@entifix/next-shell 0.1.0-0

package/dist/lib/command-palette/use-tabs-source.d.ts

@@ -0,0 +1,20 @@
+import { type CommandSource } from '@entifix/core';
+/**
+ * The workspace's open tabs, as one group.
+ *
+ * Read straight from the store rather than through a prop, because the palette
+ * is mounted in the chrome and the tabs are the workspace's — there is no
+ * component between them to thread it through.
+ *
+ * ⚠️ Outside `/workspace` the store is deliberately **unhydrated**
+ * (`skipHydration: true`, rehydrated by `WorkspaceShell`), so this group is
+ * empty there and the palette drops it. That is right rather than a limitation:
+ * a tab is a thing you can return to inside the workspace, and offering one from
+ * a plain route would navigate somewhere the person did not ask to be.
+ *
+ * Selecting one is a **deep link**, not a store call: `?tab=` is the tab's
+ * address (ADR 0042), so the workspace focuses it on arrival and the palette
+ * does not have to be inside the workspace tree to reach the store's actions.
+ */
+export declare function useTabsSource(term: string): CommandSource;
+//# sourceMappingURL=use-tabs-source.d.ts.map

package/dist/lib/command-palette/use-tabs-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-tabs-source.d.ts","sourceRoot":"","sources":["../../../src/lib/command-palette/use-tabs-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,aAAa,EAEnB,MAAM,eAAe,CAAC;AAOvB;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAwBzD"}

package/dist/lib/command-palette/use-tabs-source.js

@@ -0,0 +1,52 @@
+'use client';
+import { matchesCommand } from '@entifix/core';
+import { useT } from '@entifix/react-controls';
+import { useMemo } from 'react';
+import { useLocaleHref } from '../i18n/index.js';
+import { useTabsState } from '../workspace/tabs-state.js';
+/**
+ * The workspace's open tabs, as one group.
+ *
+ * Read straight from the store rather than through a prop, because the palette
+ * is mounted in the chrome and the tabs are the workspace's — there is no
+ * component between them to thread it through.
+ *
+ * ⚠️ Outside `/workspace` the store is deliberately **unhydrated**
+ * (`skipHydration: true`, rehydrated by `WorkspaceShell`), so this group is
+ * empty there and the palette drops it. That is right rather than a limitation:
+ * a tab is a thing you can return to inside the workspace, and offering one from
+ * a plain route would navigate somewhere the person did not ask to be.
+ *
+ * Selecting one is a **deep link**, not a store call: `?tab=` is the tab's
+ * address (ADR 0042), so the workspace focuses it on arrival and the palette
+ * does not have to be inside the workspace tree to reach the store's actions.
+ */ export function useTabsSource(term) {
+    const t = useT('shell');
+    const withLocale = useLocaleHref();
+    const tabs = useTabsState((state)=>state.tabs);
+    return useMemo(()=>{
+        const options = tabs.map((tab)=>({
+                id: `tab:${tab.param}`,
+                label: tab.title,
+                href: withLocale(`/workspace?tab=${encodeURIComponent(tab.param)}`)
+            }));
+        return {
+            key: 'tabs',
+            groups: [
+                {
+                    key: 'tabs',
+                    label: t('commandPalette.groups.tabs'),
+                    options: options.filter((option)=>matchesCommand(term, option)),
+                    isLoading: false
+                }
+            ]
+        };
+    }, [
+        tabs,
+        term,
+        t,
+        withLocale
+    ]);
+}
+
+//# sourceMappingURL=use-tabs-source.js.map

package/dist/lib/command-palette/use-tabs-source.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/command-palette/use-tabs-source.ts"],"sourcesContent":["'use client';\n\nimport {\n  type CommandOption,\n  type CommandSource,\n  matchesCommand,\n} from '@entifix/core';\nimport { useT } from '@entifix/react-controls';\nimport { useMemo } from 'react';\n\nimport { useLocaleHref } from '../i18n/index.js';\nimport { useTabsState } from '../workspace/tabs-state.js';\n\n/**\n * The workspace's open tabs, as one group.\n *\n * Read straight from the store rather than through a prop, because the palette\n * is mounted in the chrome and the tabs are the workspace's — there is no\n * component between them to thread it through.\n *\n * ⚠️ Outside `/workspace` the store is deliberately **unhydrated**\n * (`skipHydration: true`, rehydrated by `WorkspaceShell`), so this group is\n * empty there and the palette drops it. That is right rather than a limitation:\n * a tab is a thing you can return to inside the workspace, and offering one from\n * a plain route would navigate somewhere the person did not ask to be.\n *\n * Selecting one is a **deep link**, not a store call: `?tab=` is the tab's\n * address (ADR 0042), so the workspace focuses it on arrival and the palette\n * does not have to be inside the workspace tree to reach the store's actions.\n */\nexport function useTabsSource(term: string): CommandSource {\n  const t = useT('shell');\n  const withLocale = useLocaleHref();\n  const tabs = useTabsState(state => state.tabs);\n\n  return useMemo(() => {\n    const options: CommandOption[] = tabs.map(tab => ({\n      id: `tab:${tab.param}`,\n      label: tab.title,\n      href: withLocale(`/workspace?tab=${encodeURIComponent(tab.param)}`),\n    }));\n\n    return {\n      key: 'tabs',\n      groups: [\n        {\n          key: 'tabs',\n          label: t('commandPalette.groups.tabs'),\n          options: options.filter(option => matchesCommand(term, option)),\n          isLoading: false,\n        },\n      ],\n    } satisfies CommandSource;\n  }, [tabs, term, t, withLocale]);\n}\n"],"names":["matchesCommand","useT","useMemo","useLocaleHref","useTabsState","useTabsSource","term","t","withLocale","tabs","state","options","map","tab","id","param","label","title","href","encodeURIComponent","key","groups","filter","option","isLoading"],"mappings":"AAAA;AAEA,SAGEA,cAAc,QACT,gBAAgB;AACvB,SAASC,IAAI,QAAQ,0BAA0B;AAC/C,SAASC,OAAO,QAAQ,QAAQ;AAEhC,SAASC,aAAa,QAAQ,mBAAmB;AACjD,SAASC,YAAY,QAAQ,6BAA6B;AAE1D;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,SAASC,cAAcC,IAAY;IACxC,MAAMC,IAAIN,KAAK;IACf,MAAMO,aAAaL;IACnB,MAAMM,OAAOL,aAAaM,CAAAA,QAASA,MAAMD,IAAI;IAE7C,OAAOP,QAAQ;QACb,MAAMS,UAA2BF,KAAKG,GAAG,CAACC,CAAAA,MAAQ,CAAA;gBAChDC,IAAI,CAAC,IAAI,EAAED,IAAIE,KAAK,EAAE;gBACtBC,OAAOH,IAAII,KAAK;gBAChBC,MAAMV,WAAW,CAAC,eAAe,EAAEW,mBAAmBN,IAAIE,KAAK,GAAG;YACpE,CAAA;QAEA,OAAO;YACLK,KAAK;YACLC,QAAQ;gBACN;oBACED,KAAK;oBACLJ,OAAOT,EAAE;oBACTI,SAASA,QAAQW,MAAM,CAACC,CAAAA,SAAUvB,eAAeM,MAAMiB;oBACvDC,WAAW;gBACb;aACD;QACH;IACF,GAAG;QAACf;QAAMH;QAAMC;QAAGC;KAAW;AAChC"}

package/dist/lib/command-palette/use-use-cases-source.d.ts

@@ -0,0 +1,22 @@
+import { type CommandSource, type Entity, type EntityConstructor, type EntityMetadataSource } from '@entifix/core';
+/** How a declared verb is actually carried out, keyed by the verb. */
+export type UseCaseHandlers = Readonly<Record<string, () => Promise<void>>>;
+/** One entity whose served affordances contribute palette commands. */
+export interface UseCaseCommandEntity<TEntity extends Entity = Entity> {
+    readonly entityConstructor: EntityConstructor<TEntity>;
+    /** Where `GET /api/<entity>/$metadata` is reached. */
+    readonly metadataSource: EntityMetadataSource;
+    readonly handlers: UseCaseHandlers;
+}
+/**
+ * Every declared entity's palette verbs, as one source per entity.
+ *
+ * **Why the rule is disabled below.** `entities` is declared once at module
+ * scope by the host and closed over, so it is the same array on every render and
+ * the hook count is fixed — the invariant `react-hooks/rules-of-hooks` protects
+ * and cannot see, because it reasons about the loop syntactically rather than
+ * about the array's provenance. It is isolated here so the disable is written
+ * once, with its reason, exactly as `useEntityLinkSources` does for pickers.
+ */
+export declare function useUseCaseSources(entities: readonly UseCaseCommandEntity[], term: string): CommandSource[];
+//# sourceMappingURL=use-use-cases-source.d.ts.map

package/dist/lib/command-palette/use-use-cases-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"use-use-cases-source.d.ts","sourceRoot":"","sources":["../../../src/lib/command-palette/use-use-cases-source.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,aAAa,EAElB,KAAK,MAAM,EACX,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EAI1B,MAAM,eAAe,CAAC;AASvB,sEAAsE;AACtE,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAE5E,uEAAuE;AACvE,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM;IACnE,QAAQ,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvD,sDAAsD;IACtD,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;CACpC;AAqFD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,SAAS,oBAAoB,EAAE,EACzC,IAAI,EAAE,MAAM,GACX,aAAa,EAAE,CAOjB"}

package/dist/lib/command-palette/use-use-cases-source.js

@@ -0,0 +1,93 @@
+'use client';
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { EntifixLogicError, envelopeEntityName, matchesCommand, parseKeywords } from '@entifix/core';
+import { useCasesForSurface, useT, useTranslateKey } from '@entifix/react-controls';
+import { useEntityUseCases } from '@entifix/react-integration';
+import { useMemo } from 'react';
+/**
+ * The `unbound` verbs this caller may invoke, as one group.
+ *
+ * This is the surface ADR 0035 mapped and nothing rendered: all three
+ * `unbound:*` cells resolve to `'command-palette'`, and until now the palette
+ * did not exist, so a verb declared there was granted, exported, passed every
+ * `@r10c/slices` invariant and simply never appeared.
+ *
+ * The descriptors are **served, not imported**: `$metadata` filters them through
+ * `PolicyDecisionTag` against the verified principal, which is a stronger check
+ * than anything the browser could do — and it keeps every `@useCase()` class's
+ * `Effect` body, repository tags and import closure out of the client bundle.
+ *
+ * ⚠️ A descriptor with **no handler throws**, at the first render of the
+ * palette rather than on the click. A verb that appears and does nothing is
+ * worse than one that is absent: it reads as a broken feature rather than a
+ * missing wire, and it is the same posture `assertSearchable` and `surfaceFor`
+ * already take.
+ */ function useUseCasesSource(entity, term) {
+    const t = useT('shell');
+    const translateKey = useTranslateKey();
+    const { metadata, isLoading } = useEntityUseCases(entity.entityConstructor, entity.metadataSource);
+    // Outside the memo: `useCasesForSurface` is a plain filter, but the name reads
+    // as a hook to `react-hooks/rules-of-hooks`, which then refuses it inside a
+    // callback. Hoisting is free — it is pure and cheap.
+    const descriptors = useCasesForSurface('command-palette', metadata == null ? void 0 : metadata.useCases);
+    return useMemo(()=>{
+        const name = envelopeEntityName(entity.entityConstructor);
+        const options = descriptors.map((descriptor)=>{
+            const run = entity.handlers[descriptor.key];
+            if (run === undefined) {
+                throw new EntifixLogicError(`The use case "${descriptor.key}" on ${name} reaches the command palette but this host registered no handler for it. ` + 'Add one to the entity’s `handlers`, or stop declaring the verb `unbound`.', undefined, {
+                    entity: name,
+                    key: descriptor.key
+                });
+            }
+            return _extends({
+                id: `use-case:${name}:${descriptor.key}`,
+                label: translateKey(descriptor.labelKey),
+                keywords: parseKeywords(descriptor.keywordsKey === undefined ? undefined : translateKey(descriptor.keywordsKey)),
+                run
+            }, descriptor.confirm === undefined ? {} : {
+                confirm: {
+                    tone: descriptor.confirm.tone,
+                    message: translateKey(descriptor.confirm.messageKey)
+                }
+            });
+        });
+        return {
+            key: `use-cases:${name}`,
+            groups: [
+                {
+                    key: `use-cases:${name}`,
+                    label: t('commandPalette.groups.actions'),
+                    options: options.filter((option)=>matchesCommand(term, option)),
+                    isLoading
+                }
+            ]
+        };
+    }, [
+        entity,
+        descriptors,
+        isLoading,
+        term,
+        t,
+        translateKey
+    ]);
+}
+/**
+ * Every declared entity's palette verbs, as one source per entity.
+ *
+ * **Why the rule is disabled below.** `entities` is declared once at module
+ * scope by the host and closed over, so it is the same array on every render and
+ * the hook count is fixed — the invariant `react-hooks/rules-of-hooks` protects
+ * and cannot see, because it reasons about the loop syntactically rather than
+ * about the array's provenance. It is isolated here so the disable is written
+ * once, with its reason, exactly as `useEntityLinkSources` does for pickers.
+ */ export function useUseCaseSources(entities, term) {
+    const sources = [];
+    for (const entity of entities){
+        // eslint-disable-next-line react-hooks/rules-of-hooks -- fixed-length loop over a module-scope array; see the note above.
+        sources.push(useUseCasesSource(entity, term));
+    }
+    return sources;
+}
+
+//# sourceMappingURL=use-use-cases-source.js.map

package/dist/lib/command-palette/use-use-cases-source.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/command-palette/use-use-cases-source.ts"],"sourcesContent":["'use client';\n\nimport {\n  type CommandOption,\n  type CommandSource,\n  EntifixLogicError,\n  type Entity,\n  type EntityConstructor,\n  type EntityMetadataSource,\n  envelopeEntityName,\n  matchesCommand,\n  parseKeywords,\n} from '@entifix/core';\nimport {\n  useCasesForSurface,\n  useT,\n  useTranslateKey,\n} from '@entifix/react-controls';\nimport { useEntityUseCases } from '@entifix/react-integration';\nimport { useMemo } from 'react';\n\n/** How a declared verb is actually carried out, keyed by the verb. */\nexport type UseCaseHandlers = Readonly<Record<string, () => Promise<void>>>;\n\n/** One entity whose served affordances contribute palette commands. */\nexport interface UseCaseCommandEntity<TEntity extends Entity = Entity> {\n  readonly entityConstructor: EntityConstructor<TEntity>;\n  /** Where `GET /api/<entity>/$metadata` is reached. */\n  readonly metadataSource: EntityMetadataSource;\n  readonly handlers: UseCaseHandlers;\n}\n\n/**\n * The `unbound` verbs this caller may invoke, as one group.\n *\n * This is the surface ADR 0035 mapped and nothing rendered: all three\n * `unbound:*` cells resolve to `'command-palette'`, and until now the palette\n * did not exist, so a verb declared there was granted, exported, passed every\n * `@r10c/slices` invariant and simply never appeared.\n *\n * The descriptors are **served, not imported**: `$metadata` filters them through\n * `PolicyDecisionTag` against the verified principal, which is a stronger check\n * than anything the browser could do — and it keeps every `@useCase()` class's\n * `Effect` body, repository tags and import closure out of the client bundle.\n *\n * ⚠️ A descriptor with **no handler throws**, at the first render of the\n * palette rather than on the click. A verb that appears and does nothing is\n * worse than one that is absent: it reads as a broken feature rather than a\n * missing wire, and it is the same posture `assertSearchable` and `surfaceFor`\n * already take.\n */\nfunction useUseCasesSource(\n  entity: UseCaseCommandEntity,\n  term: string,\n): CommandSource {\n  const t = useT('shell');\n  const translateKey = useTranslateKey();\n  const { metadata, isLoading } = useEntityUseCases(\n    entity.entityConstructor,\n    entity.metadataSource,\n  );\n\n  // Outside the memo: `useCasesForSurface` is a plain filter, but the name reads\n  // as a hook to `react-hooks/rules-of-hooks`, which then refuses it inside a\n  // callback. Hoisting is free — it is pure and cheap.\n  const descriptors = useCasesForSurface('command-palette', metadata?.useCases);\n\n  return useMemo(() => {\n    const name = envelopeEntityName(entity.entityConstructor);\n\n    const options: CommandOption[] = descriptors.map(descriptor => {\n      const run = entity.handlers[descriptor.key];\n      if (run === undefined) {\n        throw new EntifixLogicError(\n          `The use case \"${descriptor.key}\" on ${name} reaches the command palette but this host registered no handler for it. ` +\n            'Add one to the entity’s `handlers`, or stop declaring the verb `unbound`.',\n          undefined,\n          { entity: name, key: descriptor.key },\n        );\n      }\n\n      return {\n        id: `use-case:${name}:${descriptor.key}`,\n        label: translateKey(descriptor.labelKey),\n        keywords: parseKeywords(\n          descriptor.keywordsKey === undefined\n            ? undefined\n            : translateKey(descriptor.keywordsKey),\n        ),\n        run,\n        ...(descriptor.confirm === undefined\n          ? {}\n          : {\n              confirm: {\n                tone: descriptor.confirm.tone,\n                message: translateKey(descriptor.confirm.messageKey),\n              },\n            }),\n      } satisfies CommandOption;\n    });\n\n    return {\n      key: `use-cases:${name}`,\n      groups: [\n        {\n          key: `use-cases:${name}`,\n          label: t('commandPalette.groups.actions'),\n          options: options.filter(option => matchesCommand(term, option)),\n          isLoading,\n        },\n      ],\n    } satisfies CommandSource;\n  }, [entity, descriptors, isLoading, term, t, translateKey]);\n}\n\n/**\n * Every declared entity's palette verbs, as one source per entity.\n *\n * **Why the rule is disabled below.** `entities` is declared once at module\n * scope by the host and closed over, so it is the same array on every render and\n * the hook count is fixed — the invariant `react-hooks/rules-of-hooks` protects\n * and cannot see, because it reasons about the loop syntactically rather than\n * about the array's provenance. It is isolated here so the disable is written\n * once, with its reason, exactly as `useEntityLinkSources` does for pickers.\n */\nexport function useUseCaseSources(\n  entities: readonly UseCaseCommandEntity[],\n  term: string,\n): CommandSource[] {\n  const sources: CommandSource[] = [];\n  for (const entity of entities) {\n    // eslint-disable-next-line react-hooks/rules-of-hooks -- fixed-length loop over a module-scope array; see the note above.\n    sources.push(useUseCasesSource(entity, term));\n  }\n  return sources;\n}\n"],"names":["EntifixLogicError","envelopeEntityName","matchesCommand","parseKeywords","useCasesForSurface","useT","useTranslateKey","useEntityUseCases","useMemo","useUseCasesSource","entity","term","t","translateKey","metadata","isLoading","entityConstructor","metadataSource","descriptors","useCases","name","options","map","descriptor","run","handlers","key","undefined","id","label","labelKey","keywords","keywordsKey","confirm","tone","message","messageKey","groups","filter","option","useUseCaseSources","entities","sources","push"],"mappings":"AAAA;;AAEA,SAGEA,iBAAiB,EAIjBC,kBAAkB,EAClBC,cAAc,EACdC,aAAa,QACR,gBAAgB;AACvB,SACEC,kBAAkB,EAClBC,IAAI,EACJC,eAAe,QACV,0BAA0B;AACjC,SAASC,iBAAiB,QAAQ,6BAA6B;AAC/D,SAASC,OAAO,QAAQ,QAAQ;AAahC;;;;;;;;;;;;;;;;;;CAkBC,GACD,SAASC,kBACPC,MAA4B,EAC5BC,IAAY;IAEZ,MAAMC,IAAIP,KAAK;IACf,MAAMQ,eAAeP;IACrB,MAAM,EAAEQ,QAAQ,EAAEC,SAAS,EAAE,GAAGR,kBAC9BG,OAAOM,iBAAiB,EACxBN,OAAOO,cAAc;IAGvB,+EAA+E;IAC/E,4EAA4E;IAC5E,qDAAqD;IACrD,MAAMC,cAAcd,mBAAmB,mBAAmBU,4BAAAA,SAAUK,QAAQ;IAE5E,OAAOX,QAAQ;QACb,MAAMY,OAAOnB,mBAAmBS,OAAOM,iBAAiB;QAExD,MAAMK,UAA2BH,YAAYI,GAAG,CAACC,CAAAA;YAC/C,MAAMC,MAAMd,OAAOe,QAAQ,CAACF,WAAWG,GAAG,CAAC;YAC3C,IAAIF,QAAQG,WAAW;gBACrB,MAAM,IAAI3B,kBACR,CAAC,cAAc,EAAEuB,WAAWG,GAAG,CAAC,KAAK,EAAEN,KAAK,yEAAyE,CAAC,GACpH,6EACFO,WACA;oBAAEjB,QAAQU;oBAAMM,KAAKH,WAAWG,GAAG;gBAAC;YAExC;YAEA,OAAO;gBACLE,IAAI,CAAC,SAAS,EAAER,KAAK,CAAC,EAAEG,WAAWG,GAAG,EAAE;gBACxCG,OAAOhB,aAAaU,WAAWO,QAAQ;gBACvCC,UAAU5B,cACRoB,WAAWS,WAAW,KAAKL,YACvBA,YACAd,aAAaU,WAAWS,WAAW;gBAEzCR;eACID,WAAWU,OAAO,KAAKN,YACvB,CAAC,IACD;gBACEM,SAAS;oBACPC,MAAMX,WAAWU,OAAO,CAACC,IAAI;oBAC7BC,SAAStB,aAAaU,WAAWU,OAAO,CAACG,UAAU;gBACrD;YACF;QAER;QAEA,OAAO;YACLV,KAAK,CAAC,UAAU,EAAEN,MAAM;YACxBiB,QAAQ;gBACN;oBACEX,KAAK,CAAC,UAAU,EAAEN,MAAM;oBACxBS,OAAOjB,EAAE;oBACTS,SAASA,QAAQiB,MAAM,CAACC,CAAAA,SAAUrC,eAAeS,MAAM4B;oBACvDxB;gBACF;aACD;QACH;IACF,GAAG;QAACL;QAAQQ;QAAaH;QAAWJ;QAAMC;QAAGC;KAAa;AAC5D;AAEA;;;;;;;;;CASC,GACD,OAAO,SAAS2B,kBACdC,QAAyC,EACzC9B,IAAY;IAEZ,MAAM+B,UAA2B,EAAE;IACnC,KAAK,MAAMhC,UAAU+B,SAAU;QAC7B,0HAA0H;QAC1HC,QAAQC,IAAI,CAAClC,kBAAkBC,QAAQC;IACzC;IACA,OAAO+B;AACT"}

package/dist/lib/config/config-route.d.ts

@@ -0,0 +1,51 @@
+/** A group of parameters as `ConfigurationPlain` carries them. */
+type PlainConfiguration = Record<string, Array<{
+    key: string;
+    value: unknown;
+}>>;
+/**
+ * Rewrites backend addresses to the app's own same-origin proxy paths.
+ *
+ * config-service holds the real address, which is what the *server* needs. A
+ * browser pointed at it would be making a cross-origin request that carries no
+ * session cookie and gets a `401` — `entifix_at` is httpOnly and same-origin, and
+ * host-scoping it does not help, since that governs which host stores the cookie
+ * rather than which cross-origin requests send it.
+ *
+ * So each service domain is swapped for a path on this app's own origin before
+ * the browser ever sees it, which leaves the entity adapters unaware that a proxy
+ * exists at all. `map` is keyed by the configuration key, e.g.
+ * `{ 'config-service-domain': '/api/system' }`.
+ *
+ * Keys absent from `map` are passed through untouched, so an app only names the
+ * domains it actually proxies.
+ */
+export declare const rewriteServiceDomains: (plain: PlainConfiguration, map: Readonly<Record<string, string>>) => PlainConfiguration;
+/**
+ * Where config-service answers, for the callers that reach it directly.
+ *
+ * One declaration rather than two: this route is no longer the only server-side
+ * caller — the storefront's server components read their own configuration from
+ * config-service without a route in between, because a Next app cannot fetch
+ * its own `/api/config` while prerendering itself.
+ */
+export declare const configApiUrl: () => string;
+export interface ConfigRouteOptions {
+    /** This app's key in the `configuration` table, e.g. `back-office-app`. */
+    readonly service: string;
+    /** Service domains to rewrite to same-origin proxy paths. */
+    readonly proxies?: Readonly<Record<string, string>>;
+    /** Overrides `CONFIG_API_URL`; mainly for tests. */
+    readonly configApiUrl?: string;
+}
+/**
+ * Builds the `GET /api/config` route handler every Next app exposes: fetch this
+ * app's configuration from config-service, rewrite the proxied domains, and hand
+ * the result to the browser.
+ *
+ * Shared because all three apps did the same thing, and because the shared-token
+ * header is the kind of detail that goes stale in one copy out of three.
+ */
+export declare const createConfigRoute: ({ service, proxies, configApiUrl: configApiUrlOverride, }: ConfigRouteOptions) => () => Promise<Response>;
+export {};
+//# sourceMappingURL=config-route.d.ts.map

package/dist/lib/config/config-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-route.d.ts","sourceRoot":"","sources":["../../../src/lib/config/config-route.ts"],"names":[],"mappings":"AAIA,kEAAkE;AAClE,KAAK,kBAAkB,GAAG,MAAM,CAC9B,MAAM,EACN,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,CAAC,CACvC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,kBAAkB,EACzB,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KACpC,kBAOD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,QAAO,MAC0B,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,6DAA6D;IAC7D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,oDAAoD;IACpD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,GAAI,2DAI/B,kBAAkB,WACG,OAAO,CAAC,QAAQ,CAkBrC,CAAC"}

package/dist/lib/config/config-route.js

@@ -0,0 +1,65 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { NextResponse } from 'next/server';
+import { SERVICE_TOKEN_HEADER, serviceToken } from './service-token.js';
+/**
+ * Rewrites backend addresses to the app's own same-origin proxy paths.
+ *
+ * config-service holds the real address, which is what the *server* needs. A
+ * browser pointed at it would be making a cross-origin request that carries no
+ * session cookie and gets a `401` — `entifix_at` is httpOnly and same-origin, and
+ * host-scoping it does not help, since that governs which host stores the cookie
+ * rather than which cross-origin requests send it.
+ *
+ * So each service domain is swapped for a path on this app's own origin before
+ * the browser ever sees it, which leaves the entity adapters unaware that a proxy
+ * exists at all. `map` is keyed by the configuration key, e.g.
+ * `{ 'config-service-domain': '/api/system' }`.
+ *
+ * Keys absent from `map` are passed through untouched, so an app only names the
+ * domains it actually proxies.
+ */ export const rewriteServiceDomains = (plain, map)=>{
+    var _plain_uri;
+    return _extends({}, plain, {
+        uri: ((_plain_uri = plain['uri']) != null ? _plain_uri : []).map((parameter)=>parameter.key in map ? _extends({}, parameter, {
+                value: map[parameter.key]
+            }) : parameter)
+    });
+};
+/**
+ * Where config-service answers, for the callers that reach it directly.
+ *
+ * One declaration rather than two: this route is no longer the only server-side
+ * caller — the storefront's server components read their own configuration from
+ * config-service without a route in between, because a Next app cannot fetch
+ * its own `/api/config` while prerendering itself.
+ */ export const configApiUrl = ()=>{
+    var _process_env_CONFIG_API_URL;
+    return (_process_env_CONFIG_API_URL = process.env['CONFIG_API_URL']) != null ? _process_env_CONFIG_API_URL : 'http://localhost:3190';
+};
+/**
+ * Builds the `GET /api/config` route handler every Next app exposes: fetch this
+ * app's configuration from config-service, rewrite the proxied domains, and hand
+ * the result to the browser.
+ *
+ * Shared because all three apps did the same thing, and because the shared-token
+ * header is the kind of detail that goes stale in one copy out of three.
+ */ export const createConfigRoute = ({ service, proxies = {}, configApiUrl: configApiUrlOverride })=>async function GET() {
+        const baseUrl = configApiUrlOverride != null ? configApiUrlOverride : configApiUrl();
+        const response = await fetch(`${baseUrl}/api/config/${service}`, {
+            cache: 'no-store',
+            headers: {
+                [SERVICE_TOKEN_HEADER]: serviceToken()
+            }
+        });
+        if (!response.ok) {
+            return NextResponse.json({
+                error: 'Failed to load configuration'
+            }, {
+                status: 502
+            });
+        }
+        const plain = await response.json();
+        return NextResponse.json(rewriteServiceDomains(plain, proxies));
+    };
+
+//# sourceMappingURL=config-route.js.map

package/dist/lib/config/config-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/config/config-route.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\n\nimport { SERVICE_TOKEN_HEADER, serviceToken } from './service-token.js';\n\n/** A group of parameters as `ConfigurationPlain` carries them. */\ntype PlainConfiguration = Record<\n  string,\n  Array<{ key: string; value: unknown }>\n>;\n\n/**\n * Rewrites backend addresses to the app's own same-origin proxy paths.\n *\n * config-service holds the real address, which is what the *server* needs. A\n * browser pointed at it would be making a cross-origin request that carries no\n * session cookie and gets a `401` — `entifix_at` is httpOnly and same-origin, and\n * host-scoping it does not help, since that governs which host stores the cookie\n * rather than which cross-origin requests send it.\n *\n * So each service domain is swapped for a path on this app's own origin before\n * the browser ever sees it, which leaves the entity adapters unaware that a proxy\n * exists at all. `map` is keyed by the configuration key, e.g.\n * `{ 'config-service-domain': '/api/system' }`.\n *\n * Keys absent from `map` are passed through untouched, so an app only names the\n * domains it actually proxies.\n */\nexport const rewriteServiceDomains = (\n  plain: PlainConfiguration,\n  map: Readonly<Record<string, string>>,\n): PlainConfiguration => ({\n  ...plain,\n  uri: (plain['uri'] ?? []).map(parameter =>\n    parameter.key in map\n      ? { ...parameter, value: map[parameter.key] }\n      : parameter,\n  ),\n});\n\n/**\n * Where config-service answers, for the callers that reach it directly.\n *\n * One declaration rather than two: this route is no longer the only server-side\n * caller — the storefront's server components read their own configuration from\n * config-service without a route in between, because a Next app cannot fetch\n * its own `/api/config` while prerendering itself.\n */\nexport const configApiUrl = (): string =>\n  process.env['CONFIG_API_URL'] ?? 'http://localhost:3190';\n\nexport interface ConfigRouteOptions {\n  /** This app's key in the `configuration` table, e.g. `back-office-app`. */\n  readonly service: string;\n  /** Service domains to rewrite to same-origin proxy paths. */\n  readonly proxies?: Readonly<Record<string, string>>;\n  /** Overrides `CONFIG_API_URL`; mainly for tests. */\n  readonly configApiUrl?: string;\n}\n\n/**\n * Builds the `GET /api/config` route handler every Next app exposes: fetch this\n * app's configuration from config-service, rewrite the proxied domains, and hand\n * the result to the browser.\n *\n * Shared because all three apps did the same thing, and because the shared-token\n * header is the kind of detail that goes stale in one copy out of three.\n */\nexport const createConfigRoute = ({\n  service,\n  proxies = {},\n  configApiUrl: configApiUrlOverride,\n}: ConfigRouteOptions) =>\n  async function GET(): Promise<Response> {\n    const baseUrl = configApiUrlOverride ?? configApiUrl();\n\n    const response = await fetch(`${baseUrl}/api/config/${service}`, {\n      cache: 'no-store',\n      headers: { [SERVICE_TOKEN_HEADER]: serviceToken() },\n    });\n\n    if (!response.ok) {\n      return NextResponse.json(\n        { error: 'Failed to load configuration' },\n        { status: 502 },\n      );\n    }\n\n    const plain = (await response.json()) as PlainConfiguration;\n\n    return NextResponse.json(rewriteServiceDomains(plain, proxies));\n  };\n"],"names":["NextResponse","SERVICE_TOKEN_HEADER","serviceToken","rewriteServiceDomains","plain","map","uri","parameter","key","value","configApiUrl","process","env","createConfigRoute","service","proxies","configApiUrlOverride","GET","baseUrl","response","fetch","cache","headers","ok","json","error","status"],"mappings":";AAAA,SAASA,YAAY,QAAQ,cAAc;AAE3C,SAASC,oBAAoB,EAAEC,YAAY,QAAQ,qBAAqB;AAQxE;;;;;;;;;;;;;;;;CAgBC,GACD,OAAO,MAAMC,wBAAwB,CACnCC,OACAC;QAGMD;WAFkB,aACrBA;QACHE,KAAK,EAACF,aAAAA,KAAK,CAAC,MAAM,YAAZA,aAAgB,EAAE,EAAEC,GAAG,CAACE,CAAAA,YAC5BA,UAAUC,GAAG,IAAIH,MACb,aAAKE;gBAAWE,OAAOJ,GAAG,CAACE,UAAUC,GAAG,CAAC;iBACzCD;;EAEL;AAEH;;;;;;;CAOC,GACD,OAAO,MAAMG,eAAe;QAC1BC;YAAAA,8BAAAA,QAAQC,GAAG,CAAC,iBAAiB,YAA7BD,8BAAiC;EAAwB;AAW3D;;;;;;;CAOC,GACD,OAAO,MAAME,oBAAoB,CAAC,EAChCC,OAAO,EACPC,UAAU,CAAC,CAAC,EACZL,cAAcM,oBAAoB,EACf,GACnB,eAAeC;QACb,MAAMC,UAAUF,+BAAAA,uBAAwBN;QAExC,MAAMS,WAAW,MAAMC,MAAM,GAAGF,QAAQ,YAAY,EAAEJ,SAAS,EAAE;YAC/DO,OAAO;YACPC,SAAS;gBAAE,CAACrB,qBAAqB,EAAEC;YAAe;QACpD;QAEA,IAAI,CAACiB,SAASI,EAAE,EAAE;YAChB,OAAOvB,aAAawB,IAAI,CACtB;gBAAEC,OAAO;YAA+B,GACxC;gBAAEC,QAAQ;YAAI;QAElB;QAEA,MAAMtB,QAAS,MAAMe,SAASK,IAAI;QAElC,OAAOxB,aAAawB,IAAI,CAACrB,sBAAsBC,OAAOW;IACxD,EAAE"}

package/dist/lib/config/service-proxy-route.d.ts

@@ -0,0 +1,28 @@
+type Params = {
+    params: Promise<{
+        path: string[];
+    }>;
+};
+export interface ServiceProxyRouteOptions {
+    /** Where the service listens, without the `/api` suffix. */
+    readonly baseUrl: string;
+    /**
+     * A segment to put back in front of the forwarded path.
+     *
+     * ⚠️ **Needed when the proxy's namespace *is* the upstream's route name.**
+     * `/api/stock/stock-item` forwards to `/api/stock-item` because `stock` names
+     * the service and `stock-item` names the entity — two different words. But
+     * `/api/transaction/events` forwards to `/api/events`, which exists nowhere:
+     * there the namespace and the route are the same word, and stripping it
+     * strips half the address.
+     *
+     * Caught on the live lab rather than by any check, and the symptom is exactly
+     * the one this proxy exists to prevent — the SSE stream 404s, a pending write
+     * never settles, and every probe stays green
+     * ([ADR 0036](../../../../../../docs/adr/0036-the-reactive-stream-is-server-sent-and-same-origin.md)).
+     */
+    readonly pathPrefix?: string;
+}
+export declare const createServiceProxyRoute: ({ baseUrl, pathPrefix, }: ServiceProxyRouteOptions) => (request: Request, { params }: Params) => Promise<Response>;
+export {};
+//# sourceMappingURL=service-proxy-route.d.ts.map

package/dist/lib/config/service-proxy-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-proxy-route.d.ts","sourceRoot":"","sources":["../../../src/lib/config/service-proxy-route.ts"],"names":[],"mappings":"AAIA,KAAK,MAAM,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,4DAA4D;IAC5D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;;;;;;;;;OAcG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAgED,eAAO,MAAM,uBAAuB,GAAI,0BAGrC,wBAAwB,eAEd,OAAO,cACJ,MAAM,KACjB,OAAO,CAAC,QAAQ,CA6DpB,CAAC"}

package/dist/lib/config/service-proxy-route.js

@@ -0,0 +1,125 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+import { NextResponse } from 'next/server';
+import { bearerHeader, sessionToken } from '../session/bearer.js';
+/**
+ * Builds a same-origin proxy for one backend service, mounted as a catch-all
+ * route handler — e.g. `app/api/admin/[...path]/route.ts`.
+ *
+ * The browser can never call `:310N` directly: `entifix_at` is httpOnly and
+ * same-origin, so a cross-origin request carries no cookie and a guarded route
+ * answers `401`. Host-scoping the cookie does not help — that governs which host
+ * *stores* it, not which cross-origin requests send it. Routing through the app's
+ * own origin makes the cookie automatic and needs no CORS, which is the same
+ * reason the credential routes are shaped this way.
+ *
+ * The cookie is forwarded upstream as a bearer token. **This proxy grants
+ * nothing** — the service still verifies the token and applies its own
+ * `requirePermission`. It only carries.
+ *
+ * It also carries the **caching contract** in both directions, which it did not
+ * always: rebuilding every response as a fresh body dropped `ETag`,
+ * `Cache-Control` and `Vary`, and forwarded no `If-None-Match`. The effect was
+ * invisible and entirely wasteful — `GET /api/<entity>/$metadata` computes and
+ * hashes a permission-filtered document per request, and a validator that never
+ * reaches the service means it can never answer `304`. Worse, `Vary` is a
+ * *correctness* header here: the document differs per caller, and one stripped
+ * of `Vary: Cookie, Authorization` may be cached and served to a different
+ * principal.
+ *
+ * A factory, because a host mounts one of these per backend it talks to, and
+ * back-office-app now talks to two: marketplace-admin-service for the catalog a
+ * vendor authors, marketplace-service for the platform vocabulary it is
+ * classified in (ADR 0022).
+ */ /**
+ * Response headers that must survive the rebuild.
+ *
+ * Deliberately a short allow-list rather than copying every header: the
+ * upstream's `content-length` and `content-encoding` describe *its* body, and
+ * carrying them onto a response this function reconstructs is how a proxy
+ * serves a truncated payload.
+ */ const CACHE_HEADERS = [
+    'etag',
+    'cache-control',
+    'vary'
+];
+/**
+ * Whether the upstream answer must be piped rather than rebuilt.
+ *
+ * Reading a `text/event-stream` body to completion holds the request open
+ * forever and delivers nothing — no error, no timeout, and the browser's
+ * `EventSource` sits in `CONNECTING` while the service is happily emitting.
+ * It is the most likely way to build the reactive stream, see silence, and go
+ * looking in the wrong service (ADR 0036).
+ */ const isStreamed = (upstream)=>{
+    var _upstream_headers_get;
+    return ((_upstream_headers_get = upstream.headers.get('content-type')) == null ? void 0 : _upstream_headers_get.startsWith('text/event-stream')) === true;
+};
+const passThrough = (upstream)=>{
+    const headers = {};
+    for (const name of CACHE_HEADERS){
+        const value = upstream.headers.get(name);
+        if (value !== null) headers[name] = value;
+    }
+    return headers;
+};
+export const createServiceProxyRoute = ({ baseUrl, pathPrefix })=>{
+    const forward = async (request, { params })=>{
+        const { path } = await params;
+        const search = new URL(request.url).search;
+        const headers = _extends({
+            'content-type': 'application/json'
+        }, bearerHeader(await sessionToken()));
+        // Forwarded, or the validator never reaches the service and every
+        // `$metadata` read is a full document — see {@link CACHE_HEADERS}.
+        const ifNoneMatch = request.headers.get('if-none-match');
+        if (ifNoneMatch !== null) {
+            headers['if-none-match'] = ifNoneMatch;
+        }
+        const hasBody = request.method !== 'GET' && request.method !== 'DELETE';
+        const upstream = await fetch(`${baseUrl}/api/${[
+            pathPrefix,
+            ...path
+        ].filter(Boolean).join('/')}${search}`, {
+            method: request.method,
+            headers,
+            body: hasBody ? await request.text() : undefined,
+            cache: 'no-store'
+        });
+        const passed = passThrough(upstream);
+        // A `304` carries no body by definition, and neither does a `204`. Running
+        // either through a body read is not merely wasteful — a `304` reconstructed
+        // with a body is no longer a `304`.
+        if (upstream.status === 304) {
+            return new NextResponse(null, {
+                status: 304,
+                headers: passed
+            });
+        }
+        // Piped, never buffered, and never re-typed as JSON: the body is an open
+        // stream of frames, and `no-store` is correctness rather than politeness —
+        // this response is scoped to one principal.
+        if (isStreamed(upstream)) {
+            return new NextResponse(upstream.body, {
+                status: upstream.status,
+                headers: _extends({}, passed, {
+                    'content-type': 'text/event-stream',
+                    'cache-control': 'no-store'
+                })
+            });
+        }
+        // 204s and empty bodies must not be run through `json()`.
+        const text = await upstream.text();
+        return text === '' ? new NextResponse(null, {
+            status: upstream.status,
+            headers: passed
+        }) : new NextResponse(text, {
+            status: upstream.status,
+            headers: _extends({}, passed, {
+                'content-type': 'application/json'
+            })
+        });
+    };
+    return forward;
+};
+
+//# sourceMappingURL=service-proxy-route.js.map

package/dist/lib/config/service-proxy-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/config/service-proxy-route.ts"],"sourcesContent":["import { NextResponse } from 'next/server';\n\nimport { bearerHeader, sessionToken } from '../session/bearer.js';\n\ntype Params = { params: Promise<{ path: string[] }> };\n\nexport interface ServiceProxyRouteOptions {\n  /** Where the service listens, without the `/api` suffix. */\n  readonly baseUrl: string;\n  /**\n   * A segment to put back in front of the forwarded path.\n   *\n   * ⚠️ **Needed when the proxy's namespace *is* the upstream's route name.**\n   * `/api/stock/stock-item` forwards to `/api/stock-item` because `stock` names\n   * the service and `stock-item` names the entity — two different words. But\n   * `/api/transaction/events` forwards to `/api/events`, which exists nowhere:\n   * there the namespace and the route are the same word, and stripping it\n   * strips half the address.\n   *\n   * Caught on the live lab rather than by any check, and the symptom is exactly\n   * the one this proxy exists to prevent — the SSE stream 404s, a pending write\n   * never settles, and every probe stays green\n   * ([ADR 0036](../../../../../../docs/adr/0036-the-reactive-stream-is-server-sent-and-same-origin.md)).\n   */\n  readonly pathPrefix?: string;\n}\n\n/**\n * Builds a same-origin proxy for one backend service, mounted as a catch-all\n * route handler — e.g. `app/api/admin/[...path]/route.ts`.\n *\n * The browser can never call `:310N` directly: `entifix_at` is httpOnly and\n * same-origin, so a cross-origin request carries no cookie and a guarded route\n * answers `401`. Host-scoping the cookie does not help — that governs which host\n * *stores* it, not which cross-origin requests send it. Routing through the app's\n * own origin makes the cookie automatic and needs no CORS, which is the same\n * reason the credential routes are shaped this way.\n *\n * The cookie is forwarded upstream as a bearer token. **This proxy grants\n * nothing** — the service still verifies the token and applies its own\n * `requirePermission`. It only carries.\n *\n * It also carries the **caching contract** in both directions, which it did not\n * always: rebuilding every response as a fresh body dropped `ETag`,\n * `Cache-Control` and `Vary`, and forwarded no `If-None-Match`. The effect was\n * invisible and entirely wasteful — `GET /api/<entity>/$metadata` computes and\n * hashes a permission-filtered document per request, and a validator that never\n * reaches the service means it can never answer `304`. Worse, `Vary` is a\n * *correctness* header here: the document differs per caller, and one stripped\n * of `Vary: Cookie, Authorization` may be cached and served to a different\n * principal.\n *\n * A factory, because a host mounts one of these per backend it talks to, and\n * back-office-app now talks to two: marketplace-admin-service for the catalog a\n * vendor authors, marketplace-service for the platform vocabulary it is\n * classified in (ADR 0022).\n */\n/**\n * Response headers that must survive the rebuild.\n *\n * Deliberately a short allow-list rather than copying every header: the\n * upstream's `content-length` and `content-encoding` describe *its* body, and\n * carrying them onto a response this function reconstructs is how a proxy\n * serves a truncated payload.\n */\nconst CACHE_HEADERS = ['etag', 'cache-control', 'vary'] as const;\n\n/**\n * Whether the upstream answer must be piped rather than rebuilt.\n *\n * Reading a `text/event-stream` body to completion holds the request open\n * forever and delivers nothing — no error, no timeout, and the browser's\n * `EventSource` sits in `CONNECTING` while the service is happily emitting.\n * It is the most likely way to build the reactive stream, see silence, and go\n * looking in the wrong service (ADR 0036).\n */\nconst isStreamed = (upstream: Response): boolean =>\n  upstream.headers.get('content-type')?.startsWith('text/event-stream') ===\n  true;\n\nconst passThrough = (upstream: Response): Record<string, string> => {\n  const headers: Record<string, string> = {};\n  for (const name of CACHE_HEADERS) {\n    const value = upstream.headers.get(name);\n    if (value !== null) headers[name] = value;\n  }\n  return headers;\n};\n\nexport const createServiceProxyRoute = ({\n  baseUrl,\n  pathPrefix,\n}: ServiceProxyRouteOptions) => {\n  const forward = async (\n    request: Request,\n    { params }: Params,\n  ): Promise<Response> => {\n    const { path } = await params;\n    const search = new URL(request.url).search;\n\n    const headers: Record<string, string> = {\n      'content-type': 'application/json',\n      ...bearerHeader(await sessionToken()),\n    };\n\n    // Forwarded, or the validator never reaches the service and every\n    // `$metadata` read is a full document — see {@link CACHE_HEADERS}.\n    const ifNoneMatch = request.headers.get('if-none-match');\n    if (ifNoneMatch !== null) {\n      headers['if-none-match'] = ifNoneMatch;\n    }\n\n    const hasBody = request.method !== 'GET' && request.method !== 'DELETE';\n    const upstream = await fetch(\n      `${baseUrl}/api/${[pathPrefix, ...path].filter(Boolean).join('/')}${search}`,\n      {\n        method: request.method,\n        headers,\n        body: hasBody ? await request.text() : undefined,\n        cache: 'no-store',\n      },\n    );\n\n    const passed = passThrough(upstream);\n\n    // A `304` carries no body by definition, and neither does a `204`. Running\n    // either through a body read is not merely wasteful — a `304` reconstructed\n    // with a body is no longer a `304`.\n    if (upstream.status === 304) {\n      return new NextResponse(null, { status: 304, headers: passed });\n    }\n\n    // Piped, never buffered, and never re-typed as JSON: the body is an open\n    // stream of frames, and `no-store` is correctness rather than politeness —\n    // this response is scoped to one principal.\n    if (isStreamed(upstream)) {\n      return new NextResponse(upstream.body, {\n        status: upstream.status,\n        headers: {\n          ...passed,\n          'content-type': 'text/event-stream',\n          'cache-control': 'no-store',\n        },\n      });\n    }\n\n    // 204s and empty bodies must not be run through `json()`.\n    const text = await upstream.text();\n    return text === ''\n      ? new NextResponse(null, { status: upstream.status, headers: passed })\n      : new NextResponse(text, {\n          status: upstream.status,\n          headers: { ...passed, 'content-type': 'application/json' },\n        });\n  };\n\n  return forward;\n};\n"],"names":["NextResponse","bearerHeader","sessionToken","CACHE_HEADERS","isStreamed","upstream","headers","get","startsWith","passThrough","name","value","createServiceProxyRoute","baseUrl","pathPrefix","forward","request","params","path","search","URL","url","ifNoneMatch","hasBody","method","fetch","filter","Boolean","join","body","text","undefined","cache","passed","status"],"mappings":";AAAA,SAASA,YAAY,QAAQ,cAAc;AAE3C,SAASC,YAAY,EAAEC,YAAY,QAAQ,uBAAuB;AAyBlE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BC,GACD;;;;;;;CAOC,GACD,MAAMC,gBAAgB;IAAC;IAAQ;IAAiB;CAAO;AAEvD;;;;;;;;CAQC,GACD,MAAMC,aAAa,CAACC;QAClBA;WAAAA,EAAAA,wBAAAA,SAASC,OAAO,CAACC,GAAG,CAAC,oCAArBF,sBAAsCG,UAAU,CAAC,0BACjD;;AAEF,MAAMC,cAAc,CAACJ;IACnB,MAAMC,UAAkC,CAAC;IACzC,KAAK,MAAMI,QAAQP,cAAe;QAChC,MAAMQ,QAAQN,SAASC,OAAO,CAACC,GAAG,CAACG;QACnC,IAAIC,UAAU,MAAML,OAAO,CAACI,KAAK,GAAGC;IACtC;IACA,OAAOL;AACT;AAEA,OAAO,MAAMM,0BAA0B,CAAC,EACtCC,OAAO,EACPC,UAAU,EACe;IACzB,MAAMC,UAAU,OACdC,SACA,EAAEC,MAAM,EAAU;QAElB,MAAM,EAAEC,IAAI,EAAE,GAAG,MAAMD;QACvB,MAAME,SAAS,IAAIC,IAAIJ,QAAQK,GAAG,EAAEF,MAAM;QAE1C,MAAMb,UAAkC;YACtC,gBAAgB;WACbL,aAAa,MAAMC;QAGxB,kEAAkE;QAClE,mEAAmE;QACnE,MAAMoB,cAAcN,QAAQV,OAAO,CAACC,GAAG,CAAC;QACxC,IAAIe,gBAAgB,MAAM;YACxBhB,OAAO,CAAC,gBAAgB,GAAGgB;QAC7B;QAEA,MAAMC,UAAUP,QAAQQ,MAAM,KAAK,SAASR,QAAQQ,MAAM,KAAK;QAC/D,MAAMnB,WAAW,MAAMoB,MACrB,GAAGZ,QAAQ,KAAK,EAAE;YAACC;eAAeI;SAAK,CAACQ,MAAM,CAACC,SAASC,IAAI,CAAC,OAAOT,QAAQ,EAC5E;YACEK,QAAQR,QAAQQ,MAAM;YACtBlB;YACAuB,MAAMN,UAAU,MAAMP,QAAQc,IAAI,KAAKC;YACvCC,OAAO;QACT;QAGF,MAAMC,SAASxB,YAAYJ;QAE3B,2EAA2E;QAC3E,4EAA4E;QAC5E,oCAAoC;QACpC,IAAIA,SAAS6B,MAAM,KAAK,KAAK;YAC3B,OAAO,IAAIlC,aAAa,MAAM;gBAAEkC,QAAQ;gBAAK5B,SAAS2B;YAAO;QAC/D;QAEA,yEAAyE;QACzE,2EAA2E;QAC3E,4CAA4C;QAC5C,IAAI7B,WAAWC,WAAW;YACxB,OAAO,IAAIL,aAAaK,SAASwB,IAAI,EAAE;gBACrCK,QAAQ7B,SAAS6B,MAAM;gBACvB5B,SAAS,aACJ2B;oBACH,gBAAgB;oBAChB,iBAAiB;;YAErB;QACF;QAEA,0DAA0D;QAC1D,MAAMH,OAAO,MAAMzB,SAASyB,IAAI;QAChC,OAAOA,SAAS,KACZ,IAAI9B,aAAa,MAAM;YAAEkC,QAAQ7B,SAAS6B,MAAM;YAAE5B,SAAS2B;QAAO,KAClE,IAAIjC,aAAa8B,MAAM;YACrBI,QAAQ7B,SAAS6B,MAAM;YACvB5B,SAAS,aAAK2B;gBAAQ,gBAAgB;;QACxC;IACN;IAEA,OAAOlB;AACT,EAAE"}

package/dist/lib/config/service-token.d.ts

@@ -0,0 +1,5 @@
+/** Header config-service reads the shared fleet token from. */
+export declare const SERVICE_TOKEN_HEADER = "x-service-token";
+/** Read on each call so a test (or a rotated deployment) can change it. */
+export declare const serviceToken: () => string;
+//# sourceMappingURL=service-token.d.ts.map

package/dist/lib/config/service-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-token.d.ts","sourceRoot":"","sources":["../../../src/lib/config/service-token.ts"],"names":[],"mappings":"AAaA,+DAA+D;AAC/D,eAAO,MAAM,oBAAoB,oBAAoB,CAAC;AAEtD,2EAA2E;AAC3E,eAAO,MAAM,YAAY,QAAO,MACuB,CAAC"}

package/dist/lib/config/service-token.js

@@ -0,0 +1,18 @@
+/**
+ * config-service's fleet lookup is gated on a shared token, since it serves real
+ * connection strings and the JWT signing key. The literal default keeps local dev
+ * zero-config; it is replaced per environment through `CONFIG_SERVICE_TOKEN`.
+ *
+ * This module is server-only, so the token never reaches the browser.
+ *
+ * It lives on its own because *two* server routes call the gated endpoint: the
+ * `/api/config` fetch and the readiness probe. Readiness reaching it without the
+ * header is how an app answers `503` forever while being perfectly healthy.
+ */ const DEV_SERVICE_TOKEN = 'dev-config-service-token-change-me';
+/** Header config-service reads the shared fleet token from. */ export const SERVICE_TOKEN_HEADER = 'x-service-token';
+/** Read on each call so a test (or a rotated deployment) can change it. */ export const serviceToken = ()=>{
+    var _process_env_CONFIG_SERVICE_TOKEN;
+    return (_process_env_CONFIG_SERVICE_TOKEN = process.env.CONFIG_SERVICE_TOKEN) != null ? _process_env_CONFIG_SERVICE_TOKEN : DEV_SERVICE_TOKEN;
+};
+
+//# sourceMappingURL=service-token.js.map

package/dist/lib/config/service-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/config/service-token.ts"],"sourcesContent":["/**\n * config-service's fleet lookup is gated on a shared token, since it serves real\n * connection strings and the JWT signing key. The literal default keeps local dev\n * zero-config; it is replaced per environment through `CONFIG_SERVICE_TOKEN`.\n *\n * This module is server-only, so the token never reaches the browser.\n *\n * It lives on its own because *two* server routes call the gated endpoint: the\n * `/api/config` fetch and the readiness probe. Readiness reaching it without the\n * header is how an app answers `503` forever while being perfectly healthy.\n */\nconst DEV_SERVICE_TOKEN = 'dev-config-service-token-change-me';\n\n/** Header config-service reads the shared fleet token from. */\nexport const SERVICE_TOKEN_HEADER = 'x-service-token';\n\n/** Read on each call so a test (or a rotated deployment) can change it. */\nexport const serviceToken = (): string =>\n  process.env.CONFIG_SERVICE_TOKEN ?? DEV_SERVICE_TOKEN;\n"],"names":["DEV_SERVICE_TOKEN","SERVICE_TOKEN_HEADER","serviceToken","process","env","CONFIG_SERVICE_TOKEN"],"mappings":"AAAA;;;;;;;;;;CAUC,GACD,MAAMA,oBAAoB;AAE1B,6DAA6D,GAC7D,OAAO,MAAMC,uBAAuB,kBAAkB;AAEtD,yEAAyE,GACzE,OAAO,MAAMC,eAAe;QAC1BC;YAAAA,oCAAAA,QAAQC,GAAG,CAACC,oBAAoB,YAAhCF,oCAAoCH;EAAkB"}

package/dist/lib/crud/entity-crud-form.d.ts

@@ -0,0 +1,49 @@
+import { type EntifixError, type Entity, type EntityConstructor, type EntityMetadataSource } from '@entifix/core';
+import { type EntityDraftStore } from '@entifix/react-integration';
+import type { EntityCatalogKey, EntityCrudLinkSource } from './make-entity-crud.types.js';
+export interface EntityCrudFormProps<TEntity extends Entity> {
+    readonly entityConstructor: EntityConstructor<TEntity>;
+    readonly catalogKey: EntityCatalogKey;
+    readonly hiddenFields: readonly string[];
+    readonly links: readonly EntityCrudLinkSource[];
+    /** The record being edited; `undefined` means this is a create. */
+    readonly entity?: TEntity;
+    readonly isLoading?: boolean;
+    readonly isSaving?: boolean;
+    readonly isDeleting?: boolean;
+    readonly error?: EntifixError;
+    readonly onSave: (entity: TEntity) => void;
+    /** Omitted for a create — there is nothing to delete yet. */
+    readonly onDelete?: () => void;
+    readonly backHref: string;
+    /**
+     * Where to autosave this form's draft. Omitted by a route host, which is what
+     * keeps a plain route ephemeral; the workspace tab host supplies one.
+     */
+    readonly draft?: EntityDraftStore;
+    /**
+     * Where this caller's affordances come from. Absent keeps the pre-ADR-0026
+     * behaviour: Save and Delete render unconditionally and no declared verb
+     * appears — which is what every generated catalog did before it existed.
+     */
+    readonly metadataSource?: EntityMetadataSource;
+    /** Runs a declared `entity`-bound verb on this record, by its key. */
+    readonly onUseCase?: (key: string) => void;
+}
+/**
+ * The generated create/update form. A thin wrapper over the agnostic
+ * {@link EntityForm}: every field, label and validation rule comes from the
+ * entity's own accessor metadata, and `reconstructEntity` derives the submit
+ * rebuild from that same metadata — so nothing here is per-entity but the
+ * constructor, the catalog key and the hidden-field list.
+ *
+ * A hidden member still round-trips. `code` is assigned by the create
+ * transaction and never shown, but it is a plain writable member, so the rebuild
+ * picks it out of the seeded draft; dropping it from the rendered fields is not
+ * dropping it from the draft.
+ *
+ * `useEntityForm` owns the draft and seeds it once, so the page keys this
+ * component by the record id to reseed when the record arrives.
+ */
+export declare function EntityCrudForm<TEntity extends Entity>({ entityConstructor, catalogKey, hiddenFields, links, entity, isLoading, isSaving, isDeleting, error, onSave, onDelete, backHref, draft, metadataSource, onUseCase, }: EntityCrudFormProps<TEntity>): import("react").JSX.Element;
+//# sourceMappingURL=entity-crud-form.d.ts.map