@adminiumjs/adminium 0.1.0-rc.1

package/dist/routes/search/schema.d.ts

@@ -0,0 +1,125 @@
+/**
+ * Zod schemas for `GET /api/v1/search` (08-server-api.md §2.9, M4-T06).
+ *
+ * The reply is GROUPED: one `page` group (nav entries matched by title) and
+ * one `record` group PER searched table, in a deterministic order (connection
+ * create order, then the table's page nav order). `count` is the capped hit
+ * count — "5+" semantics, never a full COUNT(*) (§2.9: honest and fast).
+ * Empty record groups are omitted unless the table timed out, in which case
+ * the group ships `partial: true` with no hits rather than failing the
+ * request (§2.9 degradation rule).
+ */
+import { z } from 'zod';
+/** Per-group hit cap. The ⌘K palette calls with `limit=3` (§2.9). */
+export declare const SEARCH_LIMIT_DEFAULT = 5;
+export declare const SEARCH_LIMIT_MAX = 10;
+export declare const SEARCH_TYPES: readonly ["page", "record"];
+export type SearchType = (typeof SEARCH_TYPES)[number];
+export declare const searchQuery: z.ZodObject<{
+    q: z.ZodString;
+    types: z.ZodOptional<z.ZodString>;
+    connectionId: z.ZodOptional<z.ZodString>;
+    tables: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export declare const searchPageHit: z.ZodObject<{
+    pageId: z.ZodString;
+    slug: z.ZodString;
+    title: z.ZodString;
+    icon: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SearchPageHit = z.infer<typeof searchPageHit>;
+export declare const searchRecordHit: z.ZodObject<{
+    connectionId: z.ZodString;
+    table: z.ZodString;
+    recordId: z.ZodString;
+    label: z.ZodString;
+    context: z.ZodOptional<z.ZodString>;
+    pageSlug: z.ZodString;
+}, z.core.$strip>;
+export type SearchRecordHit = z.infer<typeof searchRecordHit>;
+export declare const searchPageGroup: z.ZodObject<{
+    type: z.ZodLiteral<"page">;
+    count: z.ZodNumber;
+    hits: z.ZodArray<z.ZodObject<{
+        pageId: z.ZodString;
+        slug: z.ZodString;
+        title: z.ZodString;
+        icon: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SearchPageGroup = z.infer<typeof searchPageGroup>;
+export declare const searchRecordGroup: z.ZodObject<{
+    type: z.ZodLiteral<"record">;
+    connectionId: z.ZodString;
+    table: z.ZodString;
+    pageSlug: z.ZodString;
+    count: z.ZodNumber;
+    partial: z.ZodOptional<z.ZodBoolean>;
+    hits: z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        table: z.ZodString;
+        recordId: z.ZodString;
+        label: z.ZodString;
+        context: z.ZodOptional<z.ZodString>;
+        pageSlug: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SearchRecordGroup = z.infer<typeof searchRecordGroup>;
+export declare const searchGroup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"page">;
+    count: z.ZodNumber;
+    hits: z.ZodArray<z.ZodObject<{
+        pageId: z.ZodString;
+        slug: z.ZodString;
+        title: z.ZodString;
+        icon: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"record">;
+    connectionId: z.ZodString;
+    table: z.ZodString;
+    pageSlug: z.ZodString;
+    count: z.ZodNumber;
+    partial: z.ZodOptional<z.ZodBoolean>;
+    hits: z.ZodArray<z.ZodObject<{
+        connectionId: z.ZodString;
+        table: z.ZodString;
+        recordId: z.ZodString;
+        label: z.ZodString;
+        context: z.ZodOptional<z.ZodString>;
+        pageSlug: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>], "type">;
+export type SearchGroup = z.infer<typeof searchGroup>;
+export declare const searchReply: z.ZodObject<{
+    data: z.ZodObject<{
+        groups: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            type: z.ZodLiteral<"page">;
+            count: z.ZodNumber;
+            hits: z.ZodArray<z.ZodObject<{
+                pageId: z.ZodString;
+                slug: z.ZodString;
+                title: z.ZodString;
+                icon: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>, z.ZodObject<{
+            type: z.ZodLiteral<"record">;
+            connectionId: z.ZodString;
+            table: z.ZodString;
+            pageSlug: z.ZodString;
+            count: z.ZodNumber;
+            partial: z.ZodOptional<z.ZodBoolean>;
+            hits: z.ZodArray<z.ZodObject<{
+                connectionId: z.ZodString;
+                table: z.ZodString;
+                recordId: z.ZodString;
+                label: z.ZodString;
+                context: z.ZodOptional<z.ZodString>;
+                pageSlug: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>], "type">>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SearchReply = z.infer<typeof searchReply>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/search/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/search/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,eAAO,MAAM,YAAY,6BAA8B,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,eAAO,MAAM,WAAW;;;;;;iBAUtB,CAAC;AAEH,eAAO,MAAM,aAAa;;;;;iBAKxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,eAAO,MAAM,eAAe;;;;;;;iBAgB1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,eAAe;;;;;;;;;iBAI1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;iBAS5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;2BAAqE,CAAC;AAC9F,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/routes/search/schema.js

@@ -0,0 +1,70 @@
+/**
+ * Zod schemas for `GET /api/v1/search` (08-server-api.md §2.9, M4-T06).
+ *
+ * The reply is GROUPED: one `page` group (nav entries matched by title) and
+ * one `record` group PER searched table, in a deterministic order (connection
+ * create order, then the table's page nav order). `count` is the capped hit
+ * count — "5+" semantics, never a full COUNT(*) (§2.9: honest and fast).
+ * Empty record groups are omitted unless the table timed out, in which case
+ * the group ships `partial: true` with no hits rather than failing the
+ * request (§2.9 degradation rule).
+ */
+import { z } from 'zod';
+/** Per-group hit cap. The ⌘K palette calls with `limit=3` (§2.9). */
+export const SEARCH_LIMIT_DEFAULT = 5;
+export const SEARCH_LIMIT_MAX = 10;
+export const SEARCH_TYPES = ['page', 'record'];
+export const searchQuery = z.object({
+    /** Needle; `ILIKE %q%` semantics, ≥ 2 chars after trimming (§2.9). */
+    q: z.string().min(2),
+    /** CSV subset of `page,record`; unknown entries are ignored. Default: all. */
+    types: z.string().optional(),
+    /** Restrict record search to one connection. */
+    connectionId: z.string().optional(),
+    /** CSV of qualified table ids (`public.customers`) to restrict record search. */
+    tables: z.string().optional(),
+    limit: z.coerce.number().int().min(1).max(SEARCH_LIMIT_MAX).optional(),
+});
+export const searchPageHit = z.object({
+    pageId: z.string(),
+    slug: z.string(),
+    title: z.string(),
+    icon: z.string().nullable(),
+});
+export const searchRecordHit = z.object({
+    connectionId: z.string(),
+    /** Qualified snapshot table id, e.g. `public.customers`. */
+    table: z.string(),
+    /** `:recordId` segment for `/p/:slug/r/:recordId` (crud/records.ts pkLabel). */
+    recordId: z.string(),
+    /** Display-column value (never a masked/secret column) or the PK label. */
+    label: z.string(),
+    /**
+     * §2.9 row context, e.g. `unit_price 18 · status active` — up to two
+     * leading readable columns beyond the label. Masked/secret columns are
+     * excluded (§5.3); omitted when the row has nothing else to show.
+     */
+    context: z.string().optional(),
+    /** Slug of the page that renders this table — the palette's nav target. */
+    pageSlug: z.string(),
+});
+export const searchPageGroup = z.object({
+    type: z.literal('page'),
+    count: z.number(),
+    hits: z.array(searchPageHit),
+});
+export const searchRecordGroup = z.object({
+    type: z.literal('record'),
+    connectionId: z.string(),
+    table: z.string(),
+    pageSlug: z.string(),
+    count: z.number(),
+    /** True when this table's search timed out — degraded, not failed (§2.9). */
+    partial: z.boolean().optional(),
+    hits: z.array(searchRecordHit),
+});
+export const searchGroup = z.discriminatedUnion('type', [searchPageGroup, searchRecordGroup]);
+export const searchReply = z.object({
+    data: z.object({ groups: z.array(searchGroup) }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/search/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/search/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,qEAAqE;AACrE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC;AAGxD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,sEAAsE;IACtE,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACpB,8EAA8E;IAC9E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,gDAAgD;IAChD,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CACvE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,4DAA4D;IAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,gFAAgF;IAChF,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB;;;;OAIG;IACH,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,2EAA2E;IAC3E,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CAC7B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,6EAA6E;IAC7E,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;CAC/B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAG9F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC;CACjD,CAAC,CAAC"}

package/dist/routes/settings/index.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Global-defaults settings routes (10-i18n-theming.md §7.2/§7.3, M8-T04):
+ *
+ *   GET /api/v1/settings/defaults — the four workspace default axes plus
+ *     per-axis adoption counts (`following` = users with a NULL override,
+ *     i.e. users who will see a change to that default immediately).
+ *   PUT /api/v1/settings/defaults — full-object write. Audit-logged
+ *     (category `settings`) and broadcast as `settings.defaults.updated` on
+ *     the `config-changed` realtime channel so signed-in users following
+ *     defaults re-resolve live without a reload.
+ *
+ * Both guarded by `system:settings:manage` (Super Admin built-in role).
+ * Factory plugin registered by composition, like the sibling resources —
+ * see apps/server/scripts/demo-v01.mjs.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import { type MetaDb } from '@adminium/meta';
+/** Realtime event type carried on the `config-changed` channel (§7.2). */
+export declare const SETTINGS_DEFAULTS_UPDATED = "settings.defaults.updated";
+export interface SettingsRoutesDeps {
+    meta: MetaDb;
+}
+export declare function settingsRoutes(deps: SettingsRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/settings/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/settings/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAe3D,0EAA0E;AAC1E,eAAO,MAAM,yBAAyB,8BAA8B,CAAC;AAErE,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,wBAAgB,cAAc,CAAC,IAAI,EAAE,kBAAkB,GAAG,qBAAqB,CAyM9E"}

package/dist/routes/settings/index.js

@@ -0,0 +1,164 @@
+import { settingsRepo } from '@adminium/meta';
+import { PERMISSIONS } from '../../rbac/permissions.js';
+import { settingsBrandingPutBody, settingsDefaultsPutBody, settingsDefaultsReply, settingsTelemetryPutBody, settingsTelemetryReply, settingsWorkspaceReply, } from './schema.js';
+/** Realtime event type carried on the `config-changed` channel (§7.2). */
+export const SETTINGS_DEFAULTS_UPDATED = 'settings.defaults.updated';
+const AXES = ['theme', 'accent', 'density', 'locale'];
+/** Settings-registry key per preference axis (07-meta-store.md §7.1). */
+const SETTING_KEY = {
+    theme: 'appearance.theme',
+    accent: 'appearance.accent',
+    density: 'appearance.density',
+    locale: 'locale.default',
+};
+export function settingsRoutes(deps) {
+    const { meta } = deps;
+    const settings = settingsRepo(meta);
+    async function readDefaults() {
+        const [theme, accent, density, locale] = await Promise.all([
+            settings.get('appearance.theme'),
+            settings.get('appearance.accent'),
+            settings.get('appearance.density'),
+            settings.get('locale.default'),
+        ]);
+        return { theme, accent, density, locale };
+    }
+    /** `following` = totalUsers − users holding a non-NULL override for the axis. */
+    async function readAdoption() {
+        const totalRow = await meta.db
+            .selectFrom('adminium_users')
+            .select((eb) => eb.fn.countAll().as('total'))
+            .executeTakeFirst();
+        const totalUsers = Number(totalRow?.total ?? 0);
+        const prefRows = await meta.db
+            .selectFrom('adminium_user_prefs')
+            .select(['theme', 'accent', 'density', 'locale'])
+            .execute();
+        const following = { theme: totalUsers, accent: totalUsers, density: totalUsers, locale: totalUsers };
+        for (const row of prefRows) {
+            for (const axis of AXES) {
+                if (row[axis] !== null)
+                    following[axis] -= 1;
+            }
+        }
+        return { totalUsers, following };
+    }
+    async function reply() {
+        const [defaults, adoption] = await Promise.all([readDefaults(), readAdoption()]);
+        return { data: { ...defaults, adoption } };
+    }
+    /** Registry-backed workspace identity view (M5-T05). */
+    async function workspaceReply() {
+        const appName = await settings.get('branding.appName');
+        return { data: { branding: { appName } } };
+    }
+    /** The two outbound-call consents (M10-T04). */
+    async function telemetryReply() {
+        const [telemetry, updateCheck] = await Promise.all([
+            settings.get('telemetry.enabled'),
+            settings.get('updates.checkEnabled'),
+        ]);
+        return { data: { telemetry, updateCheck } };
+    }
+    return async (app) => {
+        app.get('/settings/defaults', {
+            preHandler: app.rbac.require(PERMISSIONS.settingsManage),
+            schema: { response: { 200: settingsDefaultsReply } },
+        }, async () => reply());
+        app.put('/settings/defaults', {
+            preHandler: app.rbac.require(PERMISSIONS.settingsManage),
+            schema: { body: settingsDefaultsPutBody, response: { 200: settingsDefaultsReply } },
+        }, async (request) => {
+            const before = await readDefaults();
+            const next = request.body;
+            const at = app.rbac.now();
+            const actingUserId = request.apiKeyPrincipal === null
+                ? (request.user?.id ?? null)
+                : null;
+            for (const axis of AXES) {
+                if (before[axis] === next[axis])
+                    continue;
+                await settings.set(SETTING_KEY[axis], next[axis], { updatedBy: actingUserId, at });
+            }
+            await app.rbac.audit(request, {
+                category: 'settings',
+                action: 'settings.defaults.update',
+                changes: { before: { ...before }, after: { ...next } },
+            });
+            // Live propagation (§7.2/§7.3): every signed-in session follows
+            // `config-changed`; clients following a default re-resolve via
+            // bootstrap invalidation on this event type.
+            if (app.hasDecorator('realtime')) {
+                app.realtime.publish('config-changed', SETTINGS_DEFAULTS_UPDATED, { ...next }, at);
+            }
+            return reply();
+        });
+        // --- workspace identity (M5-T05, sectioned puts per 08 §2.16) -------------
+        // Same conventions as /settings/defaults: Zod body, super-admin guard,
+        // audit with before/after images. No realtime broadcast — nothing in the
+        // bootstrap payload derives from this key yet. The `auth.*` security
+        // controls are deliberately not exposed until an auth flow enforces them
+        // (see schema.ts) — persisting inert security toggles is worse than absent.
+        app.get('/settings/workspace', {
+            preHandler: app.rbac.require(PERMISSIONS.settingsManage),
+            schema: { response: { 200: settingsWorkspaceReply } },
+        }, async () => workspaceReply());
+        app.put('/settings/branding', {
+            preHandler: app.rbac.require(PERMISSIONS.settingsManage),
+            schema: { body: settingsBrandingPutBody, response: { 200: settingsWorkspaceReply } },
+        }, async (request) => {
+            const before = (await workspaceReply()).data.branding;
+            const at = app.rbac.now();
+            const actingUserId = request.apiKeyPrincipal === null
+                ? (request.user?.id ?? null)
+                : null;
+            if (before.appName !== request.body.appName) {
+                await settings.set('branding.appName', request.body.appName, {
+                    updatedBy: actingUserId,
+                    at,
+                });
+            }
+            await app.rbac.audit(request, {
+                category: 'settings',
+                action: 'settings.branding.update',
+                changes: { before: { ...before }, after: { ...request.body } },
+            });
+            return workspaceReply();
+        });
+        // --- telemetry + update check (M10-T04) ----------------------------------
+        // Where the first-run consent answers are revisited. Audited like every
+        // other settings write: flipping telemetry on is a decision someone should
+        // be able to trace later.
+        app.get('/settings/telemetry', {
+            preHandler: app.rbac.require(PERMISSIONS.settingsManage),
+            schema: { response: { 200: settingsTelemetryReply } },
+        }, async () => telemetryReply());
+        app.put('/settings/telemetry', {
+            preHandler: app.rbac.require(PERMISSIONS.settingsManage),
+            schema: { body: settingsTelemetryPutBody, response: { 200: settingsTelemetryReply } },
+        }, async (request) => {
+            const before = (await telemetryReply()).data;
+            const next = request.body;
+            const at = app.rbac.now();
+            const actingUserId = request.apiKeyPrincipal === null
+                ? (request.user?.id ?? null)
+                : null;
+            if (before.telemetry !== next.telemetry) {
+                await settings.set('telemetry.enabled', next.telemetry, { updatedBy: actingUserId, at });
+            }
+            if (before.updateCheck !== next.updateCheck) {
+                await settings.set('updates.checkEnabled', next.updateCheck, {
+                    updatedBy: actingUserId,
+                    at,
+                });
+            }
+            await app.rbac.audit(request, {
+                category: 'settings',
+                action: 'settings.telemetry.update',
+                changes: { before: { ...before }, after: { ...next } },
+            });
+            return telemetryReply();
+        });
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/routes/settings/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/routes/settings/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,YAAY,EAAe,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACxD,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,sBAAsB,GAIvB,MAAM,aAAa,CAAC;AAErB,0EAA0E;AAC1E,MAAM,CAAC,MAAM,yBAAyB,GAAG,2BAA2B,CAAC;AAMrE,MAAM,IAAI,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;AAG/D,yEAAyE;AACzE,MAAM,WAAW,GAAqG;IACpH,KAAK,EAAE,kBAAkB;IACzB,MAAM,EAAE,mBAAmB;IAC3B,OAAO,EAAE,oBAAoB;IAC7B,MAAM,EAAE,gBAAgB;CACzB,CAAC;AAEF,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,KAAK,UAAU,YAAY;QAMzB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACzD,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC;YAChC,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACjC,QAAQ,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAClC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC;SAC/B,CAAC,CAAC;QACH,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAC5C,CAAC;IAED,iFAAiF;IACjF,KAAK,UAAU,YAAY;QACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,UAAU,CAAC,gBAAgB,CAAC;aAC5B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;aAC5C,gBAAgB,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,EAAE;aAC3B,UAAU,CAAC,qBAAqB,CAAC;aACjC,MAAM,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;aAChD,OAAO,EAAE,CAAC;QAEb,MAAM,SAAS,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QACrG,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI;oBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,wDAAwD;IACxD,KAAK,UAAU,cAAc;QAC3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACvD,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IAED,gDAAgD;IAChD,KAAK,UAAU,cAAc;QAC3B,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACjD,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACjC,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC;SACrC,CAAC,CAAC;QACH,OAAO,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,CAAC;IAC9C,CAAC;IAED,OAAO,KAAK,EAAE,GAAG,EAAE,EAAE;QACnB,GAAG,CAAC,GAAG,CACL,oBAAoB,EACpB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;YACxD,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE;SACrD,EACD,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CACpB,CAAC;QAEF,GAAG,CAAC,GAAG,CACL,oBAAoB,EACpB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,qBAAqB,EAAE,EAAE;SACpF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;YACpC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,YAAY,GAChB,OAAO,CAAC,eAAe,KAAK,IAAI;gBAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC;YAEX,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;gBACxB,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC1C,MAAM,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE;aACvD,CAAC,CAAC;YAEH,gEAAgE;YAChE,+DAA+D;YAC/D,6CAA6C;YAC7C,IAAI,GAAG,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,gBAAgB,EAAE,yBAAyB,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YAED,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC,CACF,CAAC;QAEF,6EAA6E;QAC7E,uEAAuE;QACvE,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,4EAA4E;QAE5E,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;YACxD,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE;SACtD,EACD,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,CAC7B,CAAC;QAEF,GAAG,CAAC,GAAG,CACL,oBAAoB,EACpB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE;SACrF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;YACtD,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,YAAY,GAChB,OAAO,CAAC,eAAe,KAAK,IAAI;gBAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC5C,MAAM,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE;oBAC3D,SAAS,EAAE,YAAY;oBACvB,EAAE;iBACH,CAAC,CAAC;YACL,CAAC;YACD,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,0BAA0B;gBAClC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,EAAE;aAC/D,CAAC,CAAC;YACH,OAAO,cAAc,EAAE,CAAC;QAC1B,CAAC,CACF,CAAC;QAEF,4EAA4E;QAC5E,wEAAwE;QACxE,2EAA2E;QAC3E,0BAA0B;QAE1B,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;YACxD,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE;SACtD,EACD,KAAK,IAAI,EAAE,CAAC,cAAc,EAAE,CAC7B,CAAC;QAEF,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB;YACE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc,CAAC;YACxD,MAAM,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,sBAAsB,EAAE,EAAE;SACtF,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC;YAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC1B,MAAM,YAAY,GAChB,OAAO,CAAC,eAAe,KAAK,IAAI;gBAC9B,CAAC,CAAC,CAAE,OAAiD,CAAC,IAAI,EAAE,EAAE,IAAI,IAAI,CAAC;gBACvE,CAAC,CAAC,IAAI,CAAC;YAEX,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;gBACxC,MAAM,QAAQ,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC5C,MAAM,QAAQ,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,WAAW,EAAE;oBAC3D,SAAS,EAAE,YAAY;oBACvB,EAAE;iBACH,CAAC,CAAC;YACL,CAAC;YAED,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;gBAC5B,QAAQ,EAAE,UAAU;gBACpB,MAAM,EAAE,2BAA2B;gBACnC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,EAAE;aACvD,CAAC,CAAC;YAEH,OAAO,cAAc,EAAE,CAAC;QAC1B,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/routes/settings/schema.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Zod schemas for the global-defaults settings resource
+ * (10-i18n-theming.md §7.2, 08-server-api.md): the four preference axes with
+ * the same enums the meta json-payloads use, plus per-axis adoption counts
+ * (`following` = users whose override is NULL for that axis).
+ */
+import { z } from 'zod';
+/** PUT body — a full-object write (§7.2), never a partial patch. */
+export declare const settingsDefaultsPutBody: z.ZodObject<{
+    theme: z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+        system: "system";
+    }>;
+    accent: z.ZodEnum<{
+        indigo: "indigo";
+        blue: "blue";
+        teal: "teal";
+        violet: "violet";
+        rose: "rose";
+        red: "red";
+        orange: "orange";
+        black: "black";
+    }>;
+    density: z.ZodEnum<{
+        comfortable: "comfortable";
+        compact: "compact";
+    }>;
+    locale: z.ZodEnum<{
+        en_US: "en_US";
+        de_DE: "de_DE";
+        ar_EG: "ar_EG";
+        zh_CN: "zh_CN";
+        zh_TW: "zh_TW";
+        cs_CZ: "cs_CZ";
+        da_DK: "da_DK";
+        fr_FR: "fr_FR";
+    }>;
+}, z.core.$strip>;
+export type SettingsDefaultsPutBody = z.infer<typeof settingsDefaultsPutBody>;
+export declare const settingsDefaultsReply: z.ZodObject<{
+    data: z.ZodObject<{
+        theme: z.ZodEnum<{
+            light: "light";
+            dark: "dark";
+            system: "system";
+        }>;
+        accent: z.ZodEnum<{
+            indigo: "indigo";
+            blue: "blue";
+            teal: "teal";
+            violet: "violet";
+            rose: "rose";
+            red: "red";
+            orange: "orange";
+            black: "black";
+        }>;
+        density: z.ZodEnum<{
+            comfortable: "comfortable";
+            compact: "compact";
+        }>;
+        locale: z.ZodEnum<{
+            en_US: "en_US";
+            de_DE: "de_DE";
+            ar_EG: "ar_EG";
+            zh_CN: "zh_CN";
+            zh_TW: "zh_TW";
+            cs_CZ: "cs_CZ";
+            da_DK: "da_DK";
+            fr_FR: "fr_FR";
+        }>;
+        adoption: z.ZodObject<{
+            totalUsers: z.ZodNumber;
+            following: z.ZodObject<{
+                theme: z.ZodNumber;
+                accent: z.ZodNumber;
+                density: z.ZodNumber;
+                locale: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SettingsDefaultsReply = z.infer<typeof settingsDefaultsReply>;
+/** `PUT /settings/branding` — workspace identity (registry `branding.*`). */
+export declare const settingsBrandingPutBody: z.ZodObject<{
+    appName: z.ZodString;
+}, z.core.$strip>;
+export type SettingsBrandingPutBody = z.infer<typeof settingsBrandingPutBody>;
+export declare const settingsWorkspaceReply: z.ZodObject<{
+    data: z.ZodObject<{
+        branding: z.ZodObject<{
+            appName: z.ZodString;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SettingsWorkspaceReply = z.infer<typeof settingsWorkspaceReply>;
+/** `PUT /settings/telemetry` — the two outbound-call consents (full write). */
+export declare const settingsTelemetryPutBody: z.ZodObject<{
+    telemetry: z.ZodBoolean;
+    updateCheck: z.ZodBoolean;
+}, z.core.$strip>;
+export type SettingsTelemetryPutBody = z.infer<typeof settingsTelemetryPutBody>;
+export declare const settingsTelemetryReply: z.ZodObject<{
+    data: z.ZodObject<{
+        telemetry: z.ZodBoolean;
+        updateCheck: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SettingsTelemetryReply = z.infer<typeof settingsTelemetryReply>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/routes/settings/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/routes/settings/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAKlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAY9E,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAQhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAa1E,6EAA6E;AAC7E,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,eAAO,MAAM,sBAAsB;;;;;;iBAIjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAU5E,+EAA+E;AAC/E,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEhF,eAAO,MAAM,sBAAsB;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/routes/settings/schema.js

@@ -0,0 +1,71 @@
+/**
+ * Zod schemas for the global-defaults settings resource
+ * (10-i18n-theming.md §7.2, 08-server-api.md): the four preference axes with
+ * the same enums the meta json-payloads use, plus per-axis adoption counts
+ * (`following` = users whose override is NULL for that axis).
+ */
+import { z } from 'zod';
+import { accentSchema, densitySchema, localeSchema, themeSchema } from '@adminium/meta';
+/** PUT body — a full-object write (§7.2), never a partial patch. */
+export const settingsDefaultsPutBody = z.object({
+    theme: themeSchema,
+    accent: accentSchema,
+    density: densitySchema,
+    locale: localeSchema,
+});
+const adoptionView = z.object({
+    totalUsers: z.number().int().min(0),
+    following: z.object({
+        theme: z.number().int().min(0),
+        accent: z.number().int().min(0),
+        density: z.number().int().min(0),
+        locale: z.number().int().min(0),
+    }),
+});
+export const settingsDefaultsReply = z.object({
+    data: z.object({
+        theme: themeSchema,
+        accent: accentSchema,
+        density: densitySchema,
+        locale: localeSchema,
+        adoption: adoptionView,
+    }),
+});
+// --- workspace identity (M5-T05, 08 §2.16 sectioned puts) -----------------------
+// Bounds mirror the settings-registry Zod defs (07-meta-store.md §7.1) — the
+// repo re-validates on write, so these fail fast with a 422 instead of a 500.
+//
+// The `auth.*` security controls (require2fa / allowSignup / sessionTtlHours /
+// passwordMinLength) are intentionally NOT exposed here: no auth flow reads
+// them yet, so a PUT surface would persist inert config and present dead
+// security toggles in the UI. They return when enforcement lands (the login /
+// session / password paths), so admins are never shown a control that does
+// nothing.
+/** `PUT /settings/branding` — workspace identity (registry `branding.*`). */
+export const settingsBrandingPutBody = z.object({
+    appName: z.string().min(1).max(60),
+});
+export const settingsWorkspaceReply = z.object({
+    data: z.object({
+        branding: settingsBrandingPutBody,
+    }),
+});
+// --- telemetry + update check (M10-T04, 08 §2.16 `settingsTelemetryPutBody`) ----
+// Both are OFF by default in the registry and are first asked on the first-run
+// consent screen; this section is how they are revisited later. Unlike the
+// `auth.*` controls above, these two ARE exposed because both are enforced
+// today: `telemetry.enabled` gates ../../telemetry/service.ts and
+// `updates.checkEnabled` gates ../../telemetry/update-check.ts, each of which
+// returns before touching the network when its key is false.
+/** `PUT /settings/telemetry` — the two outbound-call consents (full write). */
+export const settingsTelemetryPutBody = z.object({
+    telemetry: z.boolean(),
+    updateCheck: z.boolean(),
+});
+export const settingsTelemetryReply = z.object({
+    data: z.object({
+        telemetry: z.boolean(),
+        updateCheck: z.boolean(),
+    }),
+});
+//# sourceMappingURL=schema.js.map

package/dist/routes/settings/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/routes/settings/schema.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAExF,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,WAAW;IAClB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,YAAY;CACrB,CAAC,CAAC;AAGH,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAChC,CAAC;CACH,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,YAAY;QACpB,OAAO,EAAE,aAAa;QACtB,MAAM,EAAE,YAAY;QACpB,QAAQ,EAAE,YAAY;KACvB,CAAC;CACH,CAAC,CAAC;AAGH,mFAAmF;AACnF,6EAA6E;AAC7E,8EAA8E;AAC9E,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,2EAA2E;AAC3E,WAAW;AAEX,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,QAAQ,EAAE,uBAAuB;KAClC,CAAC;CACH,CAAC,CAAC;AAGH,mFAAmF;AACnF,+EAA+E;AAC/E,2EAA2E;AAC3E,2EAA2E;AAC3E,kEAAkE;AAClE,8EAA8E;AAC9E,6DAA6D;AAE7D,+EAA+E;AAC/E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;CACzB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;KACzB,CAAC;CACH,CAAC,CAAC"}

package/dist/routes/setup/index.d.ts

@@ -0,0 +1,29 @@
+/**
+ * First-run setup resource (M10-T04): `GET /api/v1/setup/state` and
+ * `POST /api/v1/setup/super-admin`. The dashboard's first-run wizard is one
+ * front door onto `createSetupService`; the `adminium init` CLI wizard is the
+ * other. All logic lives in the service — this module only translates HTTP.
+ *
+ * SECURITY. These are the only unauthenticated routes that can create a user,
+ * so the once-only property is what matters:
+ *
+ *  - `POST /setup/super-admin` succeeds at most once per instance, EVER. The
+ *    guarantee is the `system.superAdminCreatedAt` PRIMARY KEY claim taken
+ *    inside `createFirstSuperAdmin`'s transaction (@adminium/meta), so a
+ *    concurrent double-submit resolves to exactly one 201 + one 409 rather
+ *    than two super admins. Once claimed the route answers 409 forever —
+ *    including after every user is later deleted, which must not re-open an
+ *    unauthenticated super-admin factory.
+ *  - `rateLimitBucket` marks it for the §6 limiter alongside `auth/login`: it
+ *    is credential-facing and unauthenticated.
+ *  - Failures are never enumerable: an already-set-up instance returns the
+ *    same 409 regardless of the email or password submitted.
+ */
+import type { FastifyPluginAsyncZod } from 'fastify-type-provider-zod';
+import { type SetupService } from '../../setup/service.js';
+export interface SetupRoutesDeps {
+    /** Built over the same meta store the rest of the app uses. */
+    service: SetupService;
+}
+export declare function setupRoutes(deps: SetupRoutesDeps): FastifyPluginAsyncZod;
+//# sourceMappingURL=index.d.ts.map

package/dist/routes/setup/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/routes/setup/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAKvE,OAAO,EAAuC,KAAK,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAWhG,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,OAAO,EAAE,YAAY,CAAC;CACvB;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,qBAAqB,CA4ExE"}