@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/data/schema.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Zod schemas for the generated CRUD API (`routes/data/`,
+ * 08-server-api.md §2.7). Row payloads are dynamic per-table shapes and
+ * pass through as open records — identifier validation happens against the
+ * schema snapshot in the handlers, never here.
+ */
+import { z } from 'zod';
+export declare const rowSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export declare const dataTableParams: z.ZodObject<{
+    connectionId: z.ZodString;
+    table: z.ZodString;
+}, z.core.$strip>;
+export declare const dataRecordParams: z.ZodObject<{
+    connectionId: z.ZodString;
+    table: z.ZodString;
+    recordId: z.ZodString;
+}, z.core.$strip>;
+export declare const recordListQuery: z.ZodObject<{
+    select: z.ZodOptional<z.ZodString>;
+    where: z.ZodOptional<z.ZodString>;
+    q: z.ZodOptional<z.ZodString>;
+    order: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    offset: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    count: z.ZodOptional<z.ZodEnum<{
+        exact: "exact";
+        none: "none";
+        estimated: "estimated";
+    }>>;
+}, z.core.$strip>;
+export declare const recordListReply: z.ZodObject<{
+    data: z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    page: z.ZodOptional<z.ZodObject<{
+        limit: z.ZodNumber;
+        offset: z.ZodNumber;
+        total: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    cursor: z.ZodOptional<z.ZodObject<{
+        next: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const recordGetQuery: z.ZodObject<{
+    include: z.ZodOptional<z.ZodEnum<{
+        inboundCounts: "inboundCounts";
+    }>>;
+}, z.core.$strip>;
+export declare const referenceCountSchema: z.ZodObject<{
+    relationId: z.ZodString;
+    table: z.ZodString;
+    column: z.ZodString;
+    count: z.ZodNumber;
+}, z.core.$strip>;
+export declare const recordReply: z.ZodObject<{
+    data: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    inboundCounts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        relationId: z.ZodString;
+        table: z.ZodString;
+        column: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export declare const referencesReply: z.ZodObject<{
+    references: z.ZodArray<z.ZodObject<{
+        relationId: z.ZodString;
+        table: z.ZodString;
+        column: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const recordCreateBody: z.ZodObject<{
+    values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export declare const recordUpdateBody: z.ZodObject<{
+    values: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strip>;
+export declare const recordDeleteQuery: z.ZodObject<{
+    dryRun: z.ZodOptional<z.ZodCoercedBoolean<unknown>>;
+    confirm: z.ZodOptional<z.ZodCoercedBoolean<unknown>>;
+}, z.core.$strip>;
+export declare const recordMutationReply: z.ZodObject<{
+    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    undoToken: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const recordCascadeReply: z.ZodObject<{
+    references: z.ZodArray<z.ZodObject<{
+        relationId: z.ZodString;
+        table: z.ZodString;
+        column: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+    requiresConfirm: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const recordDeleteReply: z.ZodUnion<readonly [z.ZodObject<{
+    data: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    undoToken: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
+    references: z.ZodArray<z.ZodObject<{
+        relationId: z.ZodString;
+        table: z.ZodString;
+        column: z.ZodString;
+        count: z.ZodNumber;
+    }, z.core.$strip>>;
+    requiresConfirm: z.ZodBoolean;
+}, z.core.$strip>]>;
+export declare const recordBulkBody: z.ZodObject<{
+    action: z.ZodEnum<{
+        delete: "delete";
+        update: "update";
+    }>;
+    ids: z.ZodArray<z.ZodUnknown>;
+    values: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export declare const recordBulkReply: z.ZodObject<{
+    results: z.ZodArray<z.ZodObject<{
+        id: z.ZodUnknown;
+        ok: z.ZodBoolean;
+        error: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    undoToken: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const undoParams: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strip>;
+export declare const undoReply: z.ZodObject<{
+    restoredIds: z.ZodArray<z.ZodUnknown>;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/data/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/data/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,SAAS,wCAAoC,CAAC;AAE3D,eAAO,MAAM,eAAe;;;iBAI1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;;iBAG3B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;;;;iBAY1B,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;;;;iBAM1B,CAAC;AAEH,eAAO,MAAM,cAAc;;;;iBAEzB,CAAC;AAEH,eAAO,MAAM,oBAAoB;;;;;iBAK/B,CAAC;AAEH,eAAO,MAAM,WAAW;;;;;;;;iBAGtB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;iBAE1B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;iBAAkC,CAAC;AAChE,eAAO,MAAM,gBAAgB;;iBAAkC,CAAC;AAEhE,eAAO,MAAM,iBAAiB;;;iBAK5B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;iBAI9B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;;;;;iBAG7B,CAAC;AAEH,eAAO,MAAM,iBAAiB;;;;;;;;;;;mBAAqD,CAAC;AAEpF,eAAO,MAAM,cAAc;;;;;;;iBAIzB,CAAC;AAEH,eAAO,MAAM,eAAe;;;;;;;iBAG1B,CAAC;AAEH,eAAO,MAAM,UAAU;;iBAAyC,CAAC;AACjE,eAAO,MAAM,SAAS;;iBAAkD,CAAC"}

package/dist/routes/data/schema.js

@@ -0,0 +1,83 @@
+/**
+ * Zod schemas for the generated CRUD API (`routes/data/`,
+ * 08-server-api.md §2.7). Row payloads are dynamic per-table shapes and
+ * pass through as open records — identifier validation happens against the
+ * schema snapshot in the handlers, never here.
+ */
+import { z } from 'zod';
+export const rowSchema = z.record(z.string(), z.unknown());
+export const dataTableParams = z.object({
+    connectionId: z.string().min(1),
+    /** URL-encoded qualified name, e.g. `public.customers` (§2.7). */
+    table: z.string().min(1),
+});
+export const dataRecordParams = dataTableParams.extend({
+    /** Single PK value, or JSON tuple/object for composite PKs (§2.7.2). */
+    recordId: z.string().min(1),
+});
+export const recordListQuery = z.object({
+    select: z.string().optional(),
+    /** URL-encoded JSON filter tree (§2.7.1 grammar). */
+    where: z.string().optional(),
+    q: z.string().optional(),
+    /** `col.desc,col2.asc` — ≤ 3 keys. */
+    order: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(200).optional(),
+    offset: z.coerce.number().int().min(0).optional(),
+    /** Keyset cursor; empty string = first keyset page. */
+    cursor: z.string().optional(),
+    count: z.enum(['exact', 'estimated', 'none']).optional(),
+});
+export const recordListReply = z.object({
+    data: z.array(rowSchema),
+    page: z
+        .object({ limit: z.number(), offset: z.number(), total: z.number().nullable() })
+        .optional(),
+    cursor: z.object({ next: z.string().nullable() }).optional(),
+});
+export const recordGetQuery = z.object({
+    include: z.enum(['inboundCounts']).optional(),
+});
+export const referenceCountSchema = z.object({
+    relationId: z.string(),
+    table: z.string(),
+    column: z.string(),
+    count: z.number(),
+});
+export const recordReply = z.object({
+    data: rowSchema,
+    inboundCounts: z.array(referenceCountSchema).optional(),
+});
+export const referencesReply = z.object({
+    references: z.array(referenceCountSchema),
+});
+export const recordCreateBody = z.object({ values: rowSchema });
+export const recordUpdateBody = z.object({ values: rowSchema });
+export const recordDeleteQuery = z.object({
+    /** Referential consequences only — no write happens (§2.7.2). */
+    dryRun: z.coerce.boolean().optional(),
+    /** Required when inbound references exist (cascade modal confirm). */
+    confirm: z.coerce.boolean().optional(),
+});
+export const recordMutationReply = z.object({
+    data: rowSchema.nullable(),
+    /** Single-use undo token (§2.7.3); null for non-undoable mutations. */
+    undoToken: z.string().nullable(),
+});
+export const recordCascadeReply = z.object({
+    references: z.array(referenceCountSchema),
+    requiresConfirm: z.boolean(),
+});
+export const recordDeleteReply = z.union([recordMutationReply, recordCascadeReply]);
+export const recordBulkBody = z.object({
+    action: z.enum(['update', 'delete']),
+    ids: z.array(z.unknown()).min(1).max(1000),
+    values: rowSchema.optional(),
+});
+export const recordBulkReply = z.object({
+    results: z.array(z.object({ id: z.unknown(), ok: z.boolean(), error: z.string().optional() })),
+    undoToken: z.string().nullable(),
+});
+export const undoParams = z.object({ token: z.string().min(1) });
+export const undoReply = z.object({ restoredIds: z.array(z.unknown()) });
+//# sourceMappingURL=schema.js.map

package/dist/routes/data/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/data/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kEAAkE;IAClE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC,MAAM,CAAC;IACrD,wEAAwE;IACxE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,qDAAqD;IACrD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACxB,sCAAsC;IACtC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACjD,uDAAuD;IACvD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;CACzD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;IACxB,IAAI,EAAE,CAAC;SACJ,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;SAC/E,QAAQ,EAAE;IACb,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,SAAS;IACf,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CAC1C,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,iEAAiE;IACjE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACrC,sEAAsE;IACtE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC1B,uEAAuE;IACvE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEpF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1C,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9F,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC"}

package/dist/routes/desktop/index.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `POST /api/v1/desktop/backup` — the §9 backup, run where the data lives
+ * (11-electron.md §9, §1 principle 2).
+ *
+ * ─── The gates, in order, mirroring `routes/auth/desktop-session.ts` ─────────
+ *
+ *  1. EXISTENCE. `compose.ts` registers this factory only when
+ *     `ADMINIUM_RUNTIME=desktop`. A self-host, Docker or npx instance does not
+ *     have the route at all — an absent route cannot be misconfigured or
+ *     bypassed, which is why §5's sibling takes the same shape. It is also
+ *     simply correct: `<dataDir>/backups` and `config.json` are desktop
+ *     concepts, and self-host's answer to "back up my instance" is
+ *     `adminium export-zip` plus whatever backs up its Postgres.
+ *  2. PEER. The SOCKET's `remoteAddress` must be loopback. Not `request.ip` —
+ *     see `auth/desktop-session.ts` for why that distinction is the difference
+ *     between a check and a vulnerability. It matters here for the same reason
+ *     it matters there: §8.3 binds `0.0.0.0` whenever LAN share is on, and a
+ *     backup archive is every row in every database plus every user record.
+ *     Whoever can call this can exfiltrate the whole install in one request.
+ *  3. SESSION + RBAC. `system:settings:manage`, i.e. Super Admin. There is no
+ *     `backups.manage` in meta's closed set (`SYSTEM_ACTION_KEYS`) and this
+ *     route is not the place to invent one; `settings:manage` is the strictest
+ *     grant that exists and a backup deserves the strictest. A LAN user with a
+ *     real super-admin account CAN take a backup — that is §8.3's RBAC promise
+ *     working, not a hole — but gate 2 means they cannot: they are not loopback.
+ *     Both gates, and the AND is the point.
+ *
+ * ─── The save dialog's path never reaches this process ───────────────────────
+ *
+ * §9's manual flow is "saveFile dialog → server does the work", which reads like
+ * the chosen path should be the request body. It is not, and this is the one
+ * design decision in the route worth arguing with. An `outPath` parameter would
+ * make this endpoint an arbitrary-file-write primitive with the server's
+ * privileges: post `{ outPath: "~/.zshrc" }` and the reply tells you it worked.
+ * Every gate above would have to hold forever for that to stay safe, and gates
+ * are exactly the things that get relaxed.
+ *
+ * So the server writes only inside `<dataDir>/backups`, and `destination:
+ * "staged"` puts the archive somewhere the MAIN PROCESS can then move to the
+ * path the user picked. Main is allowed to write there — the user just chose it
+ * in a native dialog — and main is where §4 already puts every other path
+ * decision (`main/ipc.ts`'s `saveFileSchema` refuses a separator inside
+ * `defaultName` for precisely this reason). The cost is one rename; the benefit
+ * is that the API surface has no path in it to abuse.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import type { DsnCrypto, MetaDb } from '@adminium/meta';
+export interface DesktopRoutesDeps {
+    meta: MetaDb;
+    /** Decrypts source DSNs so local SQLite files can be located. */
+    crypto: DsnCrypto;
+    /** `ADMINIUM_DATA_DIR`. */
+    dataDir: string;
+    /** Absolute path of the live meta store file (`<dataDir>/meta.db` on desktop). */
+    metaPath: string;
+    /** The shell's `app.getVersion()`, forwarded through the fork env. */
+    appVersion?: string | null | undefined;
+    now?: (() => number) | undefined;
+}
+export declare function desktopRoutes(deps: DesktopRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/desktop/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAaxD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,MAAM,EAAE,SAAS,CAAC;IAClB,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAED,wBAAgB,aAAa,CAAC,IAAI,EAAE,iBAAiB,GAAG,qBAAqB,CAuG5E"}

package/dist/routes/desktop/index.js

@@ -0,0 +1,91 @@
+import { isLoopbackPeer } from '../../auth/desktop-session.js';
+import { createBackup, rotateBackupsOnDisk, } from '../../backup/backup-service.js';
+import { notifyBackupCompleted } from '../../backup/notify.js';
+import { AppError } from '../../errors.js';
+import { PERMISSIONS } from '../../rbac/permissions.js';
+import { desktopBackupBody, desktopBackupReply } from './schema.js';
+export function desktopRoutes(deps) {
+    return async (app) => {
+        app.post('/desktop/backup', {
+            // Gate 3. `rbac.require` runs `requireAuth` semantics for us: an
+            // anonymous request has no principal to resolve and is refused before
+            // the handler exists.
+            preHandler: [app.requireMeta, app.rbac.require(PERMISSIONS.settingsManage)],
+            schema: { body: desktopBackupBody, response: { 200: desktopBackupReply } },
+        }, async (request) => {
+            // Gate 2. Before any work: a non-loopback caller learns nothing about
+            // this install, not even how long a backup takes.
+            if (!isLoopbackPeer(request.raw.socket)) {
+                throw new AppError(403, 'FORBIDDEN', 'Backups can only be taken from the computer Adminium is running on.');
+            }
+            const { destination, keep } = request.body;
+            const result = await createBackup({
+                meta: deps.meta,
+                crypto: deps.crypto,
+                dataDir: deps.dataDir,
+                metaPath: deps.metaPath,
+                redactedConfig: request.body.config ?? null,
+                appVersion: deps.appVersion ?? null,
+                destination,
+                ...(deps.now === undefined ? {} : { now: deps.now }),
+            });
+            let rotated = { kept: [], removed: [] };
+            if (destination === 'auto') {
+                rotated = await rotateBackupsOnDisk(deps.dataDir, keep);
+                await raiseNotification(request, result.path, result.bytes, result.manifest);
+            }
+            // A backup is a `system`-category event with no `changes` worth
+            // recording: the archive's contents are the manifest, and the manifest
+            // is in the reply. What an audit reader needs is that it HAPPENED, by
+            // whom, from where — which is what `audit` already writes.
+            await app.rbac.audit(request, {
+                action: 'desktop_backup_created',
+                category: 'system',
+                changes: {
+                    after: {
+                        destination,
+                        databases: result.manifest.databases.filter((entry) => entry.kind === 'local').length,
+                        bytes: result.bytes,
+                    },
+                },
+            });
+            return {
+                data: {
+                    path: result.path,
+                    bytes: result.bytes,
+                    manifest: result.manifest,
+                    rotated: rotated.removed,
+                },
+            };
+        });
+    };
+    /**
+     * §9's "Completion raises an `adminium_notifications` entry".
+     *
+     * Best-effort, and deliberately so: the archive is already on disk and its
+     * path is already in the reply. Failing the request because a courtesy row
+     * did not insert would turn a successful backup into a reported failure — and
+     * the scheduler, seeing a failure, would try again, and take another backup.
+     * Logged at `warn` so it is not silent.
+     */
+    async function raiseNotification(request, path, bytes, manifest) {
+        const userId = request.user?.id;
+        // An API-key principal has no notification inbox (`user_id` is NOT NULL).
+        // Not an error: a fleet script taking backups wants the archive, not a bell.
+        if (userId === undefined)
+            return;
+        try {
+            await notifyBackupCompleted({
+                meta: deps.meta,
+                userId,
+                path,
+                bytes,
+                databases: manifest.databases.filter((entry) => entry.kind === 'local').length,
+            });
+        }
+        catch (error) {
+            request.log.warn({ err: error }, 'backup completed but its notification could not be written');
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/desktop/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/desktop/index.ts"],"names":[],"mappings":"AAgDA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EACL,YAAY,EACZ,mBAAmB,GAEpB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAA2B,MAAM,aAAa,CAAC;AAe7F,MAAM,UAAU,aAAa,CAAC,IAAuB;IACnD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,IAAI,CACN,iBAAiB,EACjB;YACE,iEAAiE;YACjE,sEAAsE;YACtE,sBAAsB;YACtB,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,kBAAkB,EAAE,EAAE;SAC3E,EACD,KAAK,EAAE,OAAO,EAA+B,EAAE;YAC7C,sEAAsE;YACtE,kDAAkD;YAClD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,WAAW,EACX,qEAAqE,CACtE,CAAC;YACJ,CAAC;YAED,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAE3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC;gBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,cAAc,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI;gBAC3C,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;gBACnC,WAAW;gBACX,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACrD,CAAC,CAAC;YAEH,IAAI,OAAO,GAAwB,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC7D,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACxD,MAAM,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/E,CAAC;YAED,gEAAgE;YAChE,uEAAuE;YACvE,sEAAsE;YACtE,2DAA2D;YAC3D,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,MAAM,EAAE,wBAAwB;gBAChC,QAAQ,EAAE,QAAQ;gBAClB,OAAO,EAAE;oBACP,KAAK,EAAE;wBACL,WAAW;wBACX,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;wBACrF,KAAK,EAAE,MAAM,CAAC,KAAK;qBACpB;iBACF;aACF,CAAC,CAAC;YAEH,OAAO;gBACL,IAAI,EAAE;oBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,OAAO,EAAE,OAAO,CAAC,OAAO;iBACzB;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAC9B,OAAoB,EACpB,IAAY,EACZ,KAAa,EACb,QAAoD;QAEpD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,0EAA0E;QAC1E,6EAA6E;QAC7E,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO;QACjC,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC;gBAC1B,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM;gBACN,IAAI;gBACJ,KAAK;gBACL,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,MAAM;aAC/E,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,GAAG,EAAE,KAAK,EAAE,EACd,4DAA4D,CAC7D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/routes/desktop/schema.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Wire schemas for `POST /api/v1/desktop/backup` (11-electron.md §9).
+ *
+ * The reply carries the whole manifest rather than a summary, because the two
+ * callers both need it and neither can re-derive it: the Electron main process
+ * puts `metaMigrationVersion` and the local-database list in front of the user
+ * before a restore, and the M10 CLI reads the same manifest out of the archive.
+ * One shape, described once, in `backup/format.ts`.
+ */
+import { z } from 'zod';
+/**
+ * §9's two trigger paths, as the one thing that actually differs between them:
+ * where the archive lands and what happens afterwards.
+ *
+ *  - `staged`: File → "Back up now…" and Settings → Desktop → Backups. The
+ *    archive goes to a staging directory and the MAIN PROCESS moves it to the
+ *    path the user picked in the save dialog. Not rotated (it is leaving the
+ *    data dir) and not notified (main reveals it in the file manager, which is
+ *    a better answer than a notification about a file already on screen).
+ *  - `auto`: the §9 scheduler. Lands in `<dataDir>/backups/`, rotates to
+ *    `keep`, and raises the notification — because nobody is watching.
+ *
+ * NOTE WHAT IS NOT IN THIS BODY: a destination path. The save dialog's result
+ * never reaches the server. See the route header — this is the same rule
+ * `main/ipc.ts`'s `saveFileSchema` states when it refuses a separator inside
+ * `defaultName`: the renderer does not choose paths.
+ */
+export declare const desktopBackupBody: z.ZodObject<{
+    destination: z.ZodEnum<{
+        auto: "auto";
+        staged: "staged";
+    }>;
+    keep: z.ZodDefault<z.ZodNumber>;
+    config: z.ZodOptional<z.ZodUnknown>;
+}, z.core.$strict>;
+export type DesktopBackupBody = z.infer<typeof desktopBackupBody>;
+export declare const desktopBackupReply: z.ZodObject<{
+    data: z.ZodObject<{
+        path: z.ZodString;
+        bytes: z.ZodNumber;
+        manifest: z.ZodObject<{
+            formatVersion: z.ZodNumber;
+            appVersion: z.ZodNullable<z.ZodString>;
+            serverVersion: z.ZodString;
+            metaMigrationVersion: z.ZodString;
+            createdAt: z.ZodNumber;
+            meta: z.ZodObject<{
+                file: z.ZodLiteral<"meta.db">;
+                bytes: z.ZodNumber;
+                sha256: z.ZodString;
+            }, z.core.$strict>;
+            databases: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"local">;
+                slug: z.ZodString;
+                file: z.ZodString;
+                bytes: z.ZodNumber;
+                sha256: z.ZodString;
+                connectionId: z.ZodString;
+                sourcePath: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"external">;
+                slug: z.ZodString;
+                connectionId: z.ZodString;
+                engine: z.ZodString;
+            }, z.core.$strict>], "kind">>;
+        }, z.core.$strict>;
+        rotated: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type DesktopBackupReply = z.infer<typeof desktopBackupReply>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/desktop/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,iBAAiB;;;;;;;kBAiB5B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS7B,CAAC;AAEH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/routes/desktop/schema.js

@@ -0,0 +1,58 @@
+/**
+ * Wire schemas for `POST /api/v1/desktop/backup` (11-electron.md §9).
+ *
+ * The reply carries the whole manifest rather than a summary, because the two
+ * callers both need it and neither can re-derive it: the Electron main process
+ * puts `metaMigrationVersion` and the local-database list in front of the user
+ * before a restore, and the M10 CLI reads the same manifest out of the archive.
+ * One shape, described once, in `backup/format.ts`.
+ */
+import { z } from 'zod';
+import { backupManifestSchema } from '../../backup/format.js';
+import { DEFAULT_AUTO_BACKUP_KEEP } from '../../backup/backup-service.js';
+/**
+ * §9's two trigger paths, as the one thing that actually differs between them:
+ * where the archive lands and what happens afterwards.
+ *
+ *  - `staged`: File → "Back up now…" and Settings → Desktop → Backups. The
+ *    archive goes to a staging directory and the MAIN PROCESS moves it to the
+ *    path the user picked in the save dialog. Not rotated (it is leaving the
+ *    data dir) and not notified (main reveals it in the file manager, which is
+ *    a better answer than a notification about a file already on screen).
+ *  - `auto`: the §9 scheduler. Lands in `<dataDir>/backups/`, rotates to
+ *    `keep`, and raises the notification — because nobody is watching.
+ *
+ * NOTE WHAT IS NOT IN THIS BODY: a destination path. The save dialog's result
+ * never reaches the server. See the route header — this is the same rule
+ * `main/ipc.ts`'s `saveFileSchema` states when it refuses a separator inside
+ * `defaultName`: the renderer does not choose paths.
+ */
+export const desktopBackupBody = z.strictObject({
+    destination: z.enum(['staged', 'auto']),
+    /** §9's `autoBackup.keep`. Ignored for `staged`. Bounds match `config.json`. */
+    keep: z.number().int().min(1).max(365).default(DEFAULT_AUTO_BACKUP_KEEP),
+    /**
+     * The desktop `config.json`, ALREADY REDACTED by its owner (§2.3: the main
+     * process is that file's only reader). Passed in rather than read here
+     * because this process cannot see `<userData>` — it only knows `dataDir`.
+     *
+     * `unknown` on the wire and re-asserted in the service (`assertNoSecrets`):
+     * a schema here would be a second copy of `main/config.ts`'s, in a package
+     * that must not know that shape, and it would drift. What this boundary
+     * enforces is not the config's shape but the one property that matters — no
+     * secret leaves in the archive — and it enforces it by inspection, not by
+     * trusting the caller to have used `redactConfig`.
+     */
+    config: z.unknown().optional(),
+});
+export const desktopBackupReply = z.object({
+    data: z.object({
+        /** Absolute path of the archive on this machine. */
+        path: z.string(),
+        bytes: z.number().int().nonnegative(),
+        manifest: backupManifestSchema,
+        /** Archive filenames rotation removed. Empty for `staged`. */
+        rotated: z.array(z.string()),
+    }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/desktop/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/desktop/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAE1E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,YAAY,CAAC;IAC9C,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,gFAAgF;IAChF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,wBAAwB,CAAC;IACxE;;;;;;;;;;;OAWG;IACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,oDAAoD;QACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QACrC,QAAQ,EAAE,oBAAoB;QAC9B,8DAA8D;QAC9D,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC7B,CAAC;CACH,CAAC,CAAC"}

package/dist/routes/desktop-capabilities/index.d.ts

@@ -0,0 +1,9 @@
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import type { MetaDb } from '@adminium/meta';
+export interface DesktopCapabilityRoutesDeps {
+    meta: MetaDb;
+    /** Injectable clock for a deterministic `grantedAt` in tests. */
+    now?: (() => number) | undefined;
+}
+export declare function desktopCapabilityRoutes(deps: DesktopCapabilityRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/desktop-capabilities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-capabilities/index.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAgB7C,MAAM,WAAW,2BAA2B;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAaD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,2BAA2B,GAChC,qBAAqB,CAuEvB"}

package/dist/routes/desktop-capabilities/index.js

@@ -0,0 +1,62 @@
+import { isLoopbackPeer } from '../../auth/desktop-session.js';
+import { addGrant, listGrants, removeGrant } from '../../capabilities/grants.js';
+import { AppError } from '../../errors.js';
+import { PERMISSIONS } from '../../rbac/permissions.js';
+import { capabilityGrantRefBody, capabilityGrantReply, capabilityGrantsListReply, capabilityRevokeReply, } from './schema.js';
+/** Gate 2. A non-loopback caller learns nothing about this machine's grants. */
+function assertLoopback(socket) {
+    if (!isLoopbackPeer(socket)) {
+        throw new AppError(403, 'FORBIDDEN', 'Capability access can only be changed from the computer Adminium is running on.');
+    }
+}
+export function desktopCapabilityRoutes(deps) {
+    return async (app) => {
+        app.get('/desktop/capability-grants', {
+            preHandler: [app.requireMeta, app.rbac.require(PERMISSIONS.settingsManage)],
+            schema: { response: { 200: capabilityGrantsListReply } },
+        }, async (request) => {
+            assertLoopback(request.raw.socket);
+            return { data: { grants: await listGrants(deps.meta) } };
+        });
+        app.post('/desktop/capability-grants', {
+            preHandler: [app.requireMeta, app.rbac.require(PERMISSIONS.settingsManage)],
+            schema: { body: capabilityGrantRefBody, response: { 200: capabilityGrantReply } },
+        }, async (request) => {
+            assertLoopback(request.raw.socket);
+            const { manifestId, capabilityId } = request.body;
+            const grant = await addGrant(deps.meta, { manifestId, capabilityId }, {
+                ...(deps.now === undefined ? {} : { now: deps.now() }),
+                updatedBy: request.user?.id ?? null,
+            });
+            // A grant is a `settings`-category act, gated on `settings:manage`, so it
+            // is audited like one: who consented which app to which capability, from
+            // where. The grant IS the change — there is nothing else to record.
+            await app.rbac.audit(request, {
+                action: 'desktop_capability_granted',
+                category: 'settings',
+                changes: { after: { manifestId, capabilityId } },
+            });
+            return { data: { grant } };
+        });
+        app.delete('/desktop/capability-grants', {
+            preHandler: [app.requireMeta, app.rbac.require(PERMISSIONS.settingsManage)],
+            schema: { body: capabilityGrantRefBody, response: { 200: capabilityRevokeReply } },
+        }, async (request) => {
+            assertLoopback(request.raw.socket);
+            const { manifestId, capabilityId } = request.body;
+            const removed = await removeGrant(deps.meta, { manifestId, capabilityId }, { updatedBy: request.user?.id ?? null });
+            // Only audit a real revocation. A no-op DELETE (nothing was granted) is
+            // not an event; auditing it would fill the log with the consequences of
+            // a double-click.
+            if (removed) {
+                await app.rbac.audit(request, {
+                    action: 'desktop_capability_revoked',
+                    category: 'settings',
+                    changes: { before: { manifestId, capabilityId } },
+                });
+            }
+            return { data: { removed } };
+        });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/desktop-capabilities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/desktop-capabilities/index.ts"],"names":[],"mappings":"AAsCA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,GAItB,MAAM,aAAa,CAAC;AAQrB,gFAAgF;AAChF,SAAS,cAAc,CAAC,MAAc;IACpC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,WAAW,EACX,iFAAiF,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAiC;IAEjC,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CACL,4BAA4B,EAC5B;YACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC3E,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,yBAAyB,EAAE,EAAE;SACzD,EACD,KAAK,EAAE,OAAO,EAAsC,EAAE;YACpD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC3D,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,IAAI,CACN,4BAA4B,EAC5B;YACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE;SAClF,EACD,KAAK,EAAE,OAAO,EAAiC,EAAE;YAC/C,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAC1B,IAAI,CAAC,IAAI,EACT,EAAE,UAAU,EAAE,YAAY,EAAE,EAC5B;gBACE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACtD,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI;aACpC,CACF,CAAC;YACF,0EAA0E;YAC1E,yEAAyE;YACzE,oEAAoE;YACpE,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,MAAM,EAAE,4BAA4B;gBACpC,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE;aACjD,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7B,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,MAAM,CACR,4BAA4B,EAC5B;YACE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC3E,MAAM,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE;SACnF,EACD,KAAK,EAAE,OAAO,EAAkC,EAAE;YAChD,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,IAAI,CAAC,IAAI,EACT,EAAE,UAAU,EAAE,YAAY,EAAE,EAC5B,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE,CACxC,CAAC;YACF,wEAAwE;YACxE,wEAAwE;YACxE,kBAAkB;YAClB,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;oBAC5B,MAAM,EAAE,4BAA4B;oBACpC,QAAQ,EAAE,UAAU;oBACpB,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE;iBAClD,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/B,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}