@zveltio/sdk 3.0.0-beta.5 → 3.0.0-beta.68

package/dist/tests/local-store.test.js

@@ -74,3 +74,47 @@ describe('LocalStore — conflict detection', () => {
         expect(rec?._conflictData).toBeUndefined();
     });
 });
+describe('LocalStore — what the SyncManager actually passes', () => {
+    let store;
+    beforeEach(async () => {
+        store = new LocalStore();
+        await store.open();
+        await store.clear();
+    });
+    afterEach(async () => {
+        await store.close();
+    });
+    it('flags a conflict when the confirmed server version is an epoch timestamp', async () => {
+        // `syncNow()` and `pull()` both pass `Date.now()` as the server version —
+        // the collections API returns no version column. From the first ACK on,
+        // `_serverVersion` is ~1.79e12 and `_localVersion` is still a small counter,
+        // so the version comparison alone can never be true again and every local
+        // edit was overwritten in silence.
+        await store.put('posts', 'rec-ts', { title: 'v1' });
+        const [op] = await store.getPendingOps();
+        await store.markSynced(op.id, 'posts', 'rec-ts', Date.now());
+        await store.put('posts', 'rec-ts', { title: 'local edit' });
+        await store.applyServerUpdate('posts', 'rec-ts', { title: 'server wins' }, Date.now());
+        const after = await store.get('posts', 'rec-ts');
+        expect(after?._syncStatus).toBe('conflict');
+        expect(after?.data).toEqual({ title: 'local edit' });
+        expect(after?._conflictData).toEqual({ title: 'server wins' });
+    });
+    it('queues the resolved row, so a resolution reaches the server', async () => {
+        await store.applyServerUpdate('posts', 'rec-res', { title: 'server' }, Date.now());
+        await store.resolveConflict('posts', 'rec-res', { title: 'resolved' });
+        const ops = await store.getPendingOps();
+        const mine = ops.filter((o) => o.recordId === 'rec-res');
+        expect(mine, 'the resolution was never queued').toHaveLength(1);
+        expect(mine[0].payload).toEqual({ title: 'resolved' });
+        expect(mine[0].operation).toBe('update');
+    });
+    it('keeps the CRDT document across a clean server update', async () => {
+        await store.put('posts', 'rec-crdt', { title: 'local' });
+        const [op] = await store.getPendingOps();
+        await store.markSynced(op.id, 'posts', 'rec-crdt', Date.now());
+        await store.applyServerUpdate('posts', 'rec-crdt', { title: 'server' }, Date.now());
+        const after = await store.get('posts', 'rec-crdt');
+        expect(after?._crdtDoc, 'the CRDT document was dropped, so no later merge can run').toBeDefined();
+    });
+});

package/dist/tests/multipart.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=multipart.test.d.ts.map

package/dist/tests/multipart.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multipart.test.d.ts","sourceRoot":"","sources":["../../src/tests/multipart.test.ts"],"names":[],"mappings":""}

package/dist/tests/multipart.test.js

@@ -0,0 +1,37 @@
+import { describe, expect, it } from 'bun:test';
+import { MULTIPART_REQUIRED, readMultipart } from '../extension/multipart.js';
+/**
+ * Six upload handlers opened with a bare `await c.req.formData()` and put their
+ * "no file provided" 400 on the line after it. `formData()` throws when the body
+ * is not multipart, so that 400 was unreachable for exactly the requests it was
+ * written for, and they came back as a bare 500 instead.
+ *
+ * Both directions are asserted here. A guard that rejects everything would also
+ * make the suite green, and would break every upload in the product.
+ */
+const ctxWith = (body, headers = {}) => {
+    const req = new Request('http://x/upload', { method: 'POST', body, headers });
+    return { req: { formData: () => req.formData() } };
+};
+describe('readMultipart', () => {
+    it('parses a real multipart body, fields and files alike', async () => {
+        const fd = new FormData();
+        fd.append('file', new File(['salut'], 'a.txt', { type: 'text/plain' }));
+        fd.append('path', '/docs');
+        const form = await readMultipart(ctxWith(fd));
+        expect(form).not.toBeNull();
+        expect(form?.get('file')?.name).toBe('a.txt');
+        expect(form?.get('path')).toBe('/docs');
+    });
+    it('answers null for every body shape that used to throw', async () => {
+        expect(await readMultipart(ctxWith('{}', { 'content-type': 'application/json' }))).toBeNull();
+        expect(await readMultipart(ctxWith(null))).toBeNull();
+        expect(await readMultipart(ctxWith('salut', { 'content-type': 'text/plain' }))).toBeNull();
+    });
+    it('does not leak the parser own message to the caller', async () => {
+        // The body parser's error reads like "FormData parse error" — nothing a
+        // caller can act on, and echoing a parser's internals over HTTP is how
+        // request contents end up in error strings.
+        expect(MULTIPART_REQUIRED).toEqual({ error: 'Expected a multipart/form-data body.' });
+    });
+});

package/dist/tests/offline-provider-crdt.test.d.ts

@@ -0,0 +1,2 @@
+import './setup';
+//# sourceMappingURL=offline-provider-crdt.test.d.ts.map

package/dist/tests/offline-provider-crdt.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"offline-provider-crdt.test.d.ts","sourceRoot":"","sources":["../../src/tests/offline-provider-crdt.test.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,CAAC"}

package/dist/tests/offline-provider-crdt.test.js

@@ -0,0 +1,119 @@
+import './setup';
+import { afterEach, beforeEach, describe, expect, it } from 'bun:test';
+import { LocalStore } from '../local-store.js';
+import { createOfflineProvider } from '../offline/index.js';
+/**
+ * The CRDT provider is the DEFAULT (`config.provider ?? 'crdt'`) and it did
+ * nothing at all: `pull()` was an empty body, `subscribe()` returned an
+ * unsubscribe for nothing, and `push()` returned `0` — which reads as "there
+ * was nothing to send" rather than "I did not look". An application that called
+ * `createOfflineProvider({ engineUrl })` and pushed on a timer got a clean run
+ * and an empty server, forever, with nothing in any log.
+ *
+ * The test that existed asserted exactly that: `await expect(p.push())
+ * .resolves.toBe(0)`, under the title "builds a working stub". It passed for the
+ * whole life of the defect.
+ *
+ * So these assert the crossing — what ends up in the local store, and what the
+ * count means — rather than that the methods are callable.
+ */
+const ENGINE = 'http://engine.test';
+/** Rows the fake engine holds, by collection. */
+let served = {};
+/** Every request the provider made, so "did it even ask" is answerable. */
+let requests = [];
+const realFetch = globalThis.fetch;
+beforeEach(async () => {
+    served = {};
+    requests = [];
+    globalThis.fetch = (async (input, init) => {
+        const url = typeof input === 'string' ? input : input.toString();
+        requests.push(`${init?.method ?? 'GET'} ${url.replace(ENGINE, '')}`);
+        const match = url.match(/\/api\/data\/([^/?]+)/);
+        const name = match?.[1] ?? '';
+        const page = Number(new URL(url).searchParams.get('page') ?? '1');
+        // One page only: page 2 comes back empty, which is how `pull` stops.
+        const data = page === 1 ? (served[name] ?? []) : [];
+        return new Response(JSON.stringify({ data, total: data.length, page, limit: 200 }), {
+            status: 200,
+            headers: { 'content-type': 'application/json' },
+        });
+    });
+    const store = new LocalStore();
+    await store.open();
+    await store.clear();
+    await store.close();
+});
+afterEach(() => {
+    globalThis.fetch = realFetch;
+});
+async function localRows(collection) {
+    const store = new LocalStore();
+    await store.open();
+    const rows = await store.list(collection);
+    await store.close();
+    return rows;
+}
+describe('createOfflineProvider — the crdt path actually syncs', () => {
+    it('is the default provider, which is why the no-op mattered', async () => {
+        const p = await createOfflineProvider({ engineUrl: ENGINE });
+        expect(p.kind).toBe('crdt');
+        await p.close();
+    });
+    it('pull writes the server rows into the local store', async () => {
+        served.orders = [
+            { id: 'o-1', total: 10, status: 'new' },
+            { id: 'o-2', total: 20, status: 'paid' },
+        ];
+        const p = await createOfflineProvider({ engineUrl: ENGINE, tables: ['orders'] });
+        await p.pull();
+        await p.close();
+        const rows = await localRows('orders');
+        expect(rows.map((r) => r.id).sort()).toEqual(['o-1', 'o-2']);
+        expect(rows.find((r) => r.id === 'o-1')?.data.total).toBe(10);
+        // The old implementation made no request at all. This is the assertion that
+        // would have caught it.
+        expect(requests.some((r) => r.startsWith('GET /api/data/orders'))).toBe(true);
+    });
+    it('pull refuses an empty table list instead of quietly doing nothing', async () => {
+        // Silence here is exactly what the no-op was. A provider asked to replicate
+        // nothing is a configuration mistake, and an empty local database looks the
+        // same as an empty server.
+        const p = await createOfflineProvider({ engineUrl: ENGINE });
+        await expect(p.pull()).rejects.toThrow(/tables.*is empty/i);
+        await p.close();
+    });
+    it('push reports how many queued operations it actually sent', async () => {
+        const p = await createOfflineProvider({ engineUrl: ENGINE, tables: ['orders'] });
+        // Queue two local writes the way an offline application does.
+        const store = new LocalStore();
+        await store.open();
+        await store.put('orders', 'o-9', { total: 99 });
+        await store.put('orders', 'o-10', { total: 100 });
+        const queued = await store.getPendingOps();
+        await store.close();
+        expect(queued.length).toBe(2);
+        const sent = await p.push();
+        await p.close();
+        expect(sent).toBe(2);
+        // Not just a number: the writes have to have left the machine.
+        expect(requests.filter((r) => r.startsWith('POST /api/data/orders')).length).toBe(2);
+    });
+    it('subscribe delivers the local rows, and the unsubscribe stops delivery', async () => {
+        served.orders = [{ id: 'o-1', total: 10 }];
+        const p = await createOfflineProvider({ engineUrl: ENGINE, tables: ['orders'] });
+        await p.pull();
+        const seen = [];
+        const off = p.subscribe('orders', (rows) => seen.push(rows));
+        await Bun.sleep(20);
+        expect(seen.length).toBeGreaterThan(0);
+        expect(seen.at(-1).map((r) => r.id)).toEqual(['o-1']);
+        off();
+        const countAtUnsubscribe = seen.length;
+        // A second pull notifies listeners; an unsubscribed callback must not hear it.
+        await p.pull();
+        await Bun.sleep(20);
+        expect(seen.length).toBe(countAtUnsubscribe);
+        await p.close();
+    });
+});

package/dist/tests/realtime.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=realtime.test.d.ts.map

package/dist/tests/realtime.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"realtime.test.d.ts","sourceRoot":"","sources":["../../src/tests/realtime.test.ts"],"names":[],"mappings":""}

package/dist/tests/realtime.test.js

@@ -0,0 +1,39 @@
+import { describe, it, expect, afterEach } from 'bun:test';
+import { ZveltioRealtime } from '../realtime.js';
+const RealWebSocket = globalThis.WebSocket;
+afterEach(() => {
+    globalThis.WebSocket = RealWebSocket;
+});
+/** Records the constructor arguments instead of dialling out. */
+function captureSockets() {
+    const calls = [];
+    globalThis.WebSocket = class {
+        static OPEN = 1;
+        readyState = 0;
+        constructor(...args) {
+            calls.push(args);
+        }
+        close() { }
+        send() { }
+    };
+    return calls;
+}
+describe('ZveltioRealtime upgrade headers', () => {
+    // `/api/ws` accepts an API key in `X-API-Key`; a server-side client had no
+    // way to send one, so it could read a collection over REST and never
+    // subscribe to it.
+    it('passes headers to the socket when given', () => {
+        const calls = captureSockets();
+        const rt = new ZveltioRealtime('https://engine.test', { headers: { 'X-API-Key': 'zvk_x' } });
+        rt.connect();
+        expect(calls[0]).toEqual(['wss://engine.test/api/ws', { headers: { 'X-API-Key': 'zvk_x' } }]);
+        rt.disconnect();
+    });
+    it('uses the one-argument constructor without them', () => {
+        const calls = captureSockets();
+        const rt = new ZveltioRealtime('http://engine.test');
+        rt.connect();
+        expect(calls[0]).toEqual(['ws://engine.test/api/ws']);
+        rt.disconnect();
+    });
+});

package/dist/tests/sync-manager.test.d.ts

@@ -0,0 +1,2 @@
+import './setup';
+//# sourceMappingURL=sync-manager.test.d.ts.map

package/dist/tests/sync-manager.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-manager.test.d.ts","sourceRoot":"","sources":["../../src/tests/sync-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,CAAC"}

package/dist/tests/sync-manager.test.js

@@ -0,0 +1,65 @@
+import './setup';
+import { describe, it, expect, afterEach } from 'bun:test';
+import { SyncManager } from '../sync-manager.js';
+/**
+ * A client whose `get` answers the server's copy of a record — the only call the
+ * realtime handler makes.
+ */
+function fakeClient() {
+    return {
+        collection: () => ({ get: async (id) => ({ id, title: 'from server' }) }),
+    };
+}
+/** Stands in for `ZveltioRealtime`; `push` delivers a frame as the socket would. */
+function fakeRealtime() {
+    let handler;
+    return {
+        subscribe: (_collection, cb) => {
+            handler = cb;
+            return () => { };
+        },
+        disconnect: () => { },
+        push: async (msg) => handler?.(msg),
+    };
+}
+let sync;
+afterEach(async () => {
+    await sync?.stop();
+    sync = undefined;
+});
+describe('SyncManager — realtime frames as the engine sends them', () => {
+    // The frame shape is `broadcastEvent` in packages/engine/src/routes/ws.ts.
+    // The handler used to wait for `record.created` / `record_id`, names the
+    // socket never sends, so no server push ever reached the local store.
+    it('applies an insert and drops a delete without queueing one back', async () => {
+        sync = new SyncManager(fakeClient(), { syncInterval: 60_000 });
+        await sync.start();
+        const store = sync.store;
+        await store.clear();
+        const rt = fakeRealtime();
+        sync.realtime = rt;
+        let latest = [];
+        sync.collection('posts').subscribe((records) => {
+            latest = records;
+        });
+        await rt.push({ type: 'event', collection: 'posts', event: 'insert', data: { id: 'p1' } });
+        expect((await store.get('posts', 'p1'))?.data).toMatchObject({ title: 'from server' });
+        expect(latest.map((r) => r.id)).toEqual(['p1']);
+        await rt.push({ type: 'event', collection: 'posts', event: 'delete', data: { id: 'p1' } });
+        expect(await store.get('posts', 'p1')).toBeUndefined();
+        // A queued delete here would send the server's own deletion back to it.
+        expect(await store.getPendingOps()).toEqual([]);
+    });
+});
+describe('SyncManager — stop() before start() settles', () => {
+    // A React effect cleanup (and StrictMode, on every mount in development) calls
+    // `stop()` while `start()` is still awaiting the store. `start()` then armed
+    // the sync interval anyway, and nothing was left to clear it.
+    it('leaves no timer armed', async () => {
+        sync = new SyncManager(fakeClient(), { syncInterval: 60_000 });
+        const starting = sync.start();
+        await sync.stop();
+        await starting;
+        expect(sync.syncTimer).toBeNull();
+    });
+});

package/dist/tests/with-test-db.test.d.ts

@@ -0,0 +1,2 @@
+import './setup';
+//# sourceMappingURL=with-test-db.test.d.ts.map

package/dist/tests/with-test-db.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-test-db.test.d.ts","sourceRoot":"","sources":["../../src/tests/with-test-db.test.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,CAAC"}

package/dist/tests/with-test-db.test.js

@@ -0,0 +1,57 @@
+import './setup';
+import { describe, it, expect } from 'bun:test';
+import { Kysely, PostgresAdapter, PostgresIntrospector, PostgresQueryCompiler, } from 'kysely';
+import { applyMigrationStrings } from '../testing/with-test-db.js';
+/**
+ * The harness other suites trust.
+ *
+ * A Zveltio migration keeps its rollback in the same file behind a `-- DOWN`
+ * marker, and the documented way to use this helper is to glob
+ * `engine/migrations/*.sql` and hand every file to it. Running the whole file
+ * creates the schema and then drops it again inside the same call.
+ */
+function recordingDb(sink) {
+    const connection = {
+        async executeQuery(compiled) {
+            sink.push(compiled.sql);
+            return { rows: [] };
+        },
+        async *streamQuery() { },
+    };
+    const driver = {
+        async init() { },
+        async acquireConnection() {
+            return connection;
+        },
+        async beginTransaction() { },
+        async commitTransaction() { },
+        async rollbackTransaction() { },
+        async releaseConnection() { },
+        async destroy() { },
+    };
+    return new Kysely({
+        dialect: {
+            createAdapter: () => new PostgresAdapter(),
+            createDriver: () => driver,
+            createIntrospector: (db) => new PostgresIntrospector(db),
+            createQueryCompiler: () => new PostgresQueryCompiler(),
+        },
+    });
+}
+describe('applyMigrationStrings', () => {
+    it('does not run the DOWN half of a migration', async () => {
+        const executed = [];
+        const db = recordingDb(executed);
+        await applyMigrationStrings(db, ['CREATE TABLE zvd_t (id TEXT);\n-- DOWN\nDROP TABLE zvd_t;']);
+        expect(executed.join('\n')).toContain('CREATE TABLE');
+        expect(executed.join('\n'), 'the rollback ran against the schema it had just created').not.toContain('DROP TABLE');
+        await db.destroy();
+    });
+    it('still runs every statement of a file with no DOWN section', async () => {
+        const executed = [];
+        const db = recordingDb(executed);
+        await applyMigrationStrings(db, ['CREATE TABLE a (id TEXT);\nCREATE TABLE b (id TEXT);']);
+        expect(executed).toHaveLength(2);
+        await db.destroy();
+    });
+});

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,GAAG;IACpC,OAAO,EAAE,CAAC,EAAE,CAAC;IACb,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,GAAG;IACpC,OAAO,EAAE,CAAC,EAAE,CAAC;IACb,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAGD,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAGD,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IAEnB,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/validate/index.d.ts

@@ -23,6 +23,7 @@
  *   - Building the Studio bundle. Too slow; pair with `zveltio extension build`
  *     which can call validate as a sub-step.
  */
+export { SHARED_MESSAGE_KEYS } from './shared-message-keys.js';
 export interface ValidationError {
     /** Stable machine-readable code (e.g. `MANIFEST_NAME_MISMATCH`). */
     code: string;
@@ -30,6 +31,8 @@ export interface ValidationError {
     message: string;
     /** Optional file path the error applies to, relative to the extension root. */
     file?: string;
+    /** `warning` items are surfaced but do NOT fail validation (`result.ok`). */
+    severity?: 'error' | 'warning';
 }
 export interface ValidationResult {
     ok: boolean;
@@ -79,6 +82,52 @@ export interface BundleSizeInput {
     bundleSizeKbMax?: number;
 }
 export declare function validateBundleSize(input: BundleSizeInput): ValidationError[];
+/** Read-only core endpoints a schema is legitimately allowed to call (relation
+ * pickers etc.). Keep this list tiny and read-only. */
+export declare const SDUI_SHARED_READ_ALLOWLIST: ReadonlySet<string>;
+/**
+ * Schema keys whose value is user-visible text.
+ *
+ * The host renders these through `t()`, which looks the string up in the
+ * message bundle and falls back to the literal. That fallback is why a typo is
+ * invisible at runtime: the user simply sees `auth.saml.ui.begin_certificate`
+ * rendered as a placeholder. Catching it here is the only place it is cheap.
+ */
+export declare const SDUI_I18N_SLOTS: readonly string[];
+export interface SduiValidationInput {
+    /** Parsed schema JSON (a PageSchema or SettingsSchema). */
+    schema: unknown;
+    /** Owning extension name, e.g. `finance/invoicing`. */
+    extName: string;
+    /** Route paths the extension's engine actually serves, relative to its mount
+     * (e.g. `['/invoices', '/invoices/:id/pay']`). The CLI extracts these from
+     * `engine/**` source; pass `undefined` to skip the path-existence check
+     * (foreign-namespace check still runs). */
+    providedRoutes?: string[];
+    /** Extension names this one declares as dependencies (manifest.dependencies).
+     * A schema may read a dependency's `/ext/<dep>/` routes (relation pickers),
+     * which is otherwise treated as foreign. */
+    dependencies?: string[];
+    /** Message keys this schema may resolve against: the extension's own
+     * `studio/messages/en.json` keys, unioned with `SHARED_MESSAGE_KEYS`.
+     * Omit to skip the i18n checks (endpoint checks still run). */
+    messageKeys?: Iterable<string>;
+    /** For diagnostics. */
+    file?: string;
+}
+export declare function validateSduiSchema(input: SduiValidationInput): ValidationError[];
+/** Extract route paths an extension serves from its engine source text.
+ *
+ * Heuristic over `.get/post/put/patch/delete('…')` and `.route('/prefix', …)`
+ * mounts. Nested Hono sub-apps (e.g. `app.route('/query', aiQueryRoutes)`) used
+ * to be invisible here, so schemas pointing at the real `/query/history` path
+ * failed `SDUI_ENDPOINT_UNKNOWN` while a wrong bare `/history` falsely passed.
+ *
+ * Mounts register `/prefix` and `/prefix/*`; matching allows any path under that
+ * prefix (see `isProvidedRoute`). Parsing each factory body is intentionally
+ * avoided — route handlers often contain regexes/`${…}` that defeat brace
+ * matching. */
+export declare function extractEngineRoutes(engineSourceTexts: string[]): string[];
 export interface ValidateExtensionInput {
     manifest: ManifestValidationInput;
     peerDeps: PeerDepsValidationInput;

package/dist/validate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AA+CD,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CA2DlF;AAID,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CAyC1F;AAID,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAkBD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,eAAe,EAAE,CAqCtF;AAID,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,EAAE,CAQhF;AAID,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,EAAE,CAY5E;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,UAAU,EAAE,yBAAyB,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,qEAAqE;IACrE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAiBjF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAmDD,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CA4DlF;AAID,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CAyC1F;AAID,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AA+KD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,eAAe,EAAE,CA+FtF;AAID,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,EAAE,CAQhF;AAID,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,EAAE,CAY5E;AAWD;uDACuD;AACvD,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAGzD,CAAC;AAcH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAW5C,CAAC;AAwHF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;+CAG2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;gDAE4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;mEAE+D;IAC/D,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,uBAAuB;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,eAAe,EAAE,CAuFhF;AAsBD;;;;;;;;;;eAUe;AACf,wBAAgB,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAoBzE;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,UAAU,EAAE,yBAAyB,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,qEAAqE;IACrE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAkBjF"}