@fuzdev/fuz_app 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +49 -0
- package/dist/actions/action_bridge.d.ts +65 -0
- package/dist/actions/action_bridge.d.ts.map +1 -0
- package/dist/actions/action_bridge.js +76 -0
- package/dist/actions/action_codegen.d.ts +97 -0
- package/dist/actions/action_codegen.d.ts.map +1 -0
- package/dist/actions/action_codegen.js +280 -0
- package/dist/actions/action_registry.d.ts +35 -0
- package/dist/actions/action_registry.d.ts.map +1 -0
- package/dist/actions/action_registry.js +83 -0
- package/dist/actions/action_spec.d.ts +169 -0
- package/dist/actions/action_spec.d.ts.map +1 -0
- package/dist/actions/action_spec.js +76 -0
- package/dist/auth/account_queries.d.ts +96 -0
- package/dist/auth/account_queries.d.ts.map +1 -0
- package/dist/auth/account_queries.js +172 -0
- package/dist/auth/account_routes.d.ts +86 -0
- package/dist/auth/account_routes.d.ts.map +1 -0
- package/dist/auth/account_routes.js +406 -0
- package/dist/auth/account_schema.d.ts +192 -0
- package/dist/auth/account_schema.d.ts.map +1 -0
- package/dist/auth/account_schema.js +105 -0
- package/dist/auth/admin_routes.d.ts +29 -0
- package/dist/auth/admin_routes.d.ts.map +1 -0
- package/dist/auth/admin_routes.js +193 -0
- package/dist/auth/api_token.d.ts +33 -0
- package/dist/auth/api_token.d.ts.map +1 -0
- package/dist/auth/api_token.js +36 -0
- package/dist/auth/api_token_queries.d.ts +80 -0
- package/dist/auth/api_token_queries.d.ts.map +1 -0
- package/dist/auth/api_token_queries.js +116 -0
- package/dist/auth/app_settings_queries.d.ts +33 -0
- package/dist/auth/app_settings_queries.d.ts.map +1 -0
- package/dist/auth/app_settings_queries.js +51 -0
- package/dist/auth/app_settings_routes.d.ts +27 -0
- package/dist/auth/app_settings_routes.d.ts.map +1 -0
- package/dist/auth/app_settings_routes.js +66 -0
- package/dist/auth/app_settings_schema.d.ts +35 -0
- package/dist/auth/app_settings_schema.d.ts.map +1 -0
- package/dist/auth/app_settings_schema.js +22 -0
- package/dist/auth/audit_log_queries.d.ts +90 -0
- package/dist/auth/audit_log_queries.d.ts.map +1 -0
- package/dist/auth/audit_log_queries.js +205 -0
- package/dist/auth/audit_log_routes.d.ts +33 -0
- package/dist/auth/audit_log_routes.d.ts.map +1 -0
- package/dist/auth/audit_log_routes.js +106 -0
- package/dist/auth/audit_log_schema.d.ts +259 -0
- package/dist/auth/audit_log_schema.d.ts.map +1 -0
- package/dist/auth/audit_log_schema.js +123 -0
- package/dist/auth/bearer_auth.d.ts +32 -0
- package/dist/auth/bearer_auth.d.ts.map +1 -0
- package/dist/auth/bearer_auth.js +90 -0
- package/dist/auth/bootstrap_account.d.ts +82 -0
- package/dist/auth/bootstrap_account.d.ts.map +1 -0
- package/dist/auth/bootstrap_account.js +97 -0
- package/dist/auth/bootstrap_routes.d.ts +74 -0
- package/dist/auth/bootstrap_routes.d.ts.map +1 -0
- package/dist/auth/bootstrap_routes.js +154 -0
- package/dist/auth/daemon_token.d.ts +49 -0
- package/dist/auth/daemon_token.d.ts.map +1 -0
- package/dist/auth/daemon_token.js +49 -0
- package/dist/auth/daemon_token_middleware.d.ts +93 -0
- package/dist/auth/daemon_token_middleware.d.ts.map +1 -0
- package/dist/auth/daemon_token_middleware.js +167 -0
- package/dist/auth/ddl.d.ts +27 -0
- package/dist/auth/ddl.d.ts.map +1 -0
- package/dist/auth/ddl.js +111 -0
- package/dist/auth/deps.d.ts +52 -0
- package/dist/auth/deps.d.ts.map +1 -0
- package/dist/auth/deps.js +10 -0
- package/dist/auth/invite_queries.d.ts +68 -0
- package/dist/auth/invite_queries.d.ts.map +1 -0
- package/dist/auth/invite_queries.js +105 -0
- package/dist/auth/invite_routes.d.ts +18 -0
- package/dist/auth/invite_routes.d.ts.map +1 -0
- package/dist/auth/invite_routes.js +129 -0
- package/dist/auth/invite_schema.d.ts +51 -0
- package/dist/auth/invite_schema.d.ts.map +1 -0
- package/dist/auth/invite_schema.js +25 -0
- package/dist/auth/keyring.d.ts +87 -0
- package/dist/auth/keyring.d.ts.map +1 -0
- package/dist/auth/keyring.js +142 -0
- package/dist/auth/middleware.d.ts +40 -0
- package/dist/auth/middleware.d.ts.map +1 -0
- package/dist/auth/middleware.js +64 -0
- package/dist/auth/migrations.d.ts +42 -0
- package/dist/auth/migrations.d.ts.map +1 -0
- package/dist/auth/migrations.js +79 -0
- package/dist/auth/password.d.ts +39 -0
- package/dist/auth/password.d.ts.map +1 -0
- package/dist/auth/password.js +25 -0
- package/dist/auth/password_argon2.d.ts +43 -0
- package/dist/auth/password_argon2.d.ts.map +1 -0
- package/dist/auth/password_argon2.js +76 -0
- package/dist/auth/permit_queries.d.ts +72 -0
- package/dist/auth/permit_queries.d.ts.map +1 -0
- package/dist/auth/permit_queries.js +116 -0
- package/dist/auth/request_context.d.ts +114 -0
- package/dist/auth/request_context.d.ts.map +1 -0
- package/dist/auth/request_context.js +176 -0
- package/dist/auth/require_keeper.d.ts +20 -0
- package/dist/auth/require_keeper.d.ts.map +1 -0
- package/dist/auth/require_keeper.js +35 -0
- package/dist/auth/role_schema.d.ts +69 -0
- package/dist/auth/role_schema.d.ts.map +1 -0
- package/dist/auth/role_schema.js +70 -0
- package/dist/auth/route_guards.d.ts +21 -0
- package/dist/auth/route_guards.d.ts.map +1 -0
- package/dist/auth/route_guards.js +32 -0
- package/dist/auth/session_cookie.d.ts +158 -0
- package/dist/auth/session_cookie.d.ts.map +1 -0
- package/dist/auth/session_cookie.js +135 -0
- package/dist/auth/session_lifecycle.d.ts +35 -0
- package/dist/auth/session_lifecycle.d.ts.map +1 -0
- package/dist/auth/session_lifecycle.js +27 -0
- package/dist/auth/session_middleware.d.ts +33 -0
- package/dist/auth/session_middleware.d.ts.map +1 -0
- package/dist/auth/session_middleware.js +62 -0
- package/dist/auth/session_queries.d.ts +135 -0
- package/dist/auth/session_queries.d.ts.map +1 -0
- package/dist/auth/session_queries.js +186 -0
- package/dist/auth/signup_routes.d.ts +32 -0
- package/dist/auth/signup_routes.d.ts.map +1 -0
- package/dist/auth/signup_routes.js +150 -0
- package/dist/cli/args.d.ts +48 -0
- package/dist/cli/args.d.ts.map +1 -0
- package/dist/cli/args.js +76 -0
- package/dist/cli/config.d.ts +48 -0
- package/dist/cli/config.d.ts.map +1 -0
- package/dist/cli/config.js +77 -0
- package/dist/cli/daemon.d.ts +82 -0
- package/dist/cli/daemon.d.ts.map +1 -0
- package/dist/cli/daemon.js +149 -0
- package/dist/cli/help.d.ts +85 -0
- package/dist/cli/help.d.ts.map +1 -0
- package/dist/cli/help.js +138 -0
- package/dist/cli/logger.d.ts +46 -0
- package/dist/cli/logger.d.ts.map +1 -0
- package/dist/cli/logger.js +48 -0
- package/dist/cli/util.d.ts +36 -0
- package/dist/cli/util.d.ts.map +1 -0
- package/dist/cli/util.js +50 -0
- package/dist/crypto.d.ts +13 -0
- package/dist/crypto.d.ts.map +1 -0
- package/dist/crypto.js +19 -0
- package/dist/db/assert_row.d.ts +18 -0
- package/dist/db/assert_row.d.ts.map +1 -0
- package/dist/db/assert_row.js +24 -0
- package/dist/db/create_db.d.ts +38 -0
- package/dist/db/create_db.d.ts.map +1 -0
- package/dist/db/create_db.js +57 -0
- package/dist/db/db.d.ts +97 -0
- package/dist/db/db.d.ts.map +1 -0
- package/dist/db/db.js +76 -0
- package/dist/db/db_pg.d.ts +21 -0
- package/dist/db/db_pg.d.ts.map +1 -0
- package/dist/db/db_pg.js +45 -0
- package/dist/db/db_pglite.d.ts +21 -0
- package/dist/db/db_pglite.d.ts.map +1 -0
- package/dist/db/db_pglite.js +28 -0
- package/dist/db/migrate.d.ts +67 -0
- package/dist/db/migrate.d.ts.map +1 -0
- package/dist/db/migrate.js +118 -0
- package/dist/db/pg_error.d.ts +16 -0
- package/dist/db/pg_error.d.ts.map +1 -0
- package/dist/db/pg_error.js +15 -0
- package/dist/db/query_deps.d.ts +14 -0
- package/dist/db/query_deps.d.ts.map +1 -0
- package/dist/db/query_deps.js +9 -0
- package/dist/db/sql_identifier.d.ts +27 -0
- package/dist/db/sql_identifier.d.ts.map +1 -0
- package/dist/db/sql_identifier.js +31 -0
- package/dist/db/status.d.ts +62 -0
- package/dist/db/status.d.ts.map +1 -0
- package/dist/db/status.js +116 -0
- package/dist/dev/setup.d.ts +159 -0
- package/dist/dev/setup.d.ts.map +1 -0
- package/dist/dev/setup.js +265 -0
- package/dist/env/dotenv.d.ts +25 -0
- package/dist/env/dotenv.d.ts.map +1 -0
- package/dist/env/dotenv.js +52 -0
- package/dist/env/load.d.ts +52 -0
- package/dist/env/load.d.ts.map +1 -0
- package/dist/env/load.js +79 -0
- package/dist/env/mask.d.ts +19 -0
- package/dist/env/mask.d.ts.map +1 -0
- package/dist/env/mask.js +26 -0
- package/dist/env/resolve.d.ts +126 -0
- package/dist/env/resolve.d.ts.map +1 -0
- package/dist/env/resolve.js +200 -0
- package/dist/hono_context.d.ts +48 -0
- package/dist/hono_context.d.ts.map +1 -0
- package/dist/hono_context.js +22 -0
- package/dist/http/common_routes.d.ts +52 -0
- package/dist/http/common_routes.d.ts.map +1 -0
- package/dist/http/common_routes.js +65 -0
- package/dist/http/db_routes.d.ts +57 -0
- package/dist/http/db_routes.d.ts.map +1 -0
- package/dist/http/db_routes.js +176 -0
- package/dist/http/error_schemas.d.ts +169 -0
- package/dist/http/error_schemas.d.ts.map +1 -0
- package/dist/http/error_schemas.js +178 -0
- package/dist/http/middleware_spec.d.ts +19 -0
- package/dist/http/middleware_spec.d.ts.map +1 -0
- package/dist/http/middleware_spec.js +9 -0
- package/dist/http/origin.d.ts +57 -0
- package/dist/http/origin.d.ts.map +1 -0
- package/dist/http/origin.js +207 -0
- package/dist/http/proxy.d.ts +112 -0
- package/dist/http/proxy.d.ts.map +1 -0
- package/dist/http/proxy.js +240 -0
- package/dist/http/route_spec.d.ts +197 -0
- package/dist/http/route_spec.d.ts.map +1 -0
- package/dist/http/route_spec.js +243 -0
- package/dist/http/schema_helpers.d.ts +64 -0
- package/dist/http/schema_helpers.d.ts.map +1 -0
- package/dist/http/schema_helpers.js +90 -0
- package/dist/http/surface.d.ts +132 -0
- package/dist/http/surface.d.ts.map +1 -0
- package/dist/http/surface.js +156 -0
- package/dist/http/surface_query.d.ts +77 -0
- package/dist/http/surface_query.d.ts.map +1 -0
- package/dist/http/surface_query.js +86 -0
- package/dist/rate_limiter.d.ts +94 -0
- package/dist/rate_limiter.d.ts.map +1 -0
- package/dist/rate_limiter.js +156 -0
- package/dist/realtime/sse.d.ts +80 -0
- package/dist/realtime/sse.d.ts.map +1 -0
- package/dist/realtime/sse.js +109 -0
- package/dist/realtime/sse_auth_guard.d.ts +93 -0
- package/dist/realtime/sse_auth_guard.d.ts.map +1 -0
- package/dist/realtime/sse_auth_guard.js +111 -0
- package/dist/realtime/subscriber_registry.d.ts +85 -0
- package/dist/realtime/subscriber_registry.d.ts.map +1 -0
- package/dist/realtime/subscriber_registry.js +108 -0
- package/dist/runtime/deno.d.ts +21 -0
- package/dist/runtime/deno.d.ts.map +1 -0
- package/dist/runtime/deno.js +83 -0
- package/dist/runtime/deps.d.ts +113 -0
- package/dist/runtime/deps.d.ts.map +1 -0
- package/dist/runtime/deps.js +10 -0
- package/dist/runtime/fs.d.ts +15 -0
- package/dist/runtime/fs.d.ts.map +1 -0
- package/dist/runtime/fs.js +17 -0
- package/dist/runtime/mock.d.ts +81 -0
- package/dist/runtime/mock.d.ts.map +1 -0
- package/dist/runtime/mock.js +195 -0
- package/dist/runtime/node.d.ts +17 -0
- package/dist/runtime/node.d.ts.map +1 -0
- package/dist/runtime/node.js +117 -0
- package/dist/schema_meta.d.ts +16 -0
- package/dist/schema_meta.d.ts.map +1 -0
- package/dist/schema_meta.js +9 -0
- package/dist/sensitivity.d.ts +15 -0
- package/dist/sensitivity.d.ts.map +1 -0
- package/dist/sensitivity.js +9 -0
- package/dist/server/app_backend.d.ts +74 -0
- package/dist/server/app_backend.d.ts.map +1 -0
- package/dist/server/app_backend.js +39 -0
- package/dist/server/app_server.d.ts +201 -0
- package/dist/server/app_server.d.ts.map +1 -0
- package/dist/server/app_server.js +266 -0
- package/dist/server/env.d.ts +68 -0
- package/dist/server/env.d.ts.map +1 -0
- package/dist/server/env.js +95 -0
- package/dist/server/startup.d.ts +22 -0
- package/dist/server/startup.d.ts.map +1 -0
- package/dist/server/startup.js +48 -0
- package/dist/server/static.d.ts +39 -0
- package/dist/server/static.d.ts.map +1 -0
- package/dist/server/static.js +38 -0
- package/dist/server/validate_nginx.d.ts +34 -0
- package/dist/server/validate_nginx.d.ts.map +1 -0
- package/dist/server/validate_nginx.js +118 -0
- package/dist/testing/CLAUDE.md +3 -0
- package/dist/testing/admin_integration.d.ts +45 -0
- package/dist/testing/admin_integration.d.ts.map +1 -0
- package/dist/testing/admin_integration.js +840 -0
- package/dist/testing/adversarial_404.d.ts +15 -0
- package/dist/testing/adversarial_404.d.ts.map +1 -0
- package/dist/testing/adversarial_404.js +118 -0
- package/dist/testing/adversarial_headers.d.ts +36 -0
- package/dist/testing/adversarial_headers.d.ts.map +1 -0
- package/dist/testing/adversarial_headers.js +128 -0
- package/dist/testing/adversarial_input.d.ts +56 -0
- package/dist/testing/adversarial_input.d.ts.map +1 -0
- package/dist/testing/adversarial_input.js +494 -0
- package/dist/testing/app_server.d.ts +169 -0
- package/dist/testing/app_server.d.ts.map +1 -0
- package/dist/testing/app_server.js +240 -0
- package/dist/testing/assert_dev_env.d.ts +10 -0
- package/dist/testing/assert_dev_env.d.ts.map +1 -0
- package/dist/testing/assert_dev_env.js +13 -0
- package/dist/testing/assertions.d.ts +61 -0
- package/dist/testing/assertions.d.ts.map +1 -0
- package/dist/testing/assertions.js +96 -0
- package/dist/testing/attack_surface.d.ts +63 -0
- package/dist/testing/attack_surface.d.ts.map +1 -0
- package/dist/testing/attack_surface.js +224 -0
- package/dist/testing/audit_completeness.d.ts +29 -0
- package/dist/testing/audit_completeness.d.ts.map +1 -0
- package/dist/testing/audit_completeness.js +410 -0
- package/dist/testing/auth_apps.d.ts +55 -0
- package/dist/testing/auth_apps.d.ts.map +1 -0
- package/dist/testing/auth_apps.js +122 -0
- package/dist/testing/data_exposure.d.ts +62 -0
- package/dist/testing/data_exposure.d.ts.map +1 -0
- package/dist/testing/data_exposure.js +297 -0
- package/dist/testing/db.d.ts +111 -0
- package/dist/testing/db.d.ts.map +1 -0
- package/dist/testing/db.js +258 -0
- package/dist/testing/entities.d.ts +21 -0
- package/dist/testing/entities.d.ts.map +1 -0
- package/dist/testing/entities.js +42 -0
- package/dist/testing/error_coverage.d.ts +78 -0
- package/dist/testing/error_coverage.d.ts.map +1 -0
- package/dist/testing/error_coverage.js +135 -0
- package/dist/testing/integration.d.ts +37 -0
- package/dist/testing/integration.d.ts.map +1 -0
- package/dist/testing/integration.js +1139 -0
- package/dist/testing/integration_helpers.d.ts +107 -0
- package/dist/testing/integration_helpers.d.ts.map +1 -0
- package/dist/testing/integration_helpers.js +246 -0
- package/dist/testing/middleware.d.ts +125 -0
- package/dist/testing/middleware.d.ts.map +1 -0
- package/dist/testing/middleware.js +210 -0
- package/dist/testing/rate_limiting.d.ts +43 -0
- package/dist/testing/rate_limiting.d.ts.map +1 -0
- package/dist/testing/rate_limiting.js +216 -0
- package/dist/testing/round_trip.d.ts +37 -0
- package/dist/testing/round_trip.d.ts.map +1 -0
- package/dist/testing/round_trip.js +128 -0
- package/dist/testing/schema_generators.d.ts +33 -0
- package/dist/testing/schema_generators.d.ts.map +1 -0
- package/dist/testing/schema_generators.js +137 -0
- package/dist/testing/standard.d.ts +49 -0
- package/dist/testing/standard.d.ts.map +1 -0
- package/dist/testing/standard.js +16 -0
- package/dist/testing/stubs.d.ts +96 -0
- package/dist/testing/stubs.d.ts.map +1 -0
- package/dist/testing/stubs.js +192 -0
- package/dist/testing/surface_invariants.d.ts +189 -0
- package/dist/testing/surface_invariants.d.ts.map +1 -0
- package/dist/testing/surface_invariants.js +450 -0
- package/dist/ui/AccountSessions.svelte +75 -0
- package/dist/ui/AccountSessions.svelte.d.ts +19 -0
- package/dist/ui/AccountSessions.svelte.d.ts.map +1 -0
- package/dist/ui/AdminAccounts.svelte +107 -0
- package/dist/ui/AdminAccounts.svelte.d.ts +19 -0
- package/dist/ui/AdminAccounts.svelte.d.ts.map +1 -0
- package/dist/ui/AdminAuditLog.svelte +144 -0
- package/dist/ui/AdminAuditLog.svelte.d.ts +4 -0
- package/dist/ui/AdminAuditLog.svelte.d.ts.map +1 -0
- package/dist/ui/AdminInvites.svelte +142 -0
- package/dist/ui/AdminInvites.svelte.d.ts +4 -0
- package/dist/ui/AdminInvites.svelte.d.ts.map +1 -0
- package/dist/ui/AdminOverview.svelte +337 -0
- package/dist/ui/AdminOverview.svelte.d.ts +4 -0
- package/dist/ui/AdminOverview.svelte.d.ts.map +1 -0
- package/dist/ui/AdminPermitHistory.svelte +61 -0
- package/dist/ui/AdminPermitHistory.svelte.d.ts +19 -0
- package/dist/ui/AdminPermitHistory.svelte.d.ts.map +1 -0
- package/dist/ui/AdminSessions.svelte +85 -0
- package/dist/ui/AdminSessions.svelte.d.ts +19 -0
- package/dist/ui/AdminSessions.svelte.d.ts.map +1 -0
- package/dist/ui/AdminSettings.svelte +32 -0
- package/dist/ui/AdminSettings.svelte.d.ts +19 -0
- package/dist/ui/AdminSettings.svelte.d.ts.map +1 -0
- package/dist/ui/AdminSurface.svelte +42 -0
- package/dist/ui/AdminSurface.svelte.d.ts +4 -0
- package/dist/ui/AdminSurface.svelte.d.ts.map +1 -0
- package/dist/ui/AppShell.svelte +93 -0
- package/dist/ui/AppShell.svelte.d.ts +20 -0
- package/dist/ui/AppShell.svelte.d.ts.map +1 -0
- package/dist/ui/BootstrapForm.svelte +105 -0
- package/dist/ui/BootstrapForm.svelte.d.ts +4 -0
- package/dist/ui/BootstrapForm.svelte.d.ts.map +1 -0
- package/dist/ui/ColumnLayout.svelte +46 -0
- package/dist/ui/ColumnLayout.svelte.d.ts +11 -0
- package/dist/ui/ColumnLayout.svelte.d.ts.map +1 -0
- package/dist/ui/ConfirmButton.svelte +125 -0
- package/dist/ui/ConfirmButton.svelte.d.ts +54 -0
- package/dist/ui/ConfirmButton.svelte.d.ts.map +1 -0
- package/dist/ui/Datatable.svelte +185 -0
- package/dist/ui/Datatable.svelte.d.ts +35 -0
- package/dist/ui/Datatable.svelte.d.ts.map +1 -0
- package/dist/ui/LoginForm.svelte +82 -0
- package/dist/ui/LoginForm.svelte.d.ts +8 -0
- package/dist/ui/LoginForm.svelte.d.ts.map +1 -0
- package/dist/ui/LogoutButton.svelte +36 -0
- package/dist/ui/LogoutButton.svelte.d.ts +10 -0
- package/dist/ui/LogoutButton.svelte.d.ts.map +1 -0
- package/dist/ui/MenuLink.svelte +35 -0
- package/dist/ui/MenuLink.svelte.d.ts +12 -0
- package/dist/ui/MenuLink.svelte.d.ts.map +1 -0
- package/dist/ui/OpenSignupToggle.svelte +36 -0
- package/dist/ui/OpenSignupToggle.svelte.d.ts +19 -0
- package/dist/ui/OpenSignupToggle.svelte.d.ts.map +1 -0
- package/dist/ui/PopoverButton.svelte +136 -0
- package/dist/ui/PopoverButton.svelte.d.ts +63 -0
- package/dist/ui/PopoverButton.svelte.d.ts.map +1 -0
- package/dist/ui/SignupForm.svelte +117 -0
- package/dist/ui/SignupForm.svelte.d.ts +7 -0
- package/dist/ui/SignupForm.svelte.d.ts.map +1 -0
- package/dist/ui/SurfaceExplorer.svelte +287 -0
- package/dist/ui/SurfaceExplorer.svelte.d.ts +8 -0
- package/dist/ui/SurfaceExplorer.svelte.d.ts.map +1 -0
- package/dist/ui/account_sessions_state.svelte.d.ts +15 -0
- package/dist/ui/account_sessions_state.svelte.d.ts.map +1 -0
- package/dist/ui/account_sessions_state.svelte.js +45 -0
- package/dist/ui/admin_accounts_state.svelte.d.ts +19 -0
- package/dist/ui/admin_accounts_state.svelte.d.ts.map +1 -0
- package/dist/ui/admin_accounts_state.svelte.js +65 -0
- package/dist/ui/admin_invites_state.svelte.d.ts +19 -0
- package/dist/ui/admin_invites_state.svelte.d.ts.map +1 -0
- package/dist/ui/admin_invites_state.svelte.js +71 -0
- package/dist/ui/admin_sessions_state.svelte.d.ts +18 -0
- package/dist/ui/admin_sessions_state.svelte.d.ts.map +1 -0
- package/dist/ui/admin_sessions_state.svelte.js +62 -0
- package/dist/ui/app_settings_state.svelte.d.ts +14 -0
- package/dist/ui/app_settings_state.svelte.d.ts.map +1 -0
- package/dist/ui/app_settings_state.svelte.js +44 -0
- package/dist/ui/audit_log_state.svelte.d.ts +40 -0
- package/dist/ui/audit_log_state.svelte.d.ts.map +1 -0
- package/dist/ui/audit_log_state.svelte.js +153 -0
- package/dist/ui/auth_state.svelte.d.ts +85 -0
- package/dist/ui/auth_state.svelte.d.ts.map +1 -0
- package/dist/ui/auth_state.svelte.js +238 -0
- package/dist/ui/datatable.d.ts +25 -0
- package/dist/ui/datatable.d.ts.map +1 -0
- package/dist/ui/datatable.js +9 -0
- package/dist/ui/enter_advance.d.ts +13 -0
- package/dist/ui/enter_advance.d.ts.map +1 -0
- package/dist/ui/enter_advance.js +30 -0
- package/dist/ui/loadable.svelte.d.ts +55 -0
- package/dist/ui/loadable.svelte.d.ts.map +1 -0
- package/dist/ui/loadable.svelte.js +75 -0
- package/dist/ui/popover.svelte.d.ts +137 -0
- package/dist/ui/popover.svelte.d.ts.map +1 -0
- package/dist/ui/popover.svelte.js +288 -0
- package/dist/ui/position_helpers.d.ts +27 -0
- package/dist/ui/position_helpers.d.ts.map +1 -0
- package/dist/ui/position_helpers.js +81 -0
- package/dist/ui/sidebar_state.svelte.d.ts +30 -0
- package/dist/ui/sidebar_state.svelte.d.ts.map +1 -0
- package/dist/ui/sidebar_state.svelte.js +39 -0
- package/dist/ui/table_state.svelte.d.ts +63 -0
- package/dist/ui/table_state.svelte.d.ts.map +1 -0
- package/dist/ui/table_state.svelte.js +117 -0
- package/dist/ui/ui_fetch.d.ts +29 -0
- package/dist/ui/ui_fetch.d.ts.map +1 -0
- package/dist/ui/ui_fetch.js +37 -0
- package/dist/ui/ui_format.d.ts +63 -0
- package/dist/ui/ui_format.d.ts.map +1 -0
- package/dist/ui/ui_format.js +196 -0
- package/package.json +121 -0
|
@@ -0,0 +1,243 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Introspectable route spec system for Hono apps.
|
|
3
|
+
*
|
|
4
|
+
* Routes are defined as data (method, path, auth, input/output schemas, handler),
|
|
5
|
+
* then applied to Hono. The attack surface is generated from the specs —
|
|
6
|
+
* always accurate, always complete.
|
|
7
|
+
*
|
|
8
|
+
* Input/output schemas align with SAES `ActionSpec` conventions:
|
|
9
|
+
* - `input`: Zod schema for the request body (`z.null()` for no body)
|
|
10
|
+
* - `output`: Zod schema for the success response body
|
|
11
|
+
* - `z.strictObject()` for inputs (reject unknown keys)
|
|
12
|
+
*
|
|
13
|
+
* @module
|
|
14
|
+
*/
|
|
15
|
+
import { DEV } from 'esm-env';
|
|
16
|
+
import { ERROR_INVALID_JSON_BODY, ERROR_INVALID_REQUEST_BODY, ERROR_INVALID_ROUTE_PARAMS, ERROR_INVALID_QUERY_PARAMS, } from './error_schemas.js';
|
|
17
|
+
import { is_null_schema, merge_error_schemas } from './schema_helpers.js';
|
|
18
|
+
/**
|
|
19
|
+
* Get validated input from the Hono context.
|
|
20
|
+
*
|
|
21
|
+
* Call this in route handlers after the input validation middleware has run.
|
|
22
|
+
* The type parameter should match the route's `input` schema.
|
|
23
|
+
*
|
|
24
|
+
* @returns the validated request body
|
|
25
|
+
*/
|
|
26
|
+
export const get_route_input = (c) => {
|
|
27
|
+
return c.get('validated_input');
|
|
28
|
+
};
|
|
29
|
+
/**
|
|
30
|
+
* Get validated URL path params from the Hono context.
|
|
31
|
+
*
|
|
32
|
+
* Call this in route handlers after the params validation middleware has run.
|
|
33
|
+
* The type parameter should match the route's `params` schema.
|
|
34
|
+
*
|
|
35
|
+
* TODO @action-system-review Make typesafe — derive `T` from the `params` schema on the
|
|
36
|
+
* route spec so the type parameter isn't manually specified.
|
|
37
|
+
*
|
|
38
|
+
* @returns the validated path parameters
|
|
39
|
+
*/
|
|
40
|
+
export const get_route_params = (c) => {
|
|
41
|
+
return c.get('validated_params');
|
|
42
|
+
};
|
|
43
|
+
/**
|
|
44
|
+
* Get validated URL query params from the Hono context.
|
|
45
|
+
*
|
|
46
|
+
* Call this in route handlers after the query validation middleware has run.
|
|
47
|
+
* The type parameter should match the route's `query` schema.
|
|
48
|
+
*
|
|
49
|
+
* @returns the validated query parameters
|
|
50
|
+
*/
|
|
51
|
+
export const get_route_query = (c) => {
|
|
52
|
+
return c.get('validated_query');
|
|
53
|
+
};
|
|
54
|
+
/**
|
|
55
|
+
* Create input validation middleware for a route spec.
|
|
56
|
+
*
|
|
57
|
+
* Returns an empty array for null-input routes (no body expected).
|
|
58
|
+
* For routes with input schemas, returns a middleware that parses and validates
|
|
59
|
+
* the JSON body, storing the result on the context as `validated_input`.
|
|
60
|
+
*/
|
|
61
|
+
const create_input_validation = (input_schema) => {
|
|
62
|
+
if (is_null_schema(input_schema))
|
|
63
|
+
return [];
|
|
64
|
+
const validate = async (c, next) => {
|
|
65
|
+
let body;
|
|
66
|
+
try {
|
|
67
|
+
body = await c.req.json();
|
|
68
|
+
}
|
|
69
|
+
catch {
|
|
70
|
+
return c.json({ error: ERROR_INVALID_JSON_BODY }, 400);
|
|
71
|
+
}
|
|
72
|
+
if (typeof body !== 'object' || body === null || Array.isArray(body)) {
|
|
73
|
+
return c.json({ error: ERROR_INVALID_JSON_BODY }, 400);
|
|
74
|
+
}
|
|
75
|
+
const result = input_schema.safeParse(body);
|
|
76
|
+
if (!result.success) {
|
|
77
|
+
return c.json({ error: ERROR_INVALID_REQUEST_BODY, issues: result.error.issues }, 400);
|
|
78
|
+
}
|
|
79
|
+
c.set('validated_input', result.data);
|
|
80
|
+
await next();
|
|
81
|
+
};
|
|
82
|
+
return [validate];
|
|
83
|
+
};
|
|
84
|
+
/**
|
|
85
|
+
* Create params validation middleware for a route spec.
|
|
86
|
+
*
|
|
87
|
+
* Returns an empty array when no params schema is defined.
|
|
88
|
+
* For routes with params schemas, returns a middleware that validates
|
|
89
|
+
* `c.req.param()` against the schema, storing the result on the context as `validated_params`.
|
|
90
|
+
*/
|
|
91
|
+
const create_params_validation = (params_schema) => {
|
|
92
|
+
if (!params_schema)
|
|
93
|
+
return [];
|
|
94
|
+
const validate = async (c, next) => {
|
|
95
|
+
const raw_params = c.req.param();
|
|
96
|
+
const result = params_schema.safeParse(raw_params);
|
|
97
|
+
if (!result.success) {
|
|
98
|
+
return c.json({ error: ERROR_INVALID_ROUTE_PARAMS, issues: result.error.issues }, 400);
|
|
99
|
+
}
|
|
100
|
+
c.set('validated_params', result.data);
|
|
101
|
+
await next();
|
|
102
|
+
};
|
|
103
|
+
return [validate];
|
|
104
|
+
};
|
|
105
|
+
/**
|
|
106
|
+
* Create query params validation middleware for a route spec.
|
|
107
|
+
*
|
|
108
|
+
* Returns an empty array when no query schema is defined.
|
|
109
|
+
* For routes with query schemas, returns a middleware that validates
|
|
110
|
+
* `c.req.query()` against the schema, storing the result on the context as `validated_query`.
|
|
111
|
+
*/
|
|
112
|
+
const create_query_validation = (query_schema) => {
|
|
113
|
+
if (!query_schema)
|
|
114
|
+
return [];
|
|
115
|
+
const validate = async (c, next) => {
|
|
116
|
+
const raw_query = c.req.query();
|
|
117
|
+
const result = query_schema.safeParse(raw_query);
|
|
118
|
+
if (!result.success) {
|
|
119
|
+
return c.json({ error: ERROR_INVALID_QUERY_PARAMS, issues: result.error.issues }, 400);
|
|
120
|
+
}
|
|
121
|
+
c.set('validated_query', result.data);
|
|
122
|
+
await next();
|
|
123
|
+
};
|
|
124
|
+
return [validate];
|
|
125
|
+
};
|
|
126
|
+
/**
|
|
127
|
+
* Wrap a handler with DEV-only output and error validation.
|
|
128
|
+
*
|
|
129
|
+
* In development, validates 2xx JSON responses against the output schema
|
|
130
|
+
* and non-2xx responses against declared error schemas.
|
|
131
|
+
* Logs warnings for mismatches. In production, returns the handler unchanged.
|
|
132
|
+
*/
|
|
133
|
+
const wrap_output_validation = (handler, output_schema, error_schemas, log) => {
|
|
134
|
+
if (!DEV)
|
|
135
|
+
return handler;
|
|
136
|
+
if (is_null_schema(output_schema) && !error_schemas)
|
|
137
|
+
return handler;
|
|
138
|
+
return async (c, next) => {
|
|
139
|
+
const response = await handler(c, next);
|
|
140
|
+
// Only validate JSON responses — streaming responses (SSE) would hang on .json().
|
|
141
|
+
const content_type = response.headers.get('Content-Type');
|
|
142
|
+
if (!content_type?.includes('application/json'))
|
|
143
|
+
return response;
|
|
144
|
+
if (response.ok) {
|
|
145
|
+
try {
|
|
146
|
+
const cloned = response.clone();
|
|
147
|
+
const body = await cloned.json();
|
|
148
|
+
const result = output_schema.safeParse(body);
|
|
149
|
+
if (!result.success) {
|
|
150
|
+
log.warn(`Output schema mismatch: ${c.req.method} ${c.req.path}`, result.error.issues);
|
|
151
|
+
}
|
|
152
|
+
}
|
|
153
|
+
catch {
|
|
154
|
+
// clone() or json() failed on a response claiming application/json
|
|
155
|
+
}
|
|
156
|
+
}
|
|
157
|
+
else if (error_schemas) {
|
|
158
|
+
const status_schema = error_schemas[response.status];
|
|
159
|
+
if (status_schema) {
|
|
160
|
+
try {
|
|
161
|
+
const cloned = response.clone();
|
|
162
|
+
const body = await cloned.json();
|
|
163
|
+
const result = status_schema.safeParse(body);
|
|
164
|
+
if (!result.success) {
|
|
165
|
+
log.warn(`Error schema mismatch (${response.status}): ${c.req.method} ${c.req.path}`, result.error.issues);
|
|
166
|
+
}
|
|
167
|
+
}
|
|
168
|
+
catch {
|
|
169
|
+
// clone() or json() failed on a response claiming application/json
|
|
170
|
+
}
|
|
171
|
+
}
|
|
172
|
+
}
|
|
173
|
+
return response;
|
|
174
|
+
};
|
|
175
|
+
};
|
|
176
|
+
/**
|
|
177
|
+
* Apply named middleware specs to a Hono app.
|
|
178
|
+
*
|
|
179
|
+
* @param app - the Hono app
|
|
180
|
+
* @param specs - middleware specs to apply
|
|
181
|
+
* @mutates `app`
|
|
182
|
+
*/
|
|
183
|
+
export const apply_middleware_specs = (app, specs) => {
|
|
184
|
+
for (const spec of specs) {
|
|
185
|
+
app.use(spec.path, spec.handler);
|
|
186
|
+
}
|
|
187
|
+
};
|
|
188
|
+
/**
|
|
189
|
+
* Apply route specs to a Hono app.
|
|
190
|
+
*
|
|
191
|
+
* For each spec: resolves auth to guards via the provided resolver,
|
|
192
|
+
* adds input validation middleware (for routes with non-null input schemas),
|
|
193
|
+
* wraps handler with DEV-only output and error validation, and registers the route.
|
|
194
|
+
*
|
|
195
|
+
* Each handler receives a `RouteContext` with:
|
|
196
|
+
* - `db`: transaction-scoped (for non-GET) or pool-level (for GET)
|
|
197
|
+
* - `background_db`: always pool-level
|
|
198
|
+
* - `pending_effects`: fire-and-forget effect queue
|
|
199
|
+
*
|
|
200
|
+
* @param app - the Hono app
|
|
201
|
+
* @param specs - route specs to apply
|
|
202
|
+
* @param resolve_auth_guards - maps `RouteAuth` to middleware — use `fuz_auth_guard_resolver` from `auth/route_guards.ts`
|
|
203
|
+
* @param log - the logger instance
|
|
204
|
+
* @param db - database instance for transaction wrapping and `RouteContext`
|
|
205
|
+
* @mutates `app`
|
|
206
|
+
*/
|
|
207
|
+
export const apply_route_specs = (app, specs, resolve_auth_guards, log, db) => {
|
|
208
|
+
const registered = new Set();
|
|
209
|
+
for (const spec of specs) {
|
|
210
|
+
const route_key = `${spec.method} ${spec.path}`;
|
|
211
|
+
if (registered.has(route_key)) {
|
|
212
|
+
throw new Error(`Duplicate route: ${route_key} — each method+path combination must be unique`);
|
|
213
|
+
}
|
|
214
|
+
registered.add(route_key);
|
|
215
|
+
const guards = resolve_auth_guards(spec.auth);
|
|
216
|
+
const params_validation = create_params_validation(spec.params);
|
|
217
|
+
const query_validation = create_query_validation(spec.query);
|
|
218
|
+
const validation = create_input_validation(spec.input);
|
|
219
|
+
const merged_errors = merge_error_schemas(spec);
|
|
220
|
+
// Step 1: adapt RouteHandler → Handler (construct RouteContext, call spec.handler)
|
|
221
|
+
const use_transaction = spec.transaction ?? spec.method !== 'GET';
|
|
222
|
+
const inner = spec.handler;
|
|
223
|
+
let handler = use_transaction
|
|
224
|
+
? (c) => db.transaction(async (tx) => inner(c, { db: tx, background_db: db, pending_effects: c.var.pending_effects }))
|
|
225
|
+
: (c) => inner(c, { db, background_db: db, pending_effects: c.var.pending_effects });
|
|
226
|
+
// Step 2: output validation
|
|
227
|
+
handler = wrap_output_validation(handler, spec.output, merged_errors, log);
|
|
228
|
+
app.on(spec.method, [spec.path], ...guards, ...params_validation, ...query_validation, ...validation, handler);
|
|
229
|
+
}
|
|
230
|
+
};
|
|
231
|
+
/**
|
|
232
|
+
* Prepend a prefix to all route spec paths.
|
|
233
|
+
*
|
|
234
|
+
* @param prefix - the path prefix (e.g. `/api/account`)
|
|
235
|
+
* @param specs - route specs to prefix
|
|
236
|
+
* @returns new array of specs with prefixed paths
|
|
237
|
+
*/
|
|
238
|
+
export const prefix_route_specs = (prefix, specs) => {
|
|
239
|
+
return specs.map((spec) => ({
|
|
240
|
+
...spec,
|
|
241
|
+
path: `${prefix}${spec.path}`,
|
|
242
|
+
}));
|
|
243
|
+
};
|
|
@@ -0,0 +1,64 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared pure helpers for schema introspection and middleware matching.
|
|
3
|
+
*
|
|
4
|
+
* Used by both `route_spec.ts` (input validation) and `surface.ts`
|
|
5
|
+
* (attack surface generation). Extracted to avoid circular dependencies
|
|
6
|
+
* between routes and middleware.
|
|
7
|
+
*
|
|
8
|
+
* @module
|
|
9
|
+
*/
|
|
10
|
+
import { z } from 'zod';
|
|
11
|
+
import type { RouteAuth } from './route_spec.js';
|
|
12
|
+
import { type RateLimitKey, type RouteErrorSchemas } from './error_schemas.js';
|
|
13
|
+
/**
|
|
14
|
+
* Check if a schema is exactly `z.null()`.
|
|
15
|
+
*
|
|
16
|
+
* Uses Zod 4 type introspection (`_zod.def.type`) rather than runtime parsing
|
|
17
|
+
* to avoid false positives from `z.nullable(z.string())` or similar schemas
|
|
18
|
+
* that accept null but also accept other values.
|
|
19
|
+
*/
|
|
20
|
+
export declare const is_null_schema: (schema: z.ZodType) => boolean;
|
|
21
|
+
/**
|
|
22
|
+
* Check if a schema is a strict object (`z.strictObject()`).
|
|
23
|
+
*
|
|
24
|
+
* Strict objects set `catchall` to `ZodNever` to reject unknown keys.
|
|
25
|
+
* Regular `z.object()` has `catchall: undefined` (strips unknown keys in Zod 4).
|
|
26
|
+
*/
|
|
27
|
+
export declare const is_strict_object_schema: (schema: z.ZodType) => boolean;
|
|
28
|
+
/**
|
|
29
|
+
* Convert a Zod schema to a JSON-serializable representation for the surface.
|
|
30
|
+
*
|
|
31
|
+
* Returns `null` for null schemas, JSON Schema for object schemas.
|
|
32
|
+
*/
|
|
33
|
+
export declare const schema_to_surface: (schema: z.ZodType) => unknown;
|
|
34
|
+
/**
|
|
35
|
+
* Check if a middleware path pattern applies to a route path.
|
|
36
|
+
*
|
|
37
|
+
* Supports Hono-style patterns:
|
|
38
|
+
* - `/api/*` matches `/api/anything`
|
|
39
|
+
* - `/api/tx/*` matches `/api/tx/runs` but not `/api/account/login`
|
|
40
|
+
* - Exact match: `/health` matches `/health`
|
|
41
|
+
*
|
|
42
|
+
* @param mw_path - the middleware path pattern
|
|
43
|
+
* @param route_path - the route path
|
|
44
|
+
*/
|
|
45
|
+
export declare const middleware_applies: (mw_path: string, route_path: string) => boolean;
|
|
46
|
+
/**
|
|
47
|
+
* Merge auto-derived, middleware, and explicit error schemas for a route spec.
|
|
48
|
+
*
|
|
49
|
+
* Merge order: derived -> middleware -> explicit route errors.
|
|
50
|
+
* Later layers override earlier ones for the same status code.
|
|
51
|
+
*
|
|
52
|
+
* @param spec - the route spec (needs `auth`, `input`, `params`, `rate_limit`, `errors`)
|
|
53
|
+
* @param middleware_errors - optional middleware error schemas
|
|
54
|
+
* @returns merged error schemas, or `null` if empty
|
|
55
|
+
*/
|
|
56
|
+
export declare const merge_error_schemas: (spec: {
|
|
57
|
+
auth: RouteAuth;
|
|
58
|
+
input: z.ZodType;
|
|
59
|
+
params?: z.ZodObject;
|
|
60
|
+
query?: z.ZodObject;
|
|
61
|
+
rate_limit?: RateLimitKey;
|
|
62
|
+
errors?: RouteErrorSchemas;
|
|
63
|
+
}, middleware_errors?: RouteErrorSchemas | null) => RouteErrorSchemas | null;
|
|
64
|
+
//# sourceMappingURL=schema_helpers.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"schema_helpers.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/schema_helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAuB,KAAK,YAAY,EAAE,KAAK,iBAAiB,EAAC,MAAM,oBAAoB,CAAC;AAEnG;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAA0C,CAAC;AAE9F;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAI3D,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,QAAQ,CAAC,CAAC,OAAO,KAAG,OAcrD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAI,SAAS,MAAM,EAAE,YAAY,MAAM,KAAG,OAQxE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,mBAAmB,GAC/B,MAAM;IACL,IAAI,EAAE,SAAS,CAAC;IAChB,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACpB,UAAU,CAAC,EAAE,YAAY,CAAC;IAC1B,MAAM,CAAC,EAAE,iBAAiB,CAAC;CAC3B,EACD,oBAAoB,iBAAiB,GAAG,IAAI,KAC1C,iBAAiB,GAAG,IAUtB,CAAC"}
|
|
@@ -0,0 +1,90 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Shared pure helpers for schema introspection and middleware matching.
|
|
3
|
+
*
|
|
4
|
+
* Used by both `route_spec.ts` (input validation) and `surface.ts`
|
|
5
|
+
* (attack surface generation). Extracted to avoid circular dependencies
|
|
6
|
+
* between routes and middleware.
|
|
7
|
+
*
|
|
8
|
+
* @module
|
|
9
|
+
*/
|
|
10
|
+
import { z } from 'zod';
|
|
11
|
+
import { derive_error_schemas } from './error_schemas.js';
|
|
12
|
+
/**
|
|
13
|
+
* Check if a schema is exactly `z.null()`.
|
|
14
|
+
*
|
|
15
|
+
* Uses Zod 4 type introspection (`_zod.def.type`) rather than runtime parsing
|
|
16
|
+
* to avoid false positives from `z.nullable(z.string())` or similar schemas
|
|
17
|
+
* that accept null but also accept other values.
|
|
18
|
+
*/
|
|
19
|
+
export const is_null_schema = (schema) => schema._zod.def.type === 'null';
|
|
20
|
+
/**
|
|
21
|
+
* Check if a schema is a strict object (`z.strictObject()`).
|
|
22
|
+
*
|
|
23
|
+
* Strict objects set `catchall` to `ZodNever` to reject unknown keys.
|
|
24
|
+
* Regular `z.object()` has `catchall: undefined` (strips unknown keys in Zod 4).
|
|
25
|
+
*/
|
|
26
|
+
export const is_strict_object_schema = (schema) => {
|
|
27
|
+
if (schema._zod.def.type !== 'object')
|
|
28
|
+
return false;
|
|
29
|
+
const catchall = schema._zod.def.catchall;
|
|
30
|
+
return catchall?._zod.def.type === 'never';
|
|
31
|
+
};
|
|
32
|
+
/**
|
|
33
|
+
* Convert a Zod schema to a JSON-serializable representation for the surface.
|
|
34
|
+
*
|
|
35
|
+
* Returns `null` for null schemas, JSON Schema for object schemas.
|
|
36
|
+
*/
|
|
37
|
+
export const schema_to_surface = (schema) => {
|
|
38
|
+
if (is_null_schema(schema))
|
|
39
|
+
return null;
|
|
40
|
+
try {
|
|
41
|
+
const json_schema = z.toJSONSchema(schema);
|
|
42
|
+
// Strip $schema for cleaner snapshots
|
|
43
|
+
// eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
|
|
44
|
+
if (typeof json_schema === 'object' && json_schema !== null && '$schema' in json_schema) {
|
|
45
|
+
const { $schema: _, ...rest } = json_schema;
|
|
46
|
+
return rest;
|
|
47
|
+
}
|
|
48
|
+
return json_schema;
|
|
49
|
+
}
|
|
50
|
+
catch {
|
|
51
|
+
return null;
|
|
52
|
+
}
|
|
53
|
+
};
|
|
54
|
+
/**
|
|
55
|
+
* Check if a middleware path pattern applies to a route path.
|
|
56
|
+
*
|
|
57
|
+
* Supports Hono-style patterns:
|
|
58
|
+
* - `/api/*` matches `/api/anything`
|
|
59
|
+
* - `/api/tx/*` matches `/api/tx/runs` but not `/api/account/login`
|
|
60
|
+
* - Exact match: `/health` matches `/health`
|
|
61
|
+
*
|
|
62
|
+
* @param mw_path - the middleware path pattern
|
|
63
|
+
* @param route_path - the route path
|
|
64
|
+
*/
|
|
65
|
+
export const middleware_applies = (mw_path, route_path) => {
|
|
66
|
+
if (mw_path === '*')
|
|
67
|
+
return true;
|
|
68
|
+
if (mw_path === route_path)
|
|
69
|
+
return true;
|
|
70
|
+
if (mw_path.endsWith('/*')) {
|
|
71
|
+
const prefix = mw_path.slice(0, -1); // '/api/*' → '/api/'
|
|
72
|
+
return route_path.startsWith(prefix) || route_path === prefix.slice(0, -1);
|
|
73
|
+
}
|
|
74
|
+
return false;
|
|
75
|
+
};
|
|
76
|
+
/**
|
|
77
|
+
* Merge auto-derived, middleware, and explicit error schemas for a route spec.
|
|
78
|
+
*
|
|
79
|
+
* Merge order: derived -> middleware -> explicit route errors.
|
|
80
|
+
* Later layers override earlier ones for the same status code.
|
|
81
|
+
*
|
|
82
|
+
* @param spec - the route spec (needs `auth`, `input`, `params`, `rate_limit`, `errors`)
|
|
83
|
+
* @param middleware_errors - optional middleware error schemas
|
|
84
|
+
* @returns merged error schemas, or `null` if empty
|
|
85
|
+
*/
|
|
86
|
+
export const merge_error_schemas = (spec, middleware_errors) => {
|
|
87
|
+
const derived = derive_error_schemas(spec.auth, !is_null_schema(spec.input), !!spec.params, !!spec.query, spec.rate_limit);
|
|
88
|
+
const merged = { ...derived, ...middleware_errors, ...spec.errors };
|
|
89
|
+
return Object.keys(merged).length > 0 ? merged : null;
|
|
90
|
+
};
|
|
@@ -0,0 +1,132 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* App surface generation — JSON-serializable attack surface from route and middleware specs.
|
|
3
|
+
*
|
|
4
|
+
* Pure schema helpers (`is_null_schema`, `schema_to_surface`, `middleware_applies`,
|
|
5
|
+
* `merge_error_schemas`) live in `schema_helpers.ts`.
|
|
6
|
+
*
|
|
7
|
+
* @module
|
|
8
|
+
*/
|
|
9
|
+
import { z } from 'zod';
|
|
10
|
+
import type { SseEventSpec } from '../realtime/sse.js';
|
|
11
|
+
import type { MiddlewareSpec } from './middleware_spec.js';
|
|
12
|
+
import type { RouteAuth, RouteSpec } from './route_spec.js';
|
|
13
|
+
import type { RateLimitKey, RouteErrorSchemas } from './error_schemas.js';
|
|
14
|
+
import type { Sensitivity } from '../sensitivity.js';
|
|
15
|
+
/** A route in the generated attack surface (JSON-serializable). */
|
|
16
|
+
export interface AppSurfaceRoute {
|
|
17
|
+
method: string;
|
|
18
|
+
path: string;
|
|
19
|
+
auth: RouteAuth;
|
|
20
|
+
applicable_middleware: Array<string>;
|
|
21
|
+
description: string;
|
|
22
|
+
/** Whether this route mutates state (POST, PUT, DELETE, PATCH). */
|
|
23
|
+
is_mutation: boolean;
|
|
24
|
+
/** Whether this route's handler runs inside a database transaction. */
|
|
25
|
+
transaction: boolean;
|
|
26
|
+
/** Rate limit key type declared on the route spec. `null` when not rate-limited. */
|
|
27
|
+
rate_limit_key: RateLimitKey | null;
|
|
28
|
+
/** JSON Schema representation of the URL path params schema. `null` when no params. */
|
|
29
|
+
params_schema: unknown;
|
|
30
|
+
/** JSON Schema representation of the URL query params schema. `null` when no query schema. */
|
|
31
|
+
query_schema: unknown;
|
|
32
|
+
/** JSON Schema representation of the request body schema. `null` for no-body routes. */
|
|
33
|
+
input_schema: unknown;
|
|
34
|
+
/** JSON Schema representation of the success response schema. */
|
|
35
|
+
output_schema: unknown;
|
|
36
|
+
/** JSON Schema representations of error responses, keyed by HTTP status code. `null` when none. */
|
|
37
|
+
error_schemas: Record<string, unknown> | null;
|
|
38
|
+
}
|
|
39
|
+
/** A middleware in the generated attack surface (JSON-serializable). */
|
|
40
|
+
export interface AppSurfaceMiddleware {
|
|
41
|
+
name: string;
|
|
42
|
+
path: string;
|
|
43
|
+
/** JSON Schema representations of error responses, keyed by HTTP status code. `null` when none. */
|
|
44
|
+
error_schemas: Record<string, unknown> | null;
|
|
45
|
+
}
|
|
46
|
+
/** An env var in the generated attack surface (JSON-serializable). */
|
|
47
|
+
export interface AppSurfaceEnv {
|
|
48
|
+
name: string;
|
|
49
|
+
description: string;
|
|
50
|
+
/** Sensitivity level from `.meta({sensitivity})`. `null` when not sensitive. */
|
|
51
|
+
sensitivity: Sensitivity | null;
|
|
52
|
+
has_default: boolean;
|
|
53
|
+
optional: boolean;
|
|
54
|
+
}
|
|
55
|
+
/** An SSE event in the generated attack surface (JSON-serializable). */
|
|
56
|
+
export interface AppSurfaceEvent {
|
|
57
|
+
method: string;
|
|
58
|
+
description: string;
|
|
59
|
+
channel: string | null;
|
|
60
|
+
params_schema: unknown;
|
|
61
|
+
}
|
|
62
|
+
/** Assembly-time diagnostic collected during surface generation or server assembly. */
|
|
63
|
+
export interface AppSurfaceDiagnostic {
|
|
64
|
+
level: 'warning' | 'info';
|
|
65
|
+
category: string;
|
|
66
|
+
message: string;
|
|
67
|
+
source?: string;
|
|
68
|
+
}
|
|
69
|
+
/** Generated attack surface — JSON-serializable. */
|
|
70
|
+
export interface AppSurface {
|
|
71
|
+
middleware: Array<AppSurfaceMiddleware>;
|
|
72
|
+
routes: Array<AppSurfaceRoute>;
|
|
73
|
+
env: Array<AppSurfaceEnv>;
|
|
74
|
+
events: Array<AppSurfaceEvent>;
|
|
75
|
+
diagnostics: Array<AppSurfaceDiagnostic>;
|
|
76
|
+
}
|
|
77
|
+
/**
|
|
78
|
+
* The surface bundled with the source specs that produced it.
|
|
79
|
+
*
|
|
80
|
+
* `AppSurface` is JSON-serializable (snapshots, UI, startup logging).
|
|
81
|
+
* `AppSurfaceSpec` is runtime-only (tests, introspection, attack surface assertions).
|
|
82
|
+
*/
|
|
83
|
+
export interface AppSurfaceSpec {
|
|
84
|
+
surface: AppSurface;
|
|
85
|
+
route_specs: Array<RouteSpec>;
|
|
86
|
+
middleware_specs: Array<MiddlewareSpec>;
|
|
87
|
+
}
|
|
88
|
+
/** Options for `generate_app_surface`. */
|
|
89
|
+
export interface GenerateAppSurfaceOptions {
|
|
90
|
+
route_specs: Array<RouteSpec>;
|
|
91
|
+
middleware_specs: Array<MiddlewareSpec>;
|
|
92
|
+
env_schema?: z.ZodObject;
|
|
93
|
+
event_specs?: Array<SseEventSpec>;
|
|
94
|
+
}
|
|
95
|
+
/**
|
|
96
|
+
* Collect error schemas from all middleware that applies to a route path.
|
|
97
|
+
*
|
|
98
|
+
* @param middleware - the middleware specs
|
|
99
|
+
* @param route_path - the route path to match against
|
|
100
|
+
* @returns merged middleware error schemas, or `null` if none
|
|
101
|
+
*/
|
|
102
|
+
export declare const collect_middleware_errors: (middleware: Array<MiddlewareSpec>, route_path: string) => RouteErrorSchemas | null;
|
|
103
|
+
/**
|
|
104
|
+
* Convert env schema to surface entries using `.meta()` metadata.
|
|
105
|
+
*
|
|
106
|
+
* @param schema - Zod object schema with `.meta()` on fields
|
|
107
|
+
* @returns array of env surface entries
|
|
108
|
+
*/
|
|
109
|
+
export declare const env_schema_to_surface: (schema: z.ZodObject) => Array<AppSurfaceEnv>;
|
|
110
|
+
/**
|
|
111
|
+
* Convert SSE event specs to surface entries.
|
|
112
|
+
*
|
|
113
|
+
* @param event_specs - event specs to convert
|
|
114
|
+
* @returns array of event surface entries
|
|
115
|
+
*/
|
|
116
|
+
export declare const events_to_surface: (event_specs: Array<SseEventSpec>) => Array<AppSurfaceEvent>;
|
|
117
|
+
/**
|
|
118
|
+
* Generate a JSON-serializable attack surface from middleware, route specs,
|
|
119
|
+
* and optional env/event metadata.
|
|
120
|
+
*
|
|
121
|
+
* @param options - the surface generation options
|
|
122
|
+
* @returns the attack surface
|
|
123
|
+
*/
|
|
124
|
+
export declare const generate_app_surface: (options: GenerateAppSurfaceOptions) => AppSurface;
|
|
125
|
+
/**
|
|
126
|
+
* Create an `AppSurfaceSpec` — the surface bundled with its source specs.
|
|
127
|
+
*
|
|
128
|
+
* @param options - the surface generation options
|
|
129
|
+
* @returns the surface spec with surface and raw specs
|
|
130
|
+
*/
|
|
131
|
+
export declare const create_app_surface_spec: (options: GenerateAppSurfaceOptions) => AppSurfaceSpec;
|
|
132
|
+
//# sourceMappingURL=surface.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"surface.d.ts","sourceRoot":"../src/lib/","sources":["../../src/lib/http/surface.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAC,SAAS,EAAE,SAAS,EAAC,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAC,YAAY,EAAE,iBAAiB,EAAC,MAAM,oBAAoB,CAAC;AAQxE,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,mBAAmB,CAAC;AAKnD,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,SAAS,CAAC;IAChB,qBAAqB,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,WAAW,EAAE,OAAO,CAAC;IACrB,uEAAuE;IACvE,WAAW,EAAE,OAAO,CAAC;IACrB,oFAAoF;IACpF,cAAc,EAAE,YAAY,GAAG,IAAI,CAAC;IACpC,uFAAuF;IACvF,aAAa,EAAE,OAAO,CAAC;IACvB,8FAA8F;IAC9F,YAAY,EAAE,OAAO,CAAC;IACtB,wFAAwF;IACxF,YAAY,EAAE,OAAO,CAAC;IACtB,iEAAiE;IACjE,aAAa,EAAE,OAAO,CAAC;IACvB,mGAAmG;IACnG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED,wEAAwE;AACxE,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9C;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,OAAO,CAAC;CAClB;AAED,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;CACvB;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,SAAS,GAAG,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,WAAW,UAAU;IAC1B,UAAU,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/B,GAAG,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAC/B,WAAW,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;CACzC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC9B,OAAO,EAAE,UAAU,CAAC;IACpB,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;CACxC;AAED,0CAA0C;AAC1C,MAAM,WAAW,yBAAyB;IACzC,WAAW,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;IACxC,UAAU,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;IACzB,WAAW,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;CAClC;AAID;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,GACrC,YAAY,KAAK,CAAC,cAAc,CAAC,EACjC,YAAY,MAAM,KAChB,iBAAiB,GAAG,IAQtB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAAI,QAAQ,CAAC,CAAC,SAAS,KAAG,KAAK,CAAC,aAAa,CAe9E,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,aAAa,KAAK,CAAC,YAAY,CAAC,KAAG,KAAK,CAAC,eAAe,CAOzF,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,SAAS,yBAAyB,KAAG,UA2EzE,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,GAAI,SAAS,yBAAyB,KAAG,cAO5E,CAAC"}
|