@weave-kit/engine 0.1.0

package/dist/runtime/git/sourceTransaction.js

@@ -0,0 +1,176 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, readdir, rename, rm, writeFile } from 'node:fs/promises';
+import { basename, dirname, join, sep } from 'node:path';
+import { SchemaError } from '../../core/index.js';
+import { commitPaths } from './autoCommit.js';
+import { isMissingFile, readSource, writeSourceAtomically } from './sourceFile.js';
+/** project-level serial mutation queue — git writes within a project must not interleave */
+const queues = new Map();
+function enqueue(dir, task) {
+    const previous = queues.get(dir) ?? Promise.resolve();
+    const next = previous.then(task);
+    queues.set(dir, next.then(() => undefined, () => undefined));
+    return next;
+}
+/** run a source transaction on the project's serial queue */
+export function runSourceTransaction(options) {
+    return enqueue(options.projectDir, () => sourceTransactionTask(options));
+}
+/** run an arbitrary (already-serialized-safe) task on the project's mutation queue */
+export function runSerialized(projectDir, task) {
+    return enqueue(projectDir, task);
+}
+/** delete one source file and commit the removal (serialized; restores on failure) */
+export function deleteSourceFile(options) {
+    return enqueue(options.projectDir, () => deleteSourceTask(options));
+}
+async function deleteSourceTask(options) {
+    const { projectDir, path, message, identity, locale } = options;
+    const baseline = await readSource(projectDir, path);
+    if (baseline === null) {
+        throw new SchemaError('http.notFound', {}, locale);
+    }
+    await rm(join(projectDir, path), { force: true });
+    try {
+        const commit = await commitPaths({
+            dir: projectDir,
+            paths: [path],
+            message: message ?? 'chore(sources): delete file',
+            identity,
+            locale,
+        });
+        return { committed: commit.committed, sha: commit.sha };
+    }
+    catch (error) {
+        await writeSourceAtomically(projectDir, path, baseline.source);
+        throw error;
+    }
+}
+/** delete a whole source directory (page dir) and commit the removal (serialized; restores on failure) */
+export function deleteSourceDir(options) {
+    return enqueue(options.projectDir, () => deleteSourceDirTask(options));
+}
+async function listFilesRecursive(dir, base) {
+    const out = [];
+    let entries;
+    try {
+        entries = await readdir(dir, { withFileTypes: true });
+    }
+    catch (error) {
+        if (isMissingFile(error))
+            return out;
+        throw error;
+    }
+    for (const entry of entries) {
+        const rel = join(base, entry.name).split(sep).join('/');
+        if (entry.isDirectory())
+            out.push(...(await listFilesRecursive(join(dir, entry.name), rel)));
+        else
+            out.push(rel);
+    }
+    return out;
+}
+async function deleteSourceDirTask(options) {
+    const { projectDir, dir, message, identity, locale } = options;
+    const files = await listFilesRecursive(join(projectDir, dir), dir);
+    if (files.length === 0) {
+        throw new SchemaError('http.notFound', {}, locale);
+    }
+    const baselines = new Map();
+    for (const file of files) {
+        const baseline = await readSource(projectDir, file);
+        if (baseline !== null)
+            baselines.set(file, baseline);
+    }
+    await rm(join(projectDir, dir), { recursive: true, force: true });
+    try {
+        const commit = await commitPaths({
+            dir: projectDir,
+            paths: files,
+            message: message ?? 'chore(sources): delete directory',
+            identity,
+            locale,
+        });
+        return { committed: commit.committed, sha: commit.sha };
+    }
+    catch (error) {
+        for (const [file, baseline] of baselines) {
+            await writeSourceAtomically(projectDir, file, baseline.source);
+        }
+        throw error;
+    }
+}
+async function sourceTransactionTask(options) {
+    const { projectDir, files, validate, force, message, identity, locale } = options;
+    if (files.length === 0)
+        return { committed: false };
+    // 1. read baselines + strict version checks (409 unless force)
+    const baselines = new Map();
+    for (const file of files) {
+        const baseline = await readSource(projectDir, file.path);
+        baselines.set(file.path, baseline);
+        if (force)
+            continue;
+        if (baseline === null) {
+            // create — a versioned create is a conflict (client raced an existing file)
+            if (file.expectVersion !== undefined) {
+                throw new SchemaError('source.versionMismatch', { expectVersion: file.expectVersion, version: null }, locale);
+            }
+            continue;
+        }
+        if (file.expectVersion === undefined || baseline.version !== file.expectVersion) {
+            throw new SchemaError('source.versionMismatch', { expectVersion: file.expectVersion ?? null, version: baseline.version }, locale);
+        }
+    }
+    // 2. validate every candidate BEFORE any write
+    if (validate !== undefined) {
+        for (const file of files)
+            await validate(file);
+    }
+    // 3. write temps under `.weavekit/txn-<uuid>/`, then rename into place
+    const tempDir = join(projectDir, '.weavekit', `txn-${randomUUID()}`);
+    await mkdir(tempDir, { recursive: true });
+    const tempPaths = [];
+    try {
+        for (let i = 0; i < files.length; i++) {
+            const file = files[i];
+            const temp = join(tempDir, `${i}-${basename(file.path)}`);
+            await writeFile(temp, file.source, 'utf8');
+            tempPaths.push({ rel: file.path, temp });
+        }
+        for (const { rel, temp } of tempPaths) {
+            await mkdir(dirname(join(projectDir, rel)), { recursive: true });
+            await rename(temp, join(projectDir, rel));
+        }
+        // 4. one commit; restore working tree on failure (commitPaths restores the index)
+        try {
+            const commit = await commitPaths({
+                dir: projectDir,
+                paths: files.map((f) => f.path),
+                message: message ?? 'chore(sources): update pages metadata',
+                identity,
+                locale,
+            });
+            return { committed: commit.committed, sha: commit.sha };
+        }
+        catch (error) {
+            await restoreBaselines(projectDir, files, baselines);
+            throw error;
+        }
+    }
+    finally {
+        await rm(tempDir, { recursive: true, force: true });
+    }
+}
+async function restoreBaselines(projectDir, files, baselines) {
+    for (const file of files) {
+        const baseline = baselines.get(file.path);
+        if (baseline == null) {
+            await rm(join(projectDir, file.path), { force: true });
+        }
+        else {
+            await writeSourceAtomically(projectDir, file.path, baseline.source);
+        }
+    }
+}
+//# sourceMappingURL=sourceTransaction.js.map

package/dist/runtime/git/sourceTransaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sourceTransaction.js","sourceRoot":"","sources":["../../../src/runtime/git/sourceTransaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,WAAW,EAAe,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAA0B,MAAM,iBAAiB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAmCnF,4FAA4F;AAC5F,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;AAEnD,SAAS,OAAO,CAAI,GAAW,EAAE,IAAsB;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,CACR,GAAG,EACH,IAAI,CAAC,IAAI,CACP,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,oBAAoB,CAAC,OAAiC;IACpE,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAI,UAAkB,EAAE,IAAsB;IACzE,OAAO,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAWD,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,OAA4B;IAC3D,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAA4B;IAC1D,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,CAAC,IAAI,CAAC;YACb,OAAO,EAAE,OAAO,IAAI,6BAA6B;YACjD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,qBAAqB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAWD,0GAA0G;AAC1G,MAAM,UAAU,eAAe,CAAC,OAA+B;IAC7D,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,IAAY;IACzD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,aAAa,CAAC,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACrC,MAAM,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;;YACxF,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAA+B;IAChE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;IACnE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA+C,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,GAAG,EAAE,UAAU;YACf,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,OAAO,IAAI,kCAAkC;YACtD,QAAQ;YACR,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;YACzC,MAAM,qBAAqB,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAiC;IACpE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAEpD,+DAA+D;IAC/D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsD,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnC,IAAI,KAAK;YAAE,SAAS;QACpB,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,4EAA4E;YAC5E,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBACrC,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YAChH,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;YAChF,MAAM,IAAI,WAAW,CACnB,wBAAwB,EACxB,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,EACxE,MAAM,CACP,CAAC;QACJ,CAAC;IACH,CAAC;IAED,+CAA+C;IAC/C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,UAAU,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAyC,EAAE,CAAC;IAC3D,IAAI,CAAC;QACH,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACvB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC1D,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3C,SAAS,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,SAAS,EAAE,CAAC;YACtC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACjE,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;QAED,kFAAkF;QAClF,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;gBAC/B,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC/B,OAAO,EAAE,OAAO,IAAI,uCAAuC;gBAC3D,QAAQ;gBACR,MAAM;aACP,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,gBAAgB,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;YACrD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,UAAkB,EAClB,KAA4B,EAC5B,SAAkE;IAElE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,EAAE,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,CAAC;aAAM,CAAC;YACN,MAAM,qBAAqB,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/runtime/git/sync.d.ts

@@ -0,0 +1,33 @@
+import { ObjectRegistry } from '../../core/index.js';
+import type { Locale, MigrationResult } from '../../core/index.js';
+import type { LoadResult } from './loader.js';
+export interface SyncSchemaOptions {
+    /** project root containing `objects/**` */
+    dir: string;
+    /** postgres connection string; falls back to process.env.DATABASE_URL */
+    databaseUrl?: string;
+    /** generate DDL + report without executing or writing the metadata cache */
+    dryRun?: boolean;
+    /** enable row-level security for the restricted-SQL role (`this.db.query`) */
+    rls?: {
+        role: string;
+    };
+    locale?: Locale;
+    allowedFieldTypes?: readonly string[];
+}
+export interface SyncResult {
+    registry: ObjectRegistry;
+    files: LoadResult['files'];
+    migration: MigrationResult;
+    cache: {
+        updated: string[];
+        removed: string[];
+    };
+}
+/**
+ * One-way Git → PG metadata sync (MVP simplification): read schema files →
+ * validate → migrate DDL → write the PG metadata cache. Returns the registry
+ * built from disk so callers (e.g. createEngine) can reuse it.
+ */
+export declare function syncSchema(options: SyncSchemaOptions): Promise<SyncResult>;
+//# sourceMappingURL=sync.d.ts.map

package/dist/runtime/git/sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.d.ts","sourceRoot":"","sources":["../../../src/runtime/git/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAoC,MAAM,qBAAqB,CAAC;AACvF,OAAO,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGnE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9C,MAAM,WAAW,iBAAiB;IAChC,2CAA2C;IAC3C,GAAG,EAAE,MAAM,CAAC;IACZ,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4EAA4E;IAC5E,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,8EAA8E;IAC9E,GAAG,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACvC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,SAAS,EAAE,eAAe,CAAC;IAC3B,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;CACjD;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAuChF"}

package/dist/runtime/git/sync.js

@@ -0,0 +1,42 @@
+import { ObjectRegistry, SchemaError, createPool, migrate } from '../../core/index.js';
+import { syncMetadataCache } from '../metadata/index.js';
+import { loadSchemaDir } from './loader.js';
+/**
+ * One-way Git → PG metadata sync (MVP simplification): read schema files →
+ * validate → migrate DDL → write the PG metadata cache. Returns the registry
+ * built from disk so callers (e.g. createEngine) can reuse it.
+ */
+export async function syncSchema(options) {
+    const url = options.databaseUrl ?? process.env.DATABASE_URL;
+    if (url === undefined) {
+        throw new SchemaError('engine.databaseUrl.missing', {}, options.locale);
+    }
+    const { registry, files } = await loadSchemaDir(options.dir, { locale: options.locale, allowedFieldTypes: options.allowedFieldTypes });
+    registry.buildGraph({ locale: options.locale });
+    const migration = await migrate(registry, {
+        databaseUrl: url,
+        dryRun: options.dryRun,
+        rls: options.rls,
+    });
+    let cache = { updated: [], removed: [] };
+    if (!options.dryRun) {
+        const pool = createPool(url);
+        try {
+            cache = await syncMetadataCache(pool, files.map((f) => ({ name: f.name, contentHash: f.contentHash, definition: f.object })));
+        }
+        catch (error) {
+            // The DDL (migrate) above is already committed and idempotent. The cache
+            // write is a separate step — on failure surface it loudly (never a
+            // silent partial sync leaving Git source of truth vs PG cache drifted);
+            // a re-run of sync converges.
+            if (error instanceof SchemaError)
+                throw error;
+            throw new Error(`metadata cache write failed after DDL applied (re-run sync to converge): ${error instanceof Error ? error.message : String(error)}`);
+        }
+        finally {
+            await pool.end();
+        }
+    }
+    return { registry, files, migration, cache };
+}
+//# sourceMappingURL=sync.js.map

package/dist/runtime/git/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../../src/runtime/git/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAEvF,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuB5C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,OAA0B;IACzD,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC5D,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,4BAA4B,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvI,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;QACxC,WAAW,EAAE,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;KACjB,CAAC,CAAC;IAEH,IAAI,KAAK,GAA6C,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACnF,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,iBAAiB,CAC7B,IAAI,EACJ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CACvF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,mEAAmE;YACnE,wEAAwE;YACxE,8BAA8B;YAC9B,IAAI,KAAK,YAAY,WAAW;gBAAE,MAAM,KAAK,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,4EACE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,EAAE,CACH,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC/C,CAAC"}

package/dist/runtime/metadata/cache.d.ts

@@ -0,0 +1,29 @@
+import type { Pool } from 'pg';
+export interface MetadataRow {
+    objectName: string;
+    contentHash: string;
+    appliedAt: Date;
+}
+export interface MetadataEntry {
+    name: string;
+    contentHash: string;
+    definition: unknown;
+}
+/** create the metadata cache table if it does not exist */
+export declare function ensureMetadataTable(pool: Pool): Promise<void>;
+/** read the whole metadata cache keyed by object name */
+export declare function readMetadataCache(pool: Pool): Promise<Map<string, MetadataRow>>;
+/** upsert metadata cache entries inside a transaction */
+export declare function writeMetadataCache(pool: Pool, entries: MetadataEntry[]): Promise<void>;
+/** drop metadata cache rows for objects that no longer exist on disk */
+export declare function invalidateMetadata(pool: Pool, names: string[]): Promise<void>;
+/**
+ * Bring the metadata cache in sync with the loaded schema files: upsert the
+ * current definitions and prune rows for removed objects. Returns which
+ * objects were updated (content hash changed) and removed.
+ */
+export declare function syncMetadataCache(pool: Pool, files: MetadataEntry[]): Promise<{
+    updated: string[];
+    removed: string[];
+}>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/runtime/metadata/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../../src/runtime/metadata/cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAI/B,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,2DAA2D;AAC3D,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAUnE;AAED,yDAAyD;AACzD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAarF;AAED,yDAAyD;AACzD,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB5F;AAED,wEAAwE;AACxE,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnF;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,aAAa,EAAE,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAQnD"}

package/dist/runtime/metadata/cache.js

@@ -0,0 +1,70 @@
+const TABLE = 'weavekit_metadata';
+/** create the metadata cache table if it does not exist */
+export async function ensureMetadataTable(pool) {
+    await pool.query(`CREATE TABLE IF NOT EXISTS ${TABLE} (
+       object_name text PRIMARY KEY,
+       content_hash text NOT NULL,
+       definition jsonb NOT NULL,
+       applied_at timestamptz NOT NULL DEFAULT now(),
+       updated_at timestamptz NOT NULL DEFAULT now()
+     )`);
+}
+/** read the whole metadata cache keyed by object name */
+export async function readMetadataCache(pool) {
+    const result = await pool.query(`SELECT object_name, content_hash, applied_at FROM ${TABLE}`);
+    const map = new Map();
+    for (const row of result.rows) {
+        map.set(row.object_name, {
+            objectName: row.object_name,
+            contentHash: row.content_hash,
+            appliedAt: row.applied_at,
+        });
+    }
+    return map;
+}
+/** upsert metadata cache entries inside a transaction */
+export async function writeMetadataCache(pool, entries) {
+    if (entries.length === 0)
+        return;
+    const client = await pool.connect();
+    try {
+        await client.query('BEGIN');
+        for (const entry of entries) {
+            await client.query(`INSERT INTO ${TABLE} (object_name, content_hash, definition, updated_at)
+         VALUES ($1, $2, $3::jsonb, now())
+         ON CONFLICT (object_name) DO UPDATE
+           SET content_hash = EXCLUDED.content_hash,
+               definition = EXCLUDED.definition,
+               updated_at = now()`, [entry.name, entry.contentHash, JSON.stringify(entry.definition)]);
+        }
+        await client.query('COMMIT');
+    }
+    catch (error) {
+        await client.query('ROLLBACK');
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+}
+/** drop metadata cache rows for objects that no longer exist on disk */
+export async function invalidateMetadata(pool, names) {
+    if (names.length === 0)
+        return;
+    await pool.query(`DELETE FROM ${TABLE} WHERE object_name = ANY($1)`, [names]);
+}
+/**
+ * Bring the metadata cache in sync with the loaded schema files: upsert the
+ * current definitions and prune rows for removed objects. Returns which
+ * objects were updated (content hash changed) and removed.
+ */
+export async function syncMetadataCache(pool, files) {
+    await ensureMetadataTable(pool);
+    const existing = await readMetadataCache(pool);
+    const updated = files.filter((f) => existing.get(f.name)?.contentHash !== f.contentHash).map((f) => f.name);
+    const removed = [...existing.keys()].filter((name) => !files.some((f) => f.name === name));
+    await writeMetadataCache(pool, files);
+    await invalidateMetadata(pool, removed);
+    return { updated, removed };
+}
+//# sourceMappingURL=cache.js.map

package/dist/runtime/metadata/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../../src/runtime/metadata/cache.ts"],"names":[],"mappings":"AAEA,MAAM,KAAK,GAAG,mBAAmB,CAAC;AAclC,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAU;IAClD,MAAM,IAAI,CAAC,KAAK,CACd,8BAA8B,KAAK;;;;;;OAMhC,CACJ,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAU;IAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,qDAAqD,KAAK,EAAE,CAC7D,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAyE,EAAE,CAAC;QACnG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE;YACvB,UAAU,EAAE,GAAG,CAAC,WAAW;YAC3B,WAAW,EAAE,GAAG,CAAC,YAAY;YAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE,OAAwB;IAC3E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,MAAM,CAAC,KAAK,CAChB,eAAe,KAAK;;;;;kCAKM,EAC1B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAU,EAAE,KAAe;IAClE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,KAAK,8BAA8B,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAU,EACV,KAAsB;IAEtB,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC;IAC3F,MAAM,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/runtime/metadata/index.d.ts

@@ -0,0 +1,3 @@
+export { ensureMetadataTable, readMetadataCache, writeMetadataCache, invalidateMetadata, syncMetadataCache, } from './cache.js';
+export type { MetadataRow, MetadataEntry } from './cache.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/metadata/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/metadata/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/runtime/metadata/index.js

@@ -0,0 +1,2 @@
+export { ensureMetadataTable, readMetadataCache, writeMetadataCache, invalidateMetadata, syncMetadataCache, } from './cache.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/metadata/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/metadata/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/dist/runtime/proxy/fetch.d.ts

@@ -0,0 +1,36 @@
+import { type Locale } from '../../core/i18n/index.js';
+import type { ProxyTarget, ProxyRequest, ProxyResponse } from '../../core/proxy/types.js';
+/**
+ * Outbound fetch forwarder for the engine generic proxy (P-2). Lives in the
+ * runtime layer (real IO) — core stays IO-free per the proxy contract.
+ *
+ * Security: this is the wrapper that actually issues the network call, so it
+ * re-validates the path (defense in depth on top of `isAllowedProxyPath`):
+ * only `[A-Za-z0-9_/.-]`, no `..`/blank segments, no percent-encoding. The
+ * customer-engine api key is set as a Bearer header and NEVER leaks to the
+ * browser. No non-Bearer/remote headers are replayed.
+ */
+export interface ProxyForwarder {
+    /** buffered forward → `{status, body}` (reads a bounded body; JSON for json responses). */
+    forward(target: ProxyTarget, req: ProxyRequest): Promise<ProxyResponse>;
+    /** streaming forward → the raw upstream `Response` (for SSE): caller pipes the body and calls `abort()` on teardown. */
+    forwardStream(target: ProxyTarget, req: ProxyRequest): Promise<ProxyStream>;
+}
+/** a streaming forward handle: the upstream response + how to cancel it. */
+export interface ProxyStream {
+    response: Response;
+    abort(): void;
+}
+export interface ProxyForwarderOptions {
+    /** injectable fetch (tests) — defaults to the runtime global. */
+    fetchImpl?: typeof fetch;
+    /** per-request timeout (default 10_000ms; not applied to `forwardStream` — SSE is long-lived). */
+    timeoutMs?: number;
+    /** response body cap in bytes (default 1 MiB) to prevent large replay. */
+    maxBodyBytes?: number;
+    /** REST path prefix joined onto the target (default `/api`). */
+    pathPrefix?: string;
+    locale?: Locale;
+}
+export declare function createProxyForwarder(opts?: ProxyForwarderOptions): ProxyForwarder;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/runtime/proxy/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../../src/runtime/proxy/fetch.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,MAAM,EAAE,MAAM,0BAA0B,CAAC;AACvE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1F;;;;;;;;;GASG;AAEH,MAAM,WAAW,cAAc;IAC7B,2FAA2F;IAC3F,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACxE,wHAAwH;IACxH,aAAa,CAAC,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC7E;AAED,4EAA4E;AAC5E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,QAAQ,CAAC;IACnB,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,iEAAiE;IACjE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAkBD,wBAAgB,oBAAoB,CAAC,IAAI,GAAE,qBAA0B,GAAG,cAAc,CA2GrF"}

package/dist/runtime/proxy/fetch.js

@@ -0,0 +1,136 @@
+import { SchemaError } from '../../core/types/errors.js';
+import { DEFAULT_LOCALE } from '../../core/i18n/index.js';
+/** path whitelist: only engine-REST-safe chars (blocks SSRF/traversal/encoding). */
+const SAFE_PATH = /^[A-Za-z0-9_/.-]*$/;
+function safePath(raw) {
+    if (!SAFE_PATH.test(raw))
+        return null;
+    let p = raw;
+    if (p.startsWith('/'))
+        p = p.slice(1);
+    if (p.endsWith('/'))
+        p = p.slice(0, -1);
+    if (p === '')
+        return '';
+    const segs = p.split('/');
+    for (const s of segs) {
+        if (s === '' || s === '.' || s === '..')
+            return null;
+    }
+    return p;
+}
+export function createProxyForwarder(opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    const timeoutMs = opts.timeoutMs ?? 10_000;
+    const maxBodyBytes = opts.maxBodyBytes ?? 1_048_576;
+    const pathPrefix = opts.pathPrefix ?? '/api';
+    const locale = opts.locale ?? DEFAULT_LOCALE;
+    function buildUrl(target, path) {
+        const base = new URL(target.url);
+        const normPrefix = pathPrefix.startsWith('/') ? pathPrefix.replace(/\/+$/, '') : `/${pathPrefix}`;
+        const normPath = path ? (path.startsWith('/') ? path : `/${path}`) : '';
+        const basePath = base.pathname.replace(/\/+$/, '');
+        return new URL(`${basePath}${normPrefix}${normPath}`.replace(/\/{2,}/g, '/') || '/', base.origin);
+    }
+    async function throwOnUnsafe(target, req) {
+        const safe = safePath(req.path);
+        if (safe === null) {
+            throw new SchemaError('proxy.denied', { instance: req.instance, target: target.id }, locale);
+        }
+        return safe;
+    }
+    /** build the outbound URL/headers/body shared by buffered + streaming forward. */
+    function composeRequest(target, safe, req) {
+        const url = buildUrl(target, safe);
+        const qs = new URLSearchParams();
+        for (const [k, v] of Object.entries(req.query ?? {})) {
+            if (v !== undefined)
+                qs.set(k, v);
+        }
+        if (qs.size > 0)
+            url.search = qs.toString();
+        // extra passthrough headers first (e.g. `last-event-id`); the customer key is authoritative
+        const headers = { ...req.headers };
+        headers.Authorization = `Bearer ${target.apiKey}`;
+        let body;
+        if (req.body !== undefined) {
+            headers['Content-Type'] = 'application/json';
+            body = JSON.stringify(req.body);
+        }
+        return { url, method: req.method, headers, body };
+    }
+    async function open(target, req, controller) {
+        const safe = await throwOnUnsafe(target, req);
+        const { url, method, headers, body } = composeRequest(target, safe, req);
+        return fetchImpl(url, {
+            method,
+            headers,
+            body,
+            ...(controller === undefined ? {} : { signal: controller.signal }),
+        });
+    }
+    return {
+        async forward(target, req) {
+            const controller = new AbortController();
+            const timer = setTimeout(() => controller.abort(), timeoutMs);
+            let resp;
+            try {
+                resp = await open(target, req, controller);
+            }
+            catch (error) {
+                clearTimeout(timer);
+                if (error instanceof SchemaError)
+                    throw error; // e.g. proxy.denied from path validation
+                if (controller.signal.aborted) {
+                    throw new SchemaError('proxy.timeout', { instance: req.instance, timeout: timeoutMs }, locale);
+                }
+                throw new SchemaError('proxy.unreachable', { instance: req.instance, target: target.id }, locale);
+            }
+            clearTimeout(timer);
+            const text = await readBounded(resp, target, req, maxBodyBytes, locale);
+            let parsed = text;
+            const contentType = resp.headers.get('content-type') ?? '';
+            if (contentType.includes('json')) {
+                try {
+                    parsed = text ? JSON.parse(text) : undefined;
+                }
+                catch {
+                    parsed = text;
+                }
+            }
+            return { status: resp.status, body: parsed };
+        },
+        async forwardStream(target, req) {
+            // long-lived SSE: no timeout (heartbeats keep it alive); teardown is via abort()
+            const controller = new AbortController();
+            let resp;
+            try {
+                resp = await open(target, req, controller);
+            }
+            catch (error) {
+                if (error instanceof SchemaError)
+                    throw error; // e.g. proxy.denied from path validation
+                if (controller.signal.aborted) {
+                    throw new SchemaError('proxy.timeout', { instance: req.instance, timeout: timeoutMs }, locale);
+                }
+                throw new SchemaError('proxy.unreachable', { instance: req.instance, target: target.id }, locale);
+            }
+            if (resp.body === null) {
+                throw new SchemaError('proxy.unreachable', { instance: req.instance, target: target.id }, locale);
+            }
+            return { response: resp, abort: () => controller.abort() };
+        },
+    };
+}
+async function readBounded(resp, target, req, maxBodyBytes, locale) {
+    const contentLength = Number(resp.headers.get('content-length') ?? '0');
+    if (contentLength > maxBodyBytes) {
+        throw new SchemaError('proxy.responseTooLarge', { instance: req.instance, target: target.id, max: maxBodyBytes }, locale);
+    }
+    const text = await resp.text();
+    if (Buffer.byteLength(text) > maxBodyBytes) {
+        throw new SchemaError('proxy.responseTooLarge', { instance: req.instance, target: target.id, max: maxBodyBytes }, locale);
+    }
+    return text;
+}
+//# sourceMappingURL=fetch.js.map

package/dist/runtime/proxy/fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.js","sourceRoot":"","sources":["../../../src/runtime/proxy/fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAe,MAAM,0BAA0B,CAAC;AAuCvE,oFAAoF;AACpF,MAAM,SAAS,GAAG,oBAAoB,CAAC;AAEvC,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACvD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAA8B,EAAE;IACnE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC;IACpD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAE7C,SAAS,QAAQ,CAAC,MAAmB,EAAE,IAAY;QACjD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;QAClG,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,GAAG,CAAC,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,MAAmB,EAAE,GAAiB;QACjE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kFAAkF;IAClF,SAAS,cAAc,CACrB,MAAmB,EACnB,IAAY,EACZ,GAAiB;QAEjB,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS;gBAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,EAAE,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;QAE5C,4FAA4F;QAC5F,MAAM,OAAO,GAA2B,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;QAC3D,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,IAAI,IAAwB,CAAC;QAC7B,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpD,CAAC;IAED,KAAK,UAAU,IAAI,CAAC,MAAmB,EAAE,GAAiB,EAAE,UAA4B;QACtF,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzE,OAAO,SAAS,CAAC,GAAG,EAAE;YACpB,MAAM;YACN,OAAO;YACP,IAAI;YACJ,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG;YACvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,IAAc,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,KAAK,YAAY,WAAW;oBAAE,MAAM,KAAK,CAAC,CAAC,yCAAyC;gBACxF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjG,CAAC;gBACD,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,YAAY,CAAC,KAAK,CAAC,CAAC;YAEpB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YACxE,IAAI,MAAM,GAAY,IAAI,CAAC;YAC3B,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YAC3D,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBAC/C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,GAAG,IAAI,CAAC;gBAChB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/C,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG;YAC7B,iFAAiF;YACjF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,IAAI,IAAc,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,WAAW;oBAAE,MAAM,KAAK,CAAC,CAAC,yCAAyC;gBACxF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAC9B,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;gBACjG,CAAC;gBACD,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACvB,MAAM,IAAI,WAAW,CAAC,mBAAmB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,IAAc,EACd,MAAmB,EACnB,GAAiB,EACjB,YAAoB,EACpB,MAAc;IAEd,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,GAAG,CAAC,CAAC;IACxE,IAAI,aAAa,GAAG,YAAY,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5H,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CAAC,wBAAwB,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/proxy/index.d.ts

@@ -0,0 +1,3 @@
+export type { ProxyForwarder, ProxyForwarderOptions, ProxyStream } from './fetch.js';
+export { createProxyForwarder } from './fetch.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/runtime/proxy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/runtime/proxy/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,cAAc,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/runtime/proxy/index.js

@@ -0,0 +1,2 @@
+export { createProxyForwarder } from './fetch.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/proxy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/proxy/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}