@zveltio/sdk 3.0.0-beta.5 → 3.0.0-beta.70

package/dist/tests/realtime.test.js

@@ -0,0 +1,284 @@
+import { describe, it, expect, afterEach, jest, spyOn } from 'bun:test';
+import { rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { RealtimeClient } from '../client/RealtimeClient.js';
+import { ZveltioClient } from '../client/ZveltioClient.js';
+import { ZveltioRealtime } from '../realtime.js';
+import { watchSchema } from '../schema-watcher.js';
+const RealWebSocket = globalThis.WebSocket;
+afterEach(() => {
+    globalThis.WebSocket = RealWebSocket;
+});
+/** Records the constructor arguments instead of dialling out. */
+function captureSockets() {
+    const calls = [];
+    globalThis.WebSocket = class {
+        static OPEN = 1;
+        readyState = 0;
+        constructor(...args) {
+            calls.push(args);
+        }
+        close() { }
+        send() { }
+    };
+    return calls;
+}
+describe('ZveltioRealtime upgrade headers', () => {
+    // `/api/ws` accepts an API key in `X-API-Key`; a server-side client had no
+    // way to send one, so it could read a collection over REST and never
+    // subscribe to it.
+    it('passes headers to the socket when given', () => {
+        const calls = captureSockets();
+        const rt = new ZveltioRealtime('https://engine.test', { headers: { 'X-API-Key': 'zvk_x' } });
+        rt.connect();
+        expect(calls[0]).toEqual(['wss://engine.test/api/ws', { headers: { 'X-API-Key': 'zvk_x' } }]);
+        rt.disconnect();
+    });
+    it('uses the one-argument constructor without them', () => {
+        const calls = captureSockets();
+        const rt = new ZveltioRealtime('http://engine.test');
+        rt.connect();
+        expect(calls[0]).toEqual(['ws://engine.test/api/ws']);
+        rt.disconnect();
+    });
+});
+/** Fake sockets that record themselves, so a test can open or close one. */
+function fakeSockets() {
+    const made = [];
+    globalThis.WebSocket = class {
+        static CONNECTING = 0;
+        static OPEN = 1;
+        readyState = 0;
+        sent = [];
+        args;
+        onopen;
+        onclose;
+        constructor(...args) {
+            this.args = args;
+            made.push(this);
+        }
+        close() { }
+        send(p) {
+            this.sent.push(p);
+        }
+    };
+    return made;
+}
+/** Close a fake socket as the runtime does: CLOSED first, then the event. */
+function closeWith(ws, code) {
+    ws.readyState = 3;
+    ws.onclose?.({ code });
+}
+/** Drive a fake socket to OPEN, as the engine accepting the upgrade would. */
+function accept(ws) {
+    ws.readyState = 1;
+    ws.onopen?.();
+}
+describe('a socket the engine closed for revoked credentials', () => {
+    // The engine closes with 4001 when the session or key is revoked, and every
+    // reconnect is then refused with 401 — retrying only hammered the engine.
+    afterEach(() => jest.useRealTimers());
+    it('ZveltioRealtime stops reconnecting on 4001 and says so', () => {
+        jest.useFakeTimers();
+        const made = fakeSockets();
+        const rt = new ZveltioRealtime('http://engine.test');
+        let told = 0;
+        rt.onUnauthorized(() => told++);
+        rt.connect();
+        closeWith(made[0], 4001);
+        jest.advanceTimersByTime(60_000);
+        expect(made).toHaveLength(1);
+        expect(told).toBe(1);
+        rt.disconnect();
+    });
+    it('ZveltioRealtime still reconnects on any other close', () => {
+        jest.useFakeTimers();
+        const made = fakeSockets();
+        const rt = new ZveltioRealtime('http://engine.test');
+        let told = 0;
+        rt.onUnauthorized(() => told++);
+        rt.connect();
+        closeWith(made[0], 1006);
+        jest.advanceTimersByTime(1_000);
+        expect(made).toHaveLength(2);
+        expect(told).toBe(0);
+        rt.disconnect();
+    });
+    it('RealtimeClient stops reconnecting on 4001 and says so', () => {
+        jest.useFakeTimers();
+        const made = fakeSockets();
+        const rt = new RealtimeClient('http://engine.test');
+        let told = 0;
+        rt.onUnauthorized(() => told++);
+        rt.connect();
+        closeWith(made[0], 4001);
+        jest.advanceTimersByTime(60_000);
+        expect(made).toHaveLength(1);
+        expect(told).toBe(1);
+        rt.disconnect();
+    });
+    it('RealtimeClient still reconnects on any other close', () => {
+        jest.useFakeTimers();
+        const made = fakeSockets();
+        const rt = new RealtimeClient('http://engine.test');
+        rt.connect();
+        closeWith(made[0], 1006);
+        jest.advanceTimersByTime(1_000);
+        expect(made).toHaveLength(2);
+        rt.disconnect();
+    });
+});
+describe('RealtimeClient after a revocation and while the engine refuses it', () => {
+    afterEach(() => jest.useRealTimers());
+    it('after 4001, subscribe() only records; an explicit connect() sends it', () => {
+        jest.useFakeTimers();
+        const made = fakeSockets();
+        const rt = new RealtimeClient('http://engine.test');
+        rt.connect();
+        closeWith(made[0], 4001);
+        // It used to dial again here, be refused with 401 (seen as 1006) and back
+        // off forever.
+        rt.subscribe('orders', '*', () => { });
+        jest.advanceTimersByTime(600_000);
+        expect(made).toHaveLength(1);
+        rt.connect(); // the app re-authenticated
+        expect(made).toHaveLength(2);
+        accept(made[1]);
+        expect(made[1].sent).toEqual([JSON.stringify({ type: 'subscribe', channel: 'orders:*' })]);
+        rt.disconnect();
+    });
+    it('stops after a bounded number of reconnects', () => {
+        jest.useFakeTimers();
+        const made = fakeSockets();
+        const rt = new RealtimeClient('http://engine.test');
+        rt.connect();
+        // A refused handshake: no runtime shows the 401, only a 1006/1002 close.
+        for (let i = 0; i < 20; i++) {
+            closeWith(made[made.length - 1], 1006);
+            jest.advanceTimersByTime(30_000);
+        }
+        expect(made).toHaveLength(11); // the first dial and ten retries
+        rt.disconnect();
+    });
+    it('sends its headers with the upgrade', () => {
+        const made = fakeSockets();
+        const rt = new RealtimeClient('https://engine.test', { headers: { 'X-API-Key': 'zvk_x' } });
+        rt.connect();
+        expect(made[0].args).toEqual([
+            'wss://engine.test/api/ws',
+            { headers: { 'X-API-Key': 'zvk_x' } },
+        ]);
+        rt.disconnect();
+    });
+    it('ZveltioClient sends its API key on the socket and reports a 4001 as unauthorized', () => {
+        const made = fakeSockets();
+        let told = 0;
+        const client = new ZveltioClient({
+            baseUrl: 'https://engine.test',
+            apiKey: 'zvk_y',
+            onUnauthorized: () => told++,
+        });
+        client.realtime.connect();
+        expect(made[0].args).toEqual([
+            'wss://engine.test/api/ws',
+            { headers: { 'X-API-Key': 'zvk_y' } },
+        ]);
+        closeWith(made[0], 4001);
+        expect(told).toBe(1);
+        client.realtime.disconnect();
+    });
+});
+describe('watchSchema', () => {
+    // It dialled the socket with no credentials, so the engine refused every
+    // upgrade (401) and the watcher reconnected every few seconds, forever.
+    it('sends its API key with the upgrade', async () => {
+        let upgradeKey;
+        const server = Bun.serve({
+            port: 0,
+            fetch(req, srv) {
+                const url = new URL(req.url);
+                if (url.pathname === '/api/collections')
+                    return Response.json({ collections: [] });
+                if (url.pathname === '/api/ws') {
+                    upgradeKey = req.headers.get('x-api-key');
+                    if (upgradeKey !== 'zvk_watch')
+                        return new Response('Unauthorized', { status: 401 });
+                    return srv.upgrade(req) ? undefined : new Response('no upgrade', { status: 426 });
+                }
+                return new Response('not found', { status: 404 });
+            },
+            websocket: { message() { } },
+        });
+        const out = `${tmpdir()}/zveltio-watch-${Date.now()}.d.ts`;
+        const log = spyOn(console, 'log').mockImplementation(() => { });
+        const stop = await watchSchema(`http://127.0.0.1:${server.port}`, out, { apiKey: 'zvk_watch' });
+        try {
+            for (let i = 0; i < 100 && upgradeKey === undefined; i++)
+                await Bun.sleep(10);
+            expect(upgradeKey).toBe('zvk_watch');
+            for (let i = 0; i < 100 && !log.mock.calls.some((c) => String(c[0]).includes('connected')); i++) {
+                await Bun.sleep(10);
+            }
+            expect(log.mock.calls.some((c) => String(c[0]).includes('Schema watcher connected'))).toBe(true);
+        }
+        finally {
+            stop();
+            log.mockRestore();
+            server.stop(true);
+            await rm(out, { force: true });
+        }
+    });
+    // The engine publishes schema changes on `$schema` as `schema:changed`, to a
+    // schema admin's session only — so the watcher must be able to send one.
+    it('regenerates on a schema:changed event, and reports a refused subscribe', async () => {
+        let upgradeCookie = null;
+        const subscribed = [];
+        const server = Bun.serve({
+            port: 0,
+            fetch(req, srv) {
+                const url = new URL(req.url);
+                if (url.pathname === '/api/collections')
+                    return Response.json({ collections: [] });
+                if (url.pathname === '/api/ws') {
+                    upgradeCookie = req.headers.get('cookie');
+                    return srv.upgrade(req) ? undefined : new Response('no upgrade', { status: 426 });
+                }
+                return new Response('not found', { status: 404 });
+            },
+            websocket: {
+                message(ws, raw) {
+                    const msg = JSON.parse(String(raw));
+                    subscribed.push(msg);
+                    if (msg.channel !== '$schema')
+                        return;
+                    ws.send(JSON.stringify({ type: 'subscribed', channel: '$schema' }));
+                    ws.send(JSON.stringify({ type: 'schema:changed', collection: 'orders', action: 'alter' }));
+                    ws.send(JSON.stringify({ type: 'error', message: 'No read permission for "$schema"' }));
+                },
+            },
+        });
+        const out = `${tmpdir()}/zveltio-watch-evt-${Date.now()}.d.ts`;
+        const log = spyOn(console, 'log').mockImplementation(() => { });
+        let updates = 0;
+        const errors = [];
+        const stop = await watchSchema(`http://127.0.0.1:${server.port}`, out, {
+            headers: { cookie: 'session=abc' },
+            onUpdate: () => updates++,
+            onError: (e) => errors.push(e.message),
+        });
+        try {
+            for (let i = 0; i < 200 && (updates < 2 || errors.length === 0); i++)
+                await Bun.sleep(10);
+            expect(upgradeCookie).toBe('session=abc');
+            expect(subscribed).toEqual([{ type: 'subscribe', channel: '$schema' }]);
+            expect(updates).toBe(2); // the initial generation, then the event
+            expect(errors).toEqual(['Schema watcher: No read permission for "$schema"']);
+        }
+        finally {
+            stop();
+            log.mockRestore();
+            server.stop(true);
+            await rm(out, { force: true });
+        }
+    });
+});

package/dist/tests/sync-manager.test.d.ts

@@ -0,0 +1,2 @@
+import './setup';
+//# sourceMappingURL=sync-manager.test.d.ts.map

package/dist/tests/sync-manager.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-manager.test.d.ts","sourceRoot":"","sources":["../../src/tests/sync-manager.test.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,CAAC"}

package/dist/tests/sync-manager.test.js

@@ -0,0 +1,65 @@
+import './setup';
+import { describe, it, expect, afterEach } from 'bun:test';
+import { SyncManager } from '../sync-manager.js';
+/**
+ * A client whose `get` answers the server's copy of a record — the only call the
+ * realtime handler makes.
+ */
+function fakeClient() {
+    return {
+        collection: () => ({ get: async (id) => ({ id, title: 'from server' }) }),
+    };
+}
+/** Stands in for `ZveltioRealtime`; `push` delivers a frame as the socket would. */
+function fakeRealtime() {
+    let handler;
+    return {
+        subscribe: (_collection, cb) => {
+            handler = cb;
+            return () => { };
+        },
+        disconnect: () => { },
+        push: async (msg) => handler?.(msg),
+    };
+}
+let sync;
+afterEach(async () => {
+    await sync?.stop();
+    sync = undefined;
+});
+describe('SyncManager — realtime frames as the engine sends them', () => {
+    // The frame shape is `broadcastEvent` in packages/engine/src/routes/ws.ts.
+    // The handler used to wait for `record.created` / `record_id`, names the
+    // socket never sends, so no server push ever reached the local store.
+    it('applies an insert and drops a delete without queueing one back', async () => {
+        sync = new SyncManager(fakeClient(), { syncInterval: 60_000 });
+        await sync.start();
+        const store = sync.store;
+        await store.clear();
+        const rt = fakeRealtime();
+        sync.realtime = rt;
+        let latest = [];
+        sync.collection('posts').subscribe((records) => {
+            latest = records;
+        });
+        await rt.push({ type: 'event', collection: 'posts', event: 'insert', data: { id: 'p1' } });
+        expect((await store.get('posts', 'p1'))?.data).toMatchObject({ title: 'from server' });
+        expect(latest.map((r) => r.id)).toEqual(['p1']);
+        await rt.push({ type: 'event', collection: 'posts', event: 'delete', data: { id: 'p1' } });
+        expect(await store.get('posts', 'p1')).toBeUndefined();
+        // A queued delete here would send the server's own deletion back to it.
+        expect(await store.getPendingOps()).toEqual([]);
+    });
+});
+describe('SyncManager — stop() before start() settles', () => {
+    // A React effect cleanup (and StrictMode, on every mount in development) calls
+    // `stop()` while `start()` is still awaiting the store. `start()` then armed
+    // the sync interval anyway, and nothing was left to clear it.
+    it('leaves no timer armed', async () => {
+        sync = new SyncManager(fakeClient(), { syncInterval: 60_000 });
+        const starting = sync.start();
+        await sync.stop();
+        await starting;
+        expect(sync.syncTimer).toBeNull();
+    });
+});

package/dist/tests/with-test-db.test.d.ts

@@ -0,0 +1,2 @@
+import './setup';
+//# sourceMappingURL=with-test-db.test.d.ts.map

package/dist/tests/with-test-db.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-test-db.test.d.ts","sourceRoot":"","sources":["../../src/tests/with-test-db.test.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,CAAC"}

package/dist/tests/with-test-db.test.js

@@ -0,0 +1,57 @@
+import './setup';
+import { describe, it, expect } from 'bun:test';
+import { Kysely, PostgresAdapter, PostgresIntrospector, PostgresQueryCompiler, } from 'kysely';
+import { applyMigrationStrings } from '../testing/with-test-db.js';
+/**
+ * The harness other suites trust.
+ *
+ * A Zveltio migration keeps its rollback in the same file behind a `-- DOWN`
+ * marker, and the documented way to use this helper is to glob
+ * `engine/migrations/*.sql` and hand every file to it. Running the whole file
+ * creates the schema and then drops it again inside the same call.
+ */
+function recordingDb(sink) {
+    const connection = {
+        async executeQuery(compiled) {
+            sink.push(compiled.sql);
+            return { rows: [] };
+        },
+        async *streamQuery() { },
+    };
+    const driver = {
+        async init() { },
+        async acquireConnection() {
+            return connection;
+        },
+        async beginTransaction() { },
+        async commitTransaction() { },
+        async rollbackTransaction() { },
+        async releaseConnection() { },
+        async destroy() { },
+    };
+    return new Kysely({
+        dialect: {
+            createAdapter: () => new PostgresAdapter(),
+            createDriver: () => driver,
+            createIntrospector: (db) => new PostgresIntrospector(db),
+            createQueryCompiler: () => new PostgresQueryCompiler(),
+        },
+    });
+}
+describe('applyMigrationStrings', () => {
+    it('does not run the DOWN half of a migration', async () => {
+        const executed = [];
+        const db = recordingDb(executed);
+        await applyMigrationStrings(db, ['CREATE TABLE zvd_t (id TEXT);\n-- DOWN\nDROP TABLE zvd_t;']);
+        expect(executed.join('\n')).toContain('CREATE TABLE');
+        expect(executed.join('\n'), 'the rollback ran against the schema it had just created').not.toContain('DROP TABLE');
+        await db.destroy();
+    });
+    it('still runs every statement of a file with no DOWN section', async () => {
+        const executed = [];
+        const db = recordingDb(executed);
+        await applyMigrationStrings(db, ['CREATE TABLE a (id TEXT);\nCREATE TABLE b (id TEXT);']);
+        expect(executed).toHaveLength(2);
+        await db.destroy();
+    });
+});

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,GAAG;IACpC,OAAO,EAAE,CAAC,EAAE,CAAC;IACb,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAEvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,GAAG;IACpC,OAAO,EAAE,CAAC,EAAE,CAAC;IACb,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;CACH;AAGD,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAGD,MAAM,WAAW,cAAc,CAAC,CAAC,GAAG,GAAG;IACrC,MAAM,EAAE,CAAC,CAAC;CACX;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IAEnB,IAAI,EAAE,GAAG,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/validate/index.d.ts

@@ -23,6 +23,7 @@
  *   - Building the Studio bundle. Too slow; pair with `zveltio extension build`
  *     which can call validate as a sub-step.
  */
+export { SHARED_MESSAGE_KEYS } from './shared-message-keys.js';
 export interface ValidationError {
     /** Stable machine-readable code (e.g. `MANIFEST_NAME_MISMATCH`). */
     code: string;
@@ -30,6 +31,8 @@ export interface ValidationError {
     message: string;
     /** Optional file path the error applies to, relative to the extension root. */
     file?: string;
+    /** `warning` items are surfaced but do NOT fail validation (`result.ok`). */
+    severity?: 'error' | 'warning';
 }
 export interface ValidationResult {
     ok: boolean;
@@ -79,6 +82,52 @@ export interface BundleSizeInput {
     bundleSizeKbMax?: number;
 }
 export declare function validateBundleSize(input: BundleSizeInput): ValidationError[];
+/** Read-only core endpoints a schema is legitimately allowed to call (relation
+ * pickers etc.). Keep this list tiny and read-only. */
+export declare const SDUI_SHARED_READ_ALLOWLIST: ReadonlySet<string>;
+/**
+ * Schema keys whose value is user-visible text.
+ *
+ * The host renders these through `t()`, which looks the string up in the
+ * message bundle and falls back to the literal. That fallback is why a typo is
+ * invisible at runtime: the user simply sees `auth.saml.ui.begin_certificate`
+ * rendered as a placeholder. Catching it here is the only place it is cheap.
+ */
+export declare const SDUI_I18N_SLOTS: readonly string[];
+export interface SduiValidationInput {
+    /** Parsed schema JSON (a PageSchema or SettingsSchema). */
+    schema: unknown;
+    /** Owning extension name, e.g. `finance/invoicing`. */
+    extName: string;
+    /** Route paths the extension's engine actually serves, relative to its mount
+     * (e.g. `['/invoices', '/invoices/:id/pay']`). The CLI extracts these from
+     * `engine/**` source; pass `undefined` to skip the path-existence check
+     * (foreign-namespace check still runs). */
+    providedRoutes?: string[];
+    /** Extension names this one declares as dependencies (manifest.dependencies).
+     * A schema may read a dependency's `/ext/<dep>/` routes (relation pickers),
+     * which is otherwise treated as foreign. */
+    dependencies?: string[];
+    /** Message keys this schema may resolve against: the extension's own
+     * `studio/messages/en.json` keys, unioned with `SHARED_MESSAGE_KEYS`.
+     * Omit to skip the i18n checks (endpoint checks still run). */
+    messageKeys?: Iterable<string>;
+    /** For diagnostics. */
+    file?: string;
+}
+export declare function validateSduiSchema(input: SduiValidationInput): ValidationError[];
+/** Extract route paths an extension serves from its engine source text.
+ *
+ * Heuristic over `.get/post/put/patch/delete('…')` and `.route('/prefix', …)`
+ * mounts. Nested Hono sub-apps (e.g. `app.route('/query', aiQueryRoutes)`) used
+ * to be invisible here, so schemas pointing at the real `/query/history` path
+ * failed `SDUI_ENDPOINT_UNKNOWN` while a wrong bare `/history` falsely passed.
+ *
+ * Mounts register `/prefix` and `/prefix/*`; matching allows any path under that
+ * prefix (see `isProvidedRoute`). Parsing each factory body is intentionally
+ * avoided — route handlers often contain regexes/`${…}` that defeat brace
+ * matching. */
+export declare function extractEngineRoutes(engineSourceTexts: string[]): string[];
 export interface ValidateExtensionInput {
     manifest: ManifestValidationInput;
     peerDeps: PeerDepsValidationInput;

package/dist/validate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AA+CD,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CA2DlF;AAID,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CAyC1F;AAID,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAkBD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,eAAe,EAAE,CAqCtF;AAID,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,EAAE,CAQhF;AAID,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,EAAE,CAY5E;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,UAAU,EAAE,yBAAyB,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,qEAAqE;IACrE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAiBjF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAmDD,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CA2ElF;AAID,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CAyC1F;AAID,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AA+KD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,eAAe,EAAE,CA+FtF;AAID,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,EAAE,CAQhF;AAID,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,EAAE,CAY5E;AAWD;uDACuD;AACvD,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAGzD,CAAC;AAcH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAW5C,CAAC;AAwHF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;+CAG2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;gDAE4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;mEAE+D;IAC/D,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,uBAAuB;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,eAAe,EAAE,CAuFhF;AAsBD;;;;;;;;;;eAUe;AACf,wBAAgB,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAoBzE;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,UAAU,EAAE,yBAAyB,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,qEAAqE;IACrE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAkBjF"}