@weave-kit/engine 0.1.0

package/dist/adapters/rest/approvals.js

@@ -0,0 +1,83 @@
+import { APPROVAL_STATUSES, SchemaError } from '../../core/index.js';
+import { resolvePagination } from '../../runtime/data-access/index.js';
+import { authenticateRequest, checkRateLimit, readDate, readInt, readString, requireAdmin, } from './common.js';
+const VALID_STATUSES = new Set(Object.values(APPROVAL_STATUSES));
+function parseStatus(raw, locale) {
+    if (raw === undefined)
+        return undefined;
+    if (!VALID_STATUSES.has(raw))
+        throw new SchemaError('http.param.invalid', { param: 'status' }, locale);
+    return raw;
+}
+function parseFilter(query, locale) {
+    const filter = {};
+    const status = parseStatus(readString(query, 'status', locale), locale);
+    if (status !== undefined)
+        filter.status = status;
+    const action = readString(query, 'action', locale);
+    if (action !== undefined)
+        filter.action = action;
+    const actorKey = readString(query, 'actorKey', locale);
+    if (actorKey !== undefined)
+        filter.actorKey = actorKey;
+    const from = readDate(query, 'from', locale);
+    if (from !== undefined)
+        filter.from = from;
+    const to = readDate(query, 'to', locale);
+    if (to !== undefined)
+        filter.to = to;
+    const sort = readString(query, 'sort', locale);
+    if (sort !== undefined) {
+        filter.sort = { field: sort, order: readString(query, 'order', locale) === 'ASC' ? 'ASC' : 'DESC' };
+    }
+    return filter;
+}
+/**
+ * Approval queue routes (D1 depth-1 read + local write; MCP tools deferred):
+ *   GET  {prefix}/approvals — paged list with status/action/actorKey/time filters
+ *   POST {prefix}/approvals/:key/approve — resolve a pending entry (admin)
+ *   POST {prefix}/approvals/:key/reject — resolve a pending entry (admin)
+ *
+ * Reads and writes are gated to `adminRoles` (the queue carries request args —
+ * a write authority boundary). Approver id comes from the authenticated subject;
+ * resolution is audited (A7) by the queue facade. Cross-instance remote
+ * approve/reject (depth 2) is not implemented.
+ */
+export function registerApprovalsRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    const approvals = deps.approvals;
+    if (approvals === undefined)
+        return;
+    const requireAdminRoles = (roles) => requireAdmin(roles, 'approvals', options.adminRoles, locale);
+    app.get(`${prefix}/approvals`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdminRoles(subject.roles);
+        const query = request.query;
+        const filter = parseFilter(query, locale);
+        const { limit, offset } = resolvePagination({
+            limit: readInt(query, 'limit', locale),
+            offset: readInt(query, 'offset', locale),
+        });
+        filter.limit = limit;
+        filter.offset = offset;
+        const [rows, total] = await Promise.all([approvals.list(filter), approvals.count(filter)]);
+        return { rows, total, limit, offset };
+    });
+    const resolveRoute = (decision) => async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdminRoles(subject.roles);
+        const { key } = request.params;
+        const ok = decision === 'approved' ? await approvals.approve(key, subject.id) : await approvals.reject(key, subject.id);
+        if (!ok) {
+            throw new SchemaError('approval.notFound', { approvalKey: key }, locale);
+        }
+        return { approvalKey: key, status: decision, approver: subject.id };
+    };
+    app.post(`${prefix}/approvals/:key/approve`, resolveRoute('approved'));
+    app.post(`${prefix}/approvals/:key/reject`, resolveRoute('rejected'));
+}
+//# sourceMappingURL=approvals.js.map

package/dist/adapters/rest/approvals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.js","sourceRoot":"","sources":["../../../src/adapters/rest/approvals.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAe,MAAM,qBAAqB,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,QAAQ,EACR,OAAO,EACP,UAAU,EACV,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;AAEzE,SAAS,WAAW,CAAC,GAAuB,EAAE,MAAc;IAC1D,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IACvG,OAAO,GAAqB,CAAC;AAC/B,CAAC;AAED,SAAS,WAAW,CAAC,KAA8B,EAAE,MAAc;IACjE,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACjD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;IACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;IAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,EAAE,KAAK,SAAS;QAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAoB,EAAE,IAAc,EAAE,UAAuB,EAAE;IACrG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO;IAEpC,MAAM,iBAAiB,GAAG,CAAC,KAAe,EAAQ,EAAE,CAClD,YAAY,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAE/D,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAC;QACvD,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;YACtC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACvB,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3F,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAChB,CAAC,QAAiC,EAAE,EAAE,CACtC,KAAK,EAAE,OAAuB,EAAE,EAAE;QAChC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAyB,CAAC;QAClD,MAAM,EAAE,GACN,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;IACtE,CAAC,CAAC;IAEJ,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,yBAAyB,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IACvE,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,wBAAwB,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/adapters/rest/audit.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyInstance } from 'fastify';
+import type { RestDeps, RestOptions } from './plugin.js';
+/**
+ * Audit route (M11, framework-agnostic): paginated audit trail for frontend
+ * audit pages (react-admin audit page / Refine `auditLogProvider`).
+ *   GET {prefix}/audit?actorId&action&object&from&to&limit&offset
+ *
+ * RBAC filter (D15): audit rows carry before/after snapshots, so a regular
+ * identity only sees its own records (`actorId` defaults to its own id).
+ * Roles listed in `options.adminRoles` may query any actor (or the whole
+ * trail by omitting `actorId`). Not registered when the audit subsystem is
+ * disabled (disabled = not imported = zero overhead).
+ */
+export declare function registerAuditRoutes(app: FastifyInstance, deps: RestDeps, options?: RestOptions): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/adapters/rest/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAK/C,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAuBzD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CA8CzG"}

package/dist/adapters/rest/audit.js

@@ -0,0 +1,81 @@
+import { SchemaError } from '../../core/index.js';
+import { resolvePagination } from '../../runtime/data-access/index.js';
+import { authenticateRequest, checkRateLimit, readDate, readInt, readString } from './common.js';
+/** read a JSON object query param (`filter`); non-object → http.param.invalid */
+function readFilterObject(query, key, locale) {
+    const raw = readString(query, key, locale);
+    if (raw === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new SchemaError('http.param.invalid', { param: key }, locale);
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new SchemaError('http.param.invalid', { param: key }, locale);
+    }
+    return parsed;
+}
+/**
+ * Audit route (M11, framework-agnostic): paginated audit trail for frontend
+ * audit pages (react-admin audit page / Refine `auditLogProvider`).
+ *   GET {prefix}/audit?actorId&action&object&from&to&limit&offset
+ *
+ * RBAC filter (D15): audit rows carry before/after snapshots, so a regular
+ * identity only sees its own records (`actorId` defaults to its own id).
+ * Roles listed in `options.adminRoles` may query any actor (or the whole
+ * trail by omitting `actorId`). Not registered when the audit subsystem is
+ * disabled (disabled = not imported = zero overhead).
+ */
+export function registerAuditRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    const audit = deps.audit;
+    if (audit === undefined)
+        return;
+    const adminRoles = new Set(options.adminRoles ?? []);
+    app.get(`${prefix}/audit`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const query = request.query;
+        const isAdmin = subject.roles.some((r) => adminRoles.has(r));
+        const rawActor = readString(query, 'actorId', locale);
+        const filter = {};
+        if (rawActor !== undefined) {
+            if (rawActor !== subject.id && !isAdmin) {
+                throw new SchemaError('audit.denied.actor', {}, locale);
+            }
+            filter.actorId = rawActor;
+        }
+        else if (!isAdmin) {
+            filter.actorId = subject.id;
+        }
+        const action = readString(query, 'action', locale);
+        if (action !== undefined)
+            filter.action = action;
+        const object = readString(query, 'object', locale);
+        if (object !== undefined)
+            filter.object = object;
+        const from = readDate(query, 'from', locale);
+        if (from !== undefined)
+            filter.from = from;
+        const to = readDate(query, 'to', locale);
+        if (to !== undefined)
+            filter.to = to;
+        const filterObj = readFilterObject(query, 'filter', locale);
+        if (filterObj !== undefined)
+            filter.filter = filterObj;
+        const { limit, offset } = resolvePagination({
+            limit: readInt(query, 'limit', locale),
+            offset: readInt(query, 'offset', locale),
+        });
+        filter.limit = limit;
+        filter.offset = offset;
+        const { rows, total } = await audit.query(filter);
+        return { rows, total, limit, offset };
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/adapters/rest/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/adapters/rest/audit.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAEvE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjG,iFAAiF;AACjF,SAAS,gBAAgB,CACvB,KAA8B,EAC9B,GAAW,EACX,MAAc;IAEd,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAqB,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAoB,EAAE,IAAc,EAAE,UAAuB,EAAE;IACjG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzB,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAEhC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAErD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAgC,CAAC;QAEvD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,MAAM,GAAe,EAAE,CAAC;QAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,KAAK,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC;QAC5B,CAAC;aAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC;QAC9B,CAAC;QAED,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACnD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;QAC3C,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,EAAE,KAAK,SAAS;YAAE,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QACvD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC;YAC1C,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC;YACtC,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;QACrB,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;QAEvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/common.d.ts

@@ -0,0 +1,30 @@
+import type { Locale, RbacSubject } from '../../core/index.js';
+import type { SlidingWindow } from '../../core/limiter/index.js';
+import { type Authenticator } from '../auth/index.js';
+/** raw API key from the Authorization header (rate-limit key, mirrors MCP) */
+export declare function rateKey(header: string | undefined): string | undefined;
+/** enforce the sliding window for a request; throws 429 when exceeded */
+export declare function checkRateLimit(limiter: SlidingWindow | undefined, request: {
+    headers: {
+        authorization?: string;
+    };
+}, locale: Locale): void;
+/** authenticate a request against the auth source (401 on missing/invalid key) */
+export declare function authenticateRequest(authenticator: Authenticator, request: {
+    headers: {
+        authorization?: string;
+    };
+}, locale: Locale): Promise<RbacSubject>;
+/**
+ * Fail-closed admin gate (SU-7b/SU-7c): the subject must carry at least one
+ * role listed in `adminRoles`. Used for admin-only source routes (server
+ * scripts, raw schema, layout writes, page lifecycle).
+ */
+export declare function requireAdmin(roles: string[], resource: string, adminRoles: string[] | undefined, locale: Locale): void;
+/** read a string query param; non-string → http.param.invalid */
+export declare function readString(query: Record<string, unknown>, key: string, locale: Locale): string | undefined;
+/** read an ISO date query param; unparsable → http.param.invalid */
+export declare function readDate(query: Record<string, unknown>, key: string, locale: Locale): Date | undefined;
+/** read an integer query param; non-integer → http.param.invalid */
+export declare function readInt(query: Record<string, unknown>, key: string, locale: Locale): number | undefined;
+//# sourceMappingURL=common.d.ts.map

package/dist/adapters/rest/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/common.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEpE,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAItE;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAC5B,OAAO,EAAE,aAAa,GAAG,SAAS,EAClC,OAAO,EAAE;IAAE,OAAO,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChD,MAAM,EAAE,MAAM,GACb,IAAI,CAMN;AAED,kFAAkF;AAClF,wBAAsB,mBAAmB,CACvC,aAAa,EAAE,aAAa,EAC5B,OAAO,EAAE;IAAE,OAAO,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EAChD,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,WAAW,CAAC,CAEtB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EAAE,EACf,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,EAChC,MAAM,EAAE,MAAM,GACb,IAAI,CAKN;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK1G;AAED,oEAAoE;AACpE,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAMtG;AAED,oEAAoE;AACpE,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAKvG"}

package/dist/adapters/rest/common.js

@@ -0,0 +1,62 @@
+import { SchemaError } from '../../core/index.js';
+import { authenticate } from '../auth/index.js';
+/** raw API key from the Authorization header (rate-limit key, mirrors MCP) */
+export function rateKey(header) {
+    if (header === undefined)
+        return undefined;
+    const match = /^Bearer\s+(\S+)$/i.exec(header.trim());
+    return match === null ? undefined : match[1];
+}
+/** enforce the sliding window for a request; throws 429 when exceeded */
+export function checkRateLimit(limiter, request, locale) {
+    if (limiter === undefined)
+        return;
+    const key = rateKey(request.headers.authorization) ?? '(none)';
+    if (!limiter.check(key)) {
+        throw new SchemaError('http.rateLimited', {}, locale);
+    }
+}
+/** authenticate a request against the auth source (401 on missing/invalid key) */
+export async function authenticateRequest(authenticator, request, locale) {
+    return authenticate(authenticator, request.headers.authorization, locale);
+}
+/**
+ * Fail-closed admin gate (SU-7b/SU-7c): the subject must carry at least one
+ * role listed in `adminRoles`. Used for admin-only source routes (server
+ * scripts, raw schema, layout writes, page lifecycle).
+ */
+export function requireAdmin(roles, resource, adminRoles, locale) {
+    const admin = new Set(adminRoles ?? []);
+    if (!roles.some((role) => admin.has(role))) {
+        throw new SchemaError('rbac.denied.update', { object: resource, role: roles.join(',') }, locale);
+    }
+}
+/** read a string query param; non-string → http.param.invalid */
+export function readString(query, key, locale) {
+    const v = query[key];
+    if (v === undefined)
+        return undefined;
+    if (typeof v !== 'string')
+        throw new SchemaError('http.param.invalid', { param: key }, locale);
+    return v;
+}
+/** read an ISO date query param; unparsable → http.param.invalid */
+export function readDate(query, key, locale) {
+    const v = readString(query, key, locale);
+    if (v === undefined)
+        return undefined;
+    const d = new Date(v);
+    if (Number.isNaN(d.getTime()))
+        throw new SchemaError('http.param.invalid', { param: key }, locale);
+    return d;
+}
+/** read an integer query param; non-integer → http.param.invalid */
+export function readInt(query, key, locale) {
+    const v = readString(query, key, locale);
+    if (v === undefined)
+        return undefined;
+    if (!/^-?\d+$/.test(v))
+        throw new SchemaError('http.param.invalid', { param: key }, locale);
+    return Number(v);
+}
+//# sourceMappingURL=common.js.map

package/dist/adapters/rest/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/adapters/rest/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGlD,OAAO,EAAE,YAAY,EAAsB,MAAM,kBAAkB,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CAAC,MAA0B;IAChD,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAC5B,OAAkC,EAClC,OAAgD,EAChD,MAAc;IAEd,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC;IAC/D,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAA4B,EAC5B,OAAgD,EAChD,MAAc;IAEd,OAAO,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAe,EACf,QAAgB,EAChB,UAAgC,EAChC,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,UAAU,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IACpF,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/F,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,QAAQ,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IAClF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IACnG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,OAAO,CAAC,KAA8B,EAAE,GAAW,EAAE,MAAc;IACjF,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC"}

package/dist/adapters/rest/errorHandler.d.ts

@@ -0,0 +1,9 @@
+import type { FastifyInstance } from 'fastify';
+import type { Locale } from '../../core/index.js';
+/**
+ * Install uniform error handling on the app:
+ * - setErrorHandler: every thrown error → {@link mapSchemaError} spec
+ * - setNotFoundHandler: unknown routes → uniform 404 body
+ */
+export declare function setErrorHandlers(app: FastifyInstance, locale: Locale): void;
+//# sourceMappingURL=errorHandler.d.ts.map

package/dist/adapters/rest/errorHandler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/errorHandler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAIlD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAS3E"}

package/dist/adapters/rest/errorHandler.js

@@ -0,0 +1,18 @@
+import { SchemaError } from '../../core/index.js';
+import { mapSchemaError } from '../../core/api/index.js';
+/**
+ * Install uniform error handling on the app:
+ * - setErrorHandler: every thrown error → {@link mapSchemaError} spec
+ * - setNotFoundHandler: unknown routes → uniform 404 body
+ */
+export function setErrorHandlers(app, locale) {
+    app.setErrorHandler((err, _request, reply) => {
+        const spec = mapSchemaError(err, locale);
+        reply.status(spec.status).send(spec.body);
+    });
+    app.setNotFoundHandler((_request, reply) => {
+        const spec = mapSchemaError(new SchemaError('http.notFound', {}, locale), locale);
+        reply.status(spec.status).send(spec.body);
+    });
+}
+//# sourceMappingURL=errorHandler.js.map

package/dist/adapters/rest/errorHandler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errorHandler.js","sourceRoot":"","sources":["../../../src/adapters/rest/errorHandler.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAEzD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAoB,EAAE,MAAc;IACnE,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,kBAAkB,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAClF,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/guardrails.d.ts

@@ -0,0 +1,22 @@
+import type { FastifyInstance } from 'fastify';
+import { type Locale } from '../../core/index.js';
+import type { AutoCommitOptions } from '../../runtime/git/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+export interface GuardrailsRouteDeps {
+    authenticator: Authenticator;
+    locale: Locale;
+    projectDir?: string;
+    /** resolved guardrail policies directory (relative to projectDir); absent = guardrails disabled */
+    policiesDir?: string;
+    commitIdentity?: AutoCommitOptions['identity'];
+}
+/**
+ * Guardrail policy source routes (M10c, admin): list the engine project's
+ * `policies/` directory, read a policy's source, and write it back (git
+ * committed). Only the directory configured via `tools.guardrails.policies`
+ * (a string) is exposed — inline-array guardrails have no file surface.
+ * Enabled only when the engine project supplies a policies directory.
+ */
+export declare function registerGuardrailsRoutes(app: FastifyInstance, deps: GuardrailsRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=guardrails.d.ts.map

package/dist/adapters/rest/guardrails.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/guardrails.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAe,KAAK,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAOpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mGAAmG;IACnG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;CAChD;AAgBD;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,mBAAmB,EACzB,OAAO,GAAE,WAAgB,GACxB,IAAI,CAsDN"}

package/dist/adapters/rest/guardrails.js

@@ -0,0 +1,77 @@
+import { SchemaError } from '../../core/index.js';
+import { listGuardrailHistory, listGuardrailPolicies, readGuardrailPolicy, writeGuardrailPolicy, } from '../../runtime/git/guardrailSource.js';
+import { authenticateRequest, checkRateLimit, requireAdmin } from './common.js';
+function saveBody(body, locale) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        throw new SchemaError('http.param.invalid', { param: 'body' }, locale);
+    }
+    const { source, expectVersion } = body;
+    if (typeof source !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'source' }, locale);
+    }
+    if (expectVersion !== undefined && typeof expectVersion !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'expectVersion' }, locale);
+    }
+    return expectVersion === undefined ? { source } : { source, expectVersion };
+}
+/**
+ * Guardrail policy source routes (M10c, admin): list the engine project's
+ * `policies/` directory, read a policy's source, and write it back (git
+ * committed). Only the directory configured via `tools.guardrails.policies`
+ * (a string) is exposed — inline-array guardrails have no file surface.
+ * Enabled only when the engine project supplies a policies directory.
+ */
+export function registerGuardrailsRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/guardrails/policies`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'guardrails', options.adminRoles, locale);
+        if (deps.projectDir === undefined || deps.policiesDir === undefined)
+            return { policies: [] };
+        const policies = await listGuardrailPolicies(deps.projectDir, deps.policiesDir);
+        return { policies };
+    });
+    app.get(`${prefix}/guardrails/policies/:name`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'guardrails', options.adminRoles, locale);
+        if (deps.projectDir === undefined || deps.policiesDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        const document = await readGuardrailPolicy(deps.projectDir, deps.policiesDir, name);
+        if (document === null)
+            throw new SchemaError('http.notFound', {}, locale);
+        return document;
+    });
+    app.get(`${prefix}/guardrails/policies/:name/history`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'guardrails', options.adminRoles, locale);
+        if (deps.projectDir === undefined || deps.policiesDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        return await listGuardrailHistory(deps.projectDir, deps.policiesDir, name);
+    });
+    app.put(`${prefix}/guardrails/policies/:name`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'guardrails', options.adminRoles, locale);
+        if (deps.projectDir === undefined || deps.policiesDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        const body = saveBody(request.body, locale);
+        const result = await writeGuardrailPolicy(deps.projectDir, deps.policiesDir, name, {
+            source: body.source,
+            identity: deps.commitIdentity,
+            locale,
+        });
+        return { ok: true, committed: result.committed, version: result.version };
+    });
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/adapters/rest/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../../src/adapters/rest/guardrails.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAe,MAAM,qBAAqB,CAAC;AAE/D,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sCAAsC,CAAC;AAE9C,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYhF,SAAS,QAAQ,CAAC,IAAa,EAAE,MAAc;IAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAA+B,CAAC;IAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,IAAyB,EACzB,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,sBAAsB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC7F,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAChF,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACpF,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,oCAAoC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvE,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE;YACjF,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/identities.d.ts

@@ -0,0 +1,20 @@
+import type { FastifyInstance } from 'fastify';
+import type { Locale, RbacSubject } from '../../core/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+export interface IdentitiesRouteDeps {
+    authenticator: Authenticator;
+    locale: Locale;
+    /** the MCP on-behalf-of identity directory (static `ref → subject`); a function resolver has no introspectable surface */
+    identities?: Record<string, RbacSubject>;
+}
+/**
+ * Identity directory route (M11, admin read): surface the engine's
+ * `mcp.identities` static directory so the governance console can render an
+ * `IdentityTable` (ref → id / roles / team). Only the static-directory form is
+ * exposed — a customer-provided `IdentityResolver` (function) has no
+ * introspectable entries and returns `{ identities: [] }`.
+ *   GET {prefix}/identities → { identities: [{ ref, id, roles, teamId? }] }
+ */
+export declare function registerIdentitiesRoutes(app: FastifyInstance, deps: IdentitiesRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=identities.d.ts.map

package/dist/adapters/rest/identities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identities.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/identities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,0HAA0H;IAC1H,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CAC1C;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,mBAAmB,EACzB,OAAO,GAAE,WAAgB,GACxB,IAAI,CAiBN"}

package/dist/adapters/rest/identities.js

@@ -0,0 +1,27 @@
+import { authenticateRequest, checkRateLimit, requireAdmin } from './common.js';
+/**
+ * Identity directory route (M11, admin read): surface the engine's
+ * `mcp.identities` static directory so the governance console can render an
+ * `IdentityTable` (ref → id / roles / team). Only the static-directory form is
+ * exposed — a customer-provided `IdentityResolver` (function) has no
+ * introspectable entries and returns `{ identities: [] }`.
+ *   GET {prefix}/identities → { identities: [{ ref, id, roles, teamId? }] }
+ */
+export function registerIdentitiesRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/identities`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'identities', options.adminRoles, locale);
+        const identities = Object.entries(deps.identities ?? {}).map(([ref, subjectValue]) => ({
+            ref,
+            id: subjectValue.id,
+            roles: subjectValue.roles,
+            ...(subjectValue.teamId === undefined ? {} : { teamId: subjectValue.teamId }),
+        }));
+        return { identities };
+    });
+}
+//# sourceMappingURL=identities.js.map

package/dist/adapters/rest/identities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identities.js","sourceRoot":"","sources":["../../../src/adapters/rest/identities.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAUhF;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAAoB,EACpB,IAAyB,EACzB,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,GAAG;YACH,EAAE,EAAE,YAAY,CAAC,EAAE;YACnB,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;SAC9E,CAAC,CAAC,CAAC;QACJ,OAAO,EAAE,UAAU,EAAE,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/index.d.ts

@@ -0,0 +1,17 @@
+export { registerObjectRoutes } from './plugin.js';
+export type { RestDeps, RestOptions } from './plugin.js';
+export { setErrorHandlers } from './errorHandler.js';
+export { registerMetadataRoutes } from './metadata.js';
+export { registerPermissionsRoutes } from './permissions.js';
+export { registerAuditRoutes } from './audit.js';
+export { registerApprovalsRoutes } from './approvals.js';
+export { registerScriptRoutes } from './scripts.js';
+export { registerPagesRoutes } from './pages.js';
+export { registerSchemaRoutes } from './schemas.js';
+export { registerGuardrailsRoutes } from './guardrails.js';
+export { registerIdentitiesRoutes } from './identities.js';
+export { registerProxyRoutes } from './proxy.js';
+export type { ProxyRouteDeps } from './proxy.js';
+export { registerIngressRoutes } from './ingress.js';
+export type { IngressDeps } from './ingress.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/adapters/rest/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/adapters/rest/index.js

@@ -0,0 +1,14 @@
+export { registerObjectRoutes } from './plugin.js';
+export { setErrorHandlers } from './errorHandler.js';
+export { registerMetadataRoutes } from './metadata.js';
+export { registerPermissionsRoutes } from './permissions.js';
+export { registerAuditRoutes } from './audit.js';
+export { registerApprovalsRoutes } from './approvals.js';
+export { registerScriptRoutes } from './scripts.js';
+export { registerPagesRoutes } from './pages.js';
+export { registerSchemaRoutes } from './schemas.js';
+export { registerGuardrailsRoutes } from './guardrails.js';
+export { registerIdentitiesRoutes } from './identities.js';
+export { registerProxyRoutes } from './proxy.js';
+export { registerIngressRoutes } from './ingress.js';
+//# sourceMappingURL=index.js.map

package/dist/adapters/rest/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/adapters/rest/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC"}

package/dist/adapters/rest/ingress.d.ts

@@ -0,0 +1,13 @@
+import type { FastifyInstance } from 'fastify';
+import type { AuditSink, Locale } from '../../core/index.js';
+import type { IngressConfig } from '../../core/provider/event/index.js';
+import type { SlidingWindow } from '../../core/limiter/index.js';
+export interface IngressDeps {
+    /** audit sink (NOOP when audit is disabled) */
+    audit: AuditSink;
+    locale: Locale;
+    /** per-source limiter, created by the assembly layer from `config.rateLimit` */
+    rateLimiter?: SlidingWindow;
+}
+export declare function registerIngressRoutes(app: FastifyInstance, deps: IngressDeps, config: IngressConfig): void;
+//# sourceMappingURL=ingress.d.ts.map

package/dist/adapters/rest/ingress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/ingress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAkB,MAAM,SAAS,CAAC;AAE/D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAgBjE,MAAM,WAAW,WAAW;IAC1B,+CAA+C;IAC/C,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,WAAW,CAAC,EAAE,aAAa,CAAC;CAC7B;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,GAAG,IAAI,CAyC1G"}