@weave-kit/engine 0.1.0

package/dist/adapters/rest/ingress.js

@@ -0,0 +1,49 @@
+import { AUDIT_ACTOR_TYPES, SchemaError } from '../../core/index.js';
+/**
+ * Inbound external-event entry point (first-class ingress seam):
+ *   POST {prefix}/ingress/:source
+ *
+ * The raw body is preserved for signature verification, then handed to the
+ * application-supplied `verifier`; `null` rejects (401, fail-closed). A verified
+ * event goes to the application `handler` and its receipt is written to the
+ * audit stream (`ingress.<source>`). The engine maps nothing — provider
+ * semantics live with the app.
+ */
+/** raw bodies keyed by request (populated by the content-type parser below) */
+const rawBodies = new WeakMap();
+export function registerIngressRoutes(app, deps, config) {
+    const prefix = config.prefix ?? '/api';
+    // keep the exact body bytes for signature verification while still parsing
+    // JSON for the parsed `request.body`
+    app.addContentTypeParser('application/json', { parseAs: 'buffer' }, (request, body, done) => {
+        const text = body.toString('utf8');
+        rawBodies.set(request, text);
+        try {
+            done(null, JSON.parse(text));
+        }
+        catch (error) {
+            done(error);
+        }
+    });
+    app.post(`${prefix}/ingress/:source`, async (request, reply) => {
+        const { source } = request.params;
+        if (deps.rateLimiter !== undefined && !deps.rateLimiter.check(source)) {
+            throw new SchemaError('http.rateLimited', {}, deps.locale);
+        }
+        const rawBody = rawBodies.get(request) ?? (typeof request.body === 'string' ? request.body : JSON.stringify(request.body ?? {}));
+        const event = await config.verifier({ source, headers: request.headers, rawBody });
+        if (event === null)
+            throw new SchemaError('ingress.unauthorized', { source }, deps.locale);
+        await config.handler(event, { audit: deps.audit, locale: deps.locale });
+        void deps.audit.record({
+            actorType: AUDIT_ACTOR_TYPES.SYSTEM,
+            actorId: source,
+            action: `ingress.${source}`,
+            changes: { type: event.type, id: event.id },
+            meta: { source, ingressType: event.type, ingressId: event.id },
+            timestamp: new Date(),
+        });
+        reply.code(202).send({ accepted: true });
+    });
+}
+//# sourceMappingURL=ingress.js.map

package/dist/adapters/rest/ingress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingress.js","sourceRoot":"","sources":["../../../src/adapters/rest/ingress.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAKrE;;;;;;;;;GASG;AAEH,+EAA+E;AAC/E,MAAM,SAAS,GAAG,IAAI,OAAO,EAA0B,CAAC;AAUxD,MAAM,UAAU,qBAAqB,CAAC,GAAoB,EAAE,IAAiB,EAAE,MAAqB;IAClG,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IAEvC,2EAA2E;IAC3E,qCAAqC;IACrC,GAAG,CAAC,oBAAoB,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;QAC1F,MAAM,IAAI,GAAI,IAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAc,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7D,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAA4B,CAAC;QAExD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,WAAW,CAAC,kBAAkB,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,OAAO,GACX,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;QAEnH,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAE3F,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAExE,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;YACrB,SAAS,EAAE,iBAAiB,CAAC,MAAM;YACnC,OAAO,EAAE,MAAM;YACf,MAAM,EAAE,WAAW,MAAM,EAAE;YAC3B,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE;YAC3C,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE;YAC9D,SAAS,EAAE,IAAI,IAAI,EAAE;SACtB,CAAC,CAAC;QAEH,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/metadata.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyInstance } from 'fastify';
+import type { RestDeps, RestOptions } from './plugin.js';
+/**
+ * Metadata route (M11, framework-agnostic): neutral schema + permissions for
+ * frontend adapters (Refine Inferencer / react-admin auto-forms).
+ *   GET {prefix}/metadata            → { objects: [ObjectDescriptor] } (readable only)
+ *   GET {prefix}/metadata?object=X   → one ObjectDescriptor (404 unknown, 403 unreadable)
+ * Responses carry an ETag so frontends can cache/invalidate per schema hash.
+ */
+export declare function registerMetadataRoutes(app: FastifyInstance, deps: RestDeps, options?: RestOptions): void;
+//# sourceMappingURL=metadata.d.ts.map

package/dist/adapters/rest/metadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/metadata.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGzD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CAwB5G"}

package/dist/adapters/rest/metadata.js

@@ -0,0 +1,32 @@
+import { createHash } from 'node:crypto';
+import { describeObject, listObjectDescriptors } from '../../core/object/describe.js';
+import { authenticateRequest, checkRateLimit, readString } from './common.js';
+/**
+ * Metadata route (M11, framework-agnostic): neutral schema + permissions for
+ * frontend adapters (Refine Inferencer / react-admin auto-forms).
+ *   GET {prefix}/metadata            → { objects: [ObjectDescriptor] } (readable only)
+ *   GET {prefix}/metadata?object=X   → one ObjectDescriptor (404 unknown, 403 unreadable)
+ * Responses carry an ETag so frontends can cache/invalidate per schema hash.
+ */
+export function registerMetadataRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { registry, authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/metadata`, async (request, reply) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const object = readString(request.query, 'object', locale);
+        const result = object === undefined
+            ? {
+                objects: listObjectDescriptors(registry, subject.roles).map((o) => describeObject(registry, o.name, subject.roles, locale)),
+            }
+            : describeObject(registry, object, subject.roles, locale);
+        const etag = `"${createHash('sha256').update(JSON.stringify(result)).digest('hex').slice(0, 32)}"`;
+        reply.header('etag', etag);
+        if (request.headers['if-none-match'] === etag) {
+            return reply.code(304).send();
+        }
+        return result;
+    });
+}
+//# sourceMappingURL=metadata.js.map

package/dist/adapters/rest/metadata.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../../../src/adapters/rest/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAE9E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAoB,EAAE,IAAc,EAAE,UAAuB,EAAE;IACpG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,KAAgC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtF,MAAM,MAAM,GACV,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC;gBACE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAChE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CACxD;aACF;YACH,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QACnG,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3B,IAAI,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/pages.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyInstance } from 'fastify';
+import { type Locale, type ObjectRegistry } from '../../core/index.js';
+import type { AutoCommitOptions } from '../../runtime/git/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+/** page routes (SU-7c): path-mirrored layout source + custom-page lifecycle */
+export interface PagesRouteDeps {
+    registry: ObjectRegistry;
+    authenticator: Authenticator;
+    locale: Locale;
+    projectDir?: string;
+    commitIdentity?: AutoCommitOptions['identity'];
+}
+export declare function registerPagesRoutes(app: FastifyInstance, deps: PagesRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=pages.d.ts.map

package/dist/adapters/rest/pages.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/pages.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAe,KAAK,MAAM,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAOpF,OAAO,KAAK,EAAE,iBAAiB,EAAuB,MAAM,4BAA4B,CAAC;AA2BzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;CAChD;AAoDD,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,WAAgB,GACxB,IAAI,CAqMN"}

package/dist/adapters/rest/pages.js

@@ -0,0 +1,241 @@
+import { SchemaError } from '../../core/index.js';
+import { OBJECT_LAYOUT_VIEWS, layoutPagePath, parseLayoutPagePath, } from '../../layout-format.js';
+import { layoutPathOf, readLayoutSource, validateLayoutCandidate, writeLayoutSource, } from '../../runtime/git/layoutSource.js';
+import { deletePageScript, isPageScriptKind, pageFaceScriptRelPath, parsePageFaceScope, readPageScript, writePageScript, } from '../../runtime/git/pageScripts.js';
+import { schemaPathOf, validateSchemaCandidate, } from '../../runtime/git/schemaSource.js';
+import { createCustomPage, deleteCustomPage, listPages, renameCustomPage, } from '../../runtime/git/pageCatalog.js';
+import { deleteSourceFile, runSourceTransaction } from '../../runtime/git/sourceTransaction.js';
+import { authenticateRequest, checkRateLimit, requireAdmin } from './common.js';
+function parseScriptPath(path) {
+    const match = /^(.*)\/scripts\/([^/]+)$/.exec(path);
+    if (match === null || !isPageScriptKind(match[2]))
+        return null;
+    const face = parsePageFaceScope(match[1]);
+    return face === undefined ? null : { scope: 'page-face', page: face.page, object: face.object, kind: match[2] };
+}
+function scriptRelPath(script) {
+    return pageFaceScriptRelPath(script.page, script.object, script.kind);
+}
+function sourcePart(body, locale) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        throw new SchemaError('http.param.invalid', { param: 'body' }, locale);
+    }
+    const { source, expectVersion, force } = body;
+    if (typeof source !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'source' }, locale);
+    }
+    if (expectVersion !== undefined && typeof expectVersion !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'expectVersion' }, locale);
+    }
+    if (force !== undefined && typeof force !== 'boolean') {
+        throw new SchemaError('http.param.invalid', { param: 'force' }, locale);
+    }
+    return { source, expectVersion, force };
+}
+function parsePart(value, locale) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        throw new SchemaError('http.param.invalid', { param: 'body' }, locale);
+    }
+    const { source, expectVersion } = value;
+    if (typeof source !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'source' }, locale);
+    }
+    if (expectVersion !== undefined && typeof expectVersion !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'expectVersion' }, locale);
+    }
+    return expectVersion === undefined ? { source } : { source, expectVersion };
+}
+export function registerPagesRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { registry, authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    function requireProject() {
+        if (deps.projectDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        return deps.projectDir;
+    }
+    function resolveAddr(request) {
+        const path = request.params['*'];
+        if (typeof path !== 'string') {
+            throw new SchemaError('http.param.invalid', { param: 'path' }, locale);
+        }
+        const addr = parseLayoutPagePath(path);
+        if (addr === undefined) {
+            throw new SchemaError('http.param.invalid', { param: 'path' }, locale);
+        }
+        if (addr.kind === 'object') {
+            // object page — the id must be a registry object
+            if (registry.get(addr.id) === undefined) {
+                throw new SchemaError('http.notFound', {}, locale);
+            }
+        }
+        if (addr.kind === 'page-face') {
+            // page × object face — the object must exist (the page is a custom page dir)
+            if (registry.get(addr.object) === undefined) {
+                throw new SchemaError('http.notFound', {}, locale);
+            }
+        }
+        return addr;
+    }
+    // catalog (authenticated)
+    app.get(`${prefix}/pages`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        await authenticateRequest(authenticator, request, locale);
+        return listPages(requireProject(), registry);
+    });
+    // create custom page (admin)
+    app.post(`${prefix}/pages`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'pages', options.adminRoles, locale);
+        const projectDir = requireProject();
+        const body = request.body;
+        const id = body.id;
+        if (typeof id !== 'string' || id === '') {
+            throw new SchemaError('http.param.invalid', { param: 'id' }, locale);
+        }
+        const source = typeof body.source === 'string' ? body.source : undefined;
+        const result = await createCustomPage({ projectDir, registry, id, source, identity: deps.commitIdentity, locale });
+        return { ok: true, id, path: result.path };
+    });
+    // read layout source / page script (authenticated)
+    app.get(`${prefix}/pages/*`, async (request) => {
+        const path = request.params['*'];
+        const script = parseScriptPath(path);
+        checkRateLimit(limiter, request, locale);
+        await authenticateRequest(authenticator, request, locale);
+        const projectDir = requireProject();
+        if (script !== null) {
+            const document = await readPageScript(projectDir, scriptRelPath(script));
+            if (document === null)
+                throw new SchemaError('http.notFound', {}, locale);
+            return document;
+        }
+        const addr = resolveAddr(request);
+        const document = await readLayoutSource(projectDir, addr);
+        if (document === null)
+            throw new SchemaError('http.notFound', {}, locale);
+        return document;
+    });
+    // write layout source / page script (admin)
+    app.put(`${prefix}/pages/*`, async (request) => {
+        const path = request.params['*'];
+        const script = parseScriptPath(path);
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'pages', options.adminRoles, locale);
+        if (script !== null) {
+            const body = sourcePart(request.body, locale);
+            const result = await writePageScript({
+                projectDir: requireProject(),
+                relPath: scriptRelPath(script),
+                source: body.source,
+                identity: deps.commitIdentity,
+                locale,
+            });
+            return { ok: true, committed: result.committed, version: result.version };
+        }
+        const addr = resolveAddr(request);
+        const body = sourcePart(request.body, locale);
+        const result = await writeLayoutSource({
+            projectDir: requireProject(),
+            addr,
+            source: body.source,
+            expectVersion: body.expectVersion,
+            force: body.force,
+            registry,
+            identity: deps.commitIdentity,
+            locale,
+        });
+        return { ok: true, committed: result.committed, version: result.version };
+    });
+    // delete a page-scoped face (script or layout) — falling back to the object canonical (admin)
+    app.delete(`${prefix}/pages/*`, async (request) => {
+        const path = request.params['*'];
+        const script = parseScriptPath(path);
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'pages', options.adminRoles, locale);
+        const projectDir = requireProject();
+        if (script !== null) {
+            const result = await deletePageScript(projectDir, scriptRelPath(script), deps.commitIdentity, locale);
+            return { ok: true, deleted: result.deleted };
+        }
+        const addr = resolveAddr(request);
+        if (addr.kind !== 'page-face')
+            throw new SchemaError('http.notFound', {}, locale);
+        const result = await deleteSourceFile({ projectDir, path: layoutPathOf(addr), message: `chore(pages): delete face ${layoutPagePath(addr)}`, identity: deps.commitIdentity, locale });
+        return { ok: true, deleted: result.committed };
+    });
+    // rename custom page (admin)
+    app.patch(`${prefix}/pages/:id`, async (request) => {
+        const { id } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'pages', options.adminRoles, locale);
+        const body = request.body;
+        if (typeof body.newId !== 'string' || body.newId === '') {
+            throw new SchemaError('http.param.invalid', { param: 'newId' }, locale);
+        }
+        const result = await renameCustomPage({ projectDir: requireProject(), id, newId: body.newId, identity: deps.commitIdentity, locale });
+        return { ok: true, id: body.newId, path: result.path };
+    });
+    // delete custom page (admin; ref-protected)
+    app.delete(`${prefix}/pages/:id`, async (request) => {
+        const { id } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'pages', options.adminRoles, locale);
+        const result = await deleteCustomPage({ projectDir: requireProject(), id, identity: deps.commitIdentity, locale });
+        return { ok: true, deleted: result.deleted };
+    });
+    // atomic object design transaction: show + list + schema in one commit (admin)
+    app.put(`${prefix}/pages/:id/design`, async (request) => {
+        const { id } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, 'pages', options.adminRoles, locale);
+        const projectDir = requireProject();
+        if (registry.get(id) === undefined) {
+            throw new SchemaError('data.objectUnknown', { object: id }, locale);
+        }
+        const body = request.body;
+        const files = [];
+        const validators = [];
+        const pushView = (view, value) => {
+            const part = parsePart(value, locale);
+            const addr = { kind: 'object', id, view };
+            files.push({ path: layoutPathOf(addr), source: part.source, expectVersion: part.expectVersion });
+            validators.push({ path: layoutPathOf(addr), check: (s) => validateLayoutCandidate({ addr, source: s, registry, locale }) });
+        };
+        if (body.show !== undefined)
+            pushView(OBJECT_LAYOUT_VIEWS.SHOW, body.show);
+        if (body.list !== undefined)
+            pushView(OBJECT_LAYOUT_VIEWS.LIST, body.list);
+        if (body.schema !== undefined) {
+            const part = parsePart(body.schema, locale);
+            files.push({ path: schemaPathOf(id), source: part.source, expectVersion: part.expectVersion });
+            validators.push({ path: schemaPathOf(id), check: (s) => validateSchemaCandidate({ registry, name: id, source: s, locale }) });
+        }
+        if (files.length === 0) {
+            throw new SchemaError('http.param.invalid', { param: 'body' }, locale);
+        }
+        const force = typeof body.force === 'boolean' ? body.force : undefined;
+        const result = await runSourceTransaction({
+            projectDir,
+            files,
+            force,
+            identity: deps.commitIdentity,
+            locale,
+            message: `chore(design): update ${id}`,
+            validate: async (candidate) => {
+                const validator = validators.find((v) => v.path === candidate.path);
+                if (validator !== undefined)
+                    validator.check(candidate.source);
+            },
+        });
+        return { ok: true, committed: result.committed };
+    });
+}
+//# sourceMappingURL=pages.js.map

package/dist/adapters/rest/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../../src/adapters/rest/pages.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAoC,MAAM,qBAAqB,CAAC;AACpF,OAAO,EACL,mBAAmB,EACnB,cAAc,EACd,mBAAmB,GAEpB,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,cAAc,EACd,eAAe,GAEhB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,uBAAuB,GACxB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,SAAS,EACT,gBAAgB,GACjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEhG,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoBhF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC3C,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,SAAS,aAAa,CAAC,MAAmC;IACxD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,MAAc;IAC/C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAA+B,CAAC;IACzE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,MAAc;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,KAAgC,CAAC;IACnE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,IAAoB,EACpB,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,SAAS,cAAc;QACrB,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED,SAAS,WAAW,CAAC,OAA4B;QAC/C,MAAM,IAAI,GAAI,OAAO,CAAC,MAAkC,CAAC,GAAG,CAAC,CAAC;QAC9D,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC7B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,iDAAiD;YACjD,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,6EAA6E;YAC7E,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5C,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0BAA0B;IAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC,cAAc,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,mDAAmD;IACnD,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAI,OAAO,CAAC,MAAkC,CAAC,GAAG,CAAW,CAAC;QACxE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACzE,IAAI,QAAQ,KAAK,IAAI;gBAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,IAAI,GAAI,OAAO,CAAC,MAAkC,CAAC,GAAG,CAAW,CAAC;QACxE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;gBACnC,UAAU,EAAE,cAAc,EAAE;gBAC5B,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC;gBAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,cAAc;gBAC7B,MAAM;aACP,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,UAAU,EAAE,cAAc,EAAE;YAC5B,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ;YACR,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,8FAA8F;IAC9F,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,IAAI,GAAI,OAAO,CAAC,MAAkC,CAAC,GAAG,CAAW,CAAC;QACxE,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;QACrC,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;YACtG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/C,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,6BAA6B,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QACrL,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,6BAA6B;IAC7B,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;QACrD,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,EAAE,EAAE,CAAC;YACxD,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QACtI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,4CAA4C;IAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,UAAU,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QACnH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtD,MAAM,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAwB,CAAC;QAChD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAA+B,CAAC;QACrD,MAAM,KAAK,GAA0B,EAAE,CAAC;QACxC,MAAM,UAAU,GAA6D,EAAE,CAAC;QAEhF,MAAM,QAAQ,GAAG,CAAC,IAAqB,EAAE,KAAc,EAAQ,EAAE;YAC/D,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YACjG,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9H,CAAC,CAAC;QACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,CAAC,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAC/F,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC;YACxC,UAAU;YACV,KAAK;YACL,KAAK;YACL,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,MAAM;YACN,OAAO,EAAE,yBAAyB,EAAE,EAAE;YACtC,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;gBAC5B,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;gBACpE,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;SACF,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/permissions.d.ts

@@ -0,0 +1,11 @@
+import type { FastifyInstance } from 'fastify';
+import type { RestDeps, RestOptions } from './plugin.js';
+/**
+ * Permissions route (M11, framework-agnostic): the identity's effective
+ * permissions per object — the data source for Refine `accessControlProvider`
+ * / frontend RBAC menu & action gating (no more 403 trial-and-error).
+ *   GET {prefix}/permissions → { objects: [{ name, label, permissions }] }
+ * Objects with no resolved permission for the identity are omitted.
+ */
+export declare function registerPermissionsRoutes(app: FastifyInstance, deps: RestDeps, options?: RestOptions): void;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/adapters/rest/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,OAAO,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGzD;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,GAAE,WAAgB,GAAG,IAAI,CAU/G"}

package/dist/adapters/rest/permissions.js

@@ -0,0 +1,20 @@
+import { listObjectPermissions } from '../../core/object/describe.js';
+import { authenticateRequest, checkRateLimit } from './common.js';
+/**
+ * Permissions route (M11, framework-agnostic): the identity's effective
+ * permissions per object — the data source for Refine `accessControlProvider`
+ * / frontend RBAC menu & action gating (no more 403 trial-and-error).
+ *   GET {prefix}/permissions → { objects: [{ name, label, permissions }] }
+ * Objects with no resolved permission for the identity are omitted.
+ */
+export function registerPermissionsRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { registry, authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/permissions`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        return { objects: listObjectPermissions(registry, subject.roles) };
+    });
+}
+//# sourceMappingURL=permissions.js.map

package/dist/adapters/rest/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/adapters/rest/permissions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElE;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAoB,EAAE,IAAc,EAAE,UAAuB,EAAE;IACvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,qBAAqB,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/plugin.d.ts

@@ -0,0 +1,42 @@
+import type { FastifyInstance } from "fastify";
+import type { Pool } from "pg";
+import type { Locale, ObjectRegistry } from "../../core/index.js";
+import type { AuditQueryEngine } from "../../core/audit/index.js";
+import type { ToolApprovals } from "../../core/tools/index.js";
+import type { SlidingWindow } from "../../core/limiter/index.js";
+import type { ObjectDataAccess } from "../../runtime/data-access/index.js";
+import type { Authenticator } from "../auth/index.js";
+/** everything the REST layer needs to serve a request */
+export interface RestDeps {
+    registry: ObjectRegistry;
+    pool: Pool;
+    dataAccess: ObjectDataAccess;
+    authenticator: Authenticator;
+    locale: Locale;
+    /** audit query engine (M11); present when the audit subsystem is enabled — registers `GET {prefix}/audit` */
+    audit?: AuditQueryEngine;
+    /** approval queue (D1); present when the tool executor is enabled — registers `/approvals` routes */
+    approvals?: ToolApprovals;
+}
+export interface RestOptions {
+    /** URL prefix for object routes; defaults to `/api` */
+    prefix?: string;
+    /** per-agent-key sliding-window limiter; disabled when absent */
+    rateLimiter?: SlidingWindow;
+    /** roles allowed to query the full audit trail and use admin script-source read/write routes */
+    adminRoles?: string[];
+}
+/**
+ * Register the generic object CRUD routes on a fastify app:
+ *   GET    {prefix}/objects/:name
+ *   POST   {prefix}/objects/:name
+ *   GET    {prefix}/objects/:name/:id
+ *   PATCH  {prefix}/objects/:name/:id
+ *   DELETE {prefix}/objects/:name/:id
+ *
+ * Routes are parameterized by object name (not registered per object), so the
+ * registry may change without re-registering routes. Every request is
+ * authenticated and runs through the RBAC-decorated data-access layer.
+ */
+export declare function registerObjectRoutes(app: FastifyInstance, deps: RestDeps, options?: RestOptions): void;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/adapters/rest/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAC/B,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAItD,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,gBAAgB,CAAC;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,6GAA6G;IAC7G,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,qGAAqG;IACrG,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,WAAW,CAAC,EAAE,aAAa,CAAC;IAC5B,gGAAgG;IAChG,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAsFD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,QAAQ,EACd,OAAO,GAAE,WAAgB,GACxB,IAAI,CAkIN"}