@ferrule-io/ok-fine 0.0.0-stage → 0.3.6

package/dist/cli.js

@@ -0,0 +1,115 @@
+#!/usr/bin/env node
+import { execFile } from "node:child_process";
+import { homedir } from "node:os";
+import { pino } from "pino";
+import { parseCli, USAGE } from "./cli-options.js";
+import { loadConfig, loadStorageConfig } from "./config.js";
+import { lockDataDir } from "./data-dir-lock.js";
+import { startServer, startStdioServer } from "./server.js";
+import { VERSION } from "./version.js";
+const message = (err) => (err instanceof Error ? err.message : String(err));
+/** `git config user.email` in the launch directory; null when unset or git is unavailable. Not `Git`: it forces ok-fine's own email. */
+function localGitEmail(env) {
+    const { promise, resolve } = Promise.withResolvers();
+    execFile("git", ["config", "user.email"], { env }, (error, stdout) => {
+        const email = String(stdout).trim();
+        resolve(error || email.length === 0 ? null : email);
+    });
+    return promise;
+}
+/** Runs `close` once on the first trigger, then exits. */
+function shutdownOnce(close, onError) {
+    let shuttingDown = false;
+    return () => {
+        if (shuttingDown)
+            return;
+        shuttingDown = true;
+        close().then(() => process.exit(0), (err) => {
+            onError(err);
+            process.exit(1);
+        });
+    };
+}
+let inv;
+try {
+    inv = parseCli(process.argv.slice(2), process.env, homedir());
+}
+catch (err) {
+    console.error(`${message(err)}\nRun "ok-fine --help" for usage.`);
+    process.exit(2);
+}
+if (inv.command === "help") {
+    process.stdout.write(USAGE);
+    process.exit(0);
+}
+if (inv.command === "version") {
+    process.stdout.write(`${VERSION}\n`);
+    process.exit(0);
+}
+if (inv.command === "stdio") {
+    let config;
+    try {
+        config = loadStorageConfig(inv.env, { inheritGitEnv: true });
+    }
+    catch (err) {
+        console.error(message(err));
+        process.exit(1);
+    }
+    // stdout carries JSON-RPC only; every log line goes to stderr.
+    const log = pino({ level: config.logLevel }, pino.destination({ dest: 2, sync: true }));
+    try {
+        const release = await lockDataDir(config.dataDir);
+        process.once("exit", release);
+    }
+    catch (err) {
+        log.error(message(err));
+        process.exit(1);
+    }
+    const identity = await localGitEmail(inv.env);
+    log.info({ dataDir: config.dataDir, identity }, "serving MCP over stdio");
+    let server;
+    try {
+        server = await startStdioServer(config, { log, identity });
+    }
+    catch (err) {
+        log.error({ err }, "ok-fine failed to start");
+        process.exit(1);
+    }
+    const shutdown = shutdownOnce(() => server.close(), (err) => log.error({ err }, "shutdown failed"));
+    void server.done.then(shutdown);
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+}
+else {
+    let config;
+    try {
+        config = loadConfig(inv.env, { inheritGitEnv: true });
+    }
+    catch (err) {
+        console.error(message(err));
+        process.exit(1);
+    }
+    try {
+        const release = await lockDataDir(config.dataDir);
+        process.once("exit", release);
+    }
+    catch (err) {
+        console.error(message(err));
+        process.exit(1);
+    }
+    let server;
+    try {
+        server = await startServer(config);
+    }
+    catch (err) {
+        console.error("ok-fine failed to start:", err);
+        process.exit(1);
+    }
+    const shutdown = shutdownOnce(() => {
+        server.app.log.info("shutting down");
+        return server.close();
+    }, (err) => server.app.log.error({ err }, "shutdown failed"));
+    process.once("SIGINT", shutdown);
+    process.once("SIGTERM", shutdown);
+}
+//# sourceMappingURL=cli.js.map

package/dist/config.js

@@ -0,0 +1,196 @@
+import { z } from "zod";
+/** A whole-string decimal integer env var (rejects `8080junk`, `1x`, `1.5`, and blanks). */
+function intEnv(name, fallback, min, max = Number.MAX_SAFE_INTEGER) {
+    return z
+        .string()
+        .default(fallback)
+        .refine((v) => /^\d+$/.test(v), { message: `${name} must be a whole decimal integer` })
+        .transform(Number)
+        .pipe(z.number().int().min(min, `${name} must be >= ${min}`).max(max, `${name} must be <= ${max}`));
+}
+/** An optional whole-string decimal integer env var; unset or empty string evaluates to undefined. */
+function optionalIntEnv(name, min, max = Number.MAX_SAFE_INTEGER) {
+    return z
+        .string()
+        .optional()
+        .transform((v) => (v === undefined || v === "" ? undefined : v))
+        .pipe(z
+        .string()
+        .refine((v) => /^\d+$/.test(v), { message: `${name} must be a whole decimal integer` })
+        .transform(Number)
+        .pipe(z.number().int().min(min, `${name} must be >= ${min}`).max(max, `${name} must be <= ${max}`))
+        .optional());
+}
+function httpUrl(value) {
+    try {
+        const u = new URL(value);
+        return u.protocol === "http:" || u.protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+const storageEnvShape = {
+    LOG_LEVEL: z.enum(["fatal", "error", "warn", "info", "debug", "trace", "silent"]).default("info"),
+    DATA_DIR: z
+        .string()
+        .default("/data")
+        .refine((v) => v.startsWith("/"), "DATA_DIR must be an absolute path"),
+    GIT_BRANCH: z.string().default("main"),
+    GIT_REMOTE_URL: z.string().optional(),
+    GIT_SYNC_INTERVAL_SECONDS: intEnv("GIT_SYNC_INTERVAL_SECONDS", "60", 0),
+    GIT_SSH_KEY_PATH: z.string().optional(),
+    GIT_SSH_KNOWN_HOSTS_PATH: z.string().optional(),
+    GIT_HTTP_USERNAME: z.string().optional(),
+    GIT_HTTP_PASSWORD: z.string().optional(),
+    MAX_FILE_BYTES: intEnv("MAX_FILE_BYTES", "1048576", 1),
+    MAX_ARCHIVE_BYTES: intEnv("MAX_ARCHIVE_BYTES", "52428800", 1),
+    DEFAULT_STALE_AFTER_DAYS: optionalIntEnv("DEFAULT_STALE_AFTER_DAYS", 1, 36500),
+};
+const httpEnvShape = {
+    AUTH_MODE: z.enum(["oidc", "none"], "AUTH_MODE must be oidc or none").default("oidc"),
+    PORT: intEnv("PORT", "8080", 0, 65535),
+    HOST: z.string().default("0.0.0.0"),
+    PUBLIC_BASE_URL: z
+        .string({ message: "PUBLIC_BASE_URL is required" })
+        .refine(httpUrl, "PUBLIC_BASE_URL must be a valid http or https URL"),
+    OAUTH_ISSUER: z.string().optional(),
+    OAUTH_AUDIENCE: z.string().optional(),
+    OAUTH_JWKS_URI: z.string().optional(),
+    OAUTH_SCOPE_READ: z.string().default("okf:read"),
+    OAUTH_SCOPE_WRITE: z.string().default("okf:write"),
+    OAUTH_SCOPE_ADMIN: z.string().default("okf:admin"),
+    OAUTH_IDENTITY_CLAIMS: z.string().default("email,preferred_username,sub"),
+    OAUTH_ALLOW_INSECURE_ISSUER: z.string().optional(),
+};
+function refineGitCredentials(data, ctx) {
+    if (!data || typeof data !== "object")
+        return;
+    if (Boolean(data.GIT_HTTP_USERNAME) !== Boolean(data.GIT_HTTP_PASSWORD)) {
+        ctx.addIssue({
+            code: "custom",
+            path: ["GIT_HTTP_USERNAME"],
+            message: "GIT_HTTP_USERNAME and GIT_HTTP_PASSWORD must be provided together or neither",
+        });
+    }
+}
+const rawEnvSchema = z.object({ ...httpEnvShape, ...storageEnvShape }).superRefine((data, ctx) => {
+    if (!data || typeof data !== "object")
+        return;
+    refineGitCredentials(data, ctx);
+    if (data.AUTH_MODE === "oidc") {
+        if (data.OAUTH_ISSUER === undefined) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["OAUTH_ISSUER"],
+                message: "OAUTH_ISSUER is required",
+            });
+        }
+        else if (!httpUrl(data.OAUTH_ISSUER)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["OAUTH_ISSUER"],
+                message: "OAUTH_ISSUER must be a valid URL",
+            });
+        }
+        if (data.OAUTH_JWKS_URI !== undefined && !httpUrl(data.OAUTH_JWKS_URI)) {
+            ctx.addIssue({
+                code: "custom",
+                path: ["OAUTH_JWKS_URI"],
+                message: "OAUTH_JWKS_URI must be a valid URL",
+            });
+        }
+        if (data.OAUTH_ALLOW_INSECURE_ISSUER !== undefined &&
+            data.OAUTH_ALLOW_INSECURE_ISSUER !== "true" &&
+            data.OAUTH_ALLOW_INSECURE_ISSUER !== "false") {
+            ctx.addIssue({
+                code: "custom",
+                path: ["OAUTH_ALLOW_INSECURE_ISSUER"],
+                message: "OAUTH_ALLOW_INSECURE_ISSUER must be true or false",
+            });
+        }
+    }
+}, { when: () => true });
+const storageEnvSchema = z.object(storageEnvShape).superRefine(refineGitCredentials, { when: () => true });
+function formatConfigError(error) {
+    const errorMessages = error.issues.map((issue) => `${issue.path.join(".") || "config"}: ${issue.message}`);
+    return new Error(`Configuration errors:\n  ${errorMessages.join("\n  ")}`);
+}
+function storageFromRaw(raw, env, options) {
+    return {
+        logLevel: raw.LOG_LEVEL,
+        dataDir: raw.DATA_DIR,
+        gitBranch: raw.GIT_BRANCH,
+        gitRemoteUrl: raw.GIT_REMOTE_URL,
+        gitSyncIntervalSeconds: raw.GIT_SYNC_INTERVAL_SECONDS,
+        gitSshKeyPath: raw.GIT_SSH_KEY_PATH,
+        gitSshKnownHostsPath: raw.GIT_SSH_KNOWN_HOSTS_PATH,
+        gitHttpUsername: raw.GIT_HTTP_USERNAME,
+        gitHttpPassword: raw.GIT_HTTP_PASSWORD,
+        ...(options.inheritGitEnv
+            ? {
+                gitHostEnv: Object.fromEntries(Object.entries(env).filter((e) => e[1] !== undefined)),
+            }
+            : {}),
+        maxFileBytes: raw.MAX_FILE_BYTES,
+        maxArchiveBytes: raw.MAX_ARCHIVE_BYTES,
+        defaultStaleAfterDays: raw.DEFAULT_STALE_AFTER_DAYS,
+    };
+}
+/** Storage-only settings for the stdio transport: needs neither PUBLIC_BASE_URL nor OAUTH_*. */
+export function loadStorageConfig(env, options = {}) {
+    const result = storageEnvSchema.safeParse(env);
+    if (!result.success)
+        throw formatConfigError(result.error);
+    return storageFromRaw(result.data, env, options);
+}
+export function loadConfig(env = process.env, options = {}) {
+    const result = rawEnvSchema.safeParse(env);
+    if (!result.success)
+        throw formatConfigError(result.error);
+    const raw = result.data;
+    const publicBaseUrl = raw.PUBLIC_BASE_URL.replace(/\/+$/, "");
+    let auth;
+    if (raw.AUTH_MODE === "none") {
+        auth = { mode: "none" };
+    }
+    else {
+        if (raw.OAUTH_ISSUER === undefined) {
+            throw new Error("OAUTH_ISSUER is required when AUTH_MODE is oidc");
+        }
+        let oauthAudiences;
+        if (raw.OAUTH_AUDIENCE && raw.OAUTH_AUDIENCE.trim().length > 0) {
+            oauthAudiences = raw.OAUTH_AUDIENCE.split(",")
+                .map((s) => s.trim())
+                .filter((s) => s.length > 0);
+        }
+        else {
+            oauthAudiences = [`${publicBaseUrl}/mcp`];
+        }
+        const identityClaims = raw.OAUTH_IDENTITY_CLAIMS.split(",")
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0);
+        const allowInsecureIssuer = raw.OAUTH_ALLOW_INSECURE_ISSUER === "true";
+        auth = {
+            mode: "oidc",
+            issuer: raw.OAUTH_ISSUER,
+            audiences: oauthAudiences,
+            ...(raw.OAUTH_JWKS_URI === undefined ? {} : { jwksUri: raw.OAUTH_JWKS_URI }),
+            identityClaims,
+            allowInsecureIssuer,
+        };
+    }
+    return {
+        ...storageFromRaw(raw, env, options),
+        port: raw.PORT,
+        host: raw.HOST,
+        publicBaseUrl,
+        auth,
+        scopeNames: {
+            read: raw.OAUTH_SCOPE_READ,
+            write: raw.OAUTH_SCOPE_WRITE,
+            admin: raw.OAUTH_SCOPE_ADMIN,
+        },
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/data-dir-lock.js

@@ -0,0 +1,60 @@
+import { readFileSync, unlinkSync } from "node:fs";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+function errorCode(err) {
+    return err?.code;
+}
+function isRunning(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return errorCode(err) === "EPERM";
+    }
+}
+/**
+ * Takes the exclusive per-data-dir lock for a local CLI process; a lock left by a dead process is taken over.
+ * Returns a synchronous release, safe to call from `process.on("exit")`.
+ */
+export async function lockDataDir(dataDir) {
+    await mkdir(dataDir, { recursive: true });
+    const lockPath = join(dataDir, "ok-fine.lock");
+    const pid = String(process.pid);
+    let holder = "unknown";
+    for (let attempt = 0; attempt < 2; attempt++) {
+        try {
+            await writeFile(lockPath, `${pid}\n`, { flag: "wx" });
+            return () => {
+                try {
+                    if (readFileSync(lockPath, "utf8").trim() === pid)
+                        unlinkSync(lockPath);
+                }
+                catch (err) {
+                    if (errorCode(err) !== "ENOENT")
+                        throw err;
+                }
+            };
+        }
+        catch (err) {
+            if (errorCode(err) !== "EEXIST")
+                throw err;
+        }
+        let content;
+        try {
+            content = (await readFile(lockPath, "utf8")).trim();
+        }
+        catch (err) {
+            if (errorCode(err) === "ENOENT")
+                continue;
+            throw err;
+        }
+        holder = content || "unknown";
+        const holderPid = Number.parseInt(content, 10);
+        if (Number.isInteger(holderPid) && holderPid > 0 && holderPid !== process.pid && isRunning(holderPid))
+            break;
+        await rm(lockPath, { force: true });
+    }
+    throw new Error(`ok-fine is already running on ${dataDir} (pid ${holder}). One process serves a data directory: connect more clients to \`ok-fine serve\` over HTTP, or pass a different --data-dir. If no ok-fine process is running, delete ${lockPath}.`);
+}
+//# sourceMappingURL=data-dir-lock.js.map

package/dist/errors.js

@@ -0,0 +1,13 @@
+export class OkfError extends Error {
+    code;
+    status;
+    details;
+    constructor(code, status, message, details) {
+        super(message);
+        this.name = "OkfError";
+        this.code = code;
+        this.status = status;
+        this.details = details;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/http/mcp-route.js

@@ -0,0 +1,32 @@
+const DROPPED_HEADERS = {
+    host: true,
+    "content-length": true,
+    "transfer-encoding": true,
+    connection: true,
+};
+export function registerMcpRoute(app, mcpFetch, publicBaseUrl) {
+    app.route({
+        method: ["GET", "POST", "DELETE"],
+        url: "/mcp",
+        config: { permission: "read" },
+        handler: async (req, reply) => {
+            const headers = new Headers();
+            for (const [name, value] of Object.entries(req.headers)) {
+                if (value === undefined || DROPPED_HEADERS[name])
+                    continue;
+                headers.set(name, Array.isArray(value) ? value.join(", ") : value);
+            }
+            const request = new Request(new URL(req.url, publicBaseUrl), {
+                method: req.method,
+                headers,
+                body: req.method === "POST" ? JSON.stringify(req.body) : undefined,
+            });
+            const response = await mcpFetch(request, {
+                authInfo: req.authInfo ?? undefined,
+                parsedBody: req.method === "POST" ? req.body : undefined,
+            });
+            return reply.send(response);
+        },
+    });
+}
+//# sourceMappingURL=mcp-route.js.map

package/dist/http/rest.js

@@ -0,0 +1,243 @@
+import { z } from "zod";
+import { OkfError } from "../errors.js";
+import { parseFrontmatter, splitFrontmatter } from "../okf/frontmatter.js";
+const projectParams = z.object({ project: z.string() });
+const wildcardParams = z.object({ project: z.string(), "*": z.string() });
+function principalOf(req) {
+    if (!req.principal)
+        throw new OkfError("internal", 500, "request is not authenticated");
+    return req.principal;
+}
+function actorOf(req) {
+    const actor = req.headers["x-okf-actor"];
+    if (typeof actor !== "string" || actor.trim() === "") {
+        throw new OkfError("invalid_actor", 400, "X-OKF-Actor header is required");
+    }
+    return actor.trim();
+}
+/** Maps If-Match / If-None-Match to the service's expectedRevision (undefined = unconditional). */
+function expectedRevisionOf(req) {
+    const ifMatch = req.headers["if-match"];
+    const ifNoneMatch = req.headers["if-none-match"];
+    if (ifMatch !== undefined && ifNoneMatch !== undefined) {
+        throw new OkfError("bad_request", 400, "send either If-Match or If-None-Match, not both");
+    }
+    if (ifNoneMatch !== undefined) {
+        if (ifNoneMatch.trim() !== "*")
+            throw new OkfError("bad_request", 400, "If-None-Match supports only *");
+        return null;
+    }
+    if (ifMatch !== undefined) {
+        return ifMatch
+            .trim()
+            .replace(/^W\//, "")
+            .replace(/^"(.*)"$/, "$1");
+    }
+    return undefined;
+}
+function withRevision(reply, result) {
+    if (typeof result.revision === "string")
+        reply.header("etag", `"${result.revision}"`);
+    return result;
+}
+function decodeText(body) {
+    let text;
+    if (typeof body === "string") {
+        text = body;
+    }
+    else if (Buffer.isBuffer(body)) {
+        try {
+            text = new TextDecoder("utf-8", { fatal: true }).decode(body);
+        }
+        catch {
+            throw new OkfError("unsupported_media", 415, "file content must be UTF-8 text");
+        }
+    }
+    else {
+        throw new OkfError("unsupported_media", 415, "send text/* or application/octet-stream content");
+    }
+    if (text.includes("\0"))
+        throw new OkfError("unsupported_media", 415, "file content must not contain NUL bytes");
+    return text;
+}
+/** For routes whose target must already exist: If-None-Match: * cannot be honored, so it is rejected. */
+function existingRevisionOf(req) {
+    const expected = expectedRevisionOf(req);
+    if (expected === null) {
+        throw new OkfError("bad_request", 400, "If-None-Match is not supported on this route; use If-Match");
+    }
+    return expected;
+}
+const conceptJsonBody = z.object({
+    frontmatter: z.record(z.string(), z.unknown()),
+    body: z.string(),
+    message: z.string().optional(),
+});
+function conceptInput(req) {
+    if (typeof req.body === "string") {
+        const split = splitFrontmatter(req.body);
+        if (!split)
+            throw new OkfError("invalid_frontmatter", 400, "markdown must start with a --- delimited YAML frontmatter");
+        const parsed = parseFrontmatter(split.yaml);
+        if ("error" in parsed)
+            throw new OkfError("invalid_frontmatter", 400, `${parsed.error}: ${parsed.message}`);
+        return { frontmatter: parsed.data, body: split.body };
+    }
+    return conceptJsonBody.parse(req.body);
+}
+const CONTENT_TYPE_BY_EXTENSION = {
+    ".md": "text/markdown; charset=utf-8",
+    ".json": "application/json",
+};
+const searchQuery = z.object({
+    q: z.string().optional(),
+    project: z.string().optional(),
+    type: z.string().optional(),
+    tag: z.union([z.string(), z.array(z.string())]).optional(),
+    status: z.enum(["draft", "stable", "deprecated"]).optional(),
+    trustTier: z.enum(["unverified", "machine-confirmed", "human-reviewed"]).optional(),
+    stale: z.enum(["true", "false"]).optional(),
+    limit: z.coerce.number().int().min(1).max(100).optional(),
+});
+export function registerRestRoutes(app, service) {
+    const read = { permission: "read" };
+    const write = { permission: "write" };
+    const admin = { permission: "admin" };
+    app.get("/api/v1/projects", { config: read }, async (req) => {
+        const { repository } = z.object({ repository: z.string().optional() }).parse(req.query);
+        return service.listProjects({ repository });
+    });
+    app.post("/api/v1/projects", { config: write }, async (req, reply) => {
+        const body = z
+            .object({ project: z.string(), title: z.string(), description: z.string().optional() })
+            .parse(req.body);
+        const result = await service.createProject(principalOf(req), { ...body, actor: actorOf(req) });
+        return reply.code(201).send(result);
+    });
+    app.get("/api/v1/projects/:project", { config: read }, async (req) => {
+        const { project } = projectParams.parse(req.params);
+        return service.getProject(project);
+    });
+    app.delete("/api/v1/projects/:project", { config: admin }, async (req) => {
+        const { project } = projectParams.parse(req.params);
+        return service.deleteProject(principalOf(req), { project, actor: actorOf(req) });
+    });
+    app.get("/api/v1/projects/:project/index", { config: read }, async (req) => {
+        const { project } = projectParams.parse(req.params);
+        const { path } = z.object({ path: z.string().optional() }).parse(req.query);
+        return service.getIndex(project, path ?? "");
+    });
+    app.get("/api/v1/projects/:project/concepts/*", { config: read }, async (req, reply) => {
+        const { project, "*": id } = wildcardParams.parse(req.params);
+        const concept = withRevision(reply, await service.readConcept(project, id));
+        if ((req.headers.accept ?? "").includes("text/markdown")) {
+            return reply.type("text/markdown; charset=utf-8").send(concept.markdown);
+        }
+        return concept;
+    });
+    app.put("/api/v1/projects/:project/concepts/*", { config: write }, async (req, reply) => {
+        const { project, "*": id } = wildcardParams.parse(req.params);
+        const input = conceptInput(req);
+        const expectedRevision = expectedRevisionOf(req);
+        const result = await service.writeConcept(principalOf(req), {
+            project,
+            id,
+            ...input,
+            actor: actorOf(req),
+            ...(expectedRevision === undefined ? {} : { expectedRevision }),
+        });
+        return reply.code(result.created ? 201 : 200).send(withRevision(reply, result));
+    });
+    app.delete("/api/v1/projects/:project/concepts/*", { config: write }, async (req) => {
+        const { project, "*": id } = wildcardParams.parse(req.params);
+        const expectedRevision = existingRevisionOf(req);
+        return service.deleteConcept(principalOf(req), {
+            project,
+            id,
+            actor: actorOf(req),
+            ...(typeof expectedRevision === "string" ? { expectedRevision } : {}),
+        });
+    });
+    app.post("/api/v1/projects/:project/verifications", { config: write }, async (req, reply) => {
+        const { project } = projectParams.parse(req.params);
+        const { id } = z.object({ id: z.string() }).parse(req.body);
+        const expectedRevision = existingRevisionOf(req);
+        const result = await service.verifyConcept(principalOf(req), {
+            project,
+            id,
+            actor: actorOf(req),
+            ...(typeof expectedRevision === "string" ? { expectedRevision } : {}),
+        });
+        return reply.code(201).send(withRevision(reply, result));
+    });
+    app.get("/api/v1/projects/:project/files/*", { config: read }, async (req, reply) => {
+        const { project, "*": path } = wildcardParams.parse(req.params);
+        const file = withRevision(reply, await service.readFile(project, path));
+        const extension = /\.[^./]+$/.exec(path)?.[0].toLowerCase() ?? "";
+        return reply.type(CONTENT_TYPE_BY_EXTENSION[extension] ?? "text/plain; charset=utf-8").send(file.content);
+    });
+    app.put("/api/v1/projects/:project/files/*", { config: write }, async (req, reply) => {
+        const { project, "*": path } = wildcardParams.parse(req.params);
+        const expectedRevision = expectedRevisionOf(req);
+        const result = await service.writeFile(principalOf(req), {
+            project,
+            path,
+            content: decodeText(req.body),
+            actor: actorOf(req),
+            ...(expectedRevision === undefined ? {} : { expectedRevision }),
+        });
+        return withRevision(reply, result);
+    });
+    app.delete("/api/v1/projects/:project/files/*", { config: write }, async (req) => {
+        const { project, "*": path } = wildcardParams.parse(req.params);
+        const expectedRevision = existingRevisionOf(req);
+        return service.deleteFile(principalOf(req), {
+            project,
+            path,
+            actor: actorOf(req),
+            ...(typeof expectedRevision === "string" ? { expectedRevision } : {}),
+        });
+    });
+    app.get("/api/v1/projects/:project/history", { config: read }, async (req) => {
+        const { project } = projectParams.parse(req.params);
+        const { id, limit } = z
+            .object({ id: z.string().optional(), limit: z.coerce.number().int().min(1).max(100).optional() })
+            .parse(req.query);
+        return service.history(project, id, limit);
+    });
+    app.get("/api/v1/projects/:project/lint", { config: read }, async (req) => {
+        const { project } = projectParams.parse(req.params);
+        return service.lint(project);
+    });
+    app.get("/api/v1/projects/:project/archive", { config: read }, async (req, reply) => {
+        const { project } = projectParams.parse(req.params);
+        const stream = await service.exportArchive(project);
+        return reply
+            .type("application/gzip")
+            .header("content-disposition", `attachment; filename="${project}.tar.gz"`)
+            .send(stream);
+    });
+    app.put("/api/v1/projects/:project/archive", { config: admin }, async (req) => {
+        const { project } = projectParams.parse(req.params);
+        if (!Buffer.isBuffer(req.body)) {
+            throw new OkfError("unsupported_media", 415, "send the archive as application/gzip");
+        }
+        return service.importArchive(principalOf(req), { project, actor: actorOf(req), archive: req.body });
+    });
+    app.get("/api/v1/search", { config: read }, async (req) => {
+        const q = searchQuery.parse(req.query);
+        return service.search({
+            ...(q.q === undefined ? {} : { query: q.q }),
+            ...(q.project === undefined ? {} : { project: q.project }),
+            ...(q.type === undefined ? {} : { type: q.type }),
+            ...(q.tag === undefined ? {} : { tags: Array.isArray(q.tag) ? q.tag : [q.tag] }),
+            ...(q.status === undefined ? {} : { status: q.status }),
+            ...(q.trustTier === undefined ? {} : { trustTier: q.trustTier }),
+            ...(q.stale === undefined ? {} : { stale: q.stale === "true" }),
+            ...(q.limit === undefined ? {} : { limit: q.limit }),
+        });
+    });
+    app.get("/api/v1/sync", { config: read }, async () => service.syncStatus());
+    app.post("/api/v1/sync", { config: admin }, async () => service.syncNow());
+}
+//# sourceMappingURL=rest.js.map