@weave-kit/engine 0.1.0

package/dist/adapters/rest/plugin.js

@@ -0,0 +1,199 @@
+import { SchemaError } from "../../core/index.js";
+import { SORT_DIRS, resolvePagination, withTx, } from "../../runtime/data-access/index.js";
+import { parseFindParams } from "../../core/api/index.js";
+import { authenticateRequest, checkRateLimit } from "./common.js";
+/** drop `sensitive` fields from a REST-read row — secrets never reach the browser. */
+function maskSensitiveRow(registry, objectName, record) {
+    if (record === null || record === undefined)
+        return record;
+    const def = registry.get(objectName);
+    if (def === undefined)
+        return record;
+    for (const field of def.fields) {
+        if (field.sensitive === true)
+            delete record[field.name];
+    }
+    return record;
+}
+function maskSensitiveRows(registry, objectName, rows) {
+    return rows.map((row) => maskSensitiveRow(registry, objectName, row));
+}
+function bodyObject(body, locale) {
+    if (body === undefined)
+        return {};
+    if (body === null || typeof body !== "object" || Array.isArray(body)) {
+        throw new SchemaError("http.param.invalid", { param: "body" }, locale);
+    }
+    return body;
+}
+/** parse a non-empty, deduplicated array of record ids (string or number) */
+function parseIds(body, locale) {
+    const raw = body.ids;
+    if (!Array.isArray(raw) || raw.length === 0) {
+        throw new SchemaError("http.param.invalid", { param: "ids" }, locale);
+    }
+    const ids = [];
+    for (const value of raw) {
+        if (typeof value !== "string" && typeof value !== "number") {
+            throw new SchemaError("http.param.invalid", { param: "ids" }, locale);
+        }
+        const s = String(value);
+        if (!ids.includes(s))
+            ids.push(s);
+    }
+    return ids;
+}
+/** the update changeset must be a plain object (validation happens per-record inside the tx) */
+function parseChanges(body, locale) {
+    const changes = body.changes;
+    if (changes === null ||
+        typeof changes !== "object" ||
+        Array.isArray(changes)) {
+        throw new SchemaError("http.param.invalid", { param: "changes" }, locale);
+    }
+    return changes;
+}
+/** map a parsed {@link ListQuery} onto the data-access FindOptions (domain validation here) */
+function toFindOptions(list, locale) {
+    const options = {};
+    if (list.filter !== undefined)
+        options.filter = list.filter;
+    if (list.fields !== undefined)
+        options.fields = list.fields;
+    if (list.limit !== undefined)
+        options.limit = list.limit;
+    if (list.offset !== undefined)
+        options.offset = list.offset;
+    if (list.sort !== undefined) {
+        const sort = [];
+        for (const s of list.sort) {
+            if (s.direction !== SORT_DIRS.ASC && s.direction !== SORT_DIRS.DESC) {
+                throw new SchemaError("http.param.invalid", { param: "sort" }, locale);
+            }
+            sort.push({ field: s.field, dir: s.direction });
+        }
+        options.sort = sort;
+    }
+    return options;
+}
+/**
+ * Register the generic object CRUD routes on a fastify app:
+ *   GET    {prefix}/objects/:name
+ *   POST   {prefix}/objects/:name
+ *   GET    {prefix}/objects/:name/:id
+ *   PATCH  {prefix}/objects/:name/:id
+ *   DELETE {prefix}/objects/:name/:id
+ *
+ * Routes are parameterized by object name (not registered per object), so the
+ * registry may change without re-registering routes. Every request is
+ * authenticated and runs through the RBAC-decorated data-access layer.
+ */
+export function registerObjectRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? "/api";
+    const { registry, pool, dataAccess, authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/objects/:name`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const ctx = { pool, registry, subject, locale };
+        const list = parseFindParams(request.query, locale);
+        const opts = toFindOptions(list, locale);
+        const { rows, total } = await dataAccess.find(name, opts, ctx);
+        const { limit, offset } = resolvePagination(opts);
+        return { rows: maskSensitiveRows(registry, name, rows), total, limit, offset };
+    });
+    app.post(`${prefix}/objects/:name`, async (request, reply) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const warnings = [];
+        const ctx = {
+            pool,
+            registry,
+            subject,
+            locale,
+            onWarnings: (ws) => warnings.push(...ws),
+        };
+        const record = await dataAccess.create(name, bodyObject(request.body, locale), ctx);
+        const masked = maskSensitiveRow(registry, name, record);
+        return reply
+            .code(201)
+            .send(warnings.length > 0 ? { ...masked, warnings } : masked);
+    });
+    app.get(`${prefix}/objects/:name/:id`, async (request) => {
+        const { name, id } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const ctx = { pool, registry, subject, locale };
+        const record = await dataAccess.findOne(name, id, ctx);
+        if (record === null) {
+            throw new SchemaError("data.recordNotFound", { object: name, id }, locale);
+        }
+        return maskSensitiveRow(registry, name, record);
+    });
+    app.patch(`${prefix}/objects/:name/:id`, async (request) => {
+        const { name, id } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const warnings = [];
+        const ctx = {
+            pool,
+            registry,
+            subject,
+            locale,
+            onWarnings: (ws) => warnings.push(...ws),
+        };
+        const record = await dataAccess.update(name, id, bodyObject(request.body, locale), ctx);
+        const masked = maskSensitiveRow(registry, name, record);
+        return warnings.length > 0 ? { ...masked, warnings } : masked;
+    });
+    app.delete(`${prefix}/objects/:name/:id`, async (request, reply) => {
+        const { name, id } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const ctx = { pool, registry, subject, locale };
+        await dataAccess.delete(name, id, ctx);
+        reply.code(204).send();
+    });
+    // Atomic batch operations (RA updateMany/deleteMany): one transaction over
+    // the per-record write path, so per-record validation / script hooks /
+    // audit / RBAC row-scope all apply and a failure rolls back the whole batch
+    // (all-or-nothing). Auth runs once; the loop reuses the tx client.
+    app.patch(`${prefix}/objects/:name`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const body = bodyObject(request.body, locale);
+        const ids = parseIds(body, locale);
+        const changes = parseChanges(body, locale);
+        const warnings = [];
+        const ctx = {
+            pool,
+            registry,
+            subject,
+            locale,
+            onWarnings: (ws) => warnings.push(...ws),
+        };
+        await withTx(ctx, async (txCtx) => {
+            for (const id of ids) {
+                await dataAccess.update(name, id, changes, txCtx);
+            }
+        });
+        return warnings.length > 0 ? { updated: ids, warnings } : { updated: ids };
+    });
+    app.delete(`${prefix}/objects/:name`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const ids = parseIds(bodyObject(request.body, locale), locale);
+        const ctx = { pool, registry, subject, locale };
+        await withTx(ctx, async (txCtx) => {
+            for (const id of ids) {
+                await dataAccess.delete(name, id, txCtx);
+            }
+        });
+        return { deleted: ids };
+    });
+}
+//# sourceMappingURL=plugin.js.map

package/dist/adapters/rest/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/adapters/rest/plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAQlD,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,MAAM,GACP,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAkB,MAAM,yBAAyB,CAAC;AAG1E,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAwBlE,sFAAsF;AACtF,SAAS,gBAAgB,CACvB,QAAwB,EACxB,UAAkB,EAClB,MAAsC;IAEtC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC3D,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CACxB,QAAwB,EACxB,UAAkB,EAClB,IAA+B;IAE/B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,CAA4B,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,UAAU,CAAC,IAAa,EAAE,MAAc;IAC/C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,IAA6B,EAAE,MAAc;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC3D,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,SAAS,YAAY,CACnB,IAA6B,EAC7B,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IACE,OAAO,KAAK,IAAI;QAChB,OAAO,OAAO,KAAK,QAAQ;QAC3B,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EACtB,CAAC;QACD,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAkC,CAAC;AAC5C,CAAC;AAED,+FAA+F;AAC/F,SAAS,aAAa,CAAC,IAAe,EAAE,MAAc;IACpD,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACzD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAwB,EAAE,CAAC;QACrC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;gBACpE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,IAAc,EACd,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACnD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,GAAG,eAAe,CAC1B,OAAO,CAAC,KAAgC,EACxC,MAAM,CACP,CAAC;QACF,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAClD,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,OAAO;YACP,MAAM;YACN,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CACpC,IAAI,EACJ,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,GAAG,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,KAAK;aACT,IAAI,CAAC,GAAG,CAAC;aACT,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CACnB,qBAAqB,EACrB,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,EACpB,MAAM,CACP,CAAC;QACJ,CAAC;QACD,OAAO,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACzD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,OAAO;YACP,MAAM;YACN,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CACpC,IAAI,EACJ,EAAE,EACF,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAChC,GAAG,CACJ,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,oBAAoB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,MAAsC,CAAC;QACpE,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnE,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACvC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,mEAAmE;IACnE,GAAG,CAAC,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAsB;YAC7B,IAAI;YACJ,QAAQ;YACR,OAAO;YACP,MAAM;YACN,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;SACzC,CAAC;QACF,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAsB,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;QACnE,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAChC,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;gBACrB,MAAM,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/proxy.d.ts

@@ -0,0 +1,27 @@
+import type { FastifyInstance } from 'fastify';
+import { type AuditSink, type Locale, type ProxyTargetResolver } from '../../core/index.js';
+import type { ProxyForwarder } from '../../runtime/proxy/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+/** everything the proxy routes need (assembly injects resolver + forwarder) */
+export interface ProxyRouteDeps {
+    authenticator: Authenticator;
+    locale: Locale;
+    resolver: ProxyTargetResolver;
+    forwarder: ProxyForwarder;
+    /** audit sink for depth-2 proxy writes; optional (no-op when disabled). */
+    audit?: AuditSink;
+}
+/**
+ * Generic engine proxy routes (P-3; gateway, app-agnostic):
+ *   GET   {prefix}/proxy                       — list resolvable targets for the subject (resolver.list)
+ *   GET   {prefix}/proxy/:instance/*           — read passthrough (path within `allow.read`)
+ *   POST/PATCH/PUT/DELETE {prefix}/proxy/:instance/* — write passthrough (path within `allow.write`,
+ *                                                     needs `keyScope=admin` + subject admin)
+ *
+ * The path is NOT enumerated per resource — it is gated by `isAllowedProxyPath(allow)` prefix
+ * matching, so new engine/business REST surfaces are reachable by widening the allowlist. Depth-2
+ * writes are audited to the same `weavekit_audit` stream.
+ */
+export declare function registerProxyRoutes(app: FastifyInstance, deps: ProxyRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/adapters/rest/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAgC,MAAM,SAAS,CAAC;AAI7E,OAAO,EAKL,KAAK,SAAS,EACd,KAAK,MAAM,EAKX,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAEnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,SAAS,EAAE,cAAc,CAAC;IAC1B,2EAA2E;IAC3E,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AA0DD;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,WAAgB,GACxB,IAAI,CAiGN"}

package/dist/adapters/rest/proxy.js

@@ -0,0 +1,149 @@
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { AUDIT_ACTOR_TYPES, isAllowedProxyPath, PROXY_KEY_SCOPES, SchemaError, } from '../../core/index.js';
+import { authenticateRequest, checkRateLimit, requireAdmin } from './common.js';
+/** a target as exposed to the browser — the customer-engine key is never leaked. */
+function publicTarget(target) {
+    return { id: target.id, url: target.url, keyScope: target.keyScope, labels: target.labels };
+}
+/** is the caller asking for a Server-Sent Event stream (mirrors client.subscribe headers)? */
+function wantsSse(request) {
+    const accept = request.headers.accept;
+    const value = Array.isArray(accept) ? accept[0] : accept;
+    return value !== undefined && value.includes('text/event-stream');
+}
+/** pass the client's `last-event-id` upstream so the customer engine replays missed events. */
+function passthroughHeaders(request) {
+    const raw = request.headers['last-event-id'];
+    if (raw === undefined)
+        return undefined;
+    const v = Array.isArray(raw) ? raw[0] : raw;
+    return v === undefined ? undefined : { 'last-event-id': v };
+}
+/** hijack the reply and pipe the upstream SSE body through to the client. */
+async function streamSse(reply, stream) {
+    reply.hijack();
+    const raw = reply.raw;
+    const contentType = stream.response.headers.get('content-type') ?? 'text/event-stream';
+    raw.writeHead(stream.response.status, {
+        'content-type': contentType,
+        'cache-control': 'no-cache',
+        connection: 'keep-alive',
+        'x-accel-buffering': 'no',
+    });
+    raw.flushHeaders?.();
+    raw.setTimeout(0);
+    const body = Readable.fromWeb(stream.response.body);
+    // cancel the upstream request when the browser disconnects / the pipe ends
+    const abort = () => stream.abort();
+    raw.on('close', abort);
+    body.on('error', abort);
+    try {
+        await pipeline(body, raw);
+    }
+    catch {
+        // client went away / upstream closed — abort and let the reply clean up
+        abort();
+    }
+}
+/**
+ * Generic engine proxy routes (P-3; gateway, app-agnostic):
+ *   GET   {prefix}/proxy                       — list resolvable targets for the subject (resolver.list)
+ *   GET   {prefix}/proxy/:instance/*           — read passthrough (path within `allow.read`)
+ *   POST/PATCH/PUT/DELETE {prefix}/proxy/:instance/* — write passthrough (path within `allow.write`,
+ *                                                     needs `keyScope=admin` + subject admin)
+ *
+ * The path is NOT enumerated per resource — it is gated by `isAllowedProxyPath(allow)` prefix
+ * matching, so new engine/business REST surfaces are reachable by widening the allowlist. Depth-2
+ * writes are audited to the same `weavekit_audit` stream.
+ */
+export function registerProxyRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    // A target has no fallback allowlist: an absent `proxy_allow` means nothing is
+    // allowed (deny-all). The full-open default is written explicitly by the app
+    // (seeds / creation) from `DEFAULT_PROXY_ALLOW` — never auto-applied here.
+    const EMPTY_ALLOW = { read: [], write: [] };
+    const proxyPath = `${prefix}/proxy/:instance/*`;
+    async function resolveTarget(request) {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const { instance } = request.params;
+        const raw = request.params['*'];
+        const path = typeof raw === 'string' ? raw : '';
+        const target = await deps.resolver.resolve(instance, subject);
+        if (target === null) {
+            throw new SchemaError('proxy.notFound', { instance }, locale);
+        }
+        return { subject, target, instance, path };
+    }
+    function proxyRequest(request, method, instance, path) {
+        return {
+            instance,
+            method,
+            path,
+            query: request.query,
+            body: request.body,
+            ...(passthroughHeaders(request) === undefined ? {} : { headers: passthroughHeaders(request) }),
+        };
+    }
+    async function forwardWrite(req, reply, method) {
+        const { subject, target, instance, path } = await resolveTarget(req);
+        if (!isAllowedProxyPath(method, path, target.allow ?? EMPTY_ALLOW)) {
+            throw new SchemaError('proxy.denied', { instance, target: target.id }, locale);
+        }
+        if (target.keyScope !== PROXY_KEY_SCOPES.ADMIN) {
+            throw new SchemaError('proxy.denied', { instance, target: target.id }, locale);
+        }
+        requireAdmin(subject.roles, 'proxy', options.adminRoles, locale);
+        if (deps.audit !== undefined) {
+            void deps.audit.record({
+                actorType: AUDIT_ACTOR_TYPES.USER,
+                actorId: subject.id,
+                action: `proxy.${method}`,
+                objectName: instance,
+                changes: req.body,
+                meta: { path, target: target.id },
+                timestamp: new Date(),
+            });
+        }
+        const res = await deps.forwarder.forward(target, proxyRequest(req, method, instance, path));
+        reply.status(res.status).send(res.body);
+    }
+    // route `GET /api/proxy` before the wildcard so static wins over the param route.
+    app.get(`${prefix}/proxy`, async (request) => {
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const list = deps.resolver.list !== undefined ? await deps.resolver.list(subject) : [];
+        return list.map(publicTarget);
+    });
+    app.get(proxyPath, async (request, reply) => {
+        const { target, instance, path } = await resolveTarget(request);
+        if (!isAllowedProxyPath('GET', path, target.allow ?? EMPTY_ALLOW)) {
+            throw new SchemaError('proxy.denied', { instance, target: target.id }, locale);
+        }
+        const sse = wantsSse(request);
+        const req = proxyRequest(request, 'GET', instance, path);
+        if (sse && deps.forwarder.forwardStream !== undefined) {
+            const stream = await deps.forwarder.forwardStream(target, req);
+            await streamSse(reply, stream);
+            return;
+        }
+        const res = await deps.forwarder.forward(target, req);
+        reply.status(res.status).send(res.body);
+    });
+    app.post(proxyPath, async (request, reply) => {
+        await forwardWrite(request, reply, 'POST');
+    });
+    app.patch(proxyPath, async (request, reply) => {
+        await forwardWrite(request, reply, 'PATCH');
+    });
+    app.put(proxyPath, async (request, reply) => {
+        await forwardWrite(request, reply, 'PUT');
+    });
+    app.delete(proxyPath, async (request, reply) => {
+        await forwardWrite(request, reply, 'DELETE');
+    });
+}
+//# sourceMappingURL=proxy.js.map

package/dist/adapters/rest/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../../../src/adapters/rest/proxy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,WAAW,GAQZ,MAAM,qBAAqB,CAAC;AAK7B,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAiBhF,oFAAoF;AACpF,SAAS,YAAY,CAAC,MAAmB;IAMvC,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;AAC9F,CAAC;AAED,8FAA8F;AAC9F,SAAS,QAAQ,CAAC,OAAuB;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AACpE,CAAC;AAED,+FAA+F;AAC/F,SAAS,kBAAkB,CAAC,OAAuB;IACjD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC5C,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAC7E,KAAK,UAAU,SAAS,CAAC,KAAmB,EAAE,MAAmB;IAC/D,KAAK,CAAC,MAAM,EAAE,CAAC;IACf,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,mBAAmB,CAAC;IACvF,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE;QACpC,cAAc,EAAE,WAAW;QAC3B,eAAe,EAAE,UAAU;QAC3B,UAAU,EAAE,YAAY;QACxB,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;IACH,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC;IACrB,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAA6C,CAAC,CAAC;IAC7F,2EAA2E;IAC3E,MAAM,KAAK,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACzC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvB,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,KAAK,EAAE,CAAC;IACV,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAoB,EACpB,IAAoB,EACpB,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IACpC,+EAA+E;IAC/E,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,WAAW,GAAe,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACxD,MAAM,SAAS,GAAG,GAAG,MAAM,oBAAoB,CAAC;IAEhD,KAAK,UAAU,aAAa,CAAC,OAAuB;QAClD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,MAAqB,CAAC;QACnD,MAAM,GAAG,GAAI,OAAO,CAAC,MAAsB,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,WAAW,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,SAAS,YAAY,CAAC,OAAuB,EAAE,MAAmB,EAAE,QAAgB,EAAE,IAAY;QAChG,OAAO;YACL,QAAQ;YACR,MAAM;YACN,IAAI;YACJ,KAAK,EAAE,OAAO,CAAC,KAA2C;YAC1D,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,CAAC,kBAAkB,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,OAAO,CAAE,EAAE,CAAC;SAChG,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,GAAmB,EACnB,KAAmB,EACnB,MAAmB;QAEnB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC/C,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;QACD,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBACrB,SAAS,EAAE,iBAAiB,CAAC,IAAI;gBACjC,OAAO,EAAE,OAAO,CAAC,EAAE;gBACnB,MAAM,EAAE,SAAS,MAAM,EAAE;gBACzB,UAAU,EAAE,QAAQ;gBACpB,OAAO,EAAE,GAAG,CAAC,IAAI;gBACjB,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE;gBACjC,SAAS,EAAE,IAAI,IAAI,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5F,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,kFAAkF;IAClF,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC3C,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAChE,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,IAAI,WAAW,CAAC,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzD,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACtD,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3C,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC5C,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1C,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC7C,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/schemas.d.ts

@@ -0,0 +1,15 @@
+import type { FastifyInstance } from 'fastify';
+import { type Locale, type ObjectRegistry } from '../../core/index.js';
+import type { AutoCommitOptions } from '../../runtime/git/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+/** raw schema source routes (SU-7c): admin-only GET/PUT `{source, version}` */
+export interface SchemaRouteDeps {
+    registry: ObjectRegistry;
+    authenticator: Authenticator;
+    locale: Locale;
+    projectDir?: string;
+    commitIdentity?: AutoCommitOptions['identity'];
+}
+export declare function registerSchemaRoutes(app: FastifyInstance, deps: SchemaRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/adapters/rest/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAe,KAAK,MAAM,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;CAChD;AAsBD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE,WAAgB,GACxB,IAAI,CAuCN"}

package/dist/adapters/rest/schemas.js

@@ -0,0 +1,59 @@
+import { SchemaError } from '../../core/index.js';
+import { readSchemaSource, writeSchemaSource } from '../../runtime/git/schemaSource.js';
+import { authenticateRequest, checkRateLimit, requireAdmin } from './common.js';
+function schemaBody(body, locale) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        throw new SchemaError('http.param.invalid', { param: 'body' }, locale);
+    }
+    const { source, expectVersion, force } = body;
+    if (typeof source !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'source' }, locale);
+    }
+    if (expectVersion !== undefined && typeof expectVersion !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'expectVersion' }, locale);
+    }
+    if (force !== undefined && typeof force !== 'boolean') {
+        throw new SchemaError('http.param.invalid', { param: 'force' }, locale);
+    }
+    return { source, expectVersion, force };
+}
+export function registerSchemaRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { registry, authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/objects/:name/schema`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, name, options.adminRoles, locale);
+        if (deps.projectDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        const document = await readSchemaSource(deps.projectDir, name);
+        if (document === null)
+            throw new SchemaError('http.notFound', {}, locale);
+        return document;
+    });
+    app.put(`${prefix}/objects/:name/schema`, async (request) => {
+        const { name } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, name, options.adminRoles, locale);
+        if (deps.projectDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        const body = schemaBody(request.body, locale);
+        const result = await writeSchemaSource({
+            projectDir: deps.projectDir,
+            registry,
+            name,
+            source: body.source,
+            expectVersion: body.expectVersion,
+            force: body.force,
+            identity: deps.commitIdentity,
+            locale,
+        });
+        return { ok: true, committed: result.committed, version: result.version };
+    });
+}
+//# sourceMappingURL=schemas.js.map

package/dist/adapters/rest/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../src/adapters/rest/schemas.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAoC,MAAM,qBAAqB,CAAC;AAEpF,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAExF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYhF,SAAS,UAAU,CACjB,IAAa,EACb,MAAc;IAEd,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,IAA+B,CAAC;IACzE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACtD,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,IAAqB,EACrB,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,MAA0B,CAAC;QACpD,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/rest/scripts.d.ts

@@ -0,0 +1,14 @@
+import type { FastifyInstance } from 'fastify';
+import { type Locale, type ObjectRegistry } from '../../core/index.js';
+import type { AutoCommitOptions } from '../../runtime/git/index.js';
+import type { Authenticator } from '../auth/index.js';
+import type { RestOptions } from './plugin.js';
+export interface ScriptRouteDeps {
+    registry: ObjectRegistry;
+    authenticator: Authenticator;
+    locale: Locale;
+    projectDir?: string;
+    commitIdentity?: AutoCommitOptions['identity'];
+}
+export declare function registerScriptRoutes(app: FastifyInstance, deps: ScriptRouteDeps, options?: RestOptions): void;
+//# sourceMappingURL=scripts.d.ts.map

package/dist/adapters/rest/scripts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts.d.ts","sourceRoot":"","sources":["../../../src/adapters/rest/scripts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAGL,KAAK,MAAM,EACX,KAAK,cAAc,EAEpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,cAAc,CAAC;IACzB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;CAChD;AAuBD,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,eAAe,EACpB,IAAI,EAAE,eAAe,EACrB,OAAO,GAAE,WAAgB,GACxB,IAAI,CA0CN"}

package/dist/adapters/rest/scripts.js

@@ -0,0 +1,65 @@
+import { SCRIPT_SOURCE_KINDS, SchemaError, } from '../../core/index.js';
+import { readScriptSource, writeScriptSource } from '../../runtime/git/scriptSource.js';
+import { authenticateRequest, checkRateLimit, requireAdmin } from './common.js';
+function scriptKind(value, locale) {
+    if (!Object.values(SCRIPT_SOURCE_KINDS).includes(value)) {
+        throw new SchemaError('http.param.invalid', { param: 'kind' }, locale);
+    }
+    return value;
+}
+function saveBody(body, locale) {
+    if (body === null || typeof body !== 'object' || Array.isArray(body)) {
+        throw new SchemaError('http.param.invalid', { param: 'body' }, locale);
+    }
+    const { source, expectVersion } = body;
+    if (typeof source !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'source' }, locale);
+    }
+    if (expectVersion !== undefined && typeof expectVersion !== 'string') {
+        throw new SchemaError('http.param.invalid', { param: 'expectVersion' }, locale);
+    }
+    return expectVersion === undefined ? { source } : { source, expectVersion };
+}
+export function registerScriptRoutes(app, deps, options = {}) {
+    const prefix = options.prefix ?? '/api';
+    const { registry, authenticator, locale } = deps;
+    const limiter = options.rateLimiter;
+    app.get(`${prefix}/objects/:name/scripts/:kind`, async (request) => {
+        const { name, kind: rawKind } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        const kind = scriptKind(rawKind, locale);
+        if (kind === SCRIPT_SOURCE_KINDS.SERVER) {
+            requireAdmin(subject.roles, name, options.adminRoles, locale);
+        }
+        if (deps.projectDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        const document = await readScriptSource(deps.projectDir, registry, name, kind);
+        if (document === null)
+            throw new SchemaError('http.notFound', {}, locale);
+        return document;
+    });
+    app.put(`${prefix}/objects/:name/scripts/:kind`, async (request) => {
+        const { name, kind: rawKind } = request.params;
+        checkRateLimit(limiter, request, locale);
+        const subject = await authenticateRequest(authenticator, request, locale);
+        requireAdmin(subject.roles, name, options.adminRoles, locale);
+        const kind = scriptKind(rawKind, locale);
+        const body = saveBody(request.body, locale);
+        if (deps.projectDir === undefined) {
+            throw new SchemaError('http.notFound', {}, locale);
+        }
+        const result = await writeScriptSource({
+            projectDir: deps.projectDir,
+            registry,
+            objectName: name,
+            kind,
+            source: body.source,
+            identity: deps.commitIdentity,
+            locale,
+        });
+        return { ok: true, committed: result.committed, version: result.version };
+    });
+}
+//# sourceMappingURL=scripts.js.map

package/dist/adapters/rest/scripts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scripts.js","sourceRoot":"","sources":["../../../src/adapters/rest/scripts.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,WAAW,GAIZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAExF,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAWhF,SAAS,UAAU,CAAC,KAAa,EAAE,MAAc;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,KAAyB,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,KAAyB,CAAC;AACnC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa,EAAE,MAAc;IAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,GAAG,IAA+B,CAAC;IAClE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,aAAa,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,IAAI,WAAW,CAAC,oBAAoB,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,EAAE,MAAM,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,GAAoB,EACpB,IAAqB,EACrB,UAAuB,EAAE;IAEzB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC;IACxC,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC;IAEpC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,8BAA8B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAwC,CAAC;QACjF,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,mBAAmB,CAAC,MAAM,EAAE,CAAC;YACxC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/E,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC1E,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,8BAA8B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAwC,CAAC;QACjF,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1E,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,WAAW,CAAC,eAAe,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ;YACR,UAAU,EAAE,IAAI;YAChB,IAAI;YACJ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,cAAc;YAC7B,MAAM;SACP,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/commands/build.d.ts

@@ -0,0 +1,4 @@
+import type { BuildOptions } from '../types/index.js';
+/** `weave build` — bundle the server entry for production (esbuild, node platform) */
+export declare function build(cwd: string, options: BuildOptions): Promise<void>;
+//# sourceMappingURL=build.d.ts.map

package/dist/cli/commands/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,sFAAsF;AACtF,wBAAsB,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAkD7E"}