@weave-kit/engine 2.0.0 → 2.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +20 -0
- package/README.md +3 -3
- package/dist/adapters/events/index.js +2 -2
- package/dist/adapters/events/index.js.map +1 -1
- package/dist/adapters/mcp/http.d.ts +7 -0
- package/dist/adapters/mcp/http.d.ts.map +1 -1
- package/dist/adapters/mcp/http.js +56 -20
- package/dist/adapters/mcp/http.js.map +1 -1
- package/dist/adapters/mcp/index.d.ts +6 -0
- package/dist/adapters/mcp/index.d.ts.map +1 -1
- package/dist/adapters/mcp/index.js +1 -0
- package/dist/adapters/mcp/index.js.map +1 -1
- package/dist/adapters/rest/audit.js +2 -2
- package/dist/adapters/rest/audit.js.map +1 -1
- package/dist/cli/commands/deploy.js +1 -1
- package/dist/cli/commands/deploy.js.map +1 -1
- package/dist/core/i18n/ar.js +1 -1
- package/dist/core/i18n/ar.js.map +1 -1
- package/dist/core/i18n/de.js +1 -1
- package/dist/core/i18n/de.js.map +1 -1
- package/dist/core/i18n/es.js +1 -1
- package/dist/core/i18n/es.js.map +1 -1
- package/dist/core/i18n/fr.js +1 -1
- package/dist/core/i18n/fr.js.map +1 -1
- package/dist/core/i18n/hi.js +1 -1
- package/dist/core/i18n/hi.js.map +1 -1
- package/dist/core/i18n/id.js +1 -1
- package/dist/core/i18n/ja.js +1 -1
- package/dist/core/i18n/ko.js +1 -1
- package/dist/core/i18n/ko.js.map +1 -1
- package/dist/core/i18n/pt.js +1 -1
- package/dist/core/i18n/pt.js.map +1 -1
- package/dist/core/i18n/ru.js +1 -1
- package/dist/core/i18n/ru.js.map +1 -1
- package/dist/core/i18n/vi.js +1 -1
- package/dist/core/i18n/vi.js.map +1 -1
- package/dist/core/i18n/zh-hant.js +1 -1
- package/dist/core/i18n/zh.js +1 -1
- package/dist/core/i18n/zh.js.map +1 -1
- package/dist/core/limiter/index.d.ts +1 -1
- package/dist/core/limiter/index.d.ts.map +1 -1
- package/dist/core/limiter/index.js +1 -1
- package/dist/core/limiter/index.js.map +1 -1
- package/dist/core/limiter/quota.d.ts +1 -3
- package/dist/core/limiter/quota.d.ts.map +1 -1
- package/dist/core/limiter/quota.js +1 -3
- package/dist/core/limiter/quota.js.map +1 -1
- package/dist/core/rbac/rls.d.ts +1 -1
- package/dist/core/rbac/rls.js +1 -1
- package/dist/core/rbac/rowScope.d.ts.map +1 -1
- package/dist/core/rbac/rowScope.js +2 -3
- package/dist/core/rbac/rowScope.js.map +1 -1
- package/dist/runtime/config-types.d.ts +434 -0
- package/dist/runtime/config-types.d.ts.map +1 -0
- package/dist/runtime/config-types.js +2 -0
- package/dist/runtime/config-types.js.map +1 -0
- package/dist/runtime/data-access/query-helpers.d.ts +74 -0
- package/dist/runtime/data-access/query-helpers.d.ts.map +1 -0
- package/dist/runtime/data-access/query-helpers.js +238 -0
- package/dist/runtime/data-access/query-helpers.js.map +1 -0
- package/dist/runtime/data-access/query.d.ts.map +1 -1
- package/dist/runtime/data-access/query.js +4 -232
- package/dist/runtime/data-access/query.js.map +1 -1
- package/dist/runtime/engine.d.ts +4 -452
- package/dist/runtime/engine.d.ts.map +1 -1
- package/dist/runtime/engine.js +22 -195
- package/dist/runtime/engine.js.map +1 -1
- package/dist/runtime/guards.d.ts +31 -0
- package/dist/runtime/guards.d.ts.map +1 -0
- package/dist/runtime/guards.js +70 -0
- package/dist/runtime/guards.js.map +1 -0
- package/dist/runtime/register-http-routes.d.ts +40 -0
- package/dist/runtime/register-http-routes.d.ts.map +1 -0
- package/dist/runtime/register-http-routes.js +138 -0
- package/dist/runtime/register-http-routes.js.map +1 -0
- package/dist/subsystems/audit/store.js +3 -3
- package/dist/subsystems/audit/store.js.map +1 -1
- package/dist/subsystems/script/bridge.d.ts.map +1 -1
- package/dist/subsystems/script/bridge.js +1 -2
- package/dist/subsystems/script/bridge.js.map +1 -1
- package/dist/version.d.ts +1 -1
- package/dist/version.js +1 -1
- package/package.json +1 -1
package/dist/runtime/engine.d.ts
CHANGED
|
@@ -1,455 +1,7 @@
|
|
|
1
|
-
import
|
|
2
|
-
import type {
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
import type { ProjectType } from '../cli/types/index.js';
|
|
6
|
-
import { type ApprovalsQueue } from './tools/index.js';
|
|
7
|
-
import type { ToolExecutor } from './tools/index.js';
|
|
8
|
-
import type { ProxyForwarder } from './proxy/index.js';
|
|
9
|
-
import { type AuthSource, type AuthVerifier, type Authenticator, type OidcConfig } from '../adapters/auth/index.js';
|
|
10
|
-
import type { IdentitySource, IdentityStore } from '../core/provider/identity/index.js';
|
|
11
|
-
import type { CapabilitiesProvider } from '../core/provider/capabilities/index.js';
|
|
12
|
-
import type { PgIdentitySourceConfig } from './identity/sources/pg.js';
|
|
13
|
-
import { type PrincipalResolver } from '../adapters/rest/index.js';
|
|
14
|
-
import type { IngressConfig } from '../core/provider/event/index.js';
|
|
15
|
-
import { type EngineMcpConfig, type McpServerHandle } from '../adapters/mcp/index.js';
|
|
16
|
-
import { type EngineGraphQLConfig, type GraphQLServerHandle } from '../adapters/graphql/index.js';
|
|
17
|
-
import type { AuditEngine } from '../subsystems/audit/index.js';
|
|
18
|
-
import { type QueryBudget, type TotalMode } from './data-access/index.js';
|
|
19
|
-
import type { WorkflowTimerScheduler } from '../subsystems/workflow/index.js';
|
|
20
|
-
/** REST interface configuration */
|
|
21
|
-
export interface EngineRestConfig {
|
|
22
|
-
enabled?: boolean;
|
|
23
|
-
/** URL prefix for object routes; defaults to `/api` */
|
|
24
|
-
prefix?: string;
|
|
25
|
-
/** per-agent-key sliding-window rate limiting; disabled when absent */
|
|
26
|
-
rateLimit?: {
|
|
27
|
-
windowMs?: number;
|
|
28
|
-
max?: number;
|
|
29
|
-
};
|
|
30
|
-
/** CORS settings (passed to @fastify/cors); disabled when absent */
|
|
31
|
-
cors?: {
|
|
32
|
-
origin?: string | string[] | boolean;
|
|
33
|
-
methods?: string[];
|
|
34
|
-
allowedHeaders?: string[];
|
|
35
|
-
maxAge?: number;
|
|
36
|
-
};
|
|
37
|
-
/** maximum request body size in bytes; defaults to 1 MiB */
|
|
38
|
-
bodyLimit?: number;
|
|
39
|
-
/** roles allowed to query the full audit trail and use admin script-source read/write routes */
|
|
40
|
-
adminRoles?: string[];
|
|
41
|
-
/**
|
|
42
|
-
* maps an authenticated request to the data-access principal (see
|
|
43
|
-
* `PrincipalResolver`). A control plane injects this to run requests under a
|
|
44
|
-
* **system/admin scope** (cross-tenant global views, D32); absent = `userPrincipal`.
|
|
45
|
-
*/
|
|
46
|
-
principalFor?: PrincipalResolver;
|
|
47
|
-
}
|
|
48
|
-
/** audit subsystem config (optional; disabled = not loaded = zero overhead) */
|
|
49
|
-
export interface EngineAuditConfig {
|
|
50
|
-
enabled?: boolean;
|
|
51
|
-
/**
|
|
52
|
-
* Durability mode (default `best-effort`): `best-effort` = fire-and-forget
|
|
53
|
-
* process buffer; `transactional` = audit row written in the business
|
|
54
|
-
* transaction; `durable` = transactional outbox + relay (crash-safe,
|
|
55
|
-
* at-least-once).
|
|
56
|
-
*/
|
|
57
|
-
mode?: AuditMode;
|
|
58
|
-
/**
|
|
59
|
-
* Accept a best-effort fallback when `mode` is `transactional`/`durable` but
|
|
60
|
-
* the resolved sink cannot write in-transaction (`recordInTx`). Default
|
|
61
|
-
* `false` = fail-closed at startup (a misconfigured sink would otherwise drop
|
|
62
|
-
* events on crash). Built-in sinks always satisfy the requirement.
|
|
63
|
-
*/
|
|
64
|
-
allowBestEffortFallback?: boolean;
|
|
65
|
-
/** audit diff replay: attach before/after row snapshots to update/delete audit events (default off; table always has the columns) */
|
|
66
|
-
replay?: boolean;
|
|
67
|
-
/** L1 buffered-sink parameters */
|
|
68
|
-
batch?: {
|
|
69
|
-
batchSize?: number;
|
|
70
|
-
flushMs?: number;
|
|
71
|
-
};
|
|
72
|
-
}
|
|
73
|
-
/**
|
|
74
|
-
* Engine-level tool mechanism config (open contract, protocol-agnostic —
|
|
75
|
-
* lives at the top level, not under `adapters.*`). Disabled when absent.
|
|
76
|
-
*/
|
|
77
|
-
export interface EngineToolsConfig {
|
|
78
|
-
/** custom tool directory (relative to schemaDir, like `objects/`); default `tools` */
|
|
79
|
-
toolsDir?: string;
|
|
80
|
-
/** guardrail policies: inline array or a policies directory path (loaded by the assembly layer) */
|
|
81
|
-
guardrails?: {
|
|
82
|
-
policies?: GuardrailPolicy[] | string;
|
|
83
|
-
};
|
|
84
|
-
/**
|
|
85
|
-
* approval queue persistence (release-grade). Absent → PG-backed when the
|
|
86
|
-
* tool executor is created; `backend: 'memory'` opts into the single-process
|
|
87
|
-
* in-memory queue (tests). No Redis backend is implemented.
|
|
88
|
-
*/
|
|
89
|
-
approvals?: {
|
|
90
|
-
backend?: 'pg' | 'memory';
|
|
91
|
-
};
|
|
92
|
-
}
|
|
93
|
-
/** live event channel config (optional; disabled = not created = zero overhead) */
|
|
94
|
-
export interface EngineEventsConfig {
|
|
95
|
-
enabled?: boolean;
|
|
96
|
-
/** URL prefix for the SSE endpoint; defaults to `/api` */
|
|
97
|
-
prefix?: string;
|
|
98
|
-
/** roles allowed to see every actor's audit events (mirrors adapters.rest.adminRoles) */
|
|
99
|
-
adminRoles?: string[];
|
|
100
|
-
/** replay ring buffer size + heartbeat tuning */
|
|
101
|
-
replay?: {
|
|
102
|
-
maxEvents?: number;
|
|
103
|
-
heartbeatMs?: number;
|
|
104
|
-
};
|
|
105
|
-
}
|
|
106
|
-
/**
|
|
107
|
-
* Generic engine proxy. Configured with `proxy.resolver`
|
|
108
|
-
* only → otherwise (absent) the proxy is not wired (zero overhead). The engine
|
|
109
|
-
* provides the mechanism (contract + forwarder + routes); the resolver carries
|
|
110
|
-
* the application semantics (which connection a subject may reach).
|
|
111
|
-
*/
|
|
112
|
-
export interface EngineProxyConfig {
|
|
113
|
-
/** inject application layer: resolve connection → target (id/url/key/keyScope). */
|
|
114
|
-
resolver?: ProxyTargetResolver | ProxyTargetResolverBuilder;
|
|
115
|
-
/** injectable fetch (tests / custom transport). */
|
|
116
|
-
fetchImpl?: typeof fetch;
|
|
117
|
-
/**
|
|
118
|
-
* custom outbound forwarder, e.g. a tunnel-aware one that routes
|
|
119
|
-
* `transport: 'tunnel'` targets over a live connector. Builder form receives
|
|
120
|
-
* the runtime deps so the host can read its own metadata. Default = fetch.
|
|
121
|
-
*/
|
|
122
|
-
forwarder?: ProxyForwarder | ((deps: ProxyResolverDeps) => ProxyForwarder);
|
|
123
|
-
enabled?: boolean;
|
|
124
|
-
}
|
|
125
|
-
/** runtime deps handed to a {@link ProxyTargetResolverBuilder} so the app can read its own metadata. */
|
|
126
|
-
export interface ProxyResolverDeps {
|
|
127
|
-
dataAccess: ObjectDataAccess;
|
|
128
|
-
pool: Pool;
|
|
129
|
-
registry: ObjectRegistry;
|
|
130
|
-
authenticator: Authenticator;
|
|
131
|
-
locale: Locale;
|
|
132
|
-
}
|
|
133
|
-
/**
|
|
134
|
-
* Factory form of `resolver`: built by the engine at assembly time with the real
|
|
135
|
-
* runtime deps, so the app can read its metadata (e.g. the governance engine's
|
|
136
|
-
* own `connections` object) server-side without a second pool. A plain
|
|
137
|
-
* `ProxyTargetResolver` instance is also accepted.
|
|
138
|
-
*/
|
|
139
|
-
export type ProxyTargetResolverBuilder = (deps: ProxyResolverDeps) => ProxyTargetResolver;
|
|
140
|
-
/** engine assembly configuration — the single wiring point (see AGENTS.md) */
|
|
141
|
-
/** a host-level background service returned by a service's `start`. */
|
|
142
|
-
export interface EngineServiceHandle {
|
|
143
|
-
/** tear the service down (abort streams, clear timers); called on engine close. */
|
|
144
|
-
stop(): Promise<void>;
|
|
145
|
-
}
|
|
146
|
-
/** host-app service factory the engine starts once assembled, stops on close. */
|
|
147
|
-
export interface EngineService {
|
|
148
|
-
name: string;
|
|
149
|
-
start(engine: WeaveKitEngine): Promise<EngineServiceHandle> | EngineServiceHandle;
|
|
150
|
-
}
|
|
151
|
-
/** identity directory wiring (see `core/provider/identity`) */
|
|
152
|
-
export interface EngineIdentityConfig {
|
|
153
|
-
/**
|
|
154
|
-
* provisioning source: an `IdentitySource` instance (has `pull`) or a
|
|
155
|
-
* declarative `PgIdentitySourceConfig`. Absent → greenfield (the engine owns
|
|
156
|
-
* `weavekit_user`/`weavekit_department` directly).
|
|
157
|
-
*/
|
|
158
|
-
source?: IdentitySource | PgIdentitySourceConfig;
|
|
159
|
-
/** replaceable local directory store; defaults to PG over `weavekit_*` */
|
|
160
|
-
store?: IdentityStore;
|
|
161
|
-
/**
|
|
162
|
-
* credential verifier (OIDC/JWT/SAML); when set the engine authenticates via
|
|
163
|
-
* `verifier → directory → subject` and `auth.source` may be omitted.
|
|
164
|
-
*/
|
|
165
|
-
verifier?: AuthVerifier;
|
|
166
|
-
/** reject subjects with no local identity for scoped access (default false) */
|
|
167
|
-
required?: boolean;
|
|
168
|
-
sync?: {
|
|
169
|
-
/** run the source sync on engine start (fail-closed) */
|
|
170
|
-
onStart?: boolean;
|
|
171
|
-
/** soft-disable local rows absent from the source snapshot */
|
|
172
|
-
deactivateMissing?: boolean;
|
|
173
|
-
};
|
|
174
|
-
}
|
|
175
|
-
export interface EngineConfig {
|
|
176
|
-
/** postgres connection string; defaults to process.env.DATABASE_URL */
|
|
177
|
-
databaseUrl?: string;
|
|
178
|
-
/**
|
|
179
|
-
* connection string used only for schema migration/DDL by the CLI (`weave
|
|
180
|
-
* migrate`/`weave dev`). Defaults to `databaseUrl`. **Same database, a
|
|
181
|
-
* separate account** — a PostgreSQL role with DDL rights (usually the owner),
|
|
182
|
-
* so the runtime account can be least-privileged (no DDL/DROP/TRUNCATE).
|
|
183
|
-
* Pointing it at a *different* database is a misconfiguration (migrations
|
|
184
|
-
* would land where the runtime cannot see them). The engine itself never runs
|
|
185
|
-
* DDL at runtime.
|
|
186
|
-
*/
|
|
187
|
-
migrationDatabaseUrl?: string;
|
|
188
|
-
/**
|
|
189
|
-
* runtime database account guard. The engine only ever runs DML, so its
|
|
190
|
-
* account should be least-privileged (no schema `CREATE`); DDL is an explicit
|
|
191
|
-
* `weave migrate` using `migrationDatabaseUrl`. When `requireRestrictedAccount`
|
|
192
|
-
* is true (the default) the engine **fails to start** if its account can
|
|
193
|
-
* create objects in the current schema. Set false for a single-account setup
|
|
194
|
-
* (`weave dev` does this by default), or override with the
|
|
195
|
-
* `WEAVEKIT_REQUIRE_RESTRICTED_ACCOUNT` env var.
|
|
196
|
-
*/
|
|
197
|
-
runtime?: {
|
|
198
|
-
requireRestrictedAccount?: boolean;
|
|
199
|
-
};
|
|
200
|
-
/** runtime message locale; resolution: config → env WEAVEKIT_LOCALE → 'en' */
|
|
201
|
-
locale?: Locale;
|
|
202
|
-
/**
|
|
203
|
-
* project starting preset (agent/governance/service/business) — persisted by
|
|
204
|
-
* the scaffolder. Used as CLI context (e.g. `weave object:create` scaffolds a
|
|
205
|
-
* `client.js` template only for `business` projects). Not required at runtime.
|
|
206
|
-
*/
|
|
207
|
-
projectType?: ProjectType;
|
|
208
|
-
/**
|
|
209
|
-
* project root whose `objects/<name>/schema.json` files are the metadata source.
|
|
210
|
-
* The engine loads the schema on startup; it never touches the database unless
|
|
211
|
-
* `migrate.auto` is true (default false — DDL is an explicit `weave migrate`).
|
|
212
|
-
*/
|
|
213
|
-
schemaDir?: string;
|
|
214
|
-
/**
|
|
215
|
-
* migration behavior:
|
|
216
|
-
* - `auto` — run the schema→PG migration (CREATE/ALTER) on engine startup.
|
|
217
|
-
* Default false: WeaveKit is a headless bridge to your database — building/
|
|
218
|
-
* altering tables is an explicit `weave migrate`. Enable for greenfield/
|
|
219
|
-
* business projects that want the schema to drive DDL automatically.
|
|
220
|
-
* Additive DDL on existing tables is governed per object by
|
|
221
|
-
* `schema.alter: true`.
|
|
222
|
-
*/
|
|
223
|
-
migrate?: {
|
|
224
|
-
auto?: boolean;
|
|
225
|
-
};
|
|
226
|
-
/**
|
|
227
|
-
* git behavior for engine startup syncs:
|
|
228
|
-
* - `meta` — git-commit the metadata tree (`objects/`) after a `migrate.auto` sync
|
|
229
|
-
* - `identity` — commit identity; falls back to a local weavekit identity
|
|
230
|
-
*/
|
|
231
|
-
commit?: {
|
|
232
|
-
meta?: boolean;
|
|
233
|
-
identity?: {
|
|
234
|
-
name: string;
|
|
235
|
-
email: string;
|
|
236
|
-
};
|
|
237
|
-
};
|
|
238
|
-
/**
|
|
239
|
-
* Authentication: a static key map / custom resolver (`source`), a built-in
|
|
240
|
-
* OIDC/JWT verifier (`oidc`), or `identity.verifier` for a custom protocol
|
|
241
|
-
* verifier. At least one is required. `oidc` requires a resolvable identity
|
|
242
|
-
* directory (run `weave sync:identity`).
|
|
243
|
-
*/
|
|
244
|
-
auth?: {
|
|
245
|
-
source?: AuthSource;
|
|
246
|
-
oidc?: OidcConfig;
|
|
247
|
-
};
|
|
248
|
-
/** protocol adapters (REST/MCP/events/GraphQL), closable via config */
|
|
249
|
-
adapters?: {
|
|
250
|
-
rest?: EngineRestConfig;
|
|
251
|
-
mcp?: EngineMcpConfig;
|
|
252
|
-
events?: EngineEventsConfig;
|
|
253
|
-
graphql?: EngineGraphQLConfig;
|
|
254
|
-
};
|
|
255
|
-
/** engine-level tool mechanism: custom tools + guardrail policies; disabled when absent */
|
|
256
|
-
tools?: EngineToolsConfig;
|
|
257
|
-
/** optional subsystems, dynamically loaded when enabled (audit/script; workflow is declaration-driven; unknown keys error out) */
|
|
258
|
-
subsystems?: {
|
|
259
|
-
audit?: EngineAuditConfig;
|
|
260
|
-
script?: EngineScriptConfig;
|
|
261
|
-
workflow?: EngineWorkflowConfig;
|
|
262
|
-
};
|
|
263
|
-
/**
|
|
264
|
-
* durable fixed-period counters / usage budgets (optional; disabled when
|
|
265
|
-
* absent). Backed by PostgreSQL (`weavekit_counters`) and exposed as
|
|
266
|
-
* `engine.quotas`; the host consumes it around its own integration calls via
|
|
267
|
-
* `core/limiter` `consumeQuota` / `assertQuota`.
|
|
268
|
-
*/
|
|
269
|
-
quotas?: {
|
|
270
|
-
backend?: 'pg';
|
|
271
|
-
};
|
|
272
|
-
/**
|
|
273
|
-
* Agent-native query budget: caps rows/filters/sorts (data-access), joins /
|
|
274
|
-
* SQL length / statement timeout (restricted SQL) and GraphQL depth. Absent =
|
|
275
|
-
* defaults (see `QUERY_BUDGET_DEFAULTS`).
|
|
276
|
-
*/
|
|
277
|
-
queryBudget?: Partial<QueryBudget>;
|
|
278
|
-
/**
|
|
279
|
-
* List-query defaults for every read surface (REST / GraphQL / MCP).
|
|
280
|
-
* `query.total` selects how a page's `total` is computed: `exact` (default,
|
|
281
|
-
* `COUNT(*)`), `estimate` (`pg_class.reltuples` — approximate, cheap on large
|
|
282
|
-
* tables) or `none` (skip counting; `total` omitted). A per-request `total`
|
|
283
|
-
* argument overrides this.
|
|
284
|
-
*/
|
|
285
|
-
query?: {
|
|
286
|
-
total?: TotalMode;
|
|
287
|
-
};
|
|
288
|
-
/**
|
|
289
|
-
* Dedicated schema for the engine's own tables (`weavekit_*` system tables,
|
|
290
|
-
* `weavekit_record__<object>` side tables, `weavekit_m2m__*` link tables), so
|
|
291
|
-
* a DBA reviewing the customer schema does not see engine plumbing. Default
|
|
292
|
-
* (absent) keeps them in the object schema (legacy). Set the same value on
|
|
293
|
-
* `weave migrate`; the runtime appends it to `search_path`. Only affects new
|
|
294
|
-
* databases (existing installs need a manual `ALTER TABLE … SET SCHEMA`).
|
|
295
|
-
*/
|
|
296
|
-
systemSchema?: string;
|
|
297
|
-
/**
|
|
298
|
-
* Object-path row-level security (defense in depth; default off in 1.x).
|
|
299
|
-
* With `enforce`, the engine runs user-principal customer-table reads /
|
|
300
|
-
* updates / deletes under `role` (default `weavekit_object`), so PostgreSQL
|
|
301
|
-
* policies generated from the same permission matrix re-check the RBAC row
|
|
302
|
-
* scope. `weave migrate` provisions the role/policies; the engine refuses to
|
|
303
|
-
* start when they are missing. Inserts and system principals run as the owner.
|
|
304
|
-
*/
|
|
305
|
-
rls?: {
|
|
306
|
-
enforce?: boolean;
|
|
307
|
-
role?: string;
|
|
308
|
-
};
|
|
309
|
-
/**
|
|
310
|
-
* Execution evidence capture (optional; disabled when absent). When enabled,
|
|
311
|
-
* every data-access write / workflow transition / tool call records one
|
|
312
|
-
* `weavekit_evidence` row with its full stage timeline and real outcome
|
|
313
|
-
* (best-effort: a failed evidence write never blocks the execution). Capture
|
|
314
|
-
* only — export/retention belong to the enterprise E2 layer.
|
|
315
|
-
*/
|
|
316
|
-
evidence?: {
|
|
317
|
-
enabled?: boolean;
|
|
318
|
-
};
|
|
319
|
-
/**
|
|
320
|
-
* Row-scope / multi-tenancy (row mode). When enabled, a subject without a
|
|
321
|
-
* scope is stamped with `defaultScope`, and objects declaring a `scope` field
|
|
322
|
-
* are scoped to the subject's scope (RBAC row scope + RLS GUC + audit). Absent
|
|
323
|
-
* = single-scope (unchanged). Lifecycle / schema-per-tenant are out of scope
|
|
324
|
-
* (enterprise).
|
|
325
|
-
*/
|
|
326
|
-
scope?: {
|
|
327
|
-
enabled?: boolean;
|
|
328
|
-
defaultScope?: string;
|
|
329
|
-
};
|
|
330
|
-
/** generic outbound proxy route wiring (applications provide the resolver) */
|
|
331
|
-
proxy?: EngineProxyConfig;
|
|
332
|
-
/**
|
|
333
|
-
* inbound external-event entry point (first-class ingress seam; disabled when
|
|
334
|
-
* absent). The app provides provider verification + handling; the engine
|
|
335
|
-
* preserves the raw body, rate-limits per source and audits the receipt.
|
|
336
|
-
*/
|
|
337
|
-
ingress?: IngressConfig;
|
|
338
|
-
/**
|
|
339
|
-
* low-level observability sinks (optional; absent = no-op = zero overhead).
|
|
340
|
-
* The engine emits request latency/status, RBAC denials, query-budget rejects
|
|
341
|
-
* and finished spans; a host injects the telemetry backend. Labels must stay
|
|
342
|
-
* low-cardinality and PII-free (see `core/observability`).
|
|
343
|
-
*/
|
|
344
|
-
observability?: {
|
|
345
|
-
metrics?: MetricsSink;
|
|
346
|
-
trace?: TraceSink;
|
|
347
|
-
};
|
|
348
|
-
/**
|
|
349
|
-
* capability feature switches (declarative gating). `features.fieldTypes` is
|
|
350
|
-
* a whitelist of field types a schema may declare; a field outside the list is
|
|
351
|
-
* rejected by the validator (fail-closed). Defaults to the engine primitives
|
|
352
|
-
* plus every semantic type (no gating) unless a project narrows it.
|
|
353
|
-
*/
|
|
354
|
-
features?: {
|
|
355
|
-
fieldTypes?: string[];
|
|
356
|
-
};
|
|
357
|
-
/**
|
|
358
|
-
* project-local field-type registrations (open registration): a directory of
|
|
359
|
-
* modules (each default-exporting a `FieldTypeRegistration` or array) and/or
|
|
360
|
-
* inline entries. Compiled with the built-ins into an immutable effective
|
|
361
|
-
* registry passed through validation + consumers (no mutable global).
|
|
362
|
-
*/
|
|
363
|
-
fieldTypes?: {
|
|
364
|
-
dir?: string;
|
|
365
|
-
entries?: FieldTypeRegistration[];
|
|
366
|
-
};
|
|
367
|
-
/**
|
|
368
|
-
* engine-owned identity directory (see `core/provider/identity`). `source`
|
|
369
|
-
* imports an external user/department directory (a `pg` descriptor or an
|
|
370
|
-
* `IdentitySource`); `weave sync:identity` provisions it into `weavekit_user`
|
|
371
|
-
* / `weavekit_department` before the engine serves scoped access.
|
|
372
|
-
*/
|
|
373
|
-
identity?: EngineIdentityConfig;
|
|
374
|
-
/**
|
|
375
|
-
* capabilities (feature/entitlement) read-only seam (see
|
|
376
|
-
* `core/provider/capabilities`). The engine **never judges licensing** — a host
|
|
377
|
-
* (e.g. `@weave-kit/enterprise` E0) injects a `CapabilitiesProvider`; absent =
|
|
378
|
-
* baseline (no features). Surfaced at `GET {prefix}/capabilities`.
|
|
379
|
-
*/
|
|
380
|
-
capabilities?: {
|
|
381
|
-
provider?: CapabilitiesProvider;
|
|
382
|
-
};
|
|
383
|
-
/**
|
|
384
|
-
* host-level background services (e.g. an instance-liveness monitor). Started
|
|
385
|
-
* after the engine is assembled and stopped in `close()`, so both `weave dev`
|
|
386
|
-
* and production `main.ts` manage them identically. A service gets the whole
|
|
387
|
-
* engine (data-access/pool/events) to orchestrate app-specific work.
|
|
388
|
-
*/
|
|
389
|
-
services?: EngineService[];
|
|
390
|
-
}
|
|
391
|
-
/** a running engine: fastify app + pool + RBAC-decorated data access */
|
|
392
|
-
export interface WeaveKitEngine {
|
|
393
|
-
app: FastifyInstance;
|
|
394
|
-
registry: ObjectRegistry;
|
|
395
|
-
pool: Pool;
|
|
396
|
-
dataAccess: ObjectDataAccess;
|
|
397
|
-
authenticator: Authenticator;
|
|
398
|
-
/** MCP adapter handle (present unless adapters.mcp.enabled is false) */
|
|
399
|
-
mcp?: McpServerHandle;
|
|
400
|
-
/** GraphQL adapter handle (present when adapters.graphql.enabled is true) */
|
|
401
|
-
graphql?: GraphQLServerHandle;
|
|
402
|
-
/** tool mechanism (present when config.tools.toolsDir is set): executor + approval queue */
|
|
403
|
-
tools?: {
|
|
404
|
-
defs: ToolDefinition[];
|
|
405
|
-
executor: ToolExecutor;
|
|
406
|
-
};
|
|
407
|
-
/** live event publisher (present when adapters.events.enabled): emits committed writes / audit / schema changes */
|
|
408
|
-
events?: EventPublisher;
|
|
409
|
-
/** generic proxy handle (present when config.proxy.resolver is set): forwarder + resolver */
|
|
410
|
-
proxy?: {
|
|
411
|
-
forwarder: ProxyForwarder;
|
|
412
|
-
resolver: ProxyTargetResolver;
|
|
413
|
-
};
|
|
414
|
-
/** audit subsystem (present when enabled); buffered sink is flushed on close */
|
|
415
|
-
audit?: AuditEngine;
|
|
416
|
-
/** durable counter store (present when `config.quotas` is set): quota/budget primitive */
|
|
417
|
-
quotas?: CounterStore;
|
|
418
|
-
/** script subsystem (present when enabled); workers are terminated on close */
|
|
419
|
-
script?: ScriptDispatcher;
|
|
420
|
-
/** approval queue (present when config.tools is set): shared by tools and workflow transitions */
|
|
421
|
-
approvals?: ApprovalsQueue;
|
|
422
|
-
/** workflow timer scheduler (present when `subsystems.workflow.enabled`): fires `onTimeout` */
|
|
423
|
-
workflow?: WorkflowTimerScheduler;
|
|
424
|
-
/** observability sinks (no-op unless `config.observability` injects one) */
|
|
425
|
-
observability: {
|
|
426
|
-
metrics: MetricsSink;
|
|
427
|
-
trace: TraceSink;
|
|
428
|
-
};
|
|
429
|
-
close(): Promise<void>;
|
|
430
|
-
}
|
|
431
|
-
export declare function resolveLocale(configLocale: Locale | undefined): Locale;
|
|
432
|
-
/**
|
|
433
|
-
* Whether the runtime database account must be least-privileged (no schema
|
|
434
|
-
* `CREATE`). Resolution: explicit `config.runtime.requireRestrictedAccount` →
|
|
435
|
-
* env `WEAVEKIT_REQUIRE_RESTRICTED_ACCOUNT` → default `true`.
|
|
436
|
-
*/
|
|
437
|
-
export declare function resolveRequireRestrictedAccount(config: EngineConfig): boolean;
|
|
438
|
-
/** the object-path RLS role when `rls.enforce` is on, else undefined */
|
|
439
|
-
export declare function resolveObjectRlsRole(config: Pick<EngineConfig, 'rls'>): string | undefined;
|
|
440
|
-
/**
|
|
441
|
-
* Fail-closed guard for `rls.enforce`: the role must exist and be grantable to
|
|
442
|
-
* the runtime account, and every object table must carry the current policies
|
|
443
|
-
* and privileges (i.e. `weave migrate` ran with enforcement on).
|
|
444
|
-
*/
|
|
445
|
-
export declare function assertObjectRlsProvisioned(pool: Pool, registry: ObjectRegistry, role: string, locale: Locale, scope?: import('../core/index.js').SchemaScope): Promise<void>;
|
|
446
|
-
/**
|
|
447
|
-
* Fail-closed guard: refuse to start when the runtime account can create
|
|
448
|
-
* objects in the current schema. WeaveKit runs DDL only via `weave migrate`
|
|
449
|
-
* (with `migrationDatabaseUrl`); a runtime account with `CREATE` defeats the
|
|
450
|
-
* least-privilege model.
|
|
451
|
-
*/
|
|
452
|
-
export declare function assertRestrictedRuntimeAccount(pool: Pool, config: EngineConfig, locale: Locale): Promise<void>;
|
|
1
|
+
import { ObjectRegistry } from '../core/index.js';
|
|
2
|
+
import type { EngineConfig, WeaveKitEngine } from './config-types.js';
|
|
3
|
+
export type * from './config-types.js';
|
|
4
|
+
export { resolveLocale, resolveRequireRestrictedAccount, resolveObjectRlsRole, assertObjectRlsProvisioned, assertRestrictedRuntimeAccount, } from './guards.js';
|
|
453
5
|
/**
|
|
454
6
|
* Assemble a running engine from an already-built registry (no schema loading).
|
|
455
7
|
* This is the low-level assembly used by `createEngine` and by tests/dev that
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/runtime/engine.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/runtime/engine.ts"],"names":[],"mappings":"AAGA,OAAO,EAKL,cAAc,EAcf,MAAM,kBAAkB,CAAC;AAsB1B,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACtE,mBAAmB,mBAAmB,CAAC;AAOvC,OAAO,EACL,aAAa,EACb,+BAA+B,EAC/B,oBAAoB,EACpB,0BAA0B,EAC1B,8BAA8B,GAC/B,MAAM,aAAa,CAAC;AAErB;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,cAAc,EACxB,MAAM,EAAE,YAAY,GACnB,OAAO,CAAC,cAAc,CAAC,CA+azB"}
|