@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/api-keys/schema.js

@@ -0,0 +1,37 @@
+/**
+ * Zod schemas for the api-keys resource (08-server-api.md §2.16). The full
+ * secret appears exactly once — in `apiKeyCreateReply.key` ("Copy it now —
+ * you won't be able to see it again.", `designs/API Keys.dc.html`). List and
+ * detail replies never carry secret material (CI grep guard §7 item 6).
+ */
+import { z } from 'zod';
+export const apiKeyDto = z.object({
+    id: z.string(),
+    name: z.string(),
+    /** Display fragment, e.g. `adm_sk_4f2a91cd`. */
+    prefix: z.string(),
+    /** The key acts with this role's permissions (07 §3.7). */
+    roleId: z.string(),
+    createdBy: z.string().nullable(),
+    lastUsedAt: z.number().nullable(),
+    expiresAt: z.number().nullable(),
+    revokedAt: z.number().nullable(),
+    createdAt: z.number(),
+});
+export const apiKeyListReply = z.object({ apiKeys: z.array(apiKeyDto) });
+export const apiKeyCreateBody = z.object({
+    name: z.string().min(1).max(80),
+    /** Scope source: the key acts with this role's grant set (§2.16/§8). */
+    roleId: z.string(),
+    expiresAt: z.number().int().positive().optional(),
+});
+export const apiKeyCreateReply = z.object({
+    apiKey: apiKeyDto,
+    /** One-time reveal — never returned by any other route. */
+    key: z.string(),
+    /** The role's §5.1 grant strings at create time (informational). */
+    scopes: z.array(z.string()),
+});
+export const apiKeyIdParams = z.object({ id: z.string() });
+export const apiKeyOkReply = z.object({ ok: z.literal(true) });
+//# sourceMappingURL=schema.js.map

package/dist/routes/api-keys/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/api-keys/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,gDAAgD;IAChD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,2DAA2D;IAC3D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAGzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,EAAE,SAAS;IACjB,2DAA2D;IAC3D,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,oEAAoE;IACpE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC"}

package/dist/routes/audit/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Audit query routes (08-server-api.md §2.14, M2-T06): `GET /audit` with
+ * category/actor/date-range/resource filters and keyset pagination on
+ * `(created_at, id)` descending (both indexed, ids are time-ordered ULIDs —
+ * 07 §3.11), plus `GET /audit/:id`. Append-only: no mutating routes exist.
+ *
+ * Requires `system:audit:read` (meta closed-set key `audit.read`).
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+export declare const auditRoutes: FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/audit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAoFvE,eAAO,MAAM,WAAW,EAAE,qBAkEzB,CAAC"}

package/dist/routes/audit/index.js

@@ -0,0 +1,107 @@
+import { NotFoundError, ValidationFailedError } from '../../errors.js';
+import { PERMISSIONS } from '../../rbac/permissions.js';
+import { auditEntryReply, auditIdParams, auditListQuery, auditListReply, } from './schema.js';
+function parseJsonColumn(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (typeof value === 'object')
+        return value;
+    if (typeof value === 'string') {
+        try {
+            return JSON.parse(value);
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function toDto(row) {
+    return {
+        id: row.id,
+        createdAt: row.createdAt,
+        actorKind: row.actorKind,
+        actorId: row.actorId,
+        actorLabel: row.actorLabel,
+        category: row.category,
+        action: row.action,
+        connectionId: row.connectionId,
+        entity: parseJsonColumn(row.entity),
+        changes: parseJsonColumn(row.changes),
+        ip: row.ip,
+        userAgent: row.userAgent,
+        requestId: row.requestId,
+    };
+}
+function encodeCursor(cursor) {
+    return Buffer.from(`${cursor.createdAt}:${cursor.id}`, 'utf8').toString('base64url');
+}
+function decodeCursor(raw) {
+    const decoded = Buffer.from(raw, 'base64url').toString('utf8');
+    const separator = decoded.indexOf(':');
+    const createdAt = separator > 0 ? Number(decoded.slice(0, separator)) : Number.NaN;
+    const id = separator > 0 ? decoded.slice(separator + 1) : '';
+    if (!Number.isFinite(createdAt) || id.length === 0) {
+        throw new ValidationFailedError('Malformed pagination cursor.', { cursor: raw });
+    }
+    return { createdAt, id };
+}
+/** Escape LIKE wildcards in the user-supplied resource filter. */
+function escapeLike(value) {
+    return value.replace(/[\\%_]/g, (ch) => `\\${ch}`);
+}
+export const auditRoutes = async (app) => {
+    const { meta } = app.rbac;
+    app.get('/audit', {
+        preHandler: app.rbac.require(PERMISSIONS.auditRead),
+        schema: { querystring: auditListQuery, response: { 200: auditListReply } },
+    }, async (request) => {
+        const { actorId, category, resource, from, to, cursor, limit } = request.query;
+        let q = meta.db.selectFrom('adminium_audit_log').selectAll();
+        if (actorId !== undefined)
+            q = q.where('actorId', '=', actorId);
+        if (category !== undefined)
+            q = q.where('category', '=', category);
+        if (from !== undefined)
+            q = q.where('createdAt', '>=', from);
+        if (to !== undefined)
+            q = q.where('createdAt', '<=', to);
+        if (resource !== undefined && resource.length > 0) {
+            // Dotted-verb prefix: resource=role matches role.create, role.delete, …
+            const prefix = escapeLike(resource);
+            q = q.where((eb) => eb.or([eb('action', '=', resource), eb('action', 'like', `${prefix}.%`)]));
+        }
+        if (cursor !== undefined) {
+            const decoded = decodeCursor(cursor);
+            q = q.where((eb) => eb.or([
+                eb('createdAt', '<', decoded.createdAt),
+                eb.and([eb('createdAt', '=', decoded.createdAt), eb('id', '<', decoded.id)]),
+            ]));
+        }
+        const rows = await q
+            .orderBy('createdAt', 'desc')
+            .orderBy('id', 'desc')
+            .limit(limit + 1)
+            .execute();
+        const page = rows.slice(0, limit);
+        const last = page[page.length - 1];
+        const nextCursor = rows.length > limit && last !== undefined
+            ? encodeCursor({ createdAt: last.createdAt, id: last.id })
+            : null;
+        return { entries: page.map((row) => toDto(row)), nextCursor };
+    });
+    app.get('/audit/:id', {
+        preHandler: app.rbac.require(PERMISSIONS.auditRead),
+        schema: { params: auditIdParams, response: { 200: auditEntryReply } },
+    }, async (request) => {
+        const row = await meta.db
+            .selectFrom('adminium_audit_log')
+            .selectAll()
+            .where('id', '=', request.params.id)
+            .executeTakeFirst();
+        if (row === undefined)
+            throw new NotFoundError('Audit entry not found.', { id: request.params.id });
+        return toDto(row);
+    });
+};
+//# sourceMappingURL=index.js.map

package/dist/routes/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/audit/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EACL,eAAe,EACf,aAAa,EACb,cAAc,EACd,cAAc,GAEf,MAAM,aAAa,CAAC;AAkBrB,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAgC,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAC;QACtD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,KAAK,CAAC,GAAa;IAC1B,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAuC;QACtD,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAqC;QACnD,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;QACnC,OAAO,EAAE,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC;QACrC,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAOD,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACnF,MAAM,EAAE,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,qBAAqB,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;AAC3B,CAAC;AAED,kEAAkE;AAClE,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAA0B,KAAK,EAAE,GAAG,EAAE,EAAE;IAC9D,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;IAE1B,GAAG,CAAC,GAAG,CACL,QAAQ,EACR;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;QACnD,MAAM,EAAE,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE;KAC3E,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAE/E,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,SAAS,EAAE,CAAC;QAC7D,IAAI,OAAO,KAAK,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QACnE,IAAI,IAAI,KAAK,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,EAAE,KAAK,SAAS;YAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,wEAAwE;YACxE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;YACpC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACjB,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACjB,EAAE,CAAC,EAAE,CAAC;gBACJ,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC;gBACvC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;aAC7E,CAAC,CACH,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC;aACjB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;aAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;aACrB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;aAChB,OAAO,EAAE,CAAC;QAEb,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACnC,MAAM,UAAU,GACd,IAAI,CAAC,MAAM,GAAG,KAAK,IAAI,IAAI,KAAK,SAAS;YACvC,CAAC,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC;QACX,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,GAAe,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;IAC5E,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,YAAY,EACZ;QACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC;QACnD,MAAM,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;KACtE,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;aACtB,UAAU,CAAC,oBAAoB,CAAC;aAChC,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACnC,gBAAgB,EAAE,CAAC;QACtB,IAAI,GAAG,KAAK,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,wBAAwB,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACpG,OAAO,KAAK,CAAC,GAAe,CAAC,CAAC;IAChC,CAAC,CACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/routes/audit/schema.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Zod schemas for the audit resource (08-server-api.md §2.14). The API
+ * returns structured rows — the verb + bold-resource sentence anatomy is a
+ * client concern (`designs/Audit Log.dc.html`).
+ */
+import { z } from 'zod';
+export declare const auditEntryDto: z.ZodObject<{
+    id: z.ZodString;
+    createdAt: z.ZodNumber;
+    actorKind: z.ZodEnum<{
+        system: "system";
+        user: "user";
+        "api-key": "api-key";
+        automation: "automation";
+    }>;
+    actorId: z.ZodNullable<z.ZodString>;
+    actorLabel: z.ZodString;
+    category: z.ZodEnum<{
+        settings: "settings";
+        schema: "schema";
+        system: "system";
+        export: "export";
+        automation: "automation";
+        auth: "auth";
+        data: "data";
+        rbac: "rbac";
+        connection: "connection";
+        llm: "llm";
+    }>;
+    action: z.ZodString;
+    connectionId: z.ZodNullable<z.ZodString>;
+    entity: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    changes: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    ip: z.ZodNullable<z.ZodString>;
+    userAgent: z.ZodNullable<z.ZodString>;
+    requestId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AuditEntryDto = z.infer<typeof auditEntryDto>;
+export declare const auditListQuery: z.ZodObject<{
+    actorId: z.ZodOptional<z.ZodString>;
+    category: z.ZodOptional<z.ZodEnum<{
+        settings: "settings";
+        schema: "schema";
+        system: "system";
+        export: "export";
+        automation: "automation";
+        auth: "auth";
+        data: "data";
+        rbac: "rbac";
+        connection: "connection";
+        llm: "llm";
+    }>>;
+    resource: z.ZodOptional<z.ZodString>;
+    from: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    to: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type AuditListQuery = z.infer<typeof auditListQuery>;
+export declare const auditListReply: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        createdAt: z.ZodNumber;
+        actorKind: z.ZodEnum<{
+            system: "system";
+            user: "user";
+            "api-key": "api-key";
+            automation: "automation";
+        }>;
+        actorId: z.ZodNullable<z.ZodString>;
+        actorLabel: z.ZodString;
+        category: z.ZodEnum<{
+            settings: "settings";
+            schema: "schema";
+            system: "system";
+            export: "export";
+            automation: "automation";
+            auth: "auth";
+            data: "data";
+            rbac: "rbac";
+            connection: "connection";
+            llm: "llm";
+        }>;
+        action: z.ZodString;
+        connectionId: z.ZodNullable<z.ZodString>;
+        entity: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        changes: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        ip: z.ZodNullable<z.ZodString>;
+        userAgent: z.ZodNullable<z.ZodString>;
+        requestId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AuditListReply = z.infer<typeof auditListReply>;
+export declare const auditIdParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const auditEntryReply: z.ZodObject<{
+    id: z.ZodString;
+    createdAt: z.ZodNumber;
+    actorKind: z.ZodEnum<{
+        system: "system";
+        user: "user";
+        "api-key": "api-key";
+        automation: "automation";
+    }>;
+    actorId: z.ZodNullable<z.ZodString>;
+    actorLabel: z.ZodString;
+    category: z.ZodEnum<{
+        settings: "settings";
+        schema: "schema";
+        system: "system";
+        export: "export";
+        automation: "automation";
+        auth: "auth";
+        data: "data";
+        rbac: "rbac";
+        connection: "connection";
+        llm: "llm";
+    }>;
+    action: z.ZodString;
+    connectionId: z.ZodNullable<z.ZodString>;
+    entity: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    changes: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    ip: z.ZodNullable<z.ZodString>;
+    userAgent: z.ZodNullable<z.ZodString>;
+    requestId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/audit/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/audit/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAexB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,aAAa;;iBAA+B,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAAgB,CAAC"}

package/dist/routes/audit/schema.js

@@ -0,0 +1,43 @@
+/**
+ * Zod schemas for the audit resource (08-server-api.md §2.14). The API
+ * returns structured rows — the verb + bold-resource sentence anatomy is a
+ * client concern (`designs/Audit Log.dc.html`).
+ */
+import { z } from 'zod';
+import { actorKindSchema, auditCategorySchema } from '@adminium/meta';
+export const auditEntryDto = z.object({
+    id: z.string(),
+    createdAt: z.number(),
+    actorKind: actorKindSchema,
+    actorId: z.string().nullable(),
+    actorLabel: z.string(),
+    category: auditCategorySchema,
+    /** Dotted verb, e.g. `role.permission.change` (07 §3.11). */
+    action: z.string(),
+    connectionId: z.string().nullable(),
+    entity: z.record(z.string(), z.unknown()).nullable(),
+    changes: z.record(z.string(), z.unknown()).nullable(),
+    ip: z.string().nullable(),
+    userAgent: z.string().nullable(),
+    requestId: z.string().nullable(),
+});
+export const auditListQuery = z.object({
+    actorId: z.string().optional(),
+    category: auditCategorySchema.optional(),
+    /** Resource-type filter matched against the dotted action verb prefix. */
+    resource: z.string().max(80).optional(),
+    /** Epoch-ms range bounds (inclusive `from`, inclusive `to`). */
+    from: z.coerce.number().int().nonnegative().optional(),
+    to: z.coerce.number().int().nonnegative().optional(),
+    /** Opaque keyset cursor from a previous reply. */
+    cursor: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(200).default(50),
+});
+export const auditListReply = z.object({
+    entries: z.array(auditEntryDto),
+    /** Pass back as `cursor` for the next page; `null` on the last page. */
+    nextCursor: z.string().nullable(),
+});
+export const auditIdParams = z.object({ id: z.string() });
+export const auditEntryReply = auditEntryDto;
+//# sourceMappingURL=schema.js.map

package/dist/routes/audit/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/audit/schema.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,eAAe;IAC1B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,mBAAmB;IAC7B,6DAA6D;IAC7D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACrD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,QAAQ,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACxC,0EAA0E;IAC1E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACvC,gEAAgE;IAChE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACtD,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,kDAAkD;IAClD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/B,wEAAwE;IACxE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC"}

package/dist/routes/auth/desktop-session.d.ts

@@ -0,0 +1,48 @@
+/**
+ * `POST /api/v1/auth/desktop-session` — the desktop shell's boot-token
+ * auto-login (11-electron.md §5).
+ *
+ * This is the only route in the product that hands out a super-admin session
+ * without a password, so it is written as four independent gates, each of which
+ * alone is sufficient to refuse:
+ *
+ *  1. EXISTENCE. `compose.ts` registers this factory only when
+ *     `ADMINIUM_RUNTIME=desktop` AND a per-boot `ADMINIUM_BOOT_TOKEN` is set. A
+ *     self-host or Docker instance does not have the route at all — the strongest
+ *     form the gate can take, since an absent route cannot be misconfigured,
+ *     bypassed, or reached by a bug in the three gates below.
+ *  2. PEER. The socket's `remoteAddress` must be loopback (§2.4, "unconditionally").
+ *     Not `request.ip` — see `auth/desktop-session.ts` for why that distinction is
+ *     the difference between a check and a vulnerability.
+ *  3. POLICY. `adminium_settings.desktop.singleUser` must be true — the mirror of
+ *     `config.json`'s §2.3 `singleUser`, i.e. the user has not turned on "Require
+ *     login on this device".
+ *  4. TOKEN. Constant-time match against this boot's token, single-use.
+ *
+ * They run IN THAT ORDER, which is itself a decision: a non-loopback peer is
+ * turned away before the process will so much as look at a token, and a disabled
+ * device is turned away before that. Nothing that reaches the comparison can
+ * learn anything from it that it did not already have.
+ *
+ * ─── The failure vocabulary ──────────────────────────────────────────────────
+ *
+ * Wrong token, replayed token, and a token from a previous boot are ONE answer:
+ * 401 `INVALID_CREDENTIALS`, the same envelope `/auth/login` gives a bad
+ * password. They are the same fact — "this is not a credential this server will
+ * accept" — and telling them apart would answer questions worth asking (was this
+ * token ever valid? has the real one been used yet?). §5's prose says a replay is
+ * a 403; it is a 401 here because 403 means "authenticated, not allowed", and
+ * nobody who fails this check is authenticated. The one thing that IS 403 is gate
+ * 3: `DESKTOP_AUTOLOGIN_DISABLED` — a configuration answer, not a credential
+ * answer, reachable only from loopback, and the SPA renders it as "go to login"
+ * rather than "something went wrong".
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import { type MetaDb } from '@adminium/meta';
+export interface DesktopSessionRoutesDeps {
+    meta: MetaDb;
+    /** This boot's `ADMINIUM_BOOT_TOKEN` (§2.2 step 4). Never persisted. */
+    bootToken: string;
+}
+export declare function desktopSessionRoutes(deps: DesktopSessionRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=desktop-session.d.ts.map

package/dist/routes/auth/desktop-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-session.d.ts","sourceRoot":"","sources":["../../../src/routes/auth/desktop-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAA2B,KAAK,MAAM,EAAa,MAAM,gBAAgB,CAAC;AAUjF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,SAAS,EAAE,MAAM,CAAC;CACnB;AAsCD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CAkH1F"}

package/dist/routes/auth/desktop-session.js

@@ -0,0 +1,132 @@
+import { settingsRepo, usersRepo } from '@adminium/meta';
+import { AppError } from '../../errors.js';
+import { auditAuth } from '../../auth/audit.js';
+import { createBootTokenGuard, isLoopbackPeer } from '../../auth/desktop-session.js';
+import { createSession, setSessionCookie } from '../../auth/sessions.js';
+import { toUserView } from './handlers.js';
+import { RATE_LIMIT_BUCKETS } from './index.js';
+import { authDesktopSessionBody, authLoginReply } from './schema.js';
+/** Uniform credential failure — identical for wrong, replayed, and stale. */
+function invalidBootToken() {
+    return new AppError(401, 'INVALID_CREDENTIALS', 'Invalid or already-used boot token.');
+}
+/**
+ * The super admin this route signs in as (§5: "issues a normal session for the
+ * super-admin user").
+ *
+ * THE OLDEST ACTIVE ONE, deterministically. A desktop install has exactly one
+ * super admin — first run creates it and there is no second door — but "exactly
+ * one" is an expectation about data, not a constraint the schema enforces, and
+ * LAN share (§8.3) exists precisely so other people can get accounts. If a second
+ * super admin ever appears, "whichever row the database felt like returning"
+ * would make auto-login pick a different person on different boots. `createdAt`
+ * ordering picks the one that first run created, every time, on every dialect.
+ *
+ * `status = 'active'` because a suspended or invited account is not a principal:
+ * the session hook would refuse to resolve the session we just minted, and the
+ * user would get a cookie that authenticates as nobody.
+ */
+async function findSuperAdmin(meta) {
+    const row = await meta.db
+        .selectFrom('adminium_users')
+        .innerJoin('adminium_user_roles', 'adminium_user_roles.userId', 'adminium_users.id')
+        .innerJoin('adminium_roles', 'adminium_roles.id', 'adminium_user_roles.roleId')
+        .select('adminium_users.id')
+        .where('adminium_roles.slug', '=', 'super-admin')
+        .where('adminium_users.status', '=', 'active')
+        .orderBy('adminium_users.createdAt', 'asc')
+        .orderBy('adminium_users.id', 'asc')
+        .executeTakeFirst();
+    if (row === undefined)
+        return null;
+    return usersRepo(meta).findById(row.id);
+}
+export function desktopSessionRoutes(deps) {
+    const { meta } = deps;
+    // Per REGISTRATION, which is per boot: the utilityProcess is forked fresh with
+    // a fresh token each launch (§2.2), so the guard's lifetime and the token's
+    // lifetime are the same object's lifetime. Nothing to expire, nothing to clean.
+    const guard = createBootTokenGuard(deps.bootToken);
+    const settings = settingsRepo(meta);
+    return async (app) => {
+        app.post('/auth/desktop-session', {
+            preHandler: [app.requireMeta],
+            // The same §6 bucket as `/auth/login` and `/setup/super-admin`, for the
+            // same two reasons: it is unauthenticated and credential-facing, and it
+            // is reachable from the LAN whenever §8.3 sharing is on. Guessing the
+            // token is hopeless (32 random bytes, one shot), but an unlimited
+            // rejected-request loop still costs CPU and — because gate 2 audits
+            // every non-loopback attempt — writes an audit row per try. A limiter
+            // caps both. It is a marker, not an implementation: the §6 limiter in
+            // `plugins/core.ts` keys its buckets off `config.rateLimitBucket`, and
+            // a route that forgot to declare one would be the one door it never
+            // covers. Keys are per-ip, so a LAN peer burning this bucket can never
+            // lock the loopback exchange out.
+            config: { rateLimitBucket: RATE_LIMIT_BUCKETS.login },
+            schema: { body: authDesktopSessionBody, response: { 200: authLoginReply } },
+        }, async (request, reply) => {
+            // GATE 2 — the peer. `request.raw.socket` is the real connection;
+            // `request.ip` is what a header said. See the module header.
+            if (!isLoopbackPeer(request.raw.socket)) {
+                // Audited: a non-loopback hit on this route is either LAN share doing
+                // its job or somebody probing, and both are worth a row. The token is
+                // NOT in the entry — nothing here ever writes it anywhere.
+                await auditAuth(meta, request, {
+                    action: 'desktop_session_rejected',
+                    actorId: null,
+                    actorLabel: 'desktop-boot-token',
+                });
+                throw new AppError(403, 'FORBIDDEN', 'Desktop auto-login is available only from this computer.');
+            }
+            // GATE 3 — the policy. Read per request, not cached: the boot mirror is
+            // not the only writer we ever want to allow, and a stale cache here fails
+            // OPEN, which is the wrong direction for the one flag that says "this
+            // machine may skip its login".
+            if (!(await settings.get('desktop.singleUser'))) {
+                throw new AppError(403, 'DESKTOP_AUTOLOGIN_DISABLED', 'This device requires a login. Sign in with your password.');
+            }
+            // GATE 4 — the token. Verified and BURNED in one step, before the session
+            // exists: a failure after this point costs the user a relaunch, whereas a
+            // token that survived a failed attempt could be retried by whoever caused
+            // the failure.
+            const claim = guard.claim(request.body.bootToken);
+            if (claim !== 'ok') {
+                await auditAuth(meta, request, {
+                    action: 'desktop_session_failed',
+                    actorId: null,
+                    actorLabel: 'desktop-boot-token',
+                });
+                throw invalidBootToken();
+            }
+            const user = await findSuperAdmin(meta);
+            if (user === null) {
+                // No super admin yet ⇒ this is a first-run boot and the wizard, not
+                // this route, is the way in (§6). Not a credential failure: the token
+                // was right. 409 says "the instance is not in a state where this means
+                // anything", which is what the SPA needs to hear to route to /setup.
+                throw new AppError(409, 'CONFLICT', 'This instance has no super admin yet — complete first-run setup.');
+            }
+            const now = Date.now();
+            const userAgent = request.headers['user-agent'];
+            const { token } = await createSession(meta, user.id, {
+                ip: request.ip,
+                userAgent: typeof userAgent === 'string' ? userAgent.slice(0, 300) : null,
+            }, now);
+            await usersRepo(meta).recordLogin(user.id, now);
+            setSessionCookie(reply, token, request);
+            // The same `login` action `/auth/login` writes — this IS a login, and an
+            // audit reader asking "when did this account sign in?" must not have to
+            // know the desktop shell exists to get the right answer. The mechanism is
+            // the distinguishable part, so it rides in `changes`.
+            await auditAuth(meta, request, {
+                action: 'login',
+                actorId: user.id,
+                actorLabel: user.name,
+                changes: { after: { method: 'desktop-boot-token' } },
+            });
+            const fresh = (await usersRepo(meta).findById(user.id)) ?? user;
+            return { data: { user: toUserView(fresh) } };
+        });
+    };
+}
+//# sourceMappingURL=desktop-session.js.map

package/dist/routes/auth/desktop-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-session.js","sourceRoot":"","sources":["../../../src/routes/auth/desktop-session.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,YAAY,EAAE,SAAS,EAA0B,MAAM,gBAAgB,CAAC;AAEjF,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAuB,MAAM,aAAa,CAAC;AAQ1F,6EAA6E;AAC7E,SAAS,gBAAgB;IACvB,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,qBAAqB,EAAE,qCAAqC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,cAAc,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,EAAE;SACtB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,SAAS,CAAC,qBAAqB,EAAE,4BAA4B,EAAE,mBAAmB,CAAC;SACnF,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,4BAA4B,CAAC;SAC9E,MAAM,CAAC,mBAAmB,CAAC;SAC3B,KAAK,CAAC,qBAAqB,EAAE,GAAG,EAAE,aAAa,CAAC;SAChD,KAAK,CAAC,uBAAuB,EAAE,GAAG,EAAE,QAAQ,CAAC;SAC7C,OAAO,CAAC,0BAA0B,EAAE,KAAK,CAAC;SAC1C,OAAO,CAAC,mBAAmB,EAAE,KAAK,CAAC;SACnC,gBAAgB,EAAE,CAAC;IACtB,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAA8B;IACjE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB;YACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7B,wEAAwE;YACxE,wEAAwE;YACxE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,sEAAsE;YACtE,sEAAsE;YACtE,uEAAuE;YACvE,oEAAoE;YACpE,uEAAuE;YACvE,kCAAkC;YAClC,MAAM,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,EAAE;YACrD,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE;SAC5E,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAA2B,EAAE;YAChD,kEAAkE;YAClE,6DAA6D;YAC7D,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,sEAAsE;gBACtE,sEAAsE;gBACtE,2DAA2D;gBAC3D,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE;oBAC7B,MAAM,EAAE,0BAA0B;oBAClC,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,oBAAoB;iBACjC,CAAC,CAAC;gBACH,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,WAAW,EACX,0DAA0D,CAC3D,CAAC;YACJ,CAAC;YAED,wEAAwE;YACxE,0EAA0E;YAC1E,sEAAsE;YACtE,+BAA+B;YAC/B,IAAI,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,4BAA4B,EAC5B,2DAA2D,CAC5D,CAAC;YACJ,CAAC;YAED,0EAA0E;YAC1E,0EAA0E;YAC1E,0EAA0E;YAC1E,eAAe;YACf,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE;oBAC7B,MAAM,EAAE,wBAAwB;oBAChC,OAAO,EAAE,IAAI;oBACb,UAAU,EAAE,oBAAoB;iBACjC,CAAC,CAAC;gBACH,MAAM,gBAAgB,EAAE,CAAC;YAC3B,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YACxC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;gBAClB,oEAAoE;gBACpE,sEAAsE;gBACtE,uEAAuE;gBACvE,qEAAqE;gBACrE,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,UAAU,EACV,kEAAkE,CACnE,CAAC;YACJ,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACvB,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAChD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CACnC,IAAI,EACJ,IAAI,CAAC,EAAE,EACP;gBACE,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;aAC1E,EACD,GAAG,CACJ,CAAC;YACF,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;YAChD,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YACxC,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE;gBAC7B,MAAM,EAAE,OAAO;gBACf,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,UAAU,EAAE,IAAI,CAAC,IAAI;gBACrB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE;aACrD,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;YAChE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QAC/C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/auth/handlers.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Auth handlers (08-server-api.md §2.1): login (with 2FA step-up), 2FA
+ * verify/enroll/activate/disable, logout, current session, password
+ * forgot/reset. Every mutation writes an `auth` audit entry; login failures
+ * are uniform INVALID_CREDENTIALS regardless of which check failed.
+ */
+import type { FastifyReply, FastifyRequest } from 'fastify';
+import { type User } from '@adminium/meta';
+import type { AuthContext } from '../../plugins/auth.js';
+import type { Auth2faActivateBody, Auth2faActivateReply, Auth2faDisableBody, Auth2faEnrollReply, Auth2faVerifyBody, AuthForgotBody, AuthLoginBody, AuthLoginChallengeReply, AuthLoginReply, AuthResetBody, AuthSessionReply, AuthUserView, OkReply } from './schema.js';
+export declare function toUserView(user: User): AuthUserView;
+export declare function loginHandler(ctx: AuthContext, request: FastifyRequest, reply: FastifyReply, body: AuthLoginBody): Promise<AuthLoginReply | AuthLoginChallengeReply>;
+export declare function verify2faHandler(ctx: AuthContext, request: FastifyRequest, reply: FastifyReply, body: Auth2faVerifyBody): Promise<AuthLoginReply>;
+export declare function logoutHandler(ctx: AuthContext, request: FastifyRequest, reply: FastifyReply): Promise<OkReply>;
+export declare function sessionHandler(ctx: AuthContext, request: FastifyRequest): Promise<AuthSessionReply>;
+export declare function forgotPasswordHandler(ctx: AuthContext, request: FastifyRequest, body: AuthForgotBody): Promise<OkReply>;
+export declare function resetPasswordHandler(ctx: AuthContext, request: FastifyRequest, body: AuthResetBody): Promise<OkReply>;
+export declare function enroll2faHandler(ctx: AuthContext, request: FastifyRequest): Promise<Auth2faEnrollReply>;
+export declare function activate2faHandler(ctx: AuthContext, request: FastifyRequest, body: Auth2faActivateBody): Promise<Auth2faActivateReply>;
+export declare function disable2faHandler(ctx: AuthContext, request: FastifyRequest, body: Auth2faDisableBody): Promise<OkReply>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/routes/auth/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/routes/auth/handlers.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC5D,OAAO,EAML,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAyBxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,OAAO,EACR,MAAM,aAAa,CAAC;AAOrB,wBAAgB,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,YAAY,CAWnD;AAoBD,wBAAsB,YAAY,CAChC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,cAAc,GAAG,uBAAuB,CAAC,CA+CnD;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,cAAc,CAAC,CA4CzB;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,OAAO,CAAC,CAMlB;AAED,wBAAsB,cAAc,CAClC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAI3B;AAED,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,OAAO,CAAC,CAmBlB;AAED,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,OAAO,CAAC,CA2BlB;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,kBAAkB,CAAC,CAuB7B;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,oBAAoB,CAAC,CA2B/B;AAED,wBAAsB,iBAAiB,CACrC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,kBAAkB,GACvB,OAAO,CAAC,OAAO,CAAC,CA6BlB"}