b: *x }`) parses into a circular object, which JSON
+            // cannot hold and nothing downstream could compare or store.
+            JSON.stringify(value);
+            if (value !== null && value !== undefined)
+                documents.push(value);
+            if (documents.length > MAX_DOCUMENTS)
+                return { error: `Too many documents: at most ${MAX_DOCUMENTS}` };
+        }
+        return { documents };
+    }
+    catch (error) {
+        const circular = error instanceof TypeError && /circular/i.test(error.message);
+        return { error: circular ? 'Invalid YAML: an alias may not refer to a value that contains it' : clip(`Invalid YAML: ${error instanceof Error ? error.message : String(error)}`, MAX_ERROR_LENGTH) };
+    }
+}
+//# sourceMappingURL=yaml.js.map

package/dist/yaml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"yaml.js","sourceRoot":"","sources":["../src/yaml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,MAAM,CAAA;AAEzD,0HAA0H;AAC1H,MAAM,gBAAgB,GAAG,EAAE,CAAA;AAC3B,mCAAmC;AACnC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,CAAA;AAClC,qEAAqE;AACrE,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAE5B;;;GAGG;AACH,MAAM,YAAY,GAAG,mBAAmB,CAAA;AAExC;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,KAAc;IACnC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;IACxD,KAAK,CAAC,QAAQ,EAAE;QACd,MAAM,CAAC,QAAQ,EAAE,IAAI;YACnB,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAM;YAC5E,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;YAC1B,8GAA8G;YAC9G,0FAA0F;YAC1F,IAAI,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;gBAAE,IAAI,CAAC,GAAG,GAAG,uBAAuB,CAAA;QACnF,CAAC;KACF,CAAC,CAAA;IACF,OAAO,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,SAAoB,EAAU,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAEjG,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAA;AAEnG;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAa;IACzC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAA;IAC5E,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,kDAAkD,EAAE,CAAA;IAC9F,IAAI,CAAC;QACH,MAAM,SAAS,GAAc,EAAE,CAAA;QAC/B,KAAK,MAAM,QAAQ,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM;gBAAE,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YACpD,MAAM,KAAK,GAAY,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC,CAAA;YACzE,4GAA4G;YAC5G,6DAA6D;YAC7D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;YACrB,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChE,IAAI,SAAS,CAAC,MAAM,GAAG,aAAa;gBAAE,OAAO,EAAE,KAAK,EAAE,+BAA+B,aAAa,EAAE,EAAE,CAAA;QACxG,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,CAAA;IACtB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,KAAK,YAAY,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC9E,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,kEAAkE,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAA;IACrM,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,51 @@
-{
-  "name": "@better-forge/config-as-code",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "@better-forge/config-as-code",
+  "version": "0.1.0",
+  "description": "YAML configuration engine with a registry of object kinds.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/BElluu/Better-Forge.git",
+    "directory": "packages/config-as-code"
+  },
+  "homepage": "https://github.com/BElluu/Better-Forge/tree/main/packages/config-as-code#readme",
+  "bugs": {
+    "url": "https://github.com/BElluu/Better-Forge/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src",
+    "!src/**/*.test.*"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput"
+  },
+  "peerDependencies": {
+    "fastify": "^5.3.2"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.3",
+    "fastify": "^5.3.2"
+  },
+  "dependencies": {
+    "yaml": "^2.9.1",
+    "@better-forge/contracts": "0.1.0"
+  },
+  "engines": {
+    "node": ">=26.10.0"
+  }
+}