Files

T

ekklesiaandClaude Sonnet 5 d3c6bd73d3 fix: enforce API request limits

Add a single platform-owned request-body policy (hono/body-limit) with
small, named limits for Better Auth and Core's grant-mutation endpoint, and
a new required maxBodyBytes field on the executable module route contract so
every module route makes a conscious no-body-or-bounded-body choice, capped
at a platform ceiling. Every oversized request gets one sanitized 413
contract and never reaches business logic, authorization, or a handler.
Also configure finite Node header/request/keep-alive timeouts, including the
non-obvious connectionsCheckingInterval needed for them to take effect
promptly, so a slow-header or slow-body connection cannot hold a socket
indefinitely.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

2026-07-26 12:29:24 -05:00

drizzle

feat: add module migration contracts and validation

2026-07-21 08:09:30 -05:00

src

fix: enforce API request limits

2026-07-26 12:29:24 -05:00

tests

fix: enforce API request limits

2026-07-26 12:29:24 -05:00

drizzle.config.ts

feat: add module migration contracts and validation

2026-07-21 08:09:30 -05:00

ekklesia.module.json

feat: declare module permissions

2026-07-24 12:25:00 -05:00

package.json

feat: add module migration contracts and validation

2026-07-21 08:09:30 -05:00

README.md

docs: document module database access

2026-07-25 21:50:03 -05:00

tsconfig.build.json

feat: add module contracts and discovery

2026-07-12 22:14:01 -05:00

tsconfig.json

feat: add module migration contracts and validation

2026-07-21 08:09:30 -05:00

README.md

Ekklesia module template

This is the smallest supported backend-only Ekklesia module. It proves the static manifest, compiled runtime and schema entrypoints, capability registration, a module-owned Drizzle table, a generated module-owned migration, logical storage-bucket declarations, and one permissioned HTTP route (GET /records, declared in register) that reads that table through context.services.database — the platform-provided ModuleDatabase facade, never a module-constructed Drizzle instance or a raw pg client. Migration execution and storage provisioning are intentionally not included.

To create a module inside this repository:

Copy this directory to modules/<module-id>.
Rename the package in package.json and remove private when it is ready for publication.
Update the ID, name, version, namespaces, compatibility ranges, and bucket requests in ekklesia.module.json.
Keep the manifest capability versions and dependency ranges aligned with the contracts the module actually implements and consumes.
Replace src/server/index.ts with backend behavior only. Its defineModuleRuntime ID and version must match the manifest; do not duplicate the rest of the manifest in TypeScript. Declare HTTP routes only in register, against a permission the manifest already declares; start, stop, and every route handler — never register — receive context.services.database, a typed ModuleDatabase view over the platform's one PostgreSQL pool.
Replace the pure Drizzle declarations in src/schema/tables.ts and keep its table prefix aligned with the module ID. Keep the defineModuleSchema ownership wrapper in src/schema/index.ts aligned too, and never import another module's schema.
Update drizzle.config.ts, generate forward migrations with pnpm migration:generate --name=lowercase_name from the module directory, and review the SQL. Keep each generated tag in drizzle/meta/_ekklesia.json, classify it as none or approval-required, and change that file's moduleId when renaming the template.
Run pnpm install, pnpm build, pnpm modules:validate, pnpm migrations:validate, and pnpm verify from the repository root. The declared production entrypoint is the compiled dist/server/index.js, not source TypeScript; the schema entrypoint is likewise compiled to dist/schema/index.js.

Do not add UI components, styles, renderers, navigation, or layouts. Those belong to surfaces. Keep imports side-effect-free, register capabilities in register, acquire resources in start, and release them in stop. Never construct a Drizzle instance, read DATABASE_URL, or reach for a raw pg client — context.services.database is the only supported way to query this module's own tables, and it is never available during register.

The migration directory uses the pinned stable Drizzle Kit 0.31.10 PostgreSQL journal and snapshot format. Migrations are forward-only and may modify only this module's objects. Offline validation treats SQL as opaque bytes, calculates SHA-256 from the exact contents, and never opens a database or executes SQL. Destructive declarations are review metadata, not automatic SQL classification or approval.