@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/schema-edit/apply-schema-change.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Commit the schema change, then apply it.
+ *
+ * The order is the load-bearing part of this module and the reason it exists as
+ * a unit rather than as two calls a caller makes in whichever order.
+ *
+ * The two failure directions are not symmetric:
+ *
+ * - **Apply first, commit fails.** The database has a column the repository does
+ *   not describe. The ensure path is strictly additive — it never drops
+ *   anything — so the next deploy neither removes the column nor mentions it. It
+ *   sits there, absent from the collections and invisible to the API, until
+ *   somebody goes looking. Nothing in the system detects this state.
+ * - **Commit first, apply fails.** The repository describes a column the
+ *   database does not have. That is the ordinary state of every project between
+ *   an edit and a deploy, and boot's ensure reconciles it on the next start.
+ *
+ * So: commit, then apply. The bad half of the dual write lands in the direction
+ * the system already handles, and a failed apply is reported as a *state* rather
+ * than thrown as an error — because "committed, will apply on next boot" is not
+ * a failure, it is a slower success.
+ *
+ * ## Both dependencies are injected
+ *
+ * `git` and `apply` are interfaces, not imports. That keeps this testable
+ * without a repository or a database — which matters, because the thing worth
+ * testing here is the ordering and what happens when half of it fails, and both
+ * are impossible to exercise against real infrastructure on demand.
+ */
+import type { SchemaChangeFile, SchemaChangePlan, ClassifiedSchemaChanges } from "@rebasepro/types";
+/** The working tree the commit lands in. */
+export interface SchemaEditRepository {
+    /** Absolute path, for reporting. */
+    root: string;
+    /** The branch the commit will land on. */
+    currentBranch(): Promise<string>;
+    /**
+     * Paths that are already modified and not ours.
+     *
+     * A commit that sweeps up somebody's half-finished work is worse than a
+     * refusal, and this is the one thing a schema editor cannot see coming.
+     */
+    dirtyPaths(): Promise<string[]>;
+    /** Write every file, creating directories as needed. */
+    writeFiles(files: SchemaChangeFile[]): Promise<void>;
+    /** Stage exactly these paths and commit them. Returns the new sha. */
+    commit(paths: string[], message: string): Promise<string>;
+    /**
+     * The current contents of one file, or `undefined` when it does not exist.
+     *
+     * Needed by a deployment whose source is not on the machine. The AST editor
+     * rewrites a collection *file*, so a bundle — which ships compiled output —
+     * has nothing for it to open; the file has to come from the repository
+     * first. A missing file is not an error: a new collection has no source yet,
+     * and the editor creates one.
+     *
+     * Optional. A local working tree could implement it and does not need to:
+     * the file is already on the disk the editor reads.
+     */
+    readFile?(path: string): Promise<string | undefined>;
+}
+/** Runs the DDL. Separate from the repository so neither knows about the other. */
+export type SchemaEditApply = (statements: string[]) => Promise<void>;
+export interface SchemaEditInput {
+    /**
+     * What to write and run, from `admin.planSchemaChange`.
+     *
+     * Taken as a plan rather than as collections because planning is
+     * engine-specific and this module is not: it commits files and runs
+     * statements, and does not care which database rendered them.
+     */
+    plan: SchemaChangePlan;
+    repository: SchemaEditRepository;
+    apply: SchemaEditApply;
+    /**
+     * Rewrite the collection source, returning the files it touched.
+     *
+     * Called from **inside** this module, after the dirty-tree check and before
+     * the commit. It has to be: the AST editor writes through the filesystem
+     * rather than through {@link SchemaEditRepository}, so a caller that wrote
+     * first and handed the files over would already have made the tree dirty,
+     * and the check below would refuse the change on the evidence of its own
+     * edit.
+     *
+     * That is not hypothetical — it is what `/apply` did. Every change was
+     * refused with a dirty tree, because `git status --porcelain` reports
+     * untracked files too and a new collection's source file is always
+     * untracked. The rewritten file was left behind either way, so the retry
+     * found a dirty tree as well and the surface could never succeed.
+     *
+     * Optional: a caller holding the contents already, with no disk to write
+     * them through, puts them on `plan.files` and omits this.
+     */
+    writeSource?: () => Promise<SchemaChangeFile[]>;
+    /**
+     * The paths {@link writeSource} is going to touch.
+     *
+     * Needed *before* it runs so they can join the dirty check — the point of
+     * which is to read the tree before this change has touched it. The caller
+     * can derive them (`<collectionsDir>/<id>.ts`) without writing anything.
+     */
+    sourcePaths?: string[];
+}
+export interface SchemaEditResult {
+    committed: {
+        sha: string;
+        branch: string;
+        files: string[];
+    };
+    /** True when the DDL ran. False means committed and pending a boot. */
+    applied: boolean;
+    /** Why the apply did not run, when it did not. Never a reason to fail. */
+    applyError?: string;
+    statements: string[];
+    classified: ClassifiedSchemaChanges;
+    /** What to tell the person who pressed the button. */
+    summary: string;
+}
+/**
+ * The plan says the change is not applicable.
+ *
+ * Re-checked here rather than trusted from the planner: this module is the one
+ * that writes and runs things, so the guarantee belongs where the consequence
+ * is. A caller that built a plan by hand cannot route around it.
+ */
+export declare class UnapplicableChangeError extends Error {
+    readonly classified: ClassifiedSchemaChanges;
+    constructor(message: string, classified: ClassifiedSchemaChanges);
+}
+export declare class DirtyWorkingTreeError extends Error {
+    readonly paths: string[];
+    constructor(paths: string[]);
+}
+/**
+ * Generate the commit, land it, then run the DDL.
+ *
+ * Throws only for things that mean *nothing happened*: a change the ensure path
+ * cannot express, a dirty tree, or a failed commit. Once the commit lands,
+ * every outcome is a result.
+ */
+export declare function applySchemaChange(input: SchemaEditInput): Promise<SchemaEditResult>;

package/dist/schema-edit/github-repository.d.ts

@@ -0,0 +1,67 @@
+import type { SchemaEditRepository } from "./apply-schema-change.js";
+/**
+ * How to authenticate to GitHub.
+ *
+ * Two ways, because there are two deployments. A Cloud tenant is one of many
+ * behind a single app, so it authenticates as an *installation* of that app and
+ * holds no credential of its own. A self-hoster running a bundle has the same
+ * problem — no source on the machine — and no app: standing one up so that a
+ * server can commit to a repository they already own would be a great deal of
+ * ceremony around a one-line credential.
+ *
+ * Both end in the same place. Everything past the bearer token is the plain Git
+ * Data API and is identical for either, which is the point: the cloud is a
+ * better implementation of this interface, never the only one.
+ */
+export type GitHubAuth = {
+    kind: "app";
+    /** Numeric app id, or the client id — GitHub accepts either as `iss`. */
+    appId: string;
+    /**
+     * The app's private key, PEM.
+     *
+     * Accepts the literal PEM, a PEM with escaped newlines, or base64 —
+     * pass it through `normalizePemFromEnv` first, which is what the boot
+     * path does.
+     */
+    privateKey: string;
+    /** Which installation to act as. Produced when the app is installed. */
+    installationId: string;
+} | {
+    kind: "token";
+    /**
+     * A personal access token, or a fine-grained token with write access to
+     * the repository's contents. Used as the bearer directly — there is
+     * nothing to exchange and nothing to cache.
+     */
+    token: string;
+};
+export interface GitHubRepositoryOptions {
+    auth: GitHubAuth;
+    owner: string;
+    repo: string;
+    /** Branch to commit onto. */
+    branch: string;
+    /** Attribution for the commit. */
+    author?: {
+        name: string;
+        email: string;
+    };
+    /** Injected for tests. Defaults to the global. */
+    fetchImpl?: typeof fetch;
+    /** Injected so token expiry is testable without waiting an hour. */
+    now?: () => number;
+}
+export declare class GitHubApiError extends Error {
+    readonly status: number;
+    readonly path: string;
+    constructor(status: number, path: string, detail: string);
+}
+/**
+ * A JWT authenticating the app itself.
+ *
+ * `iat` is backdated by a minute: GitHub rejects a token whose `iat` is in its
+ * future, and a server clock a few seconds fast is enough to trigger it.
+ */
+export declare function createAppJwt(appId: string, privateKey: string, nowMs: number): string;
+export declare function createGitHubRepository(options: GitHubRepositoryOptions): SchemaEditRepository;

package/dist/schema-edit/local-git-repository.d.ts

@@ -0,0 +1,28 @@
+import type { SchemaEditRepository } from "./apply-schema-change.js";
+export interface LocalGitOptions {
+    /** Absolute path to the working tree the collections live in. */
+    root: string;
+    /**
+     * Who the commit is attributed to. Defaults to the repository's own git
+     * config, which is right for a developer's machine and wrong for a server
+     * — a panel edit should say which account made it.
+     */
+    author?: {
+        name: string;
+        email: string;
+    };
+}
+export declare class GitCommandError extends Error {
+    constructor(command: string, detail: string);
+}
+/**
+ * The top of the working tree containing `startDir`, or undefined.
+ *
+ * Resolved by asking git rather than by walking for a `.git`, because a
+ * worktree's `.git` is a file and a submodule's is neither where nor what a
+ * naive walk expects.
+ */
+export declare function findRepositoryRoot(startDir: string): Promise<string | undefined>;
+/** True when `root` is inside a git working tree. */
+export declare function isGitRepository(root: string): Promise<boolean>;
+export declare function createLocalGitRepository(options: LocalGitOptions): SchemaEditRepository;

package/dist/schema-edit/project-root.d.ts

@@ -0,0 +1,43 @@
+import { type SchemaCommitPaths } from "@rebasepro/types";
+/**
+ * The nearest ancestor of `startDir` holding a `rebase.json`.
+ *
+ * Bounded, like the storage-source loader it mirrors: an unbounded walk from a
+ * misconfigured path climbs to the filesystem root and reads whatever it finds
+ * there. `undefined` when there is none, which is a project that predates the
+ * file — the caller then keeps the historical behaviour rather than guessing.
+ */
+/**
+ * Where a scaffolded project keeps its collection source, project-relative.
+ *
+ * A bundle's own collections directory is compiled output, so nothing on the
+ * running machine points at this. A deployment committing to a repository states
+ * it, and this is the default it states nothing against.
+ */
+export declare const DEFAULT_COLLECTIONS_PATH = "config/collections";
+export declare function findProjectRoot(startDir: string, levels?: number): string | undefined;
+/**
+ * The generated-artifact paths for a project, expressed relative to the
+ * repository that will hold the commit.
+ *
+ * Returns `undefined` when there is nothing to correct — no project marker, or
+ * a project that *is* the repository — so the caller passes no override and the
+ * defaults stand. Saying "no change needed" is different from saying
+ * "the change is a no-op prefix", and only the first leaves the existing
+ * behaviour untouched for every project that already worked.
+ */
+export declare function commitPathsFor(collectionsDir: string, repositoryRoot: string): Partial<SchemaCommitPaths> | undefined;
+/**
+ * Does this project keep versioned migrations?
+ *
+ * It matters because live schema editing does not write one, and cannot: a
+ * migration is Atlas's format with an integrity file, minted by an external
+ * binary against a throwaway database. A server process has neither.
+ *
+ * What it *does* write is `drizzle/schema.sql`, which is exactly the input
+ * `rebase db generate` diffs against — so the migration is one command away.
+ * The hazard is nobody saying so. A project that deploys by replaying
+ * migrations would build its next environment without this change, having been
+ * told the change was applied.
+ */
+export declare function usesVersionedMigrations(collectionsDir: string): boolean;

package/dist/schema-edit/remote-source.d.ts

@@ -0,0 +1,25 @@
+import type { SchemaChangeFile } from "@rebasepro/types";
+import type { SchemaEditRepository } from "./apply-schema-change.js";
+export interface RemoteSourceOptions {
+    repository: SchemaEditRepository;
+    /**
+     * Where the collection *source* lives in the repository, as a repo-relative
+     * posix path — `config/collections`, or `app/config/collections` for a
+     * project in a subdirectory.
+     *
+     * Not derivable from the bundle: its `collectionsDir` points at compiled
+     * output, which is a different directory holding different files.
+     */
+    collectionsPath: string;
+    /** Applies the edit. Injected so this module needs no `ts-morph`. */
+    edit: (collectionsDir: string, collectionId: string, collection: Record<string, unknown>) => Promise<void>;
+}
+/**
+ * Fetch, rewrite, and return the changed file — without leaving anything behind.
+ *
+ * The scratch directory is removed on every path, including the failing one. It
+ * holds a copy of the customer's collection source, and a temp directory that
+ * accumulates those on a long-running server is a slow leak of exactly the
+ * thing worth not leaking.
+ */
+export declare function rewriteRemoteCollection(options: RemoteSourceOptions, collectionId: string, collection: Record<string, unknown>): Promise<SchemaChangeFile[]>;

package/dist/schema-edit/schema-edit-permissions.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Who may plan a schema change, and who may apply one.
+ *
+ * Being an admin is one privilege. Applying a schema change is two: it alters
+ * the database, and it writes a commit into the project's repository under
+ * somebody's name. `requireAdmin` in front of both routes answers the first
+ * question and never asks the second.
+ *
+ * `admin-roles.ts` says the rest of it: `schema-admin` is administrative
+ * "by any definition that matters", and "if a genuinely lesser role is added
+ * later, it does not belong in this list — it belongs in a capability check of
+ * its own". This is that check.
+ *
+ * ## The split that matters is not between roles
+ *
+ * It is between a person and a machine.
+ *
+ * `plan` has no side effects. It reads the collections, reads the database
+ * catalogue, and answers what would happen. Anyone already through the admin
+ * gate may do it, and a CI job that wants to know whether a proposed collection
+ * change is applicable is a *good* use of this API.
+ *
+ * `apply` commits. The commit carries an author, and the author is the point —
+ * the code that builds it says so: a schema change with an author and a diff in
+ * the project's history is the thing worth having, and an anonymous one is just
+ * a commit. A service key has no author. `api-key:7c3f…` has no author. Letting
+ * either write to the project's source produces exactly the unattributable
+ * history the feature exists to replace, and does it with a credential that is
+ * likely to be sitting in a CI environment variable.
+ *
+ * So machines plan by default and do not apply. An operator who genuinely wants
+ * an automated schema change — a migration pipeline, say — turns it on
+ * deliberately and gets a commit that says plainly which key made it.
+ */
+/** What a caller is allowed to do with the live schema editor. */
+export interface SchemaEditCapabilities {
+    /** Preview a change. No side effects. */
+    plan: boolean;
+    /** Commit the change and run the DDL. */
+    apply: boolean;
+    /**
+     * Why `apply` is denied, when it is and `plan` is not.
+     *
+     * Carried so the panel can grey out the button *and say why*, rather than
+     * letting somebody read a plan, decide, press, and only then be refused.
+     */
+    reason?: string;
+    /** A stable code for the refusal, for clients that branch rather than read. */
+    code?: string;
+}
+/** The kind of caller, which is what the `apply` decision turns on. */
+export type PrincipalKind = "person" | "machine" | "anonymous";
+export interface SchemaEditPrincipal {
+    kind: PrincipalKind;
+    /** Empty for an anonymous caller. */
+    uid: string;
+    roles: string[];
+    /** How the machine identified itself, for the refusal message. */
+    machineKind?: "service-key" | "api-key";
+}
+/** Read the caller off the request context's `user`. */
+export declare function classifyPrincipal(user: unknown): SchemaEditPrincipal;
+/**
+ * A repository that is not on this machine.
+ *
+ * Configured by a deployment running built output — every Cloud tenant, and any
+ * self-host serving a bundle. Without it, live schema editing needs the source
+ * on disk and refuses when there is none.
+ */
+export interface RemoteRepositoryConfig {
+    kind: "github";
+    owner: string;
+    repo: string;
+    /** Defaults to `main`. */
+    branch?: string;
+    /**
+     * Where the collection **source** lives in that repository, repo-relative.
+     * Defaults to `config/collections`.
+     *
+     * Not derivable from the running bundle, whose collections directory holds
+     * compiled output — a different directory with different files.
+     */
+    collectionsPath?: string;
+    /**
+     * A GitHub App installation, or a token.
+     *
+     * The app is for a control plane holding one key across many projects; the
+     * token is for a single self-hoster who would otherwise have to stand one
+     * up to let their own server commit to their own repository.
+     */
+    auth: {
+        kind: "app";
+        appId: string;
+        privateKey: string;
+        installationId: string;
+    } | {
+        kind: "token";
+        token: string;
+    };
+}
+export interface SchemaEditPolicy {
+    /**
+     * Let a service key or an API key commit a schema change.
+     *
+     * Off by default. On, the commit is attributed to the credential rather
+     * than to a person, and says so — see {@link machineCommitAuthor}.
+     */
+    allowMachineApply?: boolean;
+}
+/**
+ * What this caller may do.
+ *
+ * Assumes the admin gate has already run — this refines that decision rather
+ * than replacing it, and an anonymous caller should never have reached here.
+ * Handled anyway, because a capability function that trusts its caller to have
+ * checked is one bad refactor away from granting everything.
+ */
+export declare function schemaEditCapabilities(principal: SchemaEditPrincipal, policy?: SchemaEditPolicy): SchemaEditCapabilities;
+/**
+ * The git identity for a machine that has been allowed to apply.
+ *
+ * Named for what it is. An operator reading `git log` a month from now should
+ * be able to tell a change somebody made from one a pipeline made, and a
+ * credential wearing a person-shaped name is how that distinction is lost.
+ */
+export declare function machineCommitAuthor(principal: SchemaEditPrincipal): {
+    name: string;
+    email: string;
+};

package/dist/schema-editor-routes-Bf5h5Emf.js

@@ -0,0 +1,87 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
+import { a as record, i as object, o as string, r as boolean, s as unknown } from "./schemas-DBxgjM9A.js";
+import { AstSchemaEditor } from "./ast-schema-editor-BrarYZCq.js";
+import { Hono } from "hono";
+//#region src/api/schema-editor-routes.ts
+/**
+* Rewriting collection source from the admin panel.
+*
+* Every refusal in `AstSchemaEditor` is written for the person who will read it
+* — "Collection X has no file at …", "Relation Y has no target collection. Pick
+* one before saving." — and every one of them was a plain `Error`, which
+* `errorHandler` treats as an unexpected failure: 500, and a body that says
+* "Internal Server Error". The messages never left the server. They are 400s
+* now, so the panel can show what it was told.
+*/
+function refusalsAsBadRequest(run) {
+	return run().catch((error) => {
+		if (error instanceof ApiError) throw error;
+		throw ApiError.badRequest(error instanceof Error ? error.message : String(error), "SCHEMA_EDIT_REFUSED");
+	});
+}
+/** The identifier half of every payload here, checked once. */
+var collectionIdSchema = string().min(1, "`collectionId` is required");
+var propertyKeySchema = string().min(1, "`propertyKey` is required");
+var propertySaveSchema = object({
+	collectionId: collectionIdSchema,
+	propertyKey: propertyKeySchema,
+	propertyConfig: record(string(), unknown())
+});
+var propertyDeleteSchema = object({
+	collectionId: collectionIdSchema,
+	propertyKey: propertyKeySchema
+});
+var collectionSaveSchema = object({
+	collectionId: collectionIdSchema,
+	collectionData: record(string(), unknown()),
+	partial: boolean().optional()
+});
+var collectionDeleteSchema = object({ collectionId: collectionIdSchema });
+/** Parse a body against a schema, or 400 naming the field. */
+async function body(c, schema) {
+	const raw = await c.req.json().catch(() => void 0);
+	const parsed = schema.safeParse(raw);
+	if (!parsed.success) throw ApiError.badRequest(parsed.error.issues.map((i) => `${i.path.join(".") || "body"}: ${i.message}`).join("; "), "INVALID_INPUT");
+	return parsed.data;
+}
+function createSchemaEditorRoutes(collectionsDir) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	const editor = new AstSchemaEditor(collectionsDir);
+	router.post("/property/save", async (c) => {
+		const { collectionId, propertyKey, propertyConfig } = await body(c, propertySaveSchema);
+		await refusalsAsBadRequest(() => editor.saveProperty(collectionId, propertyKey, propertyConfig));
+		return c.json({ success: true });
+	});
+	router.post("/property/delete", async (c) => {
+		const { collectionId, propertyKey } = await body(c, propertyDeleteSchema);
+		await refusalsAsBadRequest(() => editor.deleteProperty(collectionId, propertyKey));
+		return c.json({ success: true });
+	});
+	/**
+	* `partial: true` means "this payload is what changed", not "this is the
+	* collection". Without it a one-key patch — which is what adding a column
+	* posts — is read as a whole-collection save and deletes everything it does
+	* not mention, `securityRules` included. Absent, it defaults to a full save,
+	* so an older panel keeps the behaviour it was written against.
+	*/
+	router.post("/collection/save", async (c) => {
+		const { collectionId, collectionData, partial } = await body(c, collectionSaveSchema);
+		await refusalsAsBadRequest(() => editor.saveCollection(collectionId, collectionData, { partial: partial === true }));
+		return c.json({ success: true });
+	});
+	router.post("/collection/delete", async (c) => {
+		const { collectionId } = await body(c, collectionDeleteSchema);
+		await refusalsAsBadRequest(() => editor.deleteCollection(collectionId));
+		return c.json({ success: true });
+	});
+	return router;
+}
+//#endregion
+export { createSchemaEditorRoutes };
+
+//# sourceMappingURL=schema-editor-routes-Bf5h5Emf.js.map

package/dist/schema-editor-routes-Bf5h5Emf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-editor-routes-Bf5h5Emf.js","names":[],"sources":["../src/api/schema-editor-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport { z } from \"zod\";\nimport { AstSchemaEditor } from \"./ast-schema-editor\";\nimport { ApiError, errorHandler } from \"./errors\";\nimport { HonoEnv } from \"./types\";\n\n/**\n * Rewriting collection source from the admin panel.\n *\n * Every refusal in `AstSchemaEditor` is written for the person who will read it\n * — \"Collection X has no file at …\", \"Relation Y has no target collection. Pick\n * one before saving.\" — and every one of them was a plain `Error`, which\n * `errorHandler` treats as an unexpected failure: 500, and a body that says\n * \"Internal Server Error\". The messages never left the server. They are 400s\n * now, so the panel can show what it was told.\n */\nfunction refusalsAsBadRequest<T>(run: () => Promise<T>): Promise<T> {\n    return run().catch((error: unknown) => {\n        if (error instanceof ApiError) throw error;\n        throw ApiError.badRequest(\n            error instanceof Error ? error.message : String(error),\n            \"SCHEMA_EDIT_REFUSED\"\n        );\n    });\n}\n\n/** The identifier half of every payload here, checked once. */\nconst collectionIdSchema = z.string().min(1, \"`collectionId` is required\");\nconst propertyKeySchema = z.string().min(1, \"`propertyKey` is required\");\n\nconst propertySaveSchema = z.object({\n    collectionId: collectionIdSchema,\n    propertyKey: propertyKeySchema,\n    propertyConfig: z.record(z.string(), z.unknown())\n});\nconst propertyDeleteSchema = z.object({\n    collectionId: collectionIdSchema,\n    propertyKey: propertyKeySchema\n});\nconst collectionSaveSchema = z.object({\n    collectionId: collectionIdSchema,\n    collectionData: z.record(z.string(), z.unknown()),\n    partial: z.boolean().optional()\n});\nconst collectionDeleteSchema = z.object({\n    collectionId: collectionIdSchema\n});\n\n/** Parse a body against a schema, or 400 naming the field. */\nasync function body<S extends z.ZodType>(c: { req: { json: () => Promise<unknown> } }, schema: S): Promise<z.infer<S>> {\n    const raw = await c.req.json().catch(() => undefined);\n    const parsed = schema.safeParse(raw);\n    if (!parsed.success) {\n        throw ApiError.badRequest(\n            parsed.error.issues.map(i => `${i.path.join(\".\") || \"body\"}: ${i.message}`).join(\"; \"),\n            \"INVALID_INPUT\"\n        );\n    }\n    return parsed.data;\n}\n\nexport function createSchemaEditorRoutes(collectionsDir: string): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n    const editor = new AstSchemaEditor(collectionsDir);\n\n    router.post(\"/property/save\", async (c) => {\n        const { collectionId, propertyKey, propertyConfig } = await body(c, propertySaveSchema);\n        await refusalsAsBadRequest(() => editor.saveProperty(collectionId, propertyKey, propertyConfig));\n        return c.json({ success: true });\n    });\n\n    router.post(\"/property/delete\", async (c) => {\n        const { collectionId, propertyKey } = await body(c, propertyDeleteSchema);\n        await refusalsAsBadRequest(() => editor.deleteProperty(collectionId, propertyKey));\n        return c.json({ success: true });\n    });\n\n    /**\n     * `partial: true` means \"this payload is what changed\", not \"this is the\n     * collection\". Without it a one-key patch — which is what adding a column\n     * posts — is read as a whole-collection save and deletes everything it does\n     * not mention, `securityRules` included. Absent, it defaults to a full save,\n     * so an older panel keeps the behaviour it was written against.\n     */\n    router.post(\"/collection/save\", async (c) => {\n        const { collectionId, collectionData, partial } = await body(c, collectionSaveSchema);\n        await refusalsAsBadRequest(() =>\n            editor.saveCollection(collectionId, collectionData, { partial: partial === true }));\n        return c.json({ success: true });\n    });\n\n    router.post(\"/collection/delete\", async (c) => {\n        const { collectionId } = await body(c, collectionDeleteSchema);\n        await refusalsAsBadRequest(() => editor.deleteCollection(collectionId));\n        return c.json({ success: true });\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgBA,SAAS,qBAAwB,KAAmC;CAChE,OAAO,IAAI,CAAC,CAAC,OAAO,UAAmB;EACnC,IAAI,iBAAiB,UAAU,MAAM;EACrC,MAAM,SAAS,WACX,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GACrD,qBACJ;CACJ,CAAC;AACL;;AAGA,IAAM,qBAAqB,OAAS,CAAC,CAAC,IAAI,GAAG,4BAA4B;AACzE,IAAM,oBAAoB,OAAS,CAAC,CAAC,IAAI,GAAG,2BAA2B;AAEvE,IAAM,qBAAqB,OAAS;CAChC,cAAc;CACd,aAAa;CACb,gBAAgB,OAAS,OAAS,GAAG,QAAU,CAAC;AACpD,CAAC;AACD,IAAM,uBAAuB,OAAS;CAClC,cAAc;CACd,aAAa;AACjB,CAAC;AACD,IAAM,uBAAuB,OAAS;CAClC,cAAc;CACd,gBAAgB,OAAS,OAAS,GAAG,QAAU,CAAC;CAChD,SAAS,QAAU,CAAC,CAAC,SAAS;AAClC,CAAC;AACD,IAAM,yBAAyB,OAAS,EACpC,cAAc,mBAClB,CAAC;;AAGD,eAAe,KAA0B,GAA8C,QAAgC;CACnH,MAAM,MAAM,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;CACpD,MAAM,SAAS,OAAO,UAAU,GAAG;CACnC,IAAI,CAAC,OAAO,SACR,MAAM,SAAS,WACX,OAAO,MAAM,OAAO,KAAI,MAAK,GAAG,EAAE,KAAK,KAAK,GAAG,KAAK,OAAO,IAAI,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI,GACrF,eACJ;CAEJ,OAAO,OAAO;AAClB;AAEA,SAAgB,yBAAyB,gBAAuC;CAC5E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAC3B,MAAM,SAAS,IAAI,gBAAgB,cAAc;CAEjD,OAAO,KAAK,kBAAkB,OAAO,MAAM;EACvC,MAAM,EAAE,cAAc,aAAa,mBAAmB,MAAM,KAAK,GAAG,kBAAkB;EACtF,MAAM,2BAA2B,OAAO,aAAa,cAAc,aAAa,cAAc,CAAC;EAC/F,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO,KAAK,oBAAoB,OAAO,MAAM;EACzC,MAAM,EAAE,cAAc,gBAAgB,MAAM,KAAK,GAAG,oBAAoB;EACxE,MAAM,2BAA2B,OAAO,eAAe,cAAc,WAAW,CAAC;EACjF,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;;;;;;;;CASD,OAAO,KAAK,oBAAoB,OAAO,MAAM;EACzC,MAAM,EAAE,cAAc,gBAAgB,YAAY,MAAM,KAAK,GAAG,oBAAoB;EACpF,MAAM,2BACF,OAAO,eAAe,cAAc,gBAAgB,EAAE,SAAS,YAAY,KAAK,CAAC,CAAC;EACtF,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO,KAAK,sBAAsB,OAAO,MAAM;EAC3C,MAAM,EAAE,iBAAiB,MAAM,KAAK,GAAG,sBAAsB;EAC7D,MAAM,2BAA2B,OAAO,iBAAiB,YAAY,CAAC;EACtE,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO;AACX"}