@pwfabric/cli 0.0.0-stage → 1.0.0-rc.1

package/dist/host/oidc.js

@@ -0,0 +1,192 @@
+/**
+ * A development stand-in for an external OpenID Connect issuer.
+ *
+ * When `auth.json` declares `topology: "external"`, the app's real issuer
+ * cannot be reached from a laptop without registering a redirect URI for
+ * every port `pwf dev` picks. The local host therefore plays that issuer, at
+ * `<prefix>/oidc`, with just enough of the protocol for the runner's PKCE
+ * client (session-protocol §3):
+ *
+ *   GET  <prefix>/oidc/.well-known/openid-configuration   discovery
+ *   GET  <prefix>/oidc/authorize                           code + PKCE (S256), no consent screen:
+ *                                                          the development user is signed in at once
+ *   POST <prefix>/oidc/token                               authorization_code, refresh_token
+ *                                                          (and refresh_token + scope "<audience>/.default"
+ *                                                          for the door token)
+ *
+ * The declared `clientId`, scopes and audience are kept; only the issuer
+ * address changes. Tokens are opaque; the ID token is an UNSIGNED JWT
+ * (`alg: none`), which the runner decodes and does not verify. No real
+ * issuer's keys are ever involved, and nothing here is safe to expose beyond
+ * the developer's own machine.
+ */
+import { createHash } from 'node:crypto';
+import { readForm, redirect, sendJson, HostError } from './http.js';
+import { TokenStore } from './tokens.js';
+export const ACCESS_TTL_S = 3600;
+const CODE_TTL_MS = 60_000;
+const REFRESH_TTL_MS = 24 * 3600_000;
+const b64url = (v) => Buffer.from(v).toString('base64url');
+function oauthError(res, status, error, description) {
+    sendJson(res, status, { error, error_description: description });
+}
+export class DevIssuer {
+    bearer;
+    user;
+    codes = new TokenStore();
+    refresh = new TokenStore();
+    constructor(bearer, user) {
+        this.bearer = bearer;
+        this.user = user;
+    }
+    reset() {
+        this.codes.clear();
+        this.refresh.clear();
+    }
+    /** `<origin><prefix>/oidc` — the `iss` this issuer speaks for. */
+    static issuerUrl(origin, prefix) {
+        return `${origin.replace(/\/+$/, '')}${prefix}/oidc`;
+    }
+    discovery(res, issuer) {
+        sendJson(res, 200, {
+            issuer,
+            authorization_endpoint: `${issuer}/authorize`,
+            token_endpoint: `${issuer}/token`,
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            code_challenge_methods_supported: ['S256'],
+            subject_types_supported: ['public'],
+            id_token_signing_alg_values_supported: ['none'],
+            token_endpoint_auth_methods_supported: ['none'],
+        });
+    }
+    authorize(req, res, url, auth) {
+        const q = url.searchParams;
+        const declared = auth.issuer;
+        if (!declared || q.get('client_id') !== declared.clientId) {
+            throw new HostError(400, 'UNKNOWN_CLIENT', 'client_id does not match the app declaration.');
+        }
+        let redirectUri;
+        try {
+            redirectUri = new URL(q.get('redirect_uri') ?? '');
+        }
+        catch {
+            throw new HostError(400, 'INVALID_REDIRECT_URI', 'redirect_uri must be an absolute URL.');
+        }
+        // The app is served by the same development server; anything else is not this app.
+        if (!/^https?:$/.test(redirectUri.protocol) || redirectUri.host !== req.headers.host) {
+            throw new HostError(400, 'INVALID_REDIRECT_URI', 'redirect_uri must be on this development server.');
+        }
+        const state = q.get('state');
+        const back = (params) => {
+            const target = new URL(redirectUri);
+            for (const [k, v] of Object.entries(params))
+                target.searchParams.set(k, v);
+            if (state !== null)
+                target.searchParams.set('state', state);
+            redirect(res, target.toString());
+        };
+        if (q.get('response_type') !== 'code') {
+            back({ error: 'unsupported_response_type', error_description: 'Only response_type=code is supported.' });
+            return;
+        }
+        const challenge = q.get('code_challenge');
+        if (!challenge || q.get('code_challenge_method') !== 'S256') {
+            back({ error: 'invalid_request', error_description: 'PKCE with code_challenge_method=S256 is required.' });
+            return;
+        }
+        const code = this.codes.issue({
+            principal: this.user,
+            clientId: declared.clientId,
+            redirectUri: redirectUri.toString(),
+            challenge,
+            scopes: (q.get('scope') ?? '').split(' ').filter(Boolean),
+            expiresAt: Date.now() + CODE_TTL_MS,
+        });
+        back({ code });
+    }
+    async token(req, res, issuer, auth) {
+        const form = await readForm(req);
+        const clientId = auth.issuer?.clientId;
+        if (!clientId || form.get('client_id') !== clientId) {
+            oauthError(res, 401, 'invalid_client', 'client_id does not match the app declaration.');
+            return;
+        }
+        const grantType = form.get('grant_type');
+        if (grantType === 'authorization_code') {
+            const code = this.codes.take(form.get('code') ?? undefined);
+            if (!code || code.clientId !== clientId) {
+                oauthError(res, 400, 'invalid_grant', 'The code is unknown, used or expired.');
+                return;
+            }
+            if (form.get('redirect_uri') !== code.redirectUri) {
+                oauthError(res, 400, 'invalid_grant', 'redirect_uri differs from the one the code was issued for.');
+                return;
+            }
+            const verifier = form.get('code_verifier') ?? '';
+            if (b64url(createHash('sha256').update(verifier).digest()) !== code.challenge) {
+                oauthError(res, 400, 'invalid_grant', 'code_verifier does not match the code_challenge.');
+                return;
+            }
+            sendJson(res, 200, this.mint(issuer, clientId, code.principal, code.scopes, true));
+            return;
+        }
+        if (grantType === 'refresh_token') {
+            const old = this.refresh.take(form.get('refresh_token') ?? undefined);
+            if (!old || old.clientId !== clientId) {
+                oauthError(res, 400, 'invalid_grant', 'The refresh token is unknown, used or expired.');
+                return;
+            }
+            const scope = form.get('scope');
+            if (scope) {
+                const audience = auth.issuer?.audience?.replace(/\/+$/, '');
+                if (!audience || scope !== `${audience}/.default`) {
+                    oauthError(res, 400, 'invalid_scope', 'Only the app audience scope "<audience>/.default" can be redeemed.');
+                    return;
+                }
+                sendJson(res, 200, this.mint(issuer, clientId, old.principal, [scope], false, 'door', old.scopes));
+                return;
+            }
+            sendJson(res, 200, this.mint(issuer, clientId, old.principal, old.scopes, true));
+            return;
+        }
+        oauthError(res, 400, 'unsupported_grant_type', 'grant_type must be authorization_code or refresh_token.');
+    }
+    mint(issuer, clientId, principal, scopes, withIdToken, kind = 'access', 
+    /** What the next refresh grants: a door redemption keeps the data scopes. */
+    refreshScopes = scopes) {
+        const now = Math.floor(Date.now() / 1000);
+        const accessToken = this.bearer.issue({ principal, kind, expiresAt: Date.now() + ACCESS_TTL_S * 1000 });
+        // Refresh tokens rotate on every use, as a single-page-app issuer's do.
+        const refreshToken = this.refresh.issue({
+            principal,
+            clientId,
+            scopes: refreshScopes,
+            expiresAt: Date.now() + REFRESH_TTL_MS,
+        });
+        const idToken = withIdToken
+            ? [
+                b64url(JSON.stringify({ alg: 'none', typ: 'JWT' })),
+                b64url(JSON.stringify({
+                    iss: issuer,
+                    sub: principal.id,
+                    aud: clientId,
+                    name: principal.displayName,
+                    email: principal.email,
+                    iat: now,
+                    exp: now + ACCESS_TTL_S,
+                })),
+                '',
+            ].join('.')
+            : undefined;
+        return {
+            access_token: accessToken,
+            token_type: 'Bearer',
+            expires_in: ACCESS_TTL_S,
+            refresh_token: refreshToken,
+            scope: scopes.join(' '),
+            ...(idToken ? { id_token: idToken } : {}),
+        };
+    }
+}
+//# sourceMappingURL=oidc.js.map

package/dist/host/oidc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc.js","sourceRoot":"","sources":["../../src/host/oidc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAEnE,OAAO,EAAE,UAAU,EAAkB,MAAM,aAAa,CAAA;AAyBxD,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAA;AAChC,MAAM,WAAW,GAAG,MAAM,CAAA;AAC1B,MAAM,cAAc,GAAG,EAAE,GAAG,QAAQ,CAAA;AAEpC,MAAM,MAAM,GAAG,CAAC,CAAkB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;AAEnF,SAAS,UAAU,CAAC,GAAmB,EAAE,MAAc,EAAE,KAAa,EAAE,WAAmB;IACzF,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,OAAO,SAAS;IAKD;IACA;IALF,KAAK,GAAG,IAAI,UAAU,EAAa,CAAA;IACnC,OAAO,GAAG,IAAI,UAAU,EAAgB,CAAA;IAEzD,YACmB,MAAyB,EACzB,IAAe;QADf,WAAM,GAAN,MAAM,CAAmB;QACzB,SAAI,GAAJ,IAAI,CAAW;IAC/B,CAAC;IAEJ,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAA;QAClB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;IAED,kEAAkE;IAClE,MAAM,CAAC,SAAS,CAAC,MAAc,EAAE,MAAc;QAC7C,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,OAAO,CAAA;IACtD,CAAC;IAED,SAAS,CAAC,GAAmB,EAAE,MAAc;QAC3C,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;YACjB,MAAM;YACN,sBAAsB,EAAE,GAAG,MAAM,YAAY;YAC7C,cAAc,EAAE,GAAG,MAAM,QAAQ;YACjC,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,uBAAuB,EAAE,CAAC,QAAQ,CAAC;YACnC,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,qCAAqC,EAAE,CAAC,MAAM,CAAC;SAChD,CAAC,CAAA;IACJ,CAAC;IAED,SAAS,CAAC,GAAoB,EAAE,GAAmB,EAAE,GAAQ,EAAE,IAAqB;QAClF,MAAM,CAAC,GAAG,GAAG,CAAC,YAAY,CAAA;QAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;YAC1D,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAA;QAC7F,CAAC;QACD,IAAI,WAAgB,CAAA;QACpB,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAA;QACpD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,uCAAuC,CAAC,CAAA;QAC3F,CAAC;QACD,mFAAmF;QACnF,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACrF,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sBAAsB,EAAE,kDAAkD,CAAC,CAAA;QACtG,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,CAAC,MAA8B,EAAQ,EAAE;YACpD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAA;YACnC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YAC1E,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;YAC3D,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;QAClC,CAAC,CAAA;QACD,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,MAAM,EAAE,CAAC;YACtC,IAAI,CAAC,EAAE,KAAK,EAAE,2BAA2B,EAAE,iBAAiB,EAAE,uCAAuC,EAAE,CAAC,CAAA;YACxG,OAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAA;QACzC,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,MAAM,EAAE,CAAC;YAC5D,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,mDAAmD,EAAE,CAAC,CAAA;YAC1G,OAAM;QACR,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;YAC5B,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;YACnC,SAAS;YACT,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACzD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW;SACpC,CAAC,CAAA;QACF,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;IAChB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAoB,EAAE,GAAmB,EAAE,MAAc,EAAE,IAAqB;QAC1F,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAA;QACtC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,gBAAgB,EAAE,+CAA+C,CAAC,CAAA;YACvF,OAAM;QACR,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QACxC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,SAAS,CAAC,CAAA;YAC3D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACxC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,uCAAuC,CAAC,CAAA;gBAC9E,OAAM;YACR,CAAC;YACD,IAAI,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBAClD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,4DAA4D,CAAC,CAAA;gBACnG,OAAM;YACR,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAA;YAChD,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBAC9E,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,kDAAkD,CAAC,CAAA;gBACzF,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YAClF,OAAM;QACR,CAAC;QACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YAClC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,CAAA;YACrE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,gDAAgD,CAAC,CAAA;gBACvF,OAAM;YACR,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;YAC/B,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;gBAC3D,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,GAAG,QAAQ,WAAW,EAAE,CAAC;oBAClD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,eAAe,EAAE,oEAAoE,CAAC,CAAA;oBAC3G,OAAM;gBACR,CAAC;gBACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;gBAClG,OAAM;YACR,CAAC;YACD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;YAChF,OAAM;QACR,CAAC;QACD,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,wBAAwB,EAAE,yDAAyD,CAAC,CAAA;IAC3G,CAAC;IAEO,IAAI,CACV,MAAc,EACd,QAAgB,EAChB,SAAoB,EACpB,MAAyB,EACzB,WAAoB,EACpB,OAAsB,QAAQ;IAC9B,6EAA6E;IAC7E,gBAAmC,MAAM;QAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC,CAAA;QACvG,wEAAwE;QACxE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACtC,SAAS;YACT,QAAQ;YACR,MAAM,EAAE,aAAa;YACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc;SACvC,CAAC,CAAA;QACF,MAAM,OAAO,GAAG,WAAW;YACzB,CAAC,CAAC;gBACE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnD,MAAM,CACJ,IAAI,CAAC,SAAS,CAAC;oBACb,GAAG,EAAE,MAAM;oBACX,GAAG,EAAE,SAAS,CAAC,EAAE;oBACjB,GAAG,EAAE,QAAQ;oBACb,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,KAAK,EAAE,SAAS,CAAC,KAAK;oBACtB,GAAG,EAAE,GAAG;oBACR,GAAG,EAAE,GAAG,GAAG,YAAY;iBACxB,CAAC,CACH;gBACD,EAAE;aACH,CAAC,IAAI,CAAC,GAAG,CAAC;YACb,CAAC,CAAC,SAAS,CAAA;QACb,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,QAAQ;YACpB,UAAU,EAAE,YAAY;YACxB,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAA;IACH,CAAC;CACF","sourcesContent":["/**\n * A development stand-in for an external OpenID Connect issuer.\n *\n * When `auth.json` declares `topology: \"external\"`, the app's real issuer\n * cannot be reached from a laptop without registering a redirect URI for\n * every port `pwf dev` picks. The local host therefore plays that issuer, at\n * `<prefix>/oidc`, with just enough of the protocol for the runner's PKCE\n * client (session-protocol §3):\n *\n *   GET  <prefix>/oidc/.well-known/openid-configuration   discovery\n *   GET  <prefix>/oidc/authorize                           code + PKCE (S256), no consent screen:\n *                                                          the development user is signed in at once\n *   POST <prefix>/oidc/token                               authorization_code, refresh_token\n *                                                          (and refresh_token + scope \"<audience>/.default\"\n *                                                          for the door token)\n *\n * The declared `clientId`, scopes and audience are kept; only the issuer\n * address changes. Tokens are opaque; the ID token is an UNSIGNED JWT\n * (`alg: none`), which the runner decodes and does not verify. No real\n * issuer's keys are ever involved, and nothing here is safe to expose beyond\n * the developer's own machine.\n */\n\nimport { createHash } from 'node:crypto'\nimport type { IncomingMessage, ServerResponse } from 'node:http'\nimport { readForm, redirect, sendJson, HostError } from './http.js'\nimport type { AuthDeclaration } from './definitions.js'\nimport { TokenStore, type Principal } from './tokens.js'\n\n/** What a bearer credential stands for, whichever door minted it. */\nexport interface Grant {\n  readonly principal: Principal\n  readonly expiresAt: number\n  readonly kind: 'session' | 'access' | 'door'\n}\n\ninterface CodeGrant {\n  readonly principal: Principal\n  readonly clientId: string\n  readonly redirectUri: string\n  readonly challenge: string\n  readonly scopes: readonly string[]\n  readonly expiresAt: number\n}\n\ninterface RefreshGrant {\n  readonly principal: Principal\n  readonly clientId: string\n  readonly scopes: readonly string[]\n  readonly expiresAt: number\n}\n\nexport const ACCESS_TTL_S = 3600\nconst CODE_TTL_MS = 60_000\nconst REFRESH_TTL_MS = 24 * 3600_000\n\nconst b64url = (v: string | Buffer): string => Buffer.from(v).toString('base64url')\n\nfunction oauthError(res: ServerResponse, status: number, error: string, description: string): void {\n  sendJson(res, status, { error, error_description: description })\n}\n\nexport class DevIssuer {\n  private readonly codes = new TokenStore<CodeGrant>()\n  private readonly refresh = new TokenStore<RefreshGrant>()\n\n  constructor(\n    private readonly bearer: TokenStore<Grant>,\n    private readonly user: Principal\n  ) {}\n\n  reset(): void {\n    this.codes.clear()\n    this.refresh.clear()\n  }\n\n  /** `<origin><prefix>/oidc` — the `iss` this issuer speaks for. */\n  static issuerUrl(origin: string, prefix: string): string {\n    return `${origin.replace(/\\/+$/, '')}${prefix}/oidc`\n  }\n\n  discovery(res: ServerResponse, issuer: string): void {\n    sendJson(res, 200, {\n      issuer,\n      authorization_endpoint: `${issuer}/authorize`,\n      token_endpoint: `${issuer}/token`,\n      response_types_supported: ['code'],\n      grant_types_supported: ['authorization_code', 'refresh_token'],\n      code_challenge_methods_supported: ['S256'],\n      subject_types_supported: ['public'],\n      id_token_signing_alg_values_supported: ['none'],\n      token_endpoint_auth_methods_supported: ['none'],\n    })\n  }\n\n  authorize(req: IncomingMessage, res: ServerResponse, url: URL, auth: AuthDeclaration): void {\n    const q = url.searchParams\n    const declared = auth.issuer\n    if (!declared || q.get('client_id') !== declared.clientId) {\n      throw new HostError(400, 'UNKNOWN_CLIENT', 'client_id does not match the app declaration.')\n    }\n    let redirectUri: URL\n    try {\n      redirectUri = new URL(q.get('redirect_uri') ?? '')\n    } catch {\n      throw new HostError(400, 'INVALID_REDIRECT_URI', 'redirect_uri must be an absolute URL.')\n    }\n    // The app is served by the same development server; anything else is not this app.\n    if (!/^https?:$/.test(redirectUri.protocol) || redirectUri.host !== req.headers.host) {\n      throw new HostError(400, 'INVALID_REDIRECT_URI', 'redirect_uri must be on this development server.')\n    }\n    const state = q.get('state')\n    const back = (params: Record<string, string>): void => {\n      const target = new URL(redirectUri)\n      for (const [k, v] of Object.entries(params)) target.searchParams.set(k, v)\n      if (state !== null) target.searchParams.set('state', state)\n      redirect(res, target.toString())\n    }\n    if (q.get('response_type') !== 'code') {\n      back({ error: 'unsupported_response_type', error_description: 'Only response_type=code is supported.' })\n      return\n    }\n    const challenge = q.get('code_challenge')\n    if (!challenge || q.get('code_challenge_method') !== 'S256') {\n      back({ error: 'invalid_request', error_description: 'PKCE with code_challenge_method=S256 is required.' })\n      return\n    }\n    const code = this.codes.issue({\n      principal: this.user,\n      clientId: declared.clientId,\n      redirectUri: redirectUri.toString(),\n      challenge,\n      scopes: (q.get('scope') ?? '').split(' ').filter(Boolean),\n      expiresAt: Date.now() + CODE_TTL_MS,\n    })\n    back({ code })\n  }\n\n  async token(req: IncomingMessage, res: ServerResponse, issuer: string, auth: AuthDeclaration): Promise<void> {\n    const form = await readForm(req)\n    const clientId = auth.issuer?.clientId\n    if (!clientId || form.get('client_id') !== clientId) {\n      oauthError(res, 401, 'invalid_client', 'client_id does not match the app declaration.')\n      return\n    }\n    const grantType = form.get('grant_type')\n    if (grantType === 'authorization_code') {\n      const code = this.codes.take(form.get('code') ?? undefined)\n      if (!code || code.clientId !== clientId) {\n        oauthError(res, 400, 'invalid_grant', 'The code is unknown, used or expired.')\n        return\n      }\n      if (form.get('redirect_uri') !== code.redirectUri) {\n        oauthError(res, 400, 'invalid_grant', 'redirect_uri differs from the one the code was issued for.')\n        return\n      }\n      const verifier = form.get('code_verifier') ?? ''\n      if (b64url(createHash('sha256').update(verifier).digest()) !== code.challenge) {\n        oauthError(res, 400, 'invalid_grant', 'code_verifier does not match the code_challenge.')\n        return\n      }\n      sendJson(res, 200, this.mint(issuer, clientId, code.principal, code.scopes, true))\n      return\n    }\n    if (grantType === 'refresh_token') {\n      const old = this.refresh.take(form.get('refresh_token') ?? undefined)\n      if (!old || old.clientId !== clientId) {\n        oauthError(res, 400, 'invalid_grant', 'The refresh token is unknown, used or expired.')\n        return\n      }\n      const scope = form.get('scope')\n      if (scope) {\n        const audience = auth.issuer?.audience?.replace(/\\/+$/, '')\n        if (!audience || scope !== `${audience}/.default`) {\n          oauthError(res, 400, 'invalid_scope', 'Only the app audience scope \"<audience>/.default\" can be redeemed.')\n          return\n        }\n        sendJson(res, 200, this.mint(issuer, clientId, old.principal, [scope], false, 'door', old.scopes))\n        return\n      }\n      sendJson(res, 200, this.mint(issuer, clientId, old.principal, old.scopes, true))\n      return\n    }\n    oauthError(res, 400, 'unsupported_grant_type', 'grant_type must be authorization_code or refresh_token.')\n  }\n\n  private mint(\n    issuer: string,\n    clientId: string,\n    principal: Principal,\n    scopes: readonly string[],\n    withIdToken: boolean,\n    kind: Grant['kind'] = 'access',\n    /** What the next refresh grants: a door redemption keeps the data scopes. */\n    refreshScopes: readonly string[] = scopes\n  ): Record<string, unknown> {\n    const now = Math.floor(Date.now() / 1000)\n    const accessToken = this.bearer.issue({ principal, kind, expiresAt: Date.now() + ACCESS_TTL_S * 1000 })\n    // Refresh tokens rotate on every use, as a single-page-app issuer's do.\n    const refreshToken = this.refresh.issue({\n      principal,\n      clientId,\n      scopes: refreshScopes,\n      expiresAt: Date.now() + REFRESH_TTL_MS,\n    })\n    const idToken = withIdToken\n      ? [\n          b64url(JSON.stringify({ alg: 'none', typ: 'JWT' })),\n          b64url(\n            JSON.stringify({\n              iss: issuer,\n              sub: principal.id,\n              aud: clientId,\n              name: principal.displayName,\n              email: principal.email,\n              iat: now,\n              exp: now + ACCESS_TTL_S,\n            })\n          ),\n          '',\n        ].join('.')\n      : undefined\n    return {\n      access_token: accessToken,\n      token_type: 'Bearer',\n      expires_in: ACCESS_TTL_S,\n      refresh_token: refreshToken,\n      scope: scopes.join(' '),\n      ...(idToken ? { id_token: idToken } : {}),\n    }\n  }\n}\n"]}

package/dist/host/query.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The data protocol's query language (data-protocol §3), applied by the host.
+ *
+ * The runtime applies the same query to the rows it receives, so a server
+ * need not filter to be correct. The host filters anyway — the HTTP connector
+ * sends `filter`, `sort`, `offset` and `limit`, and a paged list is only
+ * honest when the page is cut after filtering. The semantics follow the
+ * runtime's own applier: loose equality, number-looking strings compare as
+ * numbers, `contains`/`startsWith` ignore case, a leaf with no value matches.
+ */
+export type Row = Record<string, unknown>;
+export interface Filter {
+    readonly field?: string;
+    readonly operator?: string;
+    readonly value?: unknown;
+    readonly and?: readonly Filter[];
+    readonly or?: readonly Filter[];
+}
+export interface SortField {
+    readonly field: string;
+    readonly direction: 'asc' | 'desc';
+}
+export declare function matches(row: Row, filter: Filter): boolean;
+export declare function sortRows<T extends Row>(rows: readonly T[], sort: readonly SortField[]): T[];
+/** `sort=<field>:<direction>,…` as the HTTP connector writes it. */
+export declare function parseSort(value: string | null): SortField[];
+/** `filter=<json>`; `undefined` when absent. Throws on JSON that is not a filter object. */
+export declare function parseFilter(value: string | null): Filter | undefined;
+export interface AggregateResult {
+    readonly fn: 'count' | 'sum' | 'avg';
+    readonly field?: string;
+    readonly value: number | null;
+    readonly count: number;
+}
+export declare function aggregate(rows: readonly Row[], fn: 'count' | 'sum' | 'avg', field: string | undefined): AggregateResult;

package/dist/host/query.js

@@ -0,0 +1,158 @@
+/**
+ * The data protocol's query language (data-protocol §3), applied by the host.
+ *
+ * The runtime applies the same query to the rows it receives, so a server
+ * need not filter to be correct. The host filters anyway — the HTTP connector
+ * sends `filter`, `sort`, `offset` and `limit`, and a paged list is only
+ * honest when the page is cut after filtering. The semantics follow the
+ * runtime's own applier: loose equality, number-looking strings compare as
+ * numbers, `contains`/`startsWith` ignore case, a leaf with no value matches.
+ */
+function readField(row, field) {
+    if (field in row)
+        return row[field];
+    let cur = row;
+    for (const part of field.split('.')) {
+        if (cur === null || cur === undefined || typeof cur !== 'object')
+            return undefined;
+        cur = cur[part];
+    }
+    return cur;
+}
+const NUMERIC = /^\s*[-+]?(\d+\.?\d*|\.\d+)(e[-+]?\d+)?\s*$/i;
+function numeric(v) {
+    if (typeof v === 'number')
+        return Number.isFinite(v) ? v : undefined;
+    if (typeof v === 'boolean')
+        return v ? 1 : 0;
+    if (typeof v !== 'string' || !NUMERIC.test(v))
+        return undefined;
+    return Number(v);
+}
+function looseEq(a, b) {
+    if (a === b)
+        return true;
+    if (a === null || a === undefined || b === null || b === undefined)
+        return false;
+    if (typeof a === 'object' || typeof b === 'object')
+        return false;
+    return String(a) === String(b);
+}
+/** Numbers (and number-looking strings) first and numerically; the rest as text. */
+function compare(a, b) {
+    if (a === null || a === undefined || b === null || b === undefined)
+        return undefined;
+    const na = numeric(a);
+    const nb = numeric(b);
+    if (na !== undefined && nb !== undefined)
+        return na - nb;
+    if (na !== undefined)
+        return -1;
+    if (nb !== undefined)
+        return 1;
+    const sa = String(a);
+    const sb = String(b);
+    return sa < sb ? -1 : sa > sb ? 1 : 0;
+}
+function leaf(actual, operator, expected) {
+    switch (operator) {
+        case 'eq':
+            return looseEq(actual, expected);
+        case 'neq':
+            return !looseEq(actual, expected);
+        case 'gt':
+        case 'gte':
+        case 'lt':
+        case 'lte': {
+            const c = compare(actual, expected);
+            if (c === undefined)
+                return false;
+            return operator === 'gt' ? c > 0 : operator === 'gte' ? c >= 0 : operator === 'lt' ? c < 0 : c <= 0;
+        }
+        case 'in':
+            return (Array.isArray(expected) ? expected : [expected]).some((e) => looseEq(actual, e));
+        case 'contains':
+            if (Array.isArray(actual))
+                return actual.some((x) => looseEq(x, expected));
+            return actual !== null && actual !== undefined && String(actual).toLowerCase().includes(String(expected).toLowerCase());
+        case 'startsWith':
+            return actual !== null && actual !== undefined && String(actual).toLowerCase().startsWith(String(expected).toLowerCase());
+        default:
+            return false;
+    }
+}
+export function matches(row, filter) {
+    const hasLeaf = typeof filter.field === 'string' && filter.field !== '' && typeof filter.operator === 'string' && filter.value !== undefined;
+    const ok = hasLeaf ? leaf(readField(row, filter.field), filter.operator, filter.value) : true;
+    const andOk = filter.and && filter.and.length > 0 ? filter.and.every((f) => matches(row, f)) : true;
+    const orOk = filter.or && filter.or.length > 0 ? filter.or.some((f) => matches(row, f)) : true;
+    return ok && andOk && orOk;
+}
+export function sortRows(rows, sort) {
+    return rows
+        .map((item, index) => ({ item, index }))
+        .sort((a, b) => {
+        for (const s of sort) {
+            const va = readField(a.item, s.field);
+            const vb = readField(b.item, s.field);
+            const na = va === null || va === undefined;
+            const nb = vb === null || vb === undefined;
+            if (na && nb)
+                continue;
+            if (na)
+                return 1;
+            if (nb)
+                return -1;
+            const c = compare(va, vb) ?? 0;
+            if (c !== 0)
+                return s.direction === 'desc' ? -c : c;
+        }
+        return a.index - b.index;
+    })
+        .map((x) => x.item);
+}
+/** `sort=<field>:<direction>,…` as the HTTP connector writes it. */
+export function parseSort(value) {
+    if (!value)
+        return [];
+    return value
+        .split(',')
+        .map((part) => part.trim())
+        .filter(Boolean)
+        .flatMap((part) => {
+        const at = part.lastIndexOf(':');
+        const field = (at === -1 ? part : part.slice(0, at)).trim();
+        const dir = at === -1 ? 'asc' : part.slice(at + 1).trim().toLowerCase();
+        return field ? [{ field, direction: dir === 'desc' ? 'desc' : 'asc' }] : [];
+    });
+}
+/** `filter=<json>`; `undefined` when absent. Throws on JSON that is not a filter object. */
+export function parseFilter(value) {
+    if (value === null || value.trim() === '')
+        return undefined;
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw new Error('filter must be a JSON object');
+    return parsed;
+}
+export function aggregate(rows, fn, field) {
+    const base = { fn, ...(field ? { field } : {}), count: rows.length };
+    if (fn === 'count')
+        return { ...base, value: rows.length };
+    if (!field)
+        return { ...base, value: null };
+    const nums = [];
+    for (const r of rows) {
+        const v = readField(r, field);
+        if (v === null || v === undefined || v === '')
+            continue;
+        const n = typeof v === 'number' ? v : Number(v);
+        if (Number.isFinite(n))
+            nums.push(n);
+    }
+    if (nums.length === 0)
+        return { ...base, value: null };
+    const sum = nums.reduce((a, b) => a + b, 0);
+    return { ...base, value: fn === 'sum' ? sum : sum / nums.length };
+}
+//# sourceMappingURL=query.js.map

package/dist/host/query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"query.js","sourceRoot":"","sources":["../../src/host/query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAiBH,SAAS,SAAS,CAAC,GAAQ,EAAE,KAAa;IACxC,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,KAAK,CAAC,CAAA;IACnC,IAAI,GAAG,GAAY,GAAG,CAAA;IACtB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAA;QAClF,GAAG,GAAI,GAAW,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,OAAO,GAAG,6CAA6C,CAAA;AAE7D,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACpE,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAA;IAC/D,OAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,CAAU,EAAE,CAAU;IACrC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACxB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAChF,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAChE,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,oFAAoF;AACpF,SAAS,OAAO,CAAC,CAAU,EAAE,CAAU;IACrC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACpF,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACrB,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;IACrB,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,EAAE,GAAG,EAAE,CAAA;IACxD,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC,CAAA;IAC/B,IAAI,EAAE,KAAK,SAAS;QAAE,OAAO,CAAC,CAAA;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpB,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpB,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACvC,CAAC;AAED,SAAS,IAAI,CAAC,MAAe,EAAE,QAAgB,EAAE,QAAiB;IAChE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,IAAI;YACP,OAAO,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAClC,KAAK,KAAK;YACR,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACnC,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC;QACX,KAAK,IAAI,CAAC;QACV,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YACnC,IAAI,CAAC,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAA;YACjC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QACrG,CAAC;QACD,KAAK,IAAI;YACP,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAA;QAC1F,KAAK,UAAU;YACb,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAA;YAC1E,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QACzH,KAAK,YAAY;YACf,OAAO,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;QAC3H;YACE,OAAO,KAAK,CAAA;IAChB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAQ,EAAE,MAAc;IAC9C,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,CAAA;IAC5I,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,KAAe,CAAC,EAAE,MAAM,CAAC,QAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACjH,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnG,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC9F,OAAO,EAAE,IAAI,KAAK,IAAI,IAAI,CAAA;AAC5B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAgB,IAAkB,EAAE,IAA0B;IACpF,OAAO,IAAI;SACR,GAAG,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACb,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;YACrC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;YACrC,MAAM,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,CAAA;YAC1C,MAAM,EAAE,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,CAAA;YAC1C,IAAI,EAAE,IAAI,EAAE;gBAAE,SAAQ;YACtB,IAAI,EAAE;gBAAE,OAAO,CAAC,CAAA;YAChB,IAAI,EAAE;gBAAE,OAAO,CAAC,CAAC,CAAA;YACjB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,CAAA;YAC9B,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACrD,CAAC;QACD,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;IAC1B,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACvB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,SAAS,CAAC,KAAoB;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAA;IACrB,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC;SACf,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3D,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;QACvE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,KAAK,MAAM,CAAC,CAAC,CAAE,MAAgB,CAAC,CAAC,CAAE,KAAe,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACnG,CAAC,CAAC,CAAA;AACN,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,WAAW,CAAC,KAAoB;IAC9C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAA;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAY,CAAA;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACnH,OAAO,MAAgB,CAAA;AACzB,CAAC;AASD,MAAM,UAAU,SAAS,CAAC,IAAoB,EAAE,EAA2B,EAAE,KAAyB;IACpG,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;IACpE,IAAI,EAAE,KAAK,OAAO;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAA;IAC1D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC3C,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE;YAAE,SAAQ;QACvD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IACtD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAA;IAC3C,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAA;AACnE,CAAC","sourcesContent":["/**\n * The data protocol's query language (data-protocol §3), applied by the host.\n *\n * The runtime applies the same query to the rows it receives, so a server\n * need not filter to be correct. The host filters anyway — the HTTP connector\n * sends `filter`, `sort`, `offset` and `limit`, and a paged list is only\n * honest when the page is cut after filtering. The semantics follow the\n * runtime's own applier: loose equality, number-looking strings compare as\n * numbers, `contains`/`startsWith` ignore case, a leaf with no value matches.\n */\n\nexport type Row = Record<string, unknown>\n\nexport interface Filter {\n  readonly field?: string\n  readonly operator?: string\n  readonly value?: unknown\n  readonly and?: readonly Filter[]\n  readonly or?: readonly Filter[]\n}\n\nexport interface SortField {\n  readonly field: string\n  readonly direction: 'asc' | 'desc'\n}\n\nfunction readField(row: Row, field: string): unknown {\n  if (field in row) return row[field]\n  let cur: unknown = row\n  for (const part of field.split('.')) {\n    if (cur === null || cur === undefined || typeof cur !== 'object') return undefined\n    cur = (cur as Row)[part]\n  }\n  return cur\n}\n\nconst NUMERIC = /^\\s*[-+]?(\\d+\\.?\\d*|\\.\\d+)(e[-+]?\\d+)?\\s*$/i\n\nfunction numeric(v: unknown): number | undefined {\n  if (typeof v === 'number') return Number.isFinite(v) ? v : undefined\n  if (typeof v === 'boolean') return v ? 1 : 0\n  if (typeof v !== 'string' || !NUMERIC.test(v)) return undefined\n  return Number(v)\n}\n\nfunction looseEq(a: unknown, b: unknown): boolean {\n  if (a === b) return true\n  if (a === null || a === undefined || b === null || b === undefined) return false\n  if (typeof a === 'object' || typeof b === 'object') return false\n  return String(a) === String(b)\n}\n\n/** Numbers (and number-looking strings) first and numerically; the rest as text. */\nfunction compare(a: unknown, b: unknown): number | undefined {\n  if (a === null || a === undefined || b === null || b === undefined) return undefined\n  const na = numeric(a)\n  const nb = numeric(b)\n  if (na !== undefined && nb !== undefined) return na - nb\n  if (na !== undefined) return -1\n  if (nb !== undefined) return 1\n  const sa = String(a)\n  const sb = String(b)\n  return sa < sb ? -1 : sa > sb ? 1 : 0\n}\n\nfunction leaf(actual: unknown, operator: string, expected: unknown): boolean {\n  switch (operator) {\n    case 'eq':\n      return looseEq(actual, expected)\n    case 'neq':\n      return !looseEq(actual, expected)\n    case 'gt':\n    case 'gte':\n    case 'lt':\n    case 'lte': {\n      const c = compare(actual, expected)\n      if (c === undefined) return false\n      return operator === 'gt' ? c > 0 : operator === 'gte' ? c >= 0 : operator === 'lt' ? c < 0 : c <= 0\n    }\n    case 'in':\n      return (Array.isArray(expected) ? expected : [expected]).some((e) => looseEq(actual, e))\n    case 'contains':\n      if (Array.isArray(actual)) return actual.some((x) => looseEq(x, expected))\n      return actual !== null && actual !== undefined && String(actual).toLowerCase().includes(String(expected).toLowerCase())\n    case 'startsWith':\n      return actual !== null && actual !== undefined && String(actual).toLowerCase().startsWith(String(expected).toLowerCase())\n    default:\n      return false\n  }\n}\n\nexport function matches(row: Row, filter: Filter): boolean {\n  const hasLeaf = typeof filter.field === 'string' && filter.field !== '' && typeof filter.operator === 'string' && filter.value !== undefined\n  const ok = hasLeaf ? leaf(readField(row, filter.field as string), filter.operator as string, filter.value) : true\n  const andOk = filter.and && filter.and.length > 0 ? filter.and.every((f) => matches(row, f)) : true\n  const orOk = filter.or && filter.or.length > 0 ? filter.or.some((f) => matches(row, f)) : true\n  return ok && andOk && orOk\n}\n\nexport function sortRows<T extends Row>(rows: readonly T[], sort: readonly SortField[]): T[] {\n  return rows\n    .map((item, index) => ({ item, index }))\n    .sort((a, b) => {\n      for (const s of sort) {\n        const va = readField(a.item, s.field)\n        const vb = readField(b.item, s.field)\n        const na = va === null || va === undefined\n        const nb = vb === null || vb === undefined\n        if (na && nb) continue\n        if (na) return 1\n        if (nb) return -1\n        const c = compare(va, vb) ?? 0\n        if (c !== 0) return s.direction === 'desc' ? -c : c\n      }\n      return a.index - b.index\n    })\n    .map((x) => x.item)\n}\n\n/** `sort=<field>:<direction>,…` as the HTTP connector writes it. */\nexport function parseSort(value: string | null): SortField[] {\n  if (!value) return []\n  return value\n    .split(',')\n    .map((part) => part.trim())\n    .filter(Boolean)\n    .flatMap((part) => {\n      const at = part.lastIndexOf(':')\n      const field = (at === -1 ? part : part.slice(0, at)).trim()\n      const dir = at === -1 ? 'asc' : part.slice(at + 1).trim().toLowerCase()\n      return field ? [{ field, direction: dir === 'desc' ? ('desc' as const) : ('asc' as const) }] : []\n    })\n}\n\n/** `filter=<json>`; `undefined` when absent. Throws on JSON that is not a filter object. */\nexport function parseFilter(value: string | null): Filter | undefined {\n  if (value === null || value.trim() === '') return undefined\n  const parsed = JSON.parse(value) as unknown\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('filter must be a JSON object')\n  return parsed as Filter\n}\n\nexport interface AggregateResult {\n  readonly fn: 'count' | 'sum' | 'avg'\n  readonly field?: string\n  readonly value: number | null\n  readonly count: number\n}\n\nexport function aggregate(rows: readonly Row[], fn: 'count' | 'sum' | 'avg', field: string | undefined): AggregateResult {\n  const base = { fn, ...(field ? { field } : {}), count: rows.length }\n  if (fn === 'count') return { ...base, value: rows.length }\n  if (!field) return { ...base, value: null }\n  const nums: number[] = []\n  for (const r of rows) {\n    const v = readField(r, field)\n    if (v === null || v === undefined || v === '') continue\n    const n = typeof v === 'number' ? v : Number(v)\n    if (Number.isFinite(n)) nums.push(n)\n  }\n  if (nums.length === 0) return { ...base, value: null }\n  const sum = nums.reduce((a, b) => a + b, 0)\n  return { ...base, value: fn === 'sum' ? sum : sum / nums.length }\n}\n"]}

package/dist/host/receipts.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Pages, pointed at the local host's records.
+ *
+ * A receipt declares its data as `entity` sources; with no `connector` the
+ * runner would look for a connection named `graph-lists` that a local app does
+ * not have. A publisher that hosts the app's records MAY rewrite such a
+ * source into a `rest` source against its record endpoints (data-protocol
+ * §2.2), and that is what this does for every source whose `entityType` the
+ * app declares:
+ *
+ *   list       → { kind: "rest", method: "GET", endpoint: "<base>/records/<T>",
+ *                  authProviderRef: "<base>", returns: "data", query? }
+ *   aggregate  → the same, at "<base>/records/<T>/count" (a plain count) or
+ *                "<base>/records/<T>/aggregate?fn=&field=&filter=", so the
+ *                bound value is `{ fn, field?, value, count }` exactly as an
+ *                entity aggregate binds it.
+ *
+ * `authProviderRef` equal to the base is what makes the runner attach the
+ * visitor's session as a bearer token (session-protocol §7). Sources that name
+ * a connector, or a type the app does not declare, are left as written.
+ */
+type Json = Record<string, unknown>;
+/** A copy of `receipt` whose declared entity sources read from `base`. Non-mutating. */
+export declare function rewriteEntitySources(receipt: Json, base: string, declared: ReadonlySet<string>): Json;
+export {};

package/dist/host/receipts.js

@@ -0,0 +1,72 @@
+/**
+ * Pages, pointed at the local host's records.
+ *
+ * A receipt declares its data as `entity` sources; with no `connector` the
+ * runner would look for a connection named `graph-lists` that a local app does
+ * not have. A publisher that hosts the app's records MAY rewrite such a
+ * source into a `rest` source against its record endpoints (data-protocol
+ * §2.2), and that is what this does for every source whose `entityType` the
+ * app declares:
+ *
+ *   list       → { kind: "rest", method: "GET", endpoint: "<base>/records/<T>",
+ *                  authProviderRef: "<base>", returns: "data", query? }
+ *   aggregate  → the same, at "<base>/records/<T>/count" (a plain count) or
+ *                "<base>/records/<T>/aggregate?fn=&field=&filter=", so the
+ *                bound value is `{ fn, field?, value, count }` exactly as an
+ *                entity aggregate binds it.
+ *
+ * `authProviderRef` equal to the base is what makes the runner attach the
+ * visitor's session as a bearer token (session-protocol §7). Sources that name
+ * a connector, or a type the app does not declare, are left as written.
+ */
+const isObject = (v) => Boolean(v) && typeof v === 'object' && !Array.isArray(v);
+const isPersistence = (c) => isObject(c) && (c.capability === 'persistence' || c.capability === 'platform/persistence');
+function rewriteSource(source, base, declared) {
+    if (!isObject(source) || source.kind !== 'entity')
+        return source;
+    const type = source.entityType;
+    if (typeof type !== 'string' || !declared.has(type) || (typeof source.connector === 'string' && source.connector)) {
+        return source;
+    }
+    const { entityType: _t, connector: _c, aggregate, ...rest } = source;
+    const collection = `${base}/records/${encodeURIComponent(type)}`;
+    let endpoint = collection;
+    if (isObject(aggregate)) {
+        const fn = typeof aggregate.fn === 'string' ? aggregate.fn : 'count';
+        const field = typeof aggregate.field === 'string' && aggregate.field ? aggregate.field : undefined;
+        const params = new URLSearchParams();
+        if (fn !== 'count' || field) {
+            params.set('fn', fn);
+            if (field)
+                params.set('field', field);
+        }
+        if (isObject(aggregate.filter))
+            params.set('filter', JSON.stringify(aggregate.filter));
+        const route = fn === 'count' && !field ? 'count' : 'aggregate';
+        const qs = params.toString();
+        endpoint = `${collection}/${route}${qs ? `?${qs}` : ''}`;
+    }
+    return { ...rest, kind: 'rest', method: 'GET', endpoint, authProviderRef: base, returns: 'data' };
+}
+/** A copy of `receipt` whose declared entity sources read from `base`. Non-mutating. */
+export function rewriteEntitySources(receipt, base, declared) {
+    const caps = receipt.capabilities;
+    if (!Array.isArray(caps))
+        return receipt;
+    return {
+        ...receipt,
+        capabilities: caps.map((cap) => {
+            if (!isPersistence(cap))
+                return cap;
+            const c = cap;
+            const config = isObject(c.config) ? c.config : undefined;
+            if (!config || !Array.isArray(config.dataSources))
+                return cap;
+            return {
+                ...c,
+                config: { ...config, dataSources: config.dataSources.map((s) => rewriteSource(s, base, declared)) },
+            };
+        }),
+    };
+}
+//# sourceMappingURL=receipts.js.map

package/dist/host/receipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipts.js","sourceRoot":"","sources":["../../src/host/receipts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAIH,MAAM,QAAQ,GAAG,CAAC,CAAU,EAAa,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAEpG,MAAM,aAAa,GAAG,CAAC,CAAU,EAAW,EAAE,CAC5C,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,KAAK,aAAa,IAAI,CAAC,CAAC,UAAU,KAAK,sBAAsB,CAAC,CAAA;AAE5F,SAAS,aAAa,CAAC,MAAe,EAAE,IAAY,EAAE,QAA6B;IACjF,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAA;IAChE,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAA;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAClH,OAAO,MAAM,CAAA;IACf,CAAC;IACD,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAA;IACpE,MAAM,UAAU,GAAG,GAAG,IAAI,YAAY,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAA;IAChE,IAAI,QAAQ,GAAG,UAAU,CAAA;IACzB,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;QACpE,MAAM,KAAK,GAAG,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;QAClG,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;QACpC,IAAI,EAAE,KAAK,OAAO,IAAI,KAAK,EAAE,CAAC;YAC5B,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACpB,IAAI,KAAK;gBAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACvC,CAAC;QACD,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QACtF,MAAM,KAAK,GAAG,EAAE,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAA;QAC9D,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;QAC5B,QAAQ,GAAG,GAAG,UAAU,IAAI,KAAK,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;IAC1D,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AACnG,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAAC,OAAa,EAAE,IAAY,EAAE,QAA6B;IAC7F,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,CAAA;IACjC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAA;IACxC,OAAO;QACL,GAAG,OAAO;QACV,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YAC7B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAA;YACnC,MAAM,CAAC,GAAG,GAAW,CAAA;YACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;YACxD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;gBAAE,OAAO,GAAG,CAAA;YAC7D,OAAO;gBACL,GAAG,CAAC;gBACJ,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE;aACpG,CAAA;QACH,CAAC,CAAC;KACH,CAAA;AACH,CAAC","sourcesContent":["/**\n * Pages, pointed at the local host's records.\n *\n * A receipt declares its data as `entity` sources; with no `connector` the\n * runner would look for a connection named `graph-lists` that a local app does\n * not have. A publisher that hosts the app's records MAY rewrite such a\n * source into a `rest` source against its record endpoints (data-protocol\n * §2.2), and that is what this does for every source whose `entityType` the\n * app declares:\n *\n *   list       → { kind: \"rest\", method: \"GET\", endpoint: \"<base>/records/<T>\",\n *                  authProviderRef: \"<base>\", returns: \"data\", query? }\n *   aggregate  → the same, at \"<base>/records/<T>/count\" (a plain count) or\n *                \"<base>/records/<T>/aggregate?fn=&field=&filter=\", so the\n *                bound value is `{ fn, field?, value, count }` exactly as an\n *                entity aggregate binds it.\n *\n * `authProviderRef` equal to the base is what makes the runner attach the\n * visitor's session as a bearer token (session-protocol §7). Sources that name\n * a connector, or a type the app does not declare, are left as written.\n */\n\ntype Json = Record<string, unknown>\n\nconst isObject = (v: unknown): v is Json => Boolean(v) && typeof v === 'object' && !Array.isArray(v)\n\nconst isPersistence = (c: unknown): boolean =>\n  isObject(c) && (c.capability === 'persistence' || c.capability === 'platform/persistence')\n\nfunction rewriteSource(source: unknown, base: string, declared: ReadonlySet<string>): unknown {\n  if (!isObject(source) || source.kind !== 'entity') return source\n  const type = source.entityType\n  if (typeof type !== 'string' || !declared.has(type) || (typeof source.connector === 'string' && source.connector)) {\n    return source\n  }\n  const { entityType: _t, connector: _c, aggregate, ...rest } = source\n  const collection = `${base}/records/${encodeURIComponent(type)}`\n  let endpoint = collection\n  if (isObject(aggregate)) {\n    const fn = typeof aggregate.fn === 'string' ? aggregate.fn : 'count'\n    const field = typeof aggregate.field === 'string' && aggregate.field ? aggregate.field : undefined\n    const params = new URLSearchParams()\n    if (fn !== 'count' || field) {\n      params.set('fn', fn)\n      if (field) params.set('field', field)\n    }\n    if (isObject(aggregate.filter)) params.set('filter', JSON.stringify(aggregate.filter))\n    const route = fn === 'count' && !field ? 'count' : 'aggregate'\n    const qs = params.toString()\n    endpoint = `${collection}/${route}${qs ? `?${qs}` : ''}`\n  }\n  return { ...rest, kind: 'rest', method: 'GET', endpoint, authProviderRef: base, returns: 'data' }\n}\n\n/** A copy of `receipt` whose declared entity sources read from `base`. Non-mutating. */\nexport function rewriteEntitySources(receipt: Json, base: string, declared: ReadonlySet<string>): Json {\n  const caps = receipt.capabilities\n  if (!Array.isArray(caps)) return receipt\n  return {\n    ...receipt,\n    capabilities: caps.map((cap) => {\n      if (!isPersistence(cap)) return cap\n      const c = cap as Json\n      const config = isObject(c.config) ? c.config : undefined\n      if (!config || !Array.isArray(config.dataSources)) return cap\n      return {\n        ...c,\n        config: { ...config, dataSources: config.dataSources.map((s) => rewriteSource(s, base, declared)) },\n      }\n    }),\n  }\n}\n"]}

package/dist/host/records.d.ts

@@ -0,0 +1,73 @@
+/**
+ * The app's own records, in memory (data-protocol §5).
+ *
+ * One collection per entity type declared in `app/definitions/entities.json`,
+ * seeded on first use from `app/data/` (see `readSeed`). A record is
+ * `{ …fields, id, entityType, createdAt, updatedAt }`, fields spread at the
+ * top level like the reference server's.
+ *
+ * ACCESS, read off the declarations — a deliberately small version of what a
+ * hosted session server decides:
+ *
+ *  - `auth.json` `required: true`: every data request needs a session
+ *    (`401 SIGN_IN_REQUIRED`).
+ *  - A collection is OWNER-SCOPED when an `access.rules[]` entry names it and
+ *    is not a public read grant (subject `public`/`anyone`/`visitors`/…, a
+ *    rule that grants reading and does not say "own"), when the entity
+ *    declares an owner field (`owner`, `ownerId`, `userId`, `createdBy`, …),
+ *    or when the entity carries `"scope": "owner"`. An owner-scoped collection
+ *    needs a session, lists only the caller's rows, and answers another
+ *    visitor's row as `404`.
+ *  - Every other collection is shared by the whole app: anyone may read and
+ *    write it.
+ */
+import { type AuthDeclaration, type EntityDeclaration } from './definitions.js';
+import { type AggregateResult, type Row } from './query.js';
+import type { Principal } from './tokens.js';
+export type Scope = 'project' | 'owner';
+export declare function scopeOf(entity: EntityDeclaration, auth: AuthDeclaration | undefined): Scope;
+export interface Caller {
+    readonly principal: Principal | undefined;
+}
+export interface ListAnswer {
+    readonly data: Row[];
+    readonly meta: {
+        readonly total: number;
+        readonly scope: Scope;
+        readonly timestamp: string;
+    };
+}
+export interface AggregateAnswer {
+    readonly data: AggregateResult;
+    readonly meta: {
+        readonly scope: Scope;
+        readonly timestamp: string;
+    };
+}
+/** The data the request is about: which collection, under which declaration, for whom. */
+export interface Target {
+    readonly entity: EntityDeclaration;
+    readonly auth: AuthDeclaration | undefined;
+    readonly caller: Caller;
+}
+export declare class RecordStore {
+    private readonly root;
+    private readonly devUser;
+    private readonly collections;
+    private clock;
+    constructor(root: string, devUser: Principal);
+    reset(): void;
+    private collection;
+    /** Refuses a caller the declarations do not let in; answers the collection's scope. */
+    private guard;
+    /** The rows this caller may see, newest change first, after `filter`. */
+    private visible;
+    list(target: Target, params: URLSearchParams): ListAnswer;
+    /** `/count` (`plainCount`) or `/aggregate?fn&field`. */
+    aggregate(target: Target, params: URLSearchParams, plainCount: boolean): AggregateAnswer;
+    private find;
+    read(target: Target, id: string): Row;
+    create(target: Target, body: Record<string, unknown>): Row;
+    update(target: Target, id: string, body: Record<string, unknown>): Row;
+    remove(target: Target, id: string): void;
+}