@zveltio/sdk 3.0.0-beta.77 → 3.0.0-beta.79

package/dist/offline/index.js

@@ -9,51 +9,30 @@
  *     offline, applies on reconnect, handles conflicts. No external
  *     dependency beyond the SDK + engine.
  *
- *   - **`electric`** — Electric SQL replication. Postgres logical-
- *     replication slot → Electric service → client. Conflicts are
- *     resolved server-side via CRDTs Electric implements internally.
- *     Requires an Electric service running alongside Postgres + the
- *     engine routes from `routes/electric.ts` that mint short-lived
- *     JWTs the client uses to authenticate.
+ *   - **`electric`** — Electric 1.x shapes, served THROUGH the engine:
+ *     `GET {engineUrl}/api/electric/v1/shape?collection=…`. The engine decides
+ *     the table, rows and columns from the caller's grants, tenant, row rules
+ *     and column permissions, and proxies Electric's Shape protocol (initial
+ *     snapshot, then long-poll `live=true`). Read-only: writes go through the
+ *     data API, and Electric streams them back. Requires the engine's
+ *     ELECTRIC_URL + ELECTRIC_SECRET; the client never talks to Electric.
  *
- * Auth flow for the electric provider
- * -----------------------------------
- *   1. Provider calls `POST {engineUrl}/api/electric/auth` (with
- *      credentials; the engine reads the better-auth session).
- *   2. Engine returns `{ token, expiresAt, electricUrl }`.
- *   3. Provider opens a websocket to `${electricUrl}?token=<jwt>`.
- *   4. Before each token expires, the provider re-requests a fresh one
- *      (no user interaction).
- *
- * Pull/push semantics
- * -------------------
- * Electric replicates continuously over the websocket — there's no
- * explicit "pull" call. The provider's `pull()` is a no-op that returns
- * once the initial sync handshake completes. `push()` is the same: local
- * writes go through Electric's normal replication path automatically.
- * Both shims exist so the OfflineProvider interface stays uniform across
- * crdt/electric.
- *
- * Subscriptions
- * -------------
- * `subscribe('zvd_contacts', cb)` registers a callback fired whenever
- * Electric pushes a change for that table. The implementation uses the
- * websocket's `message` event with a routing table; one socket, many
- * subscriptions.
+ * `subscribe('contacts', cb)` keeps one live shape per collection and calls
+ * `cb` with every current row after each change. `pull()` brings each of
+ * `tables` up to date once.
  */
 export class ElectricNotConfigured extends Error {
     constructor(reason) {
         super(`Electric SQL provider is not configured: ${reason}. ` +
-            `Set provider: 'crdt' for the default sync path, or stand up an Electric ` +
-            `service and pass electricUrl. See docs/engine/offline-sync.md.`);
+            `Set provider: 'crdt' for the default sync path. See docs/engine/offline-sync.md.`);
         this.name = 'ElectricNotConfigured';
     }
 }
 export class ElectricUnavailable extends Error {
     constructor(reason) {
         super(`Electric SQL is unavailable: ${reason}. ` +
-            `The engine reported ELECTRIC_URL / ELECTRIC_AUTH_TOKEN are unset, or the ` +
-            `Electric service is down. Fall back to provider: 'crdt' or check the ops checklist.`);
+            `The engine refused the shape, reports ELECTRIC_URL / ELECTRIC_SECRET unset, or ` +
+            `the Electric service is down. Fall back to provider: 'crdt' or check the ops checklist.`);
         this.name = 'ElectricUnavailable';
     }
 }
@@ -62,11 +41,9 @@ export class ElectricUnavailable extends Error {
  *
  * For `crdt` (default): returns a thin adapter around `SyncManager`.
  *
- * For `electric`: returns the real Electric provider. Throws
- * `ElectricNotConfigured` synchronously when required config is missing
- * (no electricUrl AND no way to discover one), or `ElectricUnavailable`
- * lazily on the first network op when the engine reports Electric is
- * disabled.
+ * For `electric`: syncs `tables` once before resolving. Throws
+ * `ElectricNotConfigured` when there is no `fetch`, and `ElectricUnavailable`
+ * when the engine refuses a shape (401, 403, 409 with its reason, 503).
  */
 export async function createOfflineProvider(config) {
     const kind = config.provider ?? 'crdt';
@@ -141,131 +118,128 @@ async function makeElectricProvider(config) {
     if (typeof doFetch !== 'function') {
         throw new ElectricNotConfigured('no fetch implementation available — pass config.fetch');
     }
-    const WSCandidate = config.websocket ?? globalThis.WebSocket;
-    if (typeof WSCandidate !== 'function') {
-        throw new ElectricNotConfigured('no WebSocket implementation available — pass config.websocket');
-    }
-    const WS = WSCandidate;
-    // Mint the first token + figure out the Electric URL.
-    async function mintToken() {
-        const res = await doFetch(`${config.engineUrl}/api/electric/auth`, {
-            method: 'POST',
+    const shapes = new Map();
+    const subscribers = new Map();
+    const loops = new Map();
+    // The engine names collections; `zvd_contacts` is accepted for the old table spelling.
+    const nameOf = (table) => table.replace(/^zvd_/, '');
+    const notify = (name) => {
+        const rows = [...(shapes.get(name)?.rows.values() ?? [])];
+        for (const cb of subscribers.get(name) ?? [])
+            cb(rows);
+    };
+    /** One Shape-protocol request. Resolves true once the shape is up to date. */
+    async function step(name, live, signal) {
+        const st = shapes.get(name) ?? { rows: new Map(), offset: '-1' };
+        shapes.set(name, st);
+        const qs = new URLSearchParams({ collection: name, offset: st.offset });
+        if (st.handle)
+            qs.set('handle', st.handle);
+        if (live)
+            qs.set('live', 'true');
+        if (live && st.cursor)
+            qs.set('cursor', st.cursor);
+        const res = await doFetch(`${config.engineUrl}/api/electric/v1/shape?${qs}`, {
             credentials: 'include',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ tables: config.tables ?? [] }),
+            headers: config.headers,
+            signal,
         });
-        if (res.status === 401) {
-            throw new ElectricUnavailable('engine returned 401 — sign in before requesting Electric sync');
-        }
-        if (res.status === 503) {
+        if (!res.ok) {
             const body = (await res.json().catch(() => ({})));
-            throw new ElectricUnavailable(body.error ?? 'engine reports Electric is not configured');
+            if (res.status === 409 && body.code === 'electric.must_refetch') {
+                // The shape was rebuilt (a rule or grant changed): start over.
+                shapes.set(name, { rows: new Map(), offset: '-1' });
+                notify(name);
+                return false;
+            }
+            throw new ElectricUnavailable(`engine returned ${res.status}${body.code ? ` ${body.code}` : ''}: ` +
+                (body.detail ?? body.error ?? 'no detail'));
         }
-        if (!res.ok) {
-            throw new ElectricUnavailable(`engine returned ${res.status}`);
+        const messages = (await res.json());
+        st.offset = res.headers.get('electric-offset') ?? st.offset;
+        st.handle = res.headers.get('electric-handle') ?? st.handle;
+        st.cursor = res.headers.get('electric-cursor') ?? st.cursor;
+        let changed = false;
+        let upToDate = false;
+        for (const m of messages) {
+            if (m.headers.control === 'up-to-date')
+                upToDate = true;
+            if (!m.key)
+                continue;
+            changed = true;
+            if (m.headers.operation === 'delete')
+                st.rows.delete(m.key);
+            // An update carries only the changed columns.
+            else
+                st.rows.set(m.key, { ...st.rows.get(m.key), ...m.value });
         }
-        return (await res.json());
+        if (changed)
+            notify(name);
+        return upToDate;
     }
-    let auth = await mintToken();
-    const electricUrl = config.electricUrl ?? auth.electricUrl;
-    // Per-table subscription registry.
-    const subscribers = new Map();
-    // Token refresh — fire-and-forget background timer that mints a fresh
-    // token ~10s before the current one expires.
-    let refreshTimer = null;
-    function scheduleRefresh() {
-        if (refreshTimer)
-            clearTimeout(refreshTimer);
-        const delay = Math.max(1_000, auth.expiresAt - Date.now() - 10_000);
-        refreshTimer = setTimeout(async () => {
-            try {
-                auth = await mintToken();
-                scheduleRefresh();
-                // No need to reconnect — Electric accepts refreshed tokens via
-                // its in-band auth-update message. The full Electric driver
-                // would send `{ type: 'auth', token: auth.token }` over the
-                // socket. We emit it here so the server-side TLS is kept warm.
-                if (socket && socket.readyState === WS.OPEN) {
-                    socket.send(JSON.stringify({ type: 'auth', token: auth.token }));
+    async function syncOnce(name) {
+        for (let i = 0; i < 1000 && !(await step(name, false)); i++)
+            ;
+    }
+    function follow(name) {
+        if (loops.has(name))
+            return;
+        const ctl = new AbortController();
+        loops.set(name, ctl);
+        void (async () => {
+            let backoff = 1_000;
+            let upToDate = false;
+            while (!ctl.signal.aborted) {
+                try {
+                    upToDate = await step(name, upToDate, ctl.signal);
+                    backoff = 1_000;
+                }
+                catch (err) {
+                    if (ctl.signal.aborted)
+                        return;
+                    // A refusal (403, 409) stays a refusal until something changes; retry slowly.
+                    console.warn(`[offline:electric] ${name}:`, err.message);
+                    await new Promise((r) => setTimeout(r, backoff));
+                    backoff = Math.min(backoff * 2, 30_000);
                 }
             }
-            catch (err) {
-                console.warn('[offline:electric] token refresh failed:', err.message);
-            }
-        }, delay);
+        })();
     }
-    // Open the websocket. Electric's URL contract is
-    // `${baseUrl}?token=<jwt>`; we forward the URL the engine gave us.
-    let socket;
-    const handshake = new Promise((resolve, reject) => {
-        const url = `${electricUrl}${electricUrl.includes('?') ? '&' : '?'}token=${encodeURIComponent(auth.token)}`;
-        socket = new WS(url);
-        socket.addEventListener('open', () => {
-            resolve();
-            scheduleRefresh();
-        });
-        socket.addEventListener('error', (ev) => {
-            // The first error fires before `open`; treat it as a connect failure.
-            reject(new ElectricUnavailable(`websocket error: ${ev.message ?? 'unknown'}`));
-        });
-        socket.addEventListener('message', (ev) => {
-            let msg;
-            try {
-                msg = JSON.parse(ev.data);
-            }
-            catch {
-                return; // Electric sometimes sends binary heartbeats — skip parse errors.
-            }
-            if (msg.type === 'change' && msg.table && Array.isArray(msg.rows)) {
-                const subs = subscribers.get(msg.table);
-                if (subs)
-                    for (const cb of subs)
-                        cb(msg.rows);
-            }
-        });
-    });
-    await handshake;
-    return {
+    const provider = {
         kind: 'electric',
         async pull() {
-            // Electric is continuous-sync — `pull` is a no-op that exists for
-            // API parity with the CRDT path.
+            // A followed collection is already kept current by its live loop.
+            for (const t of config.tables ?? [])
+                if (!loops.has(nameOf(t)))
+                    await syncOnce(nameOf(t));
         },
         async push() {
-            // Same shape — local writes flow through replication automatically.
-            return 0;
+            throw new Error('The electric provider syncs reads only: write through the data API ' +
+                '(client.collection(name).create/update/delete); Electric streams the change back.');
         },
         subscribe(table, cb) {
-            let set = subscribers.get(table);
-            if (!set) {
-                set = new Set();
-                subscribers.set(table, set);
-                // Tell Electric we're interested in this table — the protocol
-                // is documented in Electric's docs as `{ type: 'subscribe', table }`.
-                if (socket.readyState === WS.OPEN) {
-                    socket.send(JSON.stringify({ type: 'subscribe', table }));
-                }
-            }
+            const name = nameOf(table);
+            const set = subscribers.get(name) ?? new Set();
+            subscribers.set(name, set);
             set.add(cb);
+            follow(name);
             return () => {
                 set.delete(cb);
                 if (set.size === 0) {
-                    subscribers.delete(table);
-                    if (socket.readyState === WS.OPEN) {
-                        socket.send(JSON.stringify({ type: 'unsubscribe', table }));
-                    }
+                    subscribers.delete(name);
+                    loops.get(name)?.abort();
+                    loops.delete(name);
                 }
             };
         },
         async close() {
-            if (refreshTimer) {
-                clearTimeout(refreshTimer);
-                refreshTimer = null;
-            }
-            if (socket.readyState === WS.OPEN || socket.readyState === WS.CONNECTING) {
-                socket.close();
-            }
+            for (const ctl of loops.values())
+                ctl.abort();
+            loops.clear();
             subscribers.clear();
         },
     };
+    // Fail at creation, as the token mint did, when the engine refuses.
+    await provider.pull();
+    return provider;
 }

package/dist/schema-codegen.d.ts

@@ -59,4 +59,26 @@ export interface CodegenOptions {
  * `<extension>/.zveltio/db.d.ts`).
  */
 export declare function emitTypeScript(schema: ParsedSchema, opts?: CodegenOptions): string;
+/**
+ * TypeScript input type of each core field type. The engine registers the same
+ * types in `field-types/index.ts`; a unit test there keeps the two equal.
+ */
+export declare const CORE_FIELD_TS_TYPES: Readonly<Record<string, string>>;
+export interface CollectionShape {
+    name: string;
+    fields: {
+        name: string;
+        type: string;
+        required?: boolean;
+    }[];
+}
+/** A type `tsTypeOf` does not know is `any`. */
+export declare function emitCollectionTypes(collection: CollectionShape, tsTypeOf?: (type: string) => string | undefined): string;
+/** The whole `zveltio.d.ts`. */
+export declare function emitCollectionTypesFile(collections: CollectionShape[], tsTypeOf?: (type: string) => string | undefined): string;
+/**
+ * The collections of a schema directory, as `{ path: content }` (the shape
+ * `zveltio schema pull` writes), in name order.
+ */
+export declare function collectionsFromSchemaFiles(files: Record<string, string>): CollectionShape[];
 //# sourceMappingURL=schema-codegen.d.ts.map

package/dist/schema-codegen.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-codegen.d.ts","sourceRoot":"","sources":["../src/schema-codegen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAoND;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BtD;AA6BD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CAoE7D;AAID,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CA0BtF"}
+{"version":3,"file":"schema-codegen.d.ts","sourceRoot":"","sources":["../src/schema-codegen.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;CACjB;AAoND;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CA+BtD;AA6BD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,YAAY,CAoE7D;AAID,MAAM,WAAW,cAAc;IAC7B,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CA0BtF;AAaD;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAuDhE,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;CAC9D;AAED,gDAAgD;AAChD,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,eAAe,EAC3B,QAAQ,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAyC,GAC7E,MAAM,CAeR;AAED,gCAAgC;AAChC,wBAAgB,uBAAuB,CACrC,WAAW,EAAE,eAAe,EAAE,EAC9B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,GAC9C,MAAM,CAGR;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,eAAe,EAAE,CAQ3F"}

package/dist/schema-codegen.js

@@ -401,3 +401,103 @@ export function emitTypeScript(schema, opts = {}) {
 function quoteIdentifierIfNeeded(name) {
     return /^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name) ? name : `'${name.replace(/'/g, "\\'")}'`;
 }
+// ── Collection types (RFC schema-as-code §8) ─────────────────────────────────
+//
+// One generator for both `zveltio generate-types` paths: the engine's
+// `/api/admin/types` (which knows every registered field type, extensions'
+// included) and `--from schema/` (no engine; core types only). Same fields in,
+// same text out.
+/**
+ * TypeScript input type of each core field type. The engine registers the same
+ * types in `field-types/index.ts`; a unit test there keeps the two equal.
+ */
+export const CORE_FIELD_TS_TYPES = {
+    text: 'string',
+    number: 'number',
+    boolean: 'boolean',
+    date: 'string',
+    datetime: 'string',
+    email: 'string',
+    url: 'string',
+    uuid: 'string',
+    json: 'Record<string, any>',
+    richtext: 'string',
+    file: '{ url: string; name: string; size: number; type: string }',
+    enum: 'string',
+    reference: 'string',
+    m2o: 'string',
+    location: '{ lat: number; lng: number }',
+    computed: 'never',
+    integer: 'number',
+    float: 'number',
+    textarea: 'string',
+    password: 'string',
+    slug: 'string',
+    color: 'string',
+    phone: 'string',
+    tags: 'string[]',
+    image: '{ url: string; name: string; size: number; width?: number; height?: number; alt?: string }',
+    o2m: 'string[]',
+    m2m: 'string[]',
+    m2a: '{ collection: string; id: string }[]',
+    geometry: '{ type: string; coordinates: any }',
+    vector: 'number[]',
+    smallint: 'number',
+    real: 'number',
+    decimal: 'number',
+    money: 'number',
+    varchar: 'string',
+    char: 'string',
+    time: 'string',
+    timetz: 'string',
+    interval: 'string',
+    bytea: 'string',
+    tsvector: 'string',
+    inet: 'string',
+    cidr: 'string',
+    macaddr: 'string',
+    xml: 'string',
+    bit: 'string',
+    varbit: 'string',
+    int4range: '{ lower: number; upper: number }',
+    int8range: '{ lower: number; upper: number }',
+    numrange: '{ lower: number; upper: number }',
+    daterange: '{ lower: string; upper: string }',
+    tsrange: '{ lower: string; upper: string }',
+    tstzrange: '{ lower: string; upper: string }',
+};
+/** A type `tsTypeOf` does not know is `any`. */
+export function emitCollectionTypes(collection, tsTypeOf = (t) => CORE_FIELD_TS_TYPES[t]) {
+    const typeName = collection.name.charAt(0).toUpperCase() + collection.name.slice(1);
+    const inputFields = collection.fields
+        .map((f) => `  ${f.name}${f.required ? '' : '?'}: ${tsTypeOf(f.type) || 'any'};`)
+        .join('\n');
+    return `export interface ${typeName}Input {
+${inputFields}
+}
+
+export interface ${typeName} extends ${typeName}Input {
+  id: string;
+  created_at: string;
+  updated_at: string;
+  status: string;
+}`;
+}
+/** The whole `zveltio.d.ts`. */
+export function emitCollectionTypesFile(collections, tsTypeOf) {
+    const types = collections.map((c) => emitCollectionTypes(c, tsTypeOf)).join('\n\n');
+    return `// Auto-generated by Zveltio\n// Do not edit manually\n\n${types}`;
+}
+/**
+ * The collections of a schema directory, as `{ path: content }` (the shape
+ * `zveltio schema pull` writes), in name order.
+ */
+export function collectionsFromSchemaFiles(files) {
+    return Object.keys(files)
+        .filter((p) => /^collections\/[^/]+\.json$/.test(p))
+        .sort()
+        .map((p) => {
+        const file = JSON.parse(files[p]);
+        return { name: file.name, fields: file.fields ?? [] };
+    });
+}

package/dist/testing/with-test-db.d.ts

@@ -26,7 +26,7 @@
  */
 import type { Kysely } from 'kysely';
 export interface WithTestDbOptions {
-    /** Postgres image. Default: `postgres:18-alpine`. */
+    /** Postgres image. Default: `pgvector/pgvector:pg18` (the image CI and docker-compose use). */
     image?: string;
     /** DB name to create. Default: `zveltio_test`. */
     database?: string;

package/dist/testing/with-test-db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-test-db.d.ts","sourceRoot":"","sources":["../../src/testing/with-test-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGrC,MAAM,WAAW,iBAAiB;IAChC,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,8DAA8D;IAE9D,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AA4BD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8E/E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAEhC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,EAE/D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED;;;;;;;;;;;GAWG;AAGH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhG;AAED;;;GAGG;AAGH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAStD;AAkBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuErD;AAGD,eAAO,MAAM,iBAAiB;;CAAsB,CAAC"}
+{"version":3,"file":"with-test-db.d.ts","sourceRoot":"","sources":["../../src/testing/with-test-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGrC,MAAM,WAAW,iBAAiB;IAChC,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kDAAkD;IAClD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,WAAW,MAAM;IACrB,8DAA8D;IAE9D,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChB,+CAA+C;IAC/C,gBAAgB,EAAE,MAAM,CAAC;IACzB,iEAAiE;IACjE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1B;AA4BD;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,MAAM,CAAC,CA8E/E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAEhC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,iBAAiB,EAE/D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED;;;;;;;;;;;GAWG;AAGH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhG;AAED;;;GAGG;AAGH,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAIzF;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAStD;AAkBD;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAuErD;AAGD,eAAO,MAAM,iBAAiB;;CAAsB,CAAC"}

package/dist/testing/with-test-db.js

@@ -55,7 +55,7 @@ async function loadKysely() {
  * pattern, prefer `withTestDb(fn)` below.
  */
 export async function startTestDb(opts = {}) {
-    const image = opts.image ?? 'postgres:18-alpine';
+    const image = opts.image ?? 'pgvector/pgvector:pg18';
     const database = opts.database ?? `zveltio_test_${Date.now()}_${Math.floor(Math.random() * 10_000)}`;
     const startupTimeoutMs = opts.startupTimeoutMs ?? 60_000;
     const tc = await loadPgContainer();

package/dist/tests/migration-parse.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=migration-parse.test.d.ts.map

package/dist/tests/migration-parse.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-parse.test.d.ts","sourceRoot":"","sources":["../../src/tests/migration-parse.test.ts"],"names":[],"mappings":""}

package/dist/tests/migration-parse.test.js

@@ -0,0 +1,17 @@
+import { describe, expect, it } from 'bun:test';
+import { parseMigrationSql } from '../validate/migration-parse.js';
+describe('parseMigrationSql', () => {
+    it('splits on a line that is exactly -- DOWN', () => {
+        expect(parseMigrationSql('CREATE TABLE a (id int);\n-- DOWN\nDROP TABLE a;')).toEqual({
+            up: 'CREATE TABLE a (id int);',
+            down: 'DROP TABLE a;',
+        });
+    });
+    it('does not end UP at a comment that only starts with -- DOWN', () => {
+        const raw = 'CREATE TABLE a (id int);\n-- DOWN: manual rollback required\nCREATE TABLE b (id int);';
+        expect(parseMigrationSql(raw)).toEqual({ up: raw, down: null });
+    });
+    it('accepts case and trailing spaces, like the engine', () => {
+        expect(parseMigrationSql('SELECT 1;\n--  down  \nSELECT 2;').down).toBe('SELECT 2;');
+    });
+});

package/dist/tests/validate-manifest-dependencies.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validate-manifest-dependencies.test.d.ts.map

package/dist/tests/validate-manifest-dependencies.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-manifest-dependencies.test.d.ts","sourceRoot":"","sources":["../../src/tests/validate-manifest-dependencies.test.ts"],"names":[],"mappings":""}

package/dist/tests/validate-manifest-dependencies.test.js

@@ -0,0 +1,27 @@
+// `zveltio extension validate` checks both dependency lists the broker reads.
+import { describe, expect, it } from 'bun:test';
+import { validateManifest } from '../validate/index.js';
+const base = {
+    name: 'a',
+    displayName: 'A',
+    category: 'custom',
+    description: 'd',
+    version: '1.0.0',
+};
+const codes = (extra) => validateManifest({ manifest: { ...base, ...extra } })
+    .filter((e) => e.code === 'MANIFEST_BAD_DEPENDENCY')
+    .map((e) => e.message);
+describe('manifest dependencies / optionalDependencies', () => {
+    it('accepts both lists', () => {
+        expect(codes({
+            dependencies: [{ name: 'crm', minVersion: '1.0.0' }],
+            optionalDependencies: [{ name: 'ai' }],
+        })).toEqual([]);
+    });
+    it('refuses a malformed entry, a bad minVersion and a name in both lists', () => {
+        expect(codes({ optionalDependencies: 'ai' })).toHaveLength(1);
+        expect(codes({ optionalDependencies: [{ minVersion: '1.0.0' }] })[0]).toContain('has no name');
+        expect(codes({ optionalDependencies: [{ name: 'ai', minVersion: 'x' }] })[0]).toContain('not semver');
+        expect(codes({ dependencies: [{ name: 'ai' }], optionalDependencies: [{ name: 'ai' }] })[0]).toContain('"ai" is listed in "dependencies" and "optionalDependencies"');
+    });
+});

package/dist/tests/validate-manifest-forward-credentials.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validate-manifest-forward-credentials.test.d.ts.map

package/dist/tests/validate-manifest-forward-credentials.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-manifest-forward-credentials.test.d.ts","sourceRoot":"","sources":["../../src/tests/validate-manifest-forward-credentials.test.ts"],"names":[],"mappings":""}

package/dist/tests/validate-manifest-forward-credentials.test.js

@@ -0,0 +1,22 @@
+// `zveltio extension validate` refuses the forwardCredentials the engine would refuse.
+import { describe, expect, it } from 'bun:test';
+import { validateManifest } from '../validate/index.js';
+const base = {
+    name: 'a',
+    displayName: 'A',
+    category: 'custom',
+    description: 'd',
+    version: '1.0.0',
+    publicRoutes: ['/scim/*'],
+};
+const errors = (forwardCredentials) => validateManifest({ manifest: { ...base, forwardCredentials } }).filter((e) => e.code === 'MANIFEST_BAD_FORWARD_CREDENTIALS');
+describe('manifest forwardCredentials', () => {
+    it('accepts a credential header on a public route', () => {
+        expect(errors({ '/scim/*': ['authorization'] })).toEqual([]);
+    });
+    it('refuses an unknown header, a non-public route and a non-object', () => {
+        expect(errors({ '/scim/*': ['stripe-signature'] })).toHaveLength(1);
+        expect(errors({ '/admin/*': ['cookie'] })).toHaveLength(1);
+        expect(errors(['authorization'])).toHaveLength(1);
+    });
+});

package/dist/validate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAmDD,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CA2ElF;AAID,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CAyC1F;AAID,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AA+KD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,eAAe,EAAE,CA+FtF;AAID,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,EAAE,CAQhF;AAID,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,EAAE,CAY5E;AAWD;uDACuD;AACvD,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAGzD,CAAC;AAcH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAW5C,CAAC;AAwHF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;+CAG2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;gDAE4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;mEAE+D;IAC/D,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,uBAAuB;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,eAAe,EAAE,CAuFhF;AAsBD;;;;;;;;;;eAUe;AACf,wBAAgB,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAoBzE;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,UAAU,EAAE,yBAAyB,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,qEAAqE;IACrE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAkBjF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/validate/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAK/D,MAAM,WAAW,eAAe;IAC9B,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,oDAAoD;IACpD,KAAK,EAAE;QACL,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAmDD,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CAmJlF;AAID,MAAM,WAAW,uBAAuB;IACtC,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IACrD,iFAAiF;IACjF,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CACtC;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,uBAAuB,GAAG,eAAe,EAAE,CAyC1F;AAID,MAAM,WAAW,yBAAyB;IACxC,2EAA2E;IAC3E,KAAK,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,qFAAqF;IACrF,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AA+KD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,GAAG,eAAe,EAAE,CA+FtF;AAID,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,EAAE,CAQhF;AAID,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,wCAAwC;IACxC,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAID,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,eAAe,EAAE,CAY5E;AAWD;uDACuD;AACvD,eAAO,MAAM,0BAA0B,EAAE,WAAW,CAAC,MAAM,CAGzD,CAAC;AAcH;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAW5C,CAAC;AAwHF,MAAM,WAAW,mBAAmB;IAClC,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;+CAG2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;gDAE4C;IAC5C,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB;;mEAE+D;IAC/D,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,uBAAuB;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,mBAAmB,GAAG,eAAe,EAAE,CAuFhF;AAsBD;;;;;;;;;;eAUe;AACf,wBAAgB,mBAAmB,CAAC,iBAAiB,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAoBzE;AAID,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,QAAQ,EAAE,uBAAuB,CAAC;IAClC,UAAU,EAAE,yBAAyB,CAAC;IACtC,YAAY,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B,qEAAqE;IACrE,KAAK,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,gBAAgB,CAkBjF"}