canopycms 0.0.0

package/dist/api/groups.d.ts

@@ -0,0 +1,91 @@
+import { z } from 'zod';
+import type { ApiResponse } from './types';
+import type { CanopyGroupId } from '../types';
+import { type InternalGroup } from '../authorization';
+/** Response type for getting internal groups */
+export type InternalGroupsResponse = ApiResponse<{
+    groups: InternalGroup[];
+}>;
+/** Response type for updating internal groups */
+export type UpdateInternalGroupsResponse = ApiResponse<Record<string, never>>;
+/** Response type for searching external groups */
+export type ExternalGroupsResponse = ApiResponse<{
+    groups: ExternalGroup[];
+}>;
+/**
+ * Validate that an update to internal groups doesn't remove the last admin.
+ * Considers both internal Admins group members and bootstrap admins.
+ */
+export declare const validateAdminGroupUpdate: (newGroups: InternalGroup[], bootstrapAdminIds: Set<string>) => {
+    valid: boolean;
+    error?: string;
+};
+/**
+ * Validate that reserved groups are not deleted or renamed.
+ */
+export declare const validateReservedGroups: (newGroups: InternalGroup[]) => {
+    valid: boolean;
+    error?: string;
+};
+export interface UpdateInternalGroupsBody {
+    groups: InternalGroup[];
+}
+/**
+ * Search external groups (for group UI)
+ */
+export interface SearchExternalGroupsParams {
+    query: string;
+}
+export interface ExternalGroup {
+    id: CanopyGroupId;
+    name: string;
+}
+/**
+ * Exported routes for router registration
+ */
+export declare const GROUP_ROUTES: {
+    readonly getInternal: import("./route-builder").RouteDefinition<undefined, undefined, InternalGroupsResponse>;
+    readonly updateInternal: import("./route-builder").RouteDefinition<undefined, z.ZodObject<{
+        groups: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+            members: z.ZodArray<z.ZodString, "many">;
+        }, "strip", z.ZodTypeAny, {
+            name: string;
+            members: string[];
+            id: string;
+            description?: string | undefined;
+        }, {
+            name: string;
+            members: string[];
+            id: string;
+            description?: string | undefined;
+        }>, "many">;
+        expectedContentVersion: z.ZodOptional<z.ZodNumber>;
+    }, "strip", z.ZodTypeAny, {
+        groups: {
+            name: string;
+            members: string[];
+            id: string;
+            description?: string | undefined;
+        }[];
+        expectedContentVersion?: number | undefined;
+    }, {
+        groups: {
+            name: string;
+            members: string[];
+            id: string;
+            description?: string | undefined;
+        }[];
+        expectedContentVersion?: number | undefined;
+    }>, UpdateInternalGroupsResponse>;
+    readonly searchExternal: import("./route-builder").RouteDefinition<z.ZodObject<{
+        query: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        query: string;
+    }, {
+        query: string;
+    }>, undefined, ExternalGroupsResponse>;
+};
+//# sourceMappingURL=groups.d.ts.map

package/dist/api/groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.d.ts","sourceRoot":"","sources":["../../src/api/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAA0B,WAAW,EAAE,MAAM,SAAS,CAAA;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,kBAAkB,CAAA;AAKzB,gDAAgD;AAChD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAAA;AAE7E,iDAAiD;AACjD,MAAM,MAAM,4BAA4B,GAAG,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAA;AAE7E,kDAAkD;AAClD,MAAM,MAAM,sBAAsB,GAAG,WAAW,CAAC;IAAE,MAAM,EAAE,aAAa,EAAE,CAAA;CAAE,CAAC,CAAA;AAsB7E;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GACnC,WAAW,aAAa,EAAE,EAC1B,mBAAmB,GAAG,CAAC,MAAM,CAAC,KAC7B;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAwBlC,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,sBAAsB,GACjC,WAAW,aAAa,EAAE,KACzB;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAelC,CAAA;AAqCD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,aAAa,EAAE,CAAA;CACxB;AAwID;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,aAAa,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;CACb;AAoFD;;GAEG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAIf,CAAA"}

package/dist/api/groups.js

@@ -0,0 +1,270 @@
+import { z } from 'zod';
+import { loadInternalGroups, saveInternalGroups, loadGroupsFile, RESERVED_GROUPS, isReservedGroup, } from '../authorization';
+import { defineEndpoint } from './route-builder';
+import { getSettingsBranchContext, commitSettings } from './settings-helpers';
+import { generateId } from '../id';
+// ============================================================================
+// Zod Schemas for Validation
+// ============================================================================
+const internalGroupSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    description: z.string().optional(),
+    members: z.array(z.string()),
+});
+const updateInternalGroupsBodySchema = z.object({
+    groups: z.array(internalGroupSchema),
+    expectedContentVersion: z.number().optional(),
+});
+const searchExternalGroupsParamsSchema = z.object({
+    query: z.string(),
+});
+/**
+ * Validate that an update to internal groups doesn't remove the last admin.
+ * Considers both internal Admins group members and bootstrap admins.
+ */
+export const validateAdminGroupUpdate = (newGroups, bootstrapAdminIds) => {
+    // Find the Admins group in the new groups
+    const adminsGroup = newGroups.find((g) => g.id === RESERVED_GROUPS.ADMINS);
+    const adminMembersCount = adminsGroup?.members?.length ?? 0;
+    // Total admins = internal Admins group members + bootstrap admins (excluding overlap)
+    const internalAdmins = new Set(adminsGroup?.members ?? []);
+    let totalAdmins = adminMembersCount;
+    // Add bootstrap admins that aren't already in the internal group
+    for (const bootstrapId of bootstrapAdminIds) {
+        if (!internalAdmins.has(bootstrapId)) {
+            totalAdmins++;
+        }
+    }
+    if (totalAdmins === 0) {
+        return {
+            valid: false,
+            error: 'Cannot remove last admin - at least one admin is required',
+        };
+    }
+    return { valid: true };
+};
+/**
+ * Validate that reserved groups are not deleted or renamed.
+ */
+export const validateReservedGroups = (newGroups) => {
+    // Check if any reserved group IDs have been altered
+    for (const group of newGroups) {
+        if (isReservedGroup(group.id)) {
+            // Reserved group exists - make sure the name matches the ID
+            if (group.name !== group.id) {
+                return {
+                    valid: false,
+                    error: `Reserved group '${group.id}' cannot be renamed`,
+                };
+            }
+        }
+    }
+    return { valid: true };
+};
+/**
+ * Get internal groups (admin only)
+ */
+const getInternalGroupsHandler = async (_gc, ctx, _req) => {
+    try {
+        const result = await getSettingsBranchContext(ctx);
+        if ('error' in result) {
+            return { ok: false, status: result.status, error: result.error };
+        }
+        const { context, mode } = result;
+        const groups = await loadInternalGroups(context.branchRoot, mode, ctx.services.bootstrapAdminIds);
+        return {
+            ok: true,
+            status: 200,
+            data: { groups },
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            status: 500,
+            error: error instanceof Error ? error.message : 'Failed to load groups',
+        };
+    }
+};
+/**
+ * Update internal groups (admin only)
+ */
+const updateInternalGroupsHandler = async (_gc, ctx, req, body) => {
+    if (!body?.groups) {
+        return { ok: false, status: 400, error: 'groups array required' };
+    }
+    try {
+        const result = await getSettingsBranchContext(ctx);
+        if ('error' in result) {
+            return { ok: false, status: result.status, error: result.error };
+        }
+        const { context, mode } = result;
+        // Load current file to check version (optimistic locking)
+        const currentFile = await loadGroupsFile(context.branchRoot, mode);
+        // Check for version conflict if client sent expected version
+        if (body.expectedContentVersion !== undefined) {
+            const currentVersion = currentFile?.contentVersion ?? 0;
+            if (currentVersion !== body.expectedContentVersion) {
+                return {
+                    ok: false,
+                    status: 409,
+                    error: 'Groups were modified by another user. Please reload and try again.',
+                };
+            }
+        }
+        // Build map of existing group IDs
+        const existingGroups = await loadInternalGroups(context.branchRoot, mode, ctx.services.bootstrapAdminIds);
+        const existingById = new Set(existingGroups.map((g) => g.id));
+        // Process groups: generate IDs for new groups, keep IDs for existing groups
+        const processedGroups = body.groups.map((group) => {
+            // Existing group with valid ID - keep ID
+            if (group.id && group.id.trim() !== '' && existingById.has(group.id)) {
+                return group;
+            }
+            // Check if this is a reserved group (by ID or name)
+            if (isReservedGroup(group.id) || isReservedGroup(group.name)) {
+                // Reserved groups: ID = name (e.g., "Admins", "Reviewers")
+                return { ...group, id: group.name };
+            }
+            // New regular group (empty ID or not in existing set) - generate ID
+            return { ...group, id: generateId() };
+        });
+        // Validate no duplicate IDs
+        const idSet = new Set();
+        for (const group of processedGroups) {
+            if (idSet.has(group.id)) {
+                return {
+                    ok: false,
+                    status: 400,
+                    error: `Duplicate group ID detected: ${group.id}`,
+                };
+            }
+            idSet.add(group.id);
+        }
+        // Validate no duplicate names
+        const nameSet = new Set();
+        for (const group of processedGroups) {
+            const normalizedName = group.name.toLowerCase().trim();
+            if (nameSet.has(normalizedName)) {
+                return {
+                    ok: false,
+                    status: 400,
+                    error: `Duplicate group name detected: ${group.name}`,
+                };
+            }
+            nameSet.add(normalizedName);
+        }
+        // Validate reserved groups are not renamed (after ID generation)
+        const reservedValidation = validateReservedGroups(processedGroups);
+        if (!reservedValidation.valid) {
+            return { ok: false, status: 400, error: reservedValidation.error };
+        }
+        // Validate we're not removing the last admin (after ID generation)
+        const adminValidation = validateAdminGroupUpdate(processedGroups, ctx.services.bootstrapAdminIds);
+        if (!adminValidation.valid) {
+            return { ok: false, status: 400, error: adminValidation.error };
+        }
+        // Increment version when saving
+        const newContentVersion = (currentFile?.contentVersion ?? 0) + 1;
+        // Save file (uses mode-aware file path)
+        await saveInternalGroups(context.branchRoot, processedGroups, req.user.userId, mode, newContentVersion);
+        // Commit and push (mode-aware)
+        await commitSettings(ctx, {
+            context,
+            branchRoot: context.branchRoot,
+            fileName: 'groups.json',
+            message: 'Update internal groups',
+            mode,
+        });
+        return { ok: true, status: 200 };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            status: 500,
+            error: error instanceof Error ? error.message : 'Failed to save groups',
+        };
+    }
+};
+const searchExternalGroupsHandler = async (_gc, ctx, req, params) => {
+    const authPlugin = ctx.authPlugin;
+    if (!authPlugin || !authPlugin.searchExternalGroups) {
+        return {
+            ok: false,
+            status: 501,
+            error: 'External group search not configured',
+        };
+    }
+    try {
+        const groups = await authPlugin.searchExternalGroups(params.query);
+        return { ok: true, status: 200, data: { groups } };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            status: 500,
+            error: error instanceof Error ? error.message : 'External group search failed',
+        };
+    }
+};
+// ============================================================================
+// Route Definitions with defineEndpoint
+// ============================================================================
+/**
+ * Get internal groups
+ * GET /groups/internal
+ */
+const getInternal = defineEndpoint({
+    namespace: 'groups',
+    name: 'getInternal',
+    method: 'GET',
+    path: '/groups/internal',
+    responseType: 'InternalGroupsResponse',
+    response: {},
+    defaultMockData: { groups: [] },
+    guards: ['admin'],
+    handler: getInternalGroupsHandler,
+});
+/**
+ * Update internal groups
+ * PUT /groups/internal
+ */
+const updateInternal = defineEndpoint({
+    namespace: 'groups',
+    name: 'updateInternal',
+    method: 'PUT',
+    path: '/groups/internal',
+    body: updateInternalGroupsBodySchema,
+    bodyType: 'UpdateInternalGroupsBody',
+    responseType: 'UpdateInternalGroupsResponse',
+    response: {},
+    defaultMockData: {},
+    guards: ['admin'],
+    handler: updateInternalGroupsHandler,
+});
+/**
+ * Search external groups
+ * GET /groups/search?q=...
+ */
+const searchExternal = defineEndpoint({
+    namespace: 'groups',
+    name: 'searchExternal',
+    method: 'GET',
+    path: '/groups/search',
+    params: searchExternalGroupsParamsSchema,
+    responseType: 'ExternalGroupsResponse',
+    response: {},
+    defaultMockData: { groups: [] },
+    guards: ['admin'],
+    handler: searchExternalGroupsHandler,
+});
+/**
+ * Exported routes for router registration
+ */
+export const GROUP_ROUTES = {
+    getInternal,
+    updateInternal,
+    searchExternal,
+};
+//# sourceMappingURL=groups.js.map

package/dist/api/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../src/api/groups.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,OAAO,EAEL,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,eAAe,GAChB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,wBAAwB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAA;AAWlC,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACpC,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAA;AAEF,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACtC,SAA0B,EAC1B,iBAA8B,EACM,EAAE;IACtC,0CAA0C;IAC1C,MAAM,WAAW,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,MAAM,CAAC,CAAA;IAC1E,MAAM,iBAAiB,GAAG,WAAW,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC,CAAA;IAE3D,sFAAsF;IACtF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,OAAO,IAAI,EAAE,CAAC,CAAA;IAC1D,IAAI,WAAW,GAAG,iBAAiB,CAAA;IAEnC,iEAAiE;IACjE,KAAK,MAAM,WAAW,IAAI,iBAAiB,EAAE,CAAC;QAC5C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACrC,WAAW,EAAE,CAAA;QACf,CAAC;IACH,CAAC;IAED,IAAI,WAAW,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,2DAA2D;SACnE,CAAA;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CACpC,SAA0B,EACU,EAAE;IACtC,oDAAoD;IACpD,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAC9B,4DAA4D;YAC5D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;gBAC5B,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,KAAK,EAAE,mBAAmB,KAAK,CAAC,EAAE,qBAAqB;iBACxD,CAAA;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;AACxB,CAAC,CAAA;AAED;;GAEG;AACH,MAAM,wBAAwB,GAAG,KAAK,EACpC,GAA0B,EAC1B,GAAe,EACf,IAAgB,EACiB,EAAE;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;QAClD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QAClE,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;QAChC,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,OAAO,CAAC,UAAU,EAClB,IAAI,EACJ,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAC/B,CAAA;QAED,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;SACxE,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAMD;;GAEG;AACH,MAAM,2BAA2B,GAAG,KAAK,EACvC,GAA0B,EAC1B,GAAe,EACf,GAAe,EACf,IAAoD,EACb,EAAE;IACzC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAA;IACnE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,GAAG,CAAC,CAAA;QAClD,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;YACtB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAA;QAClE,CAAC;QAED,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAA;QAEhC,0DAA0D;QAC1D,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAElE,6DAA6D;QAC7D,IAAI,IAAI,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,cAAc,GAAG,WAAW,EAAE,cAAc,IAAI,CAAC,CAAA;YACvD,IAAI,cAAc,KAAK,IAAI,CAAC,sBAAsB,EAAE,CAAC;gBACnD,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,oEAAoE;iBAC5E,CAAA;YACH,CAAC;QACH,CAAC;QAED,kCAAkC;QAClC,MAAM,cAAc,GAAG,MAAM,kBAAkB,CAC7C,OAAO,CAAC,UAAU,EAClB,IAAI,EACJ,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAC/B,CAAA;QACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QAE7D,4EAA4E;QAC5E,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAChD,yCAAyC;YACzC,IAAI,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACrE,OAAO,KAAK,CAAA;YACd,CAAC;YAED,oDAAoD;YACpD,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC7D,2DAA2D;gBAC3D,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,KAAK,CAAC,IAAqB,EAAE,CAAA;YACtD,CAAC;YAED,oEAAoE;YACpE,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,UAAU,EAAmB,EAAE,CAAA;QACxD,CAAC,CAAC,CAAA;QAEF,4BAA4B;QAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;QAC/B,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;gBACxB,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,gCAAgC,KAAK,CAAC,EAAE,EAAE;iBAClD,CAAA;YACH,CAAC;YACD,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACrB,CAAC;QAED,8BAA8B;QAC9B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAA;QACjC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;YACpC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;YACtD,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChC,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,kCAAkC,KAAK,CAAC,IAAI,EAAE;iBACtD,CAAA;YACH,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC7B,CAAC;QAED,iEAAiE;QACjE,MAAM,kBAAkB,GAAG,sBAAsB,CAAC,eAAe,CAAC,CAAA;QAClE,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,CAAC,KAAK,EAAE,CAAA;QACpE,CAAC;QAED,mEAAmE;QACnE,MAAM,eAAe,GAAG,wBAAwB,CAC9C,eAAe,EACf,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAC/B,CAAA;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,EAAE,CAAA;QACjE,CAAC;QAED,gCAAgC;QAChC,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QAEhE,wCAAwC;QACxC,MAAM,kBAAkB,CACtB,OAAO,CAAC,UAAU,EAClB,eAAe,EACf,GAAG,CAAC,IAAI,CAAC,MAAM,EACf,IAAI,EACJ,iBAAiB,CAClB,CAAA;QAED,+BAA+B;QAC/B,MAAM,cAAc,CAAC,GAAG,EAAE;YACxB,OAAO;YACP,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,wBAAwB;YACjC,IAAI;SACL,CAAC,CAAA;QAEF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,uBAAuB;SACxE,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAcD,MAAM,2BAA2B,GAAG,KAAK,EACvC,GAA0B,EAC1B,GAAe,EACf,GAAe,EACf,MAAwD,EACvB,EAAE;IACnC,MAAM,UAAU,GAAG,GAAG,CAAC,UAAU,CAAA;IACjC,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,oBAAoB,EAAE,CAAC;QACpD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,sCAAsC;SAC9C,CAAA;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAA;IACpD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG;YACX,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;SAC/E,CAAA;IACH,CAAC;AACH,CAAC,CAAA;AAED,+EAA+E;AAC/E,wCAAwC;AACxC,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,WAAW,GAAG,cAAc,CAAC;IACjC,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,aAAa;IACnB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,kBAAkB;IACxB,YAAY,EAAE,wBAAwB;IACtC,QAAQ,EAAE,EAA4B;IACtC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/B,MAAM,EAAE,CAAC,OAAO,CAAU;IAC1B,OAAO,EAAE,wBAAwB;CAClC,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,cAAc,GAAG,cAAc,CAAC;IACpC,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,kBAAkB;IACxB,IAAI,EAAE,8BAA8B;IACpC,QAAQ,EAAE,0BAA0B;IACpC,YAAY,EAAE,8BAA8B;IAC5C,QAAQ,EAAE,EAAkC;IAC5C,eAAe,EAAE,EAAE;IACnB,MAAM,EAAE,CAAC,OAAO,CAAU;IAC1B,OAAO,EAAE,2BAA2B;CACrC,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,cAAc,GAAG,cAAc,CAAC;IACpC,SAAS,EAAE,QAAQ;IACnB,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,gBAAgB;IACtB,MAAM,EAAE,gCAAgC;IACxC,YAAY,EAAE,wBAAwB;IACtC,QAAQ,EAAE,EAA4B;IACtC,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;IAC/B,MAAM,EAAE,CAAC,OAAO,CAAU;IAC1B,OAAO,EAAE,2BAA2B;CACrC,CAAC,CAAA;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,WAAW;IACX,cAAc;IACd,cAAc;CACN,CAAA"}

package/dist/api/guards.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Declarative guard system for API endpoints.
+ *
+ * Guards run before the handler and either:
+ * - Return an error response (404, 403, 500) to short-circuit
+ * - Produce a guard context (e.g., branch context with schema) for the handler
+ *
+ * Usage in defineEndpoint:
+ * ```ts
+ * defineEndpoint({
+ *   guards: ['branchAccessWithSchema'] as const,
+ *   handler: async (gc, ctx, req, params) => {
+ *     // gc.branchContext is guaranteed non-null with flatSchema
+ *   }
+ * })
+ * ```
+ */
+import type { BranchContext, BranchContextWithSchema } from '../types';
+import type { ApiContext, ApiRequest, ApiResponse } from './types';
+/** All available guard identifiers */
+export type GuardId = 'branch' | 'branchAccess' | 'schema' | 'branchAccessWithSchema' | 'admin' | 'reviewer' | 'privileged';
+/** Maps each guard ID to the context it contributes */
+export interface GuardContextMap {
+    branch: {
+        branchContext: BranchContext;
+    };
+    branchAccess: {
+        branchContext: BranchContext;
+    };
+    schema: {
+        branchContext: BranchContextWithSchema;
+    };
+    branchAccessWithSchema: {
+        branchContext: BranchContextWithSchema;
+    };
+    admin: Record<string, never>;
+    reviewer: Record<string, never>;
+    privileged: Record<string, never>;
+}
+/** Helper: convert union to intersection */
+type UnionToIntersection<U> = (U extends unknown ? (k: U) => void : never) extends (k: infer I) => void ? I : never;
+/** Compute the guard context type from a tuple of guard IDs */
+export type ComputeGuardContext<T extends readonly GuardId[]> = UnionToIntersection<GuardContextMap[T[number]]>;
+/** Result of executeGuards */
+export type ExecuteGuardsResult<T extends readonly GuardId[]> = {
+    ok: true;
+    guardContext: ComputeGuardContext<T>;
+} | {
+    ok: false;
+    response: ApiResponse<never>;
+};
+/**
+ * Execute a chain of guards in order.
+ * Returns the accumulated guard context on success, or the first error response on failure.
+ */
+export declare function executeGuards<T extends readonly GuardId[]>(guards: T, ctx: ApiContext, req: ApiRequest, params: Record<string, unknown>): Promise<ExecuteGuardsResult<T>>;
+export {};
+//# sourceMappingURL=guards.d.ts.map

package/dist/api/guards.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../../src/api/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AAOlE,sCAAsC;AACtC,MAAM,MAAM,OAAO,GACf,QAAQ,GACR,cAAc,GACd,QAAQ,GACR,wBAAwB,GACxB,OAAO,GACP,UAAU,GACV,YAAY,CAAA;AAEhB,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE;QAAE,aAAa,EAAE,aAAa,CAAA;KAAE,CAAA;IACxC,YAAY,EAAE;QAAE,aAAa,EAAE,aAAa,CAAA;KAAE,CAAA;IAC9C,MAAM,EAAE;QAAE,aAAa,EAAE,uBAAuB,CAAA;KAAE,CAAA;IAClD,sBAAsB,EAAE;QAAE,aAAa,EAAE,uBAAuB,CAAA;KAAE,CAAA;IAClE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC5B,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;CAClC;AAMD,4CAA4C;AAC5C,KAAK,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,OAAO,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI,GAAG,KAAK,CAAC,SAAS,CACjF,CAAC,EAAE,MAAM,CAAC,KACP,IAAI,GACL,CAAC,GACD,KAAK,CAAA;AAET,+DAA+D;AAC/D,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,IAAI,mBAAmB,CACjF,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAC3B,CAAA;AAqLD,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,IACxD;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,YAAY,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAA;CAAE,GAClD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAC,KAAK,CAAC,CAAA;CAAE,CAAA;AAE/C;;;GAGG;AACH,wBAAsB,aAAa,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,EAC9D,MAAM,EAAE,CAAC,EACT,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,UAAU,EACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAcjC"}

package/dist/api/guards.js

@@ -0,0 +1,166 @@
+/**
+ * Declarative guard system for API endpoints.
+ *
+ * Guards run before the handler and either:
+ * - Return an error response (404, 403, 500) to short-circuit
+ * - Produce a guard context (e.g., branch context with schema) for the handler
+ *
+ * Usage in defineEndpoint:
+ * ```ts
+ * defineEndpoint({
+ *   guards: ['branchAccessWithSchema'] as const,
+ *   handler: async (gc, ctx, req, params) => {
+ *     // gc.branchContext is guaranteed non-null with flatSchema
+ *   }
+ * })
+ * ```
+ */
+import { isAdmin, isReviewer, isPrivileged } from '../authorization/helpers';
+// ============================================================================
+// Guard runner implementations
+// ============================================================================
+/** Extracts branch name from params, returning error response if missing */
+function extractBranchName(params) {
+    const branch = params.branch;
+    if (typeof branch !== 'string' || !branch) {
+        return { ok: false, status: 400, error: 'Branch parameter required' };
+    }
+    return branch;
+}
+/** Resolve branch context, reusing from accumulated if available */
+async function resolveBranchContext(ctx, params, accumulated, options) {
+    // Reuse accumulated context if it has everything we need
+    if (accumulated.branchContext) {
+        if (!options?.loadSchema || accumulated.branchContext.flatSchema) {
+            return accumulated.branchContext;
+        }
+        // Need schema but accumulated doesn't have it — re-fetch with schema
+    }
+    const branch = extractBranchName(params);
+    if (typeof branch !== 'string')
+        return null;
+    return ctx.getBranchContext(branch, options);
+}
+const runBranchGuard = async (ctx, _req, params, accumulated) => {
+    const branch = extractBranchName(params);
+    if (typeof branch !== 'string')
+        return { ok: false, response: branch };
+    const context = accumulated.branchContext ?? (await ctx.getBranchContext(branch));
+    if (!context) {
+        return { ok: false, response: { ok: false, status: 404, error: 'Branch not found' } };
+    }
+    return { ok: true, context: { branchContext: context } };
+};
+const runBranchAccessGuard = async (ctx, req, params, accumulated) => {
+    const branch = extractBranchName(params);
+    if (typeof branch !== 'string')
+        return { ok: false, response: branch };
+    const context = accumulated.branchContext ?? (await ctx.getBranchContext(branch));
+    if (!context) {
+        return { ok: false, response: { ok: false, status: 404, error: 'Branch not found' } };
+    }
+    const access = ctx.services.checkBranchAccess(context, req.user);
+    if (!access.allowed) {
+        return {
+            ok: false,
+            response: { ok: false, status: 403, error: access.reason || 'Forbidden' },
+        };
+    }
+    return { ok: true, context: { branchContext: context } };
+};
+const runSchemaGuard = async (ctx, _req, params, accumulated) => {
+    const branch = extractBranchName(params);
+    if (typeof branch !== 'string')
+        return { ok: false, response: branch };
+    const context = await resolveBranchContext(ctx, params, accumulated, { loadSchema: true });
+    if (!context) {
+        return { ok: false, response: { ok: false, status: 404, error: 'Branch not found' } };
+    }
+    if (!context.flatSchema) {
+        return {
+            ok: false,
+            response: { ok: false, status: 500, error: 'Schema not loaded for branch' },
+        };
+    }
+    return { ok: true, context: { branchContext: context } };
+};
+const runBranchAccessWithSchemaGuard = async (ctx, req, params, accumulated) => {
+    const branch = extractBranchName(params);
+    if (typeof branch !== 'string')
+        return { ok: false, response: branch };
+    const context = await resolveBranchContext(ctx, params, accumulated, { loadSchema: true });
+    if (!context) {
+        return { ok: false, response: { ok: false, status: 404, error: 'Branch not found' } };
+    }
+    const access = ctx.services.checkBranchAccess(context, req.user);
+    if (!access.allowed) {
+        return {
+            ok: false,
+            response: { ok: false, status: 403, error: access.reason || 'Forbidden' },
+        };
+    }
+    if (!context.flatSchema) {
+        return {
+            ok: false,
+            response: { ok: false, status: 500, error: 'Schema not loaded for branch' },
+        };
+    }
+    return { ok: true, context: { branchContext: context } };
+};
+const runAdminGuard = async (_ctx, req) => {
+    if (!isAdmin(req.user.groups)) {
+        return {
+            ok: false,
+            response: { ok: false, status: 403, error: 'Admin access required' },
+        };
+    }
+    return { ok: true, context: {} };
+};
+const runReviewerGuard = async (_ctx, req) => {
+    if (!isReviewer(req.user.groups)) {
+        return {
+            ok: false,
+            response: { ok: false, status: 403, error: 'Reviewer access required' },
+        };
+    }
+    return { ok: true, context: {} };
+};
+const runPrivilegedGuard = async (_ctx, req) => {
+    if (!isPrivileged(req.user.groups)) {
+        return {
+            ok: false,
+            response: { ok: false, status: 403, error: 'Privileged access required' },
+        };
+    }
+    return { ok: true, context: {} };
+};
+// ============================================================================
+// Guard registry
+// ============================================================================
+const GUARD_RUNNERS = {
+    branch: runBranchGuard,
+    branchAccess: runBranchAccessGuard,
+    schema: runSchemaGuard,
+    branchAccessWithSchema: runBranchAccessWithSchemaGuard,
+    admin: runAdminGuard,
+    reviewer: runReviewerGuard,
+    privileged: runPrivilegedGuard,
+};
+/**
+ * Execute a chain of guards in order.
+ * Returns the accumulated guard context on success, or the first error response on failure.
+ */
+export async function executeGuards(guards, ctx, req, params) {
+    const accumulated = {};
+    for (const guardId of guards) {
+        const runner = GUARD_RUNNERS[guardId];
+        const result = await runner(ctx, req, params, accumulated);
+        if (!result.ok) {
+            return { ok: false, response: result.response };
+        }
+        // Merge context contributions
+        Object.assign(accumulated, result.context);
+    }
+    return { ok: true, guardContext: accumulated };
+}
+//# sourceMappingURL=guards.js.map

package/dist/api/guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../src/api/guards.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AAiE5E,+EAA+E;AAC/E,+BAA+B;AAC/B,+EAA+E;AAE/E,4EAA4E;AAC5E,SAAS,iBAAiB,CAAC,MAA+B;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAA;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC1C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,2BAA2B,EAAE,CAAA;IACvE,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,oEAAoE;AACpE,KAAK,UAAU,oBAAoB,CACjC,GAAe,EACf,MAA+B,EAC/B,WAAyB,EACzB,OAAkC;IAElC,yDAAyD;IACzD,IAAI,WAAW,CAAC,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,OAAO,EAAE,UAAU,IAAI,WAAW,CAAC,aAAa,CAAC,UAAU,EAAE,CAAC;YACjE,OAAO,WAAW,CAAC,aAAa,CAAA;QAClC,CAAC;QACD,qEAAqE;IACvE,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC3C,OAAO,GAAG,CAAC,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAC9C,CAAC;AAED,MAAM,cAAc,GAAgB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IAC3E,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAEtE,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAA;IACjF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAA;IACvF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAA;AAC1D,CAAC,CAAA;AAED,MAAM,oBAAoB,GAAgB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAEtE,MAAM,OAAO,GAAG,WAAW,CAAC,aAAa,IAAI,CAAC,MAAM,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAA;IACjF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAA;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE;SAC1E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,CAAA;AAC1D,CAAC,CAAA;AAED,MAAM,cAAc,GAAgB,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IAC3E,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAEtE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAA;IACvF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE;SAC5E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAkC,EAAE,EAAE,CAAA;AACrF,CAAC,CAAA;AAED,MAAM,8BAA8B,GAAgB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IAC1F,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;IACxC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;IAEtE,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,CAAA;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,WAAW,EAAE;SAC1E,CAAA;IACH,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,8BAA8B,EAAE;SAC5E,CAAA;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,OAAkC,EAAE,EAAE,CAAA;AACrF,CAAC,CAAA;AAED,MAAM,aAAa,GAAgB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uBAAuB,EAAE;SACrE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,gBAAgB,GAAgB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IACxD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,0BAA0B,EAAE;SACxE,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAgB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE;SAC1E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;AAClC,CAAC,CAAA;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,MAAM,aAAa,GAAiC;IAClD,MAAM,EAAE,cAAc;IACtB,YAAY,EAAE,oBAAoB;IAClC,MAAM,EAAE,cAAc;IACtB,sBAAsB,EAAE,8BAA8B;IACtD,KAAK,EAAE,aAAa;IACpB,QAAQ,EAAE,gBAAgB;IAC1B,UAAU,EAAE,kBAAkB;CAC/B,CAAA;AAWD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAS,EACT,GAAe,EACf,GAAe,EACf,MAA+B;IAE/B,MAAM,WAAW,GAAiB,EAAE,CAAA;IAEpC,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAA;QACjD,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;IAC5C,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,WAAqC,EAAE,CAAA;AAC1E,CAAC"}

package/dist/api/index.d.ts

@@ -0,0 +1,18 @@
+export type { ApiResponse, ApiRequest, ApiContext } from './types';
+export type { BranchResponse, BranchListResponse, BranchDeleteResponse, CreateBranchBody, UpdateBranchAccessBody, } from './branch';
+export type { BranchMergeResponse } from './branch-merge';
+export type { CommentsResponse, AddCommentResponse, ResolveCommentResponse, ListCommentsResponse, } from './comments';
+export type { EntriesResponse, ListEntriesResponse, CollectionItem, ListEntriesParams, DeleteEntryResponse, } from './entries';
+export type { PermissionsResponse, UpdatePermissionsBody, SearchUsersParams, GetUserMetadataResponse, GetUserMetadataParams, } from './permissions';
+export type { UserInfoResponse } from './user';
+export type { AssetsListResponse, AssetUploadResponse, UploadAssetBody, DeleteAssetBody, ListAssetsParams, } from './assets';
+export type { InternalGroupsResponse, ExternalGroupsResponse, UpdateInternalGroupsBody, SearchExternalGroupsParams, ExternalGroup, } from './groups';
+export type { ReferenceOptionsResponse } from './reference-options';
+export type { ResolveReferencesResponse } from './resolve-references';
+export type { SchemaResponse, WireEntryType, WireCollectionConfig, WireFlatSchemaItem, CollectionResponse, CreateCollectionResponse, UpdateCollectionResponse, DeleteCollectionResponse, AddEntryTypeResponse, UpdateEntryTypeResponse, RemoveEntryTypeResponse, UpdateOrderResponse, GetSchemaApiResponse, GetCollectionApiResponse, CreateCollectionApiResponse, UpdateCollectionApiResponse, DeleteCollectionApiResponse, AddEntryTypeApiResponse, UpdateEntryTypeApiResponse, RemoveEntryTypeApiResponse, UpdateOrderApiResponse, } from './schema';
+export type { CreateCollectionInput, UpdateCollectionInput, CreateEntryTypeInput, UpdateEntryTypeInput, } from '../schema/schema-store-types';
+export type { EntryTypeSummary } from './entries';
+export { USER_ROUTES } from './user';
+export { CanopyApiClient, createApiClient } from './client';
+export type { ApiClientOptions } from './client';
+//# sourceMappingURL=index.d.ts.map

package/dist/api/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AACA,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAClE,YAAY,EACV,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACzD,YAAY,EACV,gBAAgB,EAChB,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,cAAc,EACd,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,WAAW,CAAA;AAClB,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AACtB,YAAY,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAA;AAC9C,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,eAAe,EACf,gBAAgB,GACjB,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,sBAAsB,EACtB,sBAAsB,EACtB,wBAAwB,EACxB,0BAA0B,EAC1B,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,YAAY,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,YAAY,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAA;AACrE,YAAY,EACV,cAAc,EACd,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,oBAAoB,EACpB,uBAAuB,EACvB,uBAAuB,EACvB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,8BAA8B,CAAA;AACrC,YAAY,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAIjD,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AAKpC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC3D,YAAY,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA"}

package/dist/api/index.js

@@ -0,0 +1,8 @@
+// Content API uses path-based routing now - no separate params/body types exported
+// Export route definitions
+export { USER_ROUTES } from './user';
+// Note: SCHEMA_ROUTES is not exported here because it imports server-only code (fs module).
+// Import it directly from './schema' in server-side code when needed.
+// Export client
+export { CanopyApiClient, createApiClient } from './client';
+//# sourceMappingURL=index.js.map

package/dist/api/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/api/index.ts"],"names":[],"mappings":"AA6EA,mFAAmF;AAEnF,2BAA2B;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAA;AACpC,4FAA4F;AAC5F,sEAAsE;AAEtE,gBAAgB;AAChB,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA"}