@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/desktop-lan/index.js

@@ -0,0 +1,33 @@
+import { isLoopbackPeer } from '../../auth/desktop-session.js';
+import { readLanShareStatus } from '../../desktop/lan-share.js';
+import { AppError } from '../../errors.js';
+import { PERMISSIONS } from '../../rbac/permissions.js';
+import { desktopLanShareReply } from './schema.js';
+export function desktopLanRoutes(deps) {
+    return async (app) => {
+        app.get('/desktop/lan-share', {
+            // Gate 3. `rbac.require` carries `requireAuth` semantics: an anonymous
+            // request has no principal to resolve and is refused before the handler.
+            preHandler: [app.requireMeta, app.rbac.require(PERMISSIONS.settingsManage)],
+            schema: { response: { 200: desktopLanShareReply } },
+        }, async (request) => {
+            // Gate 2, before any work: a LAN peer learns nothing here, not even
+            // whether the question was expensive to answer.
+            if (!isLoopbackPeer(request.raw.socket)) {
+                throw new AppError(403, 'FORBIDDEN', 'The network-sharing panel is only available on the computer Adminium is running on.');
+            }
+            // `deps.now?.()` — an absent clock passes `undefined`, which takes the
+            // parameter's `Date.now()` default rather than pinning time to the boot.
+            const status = await readLanShareStatus(deps.env, deps.meta, deps.now?.());
+            return {
+                data: {
+                    active: status.active,
+                    host: deps.env.HOST,
+                    lanSessions: status.lanSessions,
+                    otherUsers: status.otherUsers,
+                },
+            };
+        });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/desktop-lan/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/desktop-lan/index.ts"],"names":[],"mappings":"AAwCA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAA6B,MAAM,aAAa,CAAC;AAe9E,MAAM,UAAU,gBAAgB,CAAC,IAA0B;IACzD,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CACL,oBAAoB,EACpB;YACE,uEAAuE;YACvE,yEAAyE;YACzE,UAAU,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YAC3E,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,oBAAoB,EAAE,EAAE;SACpD,EACD,KAAK,EAAE,OAAO,EAAiC,EAAE;YAC/C,oEAAoE;YACpE,gDAAgD;YAChD,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,WAAW,EACX,qFAAqF,CACtF,CAAC;YACJ,CAAC;YAED,uEAAuE;YACvE,yEAAyE;YACzE,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAE3E,OAAO;gBACL,IAAI,EAAE;oBACJ,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;oBACnB,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;iBAC9B;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/desktop-lan/schema.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Wire schema for `GET /api/v1/desktop/lan-share` (11-electron.md §8.3).
+ *
+ * READ-ONLY, and there is no sibling POST. Turning sharing on is not something
+ * this process can do: §8.3's mechanics are "flipping the toggle updates
+ * `config.lanShare` … and gracefully restarts the utilityProcess with
+ * `ADMINIUM_HOST=0.0.0.0`", and both halves belong to the main process —
+ * `config.json` is its file (§2.3) and the utilityProcess is its child. A server
+ * route that "enabled LAN share" could at best write a value nobody reads and at
+ * worst ask this process to re-listen on a socket its supervisor knows nothing
+ * about. The SPA writes the toggle through §4's `setConfig` bridge; this route
+ * answers only the two questions the bridge cannot.
+ */
+import { z } from 'zod';
+export declare const desktopLanShareReply: z.ZodObject<{
+    data: z.ZodObject<{
+        active: z.ZodBoolean;
+        host: z.ZodString;
+        lanSessions: z.ZodNumber;
+        otherUsers: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type DesktopLanShareReply = z.infer<typeof desktopLanShareReply>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/desktop-lan/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-lan/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,oBAAoB;;;;;;;iBAwB/B,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/routes/desktop-lan/schema.js

@@ -0,0 +1,40 @@
+/**
+ * Wire schema for `GET /api/v1/desktop/lan-share` (11-electron.md §8.3).
+ *
+ * READ-ONLY, and there is no sibling POST. Turning sharing on is not something
+ * this process can do: §8.3's mechanics are "flipping the toggle updates
+ * `config.lanShare` … and gracefully restarts the utilityProcess with
+ * `ADMINIUM_HOST=0.0.0.0`", and both halves belong to the main process —
+ * `config.json` is its file (§2.3) and the utilityProcess is its child. A server
+ * route that "enabled LAN share" could at best write a value nobody reads and at
+ * worst ask this process to re-listen on a socket its supervisor knows nothing
+ * about. The SPA writes the toggle through §4's `setConfig` bridge; this route
+ * answers only the two questions the bridge cannot.
+ */
+import { z } from 'zod';
+export const desktopLanShareReply = z.object({
+    data: z.object({
+        /**
+         * Is this process ACTUALLY bound to every interface right now?
+         *
+         * Deliberately not named `enabled`: `config.lanShare.enabled` is the user's
+         * intent and this is the state of the socket. They differ for a whole server
+         * lifetime after a toggle that has not been applied yet, and the panel needs
+         * to show what is true, not what was asked for.
+         */
+        active: z.boolean(),
+        /** The bind address, so the panel can say something specific when they disagree. */
+        host: z.string(),
+        /** Sessions held right now by a peer that is not this machine (§8.3). */
+        lanSessions: z.number().int().nonnegative(),
+        /**
+         * Active non-super-admin users — §8.3's precondition ("at least one
+         * non-super-admin user exists *or* the admin acknowledges they'll invite
+         * users next"). A count and not a boolean: the panel says "2 people can sign
+         * in", which is the sentence that makes the precondition make sense, and a
+         * bare `true` cannot be rendered as one.
+         */
+        otherUsers: z.number().int().nonnegative(),
+    }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/desktop-lan/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/desktop-lan/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb;;;;;;;WAOG;QACH,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;QACnB,oFAAoF;QACpF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,yEAAyE;QACzE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;QAC3C;;;;;;WAMG;QACH,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC;CACH,CAAC,CAAC"}

package/dist/routes/desktop-local-db/handlers.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Create a local SQLite database and register it (11-electron.md §6 step 2
+ * card 1, task 11-T07).
+ *
+ * §6: "Name → slug → creates `<dataDir>/databases/<slug>.sqlite` (WAL, §9).
+ * Sub-choice: *Blank* … or *From a schema file* … translated to SQLite DDL and
+ * applied; includes the 'Auto-generate placeholder entries' toggle."
+ *
+ * ─── WHY THE SERVER CREATES THE FILE AT ALL ──────────────────────────────────
+ *
+ * `adapter-sqlite` opens every handle with `fileMustExist: true` for anything but
+ * `:memory:` (`packages/adapter-sqlite/src/index.ts`), which is correct — an
+ * adapter that creates a database when it fails to find one turns a typo in a DSN
+ * into a silently empty install. So `POST /connections` with
+ * `sqlite:/…/new.sqlite` cannot be the implementation of "create a new local
+ * database": it fails, and it fails for a good reason. This route is where the
+ * file legitimately comes into existence, and it is desktop-only for the same
+ * reason `desktop-demo` is — §2.1's "the server is the only data owner" holds,
+ * and `<dataDir>` only means something under the shell.
+ *
+ * ─── WHY `better-sqlite3` DIRECTLY AND NOT THROUGH THE ADAPTER ───────────────
+ *
+ * Same answer as `desktop-demo/handlers.ts`: the adapter's contract is
+ * introspect/query/mutate over an EXISTING database, and there is no `execute
+ * arbitrary DDL` method on it — deliberately, since that method is the one every
+ * SQL-injection review starts at. Creating a file and running a CREATE TABLE
+ * script is a different act from serving a connection, so it is spelled
+ * differently. `@adminium/adapter-sqlite`'s own pragma helper is reused rather
+ * than a second copy of §9's four lines (see `applyDataPragmas` below).
+ */
+import { type DatabaseModel, type ImportFormat } from '@adminium/engine';
+import type { ConnectionManager } from '../../connections/manager.js';
+import { type DdlWarning } from './sqlite-ddl.js';
+/** §6: `<dataDir>/databases/<slug>.sqlite`. Shared with `desktop-demo`'s copy. */
+export declare const LOCAL_DATABASE_DIR = "databases";
+/**
+ * Name → slug.
+ *
+ * The output alphabet is `[a-z0-9-]`, which is what makes {@link localDatabaseFile}
+ * safe by construction rather than by a path check: `../../etc/passwd`,
+ * `C:\evil`, and a NUL byte all reduce to hyphens, so no input can escape
+ * `<dataDir>/databases/`. That is the SECOND line of defence — the name is also
+ * length-capped by the Zod body — but it is the one that does not depend on
+ * anybody keeping a validator in sync with a path join.
+ */
+export declare function slugFor(name: string): string;
+/** `<dataDir>/databases/<slug>.sqlite`, absolute. */
+export declare function localDatabaseFile(dataDir: string, slug: string): string;
+/** §6: "registered in `adminium_connections` as `sqlite:<absolute path>`". */
+export declare function localDsn(file: string): string;
+export interface LocalDatabaseResult {
+    connectionId: string;
+    name: string;
+    slug: string;
+    file: string;
+    tables: string[];
+    rows: Record<string, number>;
+    warnings: DdlWarning[];
+}
+export interface LocalDatabaseDeps {
+    manager: ConnectionManager;
+    /** `ADMINIUM_DATA_DIR` — the database lands under it (§2.2/§6). */
+    dataDir: string;
+    /**
+     * Parse a schema file into the engine IR. Production passes
+     * `routes/schema-import`'s `parseSchemaFile` — the SAME resolver
+     * `POST /schema-import/parse` uses, so the eight formats behave identically on
+     * both paths and there is no second answer to "is this a valid Prisma schema".
+     */
+    parseSchema: (input: {
+        content: string;
+        format: ImportFormat | undefined;
+        fileName: string | undefined;
+    }) => Promise<{
+        model: DatabaseModel;
+        warnings: string[];
+    }>;
+    /** Injected for the suite; see `placeholder.ts`. */
+    now?: (() => Date) | undefined;
+}
+export interface LocalDatabaseInput {
+    name: string;
+    schemaFile: {
+        content: string;
+        format: ImportFormat | undefined;
+        fileName: string | undefined;
+    } | undefined;
+    placeholderRows: boolean;
+    actorId: string | null;
+}
+export declare function createLocalDatabaseHandler(deps: LocalDatabaseDeps, input: LocalDatabaseInput): Promise<LocalDatabaseResult>;
+//# sourceMappingURL=handlers.d.ts.map

package/dist/routes/desktop-local-db/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-local-db/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAMH,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAG9G,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAA0C,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAG1F,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,cAAc,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAc5C;AAED,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,8EAA8E;AAC9E,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,EAAE,UAAU,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC;QACjC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;KAC9B,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAC5D,oDAAoD;IACpD,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,YAAY,GAAG,SAAS,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,GAAG,SAAS,CAAC;IAC5G,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAoBD,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CA4G9B"}

package/dist/routes/desktop-local-db/handlers.js

@@ -0,0 +1,300 @@
+/**
+ * Create a local SQLite database and register it (11-electron.md §6 step 2
+ * card 1, task 11-T07).
+ *
+ * §6: "Name → slug → creates `<dataDir>/databases/<slug>.sqlite` (WAL, §9).
+ * Sub-choice: *Blank* … or *From a schema file* … translated to SQLite DDL and
+ * applied; includes the 'Auto-generate placeholder entries' toggle."
+ *
+ * ─── WHY THE SERVER CREATES THE FILE AT ALL ──────────────────────────────────
+ *
+ * `adapter-sqlite` opens every handle with `fileMustExist: true` for anything but
+ * `:memory:` (`packages/adapter-sqlite/src/index.ts`), which is correct — an
+ * adapter that creates a database when it fails to find one turns a typo in a DSN
+ * into a silently empty install. So `POST /connections` with
+ * `sqlite:/…/new.sqlite` cannot be the implementation of "create a new local
+ * database": it fails, and it fails for a good reason. This route is where the
+ * file legitimately comes into existence, and it is desktop-only for the same
+ * reason `desktop-demo` is — §2.1's "the server is the only data owner" holds,
+ * and `<dataDir>` only means something under the shell.
+ *
+ * ─── WHY `better-sqlite3` DIRECTLY AND NOT THROUGH THE ADAPTER ───────────────
+ *
+ * Same answer as `desktop-demo/handlers.ts`: the adapter's contract is
+ * introspect/query/mutate over an EXISTING database, and there is no `execute
+ * arbitrary DDL` method on it — deliberately, since that method is the one every
+ * SQL-injection review starts at. Creating a file and running a CREATE TABLE
+ * script is a different act from serving a connection, so it is spelled
+ * differently. `@adminium/adapter-sqlite`'s own pragma helper is reused rather
+ * than a second copy of §9's four lines (see `applyDataPragmas` below).
+ */
+import BetterSqlite3 from 'better-sqlite3';
+import { mkdir } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { parseDatabaseModel } from '@adminium/engine';
+import { AppError, ValidationFailedError } from '../../errors.js';
+import { emitSqliteDdl, orderTables, quoteIdent } from './sqlite-ddl.js';
+import { planPlaceholderRows } from './placeholder.js';
+/** §6: `<dataDir>/databases/<slug>.sqlite`. Shared with `desktop-demo`'s copy. */
+export const LOCAL_DATABASE_DIR = 'databases';
+/**
+ * Name → slug.
+ *
+ * The output alphabet is `[a-z0-9-]`, which is what makes {@link localDatabaseFile}
+ * safe by construction rather than by a path check: `../../etc/passwd`,
+ * `C:\evil`, and a NUL byte all reduce to hyphens, so no input can escape
+ * `<dataDir>/databases/`. That is the SECOND line of defence — the name is also
+ * length-capped by the Zod body — but it is the one that does not depend on
+ * anybody keeping a validator in sync with a path join.
+ */
+export function slugFor(name) {
+    const slug = name
+        .normalize('NFKD')
+        // Strip combining marks so `Café` → `cafe` rather than `caf-`.
+        .replace(/[̀-ͯ]/g, '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48)
+        .replace(/-+$/g, '');
+    // A name of only non-Latin characters (`日本語`, `العربية`) legitimately slugs
+    // to nothing. Rejecting it would make the wizard's first field refuse a
+    // perfectly good database name in three of the eight locales this app ships.
+    return slug.length > 0 ? slug : 'database';
+}
+/** `<dataDir>/databases/<slug>.sqlite`, absolute. */
+export function localDatabaseFile(dataDir, slug) {
+    return join(resolve(dataDir), LOCAL_DATABASE_DIR, `${slug}.sqlite`);
+}
+/** §6: "registered in `adminium_connections` as `sqlite:<absolute path>`". */
+export function localDsn(file) {
+    return `sqlite:${file}`;
+}
+/**
+ * §9's four pragmas, applied at creation so the file is WAL from its first byte.
+ *
+ * They are re-applied by `adapter-sqlite`'s data role on every open, which is
+ * what actually keeps them true — `journal_mode` is the only one that persists in
+ * the file header; `synchronous`, `foreign_keys` and `busy_timeout` are
+ * per-connection and reset to their defaults for anybody who opens the file
+ * without them. Setting them here is still not redundant: `foreign_keys = ON`
+ * governs THIS connection, the one that is about to run the placeholder INSERTs,
+ * and without it a dangling FK would be written silently instead of rejected.
+ */
+function applyCreationPragmas(db) {
+    db.pragma('journal_mode = WAL');
+    db.pragma('synchronous = NORMAL');
+    db.pragma('foreign_keys = ON');
+    db.pragma('busy_timeout = 5000');
+}
+export async function createLocalDatabaseHandler(deps, input) {
+    const slug = slugFor(input.name);
+    const file = localDatabaseFile(deps.dataDir, slug);
+    const dsn = localDsn(file);
+    // Two different conflicts, and collapsing them would be a lie in one
+    // direction or the other: a file already here is the user's data (never
+    // overwritten — §9's ethos is that the app moves data aside and never
+    // destroys it), while a connection already here is a naming collision.
+    if (existsSync(file)) {
+        throw new AppError(409, 'CONFLICT', `A database file named "${slug}.sqlite" already exists. Choose a different name, or open the existing file instead.`, { slug, file });
+    }
+    const clash = await findConnectionForDsn(deps.manager, dsn);
+    if (clash !== null) {
+        throw new AppError(409, 'CONFLICT', `A connection named "${input.name}" already points at this file.`, {
+            connectionId: clash,
+        });
+    }
+    const warnings = [];
+    let tables = [];
+    let rows = {};
+    await mkdir(dirname(file), { recursive: true });
+    // From here on the FILE EXISTS. Every failure below must remove it: a
+    // half-created database left on disk means the user's retry hits the 409
+    // above — a dead end reachable by one rejected CHECK constraint, with no
+    // affordance anywhere in the product to clear it.
+    let db;
+    try {
+        db = new BetterSqlite3(file);
+    }
+    catch (error) {
+        throw new AppError(500, 'INTERNAL', `Could not create ${file}: ${messageOf(error)}`);
+    }
+    try {
+        applyCreationPragmas(db);
+        if (input.schemaFile !== undefined) {
+            const parsed = await parseOrReject(deps, input.schemaFile);
+            // The PARSER's gaps come first because they happened first: a
+            // `CREATE VIEW` the SQL parser could not read never reaches the emitter,
+            // so `emitSqliteDdl` cannot know it existed. Only the two lists together
+            // describe what the user's file lost on the way to their database.
+            warnings.push(...parsed.warnings.map((message) => ({
+                code: 'source-not-translated',
+                message,
+                tableId: null,
+            })));
+            const ddl = emitSqliteDdl(parsed.model);
+            warnings.push(...ddl.warnings);
+            tables = ddl.tables;
+            applyDdl(db, ddl.statements);
+            if (input.placeholderRows) {
+                rows = seedPlaceholders(db, parsed.model, deps.now?.() ?? new Date());
+            }
+        }
+        // §9: "`wal_checkpoint(TRUNCATE)` runs on server shutdown so `.sqlite` files
+        // are self-contained at rest." The same reasoning applies the moment this
+        // handle closes: the connection that opens the file next is a different
+        // process' handle in dev, and a user who backs up or copies the file
+        // seconds after the wizard created it should get all of it.
+        db.pragma('wal_checkpoint(TRUNCATE)');
+    }
+    catch (error) {
+        db.close();
+        await removeQuietly(file);
+        if (error instanceof AppError)
+            throw error;
+        throw new AppError(500, 'INTERNAL', `Could not build ${slug}.sqlite: ${messageOf(error)}`);
+    }
+    finally {
+        if (db.open)
+            db.close();
+    }
+    // The same probe `POST /connections` runs — see `desktop-demo/handlers.ts`,
+    // which explains why placement is asserted rather than assumed.
+    const summary = await deps.manager.testDsn('sqlite', dsn);
+    if (summary.ok)
+        deps.manager.enforceMetaPlacement(dsn, summary);
+    const connection = await deps.manager.connections.create({
+        name: input.name,
+        engine: 'sqlite',
+        sourceKind: 'dsn',
+        introspectDsn: dsn,
+        // One role — `POST /connections` stores null when both DSNs are the string.
+        dataDsn: null,
+        readOnly: summary.readOnly,
+        settings: {},
+        status: summary.ok ? 'connected' : 'error',
+        createdBy: input.actorId,
+    });
+    await deps.manager.connections.recordTestResult(connection.id, {
+        ok: summary.ok,
+        latencyMs: summary.latencyMs,
+        error: summary.error?.message ?? null,
+        readOnly: summary.readOnly,
+    });
+    return { connectionId: connection.id, name: connection.name, slug, file, tables, rows, warnings };
+}
+async function parseOrReject(deps, schemaFile) {
+    const parsed = await deps.parseSchema({
+        content: schemaFile.content,
+        format: schemaFile.format,
+        fileName: schemaFile.fileName,
+    });
+    // Re-validated even though `parseSchema` already did: this handler is a write
+    // boundary, and the injected parser is a seam a test can replace.
+    const model = parseDatabaseModel(parsed.model);
+    if (model.tables.length === 0) {
+        // Mirrors `POST /schema-import/parse`'s own rejection: a parse that yields
+        // zero tables is not a database, and creating an empty file for it would
+        // hand the user a "success" they then cannot explain.
+        throw new ValidationFailedError('The schema file contained no parseable tables.', {
+            reason: 'PARSE_FAILED',
+            info: { warnings: parsed.warnings },
+        });
+    }
+    return { model, warnings: parsed.warnings };
+}
+/**
+ * Run the DDL as ONE transaction.
+ *
+ * SQLite is transactional for DDL (unlike MySQL), so a rejected statement rolls
+ * the whole script back and the database is empty rather than half a schema. The
+ * caller then deletes the file — but the transaction is what makes that deletion
+ * a tidy-up rather than the actual recovery.
+ *
+ * The statement text rides in the error message because there is nowhere else
+ * for the user to see it: the schema file is theirs, the failure is almost always
+ * in a `CHECK` expression written in another engine's dialect (`sqlite-ddl.ts`
+ * documents why those are passed through), and "SQLITE_ERROR: near ')'" without
+ * the statement is unactionable. It carries no row data — this database has none
+ * yet.
+ */
+function applyDdl(db, statements) {
+    const run = db.transaction((script) => {
+        for (const statement of script) {
+            try {
+                db.exec(statement);
+            }
+            catch (error) {
+                throw new ValidationFailedError(`The schema could not be applied to SQLite: ${messageOf(error)}`, { reason: 'DDL_FAILED', statement });
+            }
+        }
+    });
+    run(statements);
+}
+/** Insert the planned placeholder rows; returns rows-written per table. */
+function seedPlaceholders(db, model, now) {
+    const { order } = orderTables(model);
+    const prefixed = needsPrefix(order);
+    const nameOf = (table) => (prefixed ? `${table.schema}_${table.name}` : table.name);
+    const plan = planPlaceholderRows(model, order, nameOf, { now });
+    const written = {};
+    const run = db.transaction(() => {
+        for (const insert of plan.inserts) {
+            const columns = insert.columns.map(quoteIdent).join(', ');
+            const marks = insert.columns.map(() => '?').join(', ');
+            const statement = db.prepare(`INSERT INTO ${quoteIdent(insert.table)} (${columns}) VALUES (${marks})`);
+            for (const row of insert.rows)
+                statement.run(row);
+            written[insert.table] = insert.rows.length;
+        }
+    });
+    run();
+    return written;
+}
+/** Mirrors `sqlite-ddl.ts`'s rule — see `needsSchemaPrefix` there. */
+function needsPrefix(tables) {
+    const seen = new Set();
+    for (const table of tables) {
+        if (seen.has(table.name))
+            return true;
+        seen.add(table.name);
+    }
+    return false;
+}
+/** The connection id whose introspect/data DSN is this file, if any. */
+async function findConnectionForDsn(manager, dsn) {
+    for (const connection of await manager.connections.list()) {
+        if (connection.engine !== 'sqlite')
+            continue;
+        const dsns = await manager.connections.getDsns(connection.id);
+        if (dsns?.introspectDsn === dsn || dsns?.dataDsn === dsn)
+            return connection.id;
+    }
+    return null;
+}
+/**
+ * Best-effort cleanup of a failed creation.
+ *
+ * Failure to delete is swallowed on purpose: the user is already getting the
+ * REAL error (the DDL that would not apply), and replacing it with "could not
+ * unlink a temp file" would hide the one message they can act on. WAL/SHM
+ * siblings go too — `close()` normally removes them, but a crashed handle can
+ * leave them behind, and an orphan `-wal` next to a recreated file of the same
+ * name is a corruption report waiting to happen.
+ */
+async function removeQuietly(file) {
+    const { rm } = await import('node:fs/promises');
+    for (const path of [file, `${file}-wal`, `${file}-shm`]) {
+        try {
+            await rm(path, { force: true });
+        }
+        catch {
+            // see above
+        }
+    }
+}
+function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=handlers.js.map

package/dist/routes/desktop-local-db/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../../../src/routes/desktop-local-db/handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,aAAa,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,kBAAkB,EAA0D,MAAM,kBAAkB,CAAC;AAE9G,OAAO,EAAE,QAAQ,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAmB,MAAM,iBAAiB,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAE9C;;;;;;;;;GASG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,MAAM,IAAI,GAAG,IAAI;SACd,SAAS,CAAC,MAAM,CAAC;QAClB,+DAA+D;SAC9D,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;SACZ,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACvB,4EAA4E;IAC5E,wEAAwE;IACxE,6EAA6E;IAC7E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7C,CAAC;AAED,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,IAAY;IAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,kBAAkB,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,OAAO,UAAU,IAAI,EAAE,CAAC;AAC1B,CAAC;AAsCD;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAAC,EAA0B;IACtD,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAChC,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAClC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC/B,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,IAAuB,EACvB,KAAyB;IAEzB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3B,qEAAqE;IACrE,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,QAAQ,CAChB,GAAG,EACH,UAAU,EACV,0BAA0B,IAAI,sFAAsF,EACpH,EAAE,IAAI,EAAE,IAAI,EAAE,CACf,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,uBAAuB,KAAK,CAAC,IAAI,gCAAgC,EAAE;YACrG,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAiB,EAAE,CAAC;IAClC,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,IAAI,GAA2B,EAAE,CAAC;IAEtC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEhD,sEAAsE;IACtE,yEAAyE;IACzE,yEAAyE;IACzE,kDAAkD;IAClD,IAAI,EAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,EAAE,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,oBAAoB,IAAI,KAAK,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,CAAC;QACH,oBAAoB,CAAC,EAAE,CAAC,CAAC;QAEzB,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;YAC3D,8DAA8D;YAC9D,yEAAyE;YACzE,yEAAyE;YACzE,mEAAmE;YACnE,QAAQ,CAAC,IAAI,CACX,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACnC,IAAI,EAAE,uBAAgC;gBACtC,OAAO;gBACP,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,CACJ,CAAC;YACF,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YAEpB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;YAE7B,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC1B,IAAI,GAAG,gBAAgB,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;YACxE,CAAC;QACH,CAAC;QAED,6EAA6E;QAC7E,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,4DAA4D;QAC5D,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1B,IAAI,KAAK,YAAY,QAAQ;YAAE,MAAM,KAAK,CAAC;QAC3C,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,mBAAmB,IAAI,YAAY,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,CAAC,IAAI;YAAE,EAAE,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;IAED,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC;QACvD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE,KAAK;QACjB,aAAa,EAAE,GAAG;QAClB,4EAA4E;QAC5E,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,EAAE;QACZ,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO;QAC1C,SAAS,EAAE,KAAK,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,EAAE;QAC7D,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI;QACrC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC,CAAC;IAEH,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACpG,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,IAAuB,EACvB,UAAyD;IAEzD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;QACpC,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;KAC9B,CAAC,CAAC;IACH,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,2EAA2E;QAC3E,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,IAAI,qBAAqB,CAAC,gDAAgD,EAAE;YAChF,MAAM,EAAE,cAAc;YACtB,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,QAAQ,CAAC,EAA0B,EAAE,UAA6B;IACzE,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,MAAyB,EAAE,EAAE;QACvD,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,qBAAqB,CAC7B,8CAA8C,SAAS,CAAC,KAAK,CAAC,EAAE,EAChE,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CACpC,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,UAAU,CAAC,CAAC;AAClB,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,EAA0B,EAAE,KAAoB,EAAE,GAAS;IACnF,MAAM,EAAE,KAAK,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAExG,MAAM,IAAI,GAAG,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChE,MAAM,OAAO,GAA2B,EAAE,CAAC;IAE3C,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;QAC9B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,eAAe,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,aAAa,KAAK,GAAG,CAAC,CAAC;YACvG,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI;gBAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;IACH,GAAG,EAAE,CAAC;IAEN,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,sEAAsE;AACtE,SAAS,WAAW,CAAC,MAA6B;IAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,oBAAoB,CAAC,OAA0B,EAAE,GAAW;IACzE,KAAK,MAAM,UAAU,IAAI,MAAM,OAAO,CAAC,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC7C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,EAAE,aAAa,KAAK,GAAG,IAAI,IAAI,EAAE,OAAO,KAAK,GAAG;YAAE,OAAO,UAAU,CAAC,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,MAAM,EAAE,EAAE,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAChD,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/routes/desktop-local-db/index.d.ts

@@ -0,0 +1,39 @@
+/**
+ * `POST /api/v1/desktop/local-database` — 11-electron.md §6 step 2 card 1
+ * ("Create a new local database"), task 11-T07.
+ *
+ * ─── THE DESKTOP GATE ────────────────────────────────────────────────────────
+ *
+ * EXISTENCE is the gate, exactly as it is for `desktop-demo` and §5's
+ * `auth/desktop-session.ts`: `compose.ts` registers this factory only when
+ * `ADMINIUM_RUNTIME=desktop`, so self-host and Docker do not have the route at
+ * all. That is not a formality here — the route's whole subject is
+ * `<dataDir>/databases/`, a directory that exists because the shell created it
+ * and passed `ADMINIUM_DATA_DIR` (§2.2). On a Docker deployment `<dataDir>` is a
+ * container path nobody can reach with a file dialog, so a "create a local
+ * database" button there would create a file the user can neither find, back up,
+ * nor delete.
+ *
+ * No loopback check, for `desktop-demo`'s reason: this creates a database and
+ * registers a connection — the same act `POST /connections` performs, from the
+ * same principal, under the same `system:connections:manage` grant. The §5 route
+ * is loopback-only because it mints a session with no password; this one does
+ * not.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import type { ConnectionManager } from '../../connections/manager.js';
+import { type LocalDatabaseDeps } from './handlers.js';
+export interface DesktopLocalDbRoutesDeps {
+    manager: ConnectionManager;
+    /** `ADMINIUM_DATA_DIR`. */
+    dataDir: string;
+    /**
+     * Test seams. Production omits both: the parser defaults to the one
+     * `POST /schema-import/parse` uses (so the eight formats cannot behave
+     * differently on the two paths), and the clock to `Date`.
+     */
+    parseSchema?: LocalDatabaseDeps['parseSchema'] | undefined;
+    now?: (() => Date) | undefined;
+}
+export declare function desktopLocalDbRoutes(deps: DesktopLocalDbRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/desktop-local-db/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/desktop-local-db/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAEvE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAItE,OAAO,EAAwC,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAG7F,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,iBAAiB,CAAC;IAC3B,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;IAC3D,GAAG,CAAC,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;CAChC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,wBAAwB,GAAG,qBAAqB,CAkE1F"}

package/dist/routes/desktop-local-db/index.js

@@ -0,0 +1,83 @@
+/**
+ * `POST /api/v1/desktop/local-database` — 11-electron.md §6 step 2 card 1
+ * ("Create a new local database"), task 11-T07.
+ *
+ * ─── THE DESKTOP GATE ────────────────────────────────────────────────────────
+ *
+ * EXISTENCE is the gate, exactly as it is for `desktop-demo` and §5's
+ * `auth/desktop-session.ts`: `compose.ts` registers this factory only when
+ * `ADMINIUM_RUNTIME=desktop`, so self-host and Docker do not have the route at
+ * all. That is not a formality here — the route's whole subject is
+ * `<dataDir>/databases/`, a directory that exists because the shell created it
+ * and passed `ADMINIUM_DATA_DIR` (§2.2). On a Docker deployment `<dataDir>` is a
+ * container path nobody can reach with a file dialog, so a "create a local
+ * database" button there would create a file the user can neither find, back up,
+ * nor delete.
+ *
+ * No loopback check, for `desktop-demo`'s reason: this creates a database and
+ * registers a connection — the same act `POST /connections` performs, from the
+ * same principal, under the same `system:connections:manage` grant. The §5 route
+ * is loopback-only because it mints a session with no password; this one does
+ * not.
+ */
+import { maskDsn } from '../../connections/dsn.js';
+import { CONNECTIONS_MANAGE } from '../connections/index.js';
+import { parseSchemaFileContent } from '../schema-import/index.js';
+import { createLocalDatabaseHandler, localDsn } from './handlers.js';
+import { desktopLocalDbBody, desktopLocalDbReply } from './schema.js';
+export function desktopLocalDbRoutes(deps) {
+    return async (app) => {
+        app.post('/desktop/local-database', {
+            preHandler: app.rbac.require(CONNECTIONS_MANAGE),
+            schema: { body: desktopLocalDbBody, response: { 201: desktopLocalDbReply } },
+        }, async (request, reply) => {
+            const actorId = request.apiKeyPrincipal === null
+                ? (request.user?.id ?? null)
+                : null;
+            const body = request.body;
+            const result = await createLocalDatabaseHandler({
+                manager: deps.manager,
+                dataDir: deps.dataDir,
+                parseSchema: deps.parseSchema ?? parseSchemaFileContent,
+                ...(deps.now === undefined ? {} : { now: deps.now }),
+            }, {
+                name: body.name,
+                schemaFile: body.schemaFile === undefined
+                    ? undefined
+                    : {
+                        content: body.schemaFile.content,
+                        format: body.schemaFile.format,
+                        fileName: body.schemaFile.fileName,
+                    },
+                placeholderRows: body.placeholderRows,
+                actorId,
+            });
+            // `connection.create`, for `desktop-demo`'s reason: the audit reader asks
+            // "where did this connection come from?", and the answer belongs in the
+            // action every other connection writes. The creation details ride in
+            // `changes`.
+            //
+            // `placeholderRows` is recorded because it is the one part of this
+            // request that WRITES ROWS. An operator looking at a table of sample data
+            // six months from now needs the audit log to say the app put it there.
+            await app.rbac.audit(request, {
+                category: 'connection',
+                action: 'connection.create',
+                connectionId: result.connectionId,
+                changes: {
+                    after: {
+                        name: result.name,
+                        engine: 'sqlite',
+                        dsnMasked: maskDsn(localDsn(result.file)),
+                        source: 'desktop-local-database',
+                        tables: result.tables.length,
+                        placeholderRows: body.placeholderRows,
+                    },
+                },
+            });
+            reply.status(201);
+            return { data: result };
+        });
+    };
+}
+//# sourceMappingURL=index.js.map