mythik-server 0.1.0

package/dist/server.js

@@ -0,0 +1,717 @@
+import express from 'express';
+import mssql from 'mssql';
+import { validateApiSpec } from './validation/spec-validator.js';
+import { createConnectionPool } from './connection.js';
+import { buildCatalogQuery } from './catalog-builder.js';
+import { parseParamValue, getSqlType, buildPaginatedQuery, buildCountQuery, buildTotalsQuery } from './query-engine.js';
+import { filterFields, buildInsertQuery, buildUpdateQuery, buildDeleteQuery } from './crud-builder.js';
+import { injectAuditFields } from './audit.js';
+import { checkScreensTable, buildSpecServingRoutes, stripSensitiveFields } from './spec-serving.js';
+import { createJwtStrategy } from './auth/jwt-strategy.js';
+import { discoverHandlers, getHandlerRefs, validateHandlerRefs } from './handler-loader.js';
+import { createErrorHandler } from './middleware/error-handler.js';
+import { createCors } from './middleware/cors.js';
+import { createAuthMiddleware } from './auth/middleware.js';
+import { createDbAuthProvider } from './auth/db-auth-provider.js';
+import { buildScopeWhereClause, wrapQueryWithScopeFilter, resolveActiveScope, validateScopeForInsert } from './auth/scope-filter.js';
+import { resolveEnvVars } from './spec-loader.js';
+import path from 'path';
+import fs from 'fs';
+async function resolveSpec(config) {
+    const { spec } = config;
+    // Mode 1: ApiSpec object
+    if (typeof spec === 'object' && 'type' in spec && spec.type === 'api') {
+        return spec;
+    }
+    // Mode 2: File path string
+    if (typeof spec === 'string') {
+        const raw = fs.readFileSync(path.resolve(spec), 'utf-8');
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            throw new Error(`Failed to parse spec file "${spec}" — invalid JSON`);
+        }
+        return parsed;
+    }
+    // Mode 3: Store + ID
+    if (typeof spec === 'object' && 'store' in spec && 'id' in spec) {
+        const loaded = await spec.store.load(spec.id);
+        return loaded;
+    }
+    throw new Error('Invalid spec config: must be a file path (string), ApiSpec object, or { store, id }');
+}
+export function createServer(config) {
+    const app = express();
+    let pool = null;
+    let httpServer = null;
+    async function start(port) {
+        // 1. Load and validate spec
+        const spec = await resolveSpec(config);
+        const validation = validateApiSpec(spec);
+        if (!validation.valid) {
+            throw new Error(`Invalid API spec:\n${validation.errors.map(e => `  - ${e}`).join('\n')}`);
+        }
+        // 2. Resolve env vars and connect to DB
+        pool = await createConnectionPool(resolveEnvVars(config.database));
+        const specDir = typeof config.spec === 'string' ? path.dirname(path.resolve(config.spec)) : process.cwd();
+        // 3. Discover handlers
+        const handlersDir = path.resolve(specDir, config.handlersDir ?? './handlers');
+        const handlers = await discoverHandlers(handlersDir);
+        // Validate handler references
+        const handlerRefs = getHandlerRefs(spec);
+        const handlerErrors = validateHandlerRefs(handlerRefs, handlers);
+        if (handlerErrors.length > 0) {
+            throw new Error(`Handler errors:\n${handlerErrors.map(e => `  - ${e}`).join('\n')}`);
+        }
+        // 4. Setup middleware
+        app.use(createCors(config.cors !== false));
+        app.use(express.json());
+        const serverPort = port ?? config.port ?? 3010;
+        const devMode = process.env.NODE_ENV !== 'production';
+        // 4b. Auth setup — merge spec auth (declarative) with config auth (secrets)
+        const jwtConfig = config.auth?.jwt
+            ? resolveEnvVars(config.auth.jwt)
+            : null;
+        const fullAuthConfig = spec.auth && jwtConfig
+            ? { ...spec.auth, strategy: 'jwt', jwt: { ...jwtConfig, claims: spec.auth.claims } }
+            : null;
+        const authMiddleware = fullAuthConfig ? createAuthMiddleware(fullAuthConfig) : null;
+        const defaultPolicy = fullAuthConfig ? undefined : 'public'; // no auth config = all public
+        // 4c. Built-in login provider (when auth.provider is configured)
+        if (spec.auth?.provider && jwtConfig && pool) {
+            const jwtWithClaims = { ...jwtConfig, claims: spec.auth.claims };
+            const dbProvider = createDbAuthProvider(spec.auth.provider, jwtWithClaims, pool);
+            app.post('/api/auth/login', async (req, res, next) => {
+                try {
+                    const { username, password } = req.body;
+                    if (!username || !password) {
+                        res.status(400).json({ error: { code: 'VALIDATION_FAILED', message: 'username and password are required' } });
+                        return;
+                    }
+                    const result = await dbProvider.login(username, password);
+                    res.json(result);
+                }
+                catch (err) {
+                    next(err);
+                }
+            });
+            app.post('/api/auth/refresh', async (req, res, next) => {
+                try {
+                    const { refreshToken } = req.body;
+                    if (!refreshToken) {
+                        res.status(400).json({ error: { code: 'VALIDATION_FAILED', message: 'refreshToken is required' } });
+                        return;
+                    }
+                    const result = await dbProvider.refresh(refreshToken);
+                    res.json(result);
+                }
+                catch (err) {
+                    next(err);
+                }
+            });
+        }
+        // 5. Catalog routes
+        if (spec.catalogs) {
+            const catalogPolicy = fullAuthConfig?.catalogsPolicy === 'public' ? 'public' : defaultPolicy;
+            for (const [name, catalogConfig] of Object.entries(spec.catalogs)) {
+                const routeHandlers = [];
+                if (authMiddleware && catalogPolicy !== 'public') {
+                    routeHandlers.push(authMiddleware(catalogPolicy));
+                }
+                routeHandlers.push(async (_req, res, next) => {
+                    try {
+                        if (catalogConfig.static) {
+                            res.json(catalogConfig.static);
+                            return;
+                        }
+                        const catalogSql = buildCatalogQuery(catalogConfig);
+                        if (!catalogSql) {
+                            res.json([]);
+                            return;
+                        }
+                        const result = await pool.request().query(catalogSql);
+                        res.json(result.recordset);
+                    }
+                    catch (err) {
+                        next(err);
+                    }
+                });
+                app.get(`/api/catalogs/${name}`, ...routeHandlers);
+            }
+        }
+        // 6. Spec serving
+        const specServingConfig = config.specServing;
+        if (specServingConfig !== false) {
+            const tableName = typeof specServingConfig === 'object' ? specServingConfig.table : 'screens';
+            const tableExists = await checkScreensTable(pool, tableName);
+            if (tableExists) {
+                const serving = buildSpecServingRoutes(pool, tableName);
+                // Auto-detect public screens: AppSpecs are always public (needed for bootstrap),
+                // and each AppSpec's loginScreen is also public (must load before auth).
+                // All other screens require authentication.
+                const publicScreenIds = new Set();
+                if (fullAuthConfig) {
+                    const appSpecs = await discoverAppSpecs(pool, tableName);
+                    for (const { id, loginScreen } of appSpecs) {
+                        publicScreenIds.add(id);
+                        if (loginScreen)
+                            publicScreenIds.add(loginScreen);
+                    }
+                }
+                // JWT strategy for optional token validation on AppSpec requests
+                const appSpecJwt = fullAuthConfig ? createJwtStrategy(fullAuthConfig.jwt) : null;
+                // /api/app/:id — returns full AppSpec with valid Bearer, filtered without
+                app.get('/api/app/:id', async (req, res, next) => {
+                    try {
+                        const appSpecData = await serving.loadApp(req.params.id);
+                        if (!appSpecData) {
+                            res.status(404).json({ error: { code: 'NOT_FOUND', message: `App "${req.params.id}" not found` } });
+                            return;
+                        }
+                        // If auth is configured, check for valid Bearer token
+                        if (appSpecJwt) {
+                            const token = appSpecJwt.extractToken(req);
+                            if (token) {
+                                try {
+                                    await appSpecJwt.validateToken(token);
+                                    // Valid token — return full AppSpec
+                                    res.json(appSpecData);
+                                    return;
+                                }
+                                catch {
+                                    // Invalid token — fall through to filtered response
+                                }
+                            }
+                            // No token or invalid token — return filtered AppSpec
+                            res.json(stripSensitiveFields(appSpecData));
+                            return;
+                        }
+                        // No auth configured — return full AppSpec
+                        res.json(appSpecData);
+                    }
+                    catch (err) {
+                        next(err);
+                    }
+                });
+                // /api/screens/:id — public for loginScreens, authenticated for everything else
+                if (authMiddleware && fullAuthConfig) {
+                    app.get('/api/screens/:id', async (req, res, next) => {
+                        if (publicScreenIds.has(req.params.id)) {
+                            return next(); // public — skip auth
+                        }
+                        // Apply auth middleware
+                        authMiddleware(defaultPolicy)(req, res, next);
+                    }, async (req, res, next) => {
+                        try {
+                            const screenSpec = await serving.loadScreen(req.params.id);
+                            if (!screenSpec) {
+                                res.status(404).json({ error: { code: 'NOT_FOUND', message: `Screen "${req.params.id}" not found` } });
+                                return;
+                            }
+                            res.json(screenSpec);
+                        }
+                        catch (err) {
+                            next(err);
+                        }
+                    });
+                }
+                else {
+                    app.get('/api/screens/:id', async (req, res, next) => {
+                        try {
+                            const screenSpec = await serving.loadScreen(req.params.id);
+                            if (!screenSpec) {
+                                res.status(404).json({ error: { code: 'NOT_FOUND', message: `Screen "${req.params.id}" not found` } });
+                                return;
+                            }
+                            res.json(screenSpec);
+                        }
+                        catch (err) {
+                            next(err);
+                        }
+                    });
+                }
+            }
+        }
+        // 7. Endpoint routes
+        if (spec.endpoints) {
+            for (const [, endpointConfig] of Object.entries(spec.endpoints)) {
+                registerEndpoint(app, pool, endpointConfig, handlers, authMiddleware, defaultPolicy, fullAuthConfig ?? undefined);
+            }
+        }
+        // 8. Error handler (must be last)
+        app.use(createErrorHandler(devMode));
+        // 9. Start listening
+        await new Promise((resolve) => {
+            httpServer = app.listen(serverPort, () => {
+                printStartupInfo(spec, config, serverPort, handlers, specServingConfig !== false);
+                resolve();
+            });
+        });
+    }
+    async function stop() {
+        if (httpServer) {
+            await new Promise((resolve) => httpServer.close(() => resolve()));
+            httpServer = null;
+        }
+        if (pool) {
+            await pool.close();
+            pool = null;
+        }
+    }
+    function getApp() {
+        return app;
+    }
+    return { start, stop, getApp };
+}
+// --- App spec discovery (for public screen detection) ---
+async function discoverAppSpecs(pool, tableName) {
+    try {
+        const result = await pool.request()
+            .query(`SELECT id, spec FROM [${tableName}]`);
+        const appSpecs = [];
+        for (const row of result.recordset) {
+            const spec = typeof row.spec === 'string' ? JSON.parse(row.spec) : row.spec;
+            if (spec?.type === 'app') {
+                appSpecs.push({
+                    id: row.id,
+                    loginScreen: spec.navigation?.auth?.loginScreen ?? null,
+                });
+            }
+        }
+        return appSpecs;
+    }
+    catch {
+        return [];
+    }
+}
+// --- Scope filter helpers ---
+function resolveScopeConfig(endpoint, authConfig) {
+    if (!authConfig?.scopeFilter)
+        return null;
+    const sf = endpoint.scopeFilter;
+    if (sf === false || sf === undefined)
+        return null;
+    if (sf === true)
+        return authConfig.scopeFilter;
+    if (typeof sf === 'object' && 'column' in sf) {
+        return { ...authConfig.scopeFilter, column: sf.column };
+    }
+    return null;
+}
+function getUserFromReq(req) {
+    return req.user;
+}
+function applyScopeToQuery(req, res, scopeFilterConfig, dataQuery, dataRequest) {
+    const user = getUserFromReq(req);
+    if (!user)
+        return dataQuery;
+    // Handle "select" mode — validate active scope
+    let activeScope = undefined;
+    if (scopeFilterConfig.mode === 'select') {
+        const headerVal = req.headers[scopeFilterConfig.header.toLowerCase()];
+        activeScope = resolveActiveScope(headerVal, scopeFilterConfig.type);
+        if (activeScope === null) {
+            res.status(400).json({ error: { code: 'SCOPE_REQUIRED', message: 'Active scope header is required' } });
+            return null; // signal to caller to stop
+        }
+        const bypassRoles = scopeFilterConfig.bypassRoles ?? [];
+        if (!user.scope.includes(activeScope) && !bypassRoles.some(r => user.roles.includes(r))) {
+            res.status(403).json({ error: { code: 'SCOPE_VIOLATION', message: 'Active scope not in allowed values' } });
+            return null;
+        }
+    }
+    const scopeClause = buildScopeWhereClause(scopeFilterConfig, user.scope, activeScope, user.roles);
+    if (!scopeClause)
+        return dataQuery; // bypass role
+    for (const [key, value] of Object.entries(scopeClause.params)) {
+        dataRequest.input(key, value);
+    }
+    return wrapQueryWithScopeFilter(dataQuery, scopeClause);
+}
+// --- Endpoint registration ---
+function registerEndpoint(app, pool, endpoint, handlers, authMiddleware, defaultPolicy, authConfig) {
+    const method = (endpoint.method ?? 'GET').toLowerCase();
+    const params = endpoint.params ?? {};
+    const policy = endpoint.policy ?? defaultPolicy;
+    const scopeFilterConfig = resolveScopeConfig(endpoint, authConfig);
+    // Auth middleware for this endpoint
+    const authHandler = authMiddleware && policy !== 'public' ? authMiddleware(policy) : null;
+    // Query-based endpoint
+    if (endpoint.query) {
+        const routeHandlers = [];
+        if (authHandler)
+            routeHandlers.push(authHandler);
+        routeHandlers.push(async (req, res, next) => {
+            try {
+                const paramValues = extractParamValues(req, params);
+                validateRequiredParams(params, paramValues);
+                const hasPagination = endpoint.pagination === 'offset';
+                const page = hasPagination ? (parseParamValue(req.query.page, 'int') ?? 0) : 0;
+                const pageSize = hasPagination
+                    ? (parseParamValue(req.query.pageSize, 'int', params.pageSize?.max) ?? params.pageSize?.default ?? 20)
+                    : 0;
+                // Build parallel queries
+                const queries = [];
+                // Data query
+                const dataRequest = pool.request();
+                bindAllParams(dataRequest, params, paramValues);
+                let dataQuery;
+                if (hasPagination) {
+                    dataQuery = buildPaginatedQuery(endpoint.query);
+                    dataRequest.input('_offset', mssql.Int, page * pageSize);
+                    dataRequest.input('_pageSize', mssql.Int, pageSize);
+                }
+                else {
+                    dataQuery = endpoint.query;
+                }
+                // Apply scope filter to data query
+                if (scopeFilterConfig) {
+                    const filtered = applyScopeToQuery(req, res, scopeFilterConfig, dataQuery, dataRequest);
+                    if (filtered === null)
+                        return; // response already sent (error)
+                    dataQuery = filtered;
+                }
+                queries.push(dataRequest.query(dataQuery));
+                // Count query (if pagination)
+                if (hasPagination) {
+                    const countRequest = pool.request();
+                    bindAllParams(countRequest, params, paramValues);
+                    let countSql = endpoint.count ?? buildCountQuery(endpoint.query);
+                    // Apply scope filter to count query too
+                    if (scopeFilterConfig) {
+                        const user = getUserFromReq(req);
+                        if (user) {
+                            let activeScope = undefined;
+                            if (scopeFilterConfig.mode === 'select') {
+                                activeScope = resolveActiveScope(req.headers[scopeFilterConfig.header.toLowerCase()], scopeFilterConfig.type);
+                            }
+                            const countClause = buildScopeWhereClause(scopeFilterConfig, user.scope, activeScope, user.roles);
+                            if (countClause) {
+                                countSql = wrapQueryWithScopeFilter(countSql, countClause);
+                                for (const [key, value] of Object.entries(countClause.params)) {
+                                    countRequest.input(key, value);
+                                }
+                            }
+                        }
+                    }
+                    queries.push(countRequest.query(countSql));
+                }
+                // Totals query
+                if (endpoint.totals) {
+                    const totalsRequest = pool.request();
+                    bindAllParams(totalsRequest, params, paramValues);
+                    let totalsSql = typeof endpoint.totals === 'string'
+                        ? endpoint.totals
+                        : buildTotalsQuery(endpoint.query, endpoint.totals);
+                    // Apply scope filter to totals query too
+                    if (totalsSql && scopeFilterConfig) {
+                        const user = getUserFromReq(req);
+                        if (user) {
+                            let activeScope = undefined;
+                            if (scopeFilterConfig.mode === 'select') {
+                                activeScope = resolveActiveScope(req.headers[scopeFilterConfig.header.toLowerCase()], scopeFilterConfig.type);
+                            }
+                            const totalsClause = buildScopeWhereClause(scopeFilterConfig, user.scope, activeScope, user.roles);
+                            if (totalsClause) {
+                                totalsSql = wrapQueryWithScopeFilter(totalsSql, totalsClause);
+                                for (const [key, value] of Object.entries(totalsClause.params)) {
+                                    totalsRequest.input(key, value);
+                                }
+                            }
+                        }
+                    }
+                    if (totalsSql) {
+                        queries.push(totalsRequest.query(totalsSql));
+                    }
+                }
+                const results = await Promise.all(queries);
+                const dataResult = results[0];
+                const response = { data: dataResult.recordset };
+                if (hasPagination && results[1]) {
+                    const countResult = results[1];
+                    response.total = countResult.recordset[0]?._total ?? 0;
+                    response.page = page;
+                    response.pageSize = pageSize;
+                }
+                if (endpoint.totals && results[hasPagination ? 2 : 1]) {
+                    const totalsResult = results[hasPagination ? 2 : 1];
+                    response.totals = totalsResult.recordset[0] ?? {};
+                }
+                res.json(response);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+        app[method](endpoint.path, ...routeHandlers);
+    }
+    // Handler-based endpoint
+    if (endpoint.handler) {
+        const handler = handlers.get(endpoint.handler);
+        const routeHandlers = [];
+        if (authHandler)
+            routeHandlers.push(authHandler);
+        routeHandlers.push(async (req, res, next) => {
+            try {
+                const paramValues = extractParamValues(req, params);
+                validateRequiredParams(params, paramValues);
+                const result = await handler({
+                    params: paramValues,
+                    db: pool,
+                    sql: { Int: mssql.Int, Float: mssql.Float, Bit: mssql.Bit, NVarChar: mssql.NVarChar, DateTime: mssql.DateTime },
+                    user: getUserFromReq(req) ?? null,
+                    query: req.query,
+                    body: req.body,
+                });
+                // Check if result is an explicit error
+                if (result && typeof result === 'object' && 'status' in result && 'error' in result) {
+                    const errResult = result;
+                    res.status(errResult.status).json({ error: errResult.error });
+                    return;
+                }
+                res.json(result);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+        app[method](endpoint.path, ...routeHandlers);
+    }
+    // CRUD endpoints
+    if (endpoint.crud) {
+        const crud = endpoint.crud;
+        // POST — create
+        const postHandlers = [];
+        if (authHandler)
+            postHandlers.push(authHandler);
+        postHandlers.push(async (req, res, next) => {
+            try {
+                // Scope filter: validate insert
+                if (scopeFilterConfig) {
+                    const user = getUserFromReq(req);
+                    if (user && !validateScopeForInsert(scopeFilterConfig, req.body, user.scope, user.roles)) {
+                        res.status(403).json({ error: { code: 'SCOPE_INSERT_VIOLATION', message: 'Cannot create record outside your scope' } });
+                        return;
+                    }
+                }
+                const fields = filterFields(req.body, crud.insertable);
+                if (endpoint.audit) {
+                    const user = getUserFromReq(req);
+                    injectAuditFields(fields, endpoint.audit, user?.username ?? null, 'insert');
+                }
+                if (Object.keys(fields).length === 0) {
+                    res.status(400).json({ error: { code: 'VALIDATION_FAILED', message: 'No valid fields in request body' } });
+                    return;
+                }
+                const { sql: insertSql, params: insertParams } = buildInsertQuery(crud.table, fields, crud.primaryKey);
+                const request = pool.request();
+                for (const [key, value] of Object.entries(insertParams)) {
+                    request.input(key, value);
+                }
+                const result = await request.query(insertSql);
+                res.status(201).json(result.recordset[0] ?? fields);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+        app.post(endpoint.path, ...postHandlers);
+        // PUT — update
+        const putHandlers = [];
+        if (authHandler)
+            putHandlers.push(authHandler);
+        putHandlers.push(async (req, res, next) => {
+            try {
+                const fields = filterFields(req.body, crud.updatable);
+                if (endpoint.audit) {
+                    const user = getUserFromReq(req);
+                    injectAuditFields(fields, endpoint.audit, user?.username ?? null, 'update');
+                }
+                if (Object.keys(fields).length === 0) {
+                    res.status(400).json({ error: { code: 'VALIDATION_FAILED', message: 'No valid fields in request body' } });
+                    return;
+                }
+                let { sql: updateSql, params: updateParams } = buildUpdateQuery(crud.table, crud.primaryKey, req.params.id, fields);
+                const request = pool.request();
+                for (const [key, value] of Object.entries(updateParams)) {
+                    request.input(key, value);
+                }
+                // Scope filter: restrict update to user's scope
+                if (scopeFilterConfig) {
+                    const user = getUserFromReq(req);
+                    if (user) {
+                        let activeScope = undefined;
+                        if (scopeFilterConfig.mode === 'select') {
+                            activeScope = resolveActiveScope(req.headers[scopeFilterConfig.header.toLowerCase()], scopeFilterConfig.type);
+                        }
+                        const scopeClause = buildScopeWhereClause(scopeFilterConfig, user.scope, activeScope, user.roles);
+                        if (scopeClause) {
+                            // Append scope condition to WHERE clause
+                            updateSql = updateSql.replace(/WHERE\s+/i, `WHERE ${scopeClause.sql} AND `);
+                            for (const [key, value] of Object.entries(scopeClause.params)) {
+                                request.input(key, value);
+                            }
+                        }
+                    }
+                }
+                const result = await request.query(updateSql);
+                if (!result.recordset[0]) {
+                    res.status(404).json({ error: { code: 'NOT_FOUND', message: 'Record not found' } });
+                    return;
+                }
+                res.json(result.recordset[0]);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+        app.put(`${endpoint.path}/:id`, ...putHandlers);
+        // DELETE
+        const deleteHandlers = [];
+        if (authHandler)
+            deleteHandlers.push(authHandler);
+        deleteHandlers.push(async (req, res, next) => {
+            try {
+                let { sql: deleteSql, params: deleteParams } = buildDeleteQuery(crud.table, crud.primaryKey, req.params.id);
+                const request = pool.request();
+                for (const [key, value] of Object.entries(deleteParams)) {
+                    request.input(key, value);
+                }
+                // Scope filter: restrict delete to user's scope
+                if (scopeFilterConfig) {
+                    const user = getUserFromReq(req);
+                    if (user) {
+                        let activeScope = undefined;
+                        if (scopeFilterConfig.mode === 'select') {
+                            activeScope = resolveActiveScope(req.headers[scopeFilterConfig.header.toLowerCase()], scopeFilterConfig.type);
+                        }
+                        const scopeClause = buildScopeWhereClause(scopeFilterConfig, user.scope, activeScope, user.roles);
+                        if (scopeClause) {
+                            deleteSql = deleteSql.replace(/WHERE\s+/i, `WHERE ${scopeClause.sql} AND `);
+                            for (const [key, value] of Object.entries(scopeClause.params)) {
+                                request.input(key, value);
+                            }
+                        }
+                    }
+                }
+                const result = await request.query(deleteSql);
+                if (result.rowsAffected[0] === 0) {
+                    res.status(404).json({ error: { code: 'NOT_FOUND', message: 'Record not found' } });
+                    return;
+                }
+                res.status(204).send();
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+        app.delete(`${endpoint.path}/:id`, ...deleteHandlers);
+    }
+}
+function extractParamValues(req, params) {
+    const values = {};
+    for (const [name, config] of Object.entries(params)) {
+        const source = config.source ?? autoDetectSource(name, req);
+        let raw;
+        if (source === 'path') {
+            raw = req.params[name];
+        }
+        else if (source === 'body') {
+            raw = req.body?.[name] !== undefined ? String(req.body[name]) : undefined;
+        }
+        else {
+            raw = req.query[name];
+        }
+        const parsed = parseParamValue(raw, config.type, config.max);
+        values[name] = parsed ?? config.default ?? null;
+    }
+    return values;
+}
+function autoDetectSource(name, req) {
+    if (req.params[name] !== undefined)
+        return 'path';
+    if (req.method !== 'GET' && req.body?.[name] !== undefined)
+        return 'body';
+    return 'query';
+}
+function validateRequiredParams(params, values) {
+    for (const [name, config] of Object.entries(params)) {
+        if (config.required && (values[name] === null || values[name] === undefined)) {
+            const err = new Error(`Required parameter "${name}" is missing`);
+            err.type = 'VALIDATION';
+            err.status = 400;
+            throw err;
+        }
+    }
+}
+function bindAllParams(request, params, values) {
+    for (const [name, config] of Object.entries(params)) {
+        const value = values[name];
+        request.input(name, getSqlType(config.type), value ?? null);
+    }
+}
+function printStartupInfo(spec, config, port, handlers, specServingEnabled) {
+    console.log('\nMythik Server v0.2.0');
+    console.log(`Connected to SQL Server — ${config.database.database}`);
+    if (spec.auth) {
+        console.log(`\nAuth: JWT${spec.auth.provider ? ' + built-in login' : ' (external)'}`);
+        if (spec.auth.provider) {
+            console.log('  POST /api/auth/login');
+            console.log('  POST /api/auth/refresh');
+        }
+        if (spec.auth.policies) {
+            console.log(`  Policies (${Object.keys(spec.auth.policies).length}): ${Object.keys(spec.auth.policies).join(', ')}`);
+        }
+        if (spec.auth.scopeFilter) {
+            console.log(`  Scope filter: ${spec.auth.scopeFilter.mode ?? 'all'} on ${spec.auth.scopeFilter.column}`);
+        }
+    }
+    if (spec.catalogs) {
+        const catalogNames = Object.keys(spec.catalogs);
+        console.log(`\nCatalogs (${catalogNames.length}):`);
+        for (const name of catalogNames) {
+            const config = spec.catalogs[name];
+            const detail = config.static
+                ? '(static)'
+                : config.distinct
+                    ? `(distinct: ${config.distinct})`
+                    : `(${config.value} → ${config.label})`;
+            console.log(`  GET /api/catalogs/${name} ${detail}`);
+        }
+    }
+    if (spec.endpoints) {
+        const endpointEntries = Object.entries(spec.endpoints);
+        console.log(`\nEndpoints (${endpointEntries.length}):`);
+        for (const [, ep] of endpointEntries) {
+            const m = (ep.method ?? 'GET').toUpperCase();
+            const details = [];
+            if (ep.query)
+                details.push('query');
+            if (ep.pagination)
+                details.push(`pagination: ${ep.pagination}`);
+            if (ep.totals)
+                details.push(`totals: ${Array.isArray(ep.totals) ? ep.totals.length : 'manual'}`);
+            if (ep.handler)
+                details.push(`handler: ${ep.handler}`);
+            if (ep.crud)
+                details.push('crud');
+            if (ep.policy)
+                details.push(`policy: ${ep.policy}`);
+            if (ep.scopeFilter)
+                details.push('scopeFilter');
+            console.log(`  ${m.padEnd(6)} ${ep.path} (${details.join(', ')})`);
+        }
+    }
+    if (specServingEnabled) {
+        console.log('\nSpec serving:');
+        console.log('  GET /api/screens/:id');
+        console.log('  GET /api/app/:id');
+    }
+    if (handlers.size > 0) {
+        console.log(`\nHandlers (${handlers.size}): ${Array.from(handlers.keys()).join(', ')}`);
+    }
+    console.log(`\nListening on http://localhost:${port}\n`);
+}
+//# sourceMappingURL=server.js.map