npm - @clef-sh/ui - Versions diffs - 0.1.28 → 0.1.29 - Mend

@clef-sh/ui 0.1.28 → 0.1.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (9) hide show

package/dist/client/assets/index-BmfzUjLY.css +1 -0
package/dist/client/assets/{index-DXZTFIp7.js → index-CGTwPvL1.js} +13 -13
package/dist/client/index.html +2 -2
package/dist/server/api.d.ts.map +1 -1
package/dist/server/api.js +90 -105
package/dist/server/api.js.map +1 -1
package/package.json +10 -10
package/src/client/useCapabilities.ts +66 -0
package/dist/client/assets/index-DbfsjTUx.css +0 -1

package/dist/client/index.html CHANGED Viewed

@@ -9,8 +9,8 @@
     <link rel="shortcut icon" href="/favicon.ico" />
     <!-- Fonts are bundled via @clef-sh/design/fonts.css (imported from
          styles.css) — no runtime dependency on Google Fonts. -->
-    <script type="module" crossorigin src="/assets/index-DXZTFIp7.js"></script>
-    <link rel="stylesheet" crossorigin href="/assets/index-DbfsjTUx.css">
+    <script type="module" crossorigin src="/assets/index-CGTwPvL1.js"></script>
+    <link rel="stylesheet" crossorigin href="/assets/index-BmfzUjLY.css">
   </head>
   <body>
     <div id="root"></div>

package/dist/server/api.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/server/api.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;~~AASpD~~,OAAO,EASL,gBAAgB,~~EA6BjB~~,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,~~CAgwDrD~~"}
1	+ {"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/server/api.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAqB,MAAM,SAAS,CAAC;AAGpD,OAAO,EASL,gBAAgB,EA4BjB,MAAM,eAAe,CAAC;AAIvB,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,gBAAgB,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CA0wDrD"}

package/dist/server/api.js CHANGED Viewed

@@ -36,97 +36,35 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createApiRouter = createApiRouter;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
-const os = __importStar(require("os"));
-const child_process_1 = require("child_process");
 const express_1 = require("express");
 const express_rate_limit_1 = __importStar(require("express-rate-limit"));
 const YAML = __importStar(require("yaml"));
-// On Linux, libuv creates socketpairs for child stdio. Go's os.Open on
-// /dev/stdin re-opens /proc/self/fd/0 which fails with ENXIO on socketpairs.
-// Use a FIFO workaround on Linux, but not inside Jest (where the runner is
-// mocked and real subprocesses are never spawned).
-const _useStdinFifo = process.platform === "linux" && !process.env.JEST_WORKER_ID;
 const core_1 = require("@clef-sh/core");
 const envelope_1 = require("./envelope");
 function createApiRouter(deps) {
     const router = (0, express_1.Router)();
     const parser = new core_1.ManifestParser();
     const matrix = new core_1.MatrixManager();
-    // Wrap the runner so sops subprocesses always run from the repo root
-    // and work around /dev/stdin failures on Linux.
-    //
-    // Problem: SopsClient.encrypt passes /dev/stdin as the input file.
-    // On Linux /dev/stdin → /proc/self/fd/0 which fails with ENXIO when
-    // the Node SEA binary was spawned with stdin detached.
-    //
-    // Fix: when we see /dev/stdin in the args AND stdin content in opts,
-    // replace it with a FIFO (named pipe). A FIFO is an in-memory kernel
-    // buffer — plaintext never touches disk. The FIFO is cleaned up after
-    // the subprocess exits.
-    const sopsRunner = {
-        run: (cmd, args, opts) => {
-            const stdinIdx = args.indexOf("/dev/stdin");
-            // Only use the FIFO workaround in Linux SEA binaries where
-            // /dev/stdin → /proc/self/fd/0 fails with ENXIO on socketpairs.
-            // Normal Node.js processes (including Jest on Linux CI) work fine.
-            const needsFifo = stdinIdx >= 0 && opts?.stdin !== undefined && _useStdinFifo;
-            if (!needsFifo) {
-                return deps.runner.run(cmd, args, {
-                    ...opts,
-                    cwd: opts?.cwd ?? deps.repoRoot,
-                    env: opts?.env,
-                });
-            }
-            // Create a FIFO and feed stdin content through a background process
-            const fifoDir = (0, child_process_1.execFileSync)("mktemp", ["-d", path.join(os.tmpdir(), "clef-fifo-XXXXXX")])
-                .toString()
-                .trim();
-            const fifoPath = path.join(fifoDir, "input");
-            (0, child_process_1.execFileSync)("mkfifo", [fifoPath]);
-            // Background writer — blocks at OS level until sops opens the read end
-            const writer = (0, child_process_1.spawn)("dd", [`of=${fifoPath}`, "status=none"], {
-                stdio: ["pipe", "ignore", "ignore"],
-            });
-            writer.stdin.write(opts.stdin);
-            writer.stdin.end();
-            const patchedArgs = [...args];
-            patchedArgs[stdinIdx] = fifoPath;
-            const { stdin: _stdin, ...restOpts } = opts;
-            return deps.runner
-                .run(cmd, patchedArgs, {
-                ...restOpts,
-                cwd: restOpts?.cwd ?? deps.repoRoot,
-                env: { SOPS_CONFIG: path.join(deps.repoRoot, ".sops.yaml"), ...restOpts?.env },
-            })
-                .finally(() => {
-                try {
-                    writer.kill();
-                }
-                catch {
-                    /* already exited */
-                }
-                try {
-                    (0, child_process_1.execFileSync)("rm", ["-rf", fifoDir]);
-                }
-                catch {
-                    /* best effort */
-                }
-            });
-        },
+    // Pin sops invocations to the repo root and apply the Linux FIFO
+    // workaround for /dev/stdin (see wrapWithLinuxStdinFifo).
+    const cwdRunner = {
+        run: (cmd, args, opts) => deps.runner.run(cmd, args, {
+            ...opts,
+            cwd: opts?.cwd ?? deps.repoRoot,
+        }),
     };
+    const sopsRunner = (0, core_1.wrapWithLinuxStdinFifo)(cwdRunner);
     const sops = new core_1.SopsClient(sopsRunner, deps.ageKeyFile, deps.ageKey, deps.sopsPath);
     const diffEngine = new core_1.DiffEngine();
     const schemaValidator = new core_1.SchemaValidator();
-    const lintRunner = new core_1.LintRunner(matrix, schemaValidator, sops);
     const git = new core_1.GitIntegration(deps.runner);
     const tx = new core_1.TransactionManager(git);
     const scanRunner = new core_1.ScanRunner(deps.runner);
-    const recipientManager = new core_1.RecipientManager(sops, matrix, tx);
-    const serviceIdManager = new core_1.ServiceIdentityManager(sops, matrix, tx);
-    const backendMigrator = new core_1.BackendMigrator(sops, matrix, tx);
-    const resetManager = new core_1.ResetManager(matrix, sops, schemaValidator, tx);
-    const syncManager = new core_1.SyncManager(matrix, sops, tx);
-    const structureManager = new core_1.StructureManager(matrix, sops, tx);
+    // Manifest-bound managers are constructed per-request so the manifest
+    // edits the user makes through other UI flows are picked up without
+    // restarting the server.
+    const buildSourceFor = (manifest) => (0, core_1.composeSecretSource)(new core_1.FilesystemStorageBackend(manifest, deps.repoRoot), sops, manifest);
+    const structureManager = new core_1.StructureManager(matrix, buildSourceFor, tx);
     // In-session scan cache
     let lastScanResult = null;
     let lastScanAt = null;
@@ -259,6 +197,19 @@ function createApiRouter(deps) {
         store: apiRateLimitStore,
     });
     router.use(apiLimiter);
+    // GET /api/capabilities — boolean trait descriptor for the composed
+    // source. Lets the UI client gate buttons (e.g. hide "Migrate backend"
+    // when the source can't migrate) without per-feature probing.
+    router.get("/capabilities", (_req, res) => {
+        try {
+            const manifest = loadManifest();
+            res.json((0, core_1.describeCapabilities)(buildSourceFor(manifest)));
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : "Failed to read capabilities";
+            res.status(500).json({ error: message, code: "CAPABILITIES_ERROR" });
+        }
+    });
     // GET /api/manifest
     router.get("/manifest", (_req, res) => {
         try {
@@ -274,7 +225,7 @@ function createApiRouter(deps) {
     router.get("/matrix", async (_req, res) => {
         try {
             const manifest = loadManifest();
-            const statuses = await matrix.getMatrixStatus(manifest, deps.repoRoot, sops);
+            const statuses = await matrix.getMatrixStatus(manifest, deps.repoRoot);
             res.json(statuses);
         }
         catch (err) {
@@ -300,12 +251,14 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            const filePath = `${deps.repoRoot}/${manifest.file_pattern.replace("{namespace}", ns).replace("{environment}", env)}`;
-            const decrypted = await sops.decrypt(filePath);
+            const source = buildSourceFor(manifest);
+            const ref = { namespace: ns, environment: env };
+            const decrypted = await source.readCell(ref);
             // Read pending keys from metadata (plaintext sidecar)
             let pending = [];
             try {
-                pending = await (0, core_1.getPendingKeys)(filePath);
+                const meta = await source.getPendingMetadata(ref);
+                pending = meta.pending.map((p) => p.key);
             }
             catch {
                 // Metadata unreadable — no pending info
@@ -358,8 +311,9 @@ function createApiRouter(deps) {
             const relCellPath = manifest.file_pattern
                 .replace("{namespace}", ns)
                 .replace("{environment}", env);
-            const filePath = `${deps.repoRoot}/${relCellPath}`;
-            const decrypted = await sops.decrypt(filePath);
+            const source = buildSourceFor(manifest);
+            const ref = { namespace: ns, environment: env };
+            const decrypted = await source.readCell(ref);
             // Inside the mutate callback we do the actual encrypt + metadata
             // update. When auto-commit is enabled this runs inside tx.run; when
             // disabled (batched edit flow) it runs directly.
@@ -367,16 +321,16 @@ function createApiRouter(deps) {
             const doWork = async () => {
                 if (random) {
                     decrypted.values[key] = (0, core_1.generateRandomValue)();
-                    await sops.encrypt(filePath, decrypted.values, manifest, env);
+                    await source.writeCell(ref, decrypted.values);
                     // Metadata update failure used to trigger an in-method rollback
                     // here. Inside tx.run, that rollback comes for free via git
                     // reset, so we just let the throw propagate.
-                    await (0, core_1.markPendingWithRetry)(filePath, [key], "clef ui");
+                    await source.markPending(ref, [key], "clef ui");
                     response = { success: true, key, pending: true };
                 }
                 else {
                     decrypted.values[key] = String(value);
-                    await sops.encrypt(filePath, decrypted.values, manifest, env);
+                    await source.writeCell(ref, decrypted.values);
                     // Validate against schema if defined
                     const nsDef = manifest.namespaces.find((n) => n.name === ns);
                     if (nsDef?.schema) {
@@ -396,11 +350,11 @@ function createApiRouter(deps) {
                             // Schema load failed — skip validation, not fatal
                         }
                     }
-                    // Real value set is a rotation event.  recordRotation also
+                    // Real value set is a rotation event. recordRotation also
                     // strips any matching pending entry, so this one call replaces
                     // the old markResolved + implicit pending cleanup.
                     try {
-                        await (0, core_1.recordRotation)(filePath, [key], "clef ui");
+                        await source.recordRotation(ref, [key], "clef ui");
                     }
                     catch {
                         // Metadata update failed — non-fatal
@@ -452,8 +406,9 @@ function createApiRouter(deps) {
             const relCellPath = manifest.file_pattern
                 .replace("{namespace}", ns)
                 .replace("{environment}", env);
-            const filePath = `${deps.repoRoot}/${relCellPath}`;
-            const decrypted = await sops.decrypt(filePath);
+            const source = buildSourceFor(manifest);
+            const ref = { namespace: ns, environment: env };
+            const decrypted = await source.readCell(ref);
             if (!(key in decrypted.values)) {
                 res.status(404).json({
                     error: `Key '${key}' not found in ${ns}/${env}.`,
@@ -463,12 +418,12 @@ function createApiRouter(deps) {
             }
             const doWork = async () => {
                 delete decrypted.values[key];
-                await sops.encrypt(filePath, decrypted.values, manifest, env);
+                await source.writeCell(ref, decrypted.values);
                 // Strip both pending and rotation records — the key no longer
                 // exists, so stale metadata would mislead policy.
                 try {
-                    await (0, core_1.markResolved)(filePath, [key]);
-                    await (0, core_1.removeRotation)(filePath, [key]);
+                    await source.markResolved(ref, [key]);
+                    await source.removeRotation(ref, [key]);
                 }
                 catch {
                     // Best effort — orphaned metadata is annoying but not dangerous
@@ -509,8 +464,9 @@ function createApiRouter(deps) {
             const relCellPath = manifest.file_pattern
                 .replace("{namespace}", ns)
                 .replace("{environment}", env);
-            const filePath = `${deps.repoRoot}/${relCellPath}`;
-            const decrypted = await sops.decrypt(filePath);
+            const source = buildSourceFor(manifest);
+            const ref = { namespace: ns, environment: env };
+            const decrypted = await source.readCell(ref);
             const value = key in decrypted.values ? String(decrypted.values[key]) : undefined;
             await tx.run(deps.repoRoot, {
                 description: `clef ui: accept ${ns}/${env}/${key}`,
@@ -521,7 +477,7 @@ function createApiRouter(deps) {
                     // rotation — it establishes a point-in-time "this is the
                     // current secret" assertion.  recordRotation also strips the
                     // pending entry.
-                    await (0, core_1.recordRotation)(filePath, [key], "clef ui (accept)");
+                    await source.recordRotation(ref, [key], "clef ui (accept)");
                 },
             });
             res.json({ success: true, key, value });
@@ -561,8 +517,11 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            const source = await sops.decrypt(fromCell.filePath);
-            if (!(key in source.values)) {
+            const cellSource = buildSourceFor(manifest);
+            const fromRef = { namespace: fromNs, environment: fromEnv };
+            const toRef = { namespace: toNs, environment: toEnv };
+            const sourceCell = await cellSource.readCell(fromRef);
+            if (!(key in sourceCell.values)) {
                 res.status(404).json({
                     error: `Key '${key}' not found in ${fromNs}/${fromEnv}.`,
                     code: "KEY_NOT_FOUND",
@@ -574,19 +533,19 @@ function createApiRouter(deps) {
                 description: `clef ui: copy ${key} from ${fromNs}/${fromEnv} to ${toNs}/${toEnv}`,
                 paths: [relToPath, relToPath.replace(/\.enc\.(yaml|json)$/, ".clef-meta.yaml")],
                 mutate: async () => {
-                    const dest = await sops.decrypt(toCell.filePath);
-                    const valueChanged = dest.values[key] !== source.values[key];
-                    dest.values[key] = source.values[key];
-                    await sops.encrypt(toCell.filePath, dest.values, manifest, toCell.environment);
+                    const dest = await cellSource.readCell(toRef);
+                    const valueChanged = dest.values[key] !== sourceCell.values[key];
+                    dest.values[key] = sourceCell.values[key];
+                    await cellSource.writeCell(toRef, dest.values);
                     // Only a real value change is a rotation.  Copying an identical
                     // value re-encrypts the ciphertext but does not rotate — matches
                     // the import semantics agreed in the design.
                     try {
                         if (valueChanged) {
-                            await (0, core_1.recordRotation)(toCell.filePath, [key], "clef ui (copy)");
+                            await cellSource.recordRotation(toRef, [key], "clef ui (copy)");
                         }
                         else {
-                            await (0, core_1.markResolved)(toCell.filePath, [key]);
+                            await cellSource.markResolved(toRef, [key]);
                         }
                     }
                     catch {
@@ -617,7 +576,13 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            const result = await diffEngine.diffFiles(ns, envA, envB, manifest, sops, deps.repoRoot);
+            // Compose a per-request SecretSource. The manifest is parsed
+            // per-request (it can change while the server runs), so the
+            // source is built here rather than at router construction.
+            const storage = new core_1.FilesystemStorageBackend(manifest, deps.repoRoot);
+            const encryption = sops;
+            const source = (0, core_1.composeSecretSource)(storage, encryption, manifest);
+            const result = await diffEngine.diffCells(ns, envA, envB, source);
             // Mask values by default — only reveal when client explicitly requests it
             if (req.query.showValues !== "true") {
                 for (const row of result.rows) {
@@ -646,6 +611,8 @@ function createApiRouter(deps) {
                 });
                 return;
             }
+            const lintSource = (0, core_1.composeSecretSource)(new core_1.FilesystemStorageBackend(manifest, deps.repoRoot), sops, manifest);
+            const lintRunner = new core_1.LintRunner(matrix, schemaValidator, lintSource);
             const result = await lintRunner.run(manifest, deps.repoRoot);
             const filtered = result.issues.filter((issue) => {
                 const issueNs = issue.file.split("/")[0];
@@ -782,6 +749,8 @@ function createApiRouter(deps) {
     router.get("/lint", async (_req, res) => {
         try {
             const manifest = loadManifest();
+            const lintSource = (0, core_1.composeSecretSource)(new core_1.FilesystemStorageBackend(manifest, deps.repoRoot), sops, manifest);
+            const lintRunner = new core_1.LintRunner(matrix, schemaValidator, lintSource);
             const result = await lintRunner.run(manifest, deps.repoRoot);
             res.json(result);
         }
@@ -794,6 +763,8 @@ function createApiRouter(deps) {
     router.post("/lint/fix", async (_req, res) => {
         try {
             const manifest = loadManifest();
+            const lintSource = (0, core_1.composeSecretSource)(new core_1.FilesystemStorageBackend(manifest, deps.repoRoot), sops, manifest);
+            const lintRunner = new core_1.LintRunner(matrix, schemaValidator, lintSource);
             const result = await lintRunner.fix(manifest, deps.repoRoot);
             res.json(result);
         }
@@ -1014,7 +985,8 @@ function createApiRouter(deps) {
                 });
                 return;
             }
-            const importRunner = new core_1.ImportRunner(sops, tx);
+            const importSource = (0, core_1.composeSecretSource)(new core_1.FilesystemStorageBackend(manifest, deps.repoRoot), sops, manifest);
+            const importRunner = new core_1.ImportRunner(importSource, tx);
             const result = await importRunner.import(target, null, content, manifest, deps.repoRoot, {
                 format,
                 dryRun: true,
@@ -1067,7 +1039,8 @@ function createApiRouter(deps) {
                 res.json({ imported: [], skipped: [], failed: [] });
                 return;
             }
-            const importRunner = new core_1.ImportRunner(sops, tx);
+            const importSource = (0, core_1.composeSecretSource)(new core_1.FilesystemStorageBackend(manifest, deps.repoRoot), sops, manifest);
+            const importRunner = new core_1.ImportRunner(importSource, tx);
             const result = await importRunner.import(target, null, content, manifest, deps.repoRoot, {
                 format,
                 keys,
@@ -1088,6 +1061,7 @@ function createApiRouter(deps) {
     router.get("/recipients", async (_req, res) => {
         try {
             const manifest = loadManifest();
+            const recipientManager = new core_1.RecipientManager(buildSourceFor(manifest), matrix, tx);
             const recipients = await recipientManager.list(manifest, deps.repoRoot);
             const cells = matrix.resolveMatrix(manifest, deps.repoRoot);
             const totalFiles = cells.filter((c) => c.exists).length;
@@ -1113,6 +1087,7 @@ function createApiRouter(deps) {
         try {
             const manifest = loadManifest();
             const { key, label } = req.body;
+            const recipientManager = new core_1.RecipientManager(buildSourceFor(manifest), matrix, tx);
             const result = await recipientManager.add(key, label, manifest, deps.repoRoot);
             res.json(result);
         }
@@ -1126,6 +1101,7 @@ function createApiRouter(deps) {
         try {
             const manifest = loadManifest();
             const { key } = req.body;
+            const recipientManager = new core_1.RecipientManager(buildSourceFor(manifest), matrix, tx);
             const result = await recipientManager.remove(key, manifest, deps.repoRoot);
             const cells = matrix.resolveMatrix(manifest, deps.repoRoot);
             const targets = cells.filter((c) => c.exists).map((c) => `${c.namespace}/${c.environment}`);
@@ -1209,6 +1185,7 @@ function createApiRouter(deps) {
                     };
                 }
             }
+            const serviceIdManager = new core_1.ServiceIdentityManager(buildSourceFor(manifest), matrix, tx);
             const result = await serviceIdManager.create(name, namespaces, description ?? "", manifest, deps.repoRoot, {
                 kmsEnvConfigs: typedKmsConfigs,
                 sharedRecipient: sharedRecipient === true,
@@ -1238,6 +1215,7 @@ function createApiRouter(deps) {
                 res.status(404).json({ error: `Service identity '${name}' not found.`, code: "NOT_FOUND" });
                 return;
             }
+            const serviceIdManager = new core_1.ServiceIdentityManager(buildSourceFor(manifest), matrix, tx);
             await serviceIdManager.delete(name, manifest, deps.repoRoot);
             res.json({ ok: true });
         }
@@ -1269,6 +1247,7 @@ function createApiRouter(deps) {
                 }
                 typedKmsConfigs[envName] = { provider: cfg.provider, keyId: cfg.keyId };
             }
+            const serviceIdManager = new core_1.ServiceIdentityManager(buildSourceFor(manifest), matrix, tx);
             await serviceIdManager.updateEnvironments(name, typedKmsConfigs, manifest, deps.repoRoot);
             res.json({ ok: true });
         }
@@ -1283,6 +1262,7 @@ function createApiRouter(deps) {
             const name = req.params.name;
             const { environment } = req.body;
             const manifest = loadManifest();
+            const serviceIdManager = new core_1.ServiceIdentityManager(buildSourceFor(manifest), matrix, tx);
             const privateKeys = await serviceIdManager.rotateKey(name, manifest, deps.repoRoot, environment);
             setNoCacheHeaders(res);
             res.json({ privateKeys });
@@ -1471,6 +1451,7 @@ function createApiRouter(deps) {
                 return;
             }
             const events = [];
+            const backendMigrator = new core_1.BackendMigrator(buildSourceFor, matrix, tx);
             const result = await backendMigrator.migrate(manifest, deps.repoRoot, { target, environment, dryRun: true }, (event) => events.push(event));
             res.json({ success: !result.rolledBack, result, events });
         }
@@ -1501,6 +1482,7 @@ function createApiRouter(deps) {
                 return;
             }
             const events = [];
+            const backendMigrator = new core_1.BackendMigrator(buildSourceFor, matrix, tx);
             const result = await backendMigrator.migrate(manifest, deps.repoRoot, { target, environment, dryRun: false }, (event) => events.push(event));
             res.json({ success: !result.rolledBack, result, events });
         }
@@ -1539,6 +1521,7 @@ function createApiRouter(deps) {
                 res.status(404).json({ error: message, code: "NOT_FOUND" });
                 return;
             }
+            const resetManager = new core_1.ResetManager(matrix, buildSourceFor, schemaValidator, tx);
             const result = await resetManager.reset({ scope, backend, key, keys }, manifest, deps.repoRoot);
             res.json({ success: true, result });
         }
@@ -1570,6 +1553,7 @@ function createApiRouter(deps) {
                     return;
                 }
             }
+            const syncManager = new core_1.SyncManager(matrix, buildSourceFor(manifest), tx);
             const plan = await syncManager.plan(manifest, deps.repoRoot, { namespace });
             res.json(plan);
         }
@@ -1593,6 +1577,7 @@ function createApiRouter(deps) {
                     return;
                 }
             }
+            const syncManager = new core_1.SyncManager(matrix, buildSourceFor(manifest), tx);
             const result = await syncManager.sync(manifest, deps.repoRoot, { namespace });
             res.json({ success: true, result });
         }