@adminiumjs/adminium 0.1.0-rc.1

package/dist/realtime/ws.js

@@ -0,0 +1,124 @@
+/**
+ * WebSocket gateway `GET /ws` (08-server-api.md §3, M2-T07). JSON frames:
+ *
+ *   client → server: { op: "subscribe" | "unsubscribe", channel } | { op: "ping" }
+ *   server → client: { channel, type, data, ts } events,
+ *                    { op: "pong" } | { op: "subscribed" | "unsubscribed", channel }
+ *                    | { op: "error", code, channel? }
+ *
+ * (`sub`/`unsub` are accepted as aliases per the §3 protocol sketch.)
+ * Unauthenticated upgrades are rejected pre-handshake; channel authorization
+ * runs at subscribe time via `authorizeChannel`. Hygiene: protocol-level ping
+ * every 30 s (dropped after 2 missed pongs), ≤ 64 channels per socket.
+ *
+ * The `@fastify/websocket` plugin must be registered before this route —
+ * `registerJobsAndRealtime` (jobs/register.ts) does both.
+ */
+import { UnauthorizedError } from '../errors.js';
+import { authorizeChannel, } from './hub.js';
+/** Max concurrent channel subscriptions per socket. */
+export const WS_MAX_CHANNELS = 64;
+/** Protocol-level heartbeat interval. */
+export const WS_HEARTBEAT_INTERVAL_MS = 30_000;
+/** Heartbeats without a pong before the socket is dropped. */
+export const WS_MAX_MISSED_PONGS = 2;
+/** Registers `GET /ws`. Call after `app.register(websocket)`. */
+export function registerWsRoute(app, deps) {
+    const users = new WeakMap();
+    const heartbeatMs = deps.heartbeatIntervalMs ?? WS_HEARTBEAT_INTERVAL_MS;
+    app.get('/ws', {
+        websocket: true,
+        // Runs before the upgrade completes — a thrown 401 rejects the
+        // handshake with the standard error envelope (§3 "pre-handshake").
+        preValidation: async (request) => {
+            const user = await deps.resolveUser(request);
+            if (user === null)
+                throw new UnauthorizedError();
+            users.set(request, user);
+        },
+    }, (socket, request) => {
+        const user = users.get(request);
+        if (user === undefined) {
+            socket.close(1011, 'no session');
+            return;
+        }
+        const subscriptions = new Map();
+        const send = (frame) => {
+            if (socket.readyState === socket.OPEN)
+                socket.send(JSON.stringify(frame));
+        };
+        // --- heartbeat -------------------------------------------------------------
+        let missedPongs = 0;
+        socket.on('pong', () => {
+            missedPongs = 0;
+        });
+        const heartbeat = setInterval(() => {
+            if (missedPongs >= WS_MAX_MISSED_PONGS) {
+                socket.terminate();
+                return;
+            }
+            missedPongs += 1;
+            socket.ping();
+        }, heartbeatMs);
+        heartbeat.unref?.();
+        // --- protocol --------------------------------------------------------------
+        const onFrame = async (raw) => {
+            let frame;
+            try {
+                frame = JSON.parse(String(raw));
+            }
+            catch {
+                send({ op: 'error', code: 'VALIDATION_FAILED', message: 'frames must be JSON objects' });
+                return;
+            }
+            const op = frame.op;
+            if (op === 'ping') {
+                send({ op: 'pong' });
+                return;
+            }
+            if (op !== 'subscribe' && op !== 'sub' && op !== 'unsubscribe' && op !== 'unsub') {
+                send({ op: 'error', code: 'VALIDATION_FAILED', message: 'unknown op' });
+                return;
+            }
+            const channel = frame.channel;
+            if (typeof channel !== 'string' || channel.length === 0) {
+                send({ op: 'error', code: 'VALIDATION_FAILED', message: 'channel required' });
+                return;
+            }
+            if (op === 'unsubscribe' || op === 'unsub') {
+                subscriptions.get(channel)?.();
+                subscriptions.delete(channel);
+                send({ op: 'unsubscribed', channel });
+                return;
+            }
+            // subscribe
+            if (subscriptions.has(channel)) {
+                send({ op: 'subscribed', channel });
+                return;
+            }
+            if (subscriptions.size >= WS_MAX_CHANNELS) {
+                send({ op: 'error', code: 'LIMIT_EXCEEDED', channel });
+                return;
+            }
+            if (!(await authorizeChannel(user, channel, deps))) {
+                send({ op: 'error', code: 'FORBIDDEN', channel });
+                return;
+            }
+            subscriptions.set(channel, deps.hub.subscribe(channel, (event) => send(event)));
+            send({ op: 'subscribed', channel });
+        };
+        socket.on('message', (raw) => {
+            void onFrame(raw).catch((err) => {
+                request.log.error({ err }, 'ws frame handling failed');
+                send({ op: 'error', code: 'INTERNAL' });
+            });
+        });
+        socket.on('close', () => {
+            clearInterval(heartbeat);
+            for (const unsubscribe of subscriptions.values())
+                unsubscribe();
+            subscriptions.clear();
+        });
+    });
+}
+//# sourceMappingURL=ws.js.map

package/dist/realtime/ws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws.js","sourceRoot":"","sources":["../../src/realtime/ws.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAKH,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EACL,gBAAgB,GAIjB,MAAM,UAAU,CAAC;AAElB,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,yCAAyC;AACzC,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAmBrC,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,GAAoB,EAAE,IAAyB;IAC7E,MAAM,KAAK,GAAG,IAAI,OAAO,EAAgC,CAAC;IAC1D,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,IAAI,wBAAwB,CAAC;IAEzE,GAAG,CAAC,GAAG,CACL,KAAK,EACL;QACE,SAAS,EAAE,IAAI;QACf,+DAA+D;QAC/D,mEAAmE;QACnE,aAAa,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,IAAI,KAAK,IAAI;gBAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;YACjD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3B,CAAC;KACF,EACD,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QAClB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,GAAG,EAAsB,CAAC;QACpD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAQ,EAAE;YACpC,IAAI,MAAM,CAAC,UAAU,KAAK,MAAM,CAAC,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,CAAC,CAAC;QAEF,8EAA8E;QAC9E,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACrB,WAAW,GAAG,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,WAAW,IAAI,mBAAmB,EAAE,CAAC;gBACvC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,WAAW,IAAI,CAAC,CAAC;YACjB,MAAM,CAAC,IAAI,EAAE,CAAC;QAChB,CAAC,EAAE,WAAW,CAAC,CAAC;QAChB,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;QAEpB,8EAA8E;QAC9E,MAAM,OAAO,GAAG,KAAK,EAAE,GAAY,EAAiB,EAAE;YACpD,IAAI,KAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAgB,CAAC;YACjD,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;gBACzF,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YAEpB,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,aAAa,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;gBACjF,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;gBACxE,OAAO;YACT,CAAC;YAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;YAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxD,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC9E,OAAO;YACT,CAAC;YAED,IAAI,EAAE,KAAK,aAAa,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC3C,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAC/B,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC,EAAE,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YAED,YAAY;YACZ,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YACD,IAAI,aAAa,CAAC,IAAI,IAAI,eAAe,EAAE,CAAC;gBAC1C,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,CAAC;gBACvD,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACnD,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YACD,aAAa,CAAC,GAAG,CACf,OAAO,EACP,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACpD,CAAC;YACF,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC;QACtC,CAAC,CAAC;QAEF,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAY,EAAE,EAAE;YACpC,KAAK,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACvC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,0BAA0B,CAAC,CAAC;gBACvD,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1C,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACtB,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,KAAK,MAAM,WAAW,IAAI,aAAa,CAAC,MAAM,EAAE;gBAAE,WAAW,EAAE,CAAC;YAChE,aAAa,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/reports/schedule.d.ts

@@ -0,0 +1,14 @@
+import type { ReportSchedule } from '@adminium/meta';
+/** Thrown for schedule payloads croner cannot evaluate (bad time/timezone). */
+export declare class ReportScheduleError extends Error {
+    readonly name = "ReportScheduleError";
+}
+/** `daily|weekly|monthly` + fields → a 5-part cron expression. */
+export declare function cronExprFor(schedule: ReportSchedule): string;
+/**
+ * Next occurrence strictly after `from`, as epoch ms; `null` when croner can
+ * find none. Invalid timezones surface as {@link ReportScheduleError} so the
+ * route layer can 422 instead of leaking a croner internal.
+ */
+export declare function nextRunAtOf(schedule: ReportSchedule, from?: number): number | null;
+//# sourceMappingURL=schedule.d.ts.map

package/dist/reports/schedule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.d.ts","sourceRoot":"","sources":["../../src/reports/schedule.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAErD,+EAA+E;AAC/E,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,SAAkB,IAAI,yBAAyB;CAChD;AAID,kEAAkE;AAClE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,cAAc,GAAG,MAAM,CAkB5D;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,GAAE,MAAmB,GAAG,MAAM,GAAG,IAAI,CAiB9F"}

package/dist/reports/schedule.js

@@ -0,0 +1,63 @@
+/**
+ * Scheduled-report time math (07-meta-store.md §3.24, M7 reports track).
+ *
+ * The stored `schedule` payload is the §3.24 field vocabulary
+ * (`frequency`/`dayOfWeek`/`dayOfMonth`/`time`/`timezone`), NOT a cron
+ * string — this module is the single place that morphs those fields into a
+ * cron expression and asks croner (BRIEF §3: croner, no Redis) for the next
+ * occurrence. The meta repo persists whatever timestamp it is handed and
+ * never parses cron (see packages/meta/src/repos/scheduled-reports.ts).
+ *
+ * Timezone-correctness rides croner's own IANA handling: `09:00` in
+ * `America/New_York` is 13:00/14:00 UTC depending on DST, and a `dayOfMonth`
+ * of 31 simply skips short months (croner semantics — the run happens on the
+ * next month that has a 31st, matching "monthly on the 31st" intent).
+ */
+import { Cron } from 'croner';
+/** Thrown for schedule payloads croner cannot evaluate (bad time/timezone). */
+export class ReportScheduleError extends Error {
+    name = 'ReportScheduleError';
+}
+const TIME_RE = /^([01]?\d|2[0-3]):([0-5]\d)$/;
+/** `daily|weekly|monthly` + fields → a 5-part cron expression. */
+export function cronExprFor(schedule) {
+    const match = TIME_RE.exec(schedule.time);
+    if (match === null) {
+        throw new ReportScheduleError(`schedule.time must be HH:mm (24h), got ${JSON.stringify(schedule.time)}`);
+    }
+    const hour = Number(match[1]);
+    const minute = Number(match[2]);
+    switch (schedule.frequency) {
+        case 'daily':
+            return `${minute} ${hour} * * *`;
+        case 'weekly':
+            // §3.24 dayOfWeek is 0–6 (Sunday = 0), cron's native vocabulary.
+            return `${minute} ${hour} * * ${schedule.dayOfWeek ?? 1}`;
+        case 'monthly':
+            return `${minute} ${hour} ${schedule.dayOfMonth ?? 1} * *`;
+    }
+}
+/**
+ * Next occurrence strictly after `from`, as epoch ms; `null` when croner can
+ * find none. Invalid timezones surface as {@link ReportScheduleError} so the
+ * route layer can 422 instead of leaking a croner internal.
+ */
+export function nextRunAtOf(schedule, from = Date.now()) {
+    const expr = cronExprFor(schedule);
+    let cron = null;
+    try {
+        // croner defers some timezone validation to evaluation time (the
+        // Intl.DateTimeFormat inside nextRun throws the RangeError), so BOTH the
+        // construction and the evaluation live under the same translation.
+        cron = new Cron(expr, { paused: true, timezone: schedule.timezone });
+        const next = cron.nextRun(new Date(from));
+        return next === null ? null : next.getTime();
+    }
+    catch (error) {
+        throw new ReportScheduleError(`schedule is not evaluatable (${error instanceof Error ? error.message : String(error)})`);
+    }
+    finally {
+        cron?.stop();
+    }
+}
+//# sourceMappingURL=schedule.js.map

package/dist/reports/schedule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedule.js","sourceRoot":"","sources":["../../src/reports/schedule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAG9B,+EAA+E;AAC/E,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC1B,IAAI,GAAG,qBAAqB,CAAC;CAChD;AAED,MAAM,OAAO,GAAG,8BAA8B,CAAC;AAE/C,kEAAkE;AAClE,MAAM,UAAU,WAAW,CAAC,QAAwB;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,mBAAmB,CAC3B,0CAA0C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC3B,KAAK,OAAO;YACV,OAAO,GAAG,MAAM,IAAI,IAAI,QAAQ,CAAC;QACnC,KAAK,QAAQ;YACX,iEAAiE;YACjE,OAAO,GAAG,MAAM,IAAI,IAAI,QAAQ,QAAQ,CAAC,SAAS,IAAI,CAAC,EAAE,CAAC;QAC5D,KAAK,SAAS;YACZ,OAAO,GAAG,MAAM,IAAI,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,QAAwB,EAAE,OAAe,IAAI,CAAC,GAAG,EAAE;IAC7E,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,GAAgB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,iEAAiE;QACjE,yEAAyE;QACzE,mEAAmE;QACnE,IAAI,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mBAAmB,CAC3B,gCAAgC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC1F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,IAAI,EAAE,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/routes/about/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * About resource (M10-T04): `GET /api/v1/about` and
+ * `GET /api/v1/about/update-check`.
+ *
+ * Backs the in-app About screen — version, AGPL-3.0 + the §13 source offer
+ * (01-architecture.md §9.3: "the AGPL §13 source offer is satisfied by linking
+ * to the public repo … from the instance footer ('About' screen, M10 scope)"),
+ * the meta-store engine, and the self-host update-available notice.
+ *
+ * Session-gated: the version string is a fingerprinting aid, so an anonymous
+ * visitor to a self-hosted instance does not get to read which build (and thus
+ * which unpatched CVEs) it is running. `GET /healthz` stays public for probes.
+ *
+ * `/about/update-check` is separate from `/about` on purpose: About must render
+ * instantly from local state, while the update check may make an outbound call
+ * (only when `updates.checkEnabled` — see ../../telemetry/update-check.ts for
+ * why that is its own preference). Opted out ⇒ `{ status: 'disabled' }` and no
+ * network, so the notice cannot become a beacon.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import { type MetaDb } from '@adminium/meta';
+import type { UpdateCheckService } from '../../telemetry/update-check.js';
+/** AGPL-3.0-only — matches every workspace package.json `license` field. */
+export declare const LICENSE_SPDX = "AGPL-3.0-only";
+/**
+ * The §13 offer is only satisfied by a link that actually reaches the source,
+ * so this must name the repository that hosts it: github.com/MoSofi/Adminium.
+ * The `adminium/adminium` slug belongs to an unrelated third party — pointing
+ * the offer there would send users to a stranger's empty repo.
+ */
+export declare const SOURCE_URL = "https://github.com/MoSofi/Adminium";
+export declare const LICENSE_URL = "https://github.com/MoSofi/Adminium/blob/main/LICENSE";
+export interface AboutRoutesDeps {
+    meta: MetaDb;
+    updates: UpdateCheckService;
+    version?: string | undefined;
+}
+export declare function aboutRoutes(deps: AboutRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/about/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/about/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,4EAA4E;AAC5E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAC5C;;;;;GAKG;AACH,eAAO,MAAM,UAAU,uCAAuC,CAAC;AAC/D,eAAO,MAAM,WAAW,yDAAyD,CAAC;AAElF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,kBAAkB,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AA2BD,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CA2CxE"}

package/dist/routes/about/index.js

@@ -0,0 +1,73 @@
+import { settingsRepo } from '@adminium/meta';
+import { APP_VERSION } from '../../version.js';
+import { aboutReply, aboutUpdateCheckReply } from './schema.js';
+/** AGPL-3.0-only — matches every workspace package.json `license` field. */
+export const LICENSE_SPDX = 'AGPL-3.0-only';
+/**
+ * The §13 offer is only satisfied by a link that actually reaches the source,
+ * so this must name the repository that hosts it: github.com/MoSofi/Adminium.
+ * The `adminium/adminium` slug belongs to an unrelated third party — pointing
+ * the offer there would send users to a stranger's empty repo.
+ */
+export const SOURCE_URL = 'https://github.com/MoSofi/Adminium';
+export const LICENSE_URL = 'https://github.com/MoSofi/Adminium/blob/main/LICENSE';
+/**
+ * The newest applied migration name, or `null` when there is none or the read
+ * fails (11-electron.md §13's About version field).
+ *
+ * NEVER THROWS, for the reason `smtpConfigured` in the system route does not: a
+ * meta-store blip must not take the whole About payload — including `version`
+ * and the AGPL source offer, which are the compliance artifact — down with it.
+ * `null` is the honest "unknown" the desktop panel already renders as a
+ * fallback. `adminium_migrations.name` is the same row `readMetaMigrationVersion`
+ * reads for a §9 backup manifest, so the two agree by construction.
+ */
+async function latestMetaMigration(meta) {
+    try {
+        const rows = await meta.db
+            .selectFrom('adminium_migrations')
+            .select('name')
+            .orderBy('name', 'desc')
+            .limit(1)
+            .execute();
+        return rows[0]?.name ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export function aboutRoutes(deps) {
+    const { meta, updates } = deps;
+    const version = deps.version ?? APP_VERSION;
+    const settings = settingsRepo(meta);
+    return async (app) => {
+        app.get('/about', {
+            preHandler: [app.requireMeta, app.requireAuth],
+            schema: { response: { 200: aboutReply } },
+        }, async () => {
+            const [telemetryEnabled, updateCheckEnabled, metaMigrationVersion] = await Promise.all([
+                settings.get('telemetry.enabled'),
+                settings.get('updates.checkEnabled'),
+                latestMetaMigration(meta),
+            ]);
+            return {
+                data: {
+                    version,
+                    license: LICENSE_SPDX,
+                    sourceUrl: SOURCE_URL,
+                    licenseUrl: LICENSE_URL,
+                    metaEngine: meta.dialect,
+                    metaMigrationVersion,
+                    node: process.version,
+                    telemetry: { enabled: telemetryEnabled },
+                    updates: { checkEnabled: updateCheckEnabled },
+                },
+            };
+        });
+        app.get('/about/update-check', {
+            preHandler: [app.requireMeta, app.requireAuth],
+            schema: { response: { 200: aboutUpdateCheckReply } },
+        }, async () => ({ data: await updates.check() }));
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/about/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/about/index.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,YAAY,EAAe,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAA+C,MAAM,aAAa,CAAC;AAE7G,4EAA4E;AAC5E,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAC5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,oCAAoC,CAAC;AAC/D,MAAM,CAAC,MAAM,WAAW,GAAG,sDAAsD,CAAC;AAQlF;;;;;;;;;;GAUG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE;aACvB,UAAU,CAAC,qBAAqB,CAAC;aACjC,MAAM,CAAC,MAAM,CAAC;aACd,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC;aACvB,KAAK,CAAC,CAAC,CAAC;aACR,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAqB;IAC/C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC;IAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CACL,QAAQ,EACR;YACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;YAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE;SAC1C,EACD,KAAK,IAAyB,EAAE;YAC9B,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,oBAAoB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBACrF,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;gBACjC,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC;gBACpC,mBAAmB,CAAC,IAAI,CAAC;aAC1B,CAAC,CAAC;YACH,OAAO;gBACL,IAAI,EAAE;oBACJ,OAAO;oBACP,OAAO,EAAE,YAAY;oBACrB,SAAS,EAAE,UAAU;oBACrB,UAAU,EAAE,WAAW;oBACvB,UAAU,EAAE,IAAI,CAAC,OAAO;oBACxB,oBAAoB;oBACpB,IAAI,EAAE,OAAO,CAAC,OAAO;oBACrB,SAAS,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE;oBACxC,OAAO,EAAE,EAAE,YAAY,EAAE,kBAAkB,EAAE;iBAC9C;aACF,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB;YACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;YAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE;SACrD,EACD,KAAK,IAAoC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAC9E,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/about/schema.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Zod schemas for the About resource (M10-T04; 01-architecture.md §9.3 — the
+ * AGPL §13 source offer is satisfied by linking the public repo from the
+ * instance's About screen).
+ */
+import { z } from 'zod';
+export declare const aboutReply: z.ZodObject<{
+    data: z.ZodObject<{
+        version: z.ZodString;
+        license: z.ZodString;
+        sourceUrl: z.ZodString;
+        licenseUrl: z.ZodString;
+        metaEngine: z.ZodEnum<{
+            postgres: "postgres";
+            mysql: "mysql";
+            sqlite: "sqlite";
+        }>;
+        metaMigrationVersion: z.ZodNullable<z.ZodString>;
+        node: z.ZodString;
+        telemetry: z.ZodObject<{
+            enabled: z.ZodBoolean;
+        }, z.core.$strip>;
+        updates: z.ZodObject<{
+            checkEnabled: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AboutReply = z.infer<typeof aboutReply>;
+/**
+ * `GET /about/update-check`. `disabled` is a first-class, un-alarming outcome:
+ * the instance opted out and made no outbound call (M10-T04).
+ */
+export declare const aboutUpdateCheckReply: z.ZodObject<{
+    data: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        status: z.ZodLiteral<"disabled">;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"current">;
+        current: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"unknown">;
+        current: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        status: z.ZodLiteral<"update-available">;
+        current: z.ZodString;
+        latest: z.ZodString;
+        url: z.ZodString;
+    }, z.core.$strip>], "status">;
+}, z.core.$strip>;
+export type AboutUpdateCheckReply = z.infer<typeof aboutUpdateCheckReply>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/about/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/about/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;iBA2BrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;iBAYhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/routes/about/schema.js

@@ -0,0 +1,53 @@
+/**
+ * Zod schemas for the About resource (M10-T04; 01-architecture.md §9.3 — the
+ * AGPL §13 source offer is satisfied by linking the public repo from the
+ * instance's About screen).
+ */
+import { z } from 'zod';
+import { metaDialect } from '../system/schema.js';
+export const aboutReply = z.object({
+    data: z.object({
+        /** Running build, from apps/server/package.json. */
+        version: z.string(),
+        /** SPDX id — AGPL-3.0-only. */
+        license: z.string(),
+        /** The AGPL §13 source offer: where this instance's source lives. */
+        sourceUrl: z.string(),
+        /** Full licence text (repo LICENSE). */
+        licenseUrl: z.string(),
+        /** Which engine backs the meta store (07-meta-store.md). */
+        metaEngine: metaDialect,
+        /**
+         * The newest applied meta-store migration (`adminium_migrations.name`),
+         * or `null` when it cannot be read. 11-electron.md §13 lists it among the
+         * desktop About screen's version fields; it is harmless on self-host and
+         * the same fact `readMetaMigrationVersion` puts in a §9 backup manifest.
+         * Nullable rather than required because About must render even when the
+         * migrations table is empty or unreadable — a version panel that 500s is
+         * worse than one that says "unknown".
+         */
+        metaMigrationVersion: z.string().nullable(),
+        node: z.string(),
+        /** Current preferences, so About can explain (and link to) both switches. */
+        telemetry: z.object({ enabled: z.boolean() }),
+        updates: z.object({ checkEnabled: z.boolean() }),
+    }),
+});
+/**
+ * `GET /about/update-check`. `disabled` is a first-class, un-alarming outcome:
+ * the instance opted out and made no outbound call (M10-T04).
+ */
+export const aboutUpdateCheckReply = z.object({
+    data: z.discriminatedUnion('status', [
+        z.object({ status: z.literal('disabled') }),
+        z.object({ status: z.literal('current'), current: z.string() }),
+        z.object({ status: z.literal('unknown'), current: z.string() }),
+        z.object({
+            status: z.literal('update-available'),
+            current: z.string(),
+            latest: z.string(),
+            url: z.string(),
+        }),
+    ]),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/about/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/about/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,oDAAoD;QACpD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,+BAA+B;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,qEAAqE;QACrE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;QACrB,wCAAwC;QACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;QACtB,4DAA4D;QAC5D,UAAU,EAAE,WAAW;QACvB;;;;;;;;WAQG;QACH,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,6EAA6E;QAC7E,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;KACjD,CAAC;CACH,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;QACnC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/D,CAAC,CAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;YACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;SAChB,CAAC;KACH,CAAC;CACH,CAAC,CAAC"}

package/dist/routes/api-keys/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * API-key routes (08-server-api.md §2.16, M2-T06): list, create with the
+ * one-time secret reveal (`adm_sk_…` stored SHA-256-hashed + short prefix for
+ * display/lookup), and revoke. Keys act with a role's permissions — scopes
+ * are that role's §5.1 grant set. Guarded by `system:api-keys:manage`
+ * (meta closed-set key `api-keys.manage`). Mutations audit under the
+ * `system` category (§7.2 matrix).
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+export declare const apiKeysRoutes: FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/api-keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/api-keys/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA8BvE,eAAO,MAAM,aAAa,EAAE,qBA4E3B,CAAC"}

package/dist/routes/api-keys/index.js

@@ -0,0 +1,79 @@
+import { apiKeysRepo, permissionsRepo, rolesRepo } from '@adminium/meta';
+import { ConflictError, NotFoundError } from '../../errors.js';
+import { generateApiKey } from '../../rbac/api-keys.js';
+import { PERMISSIONS, grantsFromMatrixRows } from '../../rbac/permissions.js';
+import { apiKeyCreateBody, apiKeyCreateReply, apiKeyIdParams, apiKeyListReply, apiKeyOkReply, } from './schema.js';
+/** Strips `tokenHash` — no secret material ever leaves this mapper. */
+function toDto(row) {
+    return {
+        id: row.id,
+        name: row.name,
+        prefix: row.prefix,
+        roleId: row.roleId,
+        createdBy: row.createdBy,
+        lastUsedAt: row.lastUsedAt,
+        expiresAt: row.expiresAt,
+        revokedAt: row.revokedAt,
+        createdAt: row.createdAt,
+    };
+}
+export const apiKeysRoutes = async (app) => {
+    const { meta } = app.rbac;
+    const apiKeys = apiKeysRepo(meta);
+    const roles = rolesRepo(meta);
+    const permissions = permissionsRepo(meta);
+    app.get('/api-keys', {
+        preHandler: app.rbac.require(PERMISSIONS.apiKeysManage),
+        schema: { response: { 200: apiKeyListReply } },
+    }, async () => ({ apiKeys: (await apiKeys.list()).map(toDto) }));
+    app.post('/api-keys', {
+        preHandler: app.rbac.require(PERMISSIONS.apiKeysManage),
+        schema: { body: apiKeyCreateBody, response: { 201: apiKeyCreateReply } },
+    }, async (request, reply) => {
+        const role = await roles.findById(request.body.roleId);
+        if (role === null) {
+            throw new NotFoundError('Role not found.', { roleId: request.body.roleId });
+        }
+        const generated = generateApiKey();
+        const actingUserId = request.apiKeyPrincipal === null
+            ? (request.user?.id ?? null)
+            : null;
+        const row = await apiKeys.create({
+            name: request.body.name,
+            prefix: generated.prefix,
+            tokenHash: generated.tokenHash,
+            roleId: role.id,
+            createdBy: actingUserId,
+            expiresAt: request.body.expiresAt ?? null,
+        }, app.rbac.now());
+        const scopes = role.slug === 'super-admin'
+            ? ['*']
+            : grantsFromMatrixRows(await permissions.listForRole(role.id));
+        await app.rbac.audit(request, {
+            category: 'system',
+            action: 'api-key.create',
+            changes: { after: { apiKeyId: row.id, name: row.name, prefix: row.prefix, roleId: role.id } },
+        });
+        // The ONLY place the full key is ever serialized (§2.16 one-time reveal).
+        return reply.status(201).send({ apiKey: toDto(row), key: generated.key, scopes });
+    });
+    app.delete('/api-keys/:id', {
+        preHandler: app.rbac.require(PERMISSIONS.apiKeysManage),
+        schema: { params: apiKeyIdParams, response: { 200: apiKeyOkReply } },
+    }, async (request) => {
+        const row = await apiKeys.findById(request.params.id);
+        if (row === null)
+            throw new NotFoundError('API key not found.', { id: request.params.id });
+        if (row.revokedAt !== null) {
+            throw new ConflictError('API key is already revoked.', 'CONFLICT', { id: row.id });
+        }
+        await apiKeys.revoke(row.id, app.rbac.now());
+        await app.rbac.audit(request, {
+            category: 'system',
+            action: 'api-key.revoke',
+            changes: { before: { apiKeyId: row.id, name: row.name, prefix: row.prefix } },
+        });
+        return { ok: true };
+    });
+};
+//# sourceMappingURL=index.js.map

package/dist/routes/api-keys/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/api-keys/index.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,SAAS,EAAe,MAAM,gBAAgB,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAC9E,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,aAAa,GAEd,MAAM,aAAa,CAAC;AAErB,uEAAuE;AACvE,SAAS,KAAK,CAAC,GAAW;IACxB,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,aAAa,GAA0B,KAAK,EAAE,GAAG,EAAE,EAAE;IAChE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAE1C,GAAG,CAAC,GAAG,CACL,WAAW,EACX;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;QACvD,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;KAC/C,EACD,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAC7D,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,WAAW,EACX;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;QACvD,MAAM,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE;KACzE,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClB,MAAM,IAAI,aAAa,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,SAAS,GAAG,cAAc,EAAE,CAAC;QACnC,MAAM,YAAY,GAChB,OAAO,CAAC,eAAe,KAAK,IAAI;YAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;YACvE,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAC9B;YACE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI;YACvB,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,YAAY;YACvB,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI;SAC1C,EACD,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CACf,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,KAAK,aAAa;YACxC,CAAC,CAAC,CAAC,GAAG,CAAC;YACP,CAAC,CAAC,oBAAoB,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACjE,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE;SAC9F,CAAC,CAAC;QACH,0EAA0E;QAC1E,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,MAAM,CACR,eAAe,EACf;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,aAAa,CAAC;QACvD,MAAM,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,EAAE;KACrE,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,GAAG,KAAK,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,IAAI,aAAa,CAAC,6BAA6B,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;YAC5B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE;SAC9E,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;IAC/B,CAAC,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/routes/api-keys/schema.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Zod schemas for the api-keys resource (08-server-api.md §2.16). The full
+ * secret appears exactly once — in `apiKeyCreateReply.key` ("Copy it now —
+ * you won't be able to see it again.", `designs/API Keys.dc.html`). List and
+ * detail replies never carry secret material (CI grep guard §7 item 6).
+ */
+import { z } from 'zod';
+export declare const apiKeyDto: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    roleId: z.ZodString;
+    createdBy: z.ZodNullable<z.ZodString>;
+    lastUsedAt: z.ZodNullable<z.ZodNumber>;
+    expiresAt: z.ZodNullable<z.ZodNumber>;
+    revokedAt: z.ZodNullable<z.ZodNumber>;
+    createdAt: z.ZodNumber;
+}, z.core.$strip>;
+export type ApiKeyDto = z.infer<typeof apiKeyDto>;
+export declare const apiKeyListReply: z.ZodObject<{
+    apiKeys: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        roleId: z.ZodString;
+        createdBy: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodNumber>;
+        expiresAt: z.ZodNullable<z.ZodNumber>;
+        revokedAt: z.ZodNullable<z.ZodNumber>;
+        createdAt: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ApiKeyListReply = z.infer<typeof apiKeyListReply>;
+export declare const apiKeyCreateBody: z.ZodObject<{
+    name: z.ZodString;
+    roleId: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type ApiKeyCreateBody = z.infer<typeof apiKeyCreateBody>;
+export declare const apiKeyCreateReply: z.ZodObject<{
+    apiKey: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        roleId: z.ZodString;
+        createdBy: z.ZodNullable<z.ZodString>;
+        lastUsedAt: z.ZodNullable<z.ZodNumber>;
+        expiresAt: z.ZodNullable<z.ZodNumber>;
+        revokedAt: z.ZodNullable<z.ZodNumber>;
+        createdAt: z.ZodNumber;
+    }, z.core.$strip>;
+    key: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type ApiKeyCreateReply = z.infer<typeof apiKeyCreateReply>;
+export declare const apiKeyIdParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const apiKeyOkReply: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/api-keys/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/api-keys/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,SAAS;;;;;;;;;;iBAYpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,eAAe;;;;;;;;;;;;iBAA4C,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;iBAK3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;iBAM5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,cAAc;;iBAA+B,CAAC;AAE3D,eAAO,MAAM,aAAa;;iBAAoC,CAAC"}