@databricks/appkit 0.66.1 → 0.68.0

package/dist/plugins/agents/manifest.js

@@ -7,27 +7,46 @@ var manifest_default = {
 	description: "AI agents driven by markdown configs or code, with auto-tool-discovery from registered plugins",
 	resources: {
 		"required": [],
-		"optional": [{
-			"type": "serving_endpoint",
-			"alias": "Default LLM for agents",
-			"resourceKey": "agents-serving-endpoint",
-			"description": "Default streaming-capable LLM endpoint for agents that don't pin their own model",
-			"permission": "CAN_QUERY",
-			"fields": { "name": {
-				"env": "DATABRICKS_SERVING_ENDPOINT_NAME",
-				"description": "Default LLM serving endpoint name"
-			} }
-		}, {
-			"type": "experiment",
-			"alias": "MLflow experiment for agent traces",
-			"resourceKey": "agents-mlflow-experiment",
-			"description": "When bound, agent turns and tool calls are traced to this MLflow experiment via OpenTelemetry. Tracing is a no-op when unset.",
-			"permission": "CAN_EDIT",
-			"fields": { "experimentId": {
-				"env": "MLFLOW_EXPERIMENT_ID",
-				"description": "MLflow experiment id traces are logged to"
-			} }
-		}]
+		"optional": [
+			{
+				"type": "serving_endpoint",
+				"alias": "Default LLM for agents",
+				"resourceKey": "agents-serving-endpoint",
+				"description": "Default streaming-capable LLM endpoint for agents that don't pin their own model",
+				"permission": "CAN_QUERY",
+				"fields": { "name": {
+					"env": "DATABRICKS_SERVING_ENDPOINT_NAME",
+					"description": "Default LLM serving endpoint name"
+				} }
+			},
+			{
+				"type": "experiment",
+				"alias": "MLflow experiment for agent traces",
+				"resourceKey": "agents-mlflow-experiment",
+				"description": "When bound, agent turns and tool calls are traced to this MLflow experiment via OpenTelemetry. Tracing is a no-op when unset.",
+				"permission": "CAN_EDIT",
+				"fields": { "experimentId": {
+					"env": "MLFLOW_EXPERIMENT_ID",
+					"description": "MLflow experiment id traces are logged to"
+				} }
+			},
+			{
+				"type": "volume",
+				"alias": "Agent skills",
+				"resourceKey": "agents-skills",
+				"description": "Optional Unity Catalog Volume providing catalog-sourced agent skills (read-only)",
+				"permission": "READ_VOLUME",
+				"fields": { "path": {
+					"env": "DATABRICKS_VOLUME_AGENT_SKILLS",
+					"description": "Volume path for agent skills (e.g. /Volumes/catalog/schema/skills)",
+					"discovery": {
+						"type": "kind",
+						"resourceKind": "volume",
+						"select": "full_name"
+					}
+				} }
+			}
+		]
 	}
 };
 

package/dist/plugins/agents/schemas.js

@@ -24,7 +24,8 @@ const chatRequestSchema = z.object({
 	message: z.string().min(1, "message must not be empty").max(MAX_MESSAGE_CHARS, `message exceeds the ${MAX_MESSAGE_CHARS}-character limit`),
 	threadId: z.string().optional(),
 	agent: z.string().optional(),
-	mlflowRunId: z.string().max(64).optional()
+	mlflowRunId: z.string().max(64).optional(),
+	skill: z.string().optional()
 });
 const messageItemSchema = z.object({
 	role: z.enum([

package/dist/plugins/agents/schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"schemas.js","names":[],"sources":["../../../src/plugins/agents/schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * Static body cap for the `message` field on `POST /chat`. 64 000 characters\n * is well above any legitimate chat turn (~16k tokens at 4 chars/token) and\n * bounds the per-request cost of appending to `InMemoryThreadStore` without\n * requiring per-deployment configuration.\n */\nconst MAX_MESSAGE_CHARS = 64_000;\n\n/** Cap applied to `/invocations` when `input` is a raw string. */\nconst MAX_INVOCATIONS_INPUT_CHARS = 64_000;\n\n/**\n * Cap on the number of items accepted in an `/invocations` `input` array\n * (one element per seeded message). Protects against a single request\n * seeding hundreds of messages into the thread store.\n */\nconst MAX_INVOCATIONS_INPUT_ITEMS = 100;\n\n/** Per-message `content` size cap (string form). */\nconst MAX_INVOCATIONS_ITEM_CHARS = 64_000;\n\n/** Per-message `content` size cap (array form). */\nconst MAX_INVOCATIONS_ITEM_ARRAY_ITEMS = 100;\n\nexport const chatRequestSchema = z.object({\n  message: z\n    .string()\n    .min(1, \"message must not be empty\")\n    .max(\n      MAX_MESSAGE_CHARS,\n      `message exceeds the ${MAX_MESSAGE_CHARS}-character limit`,\n    ),\n  threadId: z.string().optional(),\n  agent: z.string().optional(),\n  /**\n   * MLflow run id to link this turn's trace to (via `mlflow.sourceRun`), set by\n   * the eval runner so each case's trace shows under the evaluation run. Capped\n   * to a run-id-shaped length since it reaches trace metadata and logs.\n   */\n  mlflowRunId: z.string().max(64).optional(),\n});\n\nconst messageItemSchema = z.object({\n  role: z.enum([\"user\", \"assistant\", \"system\"]).optional(),\n  content: z\n    .union([\n      z.string().max(MAX_INVOCATIONS_ITEM_CHARS),\n      z.array(z.any()).max(MAX_INVOCATIONS_ITEM_ARRAY_ITEMS),\n    ])\n    .optional(),\n  type: z.string().optional(),\n});\n\nexport const invocationsRequestSchema = z.object({\n  input: z.union([\n    z.string().min(1).max(MAX_INVOCATIONS_INPUT_CHARS),\n    z\n      .array(messageItemSchema)\n      .min(1)\n      .max(\n        MAX_INVOCATIONS_INPUT_ITEMS,\n        `input array exceeds the ${MAX_INVOCATIONS_INPUT_ITEMS}-item limit`,\n      ),\n  ]),\n  model: z.string().optional(),\n  /**\n   * MLflow run id to link this turn's trace to. Same as `chatRequestSchema`,\n   * but the trace id comes back in the response body (`mlflow_trace_id`) since\n   * this surface has no `metadata` event.\n   */\n  mlflowRunId: z.string().max(64).optional(),\n});\n\nexport const approvalRequestSchema = z.object({\n  streamId: z.string().min(1, \"streamId is required\"),\n  approvalId: z.string().min(1, \"approvalId is required\"),\n  decision: z.enum([\"approve\", \"deny\"]),\n});\n\nexport const cancelRequestSchema = z.object({\n  streamId: z.string().min(1, \"streamId is required\"),\n});\n"],"mappings":";;;;;;;;;AAQA,MAAM,oBAAoB;;AAG1B,MAAM,8BAA8B;;;;;;AAOpC,MAAM,8BAA8B;;AAGpC,MAAM,6BAA6B;;AAGnC,MAAM,mCAAmC;AAEzC,MAAa,oBAAoB,EAAE,OAAO;CACxC,SAAS,EACN,QAAQ,CACR,IAAI,GAAG,4BAA4B,CACnC,IACC,mBACA,uBAAuB,kBAAkB,kBAC1C;CACH,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,OAAO,EAAE,QAAQ,CAAC,UAAU;CAM5B,aAAa,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU;CAC3C,CAAC;AAEF,MAAM,oBAAoB,EAAE,OAAO;CACjC,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAa;EAAS,CAAC,CAAC,UAAU;CACxD,SAAS,EACN,MAAM,CACL,EAAE,QAAQ,CAAC,IAAI,2BAA2B,EAC1C,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,iCAAiC,CACvD,CAAC,CACD,UAAU;CACb,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,OAAO,EAAE,MAAM,CACb,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,4BAA4B,EAClD,EACG,MAAM,kBAAkB,CACxB,IAAI,EAAE,CACN,IACC,6BACA,2BAA2B,4BAA4B,aACxD,CACJ,CAAC;CACF,OAAO,EAAE,QAAQ,CAAC,UAAU;CAM5B,aAAa,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU;CAC3C,CAAC;AAEF,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG,uBAAuB;CACnD,YAAY,EAAE,QAAQ,CAAC,IAAI,GAAG,yBAAyB;CACvD,UAAU,EAAE,KAAK,CAAC,WAAW,OAAO,CAAC;CACtC,CAAC;AAEF,MAAa,sBAAsB,EAAE,OAAO,EAC1C,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG,uBAAuB,EACpD,CAAC"}
+{"version":3,"file":"schemas.js","names":[],"sources":["../../../src/plugins/agents/schemas.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * Static body cap for the `message` field on `POST /chat`. 64 000 characters\n * is well above any legitimate chat turn (~16k tokens at 4 chars/token) and\n * bounds the per-request cost of appending to `InMemoryThreadStore` without\n * requiring per-deployment configuration.\n */\nconst MAX_MESSAGE_CHARS = 64_000;\n\n/** Cap applied to `/invocations` when `input` is a raw string. */\nconst MAX_INVOCATIONS_INPUT_CHARS = 64_000;\n\n/**\n * Cap on the number of items accepted in an `/invocations` `input` array\n * (one element per seeded message). Protects against a single request\n * seeding hundreds of messages into the thread store.\n */\nconst MAX_INVOCATIONS_INPUT_ITEMS = 100;\n\n/** Per-message `content` size cap (string form). */\nconst MAX_INVOCATIONS_ITEM_CHARS = 64_000;\n\n/** Per-message `content` size cap (array form). */\nconst MAX_INVOCATIONS_ITEM_ARRAY_ITEMS = 100;\n\nexport const chatRequestSchema = z.object({\n  message: z\n    .string()\n    .min(1, \"message must not be empty\")\n    .max(\n      MAX_MESSAGE_CHARS,\n      `message exceeds the ${MAX_MESSAGE_CHARS}-character limit`,\n    ),\n  threadId: z.string().optional(),\n  agent: z.string().optional(),\n  /**\n   * MLflow run id to link this turn's trace to (via `mlflow.sourceRun`), set by\n   * the eval runner so each case's trace shows under the evaluation run. Capped\n   * to a run-id-shaped length since it reaches trace metadata and logs.\n   */\n  mlflowRunId: z.string().max(64).optional(),\n  /**\n   * Optional skill to force-load for this turn (deterministic `/skill-name`\n   * invocation). Its instructions are injected into the turn's context; the\n   * model can still auto-load others via the `load_skill` tool.\n   */\n  skill: z.string().optional(),\n});\n\nconst messageItemSchema = z.object({\n  role: z.enum([\"user\", \"assistant\", \"system\"]).optional(),\n  content: z\n    .union([\n      z.string().max(MAX_INVOCATIONS_ITEM_CHARS),\n      z.array(z.any()).max(MAX_INVOCATIONS_ITEM_ARRAY_ITEMS),\n    ])\n    .optional(),\n  type: z.string().optional(),\n});\n\nexport const invocationsRequestSchema = z.object({\n  input: z.union([\n    z.string().min(1).max(MAX_INVOCATIONS_INPUT_CHARS),\n    z\n      .array(messageItemSchema)\n      .min(1)\n      .max(\n        MAX_INVOCATIONS_INPUT_ITEMS,\n        `input array exceeds the ${MAX_INVOCATIONS_INPUT_ITEMS}-item limit`,\n      ),\n  ]),\n  model: z.string().optional(),\n  /**\n   * MLflow run id to link this turn's trace to. Same as `chatRequestSchema`,\n   * but the trace id comes back in the response body (`mlflow_trace_id`) since\n   * this surface has no `metadata` event.\n   */\n  mlflowRunId: z.string().max(64).optional(),\n});\n\nexport const approvalRequestSchema = z.object({\n  streamId: z.string().min(1, \"streamId is required\"),\n  approvalId: z.string().min(1, \"approvalId is required\"),\n  decision: z.enum([\"approve\", \"deny\"]),\n});\n\nexport const cancelRequestSchema = z.object({\n  streamId: z.string().min(1, \"streamId is required\"),\n});\n"],"mappings":";;;;;;;;;AAQA,MAAM,oBAAoB;;AAG1B,MAAM,8BAA8B;;;;;;AAOpC,MAAM,8BAA8B;;AAGpC,MAAM,6BAA6B;;AAGnC,MAAM,mCAAmC;AAEzC,MAAa,oBAAoB,EAAE,OAAO;CACxC,SAAS,EACN,QAAQ,CACR,IAAI,GAAG,4BAA4B,CACnC,IACC,mBACA,uBAAuB,kBAAkB,kBAC1C;CACH,UAAU,EAAE,QAAQ,CAAC,UAAU;CAC/B,OAAO,EAAE,QAAQ,CAAC,UAAU;CAM5B,aAAa,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU;CAM1C,OAAO,EAAE,QAAQ,CAAC,UAAU;CAC7B,CAAC;AAEF,MAAM,oBAAoB,EAAE,OAAO;CACjC,MAAM,EAAE,KAAK;EAAC;EAAQ;EAAa;EAAS,CAAC,CAAC,UAAU;CACxD,SAAS,EACN,MAAM,CACL,EAAE,QAAQ,CAAC,IAAI,2BAA2B,EAC1C,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,IAAI,iCAAiC,CACvD,CAAC,CACD,UAAU;CACb,MAAM,EAAE,QAAQ,CAAC,UAAU;CAC5B,CAAC;AAEF,MAAa,2BAA2B,EAAE,OAAO;CAC/C,OAAO,EAAE,MAAM,CACb,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,4BAA4B,EAClD,EACG,MAAM,kBAAkB,CACxB,IAAI,EAAE,CACN,IACC,6BACA,2BAA2B,4BAA4B,aACxD,CACJ,CAAC;CACF,OAAO,EAAE,QAAQ,CAAC,UAAU;CAM5B,aAAa,EAAE,QAAQ,CAAC,IAAI,GAAG,CAAC,UAAU;CAC3C,CAAC;AAEF,MAAa,wBAAwB,EAAE,OAAO;CAC5C,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG,uBAAuB;CACnD,YAAY,EAAE,QAAQ,CAAC,IAAI,GAAG,yBAAyB;CACvD,UAAU,EAAE,KAAK,CAAC,WAAW,OAAO,CAAC;CACtC,CAAC;AAEF,MAAa,sBAAsB,EAAE,OAAO,EAC1C,UAAU,EAAE,QAAQ,CAAC,IAAI,GAAG,uBAAuB,EACpD,CAAC"}

package/dist/plugins/database/crud/codecs.js

@@ -0,0 +1,78 @@
+import { columnValueSchema } from "../../../database/schema-builder/validators.js";
+import { DatabasePluginError } from "../../../database/errors.js";
+
+//#region src/plugins/database/crud/codecs.ts
+/** Decimal integer with no sign padding, leading zeros, or exponent. */
+const DECIMAL_INT = /^-?(0|[1-9]\d*)$/;
+/**
+* Map a wire value onto the runtime representation the schema validators and
+* Drizzle columns expect. Only path segments and JSON scalars reach this, so
+* the accepted shapes stay exact rather than coercing whatever parses.
+*/
+function toRuntimeValue(kind, raw) {
+	switch (kind) {
+		case "number":
+			if (typeof raw === "number") return raw;
+			return typeof raw === "string" && DECIMAL_INT.test(raw) ? Number(raw) : void 0;
+		case "bigint":
+			if (typeof raw === "string" && DECIMAL_INT.test(raw)) return BigInt(raw);
+			return typeof raw === "number" && Number.isSafeInteger(raw) ? BigInt(raw) : void 0;
+		case "boolean": return typeof raw === "boolean" ? raw : void 0;
+		case "string":
+		case "uuid":
+		case "enum":
+		case "date": return typeof raw === "string" ? raw : void 0;
+		default: return;
+	}
+}
+function encodeValue(meta, value) {
+	if (value === null || value === void 0) return null;
+	switch (meta.kind) {
+		case "bigint":
+			if (typeof value === "bigint") return value.toString();
+			if (typeof value === "number" && Number.isSafeInteger(value)) return value.toString();
+			break;
+		case "number":
+			if (typeof value === "number" && Number.isFinite(value)) return value;
+			break;
+		case "boolean":
+			if (typeof value === "boolean") return value;
+			break;
+		case "string":
+		case "uuid":
+		case "enum":
+		case "date":
+			if (typeof value === "string") return value;
+			break;
+		case "json":
+			if (isJsonValue(value)) return value;
+			break;
+		case "unknown": break;
+	}
+	throw new DatabasePluginError("INTERNAL", "read");
+}
+function isJsonValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return true;
+	if (typeof value === "number") return Number.isFinite(value);
+	if (Array.isArray(value)) return true;
+	if (typeof value !== "object") return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/** Compile the wire codecs for one column from its finalized metadata. */
+function compileColumn(meta) {
+	const schema = columnValueSchema(meta);
+	return {
+		meta,
+		decode: (raw) => {
+			const candidate = toRuntimeValue(meta.kind, raw);
+			if (candidate === void 0) return void 0;
+			return schema.safeParse(candidate).success ? candidate : void 0;
+		},
+		encode: (value) => encodeValue(meta, value)
+	};
+}
+
+//#endregion
+export { compileColumn };
+//# sourceMappingURL=codecs.js.map

package/dist/plugins/database/crud/codecs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codecs.js","names":[],"sources":["../../../../src/plugins/database/crud/codecs.ts"],"sourcesContent":["import { DatabasePluginError } from \"../../../database/errors\";\nimport type { ScalarValue } from \"../../../database/runtime\";\nimport type { ColumnMeta } from \"../../../database/schema-builder\";\nimport { columnValueSchema } from \"../../../database/schema-builder/validators\";\n\n/** JSON-representable value; every generated response is built from these. */\nexport type JsonValue =\n  | string\n  | number\n  | boolean\n  | null\n  | JsonValue[]\n  | { [key: string]: JsonValue };\n\n/** Both wire directions for one column, compiled once per exposed table. */\nexport interface CompiledColumn {\n  readonly meta: ColumnMeta;\n  /** Untrusted wire value to canonical runtime value; `undefined` when invalid. */\n  decode(raw: unknown): ScalarValue | undefined;\n  /** Trusted runtime value to its deterministic JSON form. */\n  encode(value: unknown): JsonValue;\n}\n\n/** Decimal integer with no sign padding, leading zeros, or exponent. */\nconst DECIMAL_INT = /^-?(0|[1-9]\\d*)$/;\n\n/**\n * Map a wire value onto the runtime representation the schema validators and\n * Drizzle columns expect. Only path segments and JSON scalars reach this, so\n * the accepted shapes stay exact rather than coercing whatever parses.\n */\nfunction toRuntimeValue(\n  kind: ColumnMeta[\"kind\"],\n  raw: unknown,\n): ScalarValue | undefined {\n  switch (kind) {\n    case \"number\":\n      if (typeof raw === \"number\") return raw;\n      return typeof raw === \"string\" && DECIMAL_INT.test(raw)\n        ? Number(raw)\n        : undefined;\n    case \"bigint\":\n      if (typeof raw === \"string\" && DECIMAL_INT.test(raw)) return BigInt(raw);\n      return typeof raw === \"number\" && Number.isSafeInteger(raw)\n        ? BigInt(raw)\n        : undefined;\n    case \"boolean\":\n      return typeof raw === \"boolean\" ? raw : undefined;\n    case \"string\":\n    case \"uuid\":\n    case \"enum\":\n    case \"date\":\n      return typeof raw === \"string\" ? raw : undefined;\n    default:\n      return undefined;\n  }\n}\n\nfunction encodeValue(meta: ColumnMeta, value: unknown): JsonValue {\n  if (value === null || value === undefined) return null;\n  switch (meta.kind) {\n    case \"bigint\":\n      // JSON cannot carry a bigint, and a large id must not lose precision.\n      if (typeof value === \"bigint\") return value.toString();\n      if (typeof value === \"number\" && Number.isSafeInteger(value)) {\n        return value.toString();\n      }\n      break;\n    case \"number\":\n      if (typeof value === \"number\" && Number.isFinite(value)) return value;\n      break;\n    case \"boolean\":\n      if (typeof value === \"boolean\") return value;\n      break;\n    case \"string\":\n    case \"uuid\":\n    case \"enum\":\n    case \"date\":\n      if (typeof value === \"string\") return value;\n      break;\n    case \"json\":\n      if (isJsonValue(value)) return value;\n      break;\n    case \"unknown\":\n      break;\n  }\n  // The driver produced a value this column contract cannot describe.\n  throw new DatabasePluginError(\"INTERNAL\", \"read\");\n}\n\nfunction isJsonValue(value: unknown): value is JsonValue {\n  if (\n    value === null ||\n    typeof value === \"string\" ||\n    typeof value === \"boolean\"\n  ) {\n    return true;\n  }\n  if (typeof value === \"number\") return Number.isFinite(value);\n  if (Array.isArray(value)) return true;\n  if (typeof value !== \"object\") return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\n/** Compile the wire codecs for one column from its finalized metadata. */\nexport function compileColumn(meta: ColumnMeta): CompiledColumn {\n  const schema = columnValueSchema(meta);\n  return {\n    meta,\n    decode: (raw) => {\n      const candidate = toRuntimeValue(meta.kind, raw);\n      if (candidate === undefined) return undefined;\n      return schema.safeParse(candidate).success ? candidate : undefined;\n    },\n    encode: (value) => encodeValue(meta, value),\n  };\n}\n"],"mappings":";;;;;AAwBA,MAAM,cAAc;;;;;;AAOpB,SAAS,eACP,MACA,KACyB;AACzB,SAAQ,MAAR;EACE,KAAK;AACH,OAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,UAAO,OAAO,QAAQ,YAAY,YAAY,KAAK,IAAI,GACnD,OAAO,IAAI,GACX;EACN,KAAK;AACH,OAAI,OAAO,QAAQ,YAAY,YAAY,KAAK,IAAI,CAAE,QAAO,OAAO,IAAI;AACxE,UAAO,OAAO,QAAQ,YAAY,OAAO,cAAc,IAAI,GACvD,OAAO,IAAI,GACX;EACN,KAAK,UACH,QAAO,OAAO,QAAQ,YAAY,MAAM;EAC1C,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK,OACH,QAAO,OAAO,QAAQ,WAAW,MAAM;EACzC,QACE;;;AAIN,SAAS,YAAY,MAAkB,OAA2B;AAChE,KAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,SAAQ,KAAK,MAAb;EACE,KAAK;AAEH,OAAI,OAAO,UAAU,SAAU,QAAO,MAAM,UAAU;AACtD,OAAI,OAAO,UAAU,YAAY,OAAO,cAAc,MAAM,CAC1D,QAAO,MAAM,UAAU;AAEzB;EACF,KAAK;AACH,OAAI,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,CAAE,QAAO;AAChE;EACF,KAAK;AACH,OAAI,OAAO,UAAU,UAAW,QAAO;AACvC;EACF,KAAK;EACL,KAAK;EACL,KAAK;EACL,KAAK;AACH,OAAI,OAAO,UAAU,SAAU,QAAO;AACtC;EACF,KAAK;AACH,OAAI,YAAY,MAAM,CAAE,QAAO;AAC/B;EACF,KAAK,UACH;;AAGJ,OAAM,IAAI,oBAAoB,YAAY,OAAO;;AAGnD,SAAS,YAAY,OAAoC;AACvD,KACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,UAEjB,QAAO;AAET,KAAI,OAAO,UAAU,SAAU,QAAO,OAAO,SAAS,MAAM;AAC5D,KAAI,MAAM,QAAQ,MAAM,CAAE,QAAO;AACjC,KAAI,OAAO,UAAU,SAAU,QAAO;CACtC,MAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,QAAO,cAAc,OAAO,aAAa,cAAc;;;AAIzD,SAAgB,cAAc,MAAkC;CAC9D,MAAM,SAAS,kBAAkB,KAAK;AACtC,QAAO;EACL;EACA,SAAS,QAAQ;GACf,MAAM,YAAY,eAAe,KAAK,MAAM,IAAI;AAChD,OAAI,cAAc,OAAW,QAAO;AACpC,UAAO,OAAO,UAAU,UAAU,CAAC,UAAU,YAAY;;EAE3D,SAAS,UAAU,YAAY,MAAM,MAAM;EAC5C"}

package/dist/plugins/database/crud/contract.js

@@ -0,0 +1,151 @@
+import { filterOperatorsForKind } from "../../../database/schema-builder/types.js";
+import { DatabasePluginError, invalidDatabaseInput } from "../../../database/errors.js";
+import { MAX_SERIALIZED_DEPTH, MAX_SERIALIZED_NODES } from "../defaults.js";
+import { compileColumn } from "./codecs.js";
+
+//#region src/plugins/database/crud/contract.ts
+/** A bare object literal; a `Date`, class instance, or `Map` is not JSON. */
+function isPlainObject(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+/** A serializer that breaks its contract is trusted code failing, not input. */
+function serializerFault() {
+	throw new DatabasePluginError("INTERNAL", "read");
+}
+/** Charge one value against the output budget before descending into it. */
+function countNode(depth, state) {
+	state.nodes += 1;
+	if (state.nodes > MAX_SERIALIZED_NODES || depth > MAX_SERIALIZED_DEPTH) serializerFault();
+}
+/** Walk a container while its ancestors are tracked, so a cycle cannot pass. */
+function enterObject(value, state, visit) {
+	if (state.ancestors.has(value)) serializerFault();
+	state.ancestors.add(value);
+	try {
+		return visit();
+	} finally {
+		state.ancestors.delete(value);
+	}
+}
+/** Accept a serializer's own added value only where it is already JSON. */
+function sanitizeJson(value, depth, state) {
+	countNode(depth, state);
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) serializerFault();
+		return value;
+	}
+	if (Array.isArray(value)) return enterObject(value, state, () => value.map((item) => sanitizeJson(item, depth + 1, state)));
+	if (!isPlainObject(value)) serializerFault();
+	return enterObject(value, state, () => {
+		const out = Object.create(null);
+		for (const [key, child] of Object.entries(value)) {
+			if (child === void 0) continue;
+			out[key] = sanitizeJson(child, depth + 1, state);
+		}
+		return out;
+	});
+}
+/** Keep an included row under its own table's policy, one row or many. */
+function sanitizeRelation(target, value, depth, state) {
+	if (value === null) return null;
+	if (!Array.isArray(value)) return sanitizeRow(target, value, depth, state);
+	countNode(depth, state);
+	return enterObject(value, state, () => value.map((row) => sanitizeRow(target, row, depth + 1, state)));
+}
+/** Re-apply the private-column policy wherever the output stays contracted. */
+function sanitizeRow(table, row, depth, state) {
+	countNode(depth, state);
+	if (!isPlainObject(row)) serializerFault();
+	return enterObject(row, state, () => {
+		const out = {};
+		for (const [key, child] of Object.entries(row)) {
+			if (child === void 0) continue;
+			if (table.columns.get(key)?.meta.isPrivate) continue;
+			const relation = table.relations.get(key);
+			out[key] = relation ? sanitizeRelation(relation.target, child, depth + 1, state) : sanitizeJson(child, depth + 1, state);
+		}
+		return out;
+	});
+}
+/** Project an included row through its own table; absent to-one reads null. */
+function projectRelation(target, value) {
+	if (value === null || value === void 0) return null;
+	return Array.isArray(value) ? value.map((row) => target.projectPublicRow(row)) : target.projectPublicRow(value);
+}
+/** Build the public JSON for one driver row, dropping anything uncontracted. */
+function projectRow(table, row) {
+	const out = {};
+	for (const [key, value] of Object.entries(row)) {
+		const column = table.columns.get(key);
+		if (column) {
+			if (!column.meta.isPrivate) out[key] = column.encode(value);
+			continue;
+		}
+		const relation = table.relations.get(key);
+		if (relation) out[key] = projectRelation(relation.target, value);
+	}
+	return out;
+}
+/** Compile one table's allowlists and codecs from its finalized metadata. */
+function compileTable(table) {
+	const columns = /* @__PURE__ */ new Map();
+	const selectable = /* @__PURE__ */ new Set();
+	const queryable = /* @__PURE__ */ new Set();
+	let primaryKey;
+	for (const meta of Object.values(table.$columns)) {
+		const column = compileColumn(meta);
+		columns.set(meta.columnName, column);
+		if (meta.primaryKey && !meta.isPrivate) primaryKey = column;
+		if (meta.isPrivate) continue;
+		selectable.add(meta.columnName);
+		if (filterOperatorsForKind(meta.kind).length > 0) queryable.add(meta.columnName);
+	}
+	const compiled = {
+		name: table.$name,
+		primaryKey,
+		columns,
+		selectable,
+		queryable,
+		relations: /* @__PURE__ */ new Map(),
+		decodeId: (raw) => {
+			if (!primaryKey) throw new DatabasePluginError("INTERNAL", "read");
+			const value = primaryKey.decode(raw);
+			if (typeof value !== "string" && typeof value !== "number" && typeof value !== "bigint") throw invalidDatabaseInput(["id"], "Not a valid identifier");
+			return value;
+		},
+		projectPublicRow: (row) => projectRow(compiled, row),
+		sanitizeSerializedRow: (row) => sanitizeRow(compiled, row, 0, {
+			nodes: 0,
+			ancestors: /* @__PURE__ */ new Set()
+		})
+	};
+	return compiled;
+}
+/**
+* Compile the HTTP contract for every exposed table and wire the relations
+* they share. A relation whose target is not exposed stays unreachable, so
+* enabling one table never widens another table's public surface.
+*/
+function compileCrudTables(tables) {
+	const compiled = /* @__PURE__ */ new Map();
+	for (const table of Object.values(tables)) compiled.set(table.$name, compileTable(table));
+	for (const table of Object.values(tables)) {
+		const entry = compiled.get(table.$name);
+		for (const relation of table.$relations) {
+			const target = compiled.get(relation.targetTable);
+			if (!entry || !target) continue;
+			entry.relations.set(relation.name, {
+				cardinality: relation.cardinality,
+				target
+			});
+		}
+	}
+	return compiled;
+}
+
+//#endregion
+export { compileCrudTables };
+//# sourceMappingURL=contract.js.map

package/dist/plugins/database/crud/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","names":[],"sources":["../../../../src/plugins/database/crud/contract.ts"],"sourcesContent":["import {\n  DatabasePluginError,\n  invalidDatabaseInput,\n} from \"../../../database/errors\";\nimport type { IdValue, Row } from \"../../../database/runtime\";\nimport type { AppKitTable } from \"../../../database/schema-builder\";\nimport { filterOperatorsForKind } from \"../../../database/schema-builder/types\";\nimport { MAX_SERIALIZED_DEPTH, MAX_SERIALIZED_NODES } from \"../defaults\";\nimport { type CompiledColumn, compileColumn, type JsonValue } from \"./codecs\";\n\n/** One relation edge wired to the contract of its target table. */\nexport interface CrudRelation {\n  readonly cardinality: \"toOne\" | \"toMany\";\n  readonly target: CrudTable;\n}\n\n/** Private HTTP contract compiled once for one explicitly exposed table. */\nexport interface CrudTable {\n  readonly name: string;\n  readonly primaryKey?: CompiledColumn;\n  readonly columns: ReadonlyMap<string, CompiledColumn>;\n  /** Public columns a request may project. */\n  readonly selectable: ReadonlySet<string>;\n  /** Public columns a request may filter or order by. */\n  readonly queryable: ReadonlySet<string>;\n  readonly relations: ReadonlyMap<string, CrudRelation>;\n  decodeId(raw: string): IdValue;\n  projectPublicRow(row: Row): JsonValue;\n  sanitizeSerializedRow(row: unknown): JsonValue;\n}\n\ntype MutableCrudTable = Omit<CrudTable, \"relations\"> & {\n  readonly relations: Map<string, CrudRelation>;\n};\n\ninterface SanitizeState {\n  nodes: number;\n  readonly ancestors: Set<object>;\n}\n\n/** A bare object literal; a `Date`, class instance, or `Map` is not JSON. */\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (value === null || typeof value !== \"object\" || Array.isArray(value)) {\n    return false;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\n/** A serializer that breaks its contract is trusted code failing, not input. */\nfunction serializerFault(): never {\n  throw new DatabasePluginError(\"INTERNAL\", \"read\");\n}\n\n/** Charge one value against the output budget before descending into it. */\nfunction countNode(depth: number, state: SanitizeState): void {\n  state.nodes += 1;\n  if (state.nodes > MAX_SERIALIZED_NODES || depth > MAX_SERIALIZED_DEPTH) {\n    serializerFault();\n  }\n}\n\n/** Walk a container while its ancestors are tracked, so a cycle cannot pass. */\nfunction enterObject<T>(\n  value: object,\n  state: SanitizeState,\n  visit: () => T,\n): T {\n  if (state.ancestors.has(value)) serializerFault();\n  state.ancestors.add(value);\n  try {\n    return visit();\n  } finally {\n    state.ancestors.delete(value);\n  }\n}\n\n/** Accept a serializer's own added value only where it is already JSON. */\nfunction sanitizeJson(\n  value: unknown,\n  depth: number,\n  state: SanitizeState,\n): JsonValue {\n  countNode(depth, state);\n  if (\n    value === null ||\n    typeof value === \"string\" ||\n    typeof value === \"boolean\"\n  ) {\n    return value;\n  }\n  if (typeof value === \"number\") {\n    if (!Number.isFinite(value)) serializerFault();\n    return value;\n  }\n  if (Array.isArray(value)) {\n    return enterObject(value, state, () =>\n      value.map((item) => sanitizeJson(item, depth + 1, state)),\n    );\n  }\n  if (!isPlainObject(value)) serializerFault();\n  return enterObject(value, state, () => {\n    // A null prototype keeps `__proto__` an ordinary key instead of a setter.\n    const out: Record<string, JsonValue> = Object.create(null);\n    for (const [key, child] of Object.entries(value)) {\n      if (child === undefined) continue;\n      out[key] = sanitizeJson(child, depth + 1, state);\n    }\n    return out;\n  });\n}\n\n/** Keep an included row under its own table's policy, one row or many. */\nfunction sanitizeRelation(\n  target: CrudTable,\n  value: unknown,\n  depth: number,\n  state: SanitizeState,\n): JsonValue {\n  if (value === null) return null;\n  if (!Array.isArray(value)) return sanitizeRow(target, value, depth, state);\n  countNode(depth, state);\n  return enterObject(value, state, () =>\n    value.map((row) => sanitizeRow(target, row, depth + 1, state)),\n  );\n}\n\n/** Re-apply the private-column policy wherever the output stays contracted. */\nfunction sanitizeRow(\n  table: CrudTable,\n  row: unknown,\n  depth: number,\n  state: SanitizeState,\n): JsonValue {\n  countNode(depth, state);\n  if (!isPlainObject(row)) serializerFault();\n  return enterObject(row, state, () => {\n    const out: Record<string, JsonValue> = {};\n    for (const [key, child] of Object.entries(row)) {\n      if (child === undefined) continue;\n      if (table.columns.get(key)?.meta.isPrivate) continue;\n      const relation = table.relations.get(key);\n      out[key] = relation\n        ? sanitizeRelation(relation.target, child, depth + 1, state)\n        : sanitizeJson(child, depth + 1, state);\n    }\n    return out;\n  });\n}\n\n/** Project an included row through its own table; absent to-one reads null. */\nfunction projectRelation(target: CrudTable, value: unknown): JsonValue {\n  if (value === null || value === undefined) return null;\n  return Array.isArray(value)\n    ? value.map((row) => target.projectPublicRow(row as Row))\n    : target.projectPublicRow(value as Row);\n}\n\n/** Build the public JSON for one driver row, dropping anything uncontracted. */\nfunction projectRow(table: CrudTable, row: Row): JsonValue {\n  const out: Record<string, JsonValue> = {};\n  for (const [key, value] of Object.entries(row)) {\n    const column = table.columns.get(key);\n    if (column) {\n      // Whatever the driver returned, only public contracted columns ship.\n      if (!column.meta.isPrivate) out[key] = column.encode(value);\n      continue;\n    }\n    const relation = table.relations.get(key);\n    if (relation) out[key] = projectRelation(relation.target, value);\n  }\n  return out;\n}\n\n/** Compile one table's allowlists and codecs from its finalized metadata. */\nfunction compileTable(table: AppKitTable): MutableCrudTable {\n  const columns = new Map<string, CompiledColumn>();\n  const selectable = new Set<string>();\n  const queryable = new Set<string>();\n  let primaryKey: CompiledColumn | undefined;\n\n  for (const meta of Object.values(table.$columns)) {\n    const column = compileColumn(meta);\n    columns.set(meta.columnName, column);\n    // A private key must not power `GET /:table/:id`: per-id probing would\n    // answer 200 or 404 on an identifier the schema hides, so over HTTP the\n    // table is keyless — no detail route, and lists must name their own order.\n    if (meta.primaryKey && !meta.isPrivate) primaryKey = column;\n    if (meta.isPrivate) continue;\n    selectable.add(meta.columnName);\n    if (filterOperatorsForKind(meta.kind).length > 0) {\n      queryable.add(meta.columnName);\n    }\n  }\n\n  const compiled: MutableCrudTable = {\n    name: table.$name,\n    primaryKey,\n    columns,\n    selectable,\n    queryable,\n    relations: new Map(),\n    decodeId: (raw) => {\n      if (!primaryKey) throw new DatabasePluginError(\"INTERNAL\", \"read\");\n      const value = primaryKey.decode(raw);\n      if (\n        typeof value !== \"string\" &&\n        typeof value !== \"number\" &&\n        typeof value !== \"bigint\"\n      ) {\n        throw invalidDatabaseInput([\"id\"], \"Not a valid identifier\");\n      }\n      return value;\n    },\n    projectPublicRow: (row) => projectRow(compiled, row),\n    sanitizeSerializedRow: (row) =>\n      sanitizeRow(compiled, row, 0, { nodes: 0, ancestors: new Set() }),\n  };\n  return compiled;\n}\n\n/**\n * Compile the HTTP contract for every exposed table and wire the relations\n * they share. A relation whose target is not exposed stays unreachable, so\n * enabling one table never widens another table's public surface.\n */\nexport function compileCrudTables(\n  tables: Record<string, AppKitTable>,\n): Map<string, CrudTable> {\n  const compiled = new Map<string, MutableCrudTable>();\n  for (const table of Object.values(tables)) {\n    compiled.set(table.$name, compileTable(table));\n  }\n  for (const table of Object.values(tables)) {\n    const entry = compiled.get(table.$name);\n    for (const relation of table.$relations) {\n      const target = compiled.get(relation.targetTable);\n      if (!entry || !target) continue;\n      entry.relations.set(relation.name, {\n        cardinality: relation.cardinality,\n        target,\n      });\n    }\n  }\n  return compiled as Map<string, CrudTable>;\n}\n"],"mappings":";;;;;;;AAyCA,SAAS,cAAc,OAAkD;AACvE,KAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CACrE,QAAO;CAET,MAAM,YAAY,OAAO,eAAe,MAAM;AAC9C,QAAO,cAAc,OAAO,aAAa,cAAc;;;AAIzD,SAAS,kBAAyB;AAChC,OAAM,IAAI,oBAAoB,YAAY,OAAO;;;AAInD,SAAS,UAAU,OAAe,OAA4B;AAC5D,OAAM,SAAS;AACf,KAAI,MAAM,QAAQ,wBAAwB,QAAQ,qBAChD,kBAAiB;;;AAKrB,SAAS,YACP,OACA,OACA,OACG;AACH,KAAI,MAAM,UAAU,IAAI,MAAM,CAAE,kBAAiB;AACjD,OAAM,UAAU,IAAI,MAAM;AAC1B,KAAI;AACF,SAAO,OAAO;WACN;AACR,QAAM,UAAU,OAAO,MAAM;;;;AAKjC,SAAS,aACP,OACA,OACA,OACW;AACX,WAAU,OAAO,MAAM;AACvB,KACE,UAAU,QACV,OAAO,UAAU,YACjB,OAAO,UAAU,UAEjB,QAAO;AAET,KAAI,OAAO,UAAU,UAAU;AAC7B,MAAI,CAAC,OAAO,SAAS,MAAM,CAAE,kBAAiB;AAC9C,SAAO;;AAET,KAAI,MAAM,QAAQ,MAAM,CACtB,QAAO,YAAY,OAAO,aACxB,MAAM,KAAK,SAAS,aAAa,MAAM,QAAQ,GAAG,MAAM,CAAC,CAC1D;AAEH,KAAI,CAAC,cAAc,MAAM,CAAE,kBAAiB;AAC5C,QAAO,YAAY,OAAO,aAAa;EAErC,MAAM,MAAiC,OAAO,OAAO,KAAK;AAC1D,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,EAAE;AAChD,OAAI,UAAU,OAAW;AACzB,OAAI,OAAO,aAAa,OAAO,QAAQ,GAAG,MAAM;;AAElD,SAAO;GACP;;;AAIJ,SAAS,iBACP,QACA,OACA,OACA,OACW;AACX,KAAI,UAAU,KAAM,QAAO;AAC3B,KAAI,CAAC,MAAM,QAAQ,MAAM,CAAE,QAAO,YAAY,QAAQ,OAAO,OAAO,MAAM;AAC1E,WAAU,OAAO,MAAM;AACvB,QAAO,YAAY,OAAO,aACxB,MAAM,KAAK,QAAQ,YAAY,QAAQ,KAAK,QAAQ,GAAG,MAAM,CAAC,CAC/D;;;AAIH,SAAS,YACP,OACA,KACA,OACA,OACW;AACX,WAAU,OAAO,MAAM;AACvB,KAAI,CAAC,cAAc,IAAI,CAAE,kBAAiB;AAC1C,QAAO,YAAY,KAAK,aAAa;EACnC,MAAM,MAAiC,EAAE;AACzC,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;AAC9C,OAAI,UAAU,OAAW;AACzB,OAAI,MAAM,QAAQ,IAAI,IAAI,EAAE,KAAK,UAAW;GAC5C,MAAM,WAAW,MAAM,UAAU,IAAI,IAAI;AACzC,OAAI,OAAO,WACP,iBAAiB,SAAS,QAAQ,OAAO,QAAQ,GAAG,MAAM,GAC1D,aAAa,OAAO,QAAQ,GAAG,MAAM;;AAE3C,SAAO;GACP;;;AAIJ,SAAS,gBAAgB,QAAmB,OAA2B;AACrE,KAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAO,MAAM,QAAQ,MAAM,GACvB,MAAM,KAAK,QAAQ,OAAO,iBAAiB,IAAW,CAAC,GACvD,OAAO,iBAAiB,MAAa;;;AAI3C,SAAS,WAAW,OAAkB,KAAqB;CACzD,MAAM,MAAiC,EAAE;AACzC,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,IAAI,EAAE;EAC9C,MAAM,SAAS,MAAM,QAAQ,IAAI,IAAI;AACrC,MAAI,QAAQ;AAEV,OAAI,CAAC,OAAO,KAAK,UAAW,KAAI,OAAO,OAAO,OAAO,MAAM;AAC3D;;EAEF,MAAM,WAAW,MAAM,UAAU,IAAI,IAAI;AACzC,MAAI,SAAU,KAAI,OAAO,gBAAgB,SAAS,QAAQ,MAAM;;AAElE,QAAO;;;AAIT,SAAS,aAAa,OAAsC;CAC1D,MAAM,0BAAU,IAAI,KAA6B;CACjD,MAAM,6BAAa,IAAI,KAAa;CACpC,MAAM,4BAAY,IAAI,KAAa;CACnC,IAAI;AAEJ,MAAK,MAAM,QAAQ,OAAO,OAAO,MAAM,SAAS,EAAE;EAChD,MAAM,SAAS,cAAc,KAAK;AAClC,UAAQ,IAAI,KAAK,YAAY,OAAO;AAIpC,MAAI,KAAK,cAAc,CAAC,KAAK,UAAW,cAAa;AACrD,MAAI,KAAK,UAAW;AACpB,aAAW,IAAI,KAAK,WAAW;AAC/B,MAAI,uBAAuB,KAAK,KAAK,CAAC,SAAS,EAC7C,WAAU,IAAI,KAAK,WAAW;;CAIlC,MAAM,WAA6B;EACjC,MAAM,MAAM;EACZ;EACA;EACA;EACA;EACA,2BAAW,IAAI,KAAK;EACpB,WAAW,QAAQ;AACjB,OAAI,CAAC,WAAY,OAAM,IAAI,oBAAoB,YAAY,OAAO;GAClE,MAAM,QAAQ,WAAW,OAAO,IAAI;AACpC,OACE,OAAO,UAAU,YACjB,OAAO,UAAU,YACjB,OAAO,UAAU,SAEjB,OAAM,qBAAqB,CAAC,KAAK,EAAE,yBAAyB;AAE9D,UAAO;;EAET,mBAAmB,QAAQ,WAAW,UAAU,IAAI;EACpD,wBAAwB,QACtB,YAAY,UAAU,KAAK,GAAG;GAAE,OAAO;GAAG,2BAAW,IAAI,KAAK;GAAE,CAAC;EACpE;AACD,QAAO;;;;;;;AAQT,SAAgB,kBACd,QACwB;CACxB,MAAM,2BAAW,IAAI,KAA+B;AACpD,MAAK,MAAM,SAAS,OAAO,OAAO,OAAO,CACvC,UAAS,IAAI,MAAM,OAAO,aAAa,MAAM,CAAC;AAEhD,MAAK,MAAM,SAAS,OAAO,OAAO,OAAO,EAAE;EACzC,MAAM,QAAQ,SAAS,IAAI,MAAM,MAAM;AACvC,OAAK,MAAM,YAAY,MAAM,YAAY;GACvC,MAAM,SAAS,SAAS,IAAI,SAAS,YAAY;AACjD,OAAI,CAAC,SAAS,CAAC,OAAQ;AACvB,SAAM,UAAU,IAAI,SAAS,MAAM;IACjC,aAAa,SAAS;IACtB;IACD,CAAC;;;AAGN,QAAO"}

package/dist/plugins/database/crud/exposure.js

@@ -0,0 +1,40 @@
+import { databaseSetupFailed } from "../../../database/errors.js";
+
+//#region src/plugins/database/crud/exposure.ts
+/** A table name also becomes a URL path segment, so keep it unambiguous. */
+const ROUTABLE_TABLE = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+/** Refuse names that cannot address exactly one table over HTTP. */
+function assertRoutable(names) {
+	const lowercased = /* @__PURE__ */ new Set();
+	for (const name of names) {
+		if (!ROUTABLE_TABLE.test(name) || lowercased.has(name.toLowerCase())) throw databaseSetupFailed();
+		lowercased.add(name.toLowerCase());
+	}
+}
+/**
+* Resolve the tables whose generated reads are explicitly turned on. The
+* exposure value arrives untyped because a finalized schema widens its table
+* names to `string`, so every name is re-checked against the declared schema.
+*/
+function resolveExposedTables(exposure, declared) {
+	if (exposure === void 0 || exposure === false) return [];
+	if (exposure === true) {
+		assertRoutable(declared);
+		return [...declared];
+	}
+	if (typeof exposure !== "object" || exposure === null) throw databaseSetupFailed();
+	const requested = exposure.tables;
+	if (!Array.isArray(requested)) throw databaseSetupFailed();
+	const names = [];
+	for (const name of requested) {
+		if (typeof name !== "string" || !declared.includes(name)) throw databaseSetupFailed();
+		if (names.includes(name)) throw databaseSetupFailed();
+		names.push(name);
+	}
+	assertRoutable(names);
+	return names;
+}
+
+//#endregion
+export { resolveExposedTables };
+//# sourceMappingURL=exposure.js.map

package/dist/plugins/database/crud/exposure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exposure.js","names":[],"sources":["../../../../src/plugins/database/crud/exposure.ts"],"sourcesContent":["import { databaseSetupFailed } from \"../../../database/errors\";\n\n/** A table name also becomes a URL path segment, so keep it unambiguous. */\nconst ROUTABLE_TABLE = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;\n\n/** Refuse names that cannot address exactly one table over HTTP. */\nfunction assertRoutable(names: readonly string[]): void {\n  const lowercased = new Set<string>();\n  for (const name of names) {\n    // Express matches paths case-insensitively, so near-duplicates would alias.\n    if (!ROUTABLE_TABLE.test(name) || lowercased.has(name.toLowerCase())) {\n      throw databaseSetupFailed();\n    }\n    lowercased.add(name.toLowerCase());\n  }\n}\n\n/**\n * Resolve the tables whose generated reads are explicitly turned on. The\n * exposure value arrives untyped because a finalized schema widens its table\n * names to `string`, so every name is re-checked against the declared schema.\n */\nexport function resolveExposedTables(\n  exposure: unknown,\n  declared: readonly string[],\n): string[] {\n  if (exposure === undefined || exposure === false) return [];\n  if (exposure === true) {\n    assertRoutable(declared);\n    return [...declared];\n  }\n  if (typeof exposure !== \"object\" || exposure === null) {\n    throw databaseSetupFailed();\n  }\n  const requested = (exposure as { tables?: unknown }).tables;\n  if (!Array.isArray(requested)) throw databaseSetupFailed();\n\n  const names: string[] = [];\n  for (const name of requested) {\n    // Unknown and duplicate names are configuration bugs, not empty routes.\n    if (typeof name !== \"string\" || !declared.includes(name)) {\n      throw databaseSetupFailed();\n    }\n    if (names.includes(name)) throw databaseSetupFailed();\n    names.push(name);\n  }\n  assertRoutable(names);\n  return names;\n}\n"],"mappings":";;;;AAGA,MAAM,iBAAiB;;AAGvB,SAAS,eAAe,OAAgC;CACtD,MAAM,6BAAa,IAAI,KAAa;AACpC,MAAK,MAAM,QAAQ,OAAO;AAExB,MAAI,CAAC,eAAe,KAAK,KAAK,IAAI,WAAW,IAAI,KAAK,aAAa,CAAC,CAClE,OAAM,qBAAqB;AAE7B,aAAW,IAAI,KAAK,aAAa,CAAC;;;;;;;;AAStC,SAAgB,qBACd,UACA,UACU;AACV,KAAI,aAAa,UAAa,aAAa,MAAO,QAAO,EAAE;AAC3D,KAAI,aAAa,MAAM;AACrB,iBAAe,SAAS;AACxB,SAAO,CAAC,GAAG,SAAS;;AAEtB,KAAI,OAAO,aAAa,YAAY,aAAa,KAC/C,OAAM,qBAAqB;CAE7B,MAAM,YAAa,SAAkC;AACrD,KAAI,CAAC,MAAM,QAAQ,UAAU,CAAE,OAAM,qBAAqB;CAE1D,MAAM,QAAkB,EAAE;AAC1B,MAAK,MAAM,QAAQ,WAAW;AAE5B,MAAI,OAAO,SAAS,YAAY,CAAC,SAAS,SAAS,KAAK,CACtD,OAAM,qBAAqB;AAE7B,MAAI,MAAM,SAAS,KAAK,CAAE,OAAM,qBAAqB;AACrD,QAAM,KAAK,KAAK;;AAElB,gBAAe,MAAM;AACrB,QAAO"}