@telepath-computer/vault-server 0.1.0

package/README.md

@@ -0,0 +1,123 @@
+# vault-server
+
+`vault-server` makes an Obsidian vault — or any plain folder of markdown files —
+accessible over HTTP. It's a local sidecar for web apps — dashboards, HTML
+artifacts, anything that runs in a browser — that want to query, display,
+and modify records and follow changes live, without touching the filesystem.
+It follows Obsidian's conventions (YAML headers, wikilink references) but
+never requires Obsidian itself: point it at any directory of markdown.
+
+The URL space mirrors the vault: every file serves at its own path, and
+dropping a markdown file's `.md` extension addresses it as structured JSON —
+header parsed into fields, field references resolved. Directory URLs list records; a
+WebSocket upgrade on `/` streams change events. `spec/` is the full contract;
+this README shows the working surface.
+
+## Install and run
+
+Node.js 24 or later.
+
+```sh
+npm install -g @telepath-computer/vault-server
+vault-server                  # serve the current directory
+vault-server /path/to/vault   # or an explicit vault root
+```
+
+`--host` (default `127.0.0.1`) and `--port` (default `4747`) adjust binding.
+
+The server binds localhost only by default and has no authentication —
+expose it beyond the local machine at your own risk. CORS is wide open
+(`Access-Control-Allow-Origin: *`), so browser pages from any origin can
+call it directly.
+
+## Read
+
+```sh
+curl http://127.0.0.1:4747/journal/today     # record as JSON
+curl http://127.0.0.1:4747/journal/today.md  # same file, raw markdown
+curl http://127.0.0.1:4747/photos/cat.jpg    # any file, raw bytes
+```
+
+A record's JSON view:
+
+```json
+{
+  "path": "journal/today",
+  "fields": {
+    "status": "open",
+    "contact": { "$type": "ref", "path": "contacts/jane-doe" }
+  },
+  "body": "Raw markdown below the YAML header.\n",
+  "links": [{ "path": "contacts/jane-doe", "field": "contact" }],
+  "updated": "2026-08-07T09:15:00.000Z"
+}
+```
+
+`fields` is the markdown file's YAML header; `body`, its own key beside
+them, is the markdown below it. A
+field value that is entirely a wikilink (`contact: "[[Jane Doe]]"`) serves
+as a reference resolved against the whole vault — `{ "$type": "ref",
+"path": … }` — the target's API path, fetchable here — plus a `label` when
+the link's rendered text differs. Prose inside
+`body` serves as standard markdown — wikilinks come out as resolved
+relative links, so any renderer navigates them against these same URLs.
+`links` lists every resolved record link touching this record: outbound
+entries name their target, while entries with `backlink: true` name their
+source. `field` identifies the top-level header key; prose links omit it.
+If the frontmatter is invalid, the whole file is returned as `body` with
+empty `fields`, and the record carries `error: { "code":
+"invalid_frontmatter", "message": "Frontmatter could not be parsed" }`.
+
+## Query
+
+A trailing slash lists a directory's records recursively as
+`{ path, fields, body?, updated, error? }`; `body` remains beside `fields`,
+while the single-record `links` list is omitted. There are no query parameters;
+filter and sort in JS:
+
+```js
+const records = await (await fetch("http://127.0.0.1:4747/tasks/")).json();
+const open = records
+  .filter((record) => record.fields.status === "open")
+  .sort((a, b) => b.updated.localeCompare(a.updated));
+```
+
+## Write
+
+Record writes carry the record media type,
+`application/vnd.telepath.record+json` — the content type is what
+distinguishes a record write from an eventual raw-file upload at the
+same kind of URL; the request body is the record's
+`{ fields, body }` — the header object and the text below it, sent
+separately as they are served. PATCH merge-patches `fields` (`null` deletes a
+field) and replaces `body` only when that sibling key is present (`null`
+removes it):
+
+```js
+await fetch("http://127.0.0.1:4747/tasks/fix-roof", {
+  method: "PATCH",
+  headers: { "content-type": "application/vnd.telepath.record+json" },
+  body: JSON.stringify({ fields: { status: "done", due: null } }),
+});
+```
+
+PUT replaces the fields wholesale, creating the record if needed; DELETE
+removes it. All
+writes are atomic on disk, so a syncing vault never sees half a record.
+
+## Subscribe
+
+A WebSocket upgrade on `/` streams every change in the vault — external
+edits included (Obsidian on another device, Dropbox sync), not just writes
+made through the API. Filter by path prefix client-side:
+
+```js
+const socket = new WebSocket("ws://127.0.0.1:4747/");
+socket.onmessage = ({ data }) => {
+  const { type, path } = JSON.parse(data); // created | updated | deleted
+  refresh(path);
+};
+```
+
+Events carry no content and there is no replay: list first, then apply
+events, and re-list whenever the socket reconnects.

package/dist/src/app.d.ts

@@ -0,0 +1,63 @@
+/** Composes the vault HTTP API, filesystem watcher, and WebSocket subscriptions. */
+import { type Server } from "node:http";
+import express from "express";
+import { type RecordContent } from "./notes.ts";
+/** A record in the form it will be stored, offered for approval before it is written. */
+export type ValidatedRecord = RecordContent & {
+    path: string;
+};
+export type Validate = (record: ValidatedRecord) => void | Promise<void>;
+export type LinkFormat = "wikilink" | "markdown";
+export type VaultOptions = {
+    linkFormat?: LinkFormat;
+    rawBodies?: string[];
+};
+export type ServerOptions = {
+    jsonLimit?: string | number;
+    pingIntervalMs?: number;
+};
+export type VaultServerOptions = {
+    root: string;
+    vault?: VaultOptions;
+    server?: ServerOptions;
+    validate?: Validate;
+};
+export declare class VaultServer {
+    readonly app: express.Express;
+    readonly server: Server;
+    /** Resolves once the watcher has indexed the vault and the root is known good. */
+    readonly ready: Promise<void>;
+    private readonly root;
+    private readonly index;
+    private readonly validate;
+    private readonly watcher;
+    private readonly webSockets;
+    private readonly sockets;
+    private readonly pendingIndexRefreshes;
+    private readonly pendingWatcherEvents;
+    private readonly pingTimer;
+    private isReady;
+    private isClosing;
+    private startupRefreshFailed;
+    private startupRefreshError;
+    private boundHost;
+    constructor(options: VaultServerOptions);
+    /** The address the server is bound to, or undefined before listening. */
+    get url(): string | undefined;
+    /** The port actually bound, which for port 0 is the one the OS chose. */
+    get port(): number | undefined;
+    get recordCount(): number;
+    /** Accept connections, once the vault is indexed. Resolves with the server. */
+    listen({ host, port }?: {
+        host?: string;
+        port?: number;
+    }): Promise<this>;
+    close(): Promise<void>;
+    private context;
+    private readonly runMutation;
+    private emitEvent;
+    private handleWatcherChange;
+    private flushWatcherEvent;
+    private cancelPendingWatcherEvent;
+    private refreshIndex;
+}

package/dist/src/app.js

@@ -0,0 +1,463 @@
+/** Composes the vault HTTP API, filesystem watcher, and WebSocket subscriptions. */
+import { createServer } from "node:http";
+import { realpathSync } from "node:fs";
+import { stat } from "node:fs/promises";
+import { relative } from "node:path";
+import chokidar from "chokidar";
+import express from "express";
+import { WebSocketServer, WebSocket } from "ws";
+import { deleteNote, InvalidReferenceError, InvalidUtf8Error, listNotes, mergeFields, readNote, readRawRecord, storedBody, storedFields, VaultIndex, writeNote } from "./notes.js";
+import { hasDotSegment, isVaultPathConfined, resolveVaultPath, toVaultPath } from "./paths.js";
+const noteContentType = "application/vnd.telepath.record+json";
+const watcherDebounceMs = 50;
+/** Raised when a caller's `validate` refuses a write. */
+class ValidationError extends Error {
+}
+export class VaultServer {
+    app;
+    server;
+    /** Resolves once the watcher has indexed the vault and the root is known good. */
+    ready;
+    root;
+    index;
+    validate;
+    watcher;
+    webSockets = new WebSocketServer({ noServer: true });
+    sockets = new Map();
+    pendingIndexRefreshes = new Set();
+    pendingWatcherEvents = new Map();
+    pingTimer;
+    isReady = false;
+    isClosing = false;
+    startupRefreshFailed = false;
+    startupRefreshError;
+    boundHost;
+    constructor(options) {
+        const unknownOption = Object.keys(options).find((key) => !["root", "vault", "server", "validate"].includes(key));
+        if (unknownOption)
+            throw new Error(`unknown VaultServer option "${unknownOption}"; use the "vault" or "server" group`);
+        const { root, vault = {}, server = {}, validate } = options;
+        const { linkFormat = "wikilink", rawBodies = [] } = vault;
+        const { jsonLimit = "32mb", pingIntervalMs = 30_000 } = server;
+        // A symlinked root (e.g. ~/workspace/vault -> ~/Dropbox/Vault) must be
+        // resolved up front: the watcher ignores symlinks, so an unresolved root
+        // would index and watch nothing.
+        this.root = realpathSync(root);
+        this.validate = validate;
+        this.index = new VaultIndex(this.root, undefined, linkFormat, rawBodies);
+        this.app = express();
+        this.app.use((request, response, next) => {
+            response.set("Access-Control-Allow-Origin", "*");
+            if (request.method !== "OPTIONS") {
+                next();
+                return;
+            }
+            response.set({
+                "Access-Control-Allow-Methods": "GET, PUT, PATCH, DELETE",
+                "Access-Control-Allow-Headers": "content-type",
+                "Access-Control-Max-Age": "86400",
+            });
+            if (request.get("Access-Control-Request-Private-Network") === "true") {
+                response.set("Access-Control-Allow-Private-Network", "true");
+            }
+            response.status(204).end();
+        });
+        this.app.use(express.json({ type: (request) => shouldParseNoteBody(request), limit: jsonLimit }));
+        this.app.use(async (request, response) => { await handleRequest(this.context(), request, response); });
+        this.app.use((error, _request, response, _next) => {
+            if (isPayloadTooLarge(error))
+                sendError(response, 413, "request body too large");
+            else if (error instanceof SyntaxError)
+                sendError(response, 400, "malformed JSON");
+            else
+                sendError(response, 500, "internal server error");
+        });
+        this.server = createServer(this.app);
+        this.watcher = chokidar.watch(this.root, {
+            ignoreInitial: false,
+            followSymlinks: false,
+            ignored: (path, stats) => stats?.isSymbolicLink() === true || hasDotSegment(toVaultPath(relative(this.root, path))),
+        });
+        const watcherReady = new Promise((resolve, reject) => {
+            this.watcher.once("ready", resolve);
+            this.watcher.on("error", (error) => {
+                if (!this.isReady)
+                    reject(error);
+                else
+                    console.error("vault-server watcher error", error);
+            });
+        });
+        const rootReady = stat(this.root).then((rootStat) => { if (!rootStat.isDirectory())
+            throw new Error("vault root is not a directory"); });
+        this.ready = Promise.all([watcherReady, rootReady]).then(async () => {
+            while (this.pendingIndexRefreshes.size > 0)
+                await Promise.all([...this.pendingIndexRefreshes]);
+            if (this.startupRefreshFailed)
+                throw this.startupRefreshError;
+            this.isReady = true;
+        });
+        this.server.on("upgrade", async (request, socket, head) => {
+            const path = decodeRequestPath(request.url ?? "/");
+            if (path === null || hasHiddenUrlSegment(path) || !rawPathname(request.url ?? "/").endsWith("/")) {
+                socket.destroy();
+                return;
+            }
+            const absolutePath = resolveVaultPath(this.root, path);
+            if (!absolutePath || !await isVaultPathConfined(this.root, absolutePath)) {
+                socket.destroy();
+                return;
+            }
+            this.webSockets.handleUpgrade(request, socket, head, (webSocket) => {
+                const subscription = { isAlive: true };
+                this.sockets.set(webSocket, subscription);
+                webSocket.on("pong", () => { subscription.isAlive = true; });
+                webSocket.once("close", () => this.sockets.delete(webSocket));
+                this.webSockets.emit("connection", webSocket, request);
+            });
+        });
+        this.watcher.on("add", (path) => this.handleWatcherChange("created", path))
+            .on("change", (path) => this.handleWatcherChange("updated", path))
+            .on("unlink", (path) => {
+            const publish = this.isReady && !this.isClosing;
+            this.cancelPendingWatcherEvent(path);
+            this.index.delete(path);
+            if (publish)
+                this.emitEvent("deleted", path);
+        });
+        this.pingTimer = setInterval(() => {
+            for (const [socket, subscription] of this.sockets) {
+                if (socket.readyState !== WebSocket.OPEN)
+                    continue;
+                if (!subscription.isAlive) {
+                    socket.terminate();
+                    continue;
+                }
+                subscription.isAlive = false;
+                socket.ping();
+            }
+        }, pingIntervalMs);
+    }
+    /** The address the server is bound to, or undefined before listening. */
+    get url() {
+        const port = this.port;
+        return port === undefined || this.boundHost === undefined ? undefined : `http://${this.boundHost}:${port}`;
+    }
+    /** The port actually bound, which for port 0 is the one the OS chose. */
+    get port() {
+        const address = this.server.address();
+        return address !== null && typeof address === "object" ? address.port : undefined;
+    }
+    get recordCount() { return this.index.markdownNoteCount; }
+    /** Accept connections, once the vault is indexed. Resolves with the server. */
+    async listen({ host = "127.0.0.1", port = 4747 } = {}) {
+        await this.ready;
+        await new Promise((resolve, reject) => {
+            const onError = (error) => { this.server.removeListener("listening", onListening); reject(error); };
+            const onListening = () => { this.server.removeListener("error", onError); resolve(); };
+            this.server.once("error", onError);
+            this.server.once("listening", onListening);
+            this.server.listen(port, host);
+        });
+        this.boundHost = host;
+        return this;
+    }
+    async close() {
+        this.isClosing = true;
+        for (const path of this.pendingWatcherEvents.keys())
+            this.cancelPendingWatcherEvent(path);
+        clearInterval(this.pingTimer);
+        for (const socket of this.sockets.keys())
+            socket.terminate();
+        await this.watcher.close();
+        this.webSockets.close();
+        if (this.server.listening)
+            await new Promise((resolve, reject) => this.server.close((error) => error ? reject(error) : resolve()));
+        this.boundHost = undefined;
+    }
+    context() {
+        return { root: this.root, index: this.index, validate: this.validate, runMutation: this.runMutation };
+    }
+    runMutation = async (type, absolutePath, action) => {
+        const result = await action();
+        this.cancelPendingWatcherEvent(absolutePath);
+        this.emitEvent(type, absolutePath);
+        return result;
+    };
+    emitEvent(type, absolutePath) {
+        const diskPath = toVaultPath(relative(this.root, absolutePath));
+        const path = diskPath.endsWith(".md") ? diskPath.slice(0, -3) : diskPath;
+        if (hasDotSegment(path))
+            return;
+        for (const socket of this.sockets.keys())
+            if (socket.readyState === WebSocket.OPEN)
+                socket.send(JSON.stringify({ type, path }));
+    }
+    handleWatcherChange(type, path) {
+        if (this.isClosing)
+            return;
+        if (!this.isReady) {
+            void this.refreshIndex(path);
+            return;
+        }
+        const existing = this.pendingWatcherEvents.get(path);
+        if (existing?.timer)
+            clearTimeout(existing.timer);
+        const pending = {
+            type: existing?.type === "created" || type === "created" ? "created" : "updated",
+        };
+        pending.timer = setTimeout(() => { delete pending.timer; void this.flushWatcherEvent(path, pending); }, watcherDebounceMs);
+        pending.timer.unref();
+        this.pendingWatcherEvents.set(path, pending);
+    }
+    async flushWatcherEvent(path, pending) {
+        const outcome = await this.refreshIndex(path);
+        if (this.pendingWatcherEvents.get(path) !== pending)
+            return;
+        this.pendingWatcherEvents.delete(path);
+        if (outcome === "committed" && !this.isClosing)
+            this.emitEvent(pending.type, path);
+    }
+    cancelPendingWatcherEvent(path) {
+        const pending = this.pendingWatcherEvents.get(path);
+        if (pending?.timer)
+            clearTimeout(pending.timer);
+        this.pendingWatcherEvents.delete(path);
+    }
+    refreshIndex(path) {
+        const startup = !this.isReady;
+        const refresh = this.index.refresh(path).catch((error) => {
+            if (startup) {
+                if (!this.startupRefreshFailed)
+                    this.startupRefreshError = error;
+                this.startupRefreshFailed = true;
+            }
+            else
+                console.error("vault-server index refresh error", error);
+            return "failed";
+        });
+        this.pendingIndexRefreshes.add(refresh);
+        void refresh.finally(() => this.pendingIndexRefreshes.delete(refresh));
+        return refresh;
+    }
+}
+async function handleRequest(context, request, response) {
+    const path = decodeRequestPath(request.originalUrl);
+    if (path === null) {
+        sendError(response, 400, "invalid path");
+        return;
+    }
+    if (hasHiddenUrlSegment(path)) {
+        sendError(response, 404, "not found");
+        return;
+    }
+    const absolutePath = resolveVaultPath(context.root, path);
+    if (!absolutePath) {
+        sendError(response, 400, "path escapes vault");
+        return;
+    }
+    if (!await isVaultPathConfined(context.root, absolutePath)) {
+        sendError(response, 400, "path escapes vault");
+        return;
+    }
+    try {
+        if (request.method === "GET") {
+            await handleGet(context, absolutePath, request, response);
+            return;
+        }
+        if (["PUT", "PATCH", "DELETE"].includes(request.method)) {
+            await handleWrite(context, absolutePath, request, response);
+            return;
+        }
+        sendError(response, 405, "method not allowed");
+    }
+    catch (error) {
+        if (error instanceof ValidationError)
+            sendError(response, 422, error.message);
+        else if (error instanceof InvalidReferenceError)
+            sendError(response, 400, error.message);
+        else if (error instanceof InvalidUtf8Error)
+            sendError(response, 422, error.message);
+        else if (isMissing(error))
+            sendError(response, 404, "not found");
+        else if (error instanceof SyntaxError)
+            sendError(response, 400, "malformed JSON");
+        else {
+            console.error(error);
+            sendError(response, 500, "internal server error");
+        }
+    }
+}
+async function handleGet(context, absolutePath, request, response) {
+    if (rawPathname(request.originalUrl).endsWith("/")) {
+        if (!(await isDirectory(absolutePath))) {
+            sendError(response, 404, "directory not found");
+            return;
+        }
+        response.json(listNotes(context.index, canonicalPath(context.root, absolutePath)));
+        return;
+    }
+    if (await isFile(absolutePath)) {
+        response.sendFile(absolutePath);
+        return;
+    }
+    if (await isFile(`${absolutePath}.md`)) {
+        if (!await isVaultPathConfined(context.root, `${absolutePath}.md`)) {
+            sendError(response, 400, "path escapes vault");
+            return;
+        }
+        response.json(await readNote(context.root, `${absolutePath}.md`, context.index));
+        return;
+    }
+    if (await isDirectory(absolutePath)) {
+        response.redirect(308, `${request.path}/`);
+        return;
+    }
+    sendError(response, 404, "not found");
+}
+async function handleWrite(context, absolutePath, request, response) {
+    const path = decodeRequestPath(request.originalUrl) ?? "";
+    if (rawPathname(request.originalUrl).endsWith("/") || path.endsWith(".md")) {
+        sendError(response, 405, "path is read-only");
+        return;
+    }
+    if (request.method !== "DELETE" && !request.is(noteContentType)) {
+        sendError(response, 415, "unsupported content type");
+        return;
+    }
+    if (await isFile(absolutePath)) {
+        sendError(response, 409, "literal file occupies record URL");
+        return;
+    }
+    const notePath = `${absolutePath}.md`;
+    if (!await isVaultPathConfined(context.root, notePath)) {
+        sendError(response, 400, "path escapes vault");
+        return;
+    }
+    const exists = await isFile(notePath);
+    if (request.method === "DELETE") {
+        if (!exists) {
+            sendError(response, 404, "record not found");
+            return;
+        }
+        await context.runMutation("deleted", notePath, () => deleteNote(notePath, context.index));
+        response.status(204).end();
+        return;
+    }
+    if (!isObject(request.body)) {
+        sendError(response, 400, "body must be an object");
+        return;
+    }
+    if ("fields" in request.body && !isObject(request.body.fields)) {
+        sendError(response, 400, "fields must be an object");
+        return;
+    }
+    if ("body" in request.body && request.body.body !== null && typeof request.body.body !== "string") {
+        sendError(response, 400, "body must be a string");
+        return;
+    }
+    const linkingNotePath = canonicalPath(context.root, notePath);
+    if (request.method === "PUT") {
+        let previous;
+        if (exists) {
+            try {
+                previous = await readRawRecord(notePath);
+            }
+            catch (error) {
+                if (!(error instanceof InvalidUtf8Error))
+                    throw error;
+            }
+        }
+        const fields = storedFields((request.body.fields ?? {}), previous?.fields, context.index, linkingNotePath);
+        const body = typeof request.body.body === "string"
+            ? storedBody(request.body.body, previous?.body, context.index, linkingNotePath)
+            : undefined;
+        const record = { fields, ...(body === undefined ? {} : { body }) };
+        await approve(context, notePath, record);
+        const note = await context.runMutation(exists ? "updated" : "created", notePath, () => writeNote(context.root, notePath, context.index, record));
+        response.status(exists ? 200 : 201).json(note);
+        return;
+    }
+    if (!exists) {
+        sendError(response, 404, "record not found");
+        return;
+    }
+    const current = await readNote(context.root, notePath, context.index);
+    const fieldPatch = request.body.fields;
+    const bodyTouched = Object.hasOwn(request.body, "body");
+    if ((fieldPatch === undefined || Object.keys(fieldPatch).length === 0) && !bodyTouched) {
+        response.json(current);
+        return;
+    }
+    const previous = await readRawRecord(notePath);
+    const fields = fieldPatch === undefined
+        ? previous.fields
+        : storedFields(mergeFields(current.fields, fieldPatch), previous.fields, context.index, linkingNotePath, fieldPatch);
+    const body = bodyTouched
+        ? typeof request.body.body === "string"
+            ? storedBody(request.body.body, previous.body, context.index, linkingNotePath)
+            : undefined
+        : previous.body;
+    const record = { fields, ...(body === undefined ? {} : { body }) };
+    await approve(context, notePath, record);
+    response.json(await context.runMutation("updated", notePath, () => writeNote(context.root, notePath, context.index, record, fieldPatch ?? {}, bodyTouched, previous.rawBody)));
+}
+/**
+ * Offer the record a write would produce to the caller's `validate`, before any
+ * of it reaches disk — so a refusal leaves nothing behind, not even a temp file.
+ * The fields are the ones that will be stored, not the ones a read would give
+ * back: a rule is judged against what the write actually persists.
+ */
+async function approve(context, notePath, content) {
+    if (!context.validate)
+        return;
+    const diskPath = canonicalPath(context.root, notePath);
+    const record = { path: diskPath.slice(0, -3), ...content };
+    try {
+        await context.validate(record);
+    }
+    catch (error) {
+        throw new ValidationError(error instanceof Error ? error.message : String(error));
+    }
+}
+function isObject(value) { return value !== null && typeof value === "object" && !Array.isArray(value); }
+async function isFile(path) { try {
+    return (await stat(path)).isFile();
+}
+catch {
+    return false;
+} }
+async function isDirectory(path) { try {
+    return (await stat(path)).isDirectory();
+}
+catch {
+    return false;
+} }
+function isMissing(error) { return isObject(error) && "code" in error && error.code === "ENOENT"; }
+function isPayloadTooLarge(error) {
+    return isObject(error) && (("status" in error && error.status === 413) || ("type" in error && error.type === "entity.too.large"));
+}
+function rawPathname(url) { return url.split("?", 1)[0] ?? ""; }
+function decodeRequestPath(url) {
+    try {
+        const path = decodeURIComponent(rawPathname(url)).replace(/^\/+/, "");
+        return path.includes("\0") ? null : path;
+    }
+    catch {
+        return null;
+    }
+}
+function hasHiddenUrlSegment(path) {
+    return path.split("/").some((segment) => segment !== "." && segment !== ".." && segment.startsWith("."));
+}
+function shouldParseNoteBody(request) {
+    if (request.method !== "PUT" && request.method !== "PATCH")
+        return false;
+    if (request.headers["content-type"]?.split(";", 1)[0]?.trim().toLowerCase() !== noteContentType)
+        return false;
+    const url = request.url ?? "/";
+    const path = decodeRequestPath(url);
+    return path !== null && !hasHiddenUrlSegment(path) && !rawPathname(url).endsWith("/") && !path.endsWith(".md");
+}
+function canonicalPath(root, absolutePath) { return toVaultPath(relative(root, absolutePath)); }
+function sendError(response, status, message) { response.status(status).json({ error: message }); }
+//# sourceMappingURL=app.js.map