@plumix/core 0.1.0

package/dist/plugin/validation/meta-box-fields.js

@@ -0,0 +1,52 @@
+import { PluginContextError } from "../errors.js";
+// Must match the RPC input-schema regex for meta keys — any key that
+// doesn't match is dead code (the write path rejects it), so catch it
+// at registration instead of letting the admin discover it later.
+export const META_FIELD_KEY_RE = /^[a-zA-Z0-9_:-]+$/;
+// Reserved namespace for core-owned meta keys (e.g. revision snapshot
+// envelopes at `__plumix_snapshot`). Rejected at registration so a
+// plugin can never shadow a future core key — the matching write
+// path would otherwise have to enforce this on every entry.update.
+export const META_RESERVED_KEY_PREFIX = "__plumix_";
+// Cap on fields per box — keeps the admin's per-request payload
+// bounded and signals a modeling problem if a plugin wants to pile
+// hundreds of fields into one card. Matches the RPC input-schema cap
+// on the meta/upsert request surface.
+export const MAX_FIELDS_PER_META_BOX = 200;
+export function assertMetaBoxFields(kind, id, fields) {
+    if (fields.length > MAX_FIELDS_PER_META_BOX) {
+        throw PluginContextError.metaBoxTooManyFields({
+            kind,
+            id,
+            count: fields.length,
+            maxFields: MAX_FIELDS_PER_META_BOX,
+        });
+    }
+    const seen = new Set();
+    for (const field of fields) {
+        if (!META_FIELD_KEY_RE.test(field.key)) {
+            throw PluginContextError.metaBoxFieldInvalidKey({
+                kind,
+                id,
+                fieldKey: field.key,
+                pattern: META_FIELD_KEY_RE.source,
+            });
+        }
+        if (field.key.startsWith(META_RESERVED_KEY_PREFIX)) {
+            throw PluginContextError.metaBoxFieldReservedKey({
+                kind,
+                id,
+                fieldKey: field.key,
+            });
+        }
+        if (seen.has(field.key)) {
+            throw PluginContextError.metaBoxFieldDuplicateKey({
+                kind,
+                id,
+                fieldKey: field.key,
+            });
+        }
+        seen.add(field.key);
+    }
+}
+//# sourceMappingURL=meta-box-fields.js.map

package/dist/plugin/validation/meta-box-fields.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-box-fields.js","sourceRoot":"","sources":["../../../src/plugin/validation/meta-box-fields.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,qEAAqE;AACrE,sEAAsE;AACtE,kEAAkE;AAClE,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAErD,sEAAsE;AACtE,mEAAmE;AACnE,iEAAiE;AACjE,mEAAmE;AACnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAEpD,gEAAgE;AAChE,mEAAmE;AACnE,qEAAqE;AACrE,sCAAsC;AACtC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,MAAM,UAAU,mBAAmB,CACjC,IAAY,EACZ,EAAU,EACV,MAA+B;IAE/B,IAAI,MAAM,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC5C,MAAM,kBAAkB,CAAC,oBAAoB,CAAC;YAC5C,IAAI;YACJ,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,SAAS,EAAE,uBAAuB;SACnC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACvC,MAAM,kBAAkB,CAAC,sBAAsB,CAAC;gBAC9C,IAAI;gBACJ,EAAE;gBACF,QAAQ,EAAE,KAAK,CAAC,GAAG;gBACnB,OAAO,EAAE,iBAAiB,CAAC,MAAM;aAClC,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;YACnD,MAAM,kBAAkB,CAAC,uBAAuB,CAAC;gBAC/C,IAAI;gBACJ,EAAE;gBACF,QAAQ,EAAE,KAAK,CAAC,GAAG;aACpB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,kBAAkB,CAAC,wBAAwB,CAAC;gBAChD,IAAI;gBACJ,EAAE;gBACF,QAAQ,EAAE,KAAK,CAAC,GAAG;aACpB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/plugin/validation/paths.d.ts

@@ -0,0 +1,4 @@
+export declare function assertValidAdminPagePath(pluginId: string, path: string): void;
+export declare function assertValidRestResourcePath(pluginId: string, path: string): void;
+export declare function assertValidPluginRoutePath(pluginId: string, path: string): void;
+//# sourceMappingURL=paths.d.ts.map

package/dist/plugin/validation/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../src/plugin/validation/paths.ts"],"names":[],"mappings":"AA0BA,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAK7E;AAED,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,IAAI,CAIN;AAED,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,GACX,IAAI,CAaN"}

package/dist/plugin/validation/paths.js

@@ -0,0 +1,44 @@
+import { PluginContextError } from "../errors.js";
+// Shared `/`-anchored path validation: must start with /, no `//` or
+// `..` traversal, no `?` / `#` (we match on pathname only). The
+// admin-page and plugin-route validators diverge after this on how
+// they handle `*`, so the wildcard rule stays at each call site.
+function assertValidPathPrefix(pluginId, path, kind) {
+    if (!path.startsWith("/")) {
+        throw PluginContextError.pathMustStartWithSlash({ pluginId, kind, path });
+    }
+    if (path.includes("//") || path.includes("..")) {
+        throw PluginContextError.pathContainsTraversal({ pluginId, kind, path });
+    }
+    if (path.includes("?") || path.includes("#")) {
+        throw PluginContextError.pathContainsQueryOrFragment({
+            pluginId,
+            kind,
+            path,
+        });
+    }
+}
+export function assertValidAdminPagePath(pluginId, path) {
+    assertValidPathPrefix(pluginId, path, "admin page");
+    if (path.includes("*")) {
+        throw PluginContextError.adminPagePathContainsWildcard({ pluginId, path });
+    }
+}
+export function assertValidRestResourcePath(pluginId, path) {
+    // REST resources use oRPC `{param}` segments (no `*` wildcards); the prefix
+    // rules (leading slash, no traversal/query) are the same.
+    assertValidPathPrefix(pluginId, path, "REST resource");
+}
+export function assertValidPluginRoutePath(pluginId, path) {
+    assertValidPathPrefix(pluginId, path, "route");
+    // Allow exactly `/*` at the very end. Any other `*` is ambiguous.
+    const starIndex = path.indexOf("*");
+    if (starIndex !== -1 && starIndex !== path.length - 1) {
+        throw PluginContextError.routePathWildcardNotAtEnd({ pluginId, path });
+    }
+    if (path.endsWith("*") &&
+        (path.length < 2 || path[path.length - 2] !== "/")) {
+        throw PluginContextError.routePathWildcardNotAfterSlash({ pluginId, path });
+    }
+}
+//# sourceMappingURL=paths.js.map

package/dist/plugin/validation/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../../src/plugin/validation/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,qEAAqE;AACrE,gEAAgE;AAChE,mEAAmE;AACnE,iEAAiE;AACjE,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,IAAY,EACZ,IAAY;IAEZ,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,kBAAkB,CAAC,qBAAqB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,kBAAkB,CAAC,2BAA2B,CAAC;YACnD,QAAQ;YACR,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAgB,EAAE,IAAY;IACrE,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,kBAAkB,CAAC,6BAA6B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,QAAgB,EAChB,IAAY;IAEZ,4EAA4E;IAC5E,0DAA0D;IAC1D,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,QAAgB,EAChB,IAAY;IAEZ,qBAAqB,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/C,kEAAkE;IAClE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,kBAAkB,CAAC,yBAAyB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IACE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAClB,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,EAClD,CAAC;QACD,MAAM,kBAAkB,CAAC,8BAA8B,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC"}

package/dist/plugin/validation/scheduled-task.d.ts

@@ -0,0 +1,3 @@
+import type { ScheduledTask } from "../manifest.js";
+export declare function assertValidScheduledTask(pluginId: string, task: ScheduledTask): void;
+//# sourceMappingURL=scheduled-task.d.ts.map

package/dist/plugin/validation/scheduled-task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-task.d.ts","sourceRoot":"","sources":["../../../src/plugin/validation/scheduled-task.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAKpD,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,aAAa,GAClB,IAAI,CAUN"}

package/dist/plugin/validation/scheduled-task.js

@@ -0,0 +1,14 @@
+import { PluginContextError } from "../errors.js";
+const SCHEDULED_TASK_ID_RE = /^[a-z0-9][a-z0-9_/-]{0,63}$/i;
+export function assertValidScheduledTask(pluginId, task) {
+    if (!SCHEDULED_TASK_ID_RE.test(task.id)) {
+        throw PluginContextError.invalidScheduledTaskId({ pluginId, id: task.id });
+    }
+    if (typeof task.handler !== "function") {
+        throw PluginContextError.scheduledTaskHandlerMissing({
+            pluginId,
+            id: task.id,
+        });
+    }
+}
+//# sourceMappingURL=scheduled-task.js.map

package/dist/plugin/validation/scheduled-task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-task.js","sourceRoot":"","sources":["../../../src/plugin/validation/scheduled-task.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAE5D,MAAM,UAAU,wBAAwB,CACtC,QAAgB,EAChB,IAAmB;IAEnB,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,kBAAkB,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,kBAAkB,CAAC,2BAA2B,CAAC;YACnD,QAAQ;YACR,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/rest/base.d.ts

@@ -0,0 +1,27 @@
+import type { AppContext } from "../context/app.js";
+/**
+ * The REST request context: the resolved principal context plus whether it came
+ * from a real bearer token (vs the anonymous public principal). Plugin resource
+ * auth gates read `restAuthenticated` to enforce `authenticated`.
+ */
+export interface RestContext extends AppContext {
+    readonly restAuthenticated: boolean;
+}
+export declare const base: import("@orpc/server").Builder<RestContext & Record<never, never>, RestContext, import("@orpc/server").Schema<unknown, unknown>, import("@orpc/server").Schema<unknown, unknown>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=base.d.ts.map

package/dist/rest/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../../src/rest/base.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD;;;;GAIG;AACH,MAAM,WAAW,WAAY,SAAQ,UAAU;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,eAAO,MAAM,IAAI;;;;;;;;;;;;;;;;yBAAiD,CAAC"}

package/dist/rest/base.js

@@ -0,0 +1,4 @@
+import { os } from "@orpc/server";
+import { REST_ERRORS } from "./errors.js";
+export const base = os.$context().errors(REST_ERRORS);
+//# sourceMappingURL=base.js.map

package/dist/rest/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../src/rest/base.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,cAAc,CAAC;AAGlC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAW1C,MAAM,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC"}

package/dist/rest/build-handler.d.ts

@@ -0,0 +1,11 @@
+import type { ApiCorsConfig } from "../config.js";
+import type { AppContext } from "../context/app.js";
+import type { PluginRegistry } from "../plugin/manifest.js";
+/**
+ * Dispatches a request against the REST surface. The dispatcher branch hands
+ * over once `config.api` is enabled, so this never runs on a disabled or
+ * cold-start path.
+ */
+export type RestDispatch = (ctx: AppContext) => Promise<Response>;
+export declare function buildRestDispatcher(registry: PluginRegistry, cors?: ApiCorsConfig): RestDispatch;
+//# sourceMappingURL=build-handler.d.ts.map

package/dist/rest/build-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-handler.d.ts","sourceRoot":"","sources":["../../src/rest/build-handler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAoB5D;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAKlE,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,IAAI,CAAC,EAAE,aAAa,GACnB,YAAY,CAoDd"}

package/dist/rest/build-handler.js

@@ -0,0 +1,53 @@
+import { OpenAPIHandler } from "@orpc/openapi/fetch";
+import { jsonResponse, notFound, unauthorized, withHeaders, } from "../runtime/http.js";
+import { isOriginDependent, preflightResponse, resolveAllowedOrigin, withCors, } from "./cors.js";
+import { generateOpenApiDocument } from "./openapi.js";
+import { buildPluginRestRouter } from "./plugin-resources.js";
+import { resolveRestPrincipal } from "./principal.js";
+import { restRouter } from "./router.js";
+const API_V1_PREFIX = "/_plumix/api/v1";
+const SPEC_PATH = `${API_V1_PREFIX}/openapi.json`;
+export function buildRestDispatcher(registry, cors) {
+    // Core resources + plugin-contributed resources share one router, so plugin
+    // endpoints route and appear in the spec automatically.
+    const router = {
+        ...restRouter,
+        ...buildPluginRestRouter(registry.restResources),
+    };
+    const handler = new OpenAPIHandler(router);
+    const varyByOrigin = isOriginDependent(cors);
+    // Generated once per isolate, on first request for the spec.
+    let spec;
+    return async (ctx) => {
+        const url = new URL(ctx.request.url);
+        const allowOrigin = resolveAllowedOrigin(cors, ctx.request.headers.get("origin"));
+        if (ctx.request.method === "OPTIONS") {
+            return preflightResponse(ctx.request, allowOrigin);
+        }
+        if (url.pathname === SPEC_PATH) {
+            const doc = jsonResponse(await (spec ??= generateOpenApiDocument(router)));
+            return withCors(doc, allowOrigin, varyByOrigin);
+        }
+        const principal = await resolveRestPrincipal(ctx);
+        if (principal.kind === "unauthorized")
+            return unauthorized();
+        const context = {
+            ...principal.ctx,
+            restAuthenticated: principal.kind === "authed",
+        };
+        const result = await handler.handle(ctx.request, {
+            prefix: API_V1_PREFIX,
+            context,
+        });
+        const response = result.matched
+            ? result.response
+            : notFound("rest-route-not-found");
+        // PAT-authed reads may include non-public content: never cache them, and
+        // never CORS-expose them — a token in browser JS can't be used cross-origin.
+        if (principal.kind === "authed") {
+            return withHeaders(response, (h) => h.set("cache-control", "private, no-store"));
+        }
+        return withCors(response, allowOrigin, varyByOrigin);
+    };
+}
+//# sourceMappingURL=build-handler.js.map

package/dist/rest/build-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-handler.js","sourceRoot":"","sources":["../../src/rest/build-handler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAOrD,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,GACT,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AASzC,MAAM,aAAa,GAAG,iBAAiB,CAAC;AACxC,MAAM,SAAS,GAAG,GAAG,aAAa,eAAe,CAAC;AAElD,MAAM,UAAU,mBAAmB,CACjC,QAAwB,EACxB,IAAoB;IAEpB,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,MAAM,GAAG;QACb,GAAG,UAAU;QACb,GAAG,qBAAqB,CAAC,QAAQ,CAAC,aAAa,CAAC;KACjD,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC7C,6DAA6D;IAC7D,IAAI,IAA2C,CAAC;IAChD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,WAAW,GAAG,oBAAoB,CACtC,IAAI,EACJ,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClC,CAAC;QACF,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrC,OAAO,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,YAAY,CACtB,MAAM,CAAC,IAAI,KAAK,uBAAuB,CAAC,MAAM,CAAC,CAAC,CACjD,CAAC;YACF,OAAO,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,SAAS,GAAkB,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,SAAS,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,YAAY,EAAE,CAAC;QAE7D,MAAM,OAAO,GAAgB;YAC3B,GAAG,SAAS,CAAC,GAAG;YAChB,iBAAiB,EAAE,SAAS,CAAC,IAAI,KAAK,QAAQ;SAC/C,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;YAC/C,MAAM,EAAE,aAAa;YACrB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO;YAC7B,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QAErC,yEAAyE;QACzE,6EAA6E;QAC7E,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAC5C,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/rest/cors.d.ts

@@ -0,0 +1,11 @@
+import type { ApiCorsConfig } from "../config.js";
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request, or null when
+ * the request must not be CORS-exposed. Default-closed: no config → null.
+ * `"*"` allows any origin; an array echoes the request's origin only if listed.
+ */
+export declare function resolveAllowedOrigin(cors: ApiCorsConfig | undefined, requestOrigin: string | null): string | null;
+export declare function isOriginDependent(cors: ApiCorsConfig | undefined): boolean;
+export declare function withCors(response: Response, allowOrigin: string | null, varyByOrigin: boolean): Response;
+export declare function preflightResponse(request: Request, allowOrigin: string | null): Response;
+//# sourceMappingURL=cors.d.ts.map

package/dist/rest/cors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.d.ts","sourceRoot":"","sources":["../../src/rest/cors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,GAAG,SAAS,EAC/B,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,MAAM,GAAG,IAAI,CAOf;AAMD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAE1E;AAWD,wBAAgB,QAAQ,CACtB,QAAQ,EAAE,QAAQ,EAClB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,YAAY,EAAE,OAAO,GACpB,QAAQ,CAQV;AAMD,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,MAAM,GAAG,IAAI,GACzB,QAAQ,CAWV"}

package/dist/rest/cors.js

@@ -0,0 +1,58 @@
+import { withHeaders } from "../runtime/http.js";
+/**
+ * Resolve the `Access-Control-Allow-Origin` value for a request, or null when
+ * the request must not be CORS-exposed. Default-closed: no config → null.
+ * `"*"` allows any origin; an array echoes the request's origin only if listed.
+ */
+export function resolveAllowedOrigin(cors, requestOrigin) {
+    if (!cors?.origins)
+        return null;
+    if (cors.origins === "*")
+        return "*";
+    if (requestOrigin && cors.origins.includes(requestOrigin)) {
+        return requestOrigin;
+    }
+    return null;
+}
+// True when the allowed origin is computed from the request's Origin (an
+// allowlist), so the response must `Vary: origin` even when this request's
+// origin didn't match — otherwise a shared cache could serve a no-CORS entry to
+// an allowed origin. A `"*"` (or closed) policy is origin-independent.
+export function isOriginDependent(cors) {
+    return Array.isArray(cors?.origins);
+}
+// CORS for anonymous reads only. No `Access-Control-Allow-Credentials` is ever
+// set — the surface is bearer/anonymous, never cookie-authed, so credentialed
+// CORS would only invite a PAT-in-browser-JS footgun.
+function corsHeaders(allowOrigin) {
+    const headers = new Headers({ "access-control-allow-origin": allowOrigin });
+    if (allowOrigin !== "*")
+        headers.append("vary", "origin");
+    return headers;
+}
+export function withCors(response, allowOrigin, varyByOrigin) {
+    if (!allowOrigin && !varyByOrigin)
+        return response;
+    return withHeaders(response, (headers) => {
+        if (allowOrigin) {
+            headers.append("access-control-allow-origin", allowOrigin);
+        }
+        if (varyByOrigin)
+            headers.append("vary", "origin");
+    });
+}
+// Preflight is principal-less (the browser sends no credentials), so it's
+// gated purely on the configured origins. The actual PAT-authed response still
+// carries no CORS, so a cross-origin credentialed read fails at the response —
+// PATs stay server-to-server by design.
+export function preflightResponse(request, allowOrigin) {
+    if (allowOrigin === null)
+        return new Response(null, { status: 403 });
+    const headers = corsHeaders(allowOrigin);
+    headers.set("access-control-allow-methods", "GET, OPTIONS");
+    headers.set("access-control-allow-headers", request.headers.get("access-control-request-headers") ??
+        "authorization, content-type");
+    headers.set("access-control-max-age", "600");
+    return new Response(null, { status: 204, headers });
+}
+//# sourceMappingURL=cors.js.map

package/dist/rest/cors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cors.js","sourceRoot":"","sources":["../../src/rest/cors.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAA+B,EAC/B,aAA4B;IAE5B,IAAI,CAAC,IAAI,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,IAAI,CAAC,OAAO,KAAK,GAAG;QAAE,OAAO,GAAG,CAAC;IACrC,IAAI,aAAa,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,gFAAgF;AAChF,uEAAuE;AACvE,MAAM,UAAU,iBAAiB,CAAC,IAA+B;IAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,sDAAsD;AACtD,SAAS,WAAW,CAAC,WAAmB;IACtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,6BAA6B,EAAE,WAAW,EAAE,CAAC,CAAC;IAC5E,IAAI,WAAW,KAAK,GAAG;QAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,QAAQ,CACtB,QAAkB,EAClB,WAA0B,EAC1B,YAAqB;IAErB,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY;QAAE,OAAO,QAAQ,CAAC;IACnD,OAAO,WAAW,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,EAAE;QACvC,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,6BAA6B,EAAE,WAAW,CAAC,CAAC;QAC7D,CAAC;QACD,IAAI,YAAY;YAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAC/E,wCAAwC;AACxC,MAAM,UAAU,iBAAiB,CAC/B,OAAgB,EAChB,WAA0B;IAE1B,IAAI,WAAW,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CACT,8BAA8B,EAC9B,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC;QACnD,6BAA6B,CAChC,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/rest/entries-resource.d.ts

@@ -0,0 +1,44 @@
+import type { AppContext } from "../context/app.js";
+import type { RegisteredEntryType } from "../plugin/manifest.js";
+import type { RestErrors } from "./errors.js";
+import type { PublicEntry } from "./schemas.js";
+export declare function listEntriesEnvelope(context: AppContext, entryType: RegisteredEntryType, url: URL): Promise<{
+    data: {
+        id: number;
+        type: string;
+        slug: string;
+        title: string;
+        excerpt: string | null;
+        content: unknown;
+        status: string;
+        publishedAt: Date | null;
+        createdAt: Date;
+        updatedAt: Date;
+        author: {
+            id: number;
+            name: string | null;
+            avatarUrl: string | null;
+        } | null;
+        terms: {
+            [x: string]: {
+                id: number;
+                name: string;
+                slug: string;
+            }[];
+        };
+        meta: {
+            [x: string]: unknown;
+        };
+    }[];
+    meta: {
+        page: number;
+        per_page: number;
+    };
+    links: {
+        prev?: string | undefined;
+        next?: string | undefined;
+        self: string;
+    };
+}>;
+export declare function getEntryItem(context: AppContext, entryType: RegisteredEntryType, id: number, errors: RestErrors): Promise<PublicEntry>;
+//# sourceMappingURL=entries-resource.d.ts.map

package/dist/rest/entries-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entries-resource.d.ts","sourceRoot":"","sources":["../../src/rest/entries-resource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAgDhD,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,mBAAmB,EAC9B,GAAG,EAAE,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCT;AAGD,wBAAsB,YAAY,CAChC,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,mBAAmB,EAC9B,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,WAAW,CAAC,CAsBtB"}

package/dist/rest/entries-resource.js

@@ -0,0 +1,79 @@
+import { EntryReadError } from "../entries/errors.js";
+import { getEntry, listEntries } from "../entries/read-service.js";
+import { listEnvelope } from "./envelope.js";
+import { apiVisibleMetaKeys, loadEntriesTerms, loadPublicAuthors, projectEntry, } from "./projection.js";
+import { readPagination } from "./schemas.js";
+// Every entry-read failure mode (missing, reserved-type, forbidden, an
+// unpublished status the public principal can't see) collapses to 404 so the
+// existence of unreadable content stays hidden. A non-EntryReadError is
+// unexpected and rethrown for the dispatcher to surface as a 500.
+function entryNotFound(error, errors) {
+    if (error instanceof EntryReadError) {
+        return errors.NOT_FOUND({ data: { kind: "entry" } });
+    }
+    return error;
+}
+// Pagination params own these query keys; a taxonomy that happens to share a
+// name with one is skipped as a filter so `?page=2` can't double as a term query.
+const RESERVED_QUERY_PARAMS = new Set(["page", "per_page"]);
+// Map `?<taxonomy>=slug,slug` query params onto the service's term filter. Only
+// registered public taxonomies are honored, so any other query key is ignored.
+function readTermFilters(context, url) {
+    const filters = {};
+    for (const taxonomy of context.plugins.termTaxonomies.values()) {
+        if (taxonomy.isPublic === false)
+            continue;
+        if (RESERVED_QUERY_PARAMS.has(taxonomy.name))
+            continue;
+        const slugs = url.searchParams
+            .getAll(taxonomy.name)
+            .flatMap((value) => value.split(","))
+            .map((slug) => slug.trim())
+            .filter(Boolean);
+        if (slugs.length > 0)
+            filters[taxonomy.name] = slugs;
+    }
+    return Object.keys(filters).length > 0 ? filters : undefined;
+}
+// A paginated envelope of published entries for a public content type.
+export async function listEntriesEnvelope(context, entryType, url) {
+    const { page, perPage, offset } = readPagination(url);
+    // Over-fetch one row to detect a next page without a separate COUNT — an
+    // exact-multiple last page then reports no next link.
+    const fetched = await listEntries(context, {
+        type: entryType.name,
+        orderBy: "published_at",
+        order: "desc",
+        termTaxonomies: readTermFilters(context, url),
+        limit: perPage + 1,
+        offset,
+    });
+    const hasNext = fetched.length > perPage;
+    const rows = hasNext ? fetched.slice(0, perPage) : fetched;
+    const ids = rows.map((row) => row.id);
+    const authors = await loadPublicAuthors(context, rows.map((row) => row.authorId));
+    const termsByEntry = await loadEntriesTerms(context, ids);
+    const visibleMeta = apiVisibleMetaKeys(context.plugins, entryType.name);
+    const data = rows.map((row) => projectEntry(row, authors.get(row.authorId) ?? null, termsByEntry.get(row.id) ?? {}, visibleMeta));
+    return listEnvelope(data, { url, page, perPage, hasNext });
+}
+// One published entry. Unviewable or missing content is 404, never 403.
+export async function getEntryItem(context, entryType, id, errors) {
+    let entry;
+    try {
+        entry = await getEntry(context, { id });
+    }
+    catch (error) {
+        throw entryNotFound(error, errors);
+    }
+    // The id resolved to an entry of a different collection — hide that it
+    // exists rather than redirecting or 400ing.
+    if (entry.type !== entryType.name) {
+        throw errors.NOT_FOUND({ data: { kind: "entry" } });
+    }
+    const authors = await loadPublicAuthors(context, [entry.authorId]);
+    const termsByEntry = await loadEntriesTerms(context, [entry.id]);
+    const visibleMeta = apiVisibleMetaKeys(context.plugins, entryType.name);
+    return projectEntry(entry, authors.get(entry.authorId) ?? null, termsByEntry.get(entry.id) ?? {}, visibleMeta);
+}
+//# sourceMappingURL=entries-resource.js.map

package/dist/rest/entries-resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entries-resource.js","sourceRoot":"","sources":["../../src/rest/entries-resource.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,uEAAuE;AACvE,6EAA6E;AAC7E,wEAAwE;AACxE,kEAAkE;AAClE,SAAS,aAAa,CAAC,KAAc,EAAE,MAAkB;IACvD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,kFAAkF;AAClF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAE5D,gFAAgF;AAChF,+EAA+E;AAC/E,SAAS,eAAe,CACtB,OAAmB,EACnB,GAAQ;IAER,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/D,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK;YAAE,SAAS;QAC1C,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,SAAS;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY;aAC3B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;aACrB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;aACpC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACvD,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAmB,EACnB,SAA8B,EAC9B,GAAQ;IAER,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAEtD,yEAAyE;IACzE,sDAAsD;IACtD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE;QACzC,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,OAAO,EAAE,cAAc;QACvB,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC;QAC7C,KAAK,EAAE,OAAO,GAAG,CAAC;QAClB,MAAM;KACP,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAChC,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5B,YAAY,CACV,GAAG,EACH,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EACjC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAC9B,WAAW,CACZ,CACF,CAAC;IAEF,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAmB,EACnB,SAA8B,EAC9B,EAAU,EACV,MAAkB;IAElB,IAAI,KAA2C,CAAC;IAChD,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnE,MAAM,YAAY,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IACxE,OAAO,YAAY,CACjB,KAAK,EACL,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EACnC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAChC,WAAW,CACZ,CAAC;AACJ,CAAC"}

package/dist/rest/envelope.d.ts

@@ -0,0 +1,18 @@
+export declare function listEnvelope<T>(data: T[], options: {
+    readonly url: URL;
+    readonly page: number;
+    readonly perPage: number;
+    readonly hasNext: boolean;
+}): {
+    data: T[];
+    meta: {
+        page: number;
+        per_page: number;
+    };
+    links: {
+        prev?: string | undefined;
+        next?: string | undefined;
+        self: string;
+    };
+};
+//# sourceMappingURL=envelope.d.ts.map

package/dist/rest/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../src/rest/envelope.ts"],"names":[],"mappings":"AAAA,wBAAgB,YAAY,CAAC,CAAC,EAC5B,IAAI,EAAE,CAAC,EAAE,EACT,OAAO,EAAE;IACP,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;;;;;;;;;;;EAYF"}

package/dist/rest/envelope.js

@@ -0,0 +1,20 @@
+export function listEnvelope(data, options) {
+    const { url, page, perPage, hasNext } = options;
+    return {
+        data,
+        meta: { page, per_page: perPage },
+        links: {
+            self: pageUrl(url, page),
+            ...(hasNext ? { next: pageUrl(url, page + 1) } : {}),
+            ...(page > 1 ? { prev: pageUrl(url, page - 1) } : {}),
+        },
+    };
+}
+// Relative path + query so links don't pin the response to an internal origin;
+// clients resolve them against the request base.
+function pageUrl(url, page) {
+    const next = new URL(url);
+    next.searchParams.set("page", String(page));
+    return `${next.pathname}${next.search}`;
+}
+//# sourceMappingURL=envelope.js.map

package/dist/rest/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../src/rest/envelope.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,YAAY,CAC1B,IAAS,EACT,OAKC;IAED,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAChD,OAAO;QACL,IAAI;QACJ,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE;QACjC,KAAK,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YACxB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpD,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,iDAAiD;AACjD,SAAS,OAAO,CAAC,GAAQ,EAAE,IAAY;IACrC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,OAAO,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC"}

package/dist/rest/errors.d.ts

@@ -0,0 +1,21 @@
+import type { ORPCErrorConstructorMap } from "@orpc/server";
+import * as v from "valibot";
+export declare const REST_ERRORS: {
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: v.ObjectSchema<{
+            readonly kind: v.StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: v.ObjectSchema<{
+            readonly capability: v.StringSchema<undefined>;
+        }, undefined>;
+    };
+};
+export type RestErrors = ORPCErrorConstructorMap<typeof REST_ERRORS>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/rest/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/rest/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAK7B,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;CAUd,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,uBAAuB,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/rest/errors.js

@@ -0,0 +1,16 @@
+import * as v from "valibot";
+// Typed errors for the REST surface. Forbidden reads collapse to NOT_FOUND
+// upstream (in the entry/term services) to preserve hide-existence, so the
+// public read surface only ever needs NOT_FOUND today.
+export const REST_ERRORS = {
+    NOT_FOUND: {
+        message: "Resource not found",
+        data: v.object({ kind: v.string() }),
+    },
+    UNAUTHORIZED: { message: "Authentication required" },
+    FORBIDDEN: {
+        message: "Permission denied",
+        data: v.object({ capability: v.string() }),
+    },
+};
+//# sourceMappingURL=errors.js.map

package/dist/rest/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/rest/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,2EAA2E;AAC3E,2EAA2E;AAC3E,uDAAuD;AACvD,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,SAAS,EAAE;QACT,OAAO,EAAE,oBAAoB;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACrC;IACD,YAAY,EAAE,EAAE,OAAO,EAAE,yBAAyB,EAAE;IACpD,SAAS,EAAE;QACT,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC3C;CACO,CAAC"}

package/dist/rest/openapi.d.ts

@@ -0,0 +1,4 @@
+import type { OpenAPI } from "@orpc/openapi";
+import type { AnyRouter } from "@orpc/server";
+export declare function generateOpenApiDocument(router: AnyRouter): Promise<OpenAPI.Document>;
+//# sourceMappingURL=openapi.d.ts.map

package/dist/rest/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../src/rest/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAM9C,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,SAAS,GAChB,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAO3B"}

package/dist/rest/openapi.js

@@ -0,0 +1,13 @@
+import { OpenAPIGenerator } from "@orpc/openapi";
+import { experimental_ValibotToJsonSchemaConverter } from "@orpc/valibot";
+// Generated from the merged router (core + plugin resources) so plugin
+// endpoints appear in the spec automatically.
+export function generateOpenApiDocument(router) {
+    const generator = new OpenAPIGenerator({
+        schemaConverters: [new experimental_ValibotToJsonSchemaConverter()],
+    });
+    return generator.generate(router, {
+        info: { title: "Plumix REST API", version: "1.0.0" },
+    });
+}
+//# sourceMappingURL=openapi.js.map

package/dist/rest/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../../src/rest/openapi.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,yCAAyC,EAAE,MAAM,eAAe,CAAC;AAE1E,uEAAuE;AACvE,8CAA8C;AAC9C,MAAM,UAAU,uBAAuB,CACrC,MAAiB;IAEjB,MAAM,SAAS,GAAG,IAAI,gBAAgB,CAAC;QACrC,gBAAgB,EAAE,CAAC,IAAI,yCAAyC,EAAE,CAAC;KACpE,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE;QAChC,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,OAAO,EAAE;KACrD,CAAC,CAAC;AACL,CAAC"}

package/dist/rest/plugin-resources.d.ts

@@ -0,0 +1,3 @@
+import type { RegisteredRestResource } from "../plugin/manifest.js";
+export declare function buildPluginRestRouter(resources: readonly RegisteredRestResource[]): Record<string, unknown>;
+//# sourceMappingURL=plugin-resources.d.ts.map

package/dist/rest/plugin-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-resources.d.ts","sourceRoot":"","sources":["../../src/rest/plugin-resources.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AA2B/B,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,sBAAsB,EAAE,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAezB"}