@lovrozagar/oat 0.2.0 → 0.2.2

package/labs/annotated-openapi.yaml

@@ -99,6 +99,12 @@ paths:
       x-entity: { name: widget, action: create, identity: id }
       x-tenant: workspace_id
 
+      # ── x-feature-gate ───────────────────────────────────────────────────────
+      # Plan key this operation is sold behind. A 403 whose body is
+      # vars.type: feature_gate (and vars.feature matching this key, when present)
+      # is a coverage gap, not a seed defect — the backend matched the document.
+      x-feature-gate: widgets
+
       # ── x-invalidate ─────────────────────────────────────────────────────────
       # Which read routes this write changes. oat inverts these into the entity's
       # read surface — it is how the entity graph is built — AND verifies them: a
@@ -294,6 +300,60 @@ paths:
                   status: { type: string, enum: [pending, running, complete, failed] }
                 required: [export_id, status]
 
+  # ── public catalogue ──────────────────────────────────────────────────────
+  # No x-tenant, and `{template_id}` is not a tenant name. A second principal
+  # GETting a row created by the first is correct: the resource is shared.
+  # tenant.item-not-readable-cross-tenant does not apply here. The workspace
+  # widget above still does — tag → SECURITY, inferred → AMBIGUITY.
+  /v1/templates:
+    get:
+      operationId: template.list
+      summary: List public templates
+      x-entity: { name: template, action: list, identity: id }
+      responses:
+        "200":
+          description: A page of templates
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  templates: { type: array, items: { $ref: "#/components/schemas/Template" } }
+                required: [templates]
+    post:
+      operationId: template.create
+      summary: Publish a template
+      x-entity: { name: template, action: create, identity: id }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              properties:
+                name: { type: string, maxLength: 128 }
+              required: [name]
+      responses:
+        "201":
+          description: Created
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/Template" }
+
+  /v1/templates/{template_id}:
+    get:
+      operationId: template.read
+      x-entity: { name: template, action: read, identity: id }
+      parameters:
+        - { name: template_id, in: path, required: true, schema: { type: string } }
+      responses:
+        "200":
+          description: A public template
+          content:
+            application/json:
+              schema: { $ref: "#/components/schemas/Template" }
+
 components:
   schemas:
     Widget:
@@ -309,3 +369,9 @@ components:
         updated_at: { type: string, format: date-time }
         deleted_at: { type: [string, "null"] }
       required: [id, workspace_id, name, status, priority, created_at, updated_at]
+    Template:
+      type: object
+      properties:
+        id: { type: string }
+        name: { type: string }
+      required: [id, name]

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@lovrozagar/oat",
-	"version": "0.2.0",
+	"version": "0.2.2",
 	"description": "OpenAPI Tester — matrix-test a live API against its OpenAPI spec",
 	"keywords": [
 		"api",