@adminiumjs/adminium 0.1.0-rc.1

package/dist/start.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Process entrypoint: loadEnv → buildServer → listen, with graceful shutdown
+ * on SIGTERM/SIGINT (01-architecture.md §8.1 — the fuller boot sequence gains
+ * meta connect/migrations/backup gates in wave 2).
+ */
+import { type AdminiumServer } from './app.js';
+export interface StartOptions {
+    /** Injectable for tests; defaults to the real `process`. */
+    proc?: Pick<NodeJS.Process, 'once' | 'exit'> | undefined;
+}
+export declare function start(opts?: StartOptions): Promise<AdminiumServer>;
+//# sourceMappingURL=start.d.ts.map

package/dist/start.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AAG5D,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC;CAC1D;AAED,wBAAsB,KAAK,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAuB5E"}

package/dist/start.js

@@ -0,0 +1,28 @@
+/**
+ * Process entrypoint: loadEnv → buildServer → listen, with graceful shutdown
+ * on SIGTERM/SIGINT (01-architecture.md §8.1 — the fuller boot sequence gains
+ * meta connect/migrations/backup gates in wave 2).
+ */
+import { buildServer } from './app.js';
+import { loadEnv } from './config/env.js';
+export async function start(opts = {}) {
+    const proc = opts.proc ?? process;
+    const env = loadEnv();
+    const app = await buildServer({ env });
+    let closing = false;
+    const shutdown = (signal) => {
+        if (closing)
+            return;
+        closing = true;
+        app.log.info({ signal }, 'shutting down');
+        app.close().then(() => proc.exit(0), (error) => {
+            app.log.error({ err: error }, 'error during shutdown');
+            proc.exit(1);
+        });
+    };
+    proc.once('SIGTERM', () => shutdown('SIGTERM'));
+    proc.once('SIGINT', () => shutdown('SIGINT'));
+    await app.listen({ port: env.PORT, host: env.HOST });
+    return app;
+}
+//# sourceMappingURL=start.js.map

package/dist/start.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start.js","sourceRoot":"","sources":["../src/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,WAAW,EAAuB,MAAM,UAAU,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAO1C,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAqB,EAAE;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IAEvC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAChD,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;QAC1C,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,CACd,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAClB,CAAC,KAAc,EAAE,EAAE;YACjB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC,CACF,CAAC;IACJ,CAAC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/telemetry/payload.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The telemetry payload (M10-T04) — the EXACT and complete document a
+ * consenting instance ever sends. Documented here because "what is sent" is a
+ * promise, not an implementation detail: the first-run consent screen renders
+ * this same list (dashboard `TelemetryConsent`), and `telemetry-payload.test.ts`
+ * pins the key set so the shape cannot drift without a failing test.
+ *
+ * ────────────────────────────────────────────────────────────────────────────
+ * WHAT IS SENT (all of it):
+ *   schemaVersion  1                          — envelope version
+ *   instanceId     random UUIDv4              — seeded at bootstrap
+ *                                               (`system.instanceId`); not
+ *                                               derived from any host, user,
+ *                                               network or database identity,
+ *                                               so it cannot be reversed into
+ *                                               one. Reset it and the instance
+ *                                               is a new anonymous instance.
+ *   version        e.g. "0.5.0"               — the running Adminium build
+ *   metaEngine     postgres|mysql|sqlite      — meta-store ENGINE TYPE only
+ *   sourceEngines  ["postgres","sqlite"]      — distinct connected ENGINE
+ *                                               TYPES, deduped + sorted. A
+ *                                               closed vocabulary; never a
+ *                                               count, name, host or DSN.
+ *   sentAt         epoch ms
+ *
+ * WHAT IS NEVER SENT — no schema content (no table/column/enum names), no row
+ * data, no connection strings/hosts/credentials, no user identities (emails,
+ * names, ids), no page/widget configs, no LLM run contents or prompts. The BYO
+ * promise in 06-llm-assist.md §9 — that BYO runs are never reported — holds
+ * because nothing about any LLM run has a field to travel in: the payload is
+ * built from a fixed allow-list below, never by spreading a wider object.
+ * ────────────────────────────────────────────────────────────────────────────
+ */
+/** Meta/source engine identifiers (07-meta-store.md); a closed vocabulary. */
+export declare const TELEMETRY_ENGINES: readonly ["postgres", "mysql", "sqlite"];
+export type TelemetryEngine = (typeof TELEMETRY_ENGINES)[number];
+export interface TelemetryPayload {
+    schemaVersion: 1;
+    instanceId: string;
+    version: string;
+    metaEngine: TelemetryEngine;
+    sourceEngines: TelemetryEngine[];
+    sentAt: number;
+}
+/**
+ * The complete key set of {@link TelemetryPayload}. The builder emits exactly
+ * these and the test asserts equality both ways, so adding a field to the
+ * interface without deciding it is safe to disclose fails CI.
+ */
+export declare const TELEMETRY_PAYLOAD_KEYS: readonly string[];
+export interface TelemetryPayloadInput {
+    instanceId: string;
+    version: string;
+    metaEngine: TelemetryEngine;
+    /** Raw engine strings off `adminium_connections.engine`; filtered below. */
+    sourceEngines: readonly string[];
+    sentAt: number;
+}
+/**
+ * Builds the payload by NAMING every field (never by spreading input), so an
+ * unrelated object growing a sensitive field can never widen what is sent.
+ * Unknown engine strings are dropped rather than passed through — the wire
+ * vocabulary stays closed even if a future adapter registers a new id.
+ */
+export declare function buildTelemetryPayload(input: TelemetryPayloadInput): TelemetryPayload;
+//# sourceMappingURL=payload.d.ts.map

package/dist/telemetry/payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.d.ts","sourceRoot":"","sources":["../../src/telemetry/payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,0CAA2C,CAAC;AAC1E,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,MAAM,WAAW,gBAAgB;IAC/B,aAAa,EAAE,CAAC,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,eAAe,CAAC;IAC5B,aAAa,EAAE,eAAe,EAAE,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,SAAS,MAAM,EAOnD,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,eAAe,CAAC;IAC5B,4EAA4E;IAC5E,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CAChB;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,qBAAqB,GAAG,gBAAgB,CAUpF"}

package/dist/telemetry/payload.js

@@ -0,0 +1,69 @@
+/**
+ * The telemetry payload (M10-T04) — the EXACT and complete document a
+ * consenting instance ever sends. Documented here because "what is sent" is a
+ * promise, not an implementation detail: the first-run consent screen renders
+ * this same list (dashboard `TelemetryConsent`), and `telemetry-payload.test.ts`
+ * pins the key set so the shape cannot drift without a failing test.
+ *
+ * ────────────────────────────────────────────────────────────────────────────
+ * WHAT IS SENT (all of it):
+ *   schemaVersion  1                          — envelope version
+ *   instanceId     random UUIDv4              — seeded at bootstrap
+ *                                               (`system.instanceId`); not
+ *                                               derived from any host, user,
+ *                                               network or database identity,
+ *                                               so it cannot be reversed into
+ *                                               one. Reset it and the instance
+ *                                               is a new anonymous instance.
+ *   version        e.g. "0.5.0"               — the running Adminium build
+ *   metaEngine     postgres|mysql|sqlite      — meta-store ENGINE TYPE only
+ *   sourceEngines  ["postgres","sqlite"]      — distinct connected ENGINE
+ *                                               TYPES, deduped + sorted. A
+ *                                               closed vocabulary; never a
+ *                                               count, name, host or DSN.
+ *   sentAt         epoch ms
+ *
+ * WHAT IS NEVER SENT — no schema content (no table/column/enum names), no row
+ * data, no connection strings/hosts/credentials, no user identities (emails,
+ * names, ids), no page/widget configs, no LLM run contents or prompts. The BYO
+ * promise in 06-llm-assist.md §9 — that BYO runs are never reported — holds
+ * because nothing about any LLM run has a field to travel in: the payload is
+ * built from a fixed allow-list below, never by spreading a wider object.
+ * ────────────────────────────────────────────────────────────────────────────
+ */
+/** Meta/source engine identifiers (07-meta-store.md); a closed vocabulary. */
+export const TELEMETRY_ENGINES = ['postgres', 'mysql', 'sqlite'];
+/**
+ * The complete key set of {@link TelemetryPayload}. The builder emits exactly
+ * these and the test asserts equality both ways, so adding a field to the
+ * interface without deciding it is safe to disclose fails CI.
+ */
+export const TELEMETRY_PAYLOAD_KEYS = [
+    'schemaVersion',
+    'instanceId',
+    'version',
+    'metaEngine',
+    'sourceEngines',
+    'sentAt',
+];
+function isTelemetryEngine(value) {
+    return TELEMETRY_ENGINES.includes(value);
+}
+/**
+ * Builds the payload by NAMING every field (never by spreading input), so an
+ * unrelated object growing a sensitive field can never widen what is sent.
+ * Unknown engine strings are dropped rather than passed through — the wire
+ * vocabulary stays closed even if a future adapter registers a new id.
+ */
+export function buildTelemetryPayload(input) {
+    const sourceEngines = [...new Set(input.sourceEngines.filter(isTelemetryEngine))].sort();
+    return {
+        schemaVersion: 1,
+        instanceId: input.instanceId,
+        version: input.version,
+        metaEngine: input.metaEngine,
+        sourceEngines,
+        sentAt: input.sentAt,
+    };
+}
+//# sourceMappingURL=payload.js.map

package/dist/telemetry/payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload.js","sourceRoot":"","sources":["../../src/telemetry/payload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAY1E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAsB;IACvD,eAAe;IACf,YAAY;IACZ,SAAS;IACT,YAAY;IACZ,eAAe;IACf,QAAQ;CACT,CAAC;AAWF,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAQ,iBAAuC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAA4B;IAChE,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzF,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,aAAa;QACb,MAAM,EAAE,KAAK,CAAC,MAAM;KACrB,CAAC;AACJ,CAAC"}

package/dist/telemetry/service.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Telemetry client (M10-T04). OPT-IN: `telemetry.enabled` defaults to `false`
+ * in the settings registry, so a fresh install reports nothing until someone
+ * answers "yes" on the first-run consent screen (v0.5 exit criterion:
+ * "Telemetry is opt-in (off by default)"). `ADMINIUM_TELEMETRY`, when set,
+ * overrides that answer in both directions — see {@link TelemetryServiceDeps.envOverride}.
+ *
+ * It is CONSTRUCTED in `../compose.ts`, the composition root, and reported on
+ * the croner scheduler that every other periodic job uses. (For a while it was
+ * constructed nowhere but tests: the consent screen wrote a setting no code
+ * read, so "Share anonymous usage data → yes" promised a behavior the build did
+ * not implement. That failed safe, but a consent screen that does nothing is
+ * still a lie.)
+ *
+ * The load-bearing property, asserted by `telemetry-network-isolation.test.ts`
+ * with all outbound network disabled: when telemetry is off, `report()` makes
+ * ZERO network calls. That is why the enabled check comes first and returns
+ * before the payload is even built — there is no code path from a disabled
+ * instance to `fetch`. See ./payload.ts for exactly what a consenting instance
+ * sends (and what it never sends).
+ */
+import { type MetaDb } from '@adminium/meta';
+import { type TelemetryPayload } from './payload.js';
+/** Where consenting instances report. Overridable for tests/self-host mirrors. */
+export declare const TELEMETRY_ENDPOINT = "https://telemetry.adminium.dev/v1/ping";
+export type TelemetryReport = {
+    sent: false;
+    reason: 'disabled' | 'no-instance-id' | 'failed';
+} | {
+    sent: true;
+    payload: TelemetryPayload;
+};
+export interface TelemetryServiceDeps {
+    meta: MetaDb;
+    /** The running build (apps/server package.json). */
+    version: string;
+    endpoint?: string | undefined;
+    /**
+     * `ADMINIUM_TELEMETRY`, tri-state. Set ⇒ the ENVIRONMENT WINS OUTRIGHT over
+     * the stored consent, in both directions (01 §7.2 "environment always wins");
+     * `undefined` (unset) ⇒ the `telemetry.enabled` setting decides, which is the
+     * normal self-host case.
+     *
+     * The variable was documented as the kill-switch and read by nothing: an org
+     * that set `ADMINIUM_TELEMETRY=off` to enforce a no-phone-home policy had no
+     * protection at all once any user answered "yes" on the first-run consent
+     * screen. Since the operator who controls the process environment outranks the
+     * person clicking through the wizard, `off` is now a real veto.
+     */
+    envOverride?: boolean | undefined;
+    /** Injected so tests can observe calls; defaults to the global fetch. */
+    fetchImpl?: typeof globalThis.fetch | undefined;
+    now?: (() => number) | undefined;
+}
+export interface TelemetryService {
+    /** The single gate: `ADMINIUM_TELEMETRY` if set, else `telemetry.enabled`. No network. */
+    isEnabled(): Promise<boolean>;
+    /**
+     * The exact document `report()` would send, for the About/consent screens to
+     * show ("here is what leaves this instance"). `null` when disabled.
+     */
+    preview(): Promise<TelemetryPayload | null>;
+    /** No-op returning `{ sent: false, reason: 'disabled' }` when opted out. */
+    report(): Promise<TelemetryReport>;
+}
+export declare function createTelemetryService(deps: TelemetryServiceDeps): TelemetryService;
+//# sourceMappingURL=service.d.ts.map

package/dist/telemetry/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/telemetry/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAA+C,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElG,kFAAkF;AAClF,eAAO,MAAM,kBAAkB,2CAA2C,CAAC;AAE3E,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,QAAQ,CAAA;CAAE,GACjE;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE9C,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAClC,yEAAyE;IACzE,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC;IAChD,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,0FAA0F;IAC1F,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAC5C,4EAA4E;IAC5E,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;CACpC;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,gBAAgB,CA6EnF"}

package/dist/telemetry/service.js

@@ -0,0 +1,103 @@
+/**
+ * Telemetry client (M10-T04). OPT-IN: `telemetry.enabled` defaults to `false`
+ * in the settings registry, so a fresh install reports nothing until someone
+ * answers "yes" on the first-run consent screen (v0.5 exit criterion:
+ * "Telemetry is opt-in (off by default)"). `ADMINIUM_TELEMETRY`, when set,
+ * overrides that answer in both directions — see {@link TelemetryServiceDeps.envOverride}.
+ *
+ * It is CONSTRUCTED in `../compose.ts`, the composition root, and reported on
+ * the croner scheduler that every other periodic job uses. (For a while it was
+ * constructed nowhere but tests: the consent screen wrote a setting no code
+ * read, so "Share anonymous usage data → yes" promised a behavior the build did
+ * not implement. That failed safe, but a consent screen that does nothing is
+ * still a lie.)
+ *
+ * The load-bearing property, asserted by `telemetry-network-isolation.test.ts`
+ * with all outbound network disabled: when telemetry is off, `report()` makes
+ * ZERO network calls. That is why the enabled check comes first and returns
+ * before the payload is even built — there is no code path from a disabled
+ * instance to `fetch`. See ./payload.ts for exactly what a consenting instance
+ * sends (and what it never sends).
+ */
+import { settingsRepo } from '@adminium/meta';
+import { buildTelemetryPayload } from './payload.js';
+/** Where consenting instances report. Overridable for tests/self-host mirrors. */
+export const TELEMETRY_ENDPOINT = 'https://telemetry.adminium.dev/v1/ping';
+export function createTelemetryService(deps) {
+    const { meta, version } = deps;
+    const endpoint = deps.endpoint ?? TELEMETRY_ENDPOINT;
+    const now = deps.now ?? (() => Date.now());
+    const settings = settingsRepo(meta);
+    async function isEnabled() {
+        // The env veto is checked FIRST and short-circuits the settings read, so an
+        // `ADMINIUM_TELEMETRY=off` instance does not even touch the meta store to
+        // decide — and, more importantly, cannot reach `fetch` by any path.
+        if (deps.envOverride !== undefined)
+            return deps.envOverride;
+        return settings.get('telemetry.enabled');
+    }
+    async function build() {
+        // `settings.get` can THROW rather than return, so this is not a redundant
+        // null-check wrapper: on a Postgres meta store, reading any string-valued
+        // setting currently raises a SyntaxError (`repos/util.ts` readJson
+        // JSON.parses a jsonb value pg has already decoded — a pre-existing
+        // cross-engine bug, not this module's). `system.instanceId` is
+        // string-valued, so an opted-in Postgres instance would hit it. Telemetry
+        // is never load-bearing: it degrades to "nothing to report" rather than
+        // turning a background report into an unhandled rejection.
+        let instanceId;
+        try {
+            instanceId = await settings.get('system.instanceId');
+        }
+        catch {
+            return null;
+        }
+        if (instanceId === null)
+            return null; // never bootstrapped — nothing to say
+        // `engine` ONLY — deliberately not `connectionsRepo`, which would hand us
+        // a DsnCrypto and rows carrying encrypted DSNs. Selecting the single
+        // column makes it structurally impossible for connection material to reach
+        // the payload builder, rather than merely unlikely (07 §3.13).
+        const rows = await meta.db.selectFrom('adminium_connections').select('engine').execute();
+        return buildTelemetryPayload({
+            instanceId,
+            version,
+            metaEngine: meta.dialect,
+            sourceEngines: rows.map((row) => row.engine),
+            sentAt: now(),
+        });
+    }
+    return {
+        isEnabled,
+        async preview() {
+            if (!(await isEnabled()))
+                return null;
+            return build();
+        },
+        async report() {
+            // FIRST, and before anything can touch the network: opted out ⇒ return.
+            if (!(await isEnabled()))
+                return { sent: false, reason: 'disabled' };
+            const payload = await build();
+            if (payload === null)
+                return { sent: false, reason: 'no-instance-id' };
+            const doFetch = deps.fetchImpl ?? globalThis.fetch;
+            try {
+                const response = await doFetch(endpoint, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json' },
+                    body: JSON.stringify(payload),
+                });
+                if (!response.ok)
+                    return { sent: false, reason: 'failed' };
+                return { sent: true, payload };
+            }
+            catch {
+                // Telemetry is never load-bearing: an unreachable endpoint must not
+                // surface to the operator or fail a request.
+                return { sent: false, reason: 'failed' };
+            }
+        },
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/telemetry/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/telemetry/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,gBAAgB,CAAC;AAE3D,OAAO,EAAE,qBAAqB,EAA+C,MAAM,cAAc,CAAC;AAElG,kFAAkF;AAClF,MAAM,CAAC,MAAM,kBAAkB,GAAG,wCAAwC,CAAC;AAyC3E,MAAM,UAAU,sBAAsB,CAAC,IAA0B;IAC/D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,KAAK,UAAU,SAAS;QACtB,4EAA4E;QAC5E,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAC5D,OAAO,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,KAAK,UAAU,KAAK;QAClB,0EAA0E;QAC1E,0EAA0E;QAC1E,mEAAmE;QACnE,oEAAoE;QACpE,+DAA+D;QAC/D,0EAA0E;QAC1E,wEAAwE;QACxE,2DAA2D;QAC3D,IAAI,UAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,CAAC,sCAAsC;QAE5E,0EAA0E;QAC1E,qEAAqE;QACrE,2EAA2E;QAC3E,+DAA+D;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;QAEzF,OAAO,qBAAqB,CAAC;YAC3B,UAAU;YACV,OAAO;YACP,UAAU,EAAE,IAAI,CAAC,OAA0B;YAC3C,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5C,MAAM,EAAE,GAAG,EAAE;SACd,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,SAAS;QAET,KAAK,CAAC,OAAO;YACX,IAAI,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;gBAAE,OAAO,IAAI,CAAC;YACtC,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,MAAM;YACV,wEAAwE;YACxE,IAAI,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAErE,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC;YAC9B,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;YAEvE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;YACnD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE;oBACvC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;iBAC9B,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE;oBAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;gBAC3D,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,6CAA6C;gBAC7C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAC3C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/telemetry/update-check.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Self-host update-available check (M10-T04): compares the running build
+ * against the latest public release so a self-hoster learns a security fix
+ * exists without subscribing to anything.
+ *
+ * GATING — the deliberate choice, per the track brief ("gate the check behind
+ * the telemetry/update preference so an opted-out instance makes no outbound
+ * call; state your choice and make it testable"):
+ *
+ *   The check is gated on its OWN setting, `updates.checkEnabled`, which is
+ *   default-false — NOT on `telemetry.enabled`.
+ *
+ * Why its own key rather than reusing the telemetry answer: the two disclose
+ * different things and deserve different answers. Telemetry pushes a document
+ * about the instance; an update check pulls a version list but still discloses
+ * the instance's IP + `User-Agent` version to whoever serves it. An operator
+ * who declines telemetry may still want security notices, and one who accepts
+ * telemetry has not thereby agreed to a periodic beacon. Both default OFF, both
+ * are asked on the same first-run consent screen, and both are editable later.
+ *
+ * When the setting is false, `check()` returns `{ status: 'disabled' }` before
+ * touching `fetch` — `telemetry-network-isolation.test.ts` asserts that with
+ * all outbound network disabled. Requests carry NO instance id and no payload:
+ * an update check is a plain GET, so it is not a telemetry channel in disguise.
+ */
+import { type MetaDb } from '@adminium/meta';
+/**
+ * The public release feed for the AGPL repo (01-architecture.md §9).
+ *
+ * `MoSofi/Adminium` is where the source and the releases actually live; the
+ * `adminium/adminium` slug is an unrelated third party's repository, and
+ * polling it would either 404 or report a stranger's tags as our updates.
+ */
+export declare const UPDATE_FEED_URL = "https://api.github.com/repos/MoSofi/Adminium/releases/latest";
+export declare const RELEASES_PAGE_URL = "https://github.com/MoSofi/Adminium/releases";
+/** Don't re-check more than once an hour, however often About is opened. */
+export declare const UPDATE_CACHE_TTL_MS = 3600000;
+export type UpdateCheckResult = 
+/** Opted out — no outbound call was made. */
+{
+    status: 'disabled';
+} | {
+    status: 'current';
+    current: string;
+} | {
+    status: 'update-available';
+    current: string;
+    latest: string;
+    url: string;
+}
+/** Feed unreachable/unparseable — never surfaced as an error to the user. */
+ | {
+    status: 'unknown';
+    current: string;
+};
+/**
+ * Compares `major.minor.patch`, ignoring a leading `v` and any
+ * prerelease/build suffix. Returns <0, 0, >0 (a vs b). A prerelease of X is
+ * treated AS X: `0.5.0-rc.1` never reports "0.5.0 available", which would be a
+ * false alarm on the release it already is.
+ */
+export declare function compareVersions(a: string, b: string): number;
+export interface UpdateCheckDeps {
+    meta: MetaDb;
+    /** The running build (apps/server package.json). */
+    version: string;
+    feedUrl?: string | undefined;
+    releasesUrl?: string | undefined;
+    fetchImpl?: typeof globalThis.fetch | undefined;
+    now?: (() => number) | undefined;
+    cacheTtlMs?: number | undefined;
+}
+export interface UpdateCheckService {
+    /** Reads `updates.checkEnabled`; no network. */
+    isEnabled(): Promise<boolean>;
+    check(): Promise<UpdateCheckResult>;
+}
+export declare function createUpdateCheckService(deps: UpdateCheckDeps): UpdateCheckService;
+//# sourceMappingURL=update-check.d.ts.map

package/dist/telemetry/update-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.d.ts","sourceRoot":"","sources":["../../src/telemetry/update-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE3D;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,iEAAiE,CAAC;AAC9F,eAAO,MAAM,iBAAiB,gDAAgD,CAAC;AAE/E,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C,MAAM,MAAM,iBAAiB;AAC3B,6CAA6C;AAC3C;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE;AAC9E,6EAA6E;GAC3E;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAS5D;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,oDAAoD;IACpD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,SAAS,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,GAAG,SAAS,CAAC;IAChD,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,gDAAgD;IAChD,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9B,KAAK,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrC;AAED,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,eAAe,GAAG,kBAAkB,CAoDlF"}

package/dist/telemetry/update-check.js

@@ -0,0 +1,103 @@
+/**
+ * Self-host update-available check (M10-T04): compares the running build
+ * against the latest public release so a self-hoster learns a security fix
+ * exists without subscribing to anything.
+ *
+ * GATING — the deliberate choice, per the track brief ("gate the check behind
+ * the telemetry/update preference so an opted-out instance makes no outbound
+ * call; state your choice and make it testable"):
+ *
+ *   The check is gated on its OWN setting, `updates.checkEnabled`, which is
+ *   default-false — NOT on `telemetry.enabled`.
+ *
+ * Why its own key rather than reusing the telemetry answer: the two disclose
+ * different things and deserve different answers. Telemetry pushes a document
+ * about the instance; an update check pulls a version list but still discloses
+ * the instance's IP + `User-Agent` version to whoever serves it. An operator
+ * who declines telemetry may still want security notices, and one who accepts
+ * telemetry has not thereby agreed to a periodic beacon. Both default OFF, both
+ * are asked on the same first-run consent screen, and both are editable later.
+ *
+ * When the setting is false, `check()` returns `{ status: 'disabled' }` before
+ * touching `fetch` — `telemetry-network-isolation.test.ts` asserts that with
+ * all outbound network disabled. Requests carry NO instance id and no payload:
+ * an update check is a plain GET, so it is not a telemetry channel in disguise.
+ */
+import { settingsRepo } from '@adminium/meta';
+/**
+ * The public release feed for the AGPL repo (01-architecture.md §9).
+ *
+ * `MoSofi/Adminium` is where the source and the releases actually live; the
+ * `adminium/adminium` slug is an unrelated third party's repository, and
+ * polling it would either 404 or report a stranger's tags as our updates.
+ */
+export const UPDATE_FEED_URL = 'https://api.github.com/repos/MoSofi/Adminium/releases/latest';
+export const RELEASES_PAGE_URL = 'https://github.com/MoSofi/Adminium/releases';
+/** Don't re-check more than once an hour, however often About is opened. */
+export const UPDATE_CACHE_TTL_MS = 3_600_000;
+/**
+ * Compares `major.minor.patch`, ignoring a leading `v` and any
+ * prerelease/build suffix. Returns <0, 0, >0 (a vs b). A prerelease of X is
+ * treated AS X: `0.5.0-rc.1` never reports "0.5.0 available", which would be a
+ * false alarm on the release it already is.
+ */
+export function compareVersions(a, b) {
+    const parse = (v) => {
+        const core = v.trim().replace(/^v/, '').split(/[-+]/)[0] ?? '';
+        const parts = core.split('.').map((n) => Number.parseInt(n, 10));
+        return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0].map((n) => (Number.isNaN(n) ? 0 : n));
+    };
+    const [aMajor, aMinor, aPatch] = parse(a);
+    const [bMajor, bMinor, bPatch] = parse(b);
+    return aMajor - bMajor || aMinor - bMinor || aPatch - bPatch;
+}
+export function createUpdateCheckService(deps) {
+    const { meta, version } = deps;
+    const feedUrl = deps.feedUrl ?? UPDATE_FEED_URL;
+    const releasesUrl = deps.releasesUrl ?? RELEASES_PAGE_URL;
+    const now = deps.now ?? (() => Date.now());
+    const cacheTtlMs = deps.cacheTtlMs ?? UPDATE_CACHE_TTL_MS;
+    const settings = settingsRepo(meta);
+    let cache = null;
+    async function isEnabled() {
+        return settings.get('updates.checkEnabled');
+    }
+    async function fetchLatest() {
+        const doFetch = deps.fetchImpl ?? globalThis.fetch;
+        try {
+            const response = await doFetch(feedUrl, {
+                method: 'GET',
+                headers: { accept: 'application/json' },
+            });
+            if (!response.ok)
+                return null;
+            const body = await response.json();
+            const tag = body?.tag_name;
+            return typeof tag === 'string' && tag.length > 0 ? tag : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    return {
+        isEnabled,
+        async check() {
+            // FIRST: opted out ⇒ no fetch, no cache read, nothing.
+            if (!(await isEnabled()))
+                return { status: 'disabled' };
+            if (cache !== null && now() - cache.at < cacheTtlMs)
+                return cache.result;
+            const latest = await fetchLatest();
+            const result = latest === null
+                ? { status: 'unknown', current: version }
+                : compareVersions(latest, version) > 0
+                    ? { status: 'update-available', current: version, latest: latest.replace(/^v/, ''), url: releasesUrl }
+                    : { status: 'current', current: version };
+            // Don't cache a transient failure — the next open should retry.
+            if (result.status !== 'unknown')
+                cache = { at: now(), result };
+            return result;
+        },
+    };
+}
+//# sourceMappingURL=update-check.js.map

package/dist/telemetry/update-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-check.js","sourceRoot":"","sources":["../../src/telemetry/update-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,YAAY,EAAe,MAAM,gBAAgB,CAAC;AAE3D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,8DAA8D,CAAC;AAC9F,MAAM,CAAC,MAAM,iBAAiB,GAAG,6CAA6C,CAAC;AAE/E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAU7C;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,KAAK,GAAG,CAAC,CAAS,EAAY,EAAE;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC;IACF,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAA6B,CAAC;IACtE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAA6B,CAAC;IACtE,OAAO,MAAM,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,CAAC;AAC/D,CAAC;AAmBD,MAAM,UAAU,wBAAwB,CAAC,IAAqB;IAC5D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC1D,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,IAAI,KAAK,GAAqD,IAAI,CAAC;IAEnE,KAAK,UAAU,SAAS;QACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,UAAU,WAAW;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE;gBACtC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;aACxC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YAC9B,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAI,IAAsC,EAAE,QAAQ,CAAC;YAC9D,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QAET,KAAK,CAAC,KAAK;YACT,uDAAuD;YACvD,IAAI,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YAExD,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,UAAU;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC;YAEzE,MAAM,MAAM,GAAG,MAAM,WAAW,EAAE,CAAC;YACnC,MAAM,MAAM,GACV,MAAM,KAAK,IAAI;gBACb,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE;gBACzC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;oBACpC,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE;oBACtG,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAEhD,gEAAgE;YAChE,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;gBAAE,KAAK,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,14 @@
+export declare const APP_VERSION: string;
+/**
+ * The name this CLI is published under on npm — the ONE place it is written
+ * down, so nothing in the tree can drift onto a name we do not own.
+ *
+ * It is scoped and it does not match the workspace name: the unscoped npm name
+ * `adminium` belongs to an unrelated third party, and so does the `@adminium`
+ * scope, so `scripts/release/publish-npm.mjs` rewrites `@adminium/server` to
+ * `@<NPM_SCOPE>/adminium` (default scope `adminiumjs`) at publish time. The
+ * installed binary is still called `adminium`; only the install spec is scoped.
+ * Keep this in sync with that script's `mappedName()` if `NPM_SCOPE` changes.
+ */
+export declare const NPM_PACKAGE_NAME = "@adminiumjs/adminium";
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,WAAW,EAAE,MAAoB,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,yBAAyB,CAAC"}

package/dist/version.js

@@ -0,0 +1,21 @@
+import { readFileSync } from 'node:fs';
+/**
+ * App version read from apps/server/package.json at module load. The relative
+ * hop works from both `src/` (vitest/tsx) and `dist/` (compiled) because both
+ * sit one level below the package root.
+ */
+const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+export const APP_VERSION = pkg.version;
+/**
+ * The name this CLI is published under on npm — the ONE place it is written
+ * down, so nothing in the tree can drift onto a name we do not own.
+ *
+ * It is scoped and it does not match the workspace name: the unscoped npm name
+ * `adminium` belongs to an unrelated third party, and so does the `@adminium`
+ * scope, so `scripts/release/publish-npm.mjs` rewrites `@adminium/server` to
+ * `@<NPM_SCOPE>/adminium` (default scope `adminiumjs`) at publish time. The
+ * installed binary is still called `adminium`; only the install spec is scoped.
+ * Keep this in sync with that script's `mappedName()` if `NPM_SCOPE` changes.
+ */
+export const NPM_PACKAGE_NAME = '@adminiumjs/adminium';
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;GAIG;AACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAEvF,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAW,GAAG,CAAC,OAAO,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,sBAAsB,CAAC"}