@warlock.js/core 4.2.1 → 4.2.4

package/esm/generations/stubs.mjs

@@ -0,0 +1,436 @@
+//#region ../@warlock.js/core/src/generations/stubs.ts
+const accessConfigStub = `import { type AccessConfigurations } from "@warlock.js/access";
+import { DatabaseAccessResolver } from "app/access/services/access-resolver";
+
+/**
+ * Authorization configuration — read by @warlock.js/access on boot.
+ *
+ * The resolver is the one required piece: it tells the engine how to read a
+ * user's roles + permissions. The ejected DatabaseAccessResolver reads roles
+ * from the user_roles table and maps them through the roles catalog table (so
+ * roles + their permissions are managed at runtime, in the DB).
+ *
+ * For a fixed, code-defined catalog with no tables, swap in DefaultAccessResolver:
+ *   import { DefaultAccessResolver } from "@warlock.js/access";
+ *   resolver: new DefaultAccessResolver({ admin: ["*"], editor: ["orders.*"] }),
+ *
+ * Multi-tenant? Add a \`resolveTenant()\` to the resolver to read the active
+ * tenant from the request; checks then scope to it automatically.
+ */
+const access: AccessConfigurations = {
+  resolver: new DatabaseAccessResolver(),
+
+  // Cache resolved permission sets (default "10m").
+  // cache: { ttl: "10m" },
+};
+
+export default access;
+`;
+const accessRoleModelStub = `import { Model, RegisterModel } from "@warlock.js/cascade";
+import { type Infer, v } from "@warlock.js/seal";
+
+/**
+ * Validation schema for the roles catalog — mirrors the migration columns
+ * (snake_case). Each row is a role name plus the permission strings it grants;
+ * wildcards work ("orders.*", "*"). The DatabaseAccessResolver maps a user's
+ * assigned role names through this table to their effective permissions.
+ */
+export const roleSchema = v.object({
+  name: v.string(),
+  permissions: v.array(v.string()).default([]),
+});
+
+export type RoleSchema = Infer<typeof roleSchema>;
+
+/**
+ * The roles catalog — role name → the permissions it grants. Managed at runtime
+ * (admins add roles + edit their permissions), unlike a fixed code map. Read by
+ * DatabaseAccessResolver.resolvePermissions to expand a user's roles to permissions.
+ */
+@RegisterModel()
+export class Role extends Model<RoleSchema> {
+  public static table = "roles";
+
+  public static schema = roleSchema;
+
+  /** The permission strings this role grants. */
+  public get permissions(): string[] {
+    return this.get<string[]>("permissions", []);
+  }
+}
+`;
+const accessRoleModelIndexStub = `export * from "./role.model";
+`;
+const accessRoleMigrationStub = `import { arrayText, Migration, text } from "@warlock.js/cascade";
+import { Role } from "../role.model";
+
+/**
+ * Roles catalog table. \`name\` is unique (one row per role); \`permissions\` is a
+ * text array of the permission strings the role grants.
+ */
+export default Migration.create(Role, {
+  name: text().notNullable().unique(),
+  permissions: arrayText().nullable(),
+});
+`;
+const accessUserRoleModelStub = `import { access } from "@warlock.js/access";
+import type { Auth } from "@warlock.js/auth";
+import { Model, RegisterModel } from "@warlock.js/cascade";
+import { type Infer, v } from "@warlock.js/seal";
+
+/**
+ * Validation schema for a role assignment — mirrors the migration columns
+ * (snake_case). \`tenant\` is nullable: a null tenant is a GLOBAL assignment.
+ */
+export const userRoleSchema = v.object({
+  user_id: v.string(),
+  user_type: v.string(),
+  role: v.string(),
+  tenant: v.string().optional(),
+});
+
+export type UserRoleSchema = Infer<typeof userRoleSchema>;
+
+/**
+ * The role-assignment table — which roles a user holds, optionally per tenant.
+ * Read by DatabaseAccessResolver.resolveRoles; mutated via the statics below.
+ * \`assign\` / \`revoke\` flush the cached permission set automatically, so callers
+ * never need to call \`access.flush(user, tenant)\` themselves.
+ */
+@RegisterModel()
+export class UserRole extends Model<UserRoleSchema> {
+  public static table = "user_roles";
+
+  public static schema = userRoleSchema;
+
+  /**
+   * Role names assigned to the user in the given tenant.
+   *
+   * An unresolved tenant (\`undefined\`) scopes to GLOBAL roles only — the rows
+   * stored with no tenant (\`null\`) — never the union across every tenant. The
+   * union would be a privilege-escalation: a user who is \`owner\` in one tenant
+   * must not be treated as \`owner\` everywhere just because a check didn't carry
+   * a tenant. This mirrors how \`assign(user, role)\` stores a global row.
+   */
+  public static async rolesFor(user: Auth, tenant?: string): Promise<string[]> {
+    const rows = await this.query()
+      .where({
+        user_id: user.id,
+        user_type: user.userType,
+        tenant: tenant ?? null,
+      })
+      .get();
+
+    // De-dupe so a duplicate row (a concurrent assign that slipped past the
+    // existence check) can't distort the resolved set.
+    return [...new Set(rows.map((row) => row.get("role") as string))];
+  }
+
+  /**
+   * Assign a role to the user. No-op if the assignment already exists.
+   * Flushes the user's cached permission set automatically.
+   */
+  public static async assign(user: Auth, role: string, tenant?: string): Promise<void> {
+    const existing = await this.first({
+      user_id: user.id,
+      user_type: user.userType,
+      role,
+      tenant: tenant ?? null,
+    });
+
+    if (existing) return;
+
+    await this.create({
+      user_id: user.id,
+      user_type: user.userType,
+      role,
+      tenant,
+    });
+
+    await access.flush(user, tenant);
+  }
+
+  /**
+   * Remove a role assignment from the user.
+   * Flushes the user's cached permission set automatically.
+   */
+  public static async revoke(user: Auth, role: string, tenant?: string): Promise<void> {
+    await this.delete({
+      user_id: user.id,
+      user_type: user.userType,
+      role,
+      tenant: tenant ?? null,
+    });
+
+    await access.flush(user, tenant);
+  }
+}
+`;
+const accessUserRoleModelIndexStub = `export * from "./user-role.model";
+`;
+const accessUserRoleMigrationStub = `import { Migration, text, uuid } from "@warlock.js/cascade";
+import { UserRole } from "../user-role.model";
+
+/**
+ * Role-assignment table. \`user_id\` is a UUID — override this migration if your
+ * user ids are integers. The composite index powers the per-user (per-tenant)
+ * lookup the resolver runs on every check.
+ */
+export default Migration.create(
+  UserRole,
+  {
+    user_id: uuid().notNullable().index(),
+    user_type: text().notNullable(),
+    role: text().notNullable().index(),
+    tenant: text().nullable().index(),
+  },
+  {
+    index: [{ columns: ["user_id", "user_type", "tenant"] }],
+  },
+);
+`;
+const accessResolverStub = `import type { AccessResolver } from "@warlock.js/access";
+import type { Auth } from "@warlock.js/auth";
+import { Role } from "app/access/models/role";
+import { UserRole } from "app/access/models/user-role";
+
+/**
+ * The app's access adapter — connects @warlock.js/access to the ejected role
+ * tables. Roles come from the user_roles assignment table; permissions are
+ * expanded by mapping those role names through the roles catalog table. Both
+ * are managed at runtime (in the DB), so admins can add roles + edit their
+ * permissions without a deploy.
+ *
+ * The engine owns the hard parts (wildcard matching, caching, fail-closed); this
+ * resolver only fetches — keep it dumb, never cache inside it.
+ */
+export class DatabaseAccessResolver implements AccessResolver {
+  /** The role names this user holds (powers \`hasRole\` / \`hasAnyRole\`). */
+  public async resolveRoles(user: Auth, tenant?: string): Promise<string[]> {
+    return UserRole.rolesFor(user, tenant);
+  }
+
+  /** The effective permission strings this user has (powers \`can\` / \`authorize\`). */
+  public async resolvePermissions(user: Auth, tenant?: string): Promise<string[]> {
+    const names = await this.resolveRoles(user, tenant);
+
+    if (names.length === 0) return [];
+
+    const roles = await Role.query().whereIn("name", names).get();
+
+    // Flatten + de-dupe so two roles granting the same permission yield one entry.
+    return [...new Set(roles.flatMap((role) => role.permissions))];
+  }
+
+  /**
+   * Optional. Resolve the ambient tenant when a check doesn't pass one
+   * explicitly — derive it from the authenticated user (safer than reading
+   * client request input, which a caller could spoof). Uncomment + adapt for a
+   * multi-tenant app (single-tenant apps leave this off and return undefined).
+   */
+  // public resolveTenant(user: Auth): string | undefined {
+  //   return user.get("organization_id");
+  // }
+}
+`;
+const socketConfigStub = `import type { SocketOptions } from "@warlock.js/core";
+
+/**
+ * Socket.IO configuration — read by the framework's socket connector
+ * on boot. When the HTTP server is running the socket server attaches
+ * to it; otherwise it listens on its own configured port.
+ *
+ * Remove this file to disable the socket server entirely.
+ */
+export default {
+  options: {
+    cors: {
+      origin: "*",
+    },
+  },
+} as SocketOptions;
+`;
+const communicatorsConfigStub = `import { env } from "@mongez/dotenv";
+import type { BrokerConfigurations, RabbitMQClientOptions } from "@warlock.js/herald";
+
+const heraldConfigurations: BrokerConfigurations<RabbitMQClientOptions> = {
+  driver: "rabbitmq",
+  name: "default",
+  isDefault: true,
+
+  // ============================================================================
+  // Connection Settings
+  // ============================================================================
+
+  host: env("RABBITMQ_HOST", "localhost"),
+  port: env("RABBITMQ_PORT", 5672),
+  username: env("RABBITMQ_USERNAME", "guest"),
+  password: env("RABBITMQ_PASSWORD", "guest"),
+  vhost: env("RABBITMQ_VHOST", "/"),
+
+  // Or use connection URI (takes precedence over host/port)
+  // uri: env("RABBITMQ_URL"),
+
+  // ============================================================================
+  // Connection Options
+  // ============================================================================
+
+  /** Heartbeat interval in seconds */
+  heartbeat: 60,
+
+  /** Connection timeout in milliseconds */
+  connectionTimeout: 10000,
+
+  /** Enable automatic reconnection on disconnect */
+  reconnect: true,
+
+  /** Delay between reconnection attempts in milliseconds */
+  reconnectDelay: 5_000,
+
+  // ============================================================================
+  // Consumer Options
+  // ============================================================================
+
+  /** Default prefetch count (number of unacknowledged messages per consumer) */
+  prefetch: 10,
+
+  // ============================================================================
+  // Client Options (Native amqplib options)
+  // ============================================================================
+  // These options are passed directly to amqplib.connect()
+  // for low-level configuration like frame size, TLS, socket options, etc.
+  // ============================================================================
+  clientOptions: {
+    // Frame max size in bytes (0 = no limit)
+    // frameMax: 0,
+
+    // Channel max (0 = unlimited)
+    // channelMax: 0,
+
+    // Socket options
+    socket: {
+      // Enable TCP keep-alive
+      keepAlive: true,
+
+      // Disable Nagle's algorithm for lower latency
+      noDelay: true,
+
+      // Socket timeout (in addition to heartbeat)
+      // timeout: 30000,
+    },
+
+    // TLS/SSL options (uncomment for secure connections)
+    // socket: {
+    //   ca: fs.readFileSync('/path/to/ca.pem'),
+    //   cert: fs.readFileSync('/path/to/cert.pem'),
+    //   key: fs.readFileSync('/path/to/key.pem'),
+    //   rejectUnauthorized: true,
+    // },
+  },
+};
+
+export default heraldConfigurations;
+`;
+const notificationsConfigStub = `import { type NotificationConfig, inApp, mailChannel } from "@warlock.js/notifications";
+import { Notification } from "app/notifications/notification.model";
+
+/**
+ * Notifications configuration. Auto-loaded from src/config on boot — the
+ * framework's notifications connector reads this default export and hands it to
+ * setNotificationConfig, so this file stays declarative (no side-effect call).
+ *
+ * Each channel is payload-typed, so notify.mail(...) / notify.database(...)
+ * and defineNotification are type-checked against the registry.
+ *
+ * Channels enabled here:
+ *   - mail     wraps @warlock.js/core sendMail; route is notifiable.email.
+ *              The "from" address defaults to config/mail.ts; override per
+ *              channel with mailChannel({ from: "no-reply@yourapp.com" }).
+ *   - database in-app store backed by the Notification model. The "inApp"
+ *              facade exposes the recipient-scoped read API: listUnread,
+ *              countUnread, markAsRead, dismiss, ...
+ *
+ * Async delivery (.queue()) is OPTIONAL: run "npx warlock add herald",
+ * import { heraldQueue } from "@warlock.js/notifications", and uncomment the
+ * queue line below.
+ */
+const config: NotificationConfig = {
+  channels: {
+    mail: mailChannel(),
+    database: inApp.configure({ model: Notification }),
+  },
+
+  // Async queue — requires @warlock.js/herald (npx warlock add herald):
+  // queue: heraldQueue(),
+};
+
+export default config;
+`;
+const notificationModelStub = `import { RegisterModel } from "@warlock.js/cascade";
+import { DatabaseNotification, type NotificationColumnMap } from "@warlock.js/notifications";
+import { v } from "@warlock.js/seal";
+
+/**
+ * Validation schema for the notifications table — mirrors the migration
+ * columns (snake_case). Cascade validates + casts every write against it:
+ * nullable columns use .nullish() (may be absent or null), and payload is
+ * free-form JSON. Keep this in sync with the migration + columnMap when you
+ * add or rename columns.
+ */
+const notificationSchema = v.object({
+  user_id: v.string(),
+  type: v.string(),
+  title: v.string(),
+  body: v.string().nullish(),
+  payload: v.record(v.any()).nullish(),
+  read_at: v.date().nullish(),
+  idempotency_key: v.string().nullish(),
+});
+
+/**
+ * In-app notification model.
+ *
+ * Extends the package's DatabaseNotification base, which provides the stable
+ * accessors (recipientId, tenantId, isRead, readAt, markRead) — all derived
+ * from the columnMap below. The read/write API lives on the inApp facade
+ * (configured in config/notifications.ts); you rarely touch this class directly.
+ */
+@RegisterModel()
+export class Notification extends DatabaseNotification {
+  public static table = "notifications";
+  public static schema = notificationSchema;
+
+  /**
+   * Maps the in-app store's roles to your columns. This default is
+   * single-tenant + read_at-only. Add tenant: "organization_id" for
+   * multi-tenant; use isRead: "is_read" (instead of, or alongside, readAt) to
+   * track a boolean read flag. The migration + accessors all follow this map.
+   */
+  public static columnMap: NotificationColumnMap = { readAt: "read_at" };
+}
+`;
+const notificationMigrationStub = `import { Migration } from "@warlock.js/cascade";
+import { notificationColumns } from "@warlock.js/notifications";
+import { Notification } from "../notification.model";
+
+/**
+ * Notifications table.
+ *
+ * Columns come from notificationColumns(Notification) — the recipient / tenant
+ * / read-state names follow the model's columnMap; type / title / body /
+ * payload / idempotency_key are fixed. Spread it to add your own columns
+ * (remember to mirror them in the model schema):
+ *
+ *   import { uuid } from "@warlock.js/cascade";
+ *
+ *   export default Migration.create(Notification, {
+ *     ...notificationColumns(Notification),
+ *     // category_id: uuid().index().nullable(),
+ *   });
+ */
+export default Migration.create(Notification, notificationColumns(Notification));
+`;
+
+//#endregion
+export { accessConfigStub, accessResolverStub, accessRoleMigrationStub, accessRoleModelIndexStub, accessRoleModelStub, accessUserRoleMigrationStub, accessUserRoleModelIndexStub, accessUserRoleModelStub, communicatorsConfigStub, notificationMigrationStub, notificationModelStub, notificationsConfigStub, socketConfigStub };
+//# sourceMappingURL=stubs.mjs.map

package/esm/generations/stubs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"stubs.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/generations/stubs.ts"],"sourcesContent":["export const accessConfigStub = `import { type AccessConfigurations } from \"@warlock.js/access\";\r\nimport { DatabaseAccessResolver } from \"app/access/services/access-resolver\";\r\n\r\n/**\r\n * Authorization configuration — read by @warlock.js/access on boot.\r\n *\r\n * The resolver is the one required piece: it tells the engine how to read a\r\n * user's roles + permissions. The ejected DatabaseAccessResolver reads roles\r\n * from the user_roles table and maps them through the roles catalog table (so\r\n * roles + their permissions are managed at runtime, in the DB).\r\n *\r\n * For a fixed, code-defined catalog with no tables, swap in DefaultAccessResolver:\r\n *   import { DefaultAccessResolver } from \"@warlock.js/access\";\r\n *   resolver: new DefaultAccessResolver({ admin: [\"*\"], editor: [\"orders.*\"] }),\r\n *\r\n * Multi-tenant? Add a \\`resolveTenant()\\` to the resolver to read the active\r\n * tenant from the request; checks then scope to it automatically.\r\n */\r\nconst access: AccessConfigurations = {\r\n  resolver: new DatabaseAccessResolver(),\r\n\r\n  // Cache resolved permission sets (default \"10m\").\r\n  // cache: { ttl: \"10m\" },\r\n};\r\n\r\nexport default access;\r\n`;\r\n\r\nexport const accessRoleModelStub = `import { Model, RegisterModel } from \"@warlock.js/cascade\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for the roles catalog — mirrors the migration columns\r\n * (snake_case). Each row is a role name plus the permission strings it grants;\r\n * wildcards work (\"orders.*\", \"*\"). The DatabaseAccessResolver maps a user's\r\n * assigned role names through this table to their effective permissions.\r\n */\r\nexport const roleSchema = v.object({\r\n  name: v.string(),\r\n  permissions: v.array(v.string()).default([]),\r\n});\r\n\r\nexport type RoleSchema = Infer<typeof roleSchema>;\r\n\r\n/**\r\n * The roles catalog — role name → the permissions it grants. Managed at runtime\r\n * (admins add roles + edit their permissions), unlike a fixed code map. Read by\r\n * DatabaseAccessResolver.resolvePermissions to expand a user's roles to permissions.\r\n */\r\n@RegisterModel()\r\nexport class Role extends Model<RoleSchema> {\r\n  public static table = \"roles\";\r\n\r\n  public static schema = roleSchema;\r\n\r\n  /** The permission strings this role grants. */\r\n  public get permissions(): string[] {\r\n    return this.get<string[]>(\"permissions\", []);\r\n  }\r\n}\r\n`;\r\n\r\nexport const accessRoleModelIndexStub = `export * from \"./role.model\";\r\n`;\r\n\r\nexport const accessRoleMigrationStub = `import { arrayText, Migration, text } from \"@warlock.js/cascade\";\r\nimport { Role } from \"../role.model\";\r\n\r\n/**\r\n * Roles catalog table. \\`name\\` is unique (one row per role); \\`permissions\\` is a\r\n * text array of the permission strings the role grants.\r\n */\r\nexport default Migration.create(Role, {\r\n  name: text().notNullable().unique(),\r\n  permissions: arrayText().nullable(),\r\n});\r\n`;\r\n\r\nexport const accessUserRoleModelStub = `import { access } from \"@warlock.js/access\";\r\nimport type { Auth } from \"@warlock.js/auth\";\r\nimport { Model, RegisterModel } from \"@warlock.js/cascade\";\r\nimport { type Infer, v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for a role assignment — mirrors the migration columns\r\n * (snake_case). \\`tenant\\` is nullable: a null tenant is a GLOBAL assignment.\r\n */\r\nexport const userRoleSchema = v.object({\r\n  user_id: v.string(),\r\n  user_type: v.string(),\r\n  role: v.string(),\r\n  tenant: v.string().optional(),\r\n});\r\n\r\nexport type UserRoleSchema = Infer<typeof userRoleSchema>;\r\n\r\n/**\r\n * The role-assignment table — which roles a user holds, optionally per tenant.\r\n * Read by DatabaseAccessResolver.resolveRoles; mutated via the statics below.\r\n * \\`assign\\` / \\`revoke\\` flush the cached permission set automatically, so callers\r\n * never need to call \\`access.flush(user, tenant)\\` themselves.\r\n */\r\n@RegisterModel()\r\nexport class UserRole extends Model<UserRoleSchema> {\r\n  public static table = \"user_roles\";\r\n\r\n  public static schema = userRoleSchema;\r\n\r\n  /**\r\n   * Role names assigned to the user in the given tenant.\r\n   *\r\n   * An unresolved tenant (\\`undefined\\`) scopes to GLOBAL roles only — the rows\r\n   * stored with no tenant (\\`null\\`) — never the union across every tenant. The\r\n   * union would be a privilege-escalation: a user who is \\`owner\\` in one tenant\r\n   * must not be treated as \\`owner\\` everywhere just because a check didn't carry\r\n   * a tenant. This mirrors how \\`assign(user, role)\\` stores a global row.\r\n   */\r\n  public static async rolesFor(user: Auth, tenant?: string): Promise<string[]> {\r\n    const rows = await this.query()\r\n      .where({\r\n        user_id: user.id,\r\n        user_type: user.userType,\r\n        tenant: tenant ?? null,\r\n      })\r\n      .get();\r\n\r\n    // De-dupe so a duplicate row (a concurrent assign that slipped past the\r\n    // existence check) can't distort the resolved set.\r\n    return [...new Set(rows.map((row) => row.get(\"role\") as string))];\r\n  }\r\n\r\n  /**\r\n   * Assign a role to the user. No-op if the assignment already exists.\r\n   * Flushes the user's cached permission set automatically.\r\n   */\r\n  public static async assign(user: Auth, role: string, tenant?: string): Promise<void> {\r\n    const existing = await this.first({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant: tenant ?? null,\r\n    });\r\n\r\n    if (existing) return;\r\n\r\n    await this.create({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant,\r\n    });\r\n\r\n    await access.flush(user, tenant);\r\n  }\r\n\r\n  /**\r\n   * Remove a role assignment from the user.\r\n   * Flushes the user's cached permission set automatically.\r\n   */\r\n  public static async revoke(user: Auth, role: string, tenant?: string): Promise<void> {\r\n    await this.delete({\r\n      user_id: user.id,\r\n      user_type: user.userType,\r\n      role,\r\n      tenant: tenant ?? null,\r\n    });\r\n\r\n    await access.flush(user, tenant);\r\n  }\r\n}\r\n`;\r\n\r\nexport const accessUserRoleModelIndexStub = `export * from \"./user-role.model\";\r\n`;\r\n\r\nexport const accessUserRoleMigrationStub = `import { Migration, text, uuid } from \"@warlock.js/cascade\";\r\nimport { UserRole } from \"../user-role.model\";\r\n\r\n/**\r\n * Role-assignment table. \\`user_id\\` is a UUID — override this migration if your\r\n * user ids are integers. The composite index powers the per-user (per-tenant)\r\n * lookup the resolver runs on every check.\r\n */\r\nexport default Migration.create(\r\n  UserRole,\r\n  {\r\n    user_id: uuid().notNullable().index(),\r\n    user_type: text().notNullable(),\r\n    role: text().notNullable().index(),\r\n    tenant: text().nullable().index(),\r\n  },\r\n  {\r\n    index: [{ columns: [\"user_id\", \"user_type\", \"tenant\"] }],\r\n  },\r\n);\r\n`;\r\n\r\nexport const accessResolverStub = `import type { AccessResolver } from \"@warlock.js/access\";\r\nimport type { Auth } from \"@warlock.js/auth\";\r\nimport { Role } from \"app/access/models/role\";\r\nimport { UserRole } from \"app/access/models/user-role\";\r\n\r\n/**\r\n * The app's access adapter — connects @warlock.js/access to the ejected role\r\n * tables. Roles come from the user_roles assignment table; permissions are\r\n * expanded by mapping those role names through the roles catalog table. Both\r\n * are managed at runtime (in the DB), so admins can add roles + edit their\r\n * permissions without a deploy.\r\n *\r\n * The engine owns the hard parts (wildcard matching, caching, fail-closed); this\r\n * resolver only fetches — keep it dumb, never cache inside it.\r\n */\r\nexport class DatabaseAccessResolver implements AccessResolver {\r\n  /** The role names this user holds (powers \\`hasRole\\` / \\`hasAnyRole\\`). */\r\n  public async resolveRoles(user: Auth, tenant?: string): Promise<string[]> {\r\n    return UserRole.rolesFor(user, tenant);\r\n  }\r\n\r\n  /** The effective permission strings this user has (powers \\`can\\` / \\`authorize\\`). */\r\n  public async resolvePermissions(user: Auth, tenant?: string): Promise<string[]> {\r\n    const names = await this.resolveRoles(user, tenant);\r\n\r\n    if (names.length === 0) return [];\r\n\r\n    const roles = await Role.query().whereIn(\"name\", names).get();\r\n\r\n    // Flatten + de-dupe so two roles granting the same permission yield one entry.\r\n    return [...new Set(roles.flatMap((role) => role.permissions))];\r\n  }\r\n\r\n  /**\r\n   * Optional. Resolve the ambient tenant when a check doesn't pass one\r\n   * explicitly — derive it from the authenticated user (safer than reading\r\n   * client request input, which a caller could spoof). Uncomment + adapt for a\r\n   * multi-tenant app (single-tenant apps leave this off and return undefined).\r\n   */\r\n  // public resolveTenant(user: Auth): string | undefined {\r\n  //   return user.get(\"organization_id\");\r\n  // }\r\n}\r\n`;\r\n\r\nexport const socketConfigStub = `import type { SocketOptions } from \"@warlock.js/core\";\r\n\r\n/**\r\n * Socket.IO configuration — read by the framework's socket connector\r\n * on boot. When the HTTP server is running the socket server attaches\r\n * to it; otherwise it listens on its own configured port.\r\n *\r\n * Remove this file to disable the socket server entirely.\r\n */\r\nexport default {\r\n  options: {\r\n    cors: {\r\n      origin: \"*\",\r\n    },\r\n  },\r\n} as SocketOptions;\r\n`;\r\n\r\nexport const communicatorsConfigStub = `import { env } from \"@mongez/dotenv\";\r\nimport type { BrokerConfigurations, RabbitMQClientOptions } from \"@warlock.js/herald\";\r\n\r\nconst heraldConfigurations: BrokerConfigurations<RabbitMQClientOptions> = {\r\n  driver: \"rabbitmq\",\r\n  name: \"default\",\r\n  isDefault: true,\r\n\r\n  // ============================================================================\r\n  // Connection Settings\r\n  // ============================================================================\r\n\r\n  host: env(\"RABBITMQ_HOST\", \"localhost\"),\r\n  port: env(\"RABBITMQ_PORT\", 5672),\r\n  username: env(\"RABBITMQ_USERNAME\", \"guest\"),\r\n  password: env(\"RABBITMQ_PASSWORD\", \"guest\"),\r\n  vhost: env(\"RABBITMQ_VHOST\", \"/\"),\r\n\r\n  // Or use connection URI (takes precedence over host/port)\r\n  // uri: env(\"RABBITMQ_URL\"),\r\n\r\n  // ============================================================================\r\n  // Connection Options\r\n  // ============================================================================\r\n\r\n  /** Heartbeat interval in seconds */\r\n  heartbeat: 60,\r\n\r\n  /** Connection timeout in milliseconds */\r\n  connectionTimeout: 10000,\r\n\r\n  /** Enable automatic reconnection on disconnect */\r\n  reconnect: true,\r\n\r\n  /** Delay between reconnection attempts in milliseconds */\r\n  reconnectDelay: 5_000,\r\n\r\n  // ============================================================================\r\n  // Consumer Options\r\n  // ============================================================================\r\n\r\n  /** Default prefetch count (number of unacknowledged messages per consumer) */\r\n  prefetch: 10,\r\n\r\n  // ============================================================================\r\n  // Client Options (Native amqplib options)\r\n  // ============================================================================\r\n  // These options are passed directly to amqplib.connect()\r\n  // for low-level configuration like frame size, TLS, socket options, etc.\r\n  // ============================================================================\r\n  clientOptions: {\r\n    // Frame max size in bytes (0 = no limit)\r\n    // frameMax: 0,\r\n\r\n    // Channel max (0 = unlimited)\r\n    // channelMax: 0,\r\n\r\n    // Socket options\r\n    socket: {\r\n      // Enable TCP keep-alive\r\n      keepAlive: true,\r\n\r\n      // Disable Nagle's algorithm for lower latency\r\n      noDelay: true,\r\n\r\n      // Socket timeout (in addition to heartbeat)\r\n      // timeout: 30000,\r\n    },\r\n\r\n    // TLS/SSL options (uncomment for secure connections)\r\n    // socket: {\r\n    //   ca: fs.readFileSync('/path/to/ca.pem'),\r\n    //   cert: fs.readFileSync('/path/to/cert.pem'),\r\n    //   key: fs.readFileSync('/path/to/key.pem'),\r\n    //   rejectUnauthorized: true,\r\n    // },\r\n  },\r\n};\r\n\r\nexport default heraldConfigurations;\r\n`;\r\n\r\nexport const notificationsConfigStub = `import { type NotificationConfig, inApp, mailChannel } from \"@warlock.js/notifications\";\r\nimport { Notification } from \"app/notifications/notification.model\";\r\n\r\n/**\r\n * Notifications configuration. Auto-loaded from src/config on boot — the\r\n * framework's notifications connector reads this default export and hands it to\r\n * setNotificationConfig, so this file stays declarative (no side-effect call).\r\n *\r\n * Each channel is payload-typed, so notify.mail(...) / notify.database(...)\r\n * and defineNotification are type-checked against the registry.\r\n *\r\n * Channels enabled here:\r\n *   - mail     wraps @warlock.js/core sendMail; route is notifiable.email.\r\n *              The \"from\" address defaults to config/mail.ts; override per\r\n *              channel with mailChannel({ from: \"no-reply@yourapp.com\" }).\r\n *   - database in-app store backed by the Notification model. The \"inApp\"\r\n *              facade exposes the recipient-scoped read API: listUnread,\r\n *              countUnread, markAsRead, dismiss, ...\r\n *\r\n * Async delivery (.queue()) is OPTIONAL: run \"npx warlock add herald\",\r\n * import { heraldQueue } from \"@warlock.js/notifications\", and uncomment the\r\n * queue line below.\r\n */\r\nconst config: NotificationConfig = {\r\n  channels: {\r\n    mail: mailChannel(),\r\n    database: inApp.configure({ model: Notification }),\r\n  },\r\n\r\n  // Async queue — requires @warlock.js/herald (npx warlock add herald):\r\n  // queue: heraldQueue(),\r\n};\r\n\r\nexport default config;\r\n`;\r\n\r\nexport const notificationModelStub = `import { RegisterModel } from \"@warlock.js/cascade\";\r\nimport { DatabaseNotification, type NotificationColumnMap } from \"@warlock.js/notifications\";\r\nimport { v } from \"@warlock.js/seal\";\r\n\r\n/**\r\n * Validation schema for the notifications table — mirrors the migration\r\n * columns (snake_case). Cascade validates + casts every write against it:\r\n * nullable columns use .nullish() (may be absent or null), and payload is\r\n * free-form JSON. Keep this in sync with the migration + columnMap when you\r\n * add or rename columns.\r\n */\r\nconst notificationSchema = v.object({\r\n  user_id: v.string(),\r\n  type: v.string(),\r\n  title: v.string(),\r\n  body: v.string().nullish(),\r\n  payload: v.record(v.any()).nullish(),\r\n  read_at: v.date().nullish(),\r\n  idempotency_key: v.string().nullish(),\r\n});\r\n\r\n/**\r\n * In-app notification model.\r\n *\r\n * Extends the package's DatabaseNotification base, which provides the stable\r\n * accessors (recipientId, tenantId, isRead, readAt, markRead) — all derived\r\n * from the columnMap below. The read/write API lives on the inApp facade\r\n * (configured in config/notifications.ts); you rarely touch this class directly.\r\n */\r\n@RegisterModel()\r\nexport class Notification extends DatabaseNotification {\r\n  public static table = \"notifications\";\r\n  public static schema = notificationSchema;\r\n\r\n  /**\r\n   * Maps the in-app store's roles to your columns. This default is\r\n   * single-tenant + read_at-only. Add tenant: \"organization_id\" for\r\n   * multi-tenant; use isRead: \"is_read\" (instead of, or alongside, readAt) to\r\n   * track a boolean read flag. The migration + accessors all follow this map.\r\n   */\r\n  public static columnMap: NotificationColumnMap = { readAt: \"read_at\" };\r\n}\r\n`;\r\n\r\nexport const notificationMigrationStub = `import { Migration } from \"@warlock.js/cascade\";\r\nimport { notificationColumns } from \"@warlock.js/notifications\";\r\nimport { Notification } from \"../notification.model\";\r\n\r\n/**\r\n * Notifications table.\r\n *\r\n * Columns come from notificationColumns(Notification) — the recipient / tenant\r\n * / read-state names follow the model's columnMap; type / title / body /\r\n * payload / idempotency_key are fixed. Spread it to add your own columns\r\n * (remember to mirror them in the model schema):\r\n *\r\n *   import { uuid } from \"@warlock.js/cascade\";\r\n *\r\n *   export default Migration.create(Notification, {\r\n *     ...notificationColumns(Notification),\r\n *     // category_id: uuid().index().nullable(),\r\n *   });\r\n */\r\nexport default Migration.create(Notification, notificationColumns(Notification));\r\n`;\r\n"],"mappings":";AAAA,MAAa,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BhC,MAAa,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCnC,MAAa,2BAA2B;;AAGxC,MAAa,0BAA0B;;;;;;;;;;;;AAavC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8FvC,MAAa,+BAA+B;;AAG5C,MAAa,8BAA8B;;;;;;;;;;;;;;;;;;;;;AAsB3C,MAAa,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6ClC,MAAa,mBAAmB;;;;;;;;;;;;;;;;;AAkBhC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFvC,MAAa,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCvC,MAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4CrC,MAAa,4BAA4B"}

package/esm/manifest/manifest-manager.mjs

@@ -0,0 +1,79 @@
+import { warlockPath } from "../utils/paths.mjs";
+import "../utils/index.mjs";
+import { getJsonFileAsync, putJsonFileAsync, unlinkAsync } from "@warlock.js/fs";
+
+//#region ../@warlock.js/core/src/manifest/manifest-manager.ts
+var ManifestManager = class {
+	constructor() {
+		this._hasChanges = false;
+		this._isLoaded = false;
+	}
+	/**
+	* Get if commands json has changes
+	*/
+	get hasChanges() {
+		return this._hasChanges;
+	}
+	/**
+	* Check if commands json is loaded
+	*/
+	get isCommandLoaded() {
+		return this._isLoaded;
+	}
+	/**
+	* Load commands.json file
+	*/
+	async loadCommands() {
+		if (this._isLoaded) return this._commandsJson;
+		try {
+			this._commandsJson = await getJsonFileAsync(warlockPath("commands.json"));
+			this._isLoaded = true;
+			return this._commandsJson;
+		} catch {
+			return;
+		}
+	}
+	/**
+	* Get commands json content
+	*/
+	get commandsJson() {
+		return this._commandsJson;
+	}
+	/**
+	* Save commands in commands.json file
+	*/
+	async saveCommands() {
+		await putJsonFileAsync(warlockPath("commands.json"), this._commandsJson);
+		this._isLoaded = true;
+		this._hasChanges = false;
+	}
+	/**
+	* Add command info to commands list (But do not save commands)
+	*/
+	addCommandToList(name, command) {
+		if (!this._commandsJson) this._commandsJson = { commands: {} };
+		this._commandsJson.commands[name] = command;
+		this._hasChanges = true;
+	}
+	/**
+	* Clear commands cache
+	*/
+	clearCommandsCache() {
+		this._commandsJson = void 0;
+		this._hasChanges = false;
+		this._isLoaded = false;
+	}
+	/**
+	* Remove commands.json file
+	*/
+	async removeCommandsFile() {
+		try {
+			await unlinkAsync(warlockPath("commands.json"));
+		} catch {}
+	}
+};
+const manifestManager = new ManifestManager();
+
+//#endregion
+export { manifestManager };
+//# sourceMappingURL=manifest-manager.mjs.map

package/esm/manifest/manifest-manager.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-manager.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/manifest/manifest-manager.ts"],"sourcesContent":["import { getJsonFileAsync, putJsonFileAsync, unlinkAsync } from \"@warlock.js/fs\";\r\nimport { warlockPath } from \"../utils\";\r\n\r\n/**\r\n * Stored option metadata in manifest\r\n */\r\nexport type ManifestCommandOption = {\r\n  name: string;\r\n  text: string;\r\n  alias?: string;\r\n  description?: string;\r\n  type?: \"string\" | \"boolean\" | \"number\";\r\n  required?: boolean;\r\n  defaultValue?: string | boolean | number;\r\n};\r\n\r\n/**\r\n * Command metadata stored in commands.json\r\n */\r\nexport type ManifestCommandData = {\r\n  relativePath?: string;\r\n  source: \"framework\" | \"plugin\" | \"project\";\r\n  description?: string;\r\n  alias?: string;\r\n  options?: ManifestCommandOption[];\r\n};\r\n\r\ntype ManifestCommandsJson = {\r\n  commands: Record<string, ManifestCommandData>;\r\n};\r\n\r\nexport class ManifestManager {\r\n  /**\r\n   * commands json\r\n   */\r\n  protected _commandsJson?: ManifestCommandsJson;\r\n\r\n  /**\r\n   * Check if commands json is changed\r\n   */\r\n  protected _hasChanges = false;\r\n\r\n  /**\r\n   * Whether commands json is loaded\r\n   */\r\n  protected _isLoaded = false;\r\n\r\n  /**\r\n   * Get if commands json has changes\r\n   */\r\n  public get hasChanges() {\r\n    return this._hasChanges;\r\n  }\r\n\r\n  /**\r\n   * Check if commands json is loaded\r\n   */\r\n  public get isCommandLoaded() {\r\n    return this._isLoaded;\r\n  }\r\n\r\n  /**\r\n   * Load commands.json file\r\n   */\r\n  public async loadCommands(): Promise<ManifestCommandsJson | undefined> {\r\n    // now try to locate it in .warlock folder\r\n    if (this._isLoaded) return this._commandsJson;\r\n\r\n    try {\r\n      this._commandsJson = await getJsonFileAsync(warlockPath(\"commands.json\"));\r\n\r\n      this._isLoaded = true;\r\n\r\n      return this._commandsJson;\r\n    } catch {\r\n      return;\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Get commands json content\r\n   */\r\n  public get commandsJson() {\r\n    return this._commandsJson;\r\n  }\r\n\r\n  /**\r\n   * Save commands in commands.json file\r\n   */\r\n  public async saveCommands() {\r\n    await putJsonFileAsync(warlockPath(\"commands.json\"), this._commandsJson);\r\n\r\n    this._isLoaded = true;\r\n    this._hasChanges = false;\r\n  }\r\n\r\n  /**\r\n   * Add command info to commands list (But do not save commands)\r\n   */\r\n  public addCommandToList(name: string, command: ManifestCommandsJson[\"commands\"][string]) {\r\n    if (!this._commandsJson) {\r\n      this._commandsJson = {\r\n        commands: {},\r\n      };\r\n    }\r\n\r\n    this._commandsJson.commands[name] = command;\r\n\r\n    this._hasChanges = true;\r\n  }\r\n\r\n  /**\r\n   * Clear commands cache\r\n   */\r\n  public clearCommandsCache() {\r\n    this._commandsJson = undefined;\r\n    this._hasChanges = false;\r\n    this._isLoaded = false;\r\n  }\r\n\r\n  /**\r\n   * Remove commands.json file\r\n   */\r\n  public async removeCommandsFile() {\r\n    try {\r\n      await unlinkAsync(warlockPath(\"commands.json\"));\r\n    } catch {\r\n      // do nothing\r\n    }\r\n  }\r\n}\r\n\r\nexport const manifestManager = new ManifestManager();\r\n"],"mappings":";;;;;AA+BA,IAAa,kBAAb,MAA6B;;qBASH;mBAKF;;;;;CAKtB,IAAW,aAAa;EACtB,OAAO,KAAK;CACd;;;;CAKA,IAAW,kBAAkB;EAC3B,OAAO,KAAK;CACd;;;;CAKA,MAAa,eAA0D;EAErE,IAAI,KAAK,WAAW,OAAO,KAAK;EAEhC,IAAI;GACF,KAAK,gBAAgB,MAAM,iBAAiB,YAAY,eAAe,CAAC;GAExE,KAAK,YAAY;GAEjB,OAAO,KAAK;EACd,QAAQ;GACN;EACF;CACF;;;;CAKA,IAAW,eAAe;EACxB,OAAO,KAAK;CACd;;;;CAKA,MAAa,eAAe;EAC1B,MAAM,iBAAiB,YAAY,eAAe,GAAG,KAAK,aAAa;EAEvE,KAAK,YAAY;EACjB,KAAK,cAAc;CACrB;;;;CAKA,AAAO,iBAAiB,MAAc,SAAmD;EACvF,IAAI,CAAC,KAAK,eACR,KAAK,gBAAgB,EACnB,UAAU,CAAC,EACb;EAGF,KAAK,cAAc,SAAS,QAAQ;EAEpC,KAAK,cAAc;CACrB;;;;CAKA,AAAO,qBAAqB;EAC1B,KAAK,gBAAgB;EACrB,KAAK,cAAc;EACnB,KAAK,YAAY;CACnB;;;;CAKA,MAAa,qBAAqB;EAChC,IAAI;GACF,MAAM,YAAY,YAAY,eAAe,CAAC;EAChD,QAAQ,CAER;CACF;AACF;AAEA,MAAa,kBAAkB,IAAI,gBAAgB"}

package/esm/production/build-app-production.mjs

@@ -0,0 +1,14 @@
+import { ProductionBuilder } from "./production-builder.mjs";
+
+//#region ../@warlock.js/core/src/production/build-app-production.ts
+/**
+* Build the application for production
+* Options are loaded from warlock.config.ts
+*/
+async function buildAppProduction() {
+	await new ProductionBuilder().build();
+}
+
+//#endregion
+export { buildAppProduction };
+//# sourceMappingURL=build-app-production.mjs.map

package/esm/production/build-app-production.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-app-production.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/production/build-app-production.ts"],"sourcesContent":["import { ProductionBuilder } from \"./production-builder\";\n\n/**\n * Build the application for production\n * Options are loaded from warlock.config.ts\n */\nexport async function buildAppProduction() {\n  const builder = new ProductionBuilder();\n  await builder.build();\n}\n"],"mappings":";;;;;;;AAMA,eAAsB,qBAAqB;CAEzC,MAAM,IADc,kBACR,CAAC,CAAC,MAAM;AACtB"}

package/esm/production/esbuild-plugins.mjs

@@ -0,0 +1,37 @@
+import { __require } from "../_virtual/_rolldown/runtime.mjs";
+
+//#region ../@warlock.js/core/src/production/esbuild-plugins.ts
+const nativeNodeModulesPlugin = {
+	name: "native-node-modules",
+	setup(build) {
+		build.onResolve({
+			filter: /\.node$/,
+			namespace: "file"
+		}, (args) => ({
+			path: __require.resolve(args.path, { paths: [args.resolveDir] }),
+			namespace: "node-file"
+		}));
+		build.onLoad({
+			filter: /.*/,
+			namespace: "node-file"
+		}, (args) => ({ contents: `
+          import path from ${JSON.stringify(args.path)}
+          try { module.exports = require(path) }
+          catch {}
+        ` }));
+		build.onResolve({
+			filter: /\.node$/,
+			namespace: "node-file"
+		}, (args) => ({
+			path: args.path,
+			namespace: "file"
+		}));
+		const opts = build.initialOptions;
+		opts.loader = opts.loader || {};
+		opts.loader[".node"] = "file";
+	}
+};
+
+//#endregion
+export { nativeNodeModulesPlugin };
+//# sourceMappingURL=esbuild-plugins.mjs.map

package/esm/production/esbuild-plugins.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"esbuild-plugins.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/production/esbuild-plugins.ts"],"sourcesContent":["import type { OnLoadArgs, OnResolveArgs, PluginBuild } from \"esbuild\";\n\nexport const nativeNodeModulesPlugin = {\n  name: \"native-node-modules\",\n  setup(build: PluginBuild) {\n    build.onResolve({ filter: /\\.node$/, namespace: \"file\" }, (args: OnResolveArgs) => ({\n      path: require.resolve(args.path, { paths: [args.resolveDir] }),\n      namespace: \"node-file\",\n    }));\n\n    build.onLoad({ filter: /.*/, namespace: \"node-file\" }, (args: OnLoadArgs) => ({\n      contents: `\n          import path from ${JSON.stringify(args.path)}\n          try { module.exports = require(path) }\n          catch {}\n        `,\n    }));\n\n    build.onResolve({ filter: /\\.node$/, namespace: \"node-file\" }, (args: OnResolveArgs) => ({\n      path: args.path,\n      namespace: \"file\",\n    }));\n\n    const opts = build.initialOptions;\n    opts.loader = opts.loader || {};\n    opts.loader[\".node\"] = \"file\";\n  },\n};\n"],"mappings":";;;AAEA,MAAa,0BAA0B;CACrC,MAAM;CACN,MAAM,OAAoB;EACxB,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAO,IAAI,UAAyB;GAClF,gBAAc,QAAQ,KAAK,MAAM,EAAE,OAAO,CAAC,KAAK,UAAU,EAAE,CAAC;GAC7D,WAAW;EACb,EAAE;EAEF,MAAM,OAAO;GAAE,QAAQ;GAAM,WAAW;EAAY,IAAI,UAAsB,EAC5E,UAAU;6BACa,KAAK,UAAU,KAAK,IAAI,EAAE;;;UAInD,EAAE;EAEF,MAAM,UAAU;GAAE,QAAQ;GAAW,WAAW;EAAY,IAAI,UAAyB;GACvF,MAAM,KAAK;GACX,WAAW;EACb,EAAE;EAEF,MAAM,OAAO,MAAM;EACnB,KAAK,SAAS,KAAK,UAAU,CAAC;EAC9B,KAAK,OAAO,WAAW;CACzB;AACF"}