backend-skeleton 1.0.0-beta.3 → 1.0.0-beta.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (54) hide show
  1. package/README.md +16 -7
  2. package/bin/bskel.mjs +499 -11
  3. package/contracts/completeness.mjs +21 -2
  4. package/contracts/emit.mjs +11 -0
  5. package/contracts/openapi.mjs +95 -0
  6. package/handles/_engine.mjs +3 -1
  7. package/handles/audit.mjs +83 -0
  8. package/handles/codec.mjs +11 -5
  9. package/handles/observe-schema-projection.mjs +92 -0
  10. package/handles/providers/java-spring/emit.mjs +57 -26
  11. package/handles/providers/java-spring/observe.mjs +93 -0
  12. package/handles/providers/java-spring/plan.mjs +20 -0
  13. package/handles/providers/java-spring/templates/ContractCheck.java.tmpl +129 -0
  14. package/handles/providers/java-spring/templates/ContractObservationAspect.java.tmpl +190 -0
  15. package/handles/providers/java-spring/templates/HandleCodec.java.tmpl +13 -5
  16. package/handles/providers/java-spring/templates/HandleController.java.tmpl +54 -20
  17. package/handles/providers/java-spring/templates/ObserveContract.java.tmpl +42 -0
  18. package/handles/providers/java-spring/templates/ObserveSchemaLoader.java.tmpl +134 -0
  19. package/handles/providers/java-spring/templates/ResourceResolver.java.tmpl +17 -1
  20. package/handles/providers/java-spring/templates/ResourceResolverPolicyStub.java.tmpl +54 -0
  21. package/handles/providers/java-spring/templates/ResourceResolverStub.java.tmpl +14 -11
  22. package/handles/providers/java-spring.mjs +2 -2
  23. package/handles/providers/python-fastapi/emit.mjs +52 -22
  24. package/handles/providers/python-fastapi/observe.mjs +96 -0
  25. package/handles/providers/python-fastapi/templates/codec.py.tmpl +9 -1
  26. package/handles/providers/python-fastapi/templates/contract_check.py.tmpl +112 -0
  27. package/handles/providers/python-fastapi/templates/observe_contract.py.tmpl +165 -0
  28. package/handles/providers/python-fastapi/templates/observed_schema.py.tmpl +105 -0
  29. package/handles/providers/python-fastapi/templates/resolver.py.tmpl +6 -8
  30. package/handles/providers/python-fastapi/templates/resolver_policy.py.tmpl +19 -0
  31. package/handles/providers/python-fastapi/templates/resolvers_init.py.tmpl +5 -0
  32. package/handles/providers/python-fastapi/templates/router.py.tmpl +43 -19
  33. package/handles/providers/typescript-express/templates/codec.ts.tmpl +10 -1
  34. package/lib/cli.mjs +71 -2
  35. package/lib/gate-definitions.mjs +20 -1
  36. package/lib/handles-manifest.mjs +10 -4
  37. package/lib/repo.mjs +56 -0
  38. package/package.json +1 -1
  39. package/scanners/adapters/_express-shared.mjs +17 -12
  40. package/scanners/adapters/generic-grep.mjs +5 -1
  41. package/scanners/adapters/java-spring.mjs +60 -14
  42. package/scanners/adapters/javascript-express.mjs +5 -1
  43. package/scanners/adapters/python-fastapi.mjs +17 -14
  44. package/scanners/adapters/typescript-express.mjs +6 -1
  45. package/scanners/registry.mjs +5 -2
  46. package/scanners/text-util.mjs +25 -0
  47. package/schemas/adapter.schema.json +6 -2
  48. package/schemas/conformance-report.schema.json +49 -0
  49. package/schemas/contract-resolution.schema.json +6 -1
  50. package/schemas/handles-plan.schema.json +1 -0
  51. package/schemas/observe-receipt.schema.json +32 -0
  52. package/stack/bootstrap/db-up.sh +52 -0
  53. package/stack/bootstrap/docker-compose.postgres.yml +18 -0
  54. package/stack/catalog/postgres-dev-db.yml +55 -0
package/README.md CHANGED
@@ -1,5 +1,10 @@
1
1
  # backend-skeleton
2
2
 
3
+ [![npm version](https://img.shields.io/npm/v/backend-skeleton.svg)](https://www.npmjs.com/package/backend-skeleton)
4
+ [![npm license](https://img.shields.io/npm/l/backend-skeleton.svg)](https://github.com/popixoxipop-collab/backend-skeleton/blob/main/LICENSE)
5
+ [![node](https://img.shields.io/node/v/backend-skeleton.svg)](https://www.npmjs.com/package/backend-skeleton)
6
+ [![GitHub release](https://img.shields.io/github/v/release/popixoxipop-collab/backend-skeleton?include_prereleases&label=release)](https://github.com/popixoxipop-collab/backend-skeleton/releases)
7
+
3
8
  Spec-driven backend scaffolding for brownfield (and greenfield) Java/Spring Boot, Python/FastAPI,
4
9
  and TypeScript/JavaScript Express repos: a brownfield-collision gate before any spec/plan step,
5
10
  feature_id-scoped machine-readable contracts, UUID-addressable field handles, and stack-choice
@@ -19,13 +24,17 @@ stable. Split by actual maturity, not by feature list:
19
24
  measured verification against a real production Spring Boot repo (see `DECISIONS.md`), plus a
20
25
  synthetic fixture corpus for every adapter, run in CI on every change.
21
26
  - **`handles`** (the UUID-addressable resolver/codec/router codegen) is functionally complete and
22
- tested the same way, but has never been deployed to a real production repo, and two named gaps
23
- stay open specifically because of that: generated `fetch()`/`patch()` paths never check
24
- `HandleRegistry` for revocation, and generated authorization is inferred from a single
25
- `@PreAuthorize(hasRole(...))` shape rather than a real policy contract. Both are tracked as `O3`
26
- and `O5` in `CATALOG.md`, explicitly deferred until handles are actually used somewhere real --
27
- treat `handles emit`'s output as a scaffold to finish by hand, not a production-ready subsystem,
28
- until that work lands.
27
+ tested the same way, but has never been deployed to a real production repo. Two gaps named in
28
+ earlier betas have since been partially closed: `O3` (opt-in `--enforce-registry`, checked
29
+ fetch/patch/recover against `HandleRegistry`, revocation-aware) and `O5` (fetch/patch now derive
30
+ independently correct roles instead of silently sharing one) are both implemented -- see
31
+ `DECISIONS.md`'s `D-handle-registry-enforcement`/`D-resolver-authorization-action-aware`. Real
32
+ gaps remain and are explicitly still open, not closed: registry enforcement is opt-in, off by
33
+ default; authorization inference still only recognizes a single `@PreAuthorize(hasRole(...))`
34
+ shape (`hasAuthority`, role lists, ownership/tenant policy are unaddressed); and Java/Python are
35
+ the only providers either applies to -- TypeScript Express has no persistent handle table at
36
+ all. Treat `handles emit`'s output as a scaffold to finish by hand, not a production-ready
37
+ subsystem, until a real deployment happens.
29
38
 
30
39
  Version numbers, install instructions, and a real feedback path will firm up as this gets used
31
40
  against more real repos.