@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/connections/index.js

@@ -0,0 +1,260 @@
+/**
+ * Connections manager routes (08-server-api.md §2.4, M3-T04):
+ * create (test + encrypt + meta-placement enforcement), list with health,
+ * get/patch, type-to-confirm delete (pool disposal included), pre-create and
+ * per-connection test, and introspection (202 job when the jobs worker is
+ * wired; synchronous fallback otherwise).
+ *
+ * All routes are guarded by `system:connections:manage` — the v1 closed
+ * grant set (meta SYSTEM_ACTION_KEYS) has no `connections.read`, so reads
+ * share the manage grant until the grammar grows one.
+ */
+import { pagesRepo, snapshotsRepo } from '@adminium/meta';
+import { ConflictError, ValidationFailedError } from '../../errors.js';
+import { maskDsn } from '../../connections/dsn.js';
+import { INTROSPECT_JOB_KIND, runIntrospection, } from '../../connections/introspect.js';
+import { connectionCreateBody, connectionDeleteBody, connectionIdParams, connectionListReply, connectionPatchBody, connectionReply, connectionTestBody, connectionTestReply, introspectSyncReply, jobAcceptedReply, okReply, } from './schema.js';
+export const CONNECTIONS_MANAGE = 'system:connections:manage';
+function testReply(summary) {
+    return {
+        ok: summary.ok,
+        latencyMs: summary.latencyMs,
+        serverVersion: summary.serverVersion,
+        readOnly: summary.readOnly,
+        privileges: summary.capabilities?.privileges ?? null,
+        error: summary.error,
+    };
+}
+/** Table count from the snapshot's normalized model (opaque to meta — 05 §2). */
+function modelTableCount(schema) {
+    if (schema === null || typeof schema !== 'object')
+        return null;
+    const tables = schema.tables;
+    return Array.isArray(tables) ? tables.length : null;
+}
+export function connectionsRoutes(deps) {
+    const { manager, meta } = deps;
+    const snapshots = snapshotsRepo(meta);
+    const pages = pagesRepo(meta);
+    return async (app) => {
+        async function toDto(connection, pageCounts) {
+            const dsns = await manager.connections.getDsns(connection.id);
+            const latest = await snapshots.latest(connection.id);
+            const counts = pageCounts ?? (await pages.countGeneratedByConnection());
+            return {
+                id: connection.id,
+                name: connection.name,
+                engine: connection.engine,
+                sourceKind: connection.sourceKind,
+                dsnMasked: maskDsn(dsns?.dataDsn ?? dsns?.introspectDsn ?? null),
+                readOnly: connection.readOnly,
+                status: connection.status,
+                lastTestedAt: connection.lastTestedAt,
+                lastLatencyMs: connection.lastLatencyMs,
+                lastError: connection.lastError,
+                snapshot: latest === null
+                    ? null
+                    : { id: latest.id, createdAt: latest.createdAt, checksum: latest.checksum },
+                // Included tables: explicit allowlist wins; else everything the last
+                // introspection saw; null before the first snapshot (hub shows "—").
+                tableCount: connection.settings.includedTables?.length ??
+                    (latest === null ? null : modelTableCount(latest.schema)),
+                pageCount: counts[connection.id] ?? 0,
+                createdAt: connection.createdAt,
+                updatedAt: connection.updatedAt,
+            };
+        }
+        app.get('/connections', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: { response: { 200: connectionListReply } },
+        }, async () => {
+            const connections = await manager.connections.list();
+            // One grouped query for all cards — no per-connection page scans.
+            const pageCounts = await pages.countGeneratedByConnection();
+            return { connections: await Promise.all(connections.map(async (c) => toDto(c, pageCounts))) };
+        });
+        app.post('/connections', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: { body: connectionCreateBody, response: { 201: connectionReply } },
+        }, async (request, reply) => {
+            const body = request.body;
+            const introspectDsn = body.roles?.introspect ?? body.dsn ?? body.roles?.data;
+            const dataDsn = body.roles?.data ?? body.dsn ?? introspectDsn;
+            if (introspectDsn === undefined || dataDsn === undefined) {
+                throw new ValidationFailedError('Provide `dsn` or `roles.data` (§2.4).', {});
+            }
+            // Test the data role — its probe drives read-only + meta placement.
+            const summary = await manager.testDsn(body.engine, dataDsn);
+            if (summary.ok)
+                manager.enforceMetaPlacement(dataDsn, summary);
+            const actorId = request.apiKeyPrincipal === null
+                ? (request.user?.id ?? null)
+                : null;
+            const connection = await manager.connections.create({
+                name: body.name,
+                engine: body.engine,
+                sourceKind: 'dsn',
+                introspectDsn,
+                dataDsn: dataDsn === introspectDsn ? null : dataDsn,
+                readOnly: summary.readOnly,
+                settings: body.settings ?? {},
+                status: summary.ok ? 'connected' : 'error',
+                createdBy: actorId,
+            });
+            await manager.connections.recordTestResult(connection.id, {
+                ok: summary.ok,
+                latencyMs: summary.latencyMs,
+                error: summary.error?.message ?? null,
+                readOnly: summary.readOnly,
+            });
+            await app.rbac.audit(request, {
+                category: 'connection',
+                action: 'connection.create',
+                connectionId: connection.id,
+                changes: {
+                    after: {
+                        name: body.name,
+                        engine: body.engine,
+                        dsnMasked: maskDsn(dataDsn),
+                        ok: summary.ok,
+                        readOnly: summary.readOnly,
+                    },
+                },
+            });
+            const created = await manager.connections.findById(connection.id);
+            return reply.status(201).send(await toDto(created ?? connection));
+        });
+        app.post('/connections/test', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: { body: connectionTestBody, response: { 200: connectionTestReply } },
+        }, async (request) => {
+            // Capability probes only — never persists (§2.4).
+            const summary = await manager.testDsn(request.body.engine, request.body.dsn);
+            return testReply(summary);
+        });
+        app.get('/connections/:id', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: { params: connectionIdParams, response: { 200: connectionReply } },
+        }, async (request) => toDto(await manager.mustFind(request.params.id)));
+        app.patch('/connections/:id', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: {
+                params: connectionIdParams,
+                body: connectionPatchBody,
+                response: { 200: connectionReply },
+            },
+        }, async (request) => {
+            const connection = await manager.mustFind(request.params.id);
+            const updated = await manager.connections.update(connection.id, {
+                ...(request.body.name !== undefined ? { name: request.body.name } : {}),
+                ...(request.body.settings !== undefined ? { settings: request.body.settings } : {}),
+            });
+            await app.rbac.audit(request, {
+                category: 'connection',
+                action: 'connection.update',
+                connectionId: connection.id,
+                changes: { before: { name: connection.name }, after: { name: updated?.name ?? connection.name } },
+            });
+            return toDto(updated ?? connection);
+        });
+        app.delete('/connections/:id', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: {
+                params: connectionIdParams,
+                body: connectionDeleteBody,
+                response: { 200: okReply },
+            },
+        }, async (request) => {
+            const connection = await manager.mustFind(request.params.id);
+            // Type-to-confirm contract (§2.4): the submitted name must match.
+            if (request.body.confirmName !== connection.name) {
+                throw new ConflictError('Type the connection name to confirm deletion.', 'CONFLICT', {
+                    expectedName: connection.name,
+                });
+            }
+            await manager.dispose(connection.id);
+            await manager.connections.delete(connection.id);
+            await app.rbac.audit(request, {
+                category: 'connection',
+                action: 'connection.delete',
+                connectionId: connection.id,
+                changes: { before: { name: connection.name, engine: connection.engine } },
+            });
+            return { ok: true };
+        });
+        app.post('/connections/:id/test', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: { params: connectionIdParams, response: { 200: connectionTestReply } },
+        }, async (request) => {
+            const connection = await manager.mustFind(request.params.id);
+            const dsns = await manager.connections.getDsns(connection.id);
+            if (dsns?.dataDsn == null) {
+                throw new ValidationFailedError('Connection has no DSN to test.', { connectionId: connection.id });
+            }
+            const summary = await manager.testDsn(connection.engine, dsns.dataDsn);
+            await manager.connections.recordTestResult(connection.id, {
+                ok: summary.ok,
+                latencyMs: summary.latencyMs,
+                error: summary.error?.message ?? null,
+                readOnly: summary.readOnly,
+            });
+            return testReply(summary);
+        });
+        app.post('/connections/:id/introspect', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: {
+                params: connectionIdParams,
+                response: { 200: introspectSyncReply, 202: jobAcceptedReply },
+            },
+        }, async (request, reply) => {
+            const connection = await manager.mustFind(request.params.id);
+            const actorId = request.apiKeyPrincipal === null
+                ? (request.user?.id ?? null)
+                : null;
+            // Async path (§2.4): enqueue when the jobs worker is wired.
+            if (app.hasDecorator('jobs') && app.jobs.registry.has(INTROSPECT_JOB_KIND)) {
+                const job = await app.jobs.enqueue({
+                    kind: INTROSPECT_JOB_KIND,
+                    // `userId` is the jobs owner convention (routes/jobs jobOwnerId) —
+                    // without it the enqueuing non-super-admin could not poll their
+                    // own job. `createdBy` is what the snapshot row records.
+                    payload: { connectionId: connection.id, createdBy: actorId, userId: actorId },
+                    dedupeKey: `introspect:${connection.id}`,
+                });
+                await app.rbac.audit(request, {
+                    category: 'schema',
+                    action: 'schema.introspect.enqueue',
+                    connectionId: connection.id,
+                    changes: { after: { jobId: job.id } },
+                });
+                return reply.status(202).send({ jobId: job.id });
+            }
+            // Synchronous fallback with the 05 §10 duration budget.
+            const result = await runIntrospection({
+                manager,
+                meta,
+                connectionId: connection.id,
+                createdBy: actorId,
+            });
+            await app.rbac.audit(request, {
+                category: 'schema',
+                action: 'schema.introspect',
+                connectionId: connection.id,
+                changes: {
+                    after: {
+                        snapshotId: result.snapshot.id,
+                        noop: result.noop,
+                        proposedMasks: result.proposedMasks,
+                    },
+                },
+            });
+            return reply.status(200).send({
+                snapshotId: result.snapshot.id,
+                noop: result.noop,
+                proposedMasks: result.proposedMasks,
+                checksum: result.snapshot.checksum,
+            });
+        });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/connections/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/connections/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAgC,MAAM,gBAAgB,CAAC;AAExF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,OAAO,GAGR,MAAM,aAAa,CAAC;AAErB,MAAM,CAAC,MAAM,kBAAkB,GAAG,2BAA2B,CAAC;AAO9D,SAAS,SAAS,CAAC,OAA8B;IAC/C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,YAAY,EAAE,UAAU,IAAI,IAAI;QACpD,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,MAAe;IACtC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,MAAM,GAAI,MAA+B,CAAC,MAAM,CAAC;IACvD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE9B,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,KAAK,UAAU,KAAK,CAClB,UAAsB,EACtB,UAA6C;YAE7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,MAAM,KAAK,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACxE,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAE;gBACjB,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,aAAa,IAAI,IAAI,CAAC;gBAChE,QAAQ,EAAE,UAAU,CAAC,QAAQ;gBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,YAAY,EAAE,UAAU,CAAC,YAAY;gBACrC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,QAAQ,EACN,MAAM,KAAK,IAAI;oBACb,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;gBAC/E,qEAAqE;gBACrE,qEAAqE;gBACrE,UAAU,EACR,UAAU,CAAC,QAAQ,CAAC,cAAc,EAAE,MAAM;oBAC1C,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3D,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC;gBACrC,SAAS,EAAE,UAAU,CAAC,SAAS;gBAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;aAChC,CAAC;QACJ,CAAC;QAED,GAAG,CAAC,GAAG,CACL,cAAc,EACd;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,EAAE;SACnD,EACD,KAAK,IAAI,EAAE;YACT,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACrD,kEAAkE;YAClE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,0BAA0B,EAAE,CAAC;YAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,cAAc,EACd;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;SAC3E,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,EAAE,UAAU,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;YAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;YAC9D,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACzD,MAAM,IAAI,qBAAqB,CAAC,uCAAuC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YAED,oEAAoE;YACpE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,OAAO,CAAC,EAAE;gBAAE,OAAO,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAE/D,MAAM,OAAO,GACX,OAAO,CAAC,eAAe,KAAK,IAAI;gBAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC;YACX,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;gBAClD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,UAAU,EAAE,KAAK;gBACjB,aAAa;gBACb,OAAO,EAAE,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO;gBACnD,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE;gBAC7B,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;gBAC1C,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE;gBACxD,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;gBACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,OAAO,EAAE;oBACP,KAAK,EAAE;wBACL,IAAI,EAAE,IAAI,CAAC,IAAI;wBACf,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC;wBAC3B,EAAE,EAAE,OAAO,CAAC,EAAE;wBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;qBAC3B;iBACF;aACF,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAClE,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC,CAAC;QACpE,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,mBAAmB,EACnB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,EAAE;SAC7E,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,kDAAkD;YAClD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7E,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,GAAG,CACL,kBAAkB,EAClB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE,EAAE;SAC3E,EACD,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CACpE,CAAC;QAEF,GAAG,CAAC,KAAK,CACP,kBAAkB,EAClB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE;gBACN,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE,mBAAmB;gBACzB,QAAQ,EAAE,EAAE,GAAG,EAAE,eAAe,EAAE;aACnC;SACF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE;gBAC9D,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvE,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACpF,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE;aAClG,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,OAAO,IAAI,UAAU,CAAC,CAAC;QACtC,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,MAAM,CACR,kBAAkB,EAClB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE;gBACN,MAAM,EAAE,kBAAkB;gBAC1B,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE;aAC3B;SACF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,kEAAkE;YAClE,IAAI,OAAO,CAAC,IAAI,CAAC,WAAW,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;gBACjD,MAAM,IAAI,aAAa,CAAC,+CAA+C,EAAE,UAAU,EAAE;oBACnF,YAAY,EAAE,UAAU,CAAC,IAAI;iBAC9B,CAAC,CAAC;YACL,CAAC;YACD,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YACrC,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE;aAC1E,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;QAC/B,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,uBAAuB,EACvB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,EAAE;SAC/E,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9D,IAAI,IAAI,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC1B,MAAM,IAAI,qBAAqB,CAAC,gCAAgC,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACvE,MAAM,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE;gBACxD,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;gBACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5B,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,6BAA6B,EAC7B;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE;gBACN,MAAM,EAAE,kBAAkB;gBAC1B,QAAQ,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,gBAAgB,EAAE;aAC9D;SACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACvB,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7D,MAAM,OAAO,GACX,OAAO,CAAC,eAAe,KAAK,IAAI;gBAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC;YAEX,4DAA4D;YAC5D,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBAC3E,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC;oBACjC,IAAI,EAAE,mBAAmB;oBACzB,mEAAmE;oBACnE,gEAAgE;oBAChE,yDAAyD;oBACzD,OAAO,EAAE,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;oBAC7E,SAAS,EAAE,cAAc,UAAU,CAAC,EAAE,EAAE;iBACzC,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;oBAC5B,QAAQ,EAAE,QAAQ;oBAClB,MAAM,EAAE,2BAA2B;oBACnC,YAAY,EAAE,UAAU,CAAC,EAAE;oBAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE;iBACtC,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,wDAAwD;YACxD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC;gBACpC,OAAO;gBACP,IAAI;gBACJ,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,SAAS,EAAE,OAAO;aACnB,CAAC,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,UAAU,CAAC,EAAE;gBAC3B,OAAO,EAAE;oBACP,KAAK,EAAE;wBACL,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;wBAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;qBACpC;iBACF;aACF,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC5B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE;gBAC9B,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ;aACnC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/connections/schema.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Zod request/response schemas for `routes/connections/`
+ * (08-server-api.md §2.4). DSNs never appear in replies — `dsnMasked` only.
+ */
+import { z } from 'zod';
+export declare const connectionEngineSchema: z.ZodEnum<{
+    postgres: "postgres";
+    mysql: "mysql";
+    sqlite: "sqlite";
+}>;
+export declare const connectionRolesSchema: z.ZodObject<{
+    introspect: z.ZodOptional<z.ZodString>;
+    data: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const connectionCreateBody: z.ZodObject<{
+    name: z.ZodString;
+    engine: z.ZodEnum<{
+        postgres: "postgres";
+        mysql: "mysql";
+        sqlite: "sqlite";
+    }>;
+    dsn: z.ZodOptional<z.ZodString>;
+    roles: z.ZodOptional<z.ZodObject<{
+        introspect: z.ZodOptional<z.ZodString>;
+        data: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    settings: z.ZodOptional<z.ZodObject<{
+        includedTables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        intent: z.ZodOptional<z.ZodEnum<{
+            "full-admin": "full-admin";
+            "read-only-analytics": "read-only-analytics";
+            crud: "crud";
+            "support-console": "support-console";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ConnectionCreateBody = z.infer<typeof connectionCreateBody>;
+export declare const connectionIdParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const connectionPatchBody: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    settings: z.ZodOptional<z.ZodObject<{
+        includedTables: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        intent: z.ZodOptional<z.ZodEnum<{
+            "full-admin": "full-admin";
+            "read-only-analytics": "read-only-analytics";
+            crud: "crud";
+            "support-console": "support-console";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const connectionDeleteBody: z.ZodObject<{
+    confirmName: z.ZodString;
+    force: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const connectionTestBody: z.ZodObject<{
+    engine: z.ZodEnum<{
+        postgres: "postgres";
+        mysql: "mysql";
+        sqlite: "sqlite";
+    }>;
+    dsn: z.ZodString;
+}, z.core.$strip>;
+export declare const connectionTestReply: z.ZodObject<{
+    ok: z.ZodBoolean;
+    latencyMs: z.ZodNumber;
+    serverVersion: z.ZodNullable<z.ZodString>;
+    readOnly: z.ZodBoolean;
+    privileges: z.ZodNullable<z.ZodObject<{
+        canReadSchema: z.ZodBoolean;
+        canRead: z.ZodBoolean;
+        canWrite: z.ZodBoolean;
+        canDDL: z.ZodBoolean;
+    }, z.core.$strip>>;
+    error: z.ZodNullable<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+        hint: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ConnectionTestReply = z.infer<typeof connectionTestReply>;
+export declare const connectionDto: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    engine: z.ZodString;
+    sourceKind: z.ZodString;
+    dsnMasked: z.ZodNullable<z.ZodString>;
+    readOnly: z.ZodBoolean;
+    status: z.ZodString;
+    lastTestedAt: z.ZodNullable<z.ZodNumber>;
+    lastLatencyMs: z.ZodNullable<z.ZodNumber>;
+    lastError: z.ZodNullable<z.ZodString>;
+    snapshot: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        createdAt: z.ZodNumber;
+        checksum: z.ZodString;
+    }, z.core.$strip>>;
+    tableCount: z.ZodNullable<z.ZodNumber>;
+    pageCount: z.ZodNumber;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+export type ConnectionDto = z.infer<typeof connectionDto>;
+export declare const connectionReply: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    engine: z.ZodString;
+    sourceKind: z.ZodString;
+    dsnMasked: z.ZodNullable<z.ZodString>;
+    readOnly: z.ZodBoolean;
+    status: z.ZodString;
+    lastTestedAt: z.ZodNullable<z.ZodNumber>;
+    lastLatencyMs: z.ZodNullable<z.ZodNumber>;
+    lastError: z.ZodNullable<z.ZodString>;
+    snapshot: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        createdAt: z.ZodNumber;
+        checksum: z.ZodString;
+    }, z.core.$strip>>;
+    tableCount: z.ZodNullable<z.ZodNumber>;
+    pageCount: z.ZodNumber;
+    createdAt: z.ZodNumber;
+    updatedAt: z.ZodNumber;
+}, z.core.$strip>;
+export declare const connectionListReply: z.ZodObject<{
+    connections: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        engine: z.ZodString;
+        sourceKind: z.ZodString;
+        dsnMasked: z.ZodNullable<z.ZodString>;
+        readOnly: z.ZodBoolean;
+        status: z.ZodString;
+        lastTestedAt: z.ZodNullable<z.ZodNumber>;
+        lastLatencyMs: z.ZodNullable<z.ZodNumber>;
+        lastError: z.ZodNullable<z.ZodString>;
+        snapshot: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            createdAt: z.ZodNumber;
+            checksum: z.ZodString;
+        }, z.core.$strip>>;
+        tableCount: z.ZodNullable<z.ZodNumber>;
+        pageCount: z.ZodNumber;
+        createdAt: z.ZodNumber;
+        updatedAt: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const okReply: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export declare const introspectSyncReply: z.ZodObject<{
+    snapshotId: z.ZodString;
+    noop: z.ZodBoolean;
+    proposedMasks: z.ZodNumber;
+    checksum: z.ZodString;
+}, z.core.$strip>;
+export declare const jobAcceptedReply: z.ZodObject<{
+    jobId: z.ZodString;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/connections/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/connections/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,sBAAsB;;;;EAA0C,CAAC;AAE9E,eAAO,MAAM,qBAAqB;;;iBAKhC,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;iBAa/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,kBAAkB;;iBAAsC,CAAC;AAEtE,eAAO,MAAM,mBAAmB;;;;;;;;;;;iBAG9B,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;iBAI/B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;iBAG7B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;iBAgB9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;iBAsBxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;iBAAgB,CAAC;AAC7C,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;iBAAoD,CAAC;AAErF,eAAO,MAAM,OAAO;;iBAAoC,CAAC;AAEzD,eAAO,MAAM,mBAAmB;;;;;iBAK9B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;iBAAkC,CAAC"}

package/dist/routes/connections/schema.js

@@ -0,0 +1,91 @@
+/**
+ * Zod request/response schemas for `routes/connections/`
+ * (08-server-api.md §2.4). DSNs never appear in replies — `dsnMasked` only.
+ */
+import { z } from 'zod';
+export const connectionEngineSchema = z.enum(['postgres', 'mysql', 'sqlite']);
+export const connectionRolesSchema = z.object({
+    /** Schema-metadata-only role (01 §3); falls back to `data`. */
+    introspect: z.string().min(1).optional(),
+    /** CRUD role; falls back to `introspect`/`dsn`. */
+    data: z.string().min(1).optional(),
+});
+export const connectionCreateBody = z.object({
+    name: z.string().min(1).max(80),
+    engine: connectionEngineSchema,
+    /** Single-DSN shorthand ("use same credentials"). */
+    dsn: z.string().min(1).optional(),
+    /** Advanced split per the three-connection model. */
+    roles: connectionRolesSchema.optional(),
+    settings: z
+        .object({
+        includedTables: z.array(z.string()).optional(),
+        intent: z.enum(['full-admin', 'read-only-analytics', 'crud', 'support-console']).optional(),
+    })
+        .optional(),
+});
+export const connectionIdParams = z.object({ id: z.string().min(1) });
+export const connectionPatchBody = z.object({
+    name: z.string().min(1).max(80).optional(),
+    settings: connectionCreateBody.shape.settings,
+});
+export const connectionDeleteBody = z.object({
+    /** Type-to-confirm contract: must match the connection name exactly. */
+    confirmName: z.string(),
+    force: z.boolean().optional(),
+});
+export const connectionTestBody = z.object({
+    engine: connectionEngineSchema,
+    dsn: z.string().min(1),
+});
+export const connectionTestReply = z.object({
+    ok: z.boolean(),
+    latencyMs: z.number(),
+    serverVersion: z.string().nullable(),
+    readOnly: z.boolean(),
+    privileges: z
+        .object({
+        canReadSchema: z.boolean(),
+        canRead: z.boolean(),
+        canWrite: z.boolean(),
+        canDDL: z.boolean(),
+    })
+        .nullable(),
+    error: z
+        .object({ code: z.string(), message: z.string(), hint: z.string().nullable() })
+        .nullable(),
+});
+export const connectionDto = z.object({
+    id: z.string(),
+    name: z.string(),
+    engine: z.string(),
+    sourceKind: z.string(),
+    /** Credentials stripped — `postgres://ava@db.acme.io:5432/prod`. */
+    dsnMasked: z.string().nullable(),
+    readOnly: z.boolean(),
+    status: z.string(),
+    lastTestedAt: z.number().nullable(),
+    lastLatencyMs: z.number().nullable(),
+    lastError: z.string().nullable(),
+    /** Health-card snapshot age (§2.4). */
+    snapshot: z
+        .object({ id: z.string(), createdAt: z.number(), checksum: z.string() })
+        .nullable(),
+    /** Included tables (settings allowlist, else the latest snapshot's model). */
+    tableCount: z.number().int().nullable(),
+    /** Generated pages owned by this connection (M5-T05 hub cards). */
+    pageCount: z.number().int(),
+    createdAt: z.number(),
+    updatedAt: z.number(),
+});
+export const connectionReply = connectionDto;
+export const connectionListReply = z.object({ connections: z.array(connectionDto) });
+export const okReply = z.object({ ok: z.literal(true) });
+export const introspectSyncReply = z.object({
+    snapshotId: z.string(),
+    noop: z.boolean(),
+    proposedMasks: z.number(),
+    checksum: z.string(),
+});
+export const jobAcceptedReply = z.object({ jobId: z.string() });
+//# sourceMappingURL=schema.js.map

package/dist/routes/connections/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/connections/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE9E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,+DAA+D;IAC/D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACxC,mDAAmD;IACnD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC/B,MAAM,EAAE,sBAAsB;IAC9B,qDAAqD;IACrD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjC,qDAAqD;IACrD,KAAK,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IACvC,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC9C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE;KAC5F,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,wEAAwE;IACxE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,sBAAsB;IAC9B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACvB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC;SACV,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;KACpB,CAAC;SACD,QAAQ,EAAE;IACb,KAAK,EAAE,CAAC;SACL,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC9E,QAAQ,EAAE;CACd,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,oEAAoE;IACpE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,uCAAuC;IACvC,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SACvE,QAAQ,EAAE;IACb,8EAA8E;IAC9E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACvC,mEAAmE;IACnE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,aAAa,CAAC;AAC7C,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}

package/dist/routes/data/index.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The generated CRUD API (`routes/data/`, 08-server-api.md §2.7, M3-T05):
+ * list (filter DSL + `q` + keyset/offset), get (+ inbound counts), the
+ * cascade preflight, create/update/delete, bulk, and undo.
+ *
+ * Invariants (§7 item 1, §5.2/§5.3): every table/column string that reaches
+ * SQL is the schema snapshot's own; RBAC (`table:<conn>:<schema.table>:<action>`)
+ * runs after identifier resolution; PII columns mask for callers without the
+ * unmask grant; every mutation is audited with a RecordRef and fans out on
+ * `table:<connectionId>:<schema.table>` when the realtime hub is wired.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import { type MetaDb } from '@adminium/meta';
+import type { Dialect } from '@adminium/engine';
+import type { Kysely } from 'kysely';
+import type { ConnectionManager, SourceDatabase } from '../../connections/manager.js';
+import { type ResolvedTable } from '../../crud/identifiers.js';
+import { type Row } from '../../crud/mask.js';
+import { UndoStore } from '../../crud/undo.js';
+export interface DataRoutesDeps {
+    manager: ConnectionManager;
+    meta: MetaDb;
+    /** Injectable for TTL tests; a fresh store otherwise. */
+    undoStore?: UndoStore | undefined;
+}
+/** PG SQLSTATE / MySQL errno symbol / SQLite message → §1.4 envelope codes for inline form errors (§2.7.2). */
+export declare function mapDbError(error: unknown): never;
+/**
+ * INSERT one row and return the STORED row (defaults resolved), per dialect.
+ *
+ * Postgres and SQLite do it in one round trip with `RETURNING *`. MySQL has
+ * no RETURNING — kysely's MysqlQueryCompiler still compiles the clause, so
+ * `.returningAll()` dies with ER_PARSE_ERROR 1064 ("near 'returning *'"),
+ * which 500'd every generated-app create on mysql (e2e c5). Instead, insert
+ * bare and re-select by key (05 §4.2, mirrored by the adapter-mysql live
+ * suite): prefer the CLIENT-PROVIDED PK values whenever the payload carries
+ * them — provided keys cover char/uuid PKs (northwind customers, char(5))
+ * and composite PKs (order_details) where `LAST_INSERT_ID()` is 0 — and fall
+ * back to the driver's `insertId` only for a single missing auto-increment
+ * column. A NULL PK value counts as "not provided": that is mysql's own
+ * "generate it" spelling. If the new row is unaddressable (multi-column
+ * DB-generated key, non-auto default), echo the payload rather than guess.
+ */
+export declare function insertRow(db: Kysely<SourceDatabase>, dialect: Dialect, table: ResolvedTable, values: Row): Promise<Row>;
+export declare function dataRoutes(deps: DataRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/data/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/data/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAgC,KAAK,MAAM,EAAkB,MAAM,gBAAgB,CAAC;AAC3F,OAAO,KAAK,EAAiB,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,KAAK,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAIlD,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE7E,OAAO,EAAuB,KAAK,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAQnE,OAAO,EAAa,SAAS,EAAmC,MAAM,oBAAoB,CAAC;AAuB3F,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,yDAAyD;IACzD,SAAS,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACnC;AAWD,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CA2BhD;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,SAAS,CAC7B,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,EAC1B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,aAAa,EACpB,MAAM,EAAE,GAAG,GACV,OAAO,CAAC,GAAG,CAAC,CAiCd;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,qBAAqB,CA0etE"}