rastack 0.0.20 → 0.0.22

package/cache/types.ts

@@ -0,0 +1,85 @@
+/**
+ * The local Iceberg file cache: types.
+ *
+ * The database is a set of Iceberg files on object storage, and the browser
+ * queries them through the WASM engine — so the local cache is a cache of
+ * *those files*, not a second database. Iceberg's layout makes this cheap and
+ * exact: snapshot metadata and data files are immutable (a new commit writes
+ * new files and swaps one tiny pointer, `version-hint.text`), so everything
+ * except the pointer can be cached forever and revalidation costs one small
+ * read.
+ */
+
+/**
+ * Async byte storage behind the cache. Web uses {@link IndexedDbCacheStorage};
+ * React Native / Expo supply any key-value engine (expo-file-system, MMKV,
+ * expo-sqlite, AsyncStorage) through {@link createKeyValueCacheStorage} — the
+ * cache itself is platform-free.
+ */
+export interface CacheStorage {
+  get(key: string): Promise<Uint8Array | null>;
+  put(key: string, bytes: Uint8Array): Promise<void>;
+  delete(key: string): Promise<void>;
+  /** Every stored key, optionally only those starting with `prefix`. */
+  keys(prefix?: string): Promise<string[]>;
+}
+
+/**
+ * Where warehouse files come from: a public HTTP directory in `local` mode, or
+ * SigV4-signed S3 GETs (Cognito Identity Pool temp credentials) in `s3` mode.
+ * Implementations MUST throw {@link AccessRevokedError} when the backend
+ * refuses access (HTTP 401/403, S3 AccessDenied, an expired identity that can
+ * no longer be refreshed) — that signal is what triggers local data deletion.
+ */
+export interface WarehouseFileSource {
+  /** Fetch one warehouse object by key, or `null` if it does not exist. */
+  fetchFile(key: string): Promise<Uint8Array | null>;
+}
+
+/** The engine surface seeding needs (the WASM `RadApi`). */
+export interface SeedableEngine {
+  seedFile(key: string, bytes: Uint8Array): Promise<void>;
+}
+
+/**
+ * Access to the data has been revoked (or the identity can no longer prove
+ * it). The cache reacts by deleting everything it holds for that identity.
+ */
+export class AccessRevokedError extends Error {
+  readonly status?: number;
+
+  constructor(message = "Access revoked", status?: number) {
+    super(message);
+    this.name = "AccessRevokedError";
+    this.status = status;
+  }
+}
+
+export function isAccessRevoked(error: unknown): error is AccessRevokedError {
+  return (
+    error instanceof AccessRevokedError ||
+    (error instanceof Error && error.name === "AccessRevokedError")
+  );
+}
+
+/**
+ * The cache exceeded its offline-retention bound (`maxOfflineMs`): access
+ * could not be re-verified for too long, so the cached data was deleted
+ * rather than served. Distinct from {@link AccessRevokedError} — access may
+ * still be fine, but it could not be proven.
+ */
+export class CacheExpiredError extends Error {
+  constructor(message = "Cached data expired: access not re-verified in time") {
+    super(message);
+    this.name = "CacheExpiredError";
+  }
+}
+
+/** What a cached seed did — how much came from cache vs. the network. */
+export interface SeedStats {
+  tables: number;
+  /** Files served straight from the local cache (no network). */
+  fromCache: number;
+  /** Files fetched from the source (then cached). */
+  fetched: number;
+}

package/dist/compile/analyze.js

@@ -106,6 +106,7 @@ function analyzeResourceCall(call, checker) {
         search: options.search,
         ordering: options.ordering,
         permission: options.permission,
+        access: normaliseAccess(options.access),
     };
 }
 /**
@@ -229,6 +230,20 @@ function normaliseSync(sync) {
         model.clientIds = true;
     return model;
 }
+function normaliseAccess(access) {
+    if (!access || typeof access !== "object")
+        return undefined;
+    const model = {};
+    if (typeof access.ownerField === "string")
+        model.ownerField = access.ownerField;
+    if (access.scope === "owner" || access.scope === "shared") {
+        model.scope = access.scope;
+    }
+    if (Array.isArray(access.adminGroups)) {
+        model.adminGroups = access.adminGroups.filter((g) => typeof g === "string");
+    }
+    return Object.keys(model).length ? model : undefined;
+}
 function normaliseAdmin(admin) {
     if (admin === false)
         return false;

package/dist/compile/index.d.ts

@@ -8,7 +8,15 @@ export interface CompileResult {
     openapi: any;
     files: string[];
 }
-/** List every `.ts` resource file under a directory (or accept explicit files). */
+/**
+ * Every `.ts` resource file under a directory (recursively), or an explicit
+ * file. Recursion is what lets resource definitions live **co-located with the
+ * pages that consume them** — e.g. `app/airports/_schema.rad.ts` beside
+ * `app/airports/index.tsx` — instead of in one top-level `resources/` folder.
+ * `.tsx` route components and `.d.ts` files are skipped; only files with a
+ * `resource(...)` call contribute to the manifest, so co-located helpers are
+ * harmless.
+ */
 export declare function resolveResourceFiles(input: string): string[];
 /** Analyse resource definitions into the canonical model (no file output). */
 export declare function analyzeResources(input: string): ResourceModel[];

package/dist/compile/index.js

@@ -55,17 +55,43 @@ Object.defineProperty(exports, "buildManifest", { enumerable: true, get: functio
 var openapi_2 = require("./openapi");
 Object.defineProperty(exports, "buildOpenApi", { enumerable: true, get: function () { return openapi_2.buildOpenApi; } });
 __exportStar(require("./model"), exports);
-/** List every `.ts` resource file under a directory (or accept explicit files). */
+/** Directories never worth walking for resource definitions. */
+const IGNORE_DIRS = new Set([
+    "node_modules",
+    ".git",
+    ".expo",
+    ".rad",
+    "dist",
+    "web-build",
+]);
+/**
+ * Every `.ts` resource file under a directory (recursively), or an explicit
+ * file. Recursion is what lets resource definitions live **co-located with the
+ * pages that consume them** — e.g. `app/airports/_schema.rad.ts` beside
+ * `app/airports/index.tsx` — instead of in one top-level `resources/` folder.
+ * `.tsx` route components and `.d.ts` files are skipped; only files with a
+ * `resource(...)` call contribute to the manifest, so co-located helpers are
+ * harmless.
+ */
 function resolveResourceFiles(input) {
     const stat = fs.existsSync(input) ? fs.statSync(input) : undefined;
     if (stat?.isFile())
         return [path.resolve(input)];
     if (stat?.isDirectory()) {
-        return fs
-            .readdirSync(input)
-            .filter((f) => f.endsWith(".ts") && !f.endsWith(".d.ts"))
-            .map((f) => path.resolve(input, f))
-            .sort();
+        const files = [];
+        const walk = (dir) => {
+            for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+                if (entry.isDirectory()) {
+                    if (!IGNORE_DIRS.has(entry.name))
+                        walk(path.join(dir, entry.name));
+                }
+                else if (entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts")) {
+                    files.push(path.resolve(dir, entry.name));
+                }
+            }
+        };
+        walk(input);
+        return files.sort();
     }
     throw new Error(`No such resources path: ${input}`);
 }

package/dist/compile/model.d.ts

@@ -37,6 +37,17 @@ export interface SyncModel {
 export interface AdminModel {
     listDisplay?: string[];
 }
+/**
+ * Row-level access control, enforced by `rad-api-core` on every surface.
+ * `ownerField` names the field stamped with the authenticated subject;
+ * `scope: "owner"` places the table under a per-identity warehouse prefix
+ * (`tenants/{sub}/…`) so object-storage IAM can fence data per user.
+ */
+export interface AccessModel {
+    ownerField?: string;
+    scope?: "owner" | "shared";
+    adminGroups?: string[];
+}
 export interface ResourceModel {
     app: string;
     model: string;
@@ -47,6 +58,7 @@ export interface ResourceModel {
     search?: string[];
     ordering?: string[];
     permission?: string;
+    access?: AccessModel;
 }
 export interface Manifest {
     version: 1;

package/dist/compile/openapi.d.ts

@@ -5,7 +5,8 @@ import { ResourceModel } from "./model";
  * on — `/api/{app}/v1/{model}/` URL segments and the `x-rastack-sync*` vendor
  * extensions — so those packages are unchanged. Foreign keys additionally carry
  * a new `x-rastack-relation` extension so downstream tooling (and the admin) can
- * follow relations.
+ * follow relations, and access-controlled resources carry `x-rastack-access`
+ * (owner field + tenant scope) so the client cache can partition per identity.
  */
 export declare function buildOpenApi(resources: ResourceModel[]): any;
 export declare function openApiToJson(doc: any): string;

package/dist/compile/openapi.js

@@ -8,7 +8,8 @@ exports.openApiToJson = openApiToJson;
  * on — `/api/{app}/v1/{model}/` URL segments and the `x-rastack-sync*` vendor
  * extensions — so those packages are unchanged. Foreign keys additionally carry
  * a new `x-rastack-relation` extension so downstream tooling (and the admin) can
- * follow relations.
+ * follow relations, and access-controlled resources carry `x-rastack-access`
+ * (owner field + tenant scope) so the client cache can partition per identity.
  */
 function buildOpenApi(resources) {
     const paths = {};
@@ -196,6 +197,7 @@ function queryParam(name, type) {
  * local resource replicates.
  */
 function syncStamp(operation, resource, verb) {
+    accessStamp(operation, resource);
     const sync = resource.sync;
     if (!sync || sync.mode !== "local")
         return operation;
@@ -208,6 +210,23 @@ function syncStamp(operation, resource, verb) {
         operation["x-rastack-sync-client-ids"] = true;
     return operation;
 }
+/**
+ * Stamp `x-rastack-access` on an operation of an access-controlled resource so
+ * downstream tooling (hooks, the local cache) knows the owner field and whether
+ * the table is tenant-partitioned on object storage.
+ */
+function accessStamp(operation, resource) {
+    const access = resource.access;
+    if (!access)
+        return;
+    const stamp = {};
+    if (access.ownerField)
+        stamp.ownerField = access.ownerField;
+    if (access.scope)
+        stamp.scope = access.scope;
+    if (Object.keys(stamp).length)
+        operation["x-rastack-access"] = stamp;
+}
 function isConfirmed(confirmed, verb, operation) {
     if (!confirmed || !confirmed.length)
         return false;

package/dist/define/index.d.ts

@@ -86,6 +86,25 @@ export interface SyncOptions {
     load?: "instant" | "lazy";
     clientIds?: boolean;
 }
+/**
+ * Row-level access control. Enforced by `rad-api-core`, so the rules are
+ * identical on the server (Lambda / `rad serve`) and in the in-browser WASM
+ * engine.
+ *
+ * - `ownerField` — the field that records the owning identity (the verified
+ *   token `sub`). Rows are only listed/read/written by their owner; the field
+ *   is stamped from the token on create and immutable on update.
+ * - `scope: "owner"` — additionally *physically* partitions the resource's
+ *   Iceberg table per identity (`tenants/{sub}/{app}.db/{model}/…`), so
+ *   object-storage credentials (e.g. Cognito Identity Pool temp creds) can be
+ *   IAM-restricted to `tenants/${"${cognito-identity.amazonaws.com:sub}"}/*`.
+ * - `adminGroups` — token groups (`cognito:groups`) that bypass row filters.
+ */
+export interface AccessOptions {
+    ownerField?: string;
+    scope?: "owner" | "shared";
+    adminGroups?: string[];
+}
 export interface ResourceOptions {
     /** DRF-style search fields. */
     search?: string[];
@@ -99,6 +118,8 @@ export interface ResourceOptions {
     sync?: SyncOptions;
     /** Access policy (secure by default). */
     permission?: "authenticatedOrReadOnly" | "authenticated" | "public";
+    /** Row-level security + physical tenant partitioning. */
+    access?: AccessOptions;
 }
 /**
  * A resource definition. `App`/`Model` are preserved as string-literal type

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.20",
+  "version": "0.0.22",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/provider/provider.tsx

@@ -23,6 +23,15 @@ import {
   seedFromIceberg,
   WarehousePersistence,
 } from "./warehouse";
+import {
+  CacheStorage,
+  defaultCacheStorage,
+  deleteIndexedDb,
+  httpFileSource,
+  IcebergFileCache,
+  isAccessRevoked,
+  purgeIdentityCache,
+} from "../cache";
 
 const RadContext = createContext<RadClient | null>(null);
 
@@ -45,12 +54,38 @@ export function RAStackProvider({
   const [status, setStatus] = useState<RadStatus>("idle");
   const engineRef = useRef<RadEngine | null>(null);
   const persistRef = useRef<(() => void) & { flush: () => void }>();
+  const cacheStorageRef = useRef<CacheStorage | null>(null);
 
   const setStatusSafe = (next: RadStatus) => {
     setStatus(next);
     config.onStatusChange?.(next);
   };
 
+  // Locally persisted state is namespaced per identity, so two accounts on
+  // one device never share bytes.
+  const warehouseDb = withIdentity(
+    config.databaseName || "rad-warehouse",
+    config.identity,
+  );
+
+  /** Delete everything this identity persisted locally. */
+  const purgeLocal = async () => {
+    if (cacheStorageRef.current) {
+      await purgeIdentityCache(cacheStorageRef.current, config.identity);
+    }
+    await deleteIndexedDb(warehouseDb);
+    // Replicated rows in the sync engine's store are derived from the same
+    // access — they go too.
+    await deleteIndexedDb(config.syncDatabaseName || "rad-sync");
+  };
+
+  /** Revocation entry point shared by automatic detection and app signals. */
+  const handleAccessRevoked = async () => {
+    await purgeLocal();
+    config.onAccessRevoked?.();
+    setStatusSafe("revoked");
+  };
+
   useEffect(() => {
     let cancelled = false;
     let ejectToken: number | undefined;
@@ -84,19 +119,51 @@ export function RAStackProvider({
       if (cancelled) return;
       const engine = createEngine(mod, config.manifest, config.openapi);
 
+      // Run the in-browser engine as the signed-in identity so owner stamping
+      // and row-level security match the server exactly.
+      if (config.identity) {
+        engine.setAuth?.(config.identity, config.groups ?? []);
+      }
+
       // Warehouse persistence: IndexedDB for `local`, an S3 sink for `s3`.
-      const persistence = pickPersistence(config);
+      const persistence = pickPersistence(config, warehouseDb);
 
       setStatusSafe("seeding");
-      // A persisted local copy (with the user's edits) wins; otherwise seed
-      // from the committed Iceberg warehouse — a directory of files walked over
-      // HTTP, not a blob.
-      const existing = await persistence.load();
-      if (existing) {
-        await engine.importWarehouse(existing);
-      } else {
-        const base = config.warehouseBaseUrl ?? "/data/warehouse/";
-        await seedFromIceberg(engine, base, manifestResources(config.manifest));
+      try {
+        // A persisted local copy (with the user's edits) wins; otherwise seed
+        // from the warehouse's own Iceberg files — through the local file
+        // cache by default, so a warm client revalidates one small pointer
+        // per table and reads everything else from the device.
+        const existing = await persistence.load();
+        if (existing) {
+          await engine.importWarehouse(existing);
+        } else {
+          const base = config.warehouseBaseUrl ?? "/data/warehouse/";
+          const resources = manifestResources(config.manifest);
+          if (config.cache === false) {
+            await seedFromIceberg(engine, base, resources);
+          } else {
+            const storage =
+              typeof config.cache === "object"
+                ? config.cache
+                : defaultCacheStorage();
+            cacheStorageRef.current = storage;
+            const cache = new IcebergFileCache({
+              storage,
+              source: config.fileSource ?? httpFileSource(base),
+              identity: config.identity,
+              maxOfflineMs: config.maxOfflineMs,
+            });
+            await cache.seed(engine, resources);
+          }
+        }
+      } catch (error) {
+        if (isAccessRevoked(error)) {
+          // Access is gone ⇒ so is every locally persisted byte it fetched.
+          await handleAccessRevoked();
+          return;
+        }
+        throw error;
       }
       if (cancelled) return;
 
@@ -127,7 +194,7 @@ export function RAStackProvider({
       engineRef.current = null;
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [config.mode, config.baseURL, config.warehouseBaseUrl]);
+  }, [config.mode, config.baseURL, config.warehouseBaseUrl, config.identity]);
 
   const client = useMemo<RadClient>(
     () => ({
@@ -149,14 +216,24 @@ export function RAStackProvider({
       async persistNow() {
         persistRef.current?.flush();
       },
+      async purgeLocal() {
+        await purgeLocal();
+      },
+      async reportAccessRevoked() {
+        await handleAccessRevoked();
+      },
     }),
-    [config.mode, status],
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+    [config.mode, status, config.identity],
   );
 
   return <RadContext.Provider value={client}>{children}</RadContext.Provider>;
 }
 
-function pickPersistence(config: RAStackProviderConfig): WarehouseSource {
+function pickPersistence(
+  config: RAStackProviderConfig,
+  databaseName: string,
+): WarehouseSource {
   if (config.mode === "s3") {
     if (!config.warehouse) {
       throw new Error(
@@ -168,10 +245,15 @@ function pickPersistence(config: RAStackProviderConfig): WarehouseSource {
   if (config.persist === false) {
     return { load: async () => null, save: async () => {} };
   }
-  const store = new WarehousePersistence(config.databaseName || "rad-warehouse");
+  const store = new WarehousePersistence(databaseName);
   return { load: () => store.load(), save: (blob) => store.save(blob) };
 }
 
+/** Suffix a local database/cache name with the identity that owns it. */
+function withIdentity(name: string, identity?: string): string {
+  return identity ? `${name}::${identity}` : name;
+}
+
 /** Access the imperative Rad client (engine, status, warehouse helpers). */
 export function useRadClient(): RadClient {
   const client = useContext(RadContext);

package/provider/types.ts

@@ -26,6 +26,12 @@ export interface RadEngine {
   seedFile(key: string, bytes: Uint8Array): Promise<void>;
   importWarehouse(blob: Uint8Array): Promise<void>;
   exportWarehouse(): Promise<Uint8Array>;
+  /**
+   * Run requests as a signed-in identity (Cognito `sub` + `cognito:groups`),
+   * so owner stamping / row-level security in the in-browser engine match the
+   * server. Optional for older engine bundles.
+   */
+  setAuth?(subject: string | undefined, groups?: string[]): void;
 }
 
 /** Constructor of the generated `RadApi` class. */
@@ -61,6 +67,35 @@ export interface RAStackProviderConfig {
   /** Attach a Bearer token to every request. */
   getToken?: () => string | Promise<string>;
 
+  // -- identity & local-data security (all modes) --
+  /**
+   * The signed-in identity — the verified Cognito `sub`. It namespaces every
+   * locally persisted byte (Iceberg file cache, warehouse snapshot DB), so
+   * accounts sharing a device can't read each other's data, and it is the
+   * subject the WASM engine stamps/filters owner rows with.
+   */
+  identity?: string;
+  /** Verified group claims (`cognito:groups`) for the WASM engine's auth. */
+  groups?: string[];
+  /**
+   * Fired when the data source reports this identity's access has been
+   * revoked (401/403/AccessDenied). By then the provider has already deleted
+   * the identity's local data; use this to route to sign-in.
+   */
+  onAccessRevoked?: () => void;
+  /**
+   * The sync engine's IndexedDB database (`rad-sync` by default) so
+   * revocation and `purgeLocal()` erase replicated rows too. Set to the same
+   * `databaseName` you pass the sync engine if you changed it.
+   */
+  syncDatabaseName?: string;
+  /**
+   * Offline-retention bound for the Iceberg file cache: cached data older
+   * than this without a successful access re-verification is deleted rather
+   * than served (`CacheExpiredError`). Unset = no bound.
+   */
+  maxOfflineMs?: number;
+
   // -- local / s3 mode --
   /** `schema.rad.json` — object or JSON string. Required for WASM modes. */
   manifest?: object | string;
@@ -78,6 +113,21 @@ export interface RAStackProviderConfig {
   persist?: boolean;
   /** IndexedDB database name for the local warehouse. */
   databaseName?: string;
+  /**
+   * Cache the warehouse's Iceberg files locally (IndexedDB on web; supply a
+   * `CacheStorage` for React Native) so repeat loads revalidate one tiny
+   * pointer per table and read everything else from the device. `false`
+   * disables caching; default on. Immutable Parquet/metadata files are cached
+   * forever by key — invalidation is driven by Iceberg's own snapshot pointer.
+   */
+  cache?: boolean | import("../cache").CacheStorage;
+  /**
+   * Where warehouse files are fetched from — defaults to HTTP GETs against
+   * `warehouseBaseUrl`. Supply a SigV4-signing source (AWS SDK S3 client over
+   * Cognito Identity Pool credentials) for `s3` mode. Must throw
+   * `AccessRevokedError` on 401/403 so revocation deletes local data.
+   */
+  fileSource?: import("../cache").WarehouseFileSource;
   /** `s3` mode: how to load/save the warehouse blob from object storage. */
   warehouse?: WarehouseSource;
   /**
@@ -97,6 +147,7 @@ export type RadStatus =
   | "loading" // fetching/instantiating the WASM engine
   | "seeding" // importing the warehouse
   | "ready"
+  | "revoked" // access revoked — local data has been deleted
   | "error";
 
 /** Imperative handle exposed via `useRadClient()`. */
@@ -111,4 +162,16 @@ export interface RadClient {
   downloadWarehouse(filename?: string): Promise<void>;
   /** Force-persist now (IndexedDB and/or the `s3` sink). */
   persistNow(): Promise<void>;
+  /**
+   * Delete everything this identity has persisted on the device — the Iceberg
+   * file cache, the warehouse snapshot DB, and the sync engine's DB. Call on
+   * sign-out; called automatically when the source reports access revoked.
+   */
+  purgeLocal(): Promise<void>;
+  /**
+   * Tell the provider access has been revoked (e.g. a Cognito refresh failed
+   * definitively in `remote` mode, where no seeding fetch would notice):
+   * purges local data, fires `onAccessRevoked`, sets status `revoked`.
+   */
+  reportAccessRevoked(): Promise<void>;
 }

package/runtime.ts

@@ -1,3 +1,4 @@
 export * from "./hooks";
 export * from "./types";
 export * from "./provider";
+export * from "./cache";

package/src/compile/analyze.ts

@@ -1,5 +1,6 @@
 import * as ts from "typescript";
 import {
+  AccessModel,
   AdminModel,
   FieldModel,
   RelationModel,
@@ -93,6 +94,7 @@ function analyzeResourceCall(
     search: options.search,
     ordering: options.ordering,
     permission: options.permission,
+    access: normaliseAccess(options.access),
   };
 }
 
@@ -215,6 +217,21 @@ function normaliseSync(sync: any): SyncModel | undefined {
   return model;
 }
 
+function normaliseAccess(access: any): AccessModel | undefined {
+  if (!access || typeof access !== "object") return undefined;
+  const model: AccessModel = {};
+  if (typeof access.ownerField === "string") model.ownerField = access.ownerField;
+  if (access.scope === "owner" || access.scope === "shared") {
+    model.scope = access.scope;
+  }
+  if (Array.isArray(access.adminGroups)) {
+    model.adminGroups = access.adminGroups.filter(
+      (g: unknown) => typeof g === "string",
+    );
+  }
+  return Object.keys(model).length ? model : undefined;
+}
+
 function normaliseAdmin(admin: any): AdminModel | false | undefined {
   if (admin === false) return false;
   if (!admin || typeof admin !== "object") return undefined;

package/src/compile/index.ts

@@ -17,16 +17,41 @@ export interface CompileResult {
   files: string[];
 }
 
-/** List every `.ts` resource file under a directory (or accept explicit files). */
+/** Directories never worth walking for resource definitions. */
+const IGNORE_DIRS = new Set([
+  "node_modules",
+  ".git",
+  ".expo",
+  ".rad",
+  "dist",
+  "web-build",
+]);
+
+/**
+ * Every `.ts` resource file under a directory (recursively), or an explicit
+ * file. Recursion is what lets resource definitions live **co-located with the
+ * pages that consume them** — e.g. `app/airports/_schema.rad.ts` beside
+ * `app/airports/index.tsx` — instead of in one top-level `resources/` folder.
+ * `.tsx` route components and `.d.ts` files are skipped; only files with a
+ * `resource(...)` call contribute to the manifest, so co-located helpers are
+ * harmless.
+ */
 export function resolveResourceFiles(input: string): string[] {
   const stat = fs.existsSync(input) ? fs.statSync(input) : undefined;
   if (stat?.isFile()) return [path.resolve(input)];
   if (stat?.isDirectory()) {
-    return fs
-      .readdirSync(input)
-      .filter((f) => f.endsWith(".ts") && !f.endsWith(".d.ts"))
-      .map((f) => path.resolve(input, f))
-      .sort();
+    const files: string[] = [];
+    const walk = (dir: string): void => {
+      for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+          if (!IGNORE_DIRS.has(entry.name)) walk(path.join(dir, entry.name));
+        } else if (entry.name.endsWith(".ts") && !entry.name.endsWith(".d.ts")) {
+          files.push(path.resolve(dir, entry.name));
+        }
+      }
+    };
+    walk(input);
+    return files.sort();
   }
   throw new Error(`No such resources path: ${input}`);
 }