@suluk/platform 0.1.4 → 0.1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suluk/platform",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "The platform generator (C051): write one `definePlatform` manifest → it plans the shadcn-registry adds, generates the wired Hono entry, and merges each module's provision fragment into a single provision.config. The manifest compiles to a shadcn-add list + a C047 provision.config; the generator runs the adds + `@suluk/provision`. Turns the Suluk backend registry into a one-command platform. CANDIDATE tooling.",
   "publishConfig": {
   "access": "public"

package/src/catalog.ts

@@ -21,8 +21,10 @@ export interface CatalogEntry {
 export const CATALOG: Record<string, CatalogEntry> = {
   app: { mount: { kind: "base" } },
   auth: { mount: { kind: "middleware", symbol: "mountAuthRoutes", from: "./auth" }, provision: { symbol: "authProvision", from: "./src/provision/auth" } },
+  // the contract is a MIDDLEWARE mount: it installs the scope gate (enforceApiKeyScope) + GET /api/openapi.json. Place it
+  // after `auth` in the manifest so the gate runs after identity/apiKeyAuth set keyId/scopes. Derived + stateless.
+  contract: { mount: { kind: "middleware", symbol: "mountContract", from: "./routes/contract" } },
   // feature routes mount under /api/* — where the caller-resolution + cors + rate-limit middleware live (toolfactory parity).
-  contract: { mount: { kind: "route", path: "/api", symbol: "contractRoutes", from: "./routes/contract" } }, // serves GET /api/openapi.json (derived); stateless
   credits: { mount: { kind: "route", path: "/api/credits", symbol: "creditsRoutes", from: "./routes/credits" }, provision: { symbol: "creditsProvision", from: "./src/provision/credits" } },
   keys: { mount: { kind: "route", path: "/api/keys", symbol: "keysRoutes", from: "./routes/keys" }, provision: { symbol: "keysProvision", from: "./src/provision/keys" } },
   billing: { mount: { kind: "route", path: "/api/billing", symbol: "billingRoutes", from: "./routes/billing" }, provision: { symbol: "billingProvision", from: "./src/provision/billing" } },
@@ -33,6 +35,8 @@ export const CATALOG: Record<string, CatalogEntry> = {
   // cross-cutting MIDDLEWARE (apply globally via app.use, emitted before any route) — not routed resources.
   "rate-limit": { mount: { kind: "middleware", symbol: "mountRateLimit", from: "./services/rate-limit" } },
   i18n: { mount: { kind: "middleware", symbol: "mountI18n", from: "./services/i18n" } },
+  reference: { mount: { kind: "route", path: "/api/reference", symbol: "referenceRoutes", from: "./routes/reference" } }, // derived doc render — no provision
+  admin: { mount: { kind: "route", path: "/api/admin", symbol: "adminRoutes", from: "./routes/admin" } }, // reads existing tables — no provision
   logs: { mount: { kind: "route", path: "/api/logs", symbol: "logsRoutes", from: "./routes/logs" }, provision: { symbol: "logsProvision", from: "./src/provision/logs" } },
   // dev/CI tooling — pulled in as files, no runtime mount, no provision fragment.
   journeys: { mount: { kind: "dev" } },

package/test/plan.test.ts

@@ -83,14 +83,24 @@ describe("cost (route + provision) + dev modules (journeys/audit — files only)
     expect(lastMw).toBeLessThan(p.entry.indexOf('app.route("/api/credits"'));
   });
 
-  test("contract mounts at /api (serving /api/openapi.json) with NO provision; feature routes are under /api/*", () => {
+  test("contract is a MIDDLEWARE mount (scope gate + /api/openapi.json), emitted before routes; feature routes under /api/*", () => {
     const p = planPlatform(definePlatform({ name: "c", registry: "acme/reg", services: ["auth", "contract", "credits"] }));
-    expect(p.entry).toContain('import { contractRoutes } from "./routes/contract";');
-    expect(p.entry).toContain('app.route("/api", contractRoutes());');
+    expect(p.entry).toContain('import { mountContract } from "./routes/contract";');
+    expect(p.entry).toContain("mountContract(app);");
     expect(p.entry).toContain('app.route("/api/credits", creditsRoutes());'); // toolfactory-parity /api/* prefix
+    // the gate (middleware) is emitted before any route.
+    expect(p.entry.indexOf("mountContract(app);")).toBeLessThan(p.entry.indexOf('app.route("/api/credits"'));
     expect(p.provisionConfig).not.toContain("contractProvision");
   });
 
+  test("reference + admin mount /api routes with NO provision (derived / reads existing tables)", () => {
+    const p = planPlatform(definePlatform({ name: "ra", registry: "acme/reg", services: ["auth", "contract", "reference", "admin", "credits"] }));
+    expect(p.entry).toContain('app.route("/api/reference", referenceRoutes());');
+    expect(p.entry).toContain('app.route("/api/admin", adminRoutes());');
+    expect(p.provisionConfig).not.toContain("referenceProvision");
+    expect(p.provisionConfig).not.toContain("adminProvision");
+  });
+
   test("dev modules add shadcn refs but NO entry mount and NO provision fragment", () => {
     expect(plan.adds).toContain("acme/reg/journeys");
     expect(plan.adds).toContain("acme/reg/audit");