@nocobase/app-server 0.11.1-alpha.5 → 2.0.0-beta.1

package/dist/router/openapi/service.js

@@ -0,0 +1,162 @@
+import { createServiceToken, } from '@nocobase/service-provider';
+import { generateApiDocument, } from './document.js';
+/**
+ * The application's API documentation: who may read it, what plugins add to it, and the cached document itself.
+ *
+ * - Access: `GET /api/swagger` and `GET /api/swagger/docs` are served only once at least one access check is
+ *   registered, and only to a request one of them allows. With none registered the routes answer `404
+ *   ROUTE_NOT_FOUND`, exactly like a path that does not exist: an application that has no way to tell who is asking
+ *   does not publish its API. With checks registered and none allowing, they answer `401 UNAUTHENTICATED`.
+ * - Forwarded routes: a plugin that serves routes through a runtime dispatcher — one catch-all on `/api` that hands
+ *   each request to a router at request time — registers each router with `addApiRouter()`, and each forwarded
+ *   target it cannot see into with `addUndeclaredApiRoute()`. The document and `inspectApiRoutes(app)` treat the
+ *   routers' routes exactly like routes mounted on `/api`; an undeclared route is reported and never documented.
+ * - Fragments: paths, components, tags and security schemes a plugin documents itself, merged after the declared
+ *   routes.
+ * - Cache: the document is generated on the first request and kept until `invalidate()`, which anything that changes
+ *   what the document describes calls — a Collection's metadata changing changes its data endpoints' schemas.
+ */
+export class ApiDocsService {
+    accessChecks = [];
+    fragments = [];
+    transforms = [];
+    forwardedRouters = [];
+    undeclaredRoutes = [];
+    target;
+    cached;
+    /** Allow the requests `access.check` accepts to read the documentation. Returns a function that removes it. */
+    addAccess(access) {
+        this.accessChecks.push(access);
+        return () => {
+            const index = this.accessChecks.indexOf(access);
+            if (index >= 0)
+                this.accessChecks.splice(index, 1);
+        };
+    }
+    /** Merge `fragment` into the document. Returns a function that removes it. */
+    addFragment(fragment) {
+        this.fragments.push(fragment);
+        this.invalidate();
+        return () => {
+            const index = this.fragments.indexOf(fragment);
+            if (index >= 0)
+                this.fragments.splice(index, 1);
+            this.invalidate();
+        };
+    }
+    /** Apply `transform` to every generated document, in the order added. Returns a function that removes it. */
+    addTransform(transform) {
+        return this.track(this.transforms, transform);
+    }
+    /**
+     * Requests under `prefix` are forwarded to `router` at request time, by a dispatcher the `/api` router sees only as a
+     * catch-all. Its routes are documented and inspected at `prefix` followed by the router's own paths, exactly like
+     * routes mounted on `/api`: each declares `describeRoute({...})` or `describeRoute({ hide: true })`. With `scope`,
+     * only routes at `prefix` + `scope` or below it are documented; one outside it is never reached, is left out of the
+     * document and the duplicate-route check, and is reported as undeclared. Registered
+     * before the application registers its routes, they also take part in the duplicate-route check at start. Returns a
+     * function that removes the registration.
+     */
+    addApiRouter(registration) {
+        const { prefix } = registration;
+        if (prefix !== '/api' && !prefix.startsWith('/api/'))
+            throw new Error(`${registration.owner}: a forwarded API router's prefix must be /api or a path below it, not ${prefix}.`);
+        const { scope } = registration;
+        if (scope !== undefined && !scope.startsWith('/'))
+            throw new Error(`${registration.owner}: a forwarded API router's scope must start with /, not ${scope}.`);
+        const entry = {
+            ...registration,
+            prefix: prefix.replace(/\/+$/, ''),
+            ...(scope === undefined ? {} : { scope: scope.replace(/\/+$/, '') }),
+        };
+        return this.track(this.forwardedRouters, entry);
+    }
+    /**
+     * A forwarded target the framework cannot see into, such as a plain function a dispatcher calls: it always counts as
+     * undeclared in `findUndeclaredApiRoutes(app)`, so the API document check fails, and it never appears in the
+     * document. Returns a function that removes the registration.
+     */
+    addUndeclaredApiRoute(route) {
+        return this.track(this.undeclaredRoutes, { ...route });
+    }
+    /** What the registered dispatchers forward to, as `inspectApiRoutes()` and the document read it. */
+    get forwardedApiRoutes() {
+        return {
+            routers: [...this.forwardedRouters],
+            undeclared: [...this.undeclaredRoutes],
+        };
+    }
+    track(list, entry) {
+        list.push(entry);
+        this.invalidate();
+        return () => {
+            const index = list.indexOf(entry);
+            if (index >= 0)
+                list.splice(index, 1);
+            this.invalidate();
+        };
+    }
+    /** Whether any access check is registered, which decides whether the documentation is served at all. */
+    hasAccessChecks() {
+        return this.accessChecks.length > 0;
+    }
+    /** Whether one of the registered checks allows `context` to read the documentation. */
+    async canRead(context) {
+        for (const access of [...this.accessChecks]) {
+            if (await access.check(context))
+                return true;
+        }
+        return false;
+    }
+    /** Called by the application once its `/api` router is assembled. */
+    attach(target) {
+        this.target = target;
+        this.invalidate();
+    }
+    /** The `/api` router the document is generated from, once the application has registered its routes. */
+    get apiRouter() {
+        return this.target?.api;
+    }
+    /** The document, generated on first use and cached until `invalidate()`. */
+    getDocument() {
+        const target = this.target;
+        if (!target) {
+            return Promise.reject(new Error('The API document is not available before the application registers its routes.'));
+        }
+        if (!this.cached) {
+            const generation = this.generate(target);
+            this.cached = generation;
+            // A failed generation is not cached, so the next request tries again.
+            generation.catch(() => {
+                if (this.cached === generation)
+                    this.cached = undefined;
+            });
+        }
+        return this.cached;
+    }
+    /** Drop the cached document; the next read generates it again. */
+    invalidate() {
+        this.cached = undefined;
+    }
+    async generate(target) {
+        const fragments = [];
+        for (const source of this.fragments) {
+            fragments.push(typeof source === 'function' ? await source() : source);
+        }
+        const document = await generateApiDocument(target.api, {
+            ...(await target.describe()),
+            forwarded: this.forwardedApiRoutes,
+            fragments,
+            ...(target.onWarning ? { onWarning: target.onWarning } : {}),
+        });
+        for (const transform of [...this.transforms])
+            await transform(document);
+        return document;
+    }
+}
+/**
+ * The application's `ApiDocsService`. A plugin resolves it in its service provider's `register()` or `boot()` to add
+ * an access check or a fragment, or to invalidate the cached document.
+ */
+export const apiDocsToken = createServiceToken('@nocobase/app/api-docs');
+//# sourceMappingURL=service.js.map

package/dist/router/openapi/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/router/openapi/service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,GAEnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EACL,mBAAmB,GAQpB,MAAM,eAAe,CAAC;AA0CvB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,cAAc;IACR,YAAY,GAAoB,EAAE,CAAC;IACnC,SAAS,GAAgC,EAAE,CAAC;IAC5C,UAAU,GAA2B,EAAE,CAAC;IACxC,gBAAgB,GAAyB,EAAE,CAAC;IAC5C,gBAAgB,GAAyB,EAAE,CAAC;IACrD,MAAM,CAA4B;IAClC,MAAM,CAAmC;IAEjD,+GAA+G;IACxG,SAAS,CAAC,MAAqB;QACpC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC;IAED,8EAA8E;IACvE,WAAW,CAAC,QAAmC;QACpD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC;IAED,6GAA6G;IACtG,YAAY,CAAC,SAA+B;QACjD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAChD,CAAC;IAED;;;;;;;;OAQG;IACI,YAAY,CAAC,YAAgC;QAClD,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC;QAChC,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,CAAC,KAAK,0EAA0E,MAAM,GAAG,CACzG,CAAC;QACJ,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAC/C,MAAM,IAAI,KAAK,CACb,GAAG,YAAY,CAAC,KAAK,2DAA2D,KAAK,GAAG,CACzF,CAAC;QACJ,MAAM,KAAK,GAAuB;YAChC,GAAG,YAAY;YACf,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAClC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;SACrE,CAAC;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACI,qBAAqB,CAAC,KAAyB;QACpD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IAED,oGAAoG;IACpG,IAAW,kBAAkB;QAC3B,OAAO;YACL,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;YACnC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC;SACvC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAI,IAAS,EAAE,KAAQ;QAClC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,KAAK,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,EAAE,CAAC;QACpB,CAAC,CAAC;IACJ,CAAC;IAED,wGAAwG;IACjG,eAAe;QACpB,OAAO,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,uFAAuF;IAChF,KAAK,CAAC,OAAO,CAAC,OAAgB;QACnC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YAC5C,IAAI,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC/C,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qEAAqE;IAC9D,MAAM,CAAC,MAAqB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,EAAE,CAAC;IACpB,CAAC;IAED,wGAAwG;IACxG,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;IAC1B,CAAC;IAED,4EAA4E;IACrE,WAAW;QAChB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,gFAAgF,CACjF,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC;YACzB,sEAAsE;YACtE,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;gBACpB,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU;oBAAE,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YAC1D,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,kEAAkE;IAC3D,UAAU;QACf,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,MAAqB;QAC1C,MAAM,SAAS,GAA0B,EAAE,CAAC;QAC5C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,SAAS,CAAC,IAAI,CAAC,OAAO,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,GAAG,EAAE;YACrD,GAAG,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC5B,SAAS,EAAE,IAAI,CAAC,kBAAkB;YAClC,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7D,CAAC,CAAC;QACH,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC;YAAE,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC;QACxE,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GACvB,kBAAkB,CAAiB,wBAAwB,CAAC,CAAC"}

package/dist/router/repository-constraints.d.ts

@@ -0,0 +1,15 @@
+import type { Context } from 'hono';
+import { type RepositoryPolicy } from '@nocobase/db';
+import type { RepositoryApiAction } from './repository-routes.js';
+/** Trusted middleware may only narrow the policy of the matching endpoint. */
+export interface RepositoryRequestConstraint {
+    readonly repository: string;
+    readonly action: RepositoryApiAction;
+    readonly collection: string;
+    readonly connection?: string;
+    readonly policy: RepositoryPolicy;
+}
+export declare function addRepositoryRequestConstraint(context: Context, constraint: RepositoryRequestConstraint): void;
+/** Server-owned request state, never populated from a request body. */
+export declare function getRepositoryRequestConstraints(context: Context): readonly RepositoryRequestConstraint[];
+//# sourceMappingURL=repository-constraints.d.ts.map

package/dist/router/repository-constraints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-constraints.d.ts","sourceRoot":"","sources":["../../src/router/repository-constraints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAA6B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAIlE,8EAA8E;AAC9E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,OAAO,EAChB,UAAU,EAAE,2BAA2B,GACtC,IAAI,CAMN;AAED,uEAAuE;AACvE,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,OAAO,GACf,SAAS,2BAA2B,EAAE,CAKxC"}

package/dist/router/repository-constraints.js

@@ -0,0 +1,14 @@
+import { normalizeRepositoryPolicy } from '@nocobase/db';
+const constraintsKey = '@nocobase/app-server/repository-constraints';
+export function addRepositoryRequestConstraint(context, constraint) {
+    const previous = getRepositoryRequestConstraints(context);
+    context.set(constraintsKey, [
+        ...previous,
+        { ...constraint, policy: normalizeRepositoryPolicy(constraint.policy) },
+    ]);
+}
+/** Server-owned request state, never populated from a request body. */
+export function getRepositoryRequestConstraints(context) {
+    return (context.get(constraintsKey) ?? []);
+}
+//# sourceMappingURL=repository-constraints.js.map

package/dist/router/repository-constraints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-constraints.js","sourceRoot":"","sources":["../../src/router/repository-constraints.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAyB,MAAM,cAAc,CAAC;AAGhF,MAAM,cAAc,GAAG,6CAA6C,CAAC;AAWrE,MAAM,UAAU,8BAA8B,CAC5C,OAAgB,EAChB,UAAuC;IAEvC,MAAM,QAAQ,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;IAC1D,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE;QAC1B,GAAG,QAAQ;QACX,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,yBAAyB,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;KACxE,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,+BAA+B,CAC7C,OAAgB;IAEhB,OAAO,CACJ,OAAO,CAAC,GAAG,CAAC,cAAc,CAC0B,IAAI,EAAE,CAC5D,CAAC;AACJ,CAAC"}

package/dist/router/repository-routes.d.ts

@@ -0,0 +1,90 @@
+import { type RepositoryPolicy } from '@nocobase/db';
+import type { ServiceContainer } from '@nocobase/service-provider';
+import { type Context } from 'hono';
+import { type AppApiRouteContribution } from './routes.js';
+import type { ApiSchema } from './openapi/describe.js';
+export type RepositoryApiAction = 'findMany' | 'findOne' | 'count' | 'aggregate' | 'groupBy' | 'exists' | 'createOne' | 'updateOne' | 'deleteOne';
+/**
+ * Options an action accepts. An action decides whether an endpoint exists;
+ * what it may do is the exposure's Policy, which every action shares.
+ */
+export type RepositoryApiActionOptions = Readonly<Record<string, never>>;
+export type RepositoryApiEmptyActionOptions = RepositoryApiActionOptions;
+export interface RepositoryApiFindManyOptions {
+    /** Default and maximum limit. Defaults to 100. */
+    readonly maxLimit?: number;
+}
+export interface RepositoryApiActions {
+    readonly findMany?: RepositoryApiFindManyOptions;
+    readonly findOne?: RepositoryApiEmptyActionOptions;
+    readonly count?: RepositoryApiEmptyActionOptions;
+    readonly exists?: RepositoryApiEmptyActionOptions;
+    readonly aggregate?: RepositoryApiEmptyActionOptions;
+    readonly groupBy?: RepositoryApiEmptyActionOptions;
+    readonly createOne?: RepositoryApiEmptyActionOptions;
+    readonly updateOne?: RepositoryApiEmptyActionOptions;
+    readonly deleteOne?: RepositoryApiEmptyActionOptions;
+}
+export interface RepositoryApiExposure<P = unknown> {
+    /**
+     * The name passed to api.repository(name), and the first segment of every
+     * endpoint, `POST /api/{name}/{action}`. camelCase, such as `salesOrders`.
+     */
+    readonly name: string;
+    /** Logical Collection name; defaults to name. */
+    readonly collection?: string;
+    /** Database connection name; defaults to the application's default connection. */
+    readonly connection?: string;
+    /**
+     * The Policy every action of this exposure runs under. Required: an exposure
+     * without one would accept anything, and a missing declaration is the one
+     * mistake that reads exactly like a deliberate one.
+     *
+     * A function receives the principal resolved for the request, which is what
+     * lets a scope name the caller. It is server-owned either way — a request
+     * body naming `policy` or `scope` is refused, because the per-action
+     * allowlist below enumerates what an action reads from the body and neither
+     * is on it.
+     */
+    readonly policy: RepositoryPolicy | ((principal: P) => RepositoryPolicy);
+    readonly actions: RepositoryApiActions;
+    /**
+     * Fields the exposure adds to every record it returns that are not fields of the Collection, such as a URL derived
+     * from a record's columns, each described by a Standard Schema (such as a zod schema) or an OpenAPI schema.
+     *
+     * Documentation only: the router does not compute them. Whatever adds them to a response, such as a middleware on
+     * the exposure's paths, declares them here so the API document lists them, read-only, in the exposure's record
+     * schema wherever a record is returned. They never appear in `values`, `filter` or `sort`. A name that is also a
+     * field of the Collection fails when the routes are created.
+     */
+    readonly computedFields?: Readonly<Record<string, ApiSchema>>;
+}
+export interface DefineRepositoryApiRoutesOptions<P = unknown> {
+    readonly repositories: readonly RepositoryApiExposure<P>[];
+    /**
+     * Resolve the principal a Policy function receives. Required as soon as one
+     * exposure declares a Policy function, and never called otherwise.
+     *
+     * The application owns this: `app-server` does not know how a request is
+     * authenticated. Returning `undefined` or `null` refuses the request with
+     * 403 rather than binding a Policy built from a principal that is not there,
+     * which is why the return type admits both.
+     */
+    readonly principal?: (context: Context) => P | undefined | null | Promise<P | undefined | null>;
+}
+export interface RepositoryApiRoutesApplication {
+    readonly container: ServiceContainer;
+}
+/**
+ * Exposes only configured Repository endpoints using `POST /{name}/{action}`,
+ * mounted under `/api`. Every path is literal — a name and an action, no
+ * parameters — so the endpoints of one exposure cannot shadow each other. An
+ * exposure name shares the first segment with plugin namespaces, so it must not
+ * equal one: name an exposure after its Collection, such as `salesOrders`,
+ * rather than after a plugin.
+ *
+ * This basic adapter does not install authentication or authorization. Database
+ * services are resolved only when the application creates the router.
+ */
+export declare function defineRepositoryApiRoutes<P = unknown>(options: DefineRepositoryApiRoutesOptions<P>): AppApiRouteContribution<RepositoryApiRoutesApplication>;
+//# sourceMappingURL=repository-routes.d.ts.map

package/dist/router/repository-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository-routes.d.ts","sourceRoot":"","sources":["../../src/router/repository-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,KAAK,gBAAgB,EAUtB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAQ,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAU1C,OAAO,EAAmB,KAAK,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE5E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGvD,MAAM,MAAM,mBAAmB,GAC3B,UAAU,GACV,SAAS,GACT,OAAO,GACP,WAAW,GACX,SAAS,GACT,QAAQ,GACR,WAAW,GACX,WAAW,GACX,WAAW,CAAC;AAEhB;;;GAGG;AACH,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACzE,MAAM,MAAM,+BAA+B,GAAG,0BAA0B,CAAC;AACzE,MAAM,WAAW,4BAA4B;IAC3C,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,CAAC,EAAE,4BAA4B,CAAC;IACjD,QAAQ,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,+BAA+B,CAAC;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,+BAA+B,CAAC;IAClD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAC;IACrD,QAAQ,CAAC,OAAO,CAAC,EAAE,+BAA+B,CAAC;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,+BAA+B,CAAC;CACtD;AAED,MAAM,WAAW,qBAAqB,CAAC,CAAC,GAAG,OAAO;IAChD;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,gBAAgB,CAAC,CAAC;IACzE,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;IACvC;;;;;;;;OAQG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,gCAAgC,CAAC,CAAC,GAAG,OAAO;IAC3D,QAAQ,CAAC,YAAY,EAAE,SAAS,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3D;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,OAAO,EAAE,OAAO,KACb,CAAC,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;CACtC;AAuDD;;;;;;;;;;GAUG;AACH,wBAAgB,yBAAyB,CAAC,CAAC,GAAG,OAAO,EACnD,OAAO,EAAE,gCAAgC,CAAC,CAAC,CAAC,GAC3C,uBAAuB,CAAC,8BAA8B,CAAC,CA2NzD"}