@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/desktop-capabilities/schema.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Wire schemas for the desktop capability grant table (11-electron.md §12).
+ *
+ * The grant identity `{ manifestId, capabilityId }` is the body of both POST
+ * (consent) and DELETE (revoke) — one shape, so a form that can grant can revoke
+ * the same thing. `capabilityId` is the closed host vocabulary (`catalog.ts`),
+ * NOT a free string: a grant for a capability this build has no provider for
+ * would be a dead row that the consent UI could offer and the host could never
+ * honour, so an unknown id is a 422 here rather than a persisted lie.
+ */
+import { z } from 'zod';
+/** The identity written by consent / removed by revoke. */
+export declare const capabilityGrantRefBody: z.ZodObject<{
+    manifestId: z.ZodString;
+    capabilityId: z.ZodEnum<{
+        "printer.escpos": "printer.escpos";
+    }>;
+}, z.core.$strict>;
+export type CapabilityGrantRefBody = z.infer<typeof capabilityGrantRefBody>;
+export declare const capabilityGrantsListReply: z.ZodObject<{
+    data: z.ZodObject<{
+        grants: z.ZodArray<z.ZodObject<{
+            manifestId: z.ZodString;
+            capabilityId: z.ZodString;
+            grantedAt: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CapabilityGrantsListReply = z.infer<typeof capabilityGrantsListReply>;
+export declare const capabilityGrantReply: z.ZodObject<{
+    data: z.ZodObject<{
+        grant: z.ZodObject<{
+            manifestId: z.ZodString;
+            capabilityId: z.ZodString;
+            grantedAt: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CapabilityGrantReply = z.infer<typeof capabilityGrantReply>;
+export declare const capabilityRevokeReply: z.ZodObject<{
+    data: z.ZodObject<{
+        removed: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CapabilityRevokeReply = z.infer<typeof capabilityRevokeReply>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/desktop-capabilities/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-capabilities/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,2DAA2D;AAC3D,eAAO,MAAM,sBAAsB;;;;;kBAIjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,eAAO,MAAM,yBAAyB;;;;;;;;iBAEpC,CAAC;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAElF,eAAO,MAAM,oBAAoB;;;;;;;;iBAE/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,eAAO,MAAM,qBAAqB;;;;iBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/routes/desktop-capabilities/schema.js

@@ -0,0 +1,30 @@
+/**
+ * Wire schemas for the desktop capability grant table (11-electron.md §12).
+ *
+ * The grant identity `{ manifestId, capabilityId }` is the body of both POST
+ * (consent) and DELETE (revoke) — one shape, so a form that can grant can revoke
+ * the same thing. `capabilityId` is the closed host vocabulary (`catalog.ts`),
+ * NOT a free string: a grant for a capability this build has no provider for
+ * would be a dead row that the consent UI could offer and the host could never
+ * honour, so an unknown id is a 422 here rather than a persisted lie.
+ */
+import { z } from 'zod';
+import { capabilityGrantSchema } from '@adminium/meta';
+import { capabilityIdSchema } from '../../capabilities/catalog.js';
+/** The identity written by consent / removed by revoke. */
+export const capabilityGrantRefBody = z.strictObject({
+    /** The installed micro-SaaS manifest's id (reverse-DNS; §12 / 13-marketplace.md). */
+    manifestId: z.string().min(1).max(200),
+    capabilityId: capabilityIdSchema,
+});
+export const capabilityGrantsListReply = z.object({
+    data: z.object({ grants: z.array(capabilityGrantSchema) }),
+});
+export const capabilityGrantReply = z.object({
+    data: z.object({ grant: capabilityGrantSchema }),
+});
+export const capabilityRevokeReply = z.object({
+    /** `removed: false` when there was no such grant — revoke is idempotent, not an error. */
+    data: z.object({ removed: z.boolean() }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/desktop-capabilities/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/desktop-capabilities/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AAEnE,2DAA2D;AAC3D,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,YAAY,CAAC;IACnD,qFAAqF;IACrF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtC,YAAY,EAAE,kBAAkB;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,EAAE,CAAC;CAC3D,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;CACjD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,0FAA0F;IAC1F,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;CACzC,CAAC,CAAC"}

package/dist/routes/desktop-demo/handlers.d.ts

@@ -0,0 +1,94 @@
+/**
+ * The demo database — seed the file, register the connection (11-electron.md §6
+ * step 2 card 4, task 11-T08).
+ *
+ * ─── WHY THE SEED SCRIPT IS LOADED BY PATH ───────────────────────────────────
+ *
+ * `demo-seed.mjs` lives in `apps/desktop/resources/`, and `@adminium/server` may
+ * not import `@adminium/desktop` — the dependency arrow points the other way
+ * (.dependency-cruiser.cjs, rule `desktop-shell-only`), and it points that way
+ * because self-host and Docker run this same server with no desktop package
+ * within a mile of them. So the shell TELLS the server where the script is
+ * (`ADMINIUM_DEMO_SEED_SCRIPT`, §2.2's env block) and the server imports that
+ * path at runtime. `compose.ts` already loads `@adminium/widgets` by file path
+ * for the same boundary reason; this is that pattern, not a new one.
+ *
+ * ─── WHY THE SERVER OPENS THE FILE, NOT THE SCRIPT ───────────────────────────
+ *
+ * §2.1: "The server is the only data owner." The script is a pure description of
+ * a schema and its rows; the `better-sqlite3` handle it writes through is opened
+ * here, by the process that owns every other database handle in the app. That
+ * also keeps the script free of module resolution — see its header.
+ */
+import BetterSqlite3 from 'better-sqlite3';
+import type { ConnectionManager } from '../../connections/manager.js';
+/** §6: "creates `<dataDir>/databases/demo.sqlite`". Both halves are spec'd. */
+export declare const DEMO_DATABASE_DIR = "databases";
+export declare const DEMO_DATABASE_FILE = "demo.sqlite";
+/** What `demo-seed.mjs` exports. Structural — the script is plain JS. */
+export interface DemoSeeder {
+    createDemoDatabase(input: {
+        file: string;
+        Database: typeof BetterSqlite3;
+    }): Record<string, number>;
+}
+/** Rows-per-table, as the script reports them. */
+export type DemoSeedCounts = Record<string, number>;
+export interface DemoDatabaseResult {
+    connectionId: string;
+    name: string;
+    file: string;
+    seeded: boolean;
+    rows: DemoSeedCounts;
+}
+export interface DemoDatabaseDeps {
+    manager: ConnectionManager;
+    /** `ADMINIUM_DATA_DIR` — the demo lands under it (§2.2/§6). */
+    dataDir: string;
+    /** Absolute path to `demo-seed.mjs` (`ADMINIUM_DEMO_SEED_SCRIPT`). */
+    seedScriptPath: string;
+    /**
+     * Test seam. Production leaves it out and gets {@link importDemoSeeder}, which
+     * imports {@link DemoDatabaseDeps.seedScriptPath} — the suites point it at the
+     * REAL script rather than replacing it, because a fake seeder would test the
+     * plumbing and not the fixture the whole task exists to produce.
+     */
+    loadSeeder?: ((scriptPath: string) => Promise<DemoSeeder>) | undefined;
+}
+/**
+ * `import()` the seed script. The `file://` URL is required, not cosmetic: an
+ * absolute Windows path (`C:\…`) is not a valid ESM specifier and throws
+ * `ERR_UNSUPPORTED_ESM_URL_SCHEME`, which would make this route fail on exactly
+ * one of the three platforms §10 ships.
+ */
+export declare function importDemoSeeder(scriptPath: string): Promise<DemoSeeder>;
+/** `<dataDir>/databases/demo.sqlite`, absolute. */
+export declare function demoDatabaseFile(dataDir: string): string;
+/** §6: "registered in `adminium_connections` as `sqlite:<absolute path>`". */
+export declare function demoDsn(file: string): string;
+/**
+ * Create the demo database and register it.
+ *
+ * THREE STATES, because §6 promises the connection is "deletable afterwards from
+ * Data Connections … nothing special" — and deleting a connection does not
+ * delete the file behind it. So:
+ *
+ *   1. A connection already points at the demo file ⇒ 409. The wizard sends the
+ *      user to the connection it already has; re-seeding underneath a live
+ *      connection would silently discard whatever they had done to it.
+ *   2. The file exists but no connection does (they deleted it and came back)
+ *      ⇒ adopt the file as-is. NOT re-seeded: the app never destroys data the
+ *      user could have edited (§9's ethos — even `restore` only moves data
+ *      aside), and a demo they had been playing in is exactly that.
+ *   3. Neither ⇒ seed, then register.
+ *
+ * State 2 is the one worth having: without it, deleting the demo connection
+ * leaves the user permanently unable to make another (the file is in the way and
+ * nothing in the UI removes it), which is a dead end reachable by one click on a
+ * button the wizard offers.
+ */
+export declare function createDemoDatabaseHandler(deps: DemoDatabaseDeps, input: {
+    name: string;
+    actorId: string | null;
+}): Promise<DemoDatabaseResult>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/routes/desktop-demo/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-demo/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,aAAa,MAAM,gBAAgB,CAAC;AAQ3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAEtE,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAC7C,eAAO,MAAM,kBAAkB,gBAAgB,CAAC;AAEhD,yEAAyE;AACzE,MAAM,WAAW,UAAU;IACzB,kBAAkB,CAAC,KAAK,EAAE;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,OAAO,aAAa,CAAC;KAChC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5B;AAED,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,IAAI,EAAE,cAAc,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,iBAAiB,CAAC;IAC3B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAW9E;AAED,mDAAmD;AACnD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,gBAAgB,EACtB,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC9C,OAAO,CAAC,kBAAkB,CAAC,CAkD7B"}

package/dist/routes/desktop-demo/handlers.js

@@ -0,0 +1,182 @@
+/**
+ * The demo database — seed the file, register the connection (11-electron.md §6
+ * step 2 card 4, task 11-T08).
+ *
+ * ─── WHY THE SEED SCRIPT IS LOADED BY PATH ───────────────────────────────────
+ *
+ * `demo-seed.mjs` lives in `apps/desktop/resources/`, and `@adminium/server` may
+ * not import `@adminium/desktop` — the dependency arrow points the other way
+ * (.dependency-cruiser.cjs, rule `desktop-shell-only`), and it points that way
+ * because self-host and Docker run this same server with no desktop package
+ * within a mile of them. So the shell TELLS the server where the script is
+ * (`ADMINIUM_DEMO_SEED_SCRIPT`, §2.2's env block) and the server imports that
+ * path at runtime. `compose.ts` already loads `@adminium/widgets` by file path
+ * for the same boundary reason; this is that pattern, not a new one.
+ *
+ * ─── WHY THE SERVER OPENS THE FILE, NOT THE SCRIPT ───────────────────────────
+ *
+ * §2.1: "The server is the only data owner." The script is a pure description of
+ * a schema and its rows; the `better-sqlite3` handle it writes through is opened
+ * here, by the process that owns every other database handle in the app. That
+ * also keeps the script free of module resolution — see its header.
+ */
+import BetterSqlite3 from 'better-sqlite3';
+import { mkdir, rename, rm } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { dirname, join, resolve } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { AppError } from '../../errors.js';
+/** §6: "creates `<dataDir>/databases/demo.sqlite`". Both halves are spec'd. */
+export const DEMO_DATABASE_DIR = 'databases';
+export const DEMO_DATABASE_FILE = 'demo.sqlite';
+/**
+ * `import()` the seed script. The `file://` URL is required, not cosmetic: an
+ * absolute Windows path (`C:\…`) is not a valid ESM specifier and throws
+ * `ERR_UNSUPPORTED_ESM_URL_SCHEME`, which would make this route fail on exactly
+ * one of the three platforms §10 ships.
+ */
+export async function importDemoSeeder(scriptPath) {
+    const module = await import(pathToFileURL(scriptPath).href);
+    const seeder = module;
+    if (typeof seeder.createDemoDatabase !== 'function') {
+        throw new AppError(500, 'INTERNAL', `The demo seed script at ${scriptPath} does not export createDemoDatabase().`);
+    }
+    return seeder;
+}
+/** `<dataDir>/databases/demo.sqlite`, absolute. */
+export function demoDatabaseFile(dataDir) {
+    return join(resolve(dataDir), DEMO_DATABASE_DIR, DEMO_DATABASE_FILE);
+}
+/** §6: "registered in `adminium_connections` as `sqlite:<absolute path>`". */
+export function demoDsn(file) {
+    return `sqlite:${file}`;
+}
+/**
+ * Create the demo database and register it.
+ *
+ * THREE STATES, because §6 promises the connection is "deletable afterwards from
+ * Data Connections … nothing special" — and deleting a connection does not
+ * delete the file behind it. So:
+ *
+ *   1. A connection already points at the demo file ⇒ 409. The wizard sends the
+ *      user to the connection it already has; re-seeding underneath a live
+ *      connection would silently discard whatever they had done to it.
+ *   2. The file exists but no connection does (they deleted it and came back)
+ *      ⇒ adopt the file as-is. NOT re-seeded: the app never destroys data the
+ *      user could have edited (§9's ethos — even `restore` only moves data
+ *      aside), and a demo they had been playing in is exactly that.
+ *   3. Neither ⇒ seed, then register.
+ *
+ * State 2 is the one worth having: without it, deleting the demo connection
+ * leaves the user permanently unable to make another (the file is in the way and
+ * nothing in the UI removes it), which is a dead end reachable by one click on a
+ * button the wizard offers.
+ */
+export async function createDemoDatabaseHandler(deps, input) {
+    const file = demoDatabaseFile(deps.dataDir);
+    const dsn = demoDsn(file);
+    const existing = await findDemoConnection(deps.manager, dsn);
+    if (existing !== null) {
+        throw new AppError(409, 'CONFLICT', 'The demo database is already connected. Delete it from Data Connections to start over.', { connectionId: existing });
+    }
+    let seeded = false;
+    let rows = {};
+    if (!existsSync(file)) {
+        rows = await seedDemoFile(deps, file);
+        seeded = true;
+    }
+    // The same probe `POST /connections` runs, for the same reasons: it decides
+    // `readOnly` and it is what `enforceMetaPlacement` reads. A demo file cannot
+    // BE the meta store (§2.1 puts that at `<dataDir>/meta.db`), but the check is
+    // cheap and asserting placement here rather than assuming it means the day
+    // someone changes either path, this fails loudly instead of quietly sharing.
+    const summary = await deps.manager.testDsn('sqlite', dsn);
+    if (summary.ok)
+        deps.manager.enforceMetaPlacement(dsn, summary);
+    const connection = await deps.manager.connections.create({
+        name: input.name,
+        engine: 'sqlite',
+        sourceKind: 'dsn',
+        introspectDsn: dsn,
+        // One role: `POST /connections` stores `null` when data and introspect are
+        // the same string, and Data Connections renders whichever is set.
+        dataDsn: null,
+        readOnly: summary.readOnly,
+        settings: {},
+        status: summary.ok ? 'connected' : 'error',
+        createdBy: input.actorId,
+    });
+    await deps.manager.connections.recordTestResult(connection.id, {
+        ok: summary.ok,
+        latencyMs: summary.latencyMs,
+        error: summary.error?.message ?? null,
+        readOnly: summary.readOnly,
+    });
+    return { connectionId: connection.id, name: connection.name, file, seeded, rows };
+}
+/**
+ * Seed the demo database so that `demo.sqlite` only ever exists COMPLETE.
+ *
+ * ─── WHY THIS IS NOT `createDemoDatabase({ file })` ──────────────────────────
+ *
+ * `new Database(file)` CREATES THE FILE ON OPEN — before the schema, before the
+ * row transaction. Seeding straight into `demo.sqlite` therefore published an
+ * empty database the instant the seeder started, and left it there for good if
+ * anything went wrong in the ~800 ms that followed: the app quits mid-seed, the
+ * disk fills, or `journal_mode = WAL` fails because dataDir is on a network or
+ * synced share (the exact placement 11-T03's sync-folder detection exists to
+ * warn about).
+ *
+ * Nothing removed that file, and state 2 above adopts any `demo.sqlite` it finds
+ * BY DESIGN — so the wreckage was claimed as "a demo the user had been playing
+ * in" on every subsequent click, forever. Reproduced against the real route: a
+ * 0-byte demo.sqlite returns 201 `{seeded:false, rows:{}}`, `testDsn` says ok
+ * (an empty file is a valid 0-table SQLite database), the connection registers
+ * as 'connected', and `generate` then produces 0 pages from 0 tables. The button
+ * becomes a permanent success-returning no-op — the same dead end state 2 was
+ * added to prevent, reached by one click on a button the wizard offers.
+ *
+ * ─── THE FIX: A TEMP FILE AND A RENAME ──────────────────────────────────────
+ *
+ * `rename` is atomic and same-directory, so `demo.sqlite` goes from absent to
+ * fully-seeded with no state in between that `existsSync` can observe. A crash
+ * mid-seed leaves only `demo.sqlite.<uuid>.partial`, which state 2 does not look
+ * for and the next attempt simply ignores. A try/catch alone could not deliver
+ * that: it does not run when the process is killed, which is the case that
+ * matters most here.
+ *
+ * The seeder closes its handle in a `finally` and `wal_checkpoint(TRUNCATE)`s on
+ * the way out, so a clean close leaves no `-wal`/`-shm` beside the temp file.
+ * The cleanup removes them anyway — an UNCLEAN close is exactly when they exist,
+ * and that is exactly the path this function is here for.
+ */
+async function seedDemoFile(deps, file) {
+    await mkdir(dirname(file), { recursive: true });
+    const temp = `${file}.${randomUUID()}.partial`;
+    try {
+        const loadSeeder = deps.loadSeeder ?? importDemoSeeder;
+        const seeder = await loadSeeder(deps.seedScriptPath);
+        const rows = seeder.createDemoDatabase({ file: temp, Database: BetterSqlite3 });
+        await rename(temp, file);
+        return rows;
+    }
+    catch (error) {
+        // Best effort, and it must not mask the real failure: the user needs to know
+        // the disk filled, not that we then failed to tidy up after it.
+        await Promise.all([temp, `${temp}-wal`, `${temp}-shm`].map((path) => rm(path, { force: true }).catch(() => undefined)));
+        throw error;
+    }
+}
+/** The connection id whose introspect/data DSN is the demo file, if any. */
+async function findDemoConnection(manager, dsn) {
+    for (const connection of await manager.connections.list()) {
+        if (connection.engine !== 'sqlite')
+            continue;
+        const dsns = await manager.connections.getDsns(connection.id);
+        if (dsns?.introspectDsn === dsn || dsns?.dataDsn === dsn)
+            return connection.id;
+    }
+    return null;
+}
+//# sourceMappingURL=handlers.js.map

package/dist/routes/desktop-demo/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/routes/desktop-demo/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,aAAa,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAG3C,+EAA+E;AAC/E,MAAM,CAAC,MAAM,iBAAiB,GAAG,WAAW,CAAC;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,aAAa,CAAC;AAoChD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,MAAM,MAAM,GAAY,MAAM,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,MAA6B,CAAC;IAC7C,IAAI,OAAO,MAAM,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;QACpD,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,UAAU,EACV,2BAA2B,UAAU,wCAAwC,CAC9E,CAAC;IACJ,CAAC;IACD,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AACvE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,UAAU,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAAsB,EACtB,KAA+C;IAE/C,MAAM,IAAI,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,UAAU,EACV,wFAAwF,EACxF,EAAE,YAAY,EAAE,QAAQ,EAAE,CAC3B,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAmB,EAAE,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,GAAG;QAClB,2EAA2E;QAC3E,kEAAkE;QAClE,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;QAC1C,SAAS,EAAE,KAAK,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE;QAC7D,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,KAAK,UAAU,YAAY,CAAC,IAAsB,EAAE,IAAY;IAC9D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,UAAU,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC;QACvD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,MAAM,CAAC,kBAAkB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAChF,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,6EAA6E;QAC7E,gEAAgE;QAChE,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CACrG,CAAC;QACF,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,KAAK,UAAU,kBAAkB,CAC/B,OAA0B,EAC1B,GAAW;IAEX,KAAK,MAAM,UAAU,IAAI,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,EAAE,aAAa,KAAK,GAAG,IAAI,IAAI,EAAE,OAAO,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/routes/desktop-demo/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `POST /api/v1/desktop/demo-database` — 11-electron.md §6 step 2 card 4
+ * ("Explore the demo database"), task 11-T08.
+ *
+ * ─── THE DESKTOP GATE ────────────────────────────────────────────────────────
+ *
+ * Same shape as §5's `auth/desktop-session.ts`, and for the same reason:
+ * EXISTENCE is the gate. `compose.ts` registers this factory only when
+ * `ADMINIUM_RUNTIME=desktop` AND `ADMINIUM_DEMO_SEED_SCRIPT` names a script, so
+ * a self-host or Docker instance does not have the route at all — it 404s there,
+ * which no runtime check inside a handler could improve on. Both halves of the
+ * AND are load-bearing, exactly as they are for the boot-token route: a desktop
+ * boot with no seed script has nothing to run, so the route would be an
+ * unreachable surface, and the wizard hides the card instead.
+ *
+ * Where this route deliberately DIFFERS from the §5 route: no loopback check.
+ * §2.4 makes loopback unconditional for the boot-token exchange because that
+ * route mints a super-admin session with no password — it is a credential door,
+ * and §8.3 puts a LAN on the other side of it. This one creates a database and
+ * registers a connection: the same act `POST /connections` performs, from the
+ * same authenticated principal, under the same grant. An admin who may connect a
+ * production Postgres over the LAN may certainly seed a demo SQLite file, and
+ * refusing them would be security theatre — the authorization that matters is
+ * `system:connections:manage`, which is what guards it.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import type { ConnectionManager } from '../../connections/manager.js';
+import { type DemoSeeder } from './handlers.js';
+export interface DesktopDemoRoutesDeps {
+    manager: ConnectionManager;
+    /** `ADMINIUM_DATA_DIR`. */
+    dataDir: string;
+    /** Absolute path to `apps/desktop/resources/demo/demo-seed.mjs`. */
+    seedScriptPath: string;
+    /** Test seam — see `handlers.ts`. */
+    loadSeeder?: ((scriptPath: string) => Promise<DemoSeeder>) | undefined;
+}
+export declare function desktopDemoRoutes(deps: DesktopDemoRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/desktop-demo/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-demo/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAGtE,OAAO,EAAsC,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAGpF,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,oEAAoE;IACpE,cAAc,EAAE,MAAM,CAAC;IACvB,qCAAqC;IACrC,UAAU,CAAC,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,SAAS,CAAC;CACxE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,qBAAqB,GAAG,qBAAqB,CAqDpF"}

package/dist/routes/desktop-demo/index.js

@@ -0,0 +1,73 @@
+/**
+ * `POST /api/v1/desktop/demo-database` — 11-electron.md §6 step 2 card 4
+ * ("Explore the demo database"), task 11-T08.
+ *
+ * ─── THE DESKTOP GATE ────────────────────────────────────────────────────────
+ *
+ * Same shape as §5's `auth/desktop-session.ts`, and for the same reason:
+ * EXISTENCE is the gate. `compose.ts` registers this factory only when
+ * `ADMINIUM_RUNTIME=desktop` AND `ADMINIUM_DEMO_SEED_SCRIPT` names a script, so
+ * a self-host or Docker instance does not have the route at all — it 404s there,
+ * which no runtime check inside a handler could improve on. Both halves of the
+ * AND are load-bearing, exactly as they are for the boot-token route: a desktop
+ * boot with no seed script has nothing to run, so the route would be an
+ * unreachable surface, and the wizard hides the card instead.
+ *
+ * Where this route deliberately DIFFERS from the §5 route: no loopback check.
+ * §2.4 makes loopback unconditional for the boot-token exchange because that
+ * route mints a super-admin session with no password — it is a credential door,
+ * and §8.3 puts a LAN on the other side of it. This one creates a database and
+ * registers a connection: the same act `POST /connections` performs, from the
+ * same authenticated principal, under the same grant. An admin who may connect a
+ * production Postgres over the LAN may certainly seed a demo SQLite file, and
+ * refusing them would be security theatre — the authorization that matters is
+ * `system:connections:manage`, which is what guards it.
+ */
+import { maskDsn } from '../../connections/dsn.js';
+import { CONNECTIONS_MANAGE } from '../connections/index.js';
+import { createDemoDatabaseHandler, demoDsn } from './handlers.js';
+import { desktopDemoBody, desktopDemoReply } from './schema.js';
+export function desktopDemoRoutes(deps) {
+    return async (app) => {
+        app.post('/desktop/demo-database', {
+            // The grant that governs "add a database to this workspace" everywhere
+            // else. Reusing it rather than inventing `desktop:demo:create` is the
+            // point: the demo IS a connection, and an operator who has revoked
+            // connection management has already answered this question.
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: { body: desktopDemoBody, response: { 201: desktopDemoReply } },
+        }, async (request, reply) => {
+            const actorId = request.apiKeyPrincipal === null
+                ? (request.user?.id ?? null)
+                : null;
+            const result = await createDemoDatabaseHandler({
+                manager: deps.manager,
+                dataDir: deps.dataDir,
+                seedScriptPath: deps.seedScriptPath,
+                ...(deps.loadSeeder === undefined ? {} : { loadSeeder: deps.loadSeeder }),
+            }, { name: request.body.name, actorId });
+            // `connection.create`, not a bespoke `demo.create`: the audit reader's
+            // question is "where did this connection come from?", and the answer
+            // belongs in the same action every other connection writes. The demo-ness
+            // rides in `changes` — the same way §5's route records that a login used
+            // a boot token rather than inventing a second kind of login.
+            await app.rbac.audit(request, {
+                category: 'connection',
+                action: 'connection.create',
+                connectionId: result.connectionId,
+                changes: {
+                    after: {
+                        name: result.name,
+                        engine: 'sqlite',
+                        dsnMasked: maskDsn(demoDsn(result.file)),
+                        source: 'desktop-demo',
+                        seeded: result.seeded,
+                    },
+                },
+            });
+            reply.status(201);
+            return { data: result };
+        });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/desktop-demo/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/desktop-demo/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAKH,OAAO,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAyB,MAAM,aAAa,CAAC;AAYvF,MAAM,UAAU,iBAAiB,CAAC,IAA2B;IAC3D,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,IAAI,CACN,wBAAwB,EACxB;YACE,uEAAuE;YACvE,sEAAsE;YACtE,mEAAmE;YACnE,4DAA4D;YAC5D,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChD,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,EAAE;SACvE,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAA6B,EAAE;YAClD,MAAM,OAAO,GACX,OAAO,CAAC,eAAe,KAAK,IAAI;gBAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC;YAEX,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C;gBACE,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;aAC1E,EACD,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CACrC,CAAC;YAEF,uEAAuE;YACvE,qEAAqE;YACrE,0EAA0E;YAC1E,yEAAyE;YACzE,6DAA6D;YAC7D,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,YAAY;gBACtB,MAAM,EAAE,mBAAmB;gBAC3B,YAAY,EAAE,MAAM,CAAC,YAAY;gBACjC,OAAO,EAAE;oBACP,KAAK,EAAE;wBACL,IAAI,EAAE,MAAM,CAAC,IAAI;wBACjB,MAAM,EAAE,QAAQ;wBAChB,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;wBACxC,MAAM,EAAE,cAAc;wBACtB,MAAM,EAAE,MAAM,CAAC,MAAM;qBACtB;iBACF;aACF,CAAC,CAAC;YAEH,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/desktop-demo/schema.d.ts

@@ -0,0 +1,17 @@
+/** Zod schemas for the desktop demo-database resource (11-T08, §6 step 2 card 4). */
+import { z } from 'zod';
+export declare const desktopDemoBody: z.ZodObject<{
+    name: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type DesktopDemoBody = z.infer<typeof desktopDemoBody>;
+export declare const desktopDemoReply: z.ZodObject<{
+    data: z.ZodObject<{
+        connectionId: z.ZodString;
+        name: z.ZodString;
+        file: z.ZodString;
+        seeded: z.ZodBoolean;
+        rows: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type DesktopDemoReply = z.infer<typeof desktopDemoReply>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/desktop-demo/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-demo/schema.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,eAAe;;iBAG1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,gBAAgB;;;;;;;;iBAsB3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/routes/desktop-demo/schema.js

@@ -0,0 +1,30 @@
+/** Zod schemas for the desktop demo-database resource (11-T08, §6 step 2 card 4). */
+import { z } from 'zod';
+export const desktopDemoBody = z.object({
+    /** The name the connection appears under in Data Connections. */
+    name: z.string().min(1).max(80).default('Demo'),
+});
+export const desktopDemoReply = z.object({
+    data: z.object({
+        connectionId: z.string(),
+        name: z.string(),
+        /**
+         * The absolute `<dataDir>/databases/demo.sqlite` path.
+         *
+         * Not a secret and deliberately unmasked: a SQLite DSN carries no
+         * credentials (`maskDsn` reduces one to `sqlite:<file>` — the same string),
+         * this route only ever names a file it just created inside the app's own
+         * data directory, and the wizard's "Show in folder" affordance needs a path
+         * to hand the preload bridge.
+         */
+        file: z.string(),
+        /**
+         * Whether this call seeded the file, or adopted one already on disk (see
+         * `handlers.ts` — deleting the connection leaves the file behind).
+         */
+        seeded: z.boolean(),
+        /** Rows written per table. Empty when `seeded` is false. */
+        rows: z.record(z.string(), z.number().int().min(0)),
+    }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/desktop-demo/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/desktop-demo/schema.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,iEAAiE;IACjE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAChD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB;;;;;;;;WAQG;QACH,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB;;;WAGG;QACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;QACnB,4DAA4D;QAC5D,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;KACpD,CAAC;CACH,CAAC,CAAC"}

package/dist/routes/desktop-lan/index.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `GET /api/v1/desktop/lan-share` — what §8.3's share panel needs from the side
+ * of the boundary that holds the data (11-electron.md §8.3, §1 principle 2).
+ *
+ * The panel is built from two sources and this is one of them. §4's bridge
+ * supplies what only the main process knows — the reachable
+ * `http://<LAN-IPv4>:<port>` URLs, which come from `os.networkInterfaces()` in a
+ * process that has interfaces to enumerate. This route supplies what only the
+ * server knows: who is connected, and whether there is anyone to invite. Neither
+ * can answer the other's question, which is why the panel asks both.
+ *
+ * ─── The gates, in order, mirroring `routes/desktop/index.ts` ────────────────
+ *
+ *  1. EXISTENCE. `compose.ts` registers this factory only when
+ *     `ADMINIUM_RUNTIME=desktop`. Self-host has no LAN-share feature to report
+ *     on — it binds `0.0.0.0` as its normal, correct configuration behind a
+ *     reverse proxy, and "how many non-loopback sessions do you have" is a
+ *     question about EVERY session there. The route would answer a different
+ *     question under the same name, which is worse than 404.
+ *  2. PEER. The SOCKET's `remoteAddress` must be loopback — `request.raw.socket`,
+ *     never `request.ip`; see `auth/desktop-session.ts` for why that distinction
+ *     is the difference between a check and a vulnerability. This is the gate
+ *     with the most direct reasoning behind it in the whole file: the route
+ *     exists ONLY when the server is bound to every interface, so the LAN users
+ *     §8.3 invited can reach it by construction. Without this gate, any of them
+ *     with a super-admin account — and §8.3's whole point is that LAN users get
+ *     real accounts — could enumerate how many other people are on the network
+ *     right now. That is a surveillance surface, and it is not one the panel's
+ *     owner asked for. The panel is a LOCAL affordance about the local machine;
+ *     it belongs to the person sitting at it.
+ *  3. SESSION + RBAC. `system:settings:manage`, i.e. Super Admin — the same
+ *     grant `routes/desktop/index.ts` requires for a backup, and for the same
+ *     reason: `config.lanShare` is a security setting, and the count of who is
+ *     connected is the operational half of it. There is no narrower system
+ *     action in meta's closed set (`SYSTEM_ACTION_KEYS`) and this route is not
+ *     the place to invent one.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import type { MetaDb } from '@adminium/meta';
+import type { Env } from '../../config/env.js';
+export interface DesktopLanRoutesDeps {
+    meta: MetaDb;
+    /**
+     * The validated boot environment. INJECTED for the reason
+     * `routes/system/index.ts` gives at length: `HOST` and `ADMINIUM_RUNTIME`
+     * decide what this reply CLAIMS, and a value sampled off `process.env` inside
+     * a handler reads as a plausible default instead of failing the boot.
+     */
+    env: Env;
+    /** Test seam for the session-window arithmetic. */
+    now?: (() => number) | undefined;
+}
+export declare function desktopLanRoutes(deps: DesktopLanRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/desktop-lan/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-lan/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAG7C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAM/C,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;OAKG;IACH,GAAG,EAAE,GAAG,CAAC;IACT,mDAAmD;IACnD,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,oBAAoB,GAAG,qBAAqB,CAoClF"}