@abraca/nuxt 2.4.0 → 2.5.1

package/dist/runtime/components/shell/AWelcomeScreen.vue

@@ -4,7 +4,25 @@ const open = defineModel("open", { type: Boolean, ...{ default: true } });
 const props = defineProps({
   userName: { type: String, required: false, default: "" },
   avatarStyle: { type: String, required: false, default: "" },
-  colors: { type: Array, required: false, default: () => ["red", "orange", "amber", "yellow", "lime", "green", "emerald", "teal", "cyan", "sky", "blue", "indigo", "violet", "purple", "fuchsia", "pink", "rose"] },
+  colors: { type: Array, required: false, default: () => [
+    "red",
+    "orange",
+    "amber",
+    "yellow",
+    "lime",
+    "green",
+    "emerald",
+    "teal",
+    "cyan",
+    "sky",
+    "blue",
+    "indigo",
+    "violet",
+    "purple",
+    "fuchsia",
+    "pink",
+    "rose"
+  ] },
   neutrals: { type: Array, required: false, default: () => ["slate", "gray", "zinc", "neutral", "stone"] },
   currentColor: { type: String, required: false, default: "blue" },
   currentNeutral: { type: String, required: false, default: "zinc" },
@@ -49,11 +67,14 @@ function connectToServer() {
   if (!raw) return;
   emit("connect-server", raw);
 }
-watch(() => props.connecting, (val, prev) => {
-  if (prev && !val && !props.connectionError && step.value === "server") {
-    step.value = "done";
+watch(
+  () => props.connecting,
+  (val, prev) => {
+    if (prev && !val && !props.connectionError && step.value === "server") {
+      step.value = "done";
+    }
   }
-});
+);
 </script>
 
 <template>
@@ -74,10 +95,7 @@ watch(() => props.connecting, (val, prev) => {
   >
     <template #body>
       <div class="flex flex-col gap-6">
-        <Transition
-          name="step-fade"
-          mode="out-in"
-        >
+        <Transition name="step-fade" mode="out-in">
           <!-- ── Step 1: Identity ────────────────────────────── -->
           <div
             v-if="step === 'identity'"
@@ -93,10 +111,10 @@ watch(() => props.connecting, (val, prev) => {
                 />
               </slot>
               <div class="flex flex-col items-center gap-1">
-                <h2 class="text-xl font-bold text-(--ui-text-highlighted) tracking-tight">
-                  <slot name="title">
-                    Welcome
-                  </slot>
+                <h2
+                  class="text-xl font-bold text-(--ui-text-highlighted) tracking-tight"
+                >
+                  <slot name="title"> Welcome </slot>
                 </h2>
                 <p class="text-sm text-(--ui-text-muted)">
                   <slot name="subtitle">
@@ -126,18 +144,18 @@ watch(() => props.connecting, (val, prev) => {
 
             <!-- Color picker -->
             <div class="flex flex-col items-center gap-2">
-              <p class="text-xs font-medium text-(--ui-text-muted) uppercase tracking-wide">
+              <p
+                class="text-xs font-medium text-(--ui-text-muted) uppercase tracking-wide"
+              >
                 Choose your color
               </p>
               <div class="flex flex-wrap justify-center gap-1.5 max-w-78">
-                <UTooltip
-                  v-for="color in colors"
-                  :key="color"
-                  :text="color"
-                >
+                <UTooltip v-for="color in colors" :key="color" :text="color">
                   <button
                     class="w-5 h-5 rounded-full ring-2 ring-offset-1 ring-offset-(--ui-bg) transition-all duration-150 hover:scale-110 focus:outline-none"
-                    :class="currentColor === color ? 'ring-current scale-110' : 'ring-transparent'"
+                    :class="
+  currentColor === color ? 'ring-current scale-110' : 'ring-transparent'
+"
                     :style="{ background: `var(--color-${color}-400)` }"
                     @click="emit('set-color', color)"
                   />
@@ -147,18 +165,18 @@ watch(() => props.connecting, (val, prev) => {
 
             <!-- Neutral color picker -->
             <div class="flex flex-col items-center gap-2">
-              <p class="text-xs font-medium text-(--ui-text-muted) uppercase tracking-wide">
+              <p
+                class="text-xs font-medium text-(--ui-text-muted) uppercase tracking-wide"
+              >
                 Choose your neutral
               </p>
               <div class="flex flex-wrap justify-center gap-1.5 max-w-78">
-                <UTooltip
-                  v-for="color in neutrals"
-                  :key="color"
-                  :text="color"
-                >
+                <UTooltip v-for="color in neutrals" :key="color" :text="color">
                   <button
                     class="w-5 h-5 rounded-full ring-2 ring-offset-1 ring-offset-(--ui-bg) transition-all duration-150 hover:scale-110 focus:outline-none"
-                    :class="currentNeutral === color ? 'ring-current scale-110' : 'ring-transparent'"
+                    :class="
+  currentNeutral === color ? 'ring-current scale-110' : 'ring-transparent'
+"
                     :style="{ background: `var(--color-${color}-400)` }"
                     @click="emit('set-neutral', color)"
                   />
@@ -188,13 +206,11 @@ watch(() => props.connecting, (val, prev) => {
             class="flex flex-col gap-6"
           >
             <div class="flex flex-col items-center text-center gap-4 pt-4">
-              <UAvatar
-                :alt="displayName"
-                size="lg"
-                :style="avatarStyle"
-              />
+              <UAvatar :alt="displayName" size="lg" :style="avatarStyle" />
               <div class="flex flex-col items-center gap-1">
-                <h2 class="text-xl font-bold text-(--ui-text-highlighted) tracking-tight">
+                <h2
+                  class="text-xl font-bold text-(--ui-text-highlighted) tracking-tight"
+                >
                   How would you like to get started?
                 </h2>
                 <p class="text-sm text-(--ui-text-muted)">
@@ -213,8 +229,13 @@ watch(() => props.connecting, (val, prev) => {
                   class="size-5 text-(--ui-text-muted) group-hover:text-(--color-primary-500) transition-colors"
                 />
                 <div class="flex flex-col gap-0.5">
-                  <span class="text-xs font-semibold text-(--ui-text-highlighted) leading-tight">Start locally</span>
-                  <span class="text-[11px] text-(--ui-text-muted) leading-snug">No server needed</span>
+                  <span
+                    class="text-xs font-semibold text-(--ui-text-highlighted) leading-tight"
+                    >Start locally</span
+                  >
+                  <span class="text-[11px] text-(--ui-text-muted) leading-snug"
+                    >No server needed</span
+                  >
                 </div>
               </button>
 
@@ -227,12 +248,17 @@ watch(() => props.connecting, (val, prev) => {
                 @click="step = 'server'"
               >
                 <UIcon
-                  name="i-lucide-server"
+                  name="i-lucide-hexagon"
                   class="size-5 text-(--ui-text-muted) group-hover:text-(--color-primary-500) transition-colors"
                 />
                 <div class="flex flex-col gap-0.5">
-                  <span class="text-xs font-semibold text-(--ui-text-highlighted) leading-tight">Self-hosted</span>
-                  <span class="text-[11px] text-(--ui-text-muted) leading-snug">Your infrastructure</span>
+                  <span
+                    class="text-xs font-semibold text-(--ui-text-highlighted) leading-tight"
+                    >Self-hosted</span
+                  >
+                  <span class="text-[11px] text-(--ui-text-muted) leading-snug"
+                    >Your infrastructure</span
+                  >
                 </div>
               </button>
             </div>
@@ -254,7 +280,9 @@ watch(() => props.connecting, (val, prev) => {
                 />
               </slot>
               <div class="flex flex-col items-center gap-1">
-                <h2 class="text-xl font-bold text-(--ui-text-highlighted) tracking-tight">
+                <h2
+                  class="text-xl font-bold text-(--ui-text-highlighted) tracking-tight"
+                >
                   Connect to server
                 </h2>
                 <p class="text-sm text-(--ui-text-muted)">
@@ -307,12 +335,10 @@ watch(() => props.connecting, (val, prev) => {
             <!-- Already claimed or just claimed -->
             <template v-if="isClaimed || claimSuccess">
               <div class="relative">
-                <UAvatar
-                  :alt="displayName"
-                  size="2xl"
-                  :style="avatarStyle"
-                />
-                <div class="absolute -bottom-1 -right-1 rounded-full p-0.5 bg-(--ui-color-success-500)">
+                <UAvatar :alt="displayName" size="2xl" :style="avatarStyle" />
+                <div
+                  class="absolute -bottom-1 -right-1 rounded-full p-0.5 bg-(--ui-color-success-500)"
+                >
                   <UIcon
                     name="i-lucide-shield-check"
                     class="text-white size-4"
@@ -328,9 +354,7 @@ watch(() => props.connecting, (val, prev) => {
                   <template v-if="claimSuccess">
                     Your identity is now hardware-bound, {{ displayName }}
                   </template>
-                  <template v-else>
-                    Welcome back, {{ displayName }}
-                  </template>
+                  <template v-else> Welcome back, {{ displayName }} </template>
                 </p>
               </div>
 
@@ -347,16 +371,11 @@ watch(() => props.connecting, (val, prev) => {
             <!-- Default: offer passkey -->
             <template v-else>
               <div class="relative">
-                <UAvatar
-                  :alt="displayName"
-                  size="2xl"
-                  :style="avatarStyle"
-                />
-                <div class="absolute -bottom-1 -right-1 rounded-full p-0.5 bg-(--ui-color-success-500)">
-                  <UIcon
-                    name="i-lucide-check"
-                    class="text-white size-4"
-                  />
+                <UAvatar :alt="displayName" size="2xl" :style="avatarStyle" />
+                <div
+                  class="absolute -bottom-1 -right-1 rounded-full p-0.5 bg-(--ui-color-success-500)"
+                >
+                  <UIcon name="i-lucide-check" class="text-white size-4" />
                 </div>
               </div>
 

package/dist/runtime/components/shell/AWelcomeScreen.vue.d.ts

@@ -35,7 +35,7 @@ type __VLS_ModelProps = {
      * Ported from cou-sh/app/components/WelcomeScreen.vue — decoupled from
      * useAbracadabra, useSpaceRegistry, and all app-specific modals.
      */
-    'open'?: boolean;
+    "open"?: boolean;
 };
 type __VLS_PublicProps = __VLS_Props & __VLS_ModelProps;
 declare var __VLS_15: {}, __VLS_22: {}, __VLS_24: {}, __VLS_57: {}, __VLS_69: {}, __VLS_76: {}, __VLS_78: {};
@@ -55,8 +55,8 @@ type __VLS_Slots = {} & {
     logo?: (props: typeof __VLS_78) => any;
 };
 declare const __VLS_base: import("vue").DefineComponent<__VLS_PublicProps, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {
-    done: () => any;
     "update:open": (value: boolean) => any;
+    done: () => any;
     "set-name": (name: string) => any;
     "set-color": (color: string) => any;
     "set-neutral": (color: string) => any;
@@ -64,8 +64,8 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_PublicProps, {}, {
     "connect-server": (url: string) => any;
     "claim-passkey": () => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_PublicProps> & Readonly<{
-    onDone?: (() => any) | undefined;
     "onUpdate:open"?: ((value: boolean) => any) | undefined;
+    onDone?: (() => any) | undefined;
     "onSet-name"?: ((name: string) => any) | undefined;
     "onSet-color"?: ((color: string) => any) | undefined;
     "onSet-neutral"?: ((color: string) => any) | undefined;
@@ -74,9 +74,9 @@ declare const __VLS_base: import("vue").DefineComponent<__VLS_PublicProps, {}, {
     "onClaim-passkey"?: (() => any) | undefined;
 }>, {
     connecting: boolean;
+    isClaimed: boolean;
     userName: string;
     currentColor: string;
-    isClaimed: boolean;
     avatarStyle: string;
     connectionError: string;
     colors: string[];

package/dist/runtime/composables/useAbraAdmin.d.ts

@@ -1,9 +1,14 @@
 /**
  * useAbraAdmin
  *
- * Admin-only composable. Wraps the `/admin/*` REST endpoints (audit log,
- * backup dump, user lockout). All methods reject with `Error('not admin')`
- * when `isAdmin` is false — UI should gate route entry on the same flag.
+ * Admin-only composable. Typed facade over the full `/admin/*` REST
+ * surface (users, audit, storage, uploads, runtime config, backup).
+ * Every method rejects with the server error when the caller lacks an
+ * elevated role — UI should still gate route entry on `isAdmin`.
+ *
+ * This is the single typed entry point for admin tooling (e.g.
+ * abracadabra-arcana). Consumers must never reach for
+ * `client as any` — if a method is missing here, add it here.
  *
  * Usage:
  *   const admin = useAbraAdmin()
@@ -11,11 +16,95 @@
  *     const rows = await admin.auditList({ event_type: 'auth.login_failed' })
  *   }
  */
-import type { AuditLogEntry, AuditQueryOpts, AuditVerifyResult } from '@abraca/dabra';
+import type { AdminConfigField, AuditLogEntry, AuditQueryOpts, AuditVerifyResult, EnvSnapshotResponse, UserProfile } from '@abraca/dabra';
+/** One row from `GET /admin/users` — a profile plus admin-only fields. */
+export type AdminUserRow = UserProfile & {
+    revoked: boolean;
+    deviceKeys: string[];
+};
+/** One row from `GET /admin/uploads` (uploads ⨝ documents ⨝ file_blobs). */
+export interface AdminUploadRow {
+    id: string;
+    doc_id: string;
+    doc_label: string | null;
+    filename: string;
+    mime_type: string | null;
+    size: number | null;
+    content_hash: string | null;
+    /** Number of uploads pointing at the same content-addressed blob. */
+    ref_count: number | null;
+    owner_id: string;
+    created_at: number;
+}
+/** `GET /admin/uploads` response. */
+export interface AdminUploadList {
+    uploads: AdminUploadRow[];
+    total: number;
+}
+/** One document a user owns or has an explicit grant on
+ *  (`GET /admin/users/:id/docs`). Label is best-effort (CRDT-resident). */
+export interface AdminUserDocRow {
+    id: string;
+    label: string | null;
+    kind: string | null;
+    doc_type: string | null;
+    parent_id: string | null;
+    source: 'owner' | 'grant';
+    role: string | null;
+}
+/** `GET /admin/storage/stats` — aggregate storage figures. */
+export interface AdminStorageStats {
+    uploadCount: number;
+    blobCount: number;
+    /** Sum of upload sizes as users see them. */
+    logicalBytes: number;
+    /** On-disk after content-addressed dedup. */
+    physicalBytes: number;
+    /** `logicalBytes - physicalBytes`. */
+    dedupSaved: number;
+}
 declare function auditList(opts?: AuditQueryOpts): Promise<AuditLogEntry[]>;
 declare function auditExport(opts?: Omit<AuditQueryOpts, 'limit' | 'offset'>): Promise<string>;
 declare function auditVerify(): Promise<AuditVerifyResult>;
+declare function listUsers(): Promise<AdminUserRow[]>;
+declare function promoteUser(userId: string): Promise<void>;
+declare function demoteUser(userId: string): Promise<void>;
 declare function unlockUser(userId: string): Promise<void>;
+declare function userDocs(userId: string, opts?: {
+    limit?: number;
+}): Promise<AdminUserDocRow[]>;
+declare function listUploads(opts?: {
+    q?: string;
+    docId?: string;
+    limit?: number;
+    offset?: number;
+}): Promise<AdminUploadList>;
+declare function storageStats(): Promise<AdminStorageStats>;
+declare function storageSweep(): Promise<{
+    blobsDeleted: number;
+}>;
+declare function storageRepair(): Promise<{
+    refCountsRepaired: number;
+    blobsSwept: number;
+}>;
+declare function snapshotsBackfillRefs(): Promise<{
+    snapshotsScanned: number;
+    refsWritten: number;
+}>;
+declare function snapshotsBackfillBlobs(): Promise<{
+    snapshotsMigrated: number;
+    blobsAfter: number;
+    totalBytesAfter: number;
+}>;
+declare function configList(): Promise<AdminConfigField[]>;
+declare function configGet(path: string): Promise<AdminConfigField>;
+declare function configSet(path: string, value: unknown): Promise<AdminConfigField>;
+declare function configUnset(path: string): Promise<boolean>;
+declare function configEnvSnapshot(): Promise<EnvSnapshotResponse>;
+declare function configListRoutes(): Promise<string[]>;
+declare function configGetRoute(route: string, path: string): Promise<AdminConfigField>;
+declare function configSetRoute(route: string, path: string, value: unknown): Promise<AdminConfigField>;
+declare function configUnsetRoute(route: string, path: string): Promise<boolean>;
 declare function backupDump(opts?: {
     includeAudit?: boolean;
 }): Promise<Blob>;
@@ -44,8 +133,46 @@ export declare function useAbraAdmin(): {
     auditExport: typeof auditExport;
     /** GET /admin/audit/verify — returns the result whether ok or broken. */
     auditVerify: typeof auditVerify;
+    /** GET /admin/users — profiles + revoked + device keys + effective role. */
+    listUsers: typeof listUsers;
+    /** POST /admin/users/:id/admin (service identity only). */
+    promoteUser: typeof promoteUser;
+    /** DELETE /admin/users/:id/admin (service identity only). */
+    demoteUser: typeof demoteUser;
     /** POST /admin/users/:id/unlock. */
     unlockUser: typeof unlockUser;
+    /** GET /admin/users/:id/docs — owned + explicitly-granted docs. */
+    userDocs: typeof userDocs;
+    /** GET /admin/uploads — paginated/filterable, with dedup ref counts. */
+    listUploads: typeof listUploads;
+    /** GET /admin/storage/stats. */
+    storageStats: typeof storageStats;
+    /** POST /admin/storage/sweep — GC orphaned blobs. */
+    storageSweep: typeof storageSweep;
+    /** POST /admin/storage/repair — repair ref-counts + sweep. */
+    storageRepair: typeof storageRepair;
+    /** POST /admin/snapshots/backfill-refs — populate snapshot_files. */
+    snapshotsBackfillRefs: typeof snapshotsBackfillRefs;
+    /** POST /admin/snapshots/backfill-blobs — migrate to dedup store. */
+    snapshotsBackfillBlobs: typeof snapshotsBackfillBlobs;
+    /** GET /admin/config. */
+    configList: typeof configList;
+    /** GET /admin/config/fields/:path. */
+    configGet: typeof configGet;
+    /** PUT /admin/config/fields/:path. */
+    configSet: typeof configSet;
+    /** DELETE /admin/config/fields/:path — revert to base. */
+    configUnset: typeof configUnset;
+    /** GET /admin/config/env-snapshot. */
+    configEnvSnapshot: typeof configEnvSnapshot;
+    /** GET /admin/config/routes — routes with ≥1 override. */
+    configListRoutes: typeof configListRoutes;
+    /** GET /admin/config/routes/:route/fields/:path. */
+    configGetRoute: typeof configGetRoute;
+    /** PUT /admin/config/routes/:route/fields/:path. */
+    configSetRoute: typeof configSetRoute;
+    /** DELETE /admin/config/routes/:route/fields/:path. */
+    configUnsetRoute: typeof configUnsetRoute;
     /** GET /admin/backup/dump — returns the tar Blob. */
     backupDump: typeof backupDump;
     /** Convenience: backupDump + browser download. */

package/dist/runtime/composables/useAbraAdmin.js

@@ -13,62 +13,119 @@ function _client() {
 function _isAdminRole(role) {
   return role === "admin" || role === "service" || role === "owner";
 }
-async function auditList(opts) {
-  const { client } = _client();
+async function _run(label, fn) {
   isLoading.value = true;
   error.value = null;
   try {
-    const rows = await client.adminAuditList(opts);
-    auditEntries.value = rows;
-    return rows;
+    return await fn();
   } catch (e) {
-    error.value = e instanceof Error ? e.message : "Failed to load audit log";
+    error.value = e instanceof Error ? e.message : label;
     throw e;
   } finally {
     isLoading.value = false;
   }
 }
+async function auditList(opts) {
+  const { client } = _client();
+  const rows = await _run("Failed to load audit log", () => client.adminAuditList(opts));
+  auditEntries.value = rows;
+  return rows;
+}
 async function auditExport(opts) {
   const { client } = _client();
-  error.value = null;
-  try {
-    return await client.adminAuditExport(opts);
-  } catch (e) {
-    error.value = e instanceof Error ? e.message : "Failed to export audit log";
-    throw e;
-  }
+  return _run("Failed to export audit log", () => client.adminAuditExport(opts));
 }
 async function auditVerify() {
   const { client } = _client();
-  error.value = null;
-  try {
-    const result = await client.adminAuditVerify();
-    auditVerifyResult.value = result;
-    return result;
-  } catch (e) {
-    error.value = e instanceof Error ? e.message : "Audit verification failed";
-    throw e;
-  }
+  const result = await _run("Audit verification failed", () => client.adminAuditVerify());
+  auditVerifyResult.value = result;
+  return result;
+}
+async function listUsers() {
+  const { client } = _client();
+  const res = await _run("Failed to load users", () => client.adminListUsers());
+  return res?.users ?? [];
+}
+async function promoteUser(userId) {
+  const { client } = _client();
+  await _run("Failed to promote user", () => client.adminPromote(userId));
+}
+async function demoteUser(userId) {
+  const { client } = _client();
+  await _run("Failed to demote user", () => client.adminDemote(userId));
 }
 async function unlockUser(userId) {
   const { client } = _client();
-  error.value = null;
-  try {
-    await client.adminUnlockUser(userId);
-  } catch (e) {
-    error.value = e instanceof Error ? e.message : "Failed to unlock user";
-    throw e;
-  }
+  await _run("Failed to unlock user", () => client.adminUnlockUser(userId));
+}
+async function userDocs(userId, opts = {}) {
+  const { client } = _client();
+  const res = await _run("Failed to load user documents", () => client.adminUserDocs(userId, opts));
+  return res?.docs ?? [];
+}
+async function listUploads(opts = {}) {
+  const { client } = _client();
+  return _run("Failed to load uploads", () => client.adminListUploads(opts));
+}
+async function storageStats() {
+  const { client } = _client();
+  return _run("Failed to load storage stats", () => client.adminStorageStats());
+}
+async function storageSweep() {
+  const { client } = _client();
+  return _run("Storage sweep failed", () => client.adminStorageSweep());
+}
+async function storageRepair() {
+  const { client } = _client();
+  return _run("Storage repair failed", () => client.adminStorageRepair());
+}
+async function snapshotsBackfillRefs() {
+  const { client } = _client();
+  return _run("Snapshot ref backfill failed", () => client.adminSnapshotsBackfillRefs());
+}
+async function snapshotsBackfillBlobs() {
+  const { client } = _client();
+  return _run("Snapshot blob backfill failed", () => client.adminSnapshotsBackfillBlobs());
+}
+async function configList() {
+  const { client } = _client();
+  return _run("Failed to load config", () => client.adminConfigList());
+}
+async function configGet(path) {
+  const { client } = _client();
+  return _run(`Failed to read ${path}`, () => client.adminConfigGet(path));
+}
+async function configSet(path, value) {
+  const { client } = _client();
+  return _run(`Failed to set ${path}`, () => client.adminConfigSet(path, value));
+}
+async function configUnset(path) {
+  const { client } = _client();
+  return _run(`Failed to reset ${path}`, () => client.adminConfigUnset(path));
+}
+async function configEnvSnapshot() {
+  const { client } = _client();
+  return _run("Failed to load env snapshot", () => client.adminConfigEnvSnapshot());
+}
+async function configListRoutes() {
+  const { client } = _client();
+  return _run("Failed to load route overrides", () => client.adminConfigListRoutes());
+}
+async function configGetRoute(route, path) {
+  const { client } = _client();
+  return _run(`Failed to read ${path} for ${route}`, () => client.adminConfigGetRoute(route, path));
+}
+async function configSetRoute(route, path, value) {
+  const { client } = _client();
+  return _run(`Failed to set ${path} for ${route}`, () => client.adminConfigSetRoute(route, path, value));
+}
+async function configUnsetRoute(route, path) {
+  const { client } = _client();
+  return _run(`Failed to clear ${path} for ${route}`, () => client.adminConfigUnsetRoute(route, path));
 }
 async function backupDump(opts) {
   const { client } = _client();
-  error.value = null;
-  try {
-    return await client.adminBackupDump(opts);
-  } catch (e) {
-    error.value = e instanceof Error ? e.message : "Backup dump failed";
-    throw e;
-  }
+  return _run("Backup dump failed", () => client.adminBackupDump(opts));
 }
 async function downloadBackup(opts) {
   const { abra } = _client();
@@ -99,14 +156,57 @@ export function useAbraAdmin() {
     isLoading,
     /** Last error message, or null. */
     error,
+    /* Audit */
     /** GET /admin/audit. */
     auditList,
     /** GET /admin/audit/export — returns NDJSON as a string. */
     auditExport,
     /** GET /admin/audit/verify — returns the result whether ok or broken. */
     auditVerify,
+    /* Users */
+    /** GET /admin/users — profiles + revoked + device keys + effective role. */
+    listUsers,
+    /** POST /admin/users/:id/admin (service identity only). */
+    promoteUser,
+    /** DELETE /admin/users/:id/admin (service identity only). */
+    demoteUser,
     /** POST /admin/users/:id/unlock. */
     unlockUser,
+    /** GET /admin/users/:id/docs — owned + explicitly-granted docs. */
+    userDocs,
+    /* Storage & uploads */
+    /** GET /admin/uploads — paginated/filterable, with dedup ref counts. */
+    listUploads,
+    /** GET /admin/storage/stats. */
+    storageStats,
+    /** POST /admin/storage/sweep — GC orphaned blobs. */
+    storageSweep,
+    /** POST /admin/storage/repair — repair ref-counts + sweep. */
+    storageRepair,
+    /** POST /admin/snapshots/backfill-refs — populate snapshot_files. */
+    snapshotsBackfillRefs,
+    /** POST /admin/snapshots/backfill-blobs — migrate to dedup store. */
+    snapshotsBackfillBlobs,
+    /* Runtime config */
+    /** GET /admin/config. */
+    configList,
+    /** GET /admin/config/fields/:path. */
+    configGet,
+    /** PUT /admin/config/fields/:path. */
+    configSet,
+    /** DELETE /admin/config/fields/:path — revert to base. */
+    configUnset,
+    /** GET /admin/config/env-snapshot. */
+    configEnvSnapshot,
+    /** GET /admin/config/routes — routes with ≥1 override. */
+    configListRoutes,
+    /** GET /admin/config/routes/:route/fields/:path. */
+    configGetRoute,
+    /** PUT /admin/config/routes/:route/fields/:path. */
+    configSetRoute,
+    /** DELETE /admin/config/routes/:route/fields/:path. */
+    configUnsetRoute,
+    /* Backup */
     /** GET /admin/backup/dump — returns the tar Blob. */
     backupDump,
     /** Convenience: backupDump + browser download. */