@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/auth/handlers.js

@@ -0,0 +1,256 @@
+import { passwordResetsRepo, rolesRepo, sessionsRepo, usersRepo, writeBool, } from '@adminium/meta';
+import { AppError, ConflictError, UnauthorizedError } from '../../errors.js';
+import { auditAuth } from '../../auth/audit.js';
+import { hashPassword, needsRehash, verifyPassword } from '../../auth/passwords.js';
+import { RESET_TOKEN_PREFIX, RESET_TOKEN_TTL_MS, clearSessionCookie, consumeChallenge, createChallenge, createSession, hashToken, mintToken, setSessionCookie, } from '../../auth/sessions.js';
+import { consumeRecoveryCode, decryptTotpSecret, encryptTotpSecret, generateRecoveryCodes, generateTotpEnrollment, hashRecoveryCodes, verifyTotpCode, } from '../../auth/totp.js';
+/** Uniform credential failure — no user enumeration (§2.1). */
+function invalidCredentials(message = 'Invalid email or password.') {
+    return new AppError(401, 'INVALID_CREDENTIALS', message);
+}
+export function toUserView(user) {
+    return {
+        id: user.id,
+        email: user.email,
+        name: user.name,
+        status: user.status,
+        totpEnabled: user.totpEnabled,
+        lastLoginAt: user.lastLoginAt,
+        createdAt: user.createdAt,
+        updatedAt: user.updatedAt,
+    };
+}
+const OK = { data: { ok: true } };
+function requestMeta(request) {
+    const userAgent = request.headers['user-agent'];
+    return {
+        ip: request.ip,
+        userAgent: typeof userAgent === 'string' ? userAgent.slice(0, 300) : null,
+    };
+}
+/** The authenticated user/session, guaranteed by the requireAuth preHandler. */
+function principal(request) {
+    if (request.user === null || request.session === null) {
+        throw new UnauthorizedError('UNAUTHENTICATED');
+    }
+    return { user: request.user, sessionId: request.session.id };
+}
+export async function loginHandler(ctx, request, reply, body) {
+    const now = Date.now();
+    const users = usersRepo(ctx.meta);
+    const user = await users.findByEmail(body.email);
+    const passwordOk = user !== null &&
+        user.status === 'active' &&
+        user.passwordHash !== null &&
+        (await verifyPassword(user.passwordHash, body.password));
+    if (!passwordOk) {
+        await auditAuth(ctx.meta, request, {
+            action: 'login_failed',
+            actorId: user?.id ?? null,
+            actorLabel: user?.name ?? body.email.trim().toLowerCase(),
+        });
+        throw invalidCredentials();
+    }
+    // `user` is non-null with a non-null hash beyond this point.
+    const activeUser = user;
+    // Transparent parameter upgrades on successful verify (§7 item 7).
+    if (activeUser.passwordHash !== null && needsRehash(activeUser.passwordHash)) {
+        await users.updatePassword(activeUser.id, await hashPassword(body.password), now);
+    }
+    if (activeUser.totpEnabled) {
+        const challenge = await createChallenge(ctx.meta, activeUser.id, requestMeta(request), now);
+        await auditAuth(ctx.meta, request, {
+            action: '2fa_challenge',
+            actorId: activeUser.id,
+            actorLabel: activeUser.name,
+        });
+        void reply.status(202);
+        return { data: { twoFactorRequired: true, challengeToken: challenge.token } };
+    }
+    const { token } = await createSession(ctx.meta, activeUser.id, requestMeta(request), now);
+    await users.recordLogin(activeUser.id, now);
+    setSessionCookie(reply, token, request);
+    await auditAuth(ctx.meta, request, {
+        action: 'login',
+        actorId: activeUser.id,
+        actorLabel: activeUser.name,
+    });
+    const fresh = (await users.findById(activeUser.id)) ?? activeUser;
+    return { data: { user: toUserView(fresh) } };
+}
+export async function verify2faHandler(ctx, request, reply, body) {
+    const now = Date.now();
+    const users = usersRepo(ctx.meta);
+    const challenge = await consumeChallenge(ctx.meta, body.challengeToken, now);
+    if (challenge === null) {
+        throw invalidCredentials('Invalid or expired challenge.');
+    }
+    const user = await users.findById(challenge.userId);
+    if (user === null || user.status !== 'active' || !user.totpEnabled) {
+        throw invalidCredentials('Invalid or expired challenge.');
+    }
+    let codeOk = false;
+    if (/^\d{6}$/.test(body.code.replaceAll(/[\s-]/g, ''))) {
+        if (user.totpSecretEncrypted !== null) {
+            codeOk = verifyTotpCode(decryptTotpSecret(user.totpSecretEncrypted, ctx.totpKey), body.code, now);
+        }
+    }
+    else if (user.recoveryCodes !== null) {
+        // Recovery path: single-use — the matched hash is removed from the list.
+        const remaining = await consumeRecoveryCode(user.recoveryCodes, body.code);
+        if (remaining !== null) {
+            await users.setRecoveryCodes(user.id, remaining, now);
+            codeOk = true;
+        }
+    }
+    if (!codeOk) {
+        await auditAuth(ctx.meta, request, {
+            action: '2fa_failed',
+            actorId: user.id,
+            actorLabel: user.name,
+        });
+        throw invalidCredentials('Invalid authentication code.');
+    }
+    // Fresh token on successful 2FA verify — fixation defense (§2.1).
+    const { token } = await createSession(ctx.meta, user.id, requestMeta(request), now);
+    await users.recordLogin(user.id, now);
+    setSessionCookie(reply, token, request);
+    await auditAuth(ctx.meta, request, { action: 'login', actorId: user.id, actorLabel: user.name });
+    const fresh = (await users.findById(user.id)) ?? user;
+    return { data: { user: toUserView(fresh) } };
+}
+export async function logoutHandler(ctx, request, reply) {
+    const { user, sessionId } = principal(request);
+    await sessionsRepo(ctx.meta).revoke(sessionId);
+    clearSessionCookie(reply, request);
+    await auditAuth(ctx.meta, request, { action: 'logout', actorId: user.id, actorLabel: user.name });
+    return OK;
+}
+export async function sessionHandler(ctx, request) {
+    const { user } = principal(request);
+    const roles = await rolesRepo(ctx.meta).rolesForUser(user.id);
+    return { data: { user: toUserView(user), roles: roles.map((role) => role.slug) } };
+}
+export async function forgotPasswordHandler(ctx, request, body) {
+    const now = Date.now();
+    const user = await usersRepo(ctx.meta).findByEmail(body.email);
+    // Always 200 — the response never reveals whether the account exists (§2.1).
+    if (user === null || user.status === 'suspended')
+        return OK;
+    const token = mintToken(RESET_TOKEN_PREFIX);
+    const expiresAt = now + RESET_TOKEN_TTL_MS;
+    await passwordResetsRepo(ctx.meta).create({ userId: user.id, kind: 'reset', tokenHash: hashToken(token), expiresAt }, now);
+    ctx.deliverResetToken?.({ userId: user.id, email: user.email, token, expiresAt });
+    await auditAuth(ctx.meta, request, {
+        action: 'password_reset_requested',
+        actorId: user.id,
+        actorLabel: user.name,
+    });
+    return OK;
+}
+export async function resetPasswordHandler(ctx, request, body) {
+    const now = Date.now();
+    const resets = passwordResetsRepo(ctx.meta);
+    const users = usersRepo(ctx.meta);
+    const row = await resets.findValidByTokenHash(hashToken(body.token), now);
+    // `consume` is the single-use guard: only the first request wins.
+    if (row === null || !(await resets.consume(row.id, now))) {
+        throw invalidCredentials('Invalid or expired reset token.');
+    }
+    const user = await users.findById(row.userId);
+    if (user === null || user.status === 'suspended') {
+        throw invalidCredentials('Invalid or expired reset token.');
+    }
+    await users.updatePassword(user.id, await hashPassword(body.newPassword), now);
+    // Invite-activation path (§2.1): first password set activates the account.
+    if (user.status === 'invited')
+        await users.updateStatus(user.id, 'active', now);
+    // Credential change revokes every existing session (§7 item 7).
+    await sessionsRepo(ctx.meta).revokeAllForUser(user.id, now);
+    await auditAuth(ctx.meta, request, {
+        action: 'password_reset',
+        actorId: user.id,
+        actorLabel: user.name,
+    });
+    return OK;
+}
+export async function enroll2faHandler(ctx, request) {
+    const now = Date.now();
+    const { user } = principal(request);
+    if (user.totpEnabled) {
+        throw new ConflictError('Two-factor authentication is already enabled.');
+    }
+    const enrollment = generateTotpEnrollment(user.email);
+    // Secret encrypted at rest; not yet active until /auth/2fa/activate (§2.1).
+    await ctx.meta.db
+        .updateTable('adminium_users')
+        .set({
+        totpSecretEncrypted: encryptTotpSecret(enrollment.secret, ctx.totpKey),
+        updatedAt: now,
+    })
+        .where('id', '=', user.id)
+        .execute();
+    await auditAuth(ctx.meta, request, {
+        action: '2fa_enroll_started',
+        actorId: user.id,
+        actorLabel: user.name,
+    });
+    return { data: { secret: enrollment.secret, otpauthUrl: enrollment.otpauthUrl } };
+}
+export async function activate2faHandler(ctx, request, body) {
+    const now = Date.now();
+    const { user } = principal(request);
+    if (user.totpEnabled) {
+        throw new ConflictError('Two-factor authentication is already enabled.');
+    }
+    if (user.totpSecretEncrypted === null) {
+        throw new ConflictError('Enroll first: POST /auth/2fa/enroll.');
+    }
+    const secret = decryptTotpSecret(user.totpSecretEncrypted, ctx.totpKey);
+    if (!verifyTotpCode(secret, body.code, now)) {
+        throw invalidCredentials('Invalid authentication code.');
+    }
+    const recoveryCodes = generateRecoveryCodes();
+    await usersRepo(ctx.meta).setRecoveryCodes(user.id, await hashRecoveryCodes(recoveryCodes), now);
+    await ctx.meta.db
+        .updateTable('adminium_users')
+        .set({ totpEnabled: writeBool(ctx.meta, true), updatedAt: now })
+        .where('id', '=', user.id)
+        .execute();
+    await auditAuth(ctx.meta, request, {
+        action: '2fa_enrolled',
+        actorId: user.id,
+        actorLabel: user.name,
+    });
+    return { data: { recoveryCodes } };
+}
+export async function disable2faHandler(ctx, request, body) {
+    const now = Date.now();
+    const { user } = principal(request);
+    if (user.passwordHash === null || !(await verifyPassword(user.passwordHash, body.password))) {
+        throw invalidCredentials('Invalid password.');
+    }
+    if (body.code !== undefined && user.totpSecretEncrypted !== null) {
+        const secret = decryptTotpSecret(user.totpSecretEncrypted, ctx.totpKey);
+        if (!verifyTotpCode(secret, body.code, now)) {
+            throw invalidCredentials('Invalid authentication code.');
+        }
+    }
+    await usersRepo(ctx.meta).setRecoveryCodes(user.id, null, now);
+    await ctx.meta.db
+        .updateTable('adminium_users')
+        .set({
+        totpEnabled: writeBool(ctx.meta, false),
+        totpSecretEncrypted: null,
+        updatedAt: now,
+    })
+        .where('id', '=', user.id)
+        .execute();
+    await auditAuth(ctx.meta, request, {
+        action: '2fa_disabled',
+        actorId: user.id,
+        actorLabel: user.name,
+    });
+    return OK;
+}
+//# sourceMappingURL=handlers.js.map

package/dist/routes/auth/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/routes/auth/handlers.ts"],"names":[],"mappings":"AAOA,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,YAAY,EACZ,SAAS,EACT,SAAS,GAEV,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,SAAS,EACT,SAAS,EACT,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAkB5B,+DAA+D;AAC/D,SAAS,kBAAkB,CAAC,OAAO,GAAG,4BAA4B;IAChE,OAAO,IAAI,QAAQ,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAU;IACnC,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC;AAE3C,SAAS,WAAW,CAAC,OAAuB;IAC1C,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAChD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1E,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,SAAS,CAAC,OAAuB;IACxC,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAgB,EAChB,OAAuB,EACvB,KAAmB,EACnB,IAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,UAAU,GACd,IAAI,KAAK,IAAI;QACb,IAAI,CAAC,MAAM,KAAK,QAAQ;QACxB,IAAI,CAAC,YAAY,KAAK,IAAI;QAC1B,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE3D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;YACjC,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI;YACzB,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;SAC1D,CAAC,CAAC;QACH,MAAM,kBAAkB,EAAE,CAAC;IAC7B,CAAC;IACD,6DAA6D;IAC7D,MAAM,UAAU,GAAG,IAAI,CAAC;IAExB,mEAAmE;IACnE,IAAI,UAAU,CAAC,YAAY,KAAK,IAAI,IAAI,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7E,MAAM,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,CAAC;IAED,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5F,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;YACjC,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE,UAAU,CAAC,EAAE;YACtB,UAAU,EAAE,UAAU,CAAC,IAAI;SAC5B,CAAC,CAAC;QACH,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;IAChF,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1F,MAAM,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;QACjC,MAAM,EAAE,OAAO;QACf,OAAO,EAAE,UAAU,CAAC,EAAE;QACtB,UAAU,EAAE,UAAU,CAAC,IAAI;KAC5B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAgB,EAChB,OAAuB,EACvB,KAAmB,EACnB,IAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;IAC7E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACnE,MAAM,kBAAkB,CAAC,+BAA+B,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;QACvD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,GAAG,cAAc,CAAC,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;SAAM,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QACvC,yEAAyE;QACzE,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;YACtD,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;YACjC,MAAM,EAAE,YAAY;YACpB,OAAO,EAAE,IAAI,CAAC,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,IAAI;SACtB,CAAC,CAAC;QACH,MAAM,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IAC3D,CAAC;IAED,kEAAkE;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,MAAM,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACtC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACxC,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAgB,EAChB,OAAuB,EACvB,KAAmB;IAEnB,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/C,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAClG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAgB,EAChB,OAAuB;IAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAgB,EAChB,OAAuB,EACvB,IAAoB;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/D,6EAA6E;IAC7E,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW;QAAE,OAAO,EAAE,CAAC;IAE5D,MAAM,KAAK,GAAG,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,GAAG,GAAG,kBAAkB,CAAC;IAC3C,MAAM,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CACvC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,EAC1E,GAAG,CACJ,CAAC;IACF,GAAG,CAAC,iBAAiB,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAClF,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;QACjC,MAAM,EAAE,0BAA0B;QAClC,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,IAAI;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAgB,EAChB,OAAuB,EACvB,IAAmB;IAEnB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,kEAAkE;IAClE,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QACjD,MAAM,kBAAkB,CAAC,iCAAiC,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/E,2EAA2E;IAC3E,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IAChF,gEAAgE;IAChE,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;QACjC,MAAM,EAAE,gBAAgB;QACxB,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,IAAI;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,GAAgB,EAChB,OAAuB;IAEvB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,+CAA+C,CAAC,CAAC;IAC3E,CAAC;IAED,MAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtD,4EAA4E;IAC5E,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE;SACd,WAAW,CAAC,gBAAgB,CAAC;SAC7B,GAAG,CAAC;QACH,mBAAmB,EAAE,iBAAiB,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;QACtE,SAAS,EAAE,GAAG;KACf,CAAC;SACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;SACzB,OAAO,EAAE,CAAC;IACb,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;QACjC,MAAM,EAAE,oBAAoB;QAC5B,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,IAAI;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAgB,EAChB,OAAuB,EACvB,IAAyB;IAEzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,MAAM,IAAI,aAAa,CAAC,+CAA+C,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,aAAa,CAAC,sCAAsC,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACxE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5C,MAAM,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,aAAa,GAAG,qBAAqB,EAAE,CAAC;IAC9C,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,iBAAiB,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC,CAAC;IACjG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE;SACd,WAAW,CAAC,gBAAgB,CAAC;SAC7B,GAAG,CAAC,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SAC/D,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;SACzB,OAAO,EAAE,CAAC;IACb,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;QACjC,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,IAAI;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,GAAgB,EAChB,OAAuB,EACvB,IAAwB;IAExB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC5F,MAAM,kBAAkB,CAAC,mBAAmB,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACxE,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,kBAAkB,CAAC,8BAA8B,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/D,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE;SACd,WAAW,CAAC,gBAAgB,CAAC;SAC7B,GAAG,CAAC;QACH,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;QACvC,mBAAmB,EAAE,IAAI;QACzB,SAAS,EAAE,GAAG;KACf,CAAC;SACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;SACzB,OAAO,EAAE,CAAC;IACb,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE;QACjC,MAAM,EAAE,cAAc;QACtB,OAAO,EAAE,IAAI,CAAC,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,IAAI;KACtB,CAAC,CAAC;IACH,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/routes/auth/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Auth routes (08-server-api.md §2.1), mounted under /api/v1 by app.ts.
+ *
+ * Every route runs `requireMeta` (503 META_NOT_CONFIGURED when the server
+ * boots without a meta DB); session-bound routes add `requireAuth`. The
+ * credential-facing routes carry `config.rateLimitBucket` markers — the §6
+ * rate limiter in `plugins/core.ts` keys its buckets off them (limits live in
+ * its `RATE_BUCKETS` table; an unknown marker fails the boot).
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+/**
+ * §6 rate-limit bucket markers (5/min login+verify+reset, 3/hour forgot —
+ * the limits themselves live in `RATE_BUCKETS`, plugins/core.ts).
+ */
+export declare const RATE_LIMIT_BUCKETS: {
+    readonly login: "auth-login";
+    readonly forgot: "auth-password-forgot";
+    readonly reset: "auth-password-reset";
+};
+declare module 'fastify' {
+    interface FastifyContextConfig {
+        /** §6 bucket key the core plugin's rate limiter attaches to. */
+        rateLimitBucket?: string;
+    }
+}
+export declare const authRoutes: FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AA8BvE;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,OAAO,QAAQ,SAAS,CAAC;IACvB,UAAU,oBAAoB;QAC5B,gEAAgE;QAChE,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;CACF;AAED,eAAO,MAAM,UAAU,EAAE,qBAkGxB,CAAC"}

package/dist/routes/auth/index.js

@@ -0,0 +1,67 @@
+import { AppError } from '../../errors.js';
+import { activate2faHandler, disable2faHandler, enroll2faHandler, forgotPasswordHandler, loginHandler, logoutHandler, resetPasswordHandler, sessionHandler, verify2faHandler, } from './handlers.js';
+import { auth2faActivateBody, auth2faActivateReply, auth2faDisableBody, auth2faEnrollReply, auth2faVerifyBody, authForgotBody, authLoginBody, authLoginChallengeReply, authLoginReply, authResetBody, authSessionReply, okReply, } from './schema.js';
+/**
+ * §6 rate-limit bucket markers (5/min login+verify+reset, 3/hour forgot —
+ * the limits themselves live in `RATE_BUCKETS`, plugins/core.ts).
+ */
+export const RATE_LIMIT_BUCKETS = {
+    login: 'auth-login',
+    forgot: 'auth-password-forgot',
+    reset: 'auth-password-reset',
+};
+export const authRoutes = async (app) => {
+    /** Non-null under requireMeta — the preHandler 503s before handlers run. */
+    const ctx = () => {
+        if (app.authContext === null) {
+            throw new AppError(503, 'META_NOT_CONFIGURED', 'No meta store is configured.');
+        }
+        return app.authContext;
+    };
+    app.post('/auth/login', {
+        preHandler: [app.requireMeta],
+        config: { rateLimitBucket: RATE_LIMIT_BUCKETS.login },
+        schema: {
+            body: authLoginBody,
+            response: { 200: authLoginReply, 202: authLoginChallengeReply },
+        },
+    }, async (request, reply) => loginHandler(ctx(), request, reply, request.body));
+    app.post('/auth/2fa/verify', {
+        preHandler: [app.requireMeta],
+        config: { rateLimitBucket: RATE_LIMIT_BUCKETS.login },
+        schema: { body: auth2faVerifyBody, response: { 200: authLoginReply } },
+    }, async (request, reply) => verify2faHandler(ctx(), request, reply, request.body));
+    app.post('/auth/logout', {
+        preHandler: [app.requireMeta, app.requireAuth],
+        schema: { response: { 200: okReply } },
+    }, async (request, reply) => logoutHandler(ctx(), request, reply));
+    app.get('/auth/session', {
+        preHandler: [app.requireMeta, app.requireAuth],
+        schema: { response: { 200: authSessionReply } },
+    }, async (request) => sessionHandler(ctx(), request));
+    app.post('/auth/password/forgot', {
+        preHandler: [app.requireMeta],
+        config: { rateLimitBucket: RATE_LIMIT_BUCKETS.forgot },
+        schema: { body: authForgotBody, response: { 200: okReply } },
+    }, async (request) => forgotPasswordHandler(ctx(), request, request.body));
+    app.post('/auth/password/reset', {
+        preHandler: [app.requireMeta],
+        // The token CONSUME side: single-use + 30-min TTL (§7 item 7) bounds a
+        // token's lifetime, this bounds how fast one can be guessed within it.
+        config: { rateLimitBucket: RATE_LIMIT_BUCKETS.reset },
+        schema: { body: authResetBody, response: { 200: okReply } },
+    }, async (request) => resetPasswordHandler(ctx(), request, request.body));
+    app.post('/auth/2fa/enroll', {
+        preHandler: [app.requireMeta, app.requireAuth],
+        schema: { response: { 200: auth2faEnrollReply } },
+    }, async (request) => enroll2faHandler(ctx(), request));
+    app.post('/auth/2fa/activate', {
+        preHandler: [app.requireMeta, app.requireAuth],
+        schema: { body: auth2faActivateBody, response: { 200: auth2faActivateReply } },
+    }, async (request) => activate2faHandler(ctx(), request, request.body));
+    app.post('/auth/2fa/disable', {
+        preHandler: [app.requireMeta, app.requireAuth],
+        schema: { body: auth2faDisableBody, response: { 200: okReply } },
+    }, async (request) => disable2faHandler(ctx(), request, request.body));
+};
+//# sourceMappingURL=index.js.map

package/dist/routes/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/auth/index.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,oBAAoB,EACpB,cAAc,EACd,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,uBAAuB,EACvB,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,OAAO,GACR,MAAM,aAAa,CAAC;AAErB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,sBAAsB;IAC9B,KAAK,EAAE,qBAAqB;CACpB,CAAC;AASX,MAAM,CAAC,MAAM,UAAU,GAA0B,KAAK,EAAE,GAAG,EAAE,EAAE;IAC7D,4EAA4E;IAC5E,MAAM,GAAG,GAAG,GAAgB,EAAE;QAC5B,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,qBAAqB,EAAE,8BAA8B,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,GAAG,CAAC,WAAW,CAAC;IACzB,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,aAAa,EACb;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;QAC7B,MAAM,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,EAAE;QACrD,MAAM,EAAE;YACN,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,uBAAuB,EAAE;SAChE;KACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAC5E,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,kBAAkB,EAClB;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;QAC7B,MAAM,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,EAAE;QACrD,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE;KACvE,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,CAChF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;KACvC,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAC/D,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,eAAe,EACf;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;KAChD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CAClD,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;QAC7B,MAAM,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,MAAM,EAAE;QACtD,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;KAC7D,EACD,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CACvE,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,sBAAsB,EACtB;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC;QAC7B,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,EAAE,EAAE,eAAe,EAAE,kBAAkB,CAAC,KAAK,EAAE;QACrD,MAAM,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;KAC5D,EACD,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CACtE,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,kBAAkB,EAClB;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,EAAE;KAClD,EACD,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,CACpD,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,oBAAoB,EACpB;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE;KAC/E,EACD,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CACpE,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,mBAAmB,EACnB;QACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,WAAW,CAAC;QAC9C,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;KACjE,EACD,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CACnE,CAAC;AACJ,CAAC,CAAC"}

package/dist/routes/auth/schema.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Zod schemas for the auth resource (08-server-api.md §2.1; naming per §1.5:
+ * `<resource><Action><Part>` consts, PascalCase `z.infer` types).
+ */
+import { z } from 'zod';
+/** Public projection of `adminium_users` — never hashes/secrets (§7 item 6). */
+export declare const authUserView: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        invited: "invited";
+        suspended: "suspended";
+    }>;
+    totpEnabled: z.ZodBoolean;
+    lastLoginAt: z.ZodNullable<z.ZodNumber>;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type AuthUserView = z.infer<typeof authUserView>;
+export declare const okReply: z.ZodObject<{
+    data: z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type OkReply = z.infer<typeof okReply>;
+export declare const authLoginBody: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type AuthLoginBody = z.infer<typeof authLoginBody>;
+export declare const authLoginReply: z.ZodObject<{
+    data: z.ZodObject<{
+        user: z.ZodObject<{
+            id: z.ZodString;
+            email: z.ZodString;
+            name: z.ZodString;
+            status: z.ZodEnum<{
+                active: "active";
+                invited: "invited";
+                suspended: "suspended";
+            }>;
+            totpEnabled: z.ZodBoolean;
+            lastLoginAt: z.ZodNullable<z.ZodNumber>;
+            createdAt: z.ZodNumber;
+            updatedAt: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AuthLoginReply = z.infer<typeof authLoginReply>;
+/** 202 login step-up: the user has TOTP enabled (§2.1). */
+export declare const authLoginChallengeReply: z.ZodObject<{
+    data: z.ZodObject<{
+        twoFactorRequired: z.ZodLiteral<true>;
+        challengeToken: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AuthLoginChallengeReply = z.infer<typeof authLoginChallengeReply>;
+export declare const auth2faVerifyBody: z.ZodObject<{
+    challengeToken: z.ZodString;
+    code: z.ZodString;
+}, z.core.$strip>;
+export type Auth2faVerifyBody = z.infer<typeof auth2faVerifyBody>;
+export declare const authSessionReply: z.ZodObject<{
+    data: z.ZodObject<{
+        user: z.ZodObject<{
+            id: z.ZodString;
+            email: z.ZodString;
+            name: z.ZodString;
+            status: z.ZodEnum<{
+                active: "active";
+                invited: "invited";
+                suspended: "suspended";
+            }>;
+            totpEnabled: z.ZodBoolean;
+            lastLoginAt: z.ZodNullable<z.ZodNumber>;
+            createdAt: z.ZodNumber;
+            updatedAt: z.ZodNumber;
+        }, z.core.$strip>;
+        roles: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type AuthSessionReply = z.infer<typeof authSessionReply>;
+export declare const authForgotBody: z.ZodObject<{
+    email: z.ZodString;
+}, z.core.$strip>;
+export type AuthForgotBody = z.infer<typeof authForgotBody>;
+export declare const authResetBody: z.ZodObject<{
+    token: z.ZodString;
+    newPassword: z.ZodString;
+}, z.core.$strip>;
+export type AuthResetBody = z.infer<typeof authResetBody>;
+export declare const auth2faEnrollReply: z.ZodObject<{
+    data: z.ZodObject<{
+        secret: z.ZodString;
+        otpauthUrl: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type Auth2faEnrollReply = z.infer<typeof auth2faEnrollReply>;
+export declare const auth2faActivateBody: z.ZodObject<{
+    code: z.ZodString;
+}, z.core.$strip>;
+export type Auth2faActivateBody = z.infer<typeof auth2faActivateBody>;
+export declare const auth2faActivateReply: z.ZodObject<{
+    data: z.ZodObject<{
+        recoveryCodes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type Auth2faActivateReply = z.infer<typeof auth2faActivateReply>;
+export declare const auth2faDisableBody: z.ZodObject<{
+    password: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type Auth2faDisableBody = z.infer<typeof auth2faDisableBody>;
+/**
+ * `POST /auth/desktop-session` (11-electron.md §5) — the desktop shell's per-boot
+ * token, exchanged for a normal session.
+ *
+ * The shape is pinned to §2.2 step 4's token (32 bytes, hex) rather than left as
+ * a loose string: a body that cannot be the token is rejected by the schema
+ * before any comparison runs, and 422-on-malformed keeps the handler's own 401
+ * meaning exactly one thing — "well-formed, and wrong".
+ */
+export declare const authDesktopSessionBody: z.ZodObject<{
+    bootToken: z.ZodString;
+}, z.core.$strip>;
+export type AuthDesktopSessionBody = z.infer<typeof authDesktopSessionBody>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/auth/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/auth/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAChF,eAAO,MAAM,YAAY;;;;;;;;;;;;;iBASvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,OAAO;;;;iBAAwD,CAAC;AAC7E,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;iBAAuD,CAAC;AACnF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,2DAA2D;AAC3D,eAAO,MAAM,uBAAuB;;;;;iBAMlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,eAAO,MAAM,iBAAiB;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;iBAM3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,cAAc;;iBAEzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,aAAa;;;iBAGxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,kBAAkB;;;;;iBAO7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,oBAAoB;;;;iBAK/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,kBAAkB;;;iBAI7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/routes/auth/schema.js

@@ -0,0 +1,84 @@
+/**
+ * Zod schemas for the auth resource (08-server-api.md §2.1; naming per §1.5:
+ * `<resource><Action><Part>` consts, PascalCase `z.infer` types).
+ */
+import { z } from 'zod';
+/** Public projection of `adminium_users` — never hashes/secrets (§7 item 6). */
+export const authUserView = z.object({
+    id: z.string(),
+    email: z.string(),
+    name: z.string(),
+    status: z.enum(['active', 'invited', 'suspended']),
+    totpEnabled: z.boolean(),
+    lastLoginAt: z.number().nullable(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+});
+export const okReply = z.object({ data: z.object({ ok: z.literal(true) }) });
+export const authLoginBody = z.object({
+    email: z.string().trim().min(3).max(320),
+    password: z.string().min(1).max(200),
+});
+export const authLoginReply = z.object({ data: z.object({ user: authUserView }) });
+/** 202 login step-up: the user has TOTP enabled (§2.1). */
+export const authLoginChallengeReply = z.object({
+    data: z.object({
+        twoFactorRequired: z.literal(true),
+        /** 5-minute single-use challenge token to present at /auth/2fa/verify. */
+        challengeToken: z.string(),
+    }),
+});
+export const auth2faVerifyBody = z.object({
+    challengeToken: z.string().min(1),
+    /** 6-digit TOTP or a recovery code (`xxxxx-xxxxx`). */
+    code: z.string().trim().min(6).max(20),
+});
+export const authSessionReply = z.object({
+    data: z.object({
+        user: authUserView,
+        /** Role slugs, e.g. `["super-admin"]` — full RBAC arrives with rbac. */
+        roles: z.array(z.string()),
+    }),
+});
+export const authForgotBody = z.object({
+    email: z.string().trim().min(3).max(320),
+});
+export const authResetBody = z.object({
+    token: z.string().min(1),
+    newPassword: z.string().min(8).max(200),
+});
+export const auth2faEnrollReply = z.object({
+    data: z.object({
+        /** Base32 secret for manual entry. Shown once; encrypted at rest. */
+        secret: z.string(),
+        /** `otpauth://totp/...` — render as a QR code client-side. */
+        otpauthUrl: z.string(),
+    }),
+});
+export const auth2faActivateBody = z.object({
+    code: z.string().trim().min(6).max(20),
+});
+export const auth2faActivateReply = z.object({
+    data: z.object({
+        /** 10 single-use recovery codes — returned exactly once, stored hashed. */
+        recoveryCodes: z.array(z.string()),
+    }),
+});
+export const auth2faDisableBody = z.object({
+    password: z.string().min(1).max(200),
+    /** Optional current TOTP code — verified when provided. */
+    code: z.string().trim().min(6).max(20).optional(),
+});
+/**
+ * `POST /auth/desktop-session` (11-electron.md §5) — the desktop shell's per-boot
+ * token, exchanged for a normal session.
+ *
+ * The shape is pinned to §2.2 step 4's token (32 bytes, hex) rather than left as
+ * a loose string: a body that cannot be the token is rejected by the schema
+ * before any comparison runs, and 422-on-malformed keeps the handler's own 401
+ * meaning exactly one thing — "well-formed, and wrong".
+ */
+export const authDesktopSessionBody = z.object({
+    bootToken: z.string().regex(/^[0-9a-fA-F]{64}$/, 'must be 64 hex characters'),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/auth/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/auth/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAClD,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAG7E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC,CAAC;AAGnF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,iBAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,0EAA0E;QAC1E,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;KAC3B,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACjC,uDAAuD;IACvD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,IAAI,EAAE,YAAY;QAClB,wEAAwE;QACxE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACzC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,qEAAqE;QACrE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,8DAA8D;QAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;KACvB,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,2EAA2E;QAC3E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KACnC,CAAC;CACH,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,2DAA2D;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClD,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;CAC9E,CAAC,CAAC"}

package/dist/routes/bootstrap/handlers.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `GET /api/v1/bootstrap` handler (09-generated-app.md §2.1) — deliberately
+ * thin: one query per concern, no fan-out beyond what the shell needs on a
+ * cold load.
+ *
+ * - session user + role slugs via the existing auth plumbing;
+ * - preference axes resolved server-side (`userPrefsRepo.resolve`, §7.2);
+ * - nav tree from enabled `adminium_pages` rows bucketed into the five fixed
+ *   groups (rows land in M4 Wave B generation — an empty tree is valid);
+ * - `version` (server build) + `configVersion` (max page `updatedAt`) so the
+ *   client can drop stale caches on WS `config-changed`.
+ * - nav rows are permission-filtered server-side (09 §2.1): non-super-admins
+ *   only see pages their roles hold a `page:<id>:view` grant for — the same
+ *   grant `GET /pages/:pageId` enforces, so the nav never links to a 403.
+ * - `llm.enabled` mirrors the §3.2 provider config (06-llm-assist.md): true
+ *   once an admin has set `llm.provider` in Settings → AI, the same check
+ *   `resolveProviderClient` makes before a direct run.
+ */
+import type { FastifyRequest } from 'fastify';
+import { type PageNavRow } from '@adminium/meta';
+import type { AuthContext } from '../../plugins/auth.js';
+import { type BootstrapNavTree, type BootstrapReply } from './schema.js';
+/**
+ * Buckets page rows into the five fixed groups; empty groups are omitted.
+ * `connectionNames` (id → display name) annotates every item with its owning
+ * connection so multi-connection sidebars can label generated groups
+ * unambiguously (M5-T05); with zero/one connection clients render flat.
+ */
+export declare function buildNavTree(rows: readonly PageNavRow[], connectionNames?: ReadonlyMap<string, string>): {
+    nav: BootstrapNavTree;
+    configVersion: number;
+};
+export declare function bootstrapHandler(ctx: AuthContext, request: FastifyRequest): Promise<BootstrapReply>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/routes/bootstrap/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/routes/bootstrap/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC9C,OAAO,EAML,KAAK,UAAU,EAEhB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAGzD,OAAO,EAGL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAEpB,MAAM,aAAa,CAAC;AAOrB;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,IAAI,EAAE,SAAS,UAAU,EAAE,EAC3B,eAAe,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,GACvD;IACD,GAAG,EAAE,gBAAgB,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB,CAmCA;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAiDzB"}