@coffer-org/server 1.1.0 → 1.2.0

package/dist/index.js

@@ -1,49 +1,59 @@
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
 import { randomUUID } from 'node:crypto';
-import { createWriteStream, mkdirSync, existsSync } from 'node:fs';
+import { createWriteStream, existsSync } from 'node:fs';
+import { realpath } from 'node:fs/promises';
 import { pipeline } from 'node:stream/promises';
-import { extname, join } from 'node:path';
+import { extname, join, sep } from 'node:path';
+import { homedir } from 'node:os';
 import Fastify from 'fastify';
 import cors from '@fastify/cors';
 import multipart from '@fastify/multipart';
 import fastifyStatic from '@fastify/static';
 import { serialize } from '@mikro-orm/core';
-import { moduleToClient, fieldMap, textSearchKeys, titleKey, recordTitle, buildZodObject } from '@coffer-org/sdk/module';
-import { tokenize, matchScoreFolded, foldText } from '@coffer-org/core/search';
-import { extendToClient } from '@coffer-org/sdk/extend';
-import { extendEntityName, getExtendRecord } from './extend-table.js';
-import { moduleTableName } from './entity-schema.js';
-import { splitBody, saveExtends } from './extend-io.js';
-import { getEm } from './db.js';
-import { createRecord, getRecord, updateRecord, deleteRecord, ValidationError, NotFoundError } from './mutate.js';
-import { decodeTemporal, dtStringToDate } from './temporal.js';
-import { initPlugins, teardownPlugins, readDisabled, purgePluginData, getPluginSettings, getPlugins, } from './plugin-runtime.js';
-import { registerPluginsApi } from './plugins-api.js';
-// Завантажити app/.env (креденшели Telegram-бота тощо) ДО будь-чого, що читає env.
-// Робить app незалежним від ~/.profile. Наявні env-змінні мають пріоритет.
+import { textSearchKeys, recordTitle, buildZodObject } from '@coffer-org/sdk/module';
+import { tokenize } from '@coffer-org/core/search';
+import { moduleTableName } from "./entity-schema.js";
+import { getEm, closeDb } from "./db.js";
+import { ValidationError, NotFoundError, toIssue } from "./mutate.js";
+import { resolveEmbed } from "./embed.js";
+import { resolveWithinHome, filterSort, listDir } from "./fs-list.js";
+import { initPlugins, teardownPlugins, readDisabled, purgePluginData, getPluginSettings, getPlugins, } from "./plugin-runtime.js";
+import { registerPluginsApi } from "./plugins-api.js";
+import { buildClientSchema } from "./schema-api.js";
+import { recordList, recordGet, recordCreate, recordUpdate, recordDelete, rowMatch, UnknownTypeError } from "./records-api.js";
+import { maskTree, preserveTree } from "./secrets.js";
+import { uploadsDir } from "./uploads.js";
 const ENV_FILE = join(process.cwd(), '.env');
 if (existsSync(ENV_FILE))
     process.loadEnvFile(ENV_FILE);
 const PORT = Number(process.env.PORT ?? 7023);
-// initPlugins() сам ініціалізує ORM (двофазний bootstrap: системні таблиці →
-// _plugins → discoverEntity активних плагінів → syncSchema).
-// Життєвий цикл плагінів → АКТИВНИЙ реєстр (набір з БД _plugins).
 const reg = await initPlugins();
 const { vaults, modules, getModule, extends_, getExtendsFor } = reg;
-// Мапи: vault/type → ім'я сутності MikroORM (== ім'я таблиці) + ModuleDef.
 const entityNames = new Map();
 const moduleDefs = new Map();
 for (const m of modules) {
     entityNames.set(`${m.vault}/${m.module}`, moduleTableName(m.vault, m.module));
     moduleDefs.set(`${m.vault}/${m.module}`, m);
 }
-// Сховище медіа
-const UPLOADS = process.env.UPLOADS ?? join(process.cwd(), 'data', 'uploads');
-mkdirSync(UPLOADS, { recursive: true });
+const UPLOADS = uploadsDir();
 const app = Fastify({ logger: true });
 await app.register(cors, { origin: true });
 await app.register(multipart, { limits: { fileSize: 25 * 1024 * 1024 } });
-await app.register(fastifyStatic, { root: UPLOADS, prefix: '/uploads/' });
-// Завантаження файлу → повертає ім'я в /uploads
+await app.register(fastifyStatic, {
+    root: UPLOADS,
+    prefix: '/uploads/',
+    setHeaders: (res) => {
+        res.setHeader('Content-Security-Policy', 'sandbox');
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+    },
+});
 app.post('/api/upload', async (req, reply) => {
     const data = await req.file();
     if (!data)
@@ -53,10 +63,18 @@ app.post('/api/upload', async (req, reply) => {
     await pipeline(data.file, createWriteStream(join(UPLOADS, name)));
     return reply.send({ filename: name });
 });
+app.post('/api/embed', async (req, reply) => {
+    const url = req.body?.url;
+    if (!url || typeof url !== 'string')
+        return reply.code(400).send({ error: 'no_url' });
+    const rec = await resolveEmbed(url);
+    if (!rec)
+        return reply.code(422).send({ error: 'unresolved' });
+    return reply.send(rec);
+});
 function key(vault, type) {
     return `${vault}/${type}`;
 }
-// ─── Error helper ─────────────────────────────────────────────────────────────
 async function guard(reply, fn) {
     try {
         return await fn();
@@ -70,25 +88,16 @@ async function guard(reply, fn) {
         return reply.code(500).send({ error: 'internal' });
     }
 }
-// ─── Helper: додати _extends до запису ────────────────────────────────────────
-async function withExtends(record, vault, module) {
-    const matchedExtends = getExtendsFor(vault, module);
-    if (!matchedExtends.length)
-        return record;
-    const _extends = {};
-    await Promise.all(matchedExtends.map(async (e) => {
-        const data = await getExtendRecord(extendEntityName(e), String(record.id));
-        _extends[e.id] = data ?? null;
-    }));
-    return { ...record, _extends };
-}
-// ─── Vaults / schema ──────────────────────────────────────────────────────────
-app.get('/api/vaults', () => vaults.map((v) => ({
-    ...v.meta,
-    modules: v.modules.map(moduleToClient),
-    extends: extends_.filter((e) => e.attachTo.some((r) => r.vault === v.meta.id)).map(extendToClient),
-})));
-// ─── Лічильники записів для Dashboard (усі standalone-модулі активних плагінів) ──
+app.get('/health', async (_req, reply) => {
+    try {
+        await getEm().getConnection().execute('select 1');
+        return { status: 'ok' };
+    }
+    catch {
+        return reply.code(503).send({ status: 'db_unavailable' });
+    }
+});
+app.get('/api/vaults', () => buildClientSchema());
 app.get('/api/counts', async () => {
     const fork = getEm().fork();
     const out = {};
@@ -102,30 +111,6 @@ app.get('/api/counts', async () => {
     }
     return out;
 });
-/**
- * Матч запису модуля проти токенів пошуку — спільне для глобального та спискового
- * пошуку. Заголовок (titleKey) важить більше за інші текстові поля. Повертає
- * score + сниппет (перше «інше» поле з токеном, інакше заголовок), або null якщо
- * не матч. Поля згортаються один раз і перевикористовуються (score + сниппет).
- */
-function rowMatch(mdef, row, tokens) {
-    const textKeys = textSearchKeys(mdef);
-    if (!textKeys.length)
-        return null;
-    const tk = titleKey(mdef);
-    const otherKeys = textKeys.filter((key) => key !== tk);
-    const label = recordTitle(mdef, row);
-    const otherRaw = otherKeys.map((key) => String(row[key] ?? ''));
-    const foldedOthers = otherRaw.map(foldText);
-    const score = matchScoreFolded(foldText(label), foldedOthers, tokens);
-    if (score === null)
-        return null;
-    const hitIdx = foldedOthers.findIndex((f) => tokens.some((t) => f.includes(t)));
-    const raw = (hitIdx >= 0 ? otherRaw[hitIdx] : label) ?? label;
-    const snippet = raw.length > 120 ? raw.slice(0, 120) + '…' : raw;
-    return { score, snippet };
-}
-// ─── Глобальний пошук ─────────────────────────────────────────────────────────
 app.get('/api/search', async (req) => {
     const { q = '', limit = '20' } = req.query;
     const tokens = tokenize(q);
@@ -143,7 +128,6 @@ app.get('/api/search', async (req) => {
         if (!textSearchKeys(mdef).length)
             continue;
         const [vault, type] = k.split('/');
-        // Cap на модуль — захист від великих таблиць (персональний масштаб).
         const rows = (await fork.find(ename, {}, { limit: 1000 })).map((r) => serialize(r));
         for (const row of rows) {
             const m = rowMatch(mdef, row, tokens);
@@ -159,9 +143,6 @@ app.get('/api/search', async (req) => {
     scored.sort((a, b) => b.score - a.score);
     return scored.slice(0, lim).map((s) => s.result);
 });
-// ─── Plugins (дашборд: набір активних плагінів живе в _plugins) ───────────────
-// NB: GET /api/plugins тепер постачає registerPluginsApi (web-federation маніфест
-// з asset-URL). Решта plugin-management ендпоінтів (PATCH/DELETE/settings) лишаються тут.
 app.patch('/api/plugins/:id', async (req, reply) => {
     const { id } = req.params;
     const { enabled } = (req.body ?? {});
@@ -192,11 +173,8 @@ app.patch('/api/plugins/:id', async (req, reply) => {
         fork.create('_Plugin', { id, enabled: enabled ? 1 : 0, updated_at: new Date().toISOString() });
     }
     await fork.flush();
-    // Зміна набору активних плагінів застосовується на наступному старті сервера.
     return { ok: true, restartRequired: true };
 });
-// ЯВНЕ видалення даних плагіна (безповоротне): DROP таблиць + enabled=0.
-// Toggle (PATCH) даних не чіпає — це окрема свідома дія.
 app.delete('/api/plugins/:id/data', async (req, reply) => {
     const { id } = req.params;
     const plugins = await getPlugins();
@@ -221,7 +199,7 @@ app.get('/api/plugins/:id/settings', async (req, reply) => {
         return reply.code(404).send({ error: 'no_settings' });
     }
     const row = await getPluginSettings(id);
-    return row;
+    return maskTree(p.settings.fields, row);
 });
 app.put('/api/plugins/:id/settings', (req, reply) => guard(reply, async () => {
     const { id } = req.params;
@@ -236,29 +214,19 @@ app.put('/api/plugins/:id/settings', (req, reply) => guard(reply, async () => {
         label: `${id}.plugin.label`,
         fields: p.settings.fields,
     };
-    const parsed = buildZodObject(syntheticMod).safeParse(req.body ?? {});
+    const existing = await getPluginSettings(id);
+    const body = preserveTree(p.settings.fields, (req.body ?? {}), existing);
+    const parsed = buildZodObject(syntheticMod).safeParse(body);
     if (!parsed.success) {
-        throw new ValidationError(parsed.error.issues.map((i) => {
-            const field = String(i.path[0] ?? '');
-            try {
-                const m = JSON.parse(i.message);
-                if (typeof m.code === 'string')
-                    return { field, code: m.code, params: m.params };
-            }
-            catch {
-                /* */
-            }
-            return { field, code: 'invalid' };
-        }));
+        throw new ValidationError(parsed.error.issues.map(toIssue));
     }
     const entityName = `_settings__${id}`;
     const row = { plugin_id: id, ...parsed.data };
     await getEm()
         .fork()
         .upsert(entityName, row);
-    return { ok: true, row };
+    return { ok: true, row: maskTree(p.settings.fields, row) };
 }));
-// ─── Nextcloud: test connection ───────────────────────────────────────────────
 app.post('/api/plugins/nextcloud/test', async (_req, reply) => {
     const settings = await getPluginSettings('nextcloud');
     const url = settings['nextcloud_url'];
@@ -267,132 +235,237 @@ app.post('/api/plugins/nextcloud/test', async (_req, reply) => {
     if (!url || !login || !password) {
         return reply.code(400).send({ error: 'Nextcloud settings not configured. Save them first.' });
     }
-    // Змінний специфікатор (не літерал): server не тягне @coffer-org/plugin-nextcloud у свою
-    // tsc-програму (розрив циклу server↔плагіни). Generic plugin-routes — окреме питання.
     const ncRuntime = '@coffer-org/plugin-nextcloud/runtime';
-    const { checkNextcloudConnection } = (await import(ncRuntime));
+    const { checkNextcloudConnection } = (await import(__rewriteRelativeImportExtension(ncRuntime)));
     const result = await checkNextcloudConnection(url, login, password);
     if (result.ok)
         return { ok: true };
     return reply.code(400).send({ error: result.error });
 });
-// ─── Records CRUD ─────────────────────────────────────────────────────────────
-/** Привести значення фільтра (з query — завжди рядок) до типу колонки MikroORM. */
-function coerceFilter(v, column) {
-    if (column === 'integer' || column === 'real') {
-        const n = Number(v);
-        return Number.isNaN(n) ? v : n;
-    }
-    if (column === 'boolean')
-        return v === 'true' || v === '1';
-    if (column === 'datetime')
-        return dtStringToDate(v); // фільтр-рядок → Date під тип колонки
-    return v; // date/time лишаються рядками
+app.post('/api/plugins/finance/test', async (_req, reply) => {
+    const settings = await getPluginSettings('finance');
+    const url = settings['firefly_url'];
+    const token = settings['token'];
+    if (!url || !token) {
+        return reply.code(400).send({ error: 'Finance settings not configured. Save them first.' });
+    }
+    const finRuntime = '@coffer-org/plugin-finance/runtime';
+    const { checkFireflyConnection } = (await import(__rewriteRelativeImportExtension(finRuntime)));
+    const result = await checkFireflyConnection(url, token);
+    if (result.ok)
+        return { ok: true };
+    return reply.code(400).send({ error: result.error });
+});
+app.post('/api/plugins/finance/sync', async (_req, reply) => {
+    const finRuntime = '@coffer-org/plugin-finance/runtime';
+    const { runSync } = (await import(__rewriteRelativeImportExtension(finRuntime)));
+    try {
+        const counts = await runSync();
+        return { ok: true, ...counts };
+    }
+    catch (e) {
+        return reply.code(400).send({ error: e.message });
+    }
+});
+app.post('/api/plugins/finance/import-wise', async (_req, reply) => {
+    const finRuntime = '@coffer-org/plugin-finance/runtime';
+    const { importWise } = (await import(__rewriteRelativeImportExtension(finRuntime)));
+    try {
+        return await importWise();
+    }
+    catch (e) {
+        return reply.code(400).send({ error: e.message });
+    }
+});
+app.post('/api/plugins/devices/scan', async (_req, reply) => {
+    const devRuntime = '@coffer-org/plugin-devices/runtime';
+    const { runScan } = (await import(__rewriteRelativeImportExtension(devRuntime)));
+    try {
+        const result = await runScan({ create: true });
+        return { ok: true, result };
+    }
+    catch (e) {
+        if (e instanceof ValidationError) {
+            const detail = e.issues.map((i) => `${i.path.join('.') || i.field}: ${i.code}`).join('; ');
+            return reply.code(422).send({ error: `Validation error during scan — ${detail}`, issues: e.issues });
+        }
+        return reply.code(409).send({ error: e.message });
+    }
+});
+app.post('/api/plugins/media/test', async (_req, reply) => {
+    const settings = await getPluginSettings('media');
+    const url = settings['jellyfin_url'];
+    const token = settings['jellyfin_token'];
+    if (!url || !token) {
+        return reply.code(400).send({ error: 'Jellyfin settings not configured. Save them first.' });
+    }
+    const mediaRuntime = '@coffer-org/plugin-media/runtime';
+    const { testConnection } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
+    const result = await testConnection(url, token);
+    if (result.ok)
+        return { ok: true };
+    return reply.code(400).send({ error: result.error });
+});
+app.post('/api/plugins/media/sync', async (_req, reply) => {
+    const mediaRuntime = '@coffer-org/plugin-media/runtime';
+    const { runJellyfinSync } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
+    try {
+        const counts = await runJellyfinSync();
+        return { ok: true, ...counts };
+    }
+    catch (e) {
+        return reply.code(400).send({ error: e.message });
+    }
+});
+app.post('/api/plugins/media/add', async (req, reply) => {
+    const { query, tmdb_id, kind } = (req.body ?? {});
+    const mediaRuntime = '@coffer-org/plugin-media/runtime';
+    const { addTitle } = (await import(__rewriteRelativeImportExtension(mediaRuntime)));
+    try {
+        return await addTitle(query, tmdb_id, kind);
+    }
+    catch (e) {
+        return reply.code(400).send({ error: e.message });
+    }
+});
+app.get('/api/fs/list', async (req, reply) => {
+    const home = homedir();
+    const q = req.query;
+    const r = resolveWithinHome(q.path ?? '', home);
+    if ('error' in r)
+        return reply.code(403).send({ error: r.error });
+    let abs;
+    try {
+        abs = await realpath(r.abs);
+    }
+    catch {
+        return { dir: r.abs, entries: [] };
+    }
+    if (abs !== home && !abs.startsWith(home + sep))
+        return reply.code(403).send({ error: 'outside_home' });
+    try {
+        const entries = filterSort(await listDir(abs), q.exts ? q.exts.split(',') : undefined);
+        return { dir: abs, entries };
+    }
+    catch {
+        return { dir: abs, entries: [] };
+    }
+});
+function maskRecordRow(vault, type, row) {
+    const m = getModule(vault, type);
+    let out = m ? maskTree(m.fields, row) : row;
+    const ext = out._extends;
+    if (ext) {
+        const defs = getExtendsFor(vault, type);
+        const maskedExt = {};
+        for (const [id, sub] of Object.entries(ext)) {
+            const def = defs.find((e) => e.id === id);
+            maskedExt[id] = sub && def ? maskTree(def.fields, sub) : sub;
+        }
+        out = { ...out, _extends: maskedExt };
+    }
+    return out;
 }
 app.get('/api/:vault/:type', async (req, reply) => {
     const { vault, type } = req.params;
     const query = req.query;
-    const { q, ...filterParams } = query;
-    const ename = entityNames.get(key(vault, type));
-    const mdef = moduleDefs.get(key(vault, type));
-    if (!ename)
-        return reply.code(404).send({ error: 'unknown_type' });
-    // Збираємо фільтри за полями модуля (наприклад: trip_id=xxx, brand=Apple).
-    const where = {};
-    // Значення з query — рядки,
-    // тому приводимо до типу колонки (boolean/number) під типи сутності.
-    if (mdef) {
-        const fm = fieldMap(mdef.fields);
-        for (const [k, v] of Object.entries(filterParams)) {
-            const fieldDef = fm[k];
-            if (fieldDef && !fieldDef.virtual)
-                where[k] = coerceFilter(v, fieldDef.column);
-        }
+    try {
+        const rows = await recordList(vault, type, query);
+        return rows.map((r) => maskRecordRow(vault, type, r));
+    }
+    catch (e) {
+        if (e instanceof UnknownTypeError)
+            return reply.code(404).send({ error: 'unknown_type' });
+        throw e;
     }
-    // Точкова вибірка за id (comma-separated): резолв relation-цілей,
-    // зокрема standalone:false-модулів, що не перелічуються глобально.
-    if (filterParams.id) {
-        const ids = String(filterParams.id)
-            .split(',')
-            .map((s) => s.trim())
-            .filter(Boolean);
-        if (ids.length)
-            where['id'] = ids.length === 1 ? ids[0] : { $in: ids };
-    }
-    // standalone:false-модулі не перелічуються глобально — лише точкова вибірка
-    // (за полем-фільтром або id). Порожній where → порожній список.
-    if (mdef?.standalone === false && Object.keys(where).length === 0)
-        return [];
-    const fork = getEm().fork();
-    let rows = (await fork.find(ename, where)).map((r) => serialize(r));
-    // Текстовий пошук — у JS (SQLite LIKE не сворачивает кириличний регістр).
-    // Порядок/сортування лишаємо клієнту (TypeView сортує по колонках) — без ранжування.
-    const tokens = q ? tokenize(q) : [];
-    if (tokens.length > 0 && mdef) {
-        rows = rows.filter((row) => rowMatch(mdef, row, tokens) !== null);
-    }
-    const decoded = mdef ? rows.map((r) => decodeTemporal(mdef, r)) : rows;
-    return Promise.all(decoded.map((row) => withExtends(row, vault, type)));
 });
 app.get('/api/:vault/:type/:id', async (req, reply) => {
     const { vault, type, id } = req.params;
-    const ename = entityNames.get(key(vault, type));
-    const mdef = moduleDefs.get(key(vault, type));
-    if (!ename || mdef?.standalone === false)
-        return reply.code(404).send({ error: 'unknown_type' });
-    if (!mdef)
-        return reply.code(404).send({ error: 'unknown_type' });
-    const row = await getRecord(mdef, ename, id);
-    if (!row)
-        return reply.code(404).send({ error: 'not_found' });
-    return withExtends(row, vault, type);
+    const rid = Number(id);
+    if (isNaN(rid))
+        return reply.code(400).send({ error: 'invalid_id' });
+    try {
+        const row = await recordGet(vault, type, rid);
+        if (!row)
+            return reply.code(404).send({ error: 'not_found' });
+        return maskRecordRow(vault, type, row);
+    }
+    catch (e) {
+        if (e instanceof UnknownTypeError)
+            return reply.code(404).send({ error: 'unknown_type' });
+        throw e;
+    }
 });
 app.post('/api/:vault/:type', (req, reply) => guard(reply, async () => {
     const { vault, type } = req.params;
-    const m = getModule(vault, type);
-    const ename = entityNames.get(key(vault, type));
-    if (!m || !ename)
-        return reply.code(404).send({ error: 'unknown_type' });
-    const { base, extData } = splitBody(req.body);
-    const row = await createRecord(m, ename, base, { actor: 'gui' });
-    await saveExtends(vault, type, String(row.id), extData);
-    return reply.code(201).send(await withExtends(row, vault, type));
+    try {
+        const m = getModule(vault, type);
+        let body = (req.body ?? {});
+        if (m)
+            body = preserveTree(m.fields, body, {});
+        const row = await recordCreate(vault, type, body);
+        return reply.code(201).send(maskRecordRow(vault, type, row));
+    }
+    catch (e) {
+        if (e instanceof UnknownTypeError)
+            return reply.code(404).send({ error: 'unknown_type' });
+        throw e;
+    }
 }));
 app.patch('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
     const { vault, type, id } = req.params;
-    const m = getModule(vault, type);
-    const ename = entityNames.get(key(vault, type));
-    if (!m || !ename)
-        return reply.code(404).send({ error: 'unknown_type' });
-    const { base, extData } = splitBody(req.body);
-    const row = await updateRecord(m, ename, id, base, { actor: 'gui' });
-    await saveExtends(vault, type, id, extData);
-    return withExtends(row, vault, type);
+    const rid = Number(id);
+    if (isNaN(rid))
+        return reply.code(400).send({ error: 'invalid_id' });
+    try {
+        const m = getModule(vault, type);
+        let body = (req.body ?? {});
+        if (m) {
+            const existing = (await recordGet(vault, type, rid)) ?? {};
+            body = preserveTree(m.fields, body, existing);
+            const exDefs = getExtendsFor(vault, type);
+            const exRecs = (existing._extends ?? {});
+            for (const def of exDefs) {
+                const bk = `_extend_${def.id}`;
+                const sub = body[bk];
+                if (sub && typeof sub === 'object') {
+                    body = { ...body, [bk]: preserveTree(def.fields, sub, (exRecs[def.id] ?? {})) };
+                }
+            }
+        }
+        const row = await recordUpdate(vault, type, rid, body);
+        return maskRecordRow(vault, type, row);
+    }
+    catch (e) {
+        if (e instanceof UnknownTypeError)
+            return reply.code(404).send({ error: 'unknown_type' });
+        throw e;
+    }
 }));
 app.delete('/api/:vault/:type/:id', (req, reply) => guard(reply, async () => {
     const { vault, type, id } = req.params;
-    const m = getModule(vault, type);
-    const ename = entityNames.get(key(vault, type));
-    if (!m || !ename)
-        return reply.code(404).send({ error: 'unknown_type' });
-    await deleteRecord(m, ename, id, { actor: 'gui' });
-    return reply.code(204).send();
+    const rid = Number(id);
+    if (isNaN(rid))
+        return reply.code(400).send({ error: 'invalid_id' });
+    try {
+        await recordDelete(vault, type, rid);
+        return reply.code(204).send();
+    }
+    catch (e) {
+        if (e instanceof UnknownTypeError)
+            return reply.code(404).send({ error: 'unknown_type' });
+        throw e;
+    }
 }));
-// ─── Web-federation: маніфест активних плагінів + статичні asset'и з node_modules ─
 await registerPluginsApi(app);
-// ─── Serve-режим (продакшн): віддавати зібраний web + SPA-fallback ─────────────
-// Вмикається коли WEB_DIST вказує на packages/web/dist (через `coffer start`).
 const WEB_DIST = process.env.WEB_DIST;
 if (WEB_DIST && existsSync(join(WEB_DIST, 'index.html'))) {
     await app.register(fastifyStatic, { root: WEB_DIST, prefix: '/', decorateReply: false });
-    // Vendor singletons (react/react-dom/jsx-runtime/i18next/web-sdk) — sibling of dist/,
-    // served at /vendor/ so the importmap in index.html resolves plugin bare imports.
     const VENDOR_DIST = join(WEB_DIST, '..', 'dist-vendor');
     if (existsSync(VENDOR_DIST)) {
         await app.register(fastifyStatic, { root: VENDOR_DIST, prefix: '/vendor/', decorateReply: false });
     }
     app.setNotFoundHandler((req, reply) => {
-        // API/uploads/vendor — справжні 404; решта GET → index.html (клієнтський роутинг)
         if (req.method === 'GET' &&
             !req.url.startsWith('/api') &&
             !req.url.startsWith('/uploads') &&
@@ -410,11 +483,16 @@ app
     app.log.error(e);
     process.exit(1);
 });
-// Graceful shutdown — дає tsx watch час закрити порт перед рестартом
-const shutdown = () => Promise.resolve(teardownPlugins())
-    .then(() => app.close())
-    .then(() => process.exit(0))
-    .catch(() => process.exit(1));
+let shuttingDown = false;
+const shutdown = () => {
+    if (shuttingDown)
+        return;
+    shuttingDown = true;
+    Promise.resolve(teardownPlugins())
+        .then(() => app.close())
+        .then(() => closeDb())
+        .then(() => process.exit(0))
+        .catch(() => process.exit(1));
+};
 process.on('SIGTERM', shutdown);
 process.on('SIGINT', shutdown);
-//# sourceMappingURL=index.js.map

package/dist/local-api.d.ts

@@ -1,6 +1,5 @@
-export declare class UnknownTypeError extends Error {
-}
-export declare function localExists(vault: string, type: string, id: string): Promise<boolean>;
+import { UnknownTypeError } from './records-api.ts';
+export { UnknownTypeError };
+export declare function localExists(vault: string, type: string, id: number): Promise<boolean>;
 export declare function localPost(vault: string, type: string, body: unknown): Promise<Record<string, unknown>>;
-export declare function localPatch(vault: string, type: string, id: string, body: unknown): Promise<Record<string, unknown>>;
-//# sourceMappingURL=local-api.d.ts.map
+export declare function localPatch(vault: string, type: string, id: number, body: unknown): Promise<Record<string, unknown>>;