@adminiumjs/meta 0.1.0-rc.1

package/dist/repos/pages.js

@@ -0,0 +1,374 @@
+/**
+ * pagesRepo — adminium_pages (07-meta-store.md §3.16).
+ *
+ * Every navigable page of the Generated App, dashboards included. The
+ * `config` column is the opaque, already-validated envelope JSON
+ * (01-architecture.md §6.1) — `@adminium/meta` never imports the engine
+ * schemas; the server is the single write-time validator.
+ *
+ * Generator contract (M4-T08): `upsertGenerated` is idempotent — stable
+ * `page_<slug>` ids, unchanged documents are not rewritten, changed ones
+ * bump `revision`, rows the generator no longer emits are pruned (unless
+ * human-edited — see below), and rows whose `origin` is not `generated`
+ * (user/manifest/system pages) are never touched or pruned. The M5
+ * regeneration safety net keys on the `config.generatedHash` the engine
+ * embeds in each generated envelope (04-widget-registry.md §6.3 note: user
+ * delta wins): when the caller supplies the hash function, a stored document
+ * whose embedded hash no longer matches (a human edited it — `setLayout`
+ * deliberately leaves the hash stale) is skipped, not overwritten, and
+ * reported in `skippedEdited` — the full diff proposal UI is 04-T15. The
+ * same guard extends to deletion: an edited row missing from the new set is
+ * kept, not pruned, and reported in `keptEdited`; only unedited orphans
+ * (byte-identically regenerable) are deleted. Without `hashEnvelope` the
+ * legacy full prune applies.
+ */
+import { newId } from '../ids.js';
+import { MetaValidationError, jsonEquals, packJson, readBool, readJson, writeBool, } from './util.js';
+export const PAGE_ORIGINS = ['generated', 'user', 'manifest', 'system', 'llm'];
+/**
+ * True when a stored generated-origin envelope no longer matches its embedded
+ * `config.generatedHash` — the edited-page signal (human writes update the
+ * document but never the hash). Rows without a string hash are treated as
+ * untouched: only the generator embeds one, and regenerating restores it.
+ */
+function isEditedEnvelope(stored, hashEnvelope) {
+    if (typeof stored !== 'object' || stored === null)
+        return false;
+    const envelope = stored;
+    const config = envelope['config'];
+    if (typeof config !== 'object' || config === null)
+        return false;
+    const embedded = config['generatedHash'];
+    if (typeof embedded !== 'string')
+        return false;
+    return hashEnvelope(envelope) !== embedded;
+}
+function decode(row) {
+    return {
+        id: row.id,
+        connectionId: row.connectionId,
+        slug: row.slug,
+        type: row.type,
+        title: row.title,
+        icon: row.icon,
+        navGroup: row.navGroup,
+        navOrder: row.navOrder,
+        config: readJson(row.config),
+        origin: row.origin,
+        manifestId: row.manifestId,
+        generatedFromSnapshotId: row.generatedFromSnapshotId,
+        revision: row.revision,
+        isEnabled: readBool(row.isEnabled),
+        createdBy: row.createdBy,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+export function pagesRepo(meta) {
+    const { db } = meta;
+    return {
+        /**
+         * Idempotent bulk upsert of one generation run for a connection.
+         * Insert new rows, update changed ones (revision + 1), skip unchanged,
+         * prune generated rows missing from the new set. Non-generated rows are
+         * reported in `preserved` and never modified.
+         */
+        async upsertGenerated(connectionId, pages, opts = {}) {
+            const at = opts.at ?? Date.now();
+            const prune = opts.prune ?? true;
+            const ids = new Set(pages.map((p) => p.id));
+            if (ids.size !== pages.length) {
+                throw new MetaValidationError('duplicate page ids in one generation run');
+            }
+            for (const input of pages) {
+                if (input.id.length > 36) {
+                    throw new MetaValidationError(`page id exceeds char(36): ${input.id}`);
+                }
+            }
+            return db.transaction().execute(async (trx) => {
+                const existing = await trx
+                    .selectFrom('adminium_pages')
+                    .selectAll()
+                    .where('connectionId', '=', connectionId)
+                    .execute();
+                const byId = new Map(existing.map((row) => [row.id, row]));
+                const result = {
+                    created: 0,
+                    updated: 0,
+                    unchanged: 0,
+                    pruned: 0,
+                    preserved: [],
+                    skippedEdited: [],
+                    keptEdited: [],
+                };
+                for (const input of pages) {
+                    const row = byId.get(input.id);
+                    const packed = packJson(input.config);
+                    if (row === undefined) {
+                        await trx
+                            .insertInto('adminium_pages')
+                            .values({
+                            id: input.id,
+                            connectionId,
+                            slug: input.slug,
+                            type: input.type,
+                            title: input.title,
+                            icon: input.icon ?? null,
+                            navGroup: input.navGroup ?? null,
+                            navOrder: input.navOrder ?? 0,
+                            config: packed,
+                            origin: 'generated',
+                            manifestId: null,
+                            generatedFromSnapshotId: opts.snapshotId ?? null,
+                            revision: 1,
+                            isEnabled: writeBool(meta, true),
+                            createdBy: opts.createdBy ?? null,
+                            createdAt: at,
+                            updatedAt: at,
+                        })
+                            .execute();
+                        result.created += 1;
+                        continue;
+                    }
+                    if (row.origin !== 'generated') {
+                        // A user/manifest page claimed this id — regeneration never
+                        // overwrites it (user delta wins, 04 §6.3).
+                        result.preserved.push(row.id);
+                        continue;
+                    }
+                    // Structural, not serialized-string, equality: pg jsonb / mysql json
+                    // do not preserve key order, so the round-tripped document rarely
+                    // re-serializes byte-identical to `packed` (util.ts jsonEquals).
+                    const unchanged = jsonEquals(readJson(row.config), input.config) &&
+                        row.slug === input.slug &&
+                        row.type === input.type &&
+                        row.title === input.title &&
+                        (row.icon ?? null) === (input.icon ?? null) &&
+                        (row.navGroup ?? null) === (input.navGroup ?? null) &&
+                        row.navOrder === (input.navOrder ?? 0);
+                    if (unchanged) {
+                        result.unchanged += 1;
+                        continue;
+                    }
+                    if (opts.hashEnvelope !== undefined &&
+                        isEditedEnvelope(readJson(row.config), opts.hashEnvelope)) {
+                        // User delta wins (04 §6.3): the stored document was edited after
+                        // generation, so this run must not clobber it. The row keeps its
+                        // snapshot lineage too — it no longer descends from this run.
+                        result.skippedEdited.push(row.id);
+                        continue;
+                    }
+                    await trx
+                        .updateTable('adminium_pages')
+                        .set({
+                        slug: input.slug,
+                        type: input.type,
+                        title: input.title,
+                        icon: input.icon ?? null,
+                        navGroup: input.navGroup ?? null,
+                        navOrder: input.navOrder ?? 0,
+                        config: packed,
+                        generatedFromSnapshotId: opts.snapshotId ?? null,
+                        revision: row.revision + 1,
+                        updatedAt: at,
+                    })
+                        .where('id', '=', row.id)
+                        .execute();
+                    result.updated += 1;
+                }
+                if (prune) {
+                    for (const row of existing) {
+                        if (row.origin !== 'generated' || ids.has(row.id))
+                            continue;
+                        if (opts.hashEnvelope !== undefined &&
+                            isEditedEnvelope(readJson(row.config), opts.hashEnvelope)) {
+                            // User delta wins extends to deletion (04 §6.3): the generator
+                            // dropped this page (table removed/hidden between runs), but a
+                            // human customized the stored document, so pruning would
+                            // destroy work that cannot be regenerated. Keep the row exactly
+                            // as-is — origin stays 'generated', it stays enabled, and its
+                            // snapshot lineage is untouched. Unedited orphans are
+                            // byte-identically regenerable and still delete below.
+                            result.keptEdited.push(row.id);
+                            continue;
+                        }
+                        await trx.deleteFrom('adminium_pages').where('id', '=', row.id).execute();
+                        result.pruned += 1;
+                    }
+                }
+                return result;
+            });
+        },
+        /** Create a non-generated page (user/manifest/system flows, seeds). */
+        async create(input, at = Date.now()) {
+            const origin = input.origin ?? 'user';
+            if (!PAGE_ORIGINS.includes(origin)) {
+                throw new MetaValidationError(`invalid page origin ${JSON.stringify(origin)}`);
+            }
+            const row = {
+                id: newId('page'),
+                connectionId: input.connectionId ?? null,
+                slug: input.slug,
+                type: input.type,
+                title: input.title,
+                icon: input.icon ?? null,
+                navGroup: input.navGroup ?? null,
+                navOrder: input.navOrder ?? 0,
+                config: packJson(input.config),
+                origin,
+                manifestId: null,
+                generatedFromSnapshotId: null,
+                revision: 1,
+                isEnabled: writeBool(meta, true),
+                createdBy: input.createdBy ?? null,
+                createdAt: at,
+                updatedAt: at,
+            };
+            await db.insertInto('adminium_pages').values(row).execute();
+            return decode(row);
+        },
+        async findById(id) {
+            const row = await db
+                .selectFrom('adminium_pages')
+                .selectAll()
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return row === undefined ? null : decode(row);
+        },
+        /**
+         * Write the shared default dashboard layout into the envelope's
+         * `config.layout` slot (04-widget-registry.md §6.3; the renderer and engine
+         * envelope validator both read `envelope.config.layout`). Merges over the
+         * stored envelope so the rest of the document (title/source/nav and the
+         * other template config keys) is untouched, and bumps `updatedAt` so the
+         * bootstrap `configVersion` advances and clients re-fetch. `revision`
+         * bumps too — the counter tracks every changed document, human or machine
+         * (override-staleness and future H5 diff/telemetry read it) — while the
+         * embedded `config.generatedHash` deliberately stays stale: that mismatch
+         * IS the edited-page signal `upsertGenerated` keys on. The `layout` value
+         * is validated by the server route before it reaches here. Returns the
+         * reloaded page, or null if the id does not exist.
+         */
+        async setLayout(pageId, layout, at = Date.now()) {
+            const page = await this.findById(pageId);
+            if (page === null)
+                return null;
+            const envelope = typeof page.config === 'object' && page.config !== null
+                ? page.config
+                : {};
+            const templateConfig = typeof envelope['config'] === 'object' && envelope['config'] !== null
+                ? envelope['config']
+                : {};
+            const nextEnvelope = { ...envelope, config: { ...templateConfig, layout } };
+            await db
+                .updateTable('adminium_pages')
+                .set({ config: packJson(nextEnvelope), revision: page.revision + 1, updatedAt: at })
+                .where('id', '=', pageId)
+                .execute();
+            return this.findById(pageId);
+        },
+        /**
+         * Replace a page's whole config document — the 06-llm-assist.md §8.3
+         * materialization write: the apply executor seeds `origin: 'llm'` rows with
+         * a minimal `{source, llmRunId}` config and the regeneration hook expands
+         * it into the full validated envelope from the active snapshot. Bumps
+         * `revision` + `updatedAt` (configVersion advances → clients re-fetch);
+         * `icon` is back-filled only when the row has none. `title`/`navGroup`,
+         * when provided, sync the row's nav projection from the envelope — the
+         * bootstrap tree reads the ROW columns, so without this an expanded llm
+         * page would stay outside the nav (and `/p/$slug` resolves from the nav
+         * tree, leaving the page unreachable). Returns the reloaded page, or null
+         * if the id does not exist.
+         */
+        async replaceConfig(pageId, config, opts = {}) {
+            const page = await this.findById(pageId);
+            if (page === null)
+                return null;
+            const at = opts.at ?? Date.now();
+            const icon = opts.icon ?? null;
+            await db
+                .updateTable('adminium_pages')
+                .set({
+                config: packJson(config),
+                ...(page.icon === null && icon !== null ? { icon } : {}),
+                ...(opts.title === undefined ? {} : { title: opts.title }),
+                ...(opts.navGroup === undefined ? {} : { navGroup: opts.navGroup }),
+                revision: page.revision + 1,
+                updatedAt: at,
+            })
+                .where('id', '=', pageId)
+                .execute();
+            return this.findById(pageId);
+        },
+        /**
+         * Toggle a page's visibility (nav + GET both key on `isEnabled`). Bumps
+         * `updatedAt` only — the document itself is unchanged, so `revision`
+         * stays. Used by the §8.3 materialization pass to park an llm seed whose
+         * template cannot compose yet, instead of serving an invalid-config card.
+         */
+        async setEnabled(pageId, isEnabled, at = Date.now()) {
+            await db
+                .updateTable('adminium_pages')
+                .set({ isEnabled: writeBool(meta, isEnabled), updatedAt: at })
+                .where('id', '=', pageId)
+                .execute();
+        },
+        /** Slugs are unique per connection (uq_adminium_pages_conn_slug). */
+        async findBySlug(connectionId, slug) {
+            let q = db.selectFrom('adminium_pages').selectAll().where('slug', '=', slug);
+            q =
+                connectionId === null
+                    ? q.where('connectionId', 'is', null)
+                    : q.where('connectionId', '=', connectionId);
+            const row = await q.executeTakeFirst();
+            return row === undefined ? null : decode(row);
+        },
+        async listForConnection(connectionId) {
+            const rows = await db
+                .selectFrom('adminium_pages')
+                .selectAll()
+                .where('connectionId', '=', connectionId)
+                .orderBy('navOrder', 'asc')
+                .orderBy('slug', 'asc')
+                .execute();
+            return rows.map(decode);
+        },
+        /**
+         * The bootstrap nav projection — every page row, nav fields only
+         * (09-generated-app.md §2.2; the route buckets these into the five fixed
+         * groups and derives `configVersion` from max updatedAt).
+         */
+        async navRows() {
+            return db
+                .selectFrom('adminium_pages')
+                .select(['id', 'connectionId', 'slug', 'title', 'icon', 'navGroup', 'navOrder', 'isEnabled', 'updatedAt'])
+                .execute();
+        },
+        /** Generated-page counts per connection (connections-hub cards, 09 §8.1). */
+        async countGeneratedByConnection() {
+            const rows = await db
+                .selectFrom('adminium_pages')
+                .select(['connectionId'])
+                .select((eb) => eb.fn.countAll().as('pages'))
+                .where('origin', '=', 'generated')
+                .where('connectionId', 'is not', null)
+                .groupBy('connectionId')
+                .execute();
+            const out = {};
+            for (const row of rows) {
+                if (row.connectionId !== null)
+                    out[row.connectionId] = Number(row.pages);
+            }
+            return out;
+        },
+        /** Max updatedAt over all pages — the bootstrap `configVersion` stamp. */
+        async configVersion() {
+            const row = await db
+                .selectFrom('adminium_pages')
+                .select((eb) => eb.fn.max('updatedAt').as('max'))
+                .executeTakeFirst();
+            return Number(row?.max ?? 0);
+        },
+    };
+}
+//# sourceMappingURL=pages.js.map

package/dist/repos/pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pages.js","sourceRoot":"","sources":["../../src/repos/pages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,mBAAmB,EACnB,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,SAAS,GACV,MAAM,WAAW,CAAC;AAEnB,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AA8FxF;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,MAAe,EACf,YAA2D;IAE3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAiC,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChE,MAAM,QAAQ,GAAI,MAAkC,CAAC,eAAe,CAAC,CAAC;IACtE,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,YAAY,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC;AAC7C,CAAC;AAED,SAAS,MAAM,CAAC,GAAmC;IACjD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,uBAAuB,EAAE,GAAG,CAAC,uBAAuB;QACpD,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,OAAO;QACL;;;;;WAKG;QACH,KAAK,CAAC,eAAe,CACnB,YAAoB,EACpB,KAAoC,EACpC,OAA+B,EAAE;YAEjC,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC;YACjC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5C,IAAI,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;YAC5E,CAAC;YACD,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,KAAK,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;oBACzB,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YAED,OAAO,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;gBAC5C,MAAM,QAAQ,GAAG,MAAM,GAAG;qBACvB,UAAU,CAAC,gBAAgB,CAAC;qBAC5B,SAAS,EAAE;qBACX,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;qBACxC,OAAO,EAAE,CAAC;gBACb,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;gBAE3D,MAAM,MAAM,GAA0B;oBACpC,OAAO,EAAE,CAAC;oBACV,OAAO,EAAE,CAAC;oBACV,SAAS,EAAE,CAAC;oBACZ,MAAM,EAAE,CAAC;oBACT,SAAS,EAAE,EAAE;oBACb,aAAa,EAAE,EAAE;oBACjB,UAAU,EAAE,EAAE;iBACf,CAAC;gBAEF,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;oBAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC/B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACtC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;wBACtB,MAAM,GAAG;6BACN,UAAU,CAAC,gBAAgB,CAAC;6BAC5B,MAAM,CAAC;4BACN,EAAE,EAAE,KAAK,CAAC,EAAE;4BACZ,YAAY;4BACZ,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,KAAK,EAAE,KAAK,CAAC,KAAK;4BAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;4BACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;4BAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;4BAC7B,MAAM,EAAE,MAAM;4BACd,MAAM,EAAE,WAAW;4BACnB,UAAU,EAAE,IAAI;4BAChB,uBAAuB,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;4BAChD,QAAQ,EAAE,CAAC;4BACX,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;4BAChC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;4BACjC,SAAS,EAAE,EAAE;4BACb,SAAS,EAAE,EAAE;yBACd,CAAC;6BACD,OAAO,EAAE,CAAC;wBACb,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;wBACpB,SAAS;oBACX,CAAC;oBACD,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;wBAC/B,4DAA4D;wBAC5D,4CAA4C;wBAC5C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAC9B,SAAS;oBACX,CAAC;oBACD,qEAAqE;oBACrE,kEAAkE;oBAClE,iEAAiE;oBACjE,MAAM,SAAS,GACb,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC;wBAC9C,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;wBACvB,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;wBACvB,GAAG,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;wBACzB,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;wBAC3C,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC;wBACnD,GAAG,CAAC,QAAQ,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;oBACzC,IAAI,SAAS,EAAE,CAAC;wBACd,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;wBACtB,SAAS;oBACX,CAAC;oBACD,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;wBAC/B,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,EACzD,CAAC;wBACD,kEAAkE;wBAClE,iEAAiE;wBACjE,8DAA8D;wBAC9D,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;wBAClC,SAAS;oBACX,CAAC;oBACD,MAAM,GAAG;yBACN,WAAW,CAAC,gBAAgB,CAAC;yBAC7B,GAAG,CAAC;wBACH,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;wBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;wBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;wBAC7B,MAAM,EAAE,MAAM;wBACd,uBAAuB,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI;wBAChD,QAAQ,EAAE,GAAG,CAAC,QAAQ,GAAG,CAAC;wBAC1B,SAAS,EAAE,EAAE;qBACd,CAAC;yBACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;yBACxB,OAAO,EAAE,CAAC;oBACb,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;gBACtB,CAAC;gBAED,IAAI,KAAK,EAAE,CAAC;oBACV,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;wBAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;4BAAE,SAAS;wBAC5D,IACE,IAAI,CAAC,YAAY,KAAK,SAAS;4BAC/B,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,EACzD,CAAC;4BACD,+DAA+D;4BAC/D,+DAA+D;4BAC/D,yDAAyD;4BACzD,gEAAgE;4BAChE,8DAA8D;4BAC9D,sDAAsD;4BACtD,uDAAuD;4BACvD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BAC/B,SAAS;wBACX,CAAC;wBACD,MAAM,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;wBAC1E,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;oBACrB,CAAC;gBACH,CAAC;gBAED,OAAO,MAAM,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC;QAED,uEAAuE;QACvE,KAAK,CAAC,MAAM,CAAC,KAWZ,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,MAAM,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,mBAAmB,CAAC,uBAAuB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,GAAG,GAAG;gBACV,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;gBACjB,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;gBACxC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,CAAC;gBAC7B,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9B,MAAM;gBACN,UAAU,EAAE,IAAI;gBAChB,uBAAuB,EAAE,IAAI;gBAC7B,QAAQ,EAAE,CAAC;gBACX,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC;gBAChC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5D,OAAO,MAAM,CAAC,GAAY,CAAC,CAAC;QAC9B,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,gBAAgB,CAAC;iBAC5B,SAAS,EAAE;iBACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAED;;;;;;;;;;;;;WAaG;QACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,MAAe,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,QAAQ,GACZ,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;gBACrD,CAAC,CAAE,IAAI,CAAC,MAAkC;gBAC1C,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,cAAc,GAClB,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI;gBACnE,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAA6B;gBACjD,CAAC,CAAC,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC;YAC5E,MAAM,EAAE;iBACL,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACnF,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED;;;;;;;;;;;;WAYG;QACH,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,MAAe,EACf,OAAwF,EAAE;YAE1F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;YAC/B,MAAM,EAAE;iBACL,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC;gBACH,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxD,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnE,QAAQ,EAAE,IAAI,CAAC,QAAQ,GAAG,CAAC;gBAC3B,SAAS,EAAE,EAAE;aACd,CAAC;iBACD,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,SAAkB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC1E,MAAM,EAAE;iBACL,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAC7D,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,OAAO,EAAE,CAAC;QACf,CAAC;QAED,qEAAqE;QACrE,KAAK,CAAC,UAAU,CAAC,YAA2B,EAAE,IAAY;YACxD,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;gBACC,YAAY,KAAK,IAAI;oBACnB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,EAAE,IAAI,CAAC;oBACrC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC,CAAC;YACjD,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACvC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,YAAoB;YAC1C,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,gBAAgB,CAAC;iBAC5B,SAAS,EAAE;iBACX,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;iBACxC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC;iBAC1B,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;iBACtB,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,OAAO;YACX,OAAO,EAAE;iBACN,UAAU,CAAC,gBAAgB,CAAC;iBAC5B,MAAM,CAAC,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;iBACzG,OAAO,EAAE,CAAC;QACf,CAAC;QAED,6EAA6E;QAC7E,KAAK,CAAC,0BAA0B;YAC9B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,gBAAgB,CAAC;iBAC5B,MAAM,CAAC,CAAC,cAAc,CAAC,CAAC;iBACxB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;iBAC5C,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,WAAW,CAAC;iBACjC,KAAK,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC;iBACrC,OAAO,CAAC,cAAc,CAAC;iBACvB,OAAO,EAAE,CAAC;YACb,MAAM,GAAG,GAA2B,EAAE,CAAC;YACvC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,GAAG,CAAC,YAAY,KAAK,IAAI;oBAAE,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC3E,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QAED,0EAA0E;QAC1E,KAAK,CAAC,aAAa;YACjB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,gBAAgB,CAAC;iBAC5B,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;iBAChD,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/password-resets.d.ts

@@ -0,0 +1,32 @@
+/**
+ * passwordResetsRepo — adminium_password_resets (07-meta-store.md §3.6).
+ * Carries both reset and invite-activation tokens; single-use.
+ */
+import type { Selectable } from 'kysely';
+import { z } from 'zod';
+import type { MetaDb } from '../connect.js';
+import type { AdminiumPasswordResetsTable } from '../schema/tables.js';
+export declare const resetKindSchema: z.ZodEnum<{
+    reset: "reset";
+    invite: "invite";
+}>;
+export type ResetKind = z.infer<typeof resetKindSchema>;
+export type PasswordReset = Selectable<AdminiumPasswordResetsTable>;
+export interface CreatePasswordResetInput {
+    userId: string;
+    kind: ResetKind;
+    tokenHash: string;
+    /** reset: +2 h; invite: +7 days — computed by the server (§3.6). */
+    expiresAt: number;
+}
+export declare function passwordResetsRepo(meta: MetaDb): {
+    create(input: CreatePasswordResetInput, at?: number): Promise<PasswordReset>;
+    /** Unused and unexpired at `at`. */
+    findValidByTokenHash(tokenHash: string, at?: number): Promise<PasswordReset | null>;
+    /** Single-use guard: only the first consume wins. */
+    consume(id: string, at?: number): Promise<boolean>;
+    /** Retention §8 `password-resets` policy: used, or expired > 24 h ago. */
+    gc(at?: number): Promise<number>;
+};
+export type PasswordResetsRepo = ReturnType<typeof passwordResetsRepo>;
+//# sourceMappingURL=password-resets.d.ts.map

package/dist/repos/password-resets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-resets.d.ts","sourceRoot":"","sources":["../../src/repos/password-resets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAGvE,eAAO,MAAM,eAAe;;;EAA8B,CAAC;AAC3D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAEpE,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM;kBAGvB,wBAAwB,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,CAAC;IAc9F,oCAAoC;oCACE,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAWrG,qDAAqD;gBACnC,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAUpE,0EAA0E;YAC7D,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQrD;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/repos/password-resets.js

@@ -0,0 +1,56 @@
+/**
+ * passwordResetsRepo — adminium_password_resets (07-meta-store.md §3.6).
+ * Carries both reset and invite-activation tokens; single-use.
+ */
+import { z } from 'zod';
+import { newId } from '../ids.js';
+import { DAY_MS } from './util.js';
+export const resetKindSchema = z.enum(['reset', 'invite']);
+export function passwordResetsRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('rst'),
+                userId: input.userId,
+                kind: resetKindSchema.parse(input.kind),
+                tokenHash: input.tokenHash,
+                expiresAt: input.expiresAt,
+                usedAt: null,
+                createdAt: at,
+            };
+            await db.insertInto('adminium_password_resets').values(row).execute();
+            return row;
+        },
+        /** Unused and unexpired at `at`. */
+        async findValidByTokenHash(tokenHash, at = Date.now()) {
+            const row = await db
+                .selectFrom('adminium_password_resets')
+                .selectAll()
+                .where('tokenHash', '=', tokenHash)
+                .where('usedAt', 'is', null)
+                .where('expiresAt', '>', at)
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        /** Single-use guard: only the first consume wins. */
+        async consume(id, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_password_resets')
+                .set({ usedAt: at })
+                .where('id', '=', id)
+                .where('usedAt', 'is', null)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        /** Retention §8 `password-resets` policy: used, or expired > 24 h ago. */
+        async gc(at = Date.now()) {
+            const res = await db
+                .deleteFrom('adminium_password_resets')
+                .where((eb) => eb.or([eb('usedAt', 'is not', null), eb('expiresAt', '<', at - DAY_MS)]))
+                .executeTakeFirst();
+            return Number(res.numDeletedRows);
+        },
+    };
+}
+//# sourceMappingURL=password-resets.js.map

package/dist/repos/password-resets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-resets.js","sourceRoot":"","sources":["../../src/repos/password-resets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAa3D,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA+B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAkB;gBACzB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,oCAAoC;QACpC,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,SAAS,EAAE;iBACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC3B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,qDAAqD;QACrD,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC/C,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,0BAA0B,CAAC;iBACvC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;iBACnB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,0EAA0E;QAC1E,KAAK,CAAC,EAAE,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YAC9B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACvF,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/permissions.d.ts

@@ -0,0 +1,28 @@
+/**
+ * permissionsRepo — adminium_role_permissions (07-meta-store.md §3.9).
+ * The `actions` JSON is Zod-validated per resource kind and never queried in
+ * SQL (the server layers an in-memory cache on top).
+ */
+import type { MetaDb } from '../connect.js';
+import { type PermissionActions, type ResourceKind } from '../schema/json-payloads.js';
+export interface RolePermission {
+    id: string;
+    roleId: string;
+    resourceKind: ResourceKind;
+    resourceRef: string;
+    actions: PermissionActions;
+}
+export declare function permissionsRepo(meta: MetaDb): {
+    find: (roleId: string, resourceKind: ResourceKind, resourceRef: string) => Promise<RolePermission | null>;
+    /** Upsert one matrix row keyed by (role, kind, ref). */
+    grant(roleId: string, resourceKind: ResourceKind, resourceRef: string, actions: PermissionActions): Promise<RolePermission>;
+    revoke(roleId: string, resourceKind: ResourceKind, resourceRef: string): Promise<boolean>;
+    listForRole(roleId: string): Promise<RolePermission[]>;
+    /**
+     * Single matrix-cell check: `action` is `read`/`update`/… for tables,
+     * `view`/`edit` for pages, and ignored (the ref IS the action) for system.
+     */
+    isAllowed(roleId: string, resourceKind: ResourceKind, resourceRef: string, action?: string): Promise<boolean>;
+};
+export type PermissionsRepo = ReturnType<typeof permissionsRepo>;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/repos/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/repos/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM;mBAGd,MAAM,gBAAgB,YAAY,eAAe,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAsBlH,wDAAwD;kBAE9C,MAAM,gBACA,YAAY,eACb,MAAM,WACV,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC;mBAsBL,MAAM,gBAAgB,YAAY,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;wBAUrE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAoB5D;;;OAGG;sBACqB,MAAM,gBAAgB,YAAY,eAAe,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAStH;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/repos/permissions.js

@@ -0,0 +1,100 @@
+/**
+ * permissionsRepo — adminium_role_permissions (07-meta-store.md §3.9).
+ * The `actions` JSON is Zod-validated per resource kind and never queried in
+ * SQL (the server layers an in-memory cache on top).
+ */
+import { newId } from '../ids.js';
+import { permissionActionsSchemaFor, resourceKindSchema, } from '../schema/json-payloads.js';
+import { packJson, readJson } from './util.js';
+export function permissionsRepo(meta) {
+    const { db } = meta;
+    async function find(roleId, resourceKind, resourceRef) {
+        const row = await db
+            .selectFrom('adminium_role_permissions')
+            .selectAll()
+            .where('roleId', '=', roleId)
+            .where('resourceKind', '=', resourceKind)
+            .where('resourceRef', '=', resourceRef)
+            .executeTakeFirst();
+        if (!row)
+            return null;
+        const kind = resourceKindSchema.parse(row.resourceKind);
+        return {
+            id: row.id,
+            roleId: row.roleId,
+            resourceKind: kind,
+            resourceRef: row.resourceRef,
+            actions: permissionActionsSchemaFor(kind).parse(readJson(row.actions)),
+        };
+    }
+    return {
+        find,
+        /** Upsert one matrix row keyed by (role, kind, ref). */
+        async grant(roleId, resourceKind, resourceRef, actions) {
+            const kind = resourceKindSchema.parse(resourceKind);
+            const validated = permissionActionsSchemaFor(kind).parse(actions);
+            const value = packJson(validated);
+            const res = await db
+                .updateTable('adminium_role_permissions')
+                .set({ actions: value })
+                .where('roleId', '=', roleId)
+                .where('resourceKind', '=', kind)
+                .where('resourceRef', '=', resourceRef)
+                .executeTakeFirst();
+            if (Number(res.numUpdatedRows) === 0) {
+                await db
+                    .insertInto('adminium_role_permissions')
+                    .values({ id: newId('perm'), roleId, resourceKind: kind, resourceRef, actions: value })
+                    .execute();
+            }
+            const row = await find(roleId, kind, resourceRef);
+            if (!row)
+                throw new Error('permission row disappeared during grant');
+            return row;
+        },
+        async revoke(roleId, resourceKind, resourceRef) {
+            const res = await db
+                .deleteFrom('adminium_role_permissions')
+                .where('roleId', '=', roleId)
+                .where('resourceKind', '=', resourceKind)
+                .where('resourceRef', '=', resourceRef)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows) === 1;
+        },
+        async listForRole(roleId) {
+            const rows = await db
+                .selectFrom('adminium_role_permissions')
+                .selectAll()
+                .where('roleId', '=', roleId)
+                .orderBy('resourceKind', 'asc')
+                .orderBy('resourceRef', 'asc')
+                .execute();
+            return rows.map((row) => {
+                const kind = resourceKindSchema.parse(row.resourceKind);
+                return {
+                    id: row.id,
+                    roleId: row.roleId,
+                    resourceKind: kind,
+                    resourceRef: row.resourceRef,
+                    actions: permissionActionsSchemaFor(kind).parse(readJson(row.actions)),
+                };
+            });
+        },
+        /**
+         * Single matrix-cell check: `action` is `read`/`update`/… for tables,
+         * `view`/`edit` for pages, and ignored (the ref IS the action) for system.
+         */
+        async isAllowed(roleId, resourceKind, resourceRef, action) {
+            const row = await find(roleId, resourceKind, resourceRef);
+            if (!row)
+                return false;
+            if (resourceKind === 'system')
+                return row.actions.allowed;
+            if (action === undefined)
+                return false;
+            const value = row.actions[action];
+            return value === true;
+        },
+    };
+}
+//# sourceMappingURL=permissions.js.map

package/dist/repos/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/repos/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,GAGnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAU/C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB;QACjF,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,UAAU,CAAC,2BAA2B,CAAC;aACvC,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;aACxC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;aACtC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,IAAI;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QAEJ,wDAAwD;QACxD,KAAK,CAAC,KAAK,CACT,MAAc,EACd,YAA0B,EAC1B,WAAmB,EACnB,OAA0B;YAE1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,2BAA2B,CAAC;iBACxC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;iBACvB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC;iBAChC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,gBAAgB,EAAE,CAAC;YACtB,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,EAAE;qBACL,UAAU,CAAC,2BAA2B,CAAC;qBACvC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;qBACtF,OAAO,EAAE,CAAC;YACf,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACrE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB;YAC1E,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;iBACxC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,SAAS,EAAE;iBACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;iBAC9B,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;iBAC7B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;iBACvE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB,EAAE,MAAe;YAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,IAAI,YAAY,KAAK,QAAQ;gBAAE,OAAQ,GAAG,CAAC,OAAgC,CAAC,OAAO,CAAC;YACpF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,KAAK,GAAI,GAAG,CAAC,OAAmC,CAAC,MAAM,CAAC,CAAC;YAC/D,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}