@open-mercato/shared 0.6.7-develop.6860.1.f796b22e80 → 0.6.7

package/dist/lib/telemetry/runtime.js

@@ -1,35 +0,0 @@
-const GLOBAL_KEY = /* @__PURE__ */ Symbol.for("@open-mercato/shared.telemetryRuntime");
-const ENABLED_BACKENDS = /* @__PURE__ */ new Set(["console", "signoz", "newrelic", "otlp"]);
-function store() {
-  const globalStore = globalThis;
-  let current = globalStore[GLOBAL_KEY];
-  if (!current) {
-    current = {};
-    globalStore[GLOBAL_KEY] = current;
-  }
-  return current;
-}
-function isTelemetryBackendEnabled(raw) {
-  const value = raw ?? (typeof process === "undefined" ? void 0 : process.env.TELEMETRY_BACKEND);
-  return ENABLED_BACKENDS.has((value ?? "").trim().toLowerCase());
-}
-function registerTelemetryRuntime(runtime) {
-  store().active = runtime;
-  return () => {
-    const current = store();
-    if (current.active === runtime) current.active = void 0;
-  };
-}
-function getTelemetryRuntime() {
-  return store().active;
-}
-function resetTelemetryRuntime() {
-  store().active = void 0;
-}
-export {
-  getTelemetryRuntime,
-  isTelemetryBackendEnabled,
-  registerTelemetryRuntime,
-  resetTelemetryRuntime
-};
-//# sourceMappingURL=runtime.js.map

package/dist/lib/telemetry/runtime.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/telemetry/runtime.ts"],
-  "sourcesContent": ["export type TelemetryTraceCarrier = Record<string, string>\n\nexport type TelemetryRuntime = {\n  /**\n   * True only when the active SDK may safely use the process-global W3C\n   * propagator for cross-boundary extraction.\n   */\n  canUseGlobalTracePropagation(): boolean\n  captureTraceContext(): TelemetryTraceCarrier\n  continueTrace<T>(\n    carrier: TelemetryTraceCarrier | undefined,\n    name: string,\n    fn: () => T,\n    options?: { kind?: 'internal' | 'server' | 'client' | 'producer' | 'consumer' },\n  ): T\n  recordHttpDuration(method: string, route: string, status: number, startedAt: number): void\n  reportError(\n    error: unknown,\n    context?: {\n      module?: string\n      attributes?: Record<string, string | number | boolean | undefined>\n    },\n  ): void\n  shutdown(): Promise<void>\n}\n\nconst GLOBAL_KEY = Symbol.for('@open-mercato/shared.telemetryRuntime')\nconst ENABLED_BACKENDS = new Set(['console', 'signoz', 'newrelic', 'otlp'])\n\ntype TelemetryRuntimeStore = {\n  active?: TelemetryRuntime\n}\n\nfunction store(): TelemetryRuntimeStore {\n  const globalStore = globalThis as unknown as Record<symbol, TelemetryRuntimeStore | undefined>\n  let current = globalStore[GLOBAL_KEY]\n  if (!current) {\n    current = {}\n    globalStore[GLOBAL_KEY] = current\n  }\n  return current\n}\n\n/**\n * This check is intentionally owned by shared code so hosts can decide whether\n * to dynamically import the telemetry package without evaluating that package.\n */\nexport function isTelemetryBackendEnabled(raw?: string): boolean {\n  const value = raw ?? (\n    typeof process === 'undefined'\n      ? undefined\n      : process.env.TELEMETRY_BACKEND\n  )\n  return ENABLED_BACKENDS.has((value ?? '').trim().toLowerCase())\n}\n\nexport function registerTelemetryRuntime(runtime: TelemetryRuntime): () => void {\n  store().active = runtime\n  return () => {\n    const current = store()\n    if (current.active === runtime) current.active = undefined\n  }\n}\n\nexport function getTelemetryRuntime(): TelemetryRuntime | undefined {\n  return store().active\n}\n\n/** Test-only: clear the process-wide telemetry bridge. */\nexport function resetTelemetryRuntime(): void {\n  store().active = undefined\n}\n"],
-  "mappings": "AA0BA,MAAM,aAAa,uBAAO,IAAI,uCAAuC;AACrE,MAAM,mBAAmB,oBAAI,IAAI,CAAC,WAAW,UAAU,YAAY,MAAM,CAAC;AAM1E,SAAS,QAA+B;AACtC,QAAM,cAAc;AACpB,MAAI,UAAU,YAAY,UAAU;AACpC,MAAI,CAAC,SAAS;AACZ,cAAU,CAAC;AACX,gBAAY,UAAU,IAAI;AAAA,EAC5B;AACA,SAAO;AACT;AAMO,SAAS,0BAA0B,KAAuB;AAC/D,QAAM,QAAQ,QACZ,OAAO,YAAY,cACf,SACA,QAAQ,IAAI;AAElB,SAAO,iBAAiB,KAAK,SAAS,IAAI,KAAK,EAAE,YAAY,CAAC;AAChE;AAEO,SAAS,yBAAyB,SAAuC;AAC9E,QAAM,EAAE,SAAS;AACjB,SAAO,MAAM;AACX,UAAM,UAAU,MAAM;AACtB,QAAI,QAAQ,WAAW,QAAS,SAAQ,SAAS;AAAA,EACnD;AACF;AAEO,SAAS,sBAAoD;AAClE,SAAO,MAAM,EAAE;AACjB;AAGO,SAAS,wBAA8B;AAC5C,QAAM,EAAE,SAAS;AACnB;",
-  "names": []
-}

package/dist/lib/webhooks/body.js

@@ -1,57 +0,0 @@
-import { parseNumberWithDefault } from "../number.js";
-const DEFAULT_WEBHOOK_BODY_LIMIT_BYTES = 1024 * 1024;
-class WebhookBodyTooLargeError extends Error {
-  constructor(limitBytes) {
-    super(`Webhook body exceeds the ${limitBytes}-byte limit`);
-    this.name = "WebhookBodyTooLargeError";
-    this.limitBytes = limitBytes;
-  }
-}
-function resolveWebhookBodyLimitBytes(raw = typeof process === "undefined" ? void 0 : process.env.OM_WEBHOOK_MAX_BODY_BYTES, fallbackBytes = DEFAULT_WEBHOOK_BODY_LIMIT_BYTES) {
-  const fallback = Number.isSafeInteger(fallbackBytes) && fallbackBytes > 0 ? fallbackBytes : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES;
-  const parsed = parseNumberWithDefault(raw, fallback, { min: 1 });
-  return Number.isSafeInteger(parsed) ? parsed : fallback;
-}
-async function readBoundedRequestBody(request, options) {
-  const configuredLimit = options?.maxBytes ?? resolveWebhookBodyLimitBytes();
-  const maxBytes = Number.isSafeInteger(configuredLimit) && configuredLimit > 0 ? configuredLimit : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES;
-  const declaredLength = request.headers.get("content-length")?.trim();
-  if (declaredLength && /^\d+$/.test(declaredLength)) {
-    const declaredBytes = Number(declaredLength);
-    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {
-      throw new WebhookBodyTooLargeError(maxBytes);
-    }
-  }
-  if (!request.body) return "";
-  const reader = request.body.getReader();
-  const chunks = [];
-  let totalBytes = 0;
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) break;
-      totalBytes += value.byteLength;
-      if (totalBytes > maxBytes) {
-        await reader.cancel().catch(() => void 0);
-        throw new WebhookBodyTooLargeError(maxBytes);
-      }
-      chunks.push(value);
-    }
-  } finally {
-    reader.releaseLock();
-  }
-  const body = new Uint8Array(totalBytes);
-  let offset = 0;
-  for (const chunk of chunks) {
-    body.set(chunk, offset);
-    offset += chunk.byteLength;
-  }
-  return new TextDecoder().decode(body);
-}
-export {
-  DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,
-  WebhookBodyTooLargeError,
-  readBoundedRequestBody,
-  resolveWebhookBodyLimitBytes
-};
-//# sourceMappingURL=body.js.map

package/dist/lib/webhooks/body.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/lib/webhooks/body.ts"],
-  "sourcesContent": ["import { parseNumberWithDefault } from '../number'\n\nexport const DEFAULT_WEBHOOK_BODY_LIMIT_BYTES = 1024 * 1024\n\nexport class WebhookBodyTooLargeError extends Error {\n  readonly limitBytes: number\n\n  constructor(limitBytes: number) {\n    super(`Webhook body exceeds the ${limitBytes}-byte limit`)\n    this.name = 'WebhookBodyTooLargeError'\n    this.limitBytes = limitBytes\n  }\n}\n\nexport function resolveWebhookBodyLimitBytes(\n  raw = typeof process === 'undefined' ? undefined : process.env.OM_WEBHOOK_MAX_BODY_BYTES,\n  fallbackBytes = DEFAULT_WEBHOOK_BODY_LIMIT_BYTES,\n): number {\n  const fallback = Number.isSafeInteger(fallbackBytes) && fallbackBytes > 0\n    ? fallbackBytes\n    : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES\n  const parsed = parseNumberWithDefault(raw, fallback, { min: 1 })\n  return Number.isSafeInteger(parsed) ? parsed : fallback\n}\n\nexport async function readBoundedRequestBody(\n  request: Request,\n  options?: { maxBytes?: number },\n): Promise<string> {\n  const configuredLimit = options?.maxBytes ?? resolveWebhookBodyLimitBytes()\n  const maxBytes = Number.isSafeInteger(configuredLimit) && configuredLimit > 0\n    ? configuredLimit\n    : DEFAULT_WEBHOOK_BODY_LIMIT_BYTES\n  const declaredLength = request.headers.get('content-length')?.trim()\n  if (declaredLength && /^\\d+$/.test(declaredLength)) {\n    const declaredBytes = Number(declaredLength)\n    if (!Number.isSafeInteger(declaredBytes) || declaredBytes > maxBytes) {\n      throw new WebhookBodyTooLargeError(maxBytes)\n    }\n  }\n\n  if (!request.body) return ''\n\n  const reader = request.body.getReader()\n  const chunks: Uint8Array[] = []\n  let totalBytes = 0\n\n  try {\n    while (true) {\n      const { done, value } = await reader.read()\n      if (done) break\n      totalBytes += value.byteLength\n      if (totalBytes > maxBytes) {\n        await reader.cancel().catch(() => undefined)\n        throw new WebhookBodyTooLargeError(maxBytes)\n      }\n      chunks.push(value)\n    }\n  } finally {\n    reader.releaseLock()\n  }\n\n  const body = new Uint8Array(totalBytes)\n  let offset = 0\n  for (const chunk of chunks) {\n    body.set(chunk, offset)\n    offset += chunk.byteLength\n  }\n  return new TextDecoder().decode(body)\n}\n"],
-  "mappings": "AAAA,SAAS,8BAA8B;AAEhC,MAAM,mCAAmC,OAAO;AAEhD,MAAM,iCAAiC,MAAM;AAAA,EAGlD,YAAY,YAAoB;AAC9B,UAAM,4BAA4B,UAAU,aAAa;AACzD,SAAK,OAAO;AACZ,SAAK,aAAa;AAAA,EACpB;AACF;AAEO,SAAS,6BACd,MAAM,OAAO,YAAY,cAAc,SAAY,QAAQ,IAAI,2BAC/D,gBAAgB,kCACR;AACR,QAAM,WAAW,OAAO,cAAc,aAAa,KAAK,gBAAgB,IACpE,gBACA;AACJ,QAAM,SAAS,uBAAuB,KAAK,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/D,SAAO,OAAO,cAAc,MAAM,IAAI,SAAS;AACjD;AAEA,eAAsB,uBACpB,SACA,SACiB;AACjB,QAAM,kBAAkB,SAAS,YAAY,6BAA6B;AAC1E,QAAM,WAAW,OAAO,cAAc,eAAe,KAAK,kBAAkB,IACxE,kBACA;AACJ,QAAM,iBAAiB,QAAQ,QAAQ,IAAI,gBAAgB,GAAG,KAAK;AACnE,MAAI,kBAAkB,QAAQ,KAAK,cAAc,GAAG;AAClD,UAAM,gBAAgB,OAAO,cAAc;AAC3C,QAAI,CAAC,OAAO,cAAc,aAAa,KAAK,gBAAgB,UAAU;AACpE,YAAM,IAAI,yBAAyB,QAAQ;AAAA,IAC7C;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,KAAM,QAAO;AAE1B,QAAM,SAAS,QAAQ,KAAK,UAAU;AACtC,QAAM,SAAuB,CAAC;AAC9B,MAAI,aAAa;AAEjB,MAAI;AACF,WAAO,MAAM;AACX,YAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,UAAI,KAAM;AACV,oBAAc,MAAM;AACpB,UAAI,aAAa,UAAU;AACzB,cAAM,OAAO,OAAO,EAAE,MAAM,MAAM,MAAS;AAC3C,cAAM,IAAI,yBAAyB,QAAQ;AAAA,MAC7C;AACA,aAAO,KAAK,KAAK;AAAA,IACnB;AAAA,EACF,UAAE;AACA,WAAO,YAAY;AAAA,EACrB;AAEA,QAAM,OAAO,IAAI,WAAW,UAAU;AACtC,MAAI,SAAS;AACb,aAAW,SAAS,QAAQ;AAC1B,SAAK,IAAI,OAAO,MAAM;AACtB,cAAU,MAAM;AAAA,EAClB;AACA,SAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AACtC;",
-  "names": []
-}

package/dist/lib/webhooks/inbound-types.js

@@ -1 +0,0 @@
-//# sourceMappingURL=inbound-types.js.map

package/dist/lib/webhooks/inbound-types.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": [],
-  "sourcesContent": [],
-  "mappings": "",
-  "names": []
-}

package/dist/modules/widgets/extension-points.js

@@ -1,96 +0,0 @@
-function defineModuleExtensionPoints(declaration) {
-  return Object.freeze({
-    ...declaration,
-    hosts: Object.freeze({ ...declaration.hosts })
-  });
-}
-function injectionExtensionHost(declaration) {
-  const hasExactId = typeof declaration.spotId === "string" && declaration.spotId.length > 0;
-  const hasPattern = typeof declaration.pattern === "string" && declaration.pattern.length > 0;
-  if (hasExactId === hasPattern) {
-    throw new Error("[internal] injection extension hosts require exactly one of spotId or pattern");
-  }
-  if (hasPattern && (!declaration.parameters || Object.keys(declaration.parameters).length === 0)) {
-    throw new Error("[internal] patterned injection extension hosts require named parameters");
-  }
-  return Object.freeze({ ...declaration });
-}
-function dataTableExtensionHost(declaration) {
-  return Object.freeze({ family: "data-table", ...declaration });
-}
-function crudFormExtensionHost(declaration) {
-  return Object.freeze({ family: "crud-form", ...declaration });
-}
-function componentExtensionHost(declaration) {
-  return Object.freeze({ family: "component-handle", ...declaration });
-}
-const DATA_TABLE_EXTENSION_SURFACES = [
-  { key: "header", suffix: "header", capabilities: ["render-widget"], bound: true },
-  { key: "footer", suffix: "footer", capabilities: ["render-widget"], bound: true },
-  { key: "toolbar", suffix: "toolbar", capabilities: ["toolbar-widget"], bound: true },
-  { key: "searchTrailing", suffix: "search-trailing", capabilities: ["render-widget"], bound: true },
-  { key: "columns", suffix: "columns", capabilities: ["column-widget"], bound: true },
-  { key: "rowActions", suffix: "row-actions", capabilities: ["row-action"], bound: true },
-  { key: "bulkActions", suffix: "bulk-actions", capabilities: ["bulk-action"], bound: true },
-  { key: "filters", suffix: "filters", capabilities: ["filter-widget"], bound: true },
-  { key: "replacement", suffix: null, capabilities: ["component-replacement"], bound: true },
-  { key: "emptyState", suffix: "empty-state", capabilities: ["render-widget"], bound: false }
-];
-const CRUD_FORM_EXTENSION_SURFACES = [
-  { key: "base", suffix: null, capabilities: ["render-widget", "lifecycle-handler"], bound: true },
-  { key: "header", suffix: "header", capabilities: ["render-widget"], bound: true },
-  { key: "fields", suffix: "fields", capabilities: ["field-widget"], bound: true },
-  { key: "replacement", suffix: null, capabilities: ["component-replacement"], bound: true },
-  { key: "beforeFields", suffix: "before-fields", capabilities: ["render-widget"], bound: false },
-  { key: "afterFields", suffix: "after-fields", capabilities: ["render-widget"], bound: false },
-  { key: "footer", suffix: "footer", capabilities: ["render-widget"], bound: false },
-  { key: "sidebar", suffix: "sidebar", capabilities: ["render-widget"], bound: false },
-  { key: "group", suffix: "group:{groupId}", capabilities: ["render-widget"], bound: false },
-  { key: "fieldBefore", suffix: "field:{fieldId}:before", capabilities: ["render-widget"], bound: false },
-  { key: "fieldAfter", suffix: "field:{fieldId}:after", capabilities: ["render-widget"], bound: false }
-];
-const CRUD_FORM_LIFECYCLE_PHASES = [
-  "transformValidation",
-  "transformDisplayData",
-  "onBeforeNavigate",
-  "onAppEvent",
-  "onVisibilityChange",
-  "onBeforeDelete",
-  "onDelete",
-  "onAfterDelete",
-  "onDeleteError",
-  "onFieldChange",
-  "transformFormData",
-  "onBeforeSave",
-  "onSave",
-  "onAfterSave"
-];
-const CRUD_FORM_OPERATIONS = ["create", "update", "delete"];
-function dataTableExtensionSpotId(tableId, suffix) {
-  return suffix ? `data-table:${tableId}:${suffix}` : `data-table:${tableId}`;
-}
-function crudFormExtensionSpotId(entityId, suffix) {
-  return suffix ? `crud-form:${entityId}:${suffix}` : `crud-form:${entityId}`;
-}
-function extensionSpotChildId(spotId, suffix) {
-  return `${spotId}:${suffix}`;
-}
-function resolveExtensionPointPattern(pattern, parameters) {
-  return pattern.replace(/\{([^}]+)\}/g, (token, parameterName) => parameters[parameterName] ?? token);
-}
-export {
-  CRUD_FORM_EXTENSION_SURFACES,
-  CRUD_FORM_LIFECYCLE_PHASES,
-  CRUD_FORM_OPERATIONS,
-  DATA_TABLE_EXTENSION_SURFACES,
-  componentExtensionHost,
-  crudFormExtensionHost,
-  crudFormExtensionSpotId,
-  dataTableExtensionHost,
-  dataTableExtensionSpotId,
-  defineModuleExtensionPoints,
-  extensionSpotChildId,
-  injectionExtensionHost,
-  resolveExtensionPointPattern
-};
-//# sourceMappingURL=extension-points.js.map

package/dist/modules/widgets/extension-points.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/modules/widgets/extension-points.ts"],
-  "sourcesContent": ["export type ExtensionHostFamily =\n  | 'generic'\n  | 'menu'\n  | 'data-table'\n  | 'crud-form'\n  | 'detail'\n  | 'portal-page'\n  | 'component-handle'\n  | 'entity'\n  | 'api-route'\n  | 'command'\n  | 'event'\n  | 'query-lifecycle'\n  | 'dashboard'\n  | 'notification'\n  | 'integration'\n  | 'specialized-registry'\n  | 'module-override'\n\nexport type ExtensionHostCapability =\n  | 'render-widget'\n  | 'headless-widget'\n  | 'menu-item'\n  | 'column-widget'\n  | 'row-action'\n  | 'bulk-action'\n  | 'filter-widget'\n  | 'toolbar-widget'\n  | 'field-widget'\n  | 'lifecycle-handler'\n  | 'component-replacement'\n  | 'response-enricher'\n  | 'query-enricher'\n  | 'api-interceptor'\n  | 'command-interceptor'\n  | 'mutation-guard'\n  | 'entity-extension'\n  | 'async-subscriber'\n  | 'sync-subscriber'\n  | 'browser-client'\n  | 'browser-portal'\n  | 'registry-contribution'\n  | 'module-override'\n\nexport type ExtensionHostActivation = 'always' | 'host-opt-in' | 'caller-opt-in' | 'feature-gated'\n\nexport type ExtensionPointPatternParameter = {\n  source: string\n  pattern?: string\n}\n\ntype ExtensionHostDeclarationBase = {\n  source: string\n  contextContract?: string\n  dataContract?: string\n  scopeContract?: string\n  runtimeContract?: string\n  activation?: ExtensionHostActivation\n  aliases?: readonly string[]\n  fallbacks?: readonly string[]\n}\n\ntype InjectionExtensionHostDeclarationBase = ExtensionHostDeclarationBase & {\n  family: Exclude<ExtensionHostFamily, 'data-table' | 'crud-form' | 'component-handle'>\n  supported: readonly ExtensionHostCapability[]\n}\n\nexport type InjectionExtensionHostDeclaration = InjectionExtensionHostDeclarationBase & (\n  | {\n      spotId: string\n      pattern?: never\n      parameters?: never\n    }\n  | {\n      spotId?: never\n      pattern: string\n      parameters: Readonly<Record<string, ExtensionPointPatternParameter>>\n    }\n)\n\nexport type DataTableExtensionHostDeclaration = ExtensionHostDeclarationBase & {\n  family: 'data-table'\n  tableId: string\n  baseSpotId?: string\n}\n\nexport type CrudFormExtensionHostDeclaration = ExtensionHostDeclarationBase & {\n  family: 'crud-form'\n  entityId: string\n  spotId?: string\n}\n\nexport type ComponentExtensionHostDeclaration = ExtensionHostDeclarationBase & {\n  family: 'component-handle'\n  componentId: string\n  propsContract?: string\n}\n\nexport type ModuleExtensionHostDeclaration =\n  | InjectionExtensionHostDeclaration\n  | DataTableExtensionHostDeclaration\n  | CrudFormExtensionHostDeclaration\n  | ComponentExtensionHostDeclaration\n\nexport type ModuleExtensionPoints<\n  TModuleId extends string = string,\n  THosts extends Readonly<Record<string, ModuleExtensionHostDeclaration>> = Readonly<Record<string, ModuleExtensionHostDeclaration>>,\n> = {\n  moduleId: TModuleId\n  hosts: THosts\n}\n\nexport function defineModuleExtensionPoints<\n  const TModuleId extends string,\n  const THosts extends Readonly<Record<string, ModuleExtensionHostDeclaration>>,\n>(declaration: ModuleExtensionPoints<TModuleId, THosts>): ModuleExtensionPoints<TModuleId, THosts> {\n  return Object.freeze({\n    ...declaration,\n    hosts: Object.freeze({ ...declaration.hosts }),\n  })\n}\n\nexport function injectionExtensionHost<const TDeclaration extends InjectionExtensionHostDeclaration>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration> {\n  const hasExactId = typeof declaration.spotId === 'string' && declaration.spotId.length > 0\n  const hasPattern = typeof declaration.pattern === 'string' && declaration.pattern.length > 0\n  if (hasExactId === hasPattern) {\n    throw new Error('[internal] injection extension hosts require exactly one of spotId or pattern')\n  }\n  if (hasPattern && (!declaration.parameters || Object.keys(declaration.parameters).length === 0)) {\n    throw new Error('[internal] patterned injection extension hosts require named parameters')\n  }\n  return Object.freeze({ ...declaration })\n}\n\nexport function dataTableExtensionHost<\n  const TDeclaration extends Omit<DataTableExtensionHostDeclaration, 'family'>,\n>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration & { family: 'data-table' }> {\n  return Object.freeze({ family: 'data-table', ...declaration })\n}\n\nexport function crudFormExtensionHost<\n  const TDeclaration extends Omit<CrudFormExtensionHostDeclaration, 'family'>,\n>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration & { family: 'crud-form' }> {\n  return Object.freeze({ family: 'crud-form', ...declaration })\n}\n\nexport function componentExtensionHost<\n  const TDeclaration extends Omit<ComponentExtensionHostDeclaration, 'family'>,\n>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration & { family: 'component-handle' }> {\n  return Object.freeze({ family: 'component-handle', ...declaration })\n}\n\nexport type BoundExtensionSurface = {\n  key: string\n  suffix: string | null\n  capabilities: readonly ExtensionHostCapability[]\n  bound: boolean\n  phases?: readonly string[]\n  operations?: readonly string[]\n}\n\nexport const DATA_TABLE_EXTENSION_SURFACES = [\n  { key: 'header', suffix: 'header', capabilities: ['render-widget'], bound: true },\n  { key: 'footer', suffix: 'footer', capabilities: ['render-widget'], bound: true },\n  { key: 'toolbar', suffix: 'toolbar', capabilities: ['toolbar-widget'], bound: true },\n  { key: 'searchTrailing', suffix: 'search-trailing', capabilities: ['render-widget'], bound: true },\n  { key: 'columns', suffix: 'columns', capabilities: ['column-widget'], bound: true },\n  { key: 'rowActions', suffix: 'row-actions', capabilities: ['row-action'], bound: true },\n  { key: 'bulkActions', suffix: 'bulk-actions', capabilities: ['bulk-action'], bound: true },\n  { key: 'filters', suffix: 'filters', capabilities: ['filter-widget'], bound: true },\n  { key: 'replacement', suffix: null, capabilities: ['component-replacement'], bound: true },\n  { key: 'emptyState', suffix: 'empty-state', capabilities: ['render-widget'], bound: false },\n] as const satisfies readonly BoundExtensionSurface[]\n\nexport const CRUD_FORM_EXTENSION_SURFACES = [\n  { key: 'base', suffix: null, capabilities: ['render-widget', 'lifecycle-handler'], bound: true },\n  { key: 'header', suffix: 'header', capabilities: ['render-widget'], bound: true },\n  { key: 'fields', suffix: 'fields', capabilities: ['field-widget'], bound: true },\n  { key: 'replacement', suffix: null, capabilities: ['component-replacement'], bound: true },\n  { key: 'beforeFields', suffix: 'before-fields', capabilities: ['render-widget'], bound: false },\n  { key: 'afterFields', suffix: 'after-fields', capabilities: ['render-widget'], bound: false },\n  { key: 'footer', suffix: 'footer', capabilities: ['render-widget'], bound: false },\n  { key: 'sidebar', suffix: 'sidebar', capabilities: ['render-widget'], bound: false },\n  { key: 'group', suffix: 'group:{groupId}', capabilities: ['render-widget'], bound: false },\n  { key: 'fieldBefore', suffix: 'field:{fieldId}:before', capabilities: ['render-widget'], bound: false },\n  { key: 'fieldAfter', suffix: 'field:{fieldId}:after', capabilities: ['render-widget'], bound: false },\n] as const satisfies readonly BoundExtensionSurface[]\n\nexport const CRUD_FORM_LIFECYCLE_PHASES = [\n  'transformValidation',\n  'transformDisplayData',\n  'onBeforeNavigate',\n  'onAppEvent',\n  'onVisibilityChange',\n  'onBeforeDelete',\n  'onDelete',\n  'onAfterDelete',\n  'onDeleteError',\n  'onFieldChange',\n  'transformFormData',\n  'onBeforeSave',\n  'onSave',\n  'onAfterSave',\n] as const\n\nexport const CRUD_FORM_OPERATIONS = ['create', 'update', 'delete'] as const\n\nexport function dataTableExtensionSpotId(tableId: string, suffix?: string): string {\n  return suffix ? `data-table:${tableId}:${suffix}` : `data-table:${tableId}`\n}\n\nexport function crudFormExtensionSpotId(entityId: string, suffix?: string): string {\n  return suffix ? `crud-form:${entityId}:${suffix}` : `crud-form:${entityId}`\n}\n\nexport function extensionSpotChildId(spotId: string, suffix: string): string {\n  return `${spotId}:${suffix}`\n}\n\nexport function resolveExtensionPointPattern(\n  pattern: string,\n  parameters: Readonly<Record<string, string>>,\n): string {\n  return pattern.replace(/\\{([^}]+)\\}/g, (token, parameterName: string) => parameters[parameterName] ?? token)\n}\n\n/**\n * Portable, structural copy of the CLI provenance source reference\n * (`ModuleFactSourceRef` in `packages/cli/.../module-facts.ts`). Redefined here\n * \u2014 rather than imported \u2014 so `@open-mercato/shared` keeps zero dependency on\n * `@open-mercato/cli`. Field names are kept byte-identical so the two are\n * assignable across the package boundary.\n */\nexport type ModuleFactSourceRef = {\n  sourcePath: string\n  exportName?: string\n  line?: number\n}\n\n/** Portable, structural copy of the CLI provenance fact reference. */\nexport type ModuleFactRef = {\n  factSection: string\n  factKey: string\n}\n\nexport type ModuleExtensionContributionKind = ModuleExtensionContributionFact['kind']\n\nexport type ModuleExtensionActivationKind =\n  | 'crud-response-enricher'\n  | 'query-enricher'\n  | 'mutation-guard'\n  | 'api-interceptor-bridge'\n  | 'command-interceptor-bridge'\n  | 'widget-injection-consumer'\n  | 'component-extension-consumer'\n  | 'dashboard-host-consumer'\n\nexport type ModuleExtensionTargetRef = {\n  kind:\n    | 'module'\n    | 'entity'\n    | 'api-route'\n    | 'command'\n    | 'widget-spot'\n    | 'component'\n    | 'event'\n    | 'notification'\n    | 'wildcard'\n  id: string\n  moduleId?: string\n  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'\n}\n\nexport type ModuleExtensionActivation = {\n  id: string\n  kind: ModuleExtensionActivationKind\n  host: ModuleExtensionTargetRef\n  contributionKinds: ModuleExtensionContributionKind[]\n  phases?: string[]\n  /**\n   * Mutation operations the call site guards, when statically declared. A\n   * contribution declaring only other operations is not bound by this activation.\n   */\n  operations?: string[]\n  source: ModuleFactSourceRef\n  bridge?: ModuleFactRef\n}\n\nexport type ModuleExtensionResolution =\n  | 'bound'\n  | 'capability-only'\n  | 'optional-target-missing'\n  | 'wildcard'\n  | 'unresolved'\n\nexport type ModuleIncomingExtensionRef = {\n  contributionId: string\n  contributionKind: ModuleExtensionContributionKind\n  contributorModuleId: string\n  target: ModuleExtensionTargetRef\n  activationId?: string\n  resolution: ModuleExtensionResolution\n  source: ModuleFactSourceRef\n}\n\nexport type ModuleContributionResolution = {\n  contributionId: string\n  target: ModuleExtensionTargetRef\n  resolution: ModuleExtensionResolution\n  activationIds: string[]\n}\n\n/**\n * Additive, optional bidirectional-topology fields layered on top of the\n * existing extension-surface facts. Every field is optional so legacy consumers\n * and pre-existing generated output remain byte-compatible.\n */\nexport type ModuleExtensionSurfaceFactsAdditions = {\n  activations?: ModuleExtensionActivation[]\n  incoming?: ModuleIncomingExtensionRef[]\n  contributionResolutions?: ModuleContributionResolution[]\n}\n\nexport type ModuleExtensionSurfaceFacts = {\n  hosts: ModuleExtensionHostFact[]\n  contributions: ModuleExtensionContributionFact[]\n  unresolved: ModuleExtensionUnresolvedFact[]\n} & ModuleExtensionSurfaceFactsAdditions\n\nexport type ModuleExtensionHostFact = {\n  key: string\n  id: string\n  resolution: 'exact' | 'pattern' | 'framework' | 'fact-ref'\n  family: ExtensionHostFamily\n  ownerModule: string\n  capabilities: ExtensionHostCapability[]\n  phases?: string[]\n  operations?: string[]\n  contextContract?: string\n  dataContract?: string\n  scopeContract?: string\n  runtimeContract?: string\n  activation?: ExtensionHostActivation\n  bound: boolean\n  stability: 'frozen' | 'stable'\n  source:\n    | { kind: 'declaration'; path: string; symbol: string }\n    | { kind: 'fact-ref'; factSection: string; factKey: string }\n    | { kind: 'framework'; path: string; symbol: string }\n  aliases?: string[]\n  patternParameters?: Record<string, ExtensionPointPatternParameter>\n  fallbacks?: string[]\n}\n\nexport type ModuleExtensionTargetFact = {\n  id: string\n  resolution: 'exact' | 'pattern' | 'framework' | 'fact-ref' | 'optional-external' | 'unresolved'\n  factRef?: { factSection: string; factKey: string }\n  optionalOwnerPackage?: string\n}\n\nexport type ModuleExtensionContributionBase = {\n  id: string\n  targets: ModuleExtensionTargetFact[]\n  phases?: string[]\n  operations?: string[]\n  features?: string[]\n  scopeContract: string\n  activation?: ExtensionHostActivation\n  placement?: { relativeTo?: string; position?: 'first' | 'last' | 'before' | 'after'; priority?: number }\n  roundTripId?: string\n  override?: { domain: string; key: string; mode: 'disable-replace' | 'replace' | 'additive' }\n  source: { path: string; symbol?: string }\n}\n\nexport type ModuleExtensionContributionFact = ModuleExtensionContributionBase & (\n  | {\n      kind: 'widget'\n      details: {\n        payload: 'render' | 'headless' | 'menu' | 'dashboard' | 'notification' | 'integration'\n        registryKey: string\n        itemIds?: string[]\n        labelKeys?: string[]\n        contextContract?: string\n        dataContract?: string\n        executionGuard: 'host' | 'contribution' | 'both'\n      }\n    }\n  | {\n      kind: 'data-table'\n      details: {\n        payload: 'column' | 'row-action' | 'bulk-action' | 'filter' | 'toolbar' | 'render'\n        tableId: string\n        executionGuard: 'host' | 'contribution' | 'both'\n      }\n    }\n  | {\n      kind: 'crud-form'\n      details: {\n        payload: 'render' | 'field' | 'lifecycle-handler'\n        entityId: string\n        fieldIds?: string[]\n        groupIds?: string[]\n        requestHeaderCapability: boolean\n      }\n    }\n  | {\n      kind: 'component-override'\n      details: { handle: string; mode: 'replace' | 'wrapper' | 'props'; propsContract: string }\n    }\n  | {\n      kind: 'response-enricher'\n      details: {\n        targetEntity: string\n        surfaces: Array<'list' | 'detail'>\n        timeoutMs: number\n        fallback: 'none' | 'configured'\n        critical: boolean\n        cachePosture: 'record-pure' | 'rerun-on-list-cache-hit'\n        queryEngine?: {\n          engines: string[]\n          applyOn: Array<'list' | 'detail'>\n          activation: 'caller-opt-in'\n        }\n      }\n    }\n  | {\n      kind: 'api-interceptor'\n      details: {\n        route: string\n        methods: string[]\n        phases: Array<'before' | 'after'>\n        activation: 'crud-pipeline' | 'custom-route-bridge'\n        timeoutMs: number\n        failurePosture: 'fail-closed' | 'fallback'\n      }\n    }\n  | {\n      kind: 'command-interceptor'\n      details: {\n        targetCommand: string\n        phases: Array<'before-execute' | 'after-execute' | 'before-undo' | 'after-undo'>\n      }\n    }\n  | {\n      kind: 'mutation-guard'\n      details: {\n        entityId: string\n        operations: Array<'create' | 'update' | 'delete'>\n        capabilities: Array<'block' | 'rewrite' | 'after-success'>\n        optimisticLock: 'preserved'\n      }\n    }\n  | {\n      kind: 'entity-extension'\n      details: {\n        hostEntityId: string\n        extensionEntityId: string\n        linkId: string\n        scopeContract: string\n        orphanContract: string\n      }\n    }\n  | {\n      kind: 'subscriber'\n      details: {\n        event: string\n        subscriberId: string\n        persistent: boolean\n        sync: boolean\n        priority?: number\n      }\n    }\n  | {\n      kind: 'browser-reaction'\n      details: {\n        transports: Array<'client' | 'portal' | 'notification-effect'>\n        hooks: string[]\n        audienceScopeContract: string\n        maxPayloadBytes?: number\n        dedupWindowMs?: number\n        /**\n         * Statically declared handler id. Runtime keys `notifications.handlers`\n         * overrides by it, so it is absent when the module declares no id (such a\n         * handler cannot be overridden).\n         */\n        overrideKey?: string\n      }\n    }\n  | {\n      kind: 'specialized-registry'\n      details: {\n        registry: 'notification' | 'integration' | 'search' | 'vector' | 'ai' | 'payment' | 'shipping' | 'currency' | 'workflow'\n        registryId: string\n        specialistRoute: string\n      }\n    }\n  | {\n      kind: 'module-override'\n      details: {\n        domain: string\n        key: string\n        mode: 'disable-replace' | 'replace' | 'additive'\n      }\n    }\n)\n\nexport type ModuleExtensionUnresolvedFact = {\n  key: string\n  source: { path: string; symbol?: string }\n  reason:\n    | 'unclassified-binding'\n    | 'unbound-declaration'\n    | 'dynamic-without-pattern'\n    | 'unresolved-first-party-target'\n}\n"],
-  "mappings": "AAgHO,SAAS,4BAGd,aAAiG;AACjG,SAAO,OAAO,OAAO;AAAA,IACnB,GAAG;AAAA,IACH,OAAO,OAAO,OAAO,EAAE,GAAG,YAAY,MAAM,CAAC;AAAA,EAC/C,CAAC;AACH;AAEO,SAAS,uBACd,aACwB;AACxB,QAAM,aAAa,OAAO,YAAY,WAAW,YAAY,YAAY,OAAO,SAAS;AACzF,QAAM,aAAa,OAAO,YAAY,YAAY,YAAY,YAAY,QAAQ,SAAS;AAC3F,MAAI,eAAe,YAAY;AAC7B,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AACA,MAAI,eAAe,CAAC,YAAY,cAAc,OAAO,KAAK,YAAY,UAAU,EAAE,WAAW,IAAI;AAC/F,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AACA,SAAO,OAAO,OAAO,EAAE,GAAG,YAAY,CAAC;AACzC;AAEO,SAAS,uBAGd,aACmD;AACnD,SAAO,OAAO,OAAO,EAAE,QAAQ,cAAc,GAAG,YAAY,CAAC;AAC/D;AAEO,SAAS,sBAGd,aACkD;AAClD,SAAO,OAAO,OAAO,EAAE,QAAQ,aAAa,GAAG,YAAY,CAAC;AAC9D;AAEO,SAAS,uBAGd,aACyD;AACzD,SAAO,OAAO,OAAO,EAAE,QAAQ,oBAAoB,GAAG,YAAY,CAAC;AACrE;AAWO,MAAM,gCAAgC;AAAA,EAC3C,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAChF,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAChF,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,gBAAgB,GAAG,OAAO,KAAK;AAAA,EACnF,EAAE,KAAK,kBAAkB,QAAQ,mBAAmB,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EACjG,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAClF,EAAE,KAAK,cAAc,QAAQ,eAAe,cAAc,CAAC,YAAY,GAAG,OAAO,KAAK;AAAA,EACtF,EAAE,KAAK,eAAe,QAAQ,gBAAgB,cAAc,CAAC,aAAa,GAAG,OAAO,KAAK;AAAA,EACzF,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAClF,EAAE,KAAK,eAAe,QAAQ,MAAM,cAAc,CAAC,uBAAuB,GAAG,OAAO,KAAK;AAAA,EACzF,EAAE,KAAK,cAAc,QAAQ,eAAe,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAC5F;AAEO,MAAM,+BAA+B;AAAA,EAC1C,EAAE,KAAK,QAAQ,QAAQ,MAAM,cAAc,CAAC,iBAAiB,mBAAmB,GAAG,OAAO,KAAK;AAAA,EAC/F,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAChF,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,cAAc,GAAG,OAAO,KAAK;AAAA,EAC/E,EAAE,KAAK,eAAe,QAAQ,MAAM,cAAc,CAAC,uBAAuB,GAAG,OAAO,KAAK;AAAA,EACzF,EAAE,KAAK,gBAAgB,QAAQ,iBAAiB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EAC9F,EAAE,KAAK,eAAe,QAAQ,gBAAgB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EAC5F,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACjF,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACnF,EAAE,KAAK,SAAS,QAAQ,mBAAmB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACzF,EAAE,KAAK,eAAe,QAAQ,0BAA0B,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACtG,EAAE,KAAK,cAAc,QAAQ,yBAAyB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AACtG;AAEO,MAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,uBAAuB,CAAC,UAAU,UAAU,QAAQ;AAE1D,SAAS,yBAAyB,SAAiB,QAAyB;AACjF,SAAO,SAAS,cAAc,OAAO,IAAI,MAAM,KAAK,cAAc,OAAO;AAC3E;AAEO,SAAS,wBAAwB,UAAkB,QAAyB;AACjF,SAAO,SAAS,aAAa,QAAQ,IAAI,MAAM,KAAK,aAAa,QAAQ;AAC3E;AAEO,SAAS,qBAAqB,QAAgB,QAAwB;AAC3E,SAAO,GAAG,MAAM,IAAI,MAAM;AAC5B;AAEO,SAAS,6BACd,SACA,YACQ;AACR,SAAO,QAAQ,QAAQ,gBAAgB,CAAC,OAAO,kBAA0B,WAAW,aAAa,KAAK,KAAK;AAC7G;",
-  "names": []
-}

package/dist/security/featurePolicy.js

@@ -1,62 +0,0 @@
-import { hasAllFeatures as matchesAllFeatures } from "./features.js";
-import {
-  filterGrantsByEnabledModules,
-  getConcreteFeatureIds,
-  getEnabledModuleIds,
-  getOwningModuleId,
-  hasEnabledModulesRegistry
-} from "./enabledModulesRegistry.js";
-import { composeAclFeatureOverrides } from "../modules/overrides.js";
-function getRemovedAclFeatureIds() {
-  return Object.entries(composeAclFeatureOverrides()).filter(([, override]) => override === null).map(([featureId]) => featureId);
-}
-function isAclFeatureRemoved(featureId) {
-  return composeAclFeatureOverrides()[featureId] === null;
-}
-function isFeatureEnabled(featureId) {
-  if (!hasEnabledModulesRegistry()) return true;
-  const enabledModuleIds = getEnabledModuleIds();
-  return enabledModuleIds.includes(getOwningModuleId(featureId));
-}
-function authorizeFeatures(required, subject) {
-  if (required.length === 0) return true;
-  if (subject.scopeAllowed === false) return false;
-  if (required.some((featureId) => isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId))) {
-    return false;
-  }
-  if (subject.unrestricted === true) return true;
-  return matchesAllFeatures(
-    filterGrantsByEnabledModules(subject.grantedFeatures),
-    required
-  );
-}
-function resolveEffectiveFeatures(grantedFeatures) {
-  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures).filter((featureId) => !isAclFeatureRemoved(featureId));
-  if (!hasEnabledModulesRegistry()) {
-    return filteredGrants.filter((featureId, index, features) => featureId !== "*" && !featureId.endsWith(".*") && features.indexOf(featureId) === index);
-  }
-  const result = [];
-  const seen = /* @__PURE__ */ new Set();
-  const addFeature = (featureId) => {
-    if (seen.has(featureId) || isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)) {
-      return;
-    }
-    seen.add(featureId);
-    result.push(featureId);
-  };
-  for (const featureId of getConcreteFeatureIds()) {
-    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId);
-  }
-  for (const featureId of filteredGrants) {
-    if (featureId === "*" || featureId.endsWith(".*")) continue;
-    addFeature(featureId);
-  }
-  return result;
-}
-export {
-  authorizeFeatures,
-  getRemovedAclFeatureIds,
-  isAclFeatureRemoved,
-  resolveEffectiveFeatures
-};
-//# sourceMappingURL=featurePolicy.js.map

package/dist/security/featurePolicy.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../src/security/featurePolicy.ts"],
-  "sourcesContent": ["import { hasAllFeatures as matchesAllFeatures } from './features'\nimport {\n  filterGrantsByEnabledModules,\n  getConcreteFeatureIds,\n  getEnabledModuleIds,\n  getOwningModuleId,\n  hasEnabledModulesRegistry,\n} from './enabledModulesRegistry'\nimport { composeAclFeatureOverrides } from '../modules/overrides'\n\nexport type FeaturePolicySubject = {\n  grantedFeatures: readonly string[]\n  unrestricted?: boolean\n  scopeAllowed?: boolean\n}\n\nexport function getRemovedAclFeatureIds(): string[] {\n  return Object.entries(composeAclFeatureOverrides())\n    .filter(([, override]) => override === null)\n    .map(([featureId]) => featureId)\n}\n\nexport function isAclFeatureRemoved(featureId: string): boolean {\n  return composeAclFeatureOverrides()[featureId] === null\n}\n\nfunction isFeatureEnabled(featureId: string): boolean {\n  if (!hasEnabledModulesRegistry()) return true\n  const enabledModuleIds = getEnabledModuleIds()\n  return enabledModuleIds.includes(getOwningModuleId(featureId))\n}\n\nexport function authorizeFeatures(\n  required: readonly string[],\n  subject: FeaturePolicySubject,\n): boolean {\n  if (required.length === 0) return true\n  if (subject.scopeAllowed === false) return false\n  if (required.some((featureId) => (\n    isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)\n  ))) {\n    return false\n  }\n  if (subject.unrestricted === true) return true\n  return matchesAllFeatures(\n    filterGrantsByEnabledModules(subject.grantedFeatures),\n    required,\n  )\n}\n\nexport function resolveEffectiveFeatures(\n  grantedFeatures: readonly string[],\n): string[] {\n  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures)\n    .filter((featureId) => !isAclFeatureRemoved(featureId))\n\n  if (!hasEnabledModulesRegistry()) {\n    return filteredGrants.filter((featureId, index, features) => (\n      featureId !== '*'\n      && !featureId.endsWith('.*')\n      && features.indexOf(featureId) === index\n    ))\n  }\n\n  const result: string[] = []\n  const seen = new Set<string>()\n  const addFeature = (featureId: string) => {\n    if (\n      seen.has(featureId)\n      || isAclFeatureRemoved(featureId)\n      || !isFeatureEnabled(featureId)\n    ) {\n      return\n    }\n    seen.add(featureId)\n    result.push(featureId)\n  }\n\n  for (const featureId of getConcreteFeatureIds()) {\n    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId)\n  }\n\n  for (const featureId of filteredGrants) {\n    if (featureId === '*' || featureId.endsWith('.*')) continue\n    addFeature(featureId)\n  }\n\n  return result\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB,0BAA0B;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAQpC,SAAS,0BAAoC;AAClD,SAAO,OAAO,QAAQ,2BAA2B,CAAC,EAC/C,OAAO,CAAC,CAAC,EAAE,QAAQ,MAAM,aAAa,IAAI,EAC1C,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACnC;AAEO,SAAS,oBAAoB,WAA4B;AAC9D,SAAO,2BAA2B,EAAE,SAAS,MAAM;AACrD;AAEA,SAAS,iBAAiB,WAA4B;AACpD,MAAI,CAAC,0BAA0B,EAAG,QAAO;AACzC,QAAM,mBAAmB,oBAAoB;AAC7C,SAAO,iBAAiB,SAAS,kBAAkB,SAAS,CAAC;AAC/D;AAEO,SAAS,kBACd,UACA,SACS;AACT,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,MAAI,QAAQ,iBAAiB,MAAO,QAAO;AAC3C,MAAI,SAAS,KAAK,CAAC,cACjB,oBAAoB,SAAS,KAAK,CAAC,iBAAiB,SAAS,CAC9D,GAAG;AACF,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,iBAAiB,KAAM,QAAO;AAC1C,SAAO;AAAA,IACL,6BAA6B,QAAQ,eAAe;AAAA,IACpD;AAAA,EACF;AACF;AAEO,SAAS,yBACd,iBACU;AACV,QAAM,iBAAiB,6BAA6B,eAAe,EAChE,OAAO,CAAC,cAAc,CAAC,oBAAoB,SAAS,CAAC;AAExD,MAAI,CAAC,0BAA0B,GAAG;AAChC,WAAO,eAAe,OAAO,CAAC,WAAW,OAAO,aAC9C,cAAc,OACX,CAAC,UAAU,SAAS,IAAI,KACxB,SAAS,QAAQ,SAAS,MAAM,KACpC;AAAA,EACH;AAEA,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,aAAa,CAAC,cAAsB;AACxC,QACE,KAAK,IAAI,SAAS,KACf,oBAAoB,SAAS,KAC7B,CAAC,iBAAiB,SAAS,GAC9B;AACA;AAAA,IACF;AACA,SAAK,IAAI,SAAS;AAClB,WAAO,KAAK,SAAS;AAAA,EACvB;AAEA,aAAW,aAAa,sBAAsB,GAAG;AAC/C,QAAI,mBAAmB,gBAAgB,CAAC,SAAS,CAAC,EAAG,YAAW,SAAS;AAAA,EAC3E;AAEA,aAAW,aAAa,gBAAgB;AACtC,QAAI,cAAc,OAAO,UAAU,SAAS,IAAI,EAAG;AACnD,eAAW,SAAS;AAAA,EACtB;AAEA,SAAO;AACT;",
-  "names": []
-}

package/scripts/versionSource.cjs

@@ -1,65 +0,0 @@
-// Pure source emitter for the build-time replacement of src/lib/version.ts.
-// Kept side-effect free, and CommonJS so both build.mjs and the Jest suite can load it.
-
-const { Project, QuoteKind, ScriptKind, StructureKind, VariableDeclarationKind } = require('ts-morph')
-
-const VIRTUAL_FILE_NAME = 'version.ts'
-const BANNER = '// Build-time generated version\n'
-
-let sharedProject = null
-
-function getProject() {
-  if (!sharedProject) {
-    sharedProject = new Project({
-      useInMemoryFileSystem: true,
-      manipulationSettings: { quoteKind: QuoteKind.Single },
-    })
-  }
-
-  return sharedProject
-}
-
-function assertNoSyntacticDiagnostics(project, sourceFile) {
-  const diagnostics = project.getProgram().getSyntacticDiagnostics(sourceFile)
-  if (diagnostics.length === 0) return
-
-  const details = diagnostics
-    .map((diagnostic) => `  line ${diagnostic.getLineNumber() ?? 0}: ${diagnostic.getMessageText()}`)
-    .join('\n')
-  throw new Error(`[internal] Generated ${VIRTUAL_FILE_NAME} is not syntactically valid:\n${details}`)
-}
-
-function normalizeSourceText(text) {
-  const normalized = text.replace(/\r\n/g, '\n')
-  return normalized.endsWith('\n') ? normalized : `${normalized}\n`
-}
-
-function buildVersionSource(version) {
-  const project = getProject()
-  const sourceFile = project.createSourceFile(VIRTUAL_FILE_NAME, '', {
-    overwrite: true,
-    scriptKind: ScriptKind.TS,
-  })
-
-  sourceFile.addVariableStatement({
-    kind: StructureKind.VariableStatement,
-    isExported: true,
-    declarationKind: VariableDeclarationKind.Const,
-    declarations: [{ name: 'APP_VERSION', initializer: (writer) => writer.quote(String(version)) }],
-  })
-
-  sourceFile.addVariableStatement({
-    kind: StructureKind.VariableStatement,
-    isExported: true,
-    declarationKind: VariableDeclarationKind.Const,
-    declarations: [{ name: 'appVersion', initializer: 'APP_VERSION' }],
-  })
-
-  sourceFile.formatText({ indentSize: 2, convertTabsToSpaces: true })
-  sourceFile.insertText(0, BANNER)
-  assertNoSyntacticDiagnostics(project, sourceFile)
-
-  return normalizeSourceText(sourceFile.getFullText())
-}
-
-module.exports = { buildVersionSource }

package/src/lib/__tests__/versionSource.test.ts

@@ -1,46 +0,0 @@
-import { Project, SyntaxKind } from 'ts-morph'
-import { buildVersionSource } from '../../../scripts/versionSource.cjs'
-
-function parse(source: string) {
-  const project = new Project({ useInMemoryFileSystem: true })
-  const sourceFile = project.createSourceFile('version.ts', source, { overwrite: true })
-  return { project, sourceFile }
-}
-
-function exportedLiteral(source: string, name: string): string {
-  const { sourceFile } = parse(source)
-  return sourceFile.getVariableDeclarationOrThrow(name).getInitializerOrThrow().getText()
-}
-
-describe('buildVersionSource', () => {
-  it('exports both APP_VERSION and appVersion', () => {
-    const { sourceFile } = parse(buildVersionSource('1.2.3'))
-    expect([...sourceFile.getExportedDeclarations().keys()].sort()).toEqual(['APP_VERSION', 'appVersion'])
-  })
-
-  it('writes the supplied version as the APP_VERSION literal', () => {
-    expect(exportedLiteral(buildVersionSource('1.2.3'), 'APP_VERSION')).toBe("'1.2.3'")
-  })
-
-  it('aliases appVersion to APP_VERSION rather than repeating the literal', () => {
-    expect(exportedLiteral(buildVersionSource('1.2.3'), 'appVersion')).toBe('APP_VERSION')
-  })
-
-  it('escapes a version string that would otherwise break the literal', () => {
-    const source = buildVersionSource("0.0.0-dev'; drop")
-    const { sourceFile } = parse(source)
-    const literal = sourceFile
-      .getVariableDeclarationOrThrow('APP_VERSION')
-      .getInitializerIfKindOrThrow(SyntaxKind.StringLiteral)
-    expect(literal.getLiteralValue()).toBe("0.0.0-dev'; drop")
-  })
-
-  it('emits zero syntactic diagnostics', () => {
-    const { project, sourceFile } = parse(buildVersionSource('1.2.3'))
-    expect(project.getProgram().getSyntacticDiagnostics(sourceFile)).toEqual([])
-  })
-
-  it('keeps the build-time banner comment', () => {
-    expect(buildVersionSource('1.2.3').startsWith('// Build-time generated version\n')).toBe(true)
-  })
-})

package/src/lib/ai/__tests__/llm-provider-contract.test.ts

@@ -1,59 +0,0 @@
-import type { EnvLookup, LlmProvider, LlmCreateModelOptions } from '../llm-provider'
-
-function makeBaseProvider(overrides: Partial<LlmProvider> = {}): LlmProvider {
-  const id = overrides.id ?? 'contract-provider'
-  const envKeys = overrides.envKeys ?? [`${id.toUpperCase()}_API_KEY`]
-  const base: LlmProvider = {
-    id,
-    name: `Contract Provider ${id}`,
-    envKeys,
-    defaultModel: 'contract-model',
-    defaultModels: [{ id: 'contract-model', name: 'Contract Model', contextWindow: 8192 }],
-    isConfigured(env?: EnvLookup): boolean {
-      const lookup = env ?? process.env
-      return envKeys.some((key) => {
-        const value = lookup[key]
-        return typeof value === 'string' && value.trim().length > 0
-      })
-    },
-    resolveApiKey(): string | null {
-      return null
-    },
-    getConfiguredEnvKey(): string {
-      return envKeys[0]
-    },
-    createModel(options: LlmCreateModelOptions) {
-      return { __kind: 'contract-model', modelId: options.modelId }
-    },
-  }
-  return { ...base, ...overrides }
-}
-
-describe('LlmProvider contract — moderation/safety-identifier additive members', () => {
-  it('treats mapEndUserIdentifier and supportsInputModeration as optional (legacy adapters)', () => {
-    const provider = makeBaseProvider()
-    expect(provider.mapEndUserIdentifier).toBeUndefined()
-    expect(provider.supportsInputModeration).toBeUndefined()
-  })
-
-  it('accepts an optional endUserIdentifier on createModel options without changing behavior', () => {
-    const provider = makeBaseProvider()
-    const withIdentifier: LlmCreateModelOptions = {
-      modelId: 'contract-model',
-      apiKey: 'sk-test',
-      endUserIdentifier: 'hashed-identifier',
-    }
-    expect(provider.createModel(withIdentifier)).toEqual({ __kind: 'contract-model', modelId: 'contract-model' })
-  })
-
-  it('exposes a providerOptions fragment when mapEndUserIdentifier is implemented', () => {
-    const provider = makeBaseProvider({
-      mapEndUserIdentifier(identifier: string) {
-        return { contract: { user_id: identifier } }
-      },
-      supportsInputModeration: true,
-    })
-    expect(provider.supportsInputModeration).toBe(true)
-    expect(provider.mapEndUserIdentifier?.('abc123')).toEqual({ contract: { user_id: 'abc123' } })
-  })
-})

package/src/lib/ai/__tests__/safety-identifier.test.ts

@@ -1,71 +0,0 @@
-import { computeEndUserIdentifier, deriveAiSafetyIdentifierSecret } from '../safety-identifier'
-
-const BASE_SECRET = 'unit-test-base-secret'
-const HEX_64 = /^[0-9a-f]{64}$/
-
-describe('safety-identifier', () => {
-  describe('deriveAiSafetyIdentifierSecret', () => {
-    it('is deterministic and memoized for a given base secret', () => {
-      const first = deriveAiSafetyIdentifierSecret(BASE_SECRET)
-      const second = deriveAiSafetyIdentifierSecret(BASE_SECRET)
-      expect(first).toBe(second)
-      expect(first).toMatch(HEX_64)
-    })
-
-    it('produces a different key for a different base secret', () => {
-      expect(deriveAiSafetyIdentifierSecret(BASE_SECRET)).not.toBe(
-        deriveAiSafetyIdentifierSecret('other-base-secret'),
-      )
-    })
-
-    it('throws when no base secret is available', () => {
-      const previous = process.env.JWT_SECRET
-      delete process.env.JWT_SECRET
-      try {
-        expect(() => deriveAiSafetyIdentifierSecret()).toThrow(/JWT_SECRET/)
-      } finally {
-        if (previous !== undefined) process.env.JWT_SECRET = previous
-      }
-    })
-  })
-
-  describe('computeEndUserIdentifier', () => {
-    it('is stable for the same (tenant, user) pair', () => {
-      const a = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
-      const b = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
-      expect(a).toBe(b)
-      expect(a).toMatch(HEX_64)
-    })
-
-    it('separates the same user across tenants (tenant-salted)', () => {
-      const t1 = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
-      const t2 = computeEndUserIdentifier('tenant-2', 'user-1', { baseSecret: BASE_SECRET })
-      expect(t1).not.toBe(t2)
-    })
-
-    it('separates different users within the same tenant', () => {
-      const u1 = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
-      const u2 = computeEndUserIdentifier('tenant-1', 'user-2', { baseSecret: BASE_SECRET })
-      expect(u1).not.toBe(u2)
-    })
-
-    it('never leaks the raw tenant or user id', () => {
-      const id = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
-      expect(id).not.toContain('tenant-1')
-      expect(id).not.toContain('user-1')
-    })
-
-    it('treats a null tenant as an empty salt without throwing', () => {
-      const withNull = computeEndUserIdentifier(null, 'user-1', { baseSecret: BASE_SECRET })
-      const withEmpty = computeEndUserIdentifier('', 'user-1', { baseSecret: BASE_SECRET })
-      expect(withNull).toMatch(HEX_64)
-      expect(withNull).toBe(withEmpty)
-    })
-
-    it('throws when userId is empty', () => {
-      expect(() => computeEndUserIdentifier('tenant-1', '   ', { baseSecret: BASE_SECRET })).toThrow(
-        /userId/,
-      )
-    })
-  })
-})