@adminiumjs/meta 0.1.0-rc.1

package/dist/repos/roles.d.ts

@@ -0,0 +1,33 @@
+/**
+ * rolesRepo — adminium_roles + adminium_user_roles
+ * (07-meta-store.md §3.8, §3.10).
+ */
+import type { MetaDb } from '../connect.js';
+export interface Role {
+    id: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    isBuiltin: boolean;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface CreateRoleInput {
+    slug: string;
+    name: string;
+    description?: string | null;
+    isBuiltin?: boolean;
+}
+export declare function rolesRepo(meta: MetaDb): {
+    create(input: CreateRoleInput, at?: number): Promise<Role>;
+    findBySlug(slug: string): Promise<Role | null>;
+    findById(id: string): Promise<Role | null>;
+    list(): Promise<Role[]>;
+    rename(roleId: string, name: string, at?: number): Promise<boolean>;
+    /** Idempotent grant of a role to a user. */
+    assignToUser(userId: string, roleId: string, grantedBy?: string | null, at?: number): Promise<void>;
+    removeFromUser(userId: string, roleId: string): Promise<boolean>;
+    rolesForUser(userId: string): Promise<Role[]>;
+};
+export type RolesRepo = ReturnType<typeof rolesRepo>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/repos/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/repos/roles.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAK5C,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAcD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM;kBAGd,eAAe,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;qBAcrD,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;iBAKjC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YAKlC,OAAO,CAAC,IAAI,EAAE,CAAC;mBAKR,MAAM,QAAQ,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IASrF,4CAA4C;yBACjB,MAAM,UAAU,MAAM,cAAa,MAAM,GAAG,IAAI,OAAa,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;2BAc9F,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;yBAS3C,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;EAWtD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC"}

package/dist/repos/roles.js

@@ -0,0 +1,89 @@
+/**
+ * rolesRepo — adminium_roles + adminium_user_roles
+ * (07-meta-store.md §3.8, §3.10).
+ */
+import { newId } from '../ids.js';
+import { readBool, writeBool } from './util.js';
+function mapRole(row) {
+    return {
+        id: row.id,
+        slug: row.slug,
+        name: row.name,
+        description: row.description,
+        isBuiltin: readBool(row.isBuiltin),
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+export function rolesRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('role'),
+                slug: input.slug,
+                name: input.name,
+                description: input.description ?? null,
+                isBuiltin: writeBool(meta, input.isBuiltin ?? false),
+                createdAt: at,
+                updatedAt: at,
+            };
+            await db.insertInto('adminium_roles').values(row).execute();
+            return mapRole(row);
+        },
+        async findBySlug(slug) {
+            const row = await db.selectFrom('adminium_roles').selectAll().where('slug', '=', slug).executeTakeFirst();
+            return row ? mapRole(row) : null;
+        },
+        async findById(id) {
+            const row = await db.selectFrom('adminium_roles').selectAll().where('id', '=', id).executeTakeFirst();
+            return row ? mapRole(row) : null;
+        },
+        async list() {
+            const rows = await db.selectFrom('adminium_roles').selectAll().orderBy('slug', 'asc').execute();
+            return rows.map(mapRole);
+        },
+        async rename(roleId, name, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_roles')
+                .set({ name, updatedAt: at })
+                .where('id', '=', roleId)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        /** Idempotent grant of a role to a user. */
+        async assignToUser(userId, roleId, grantedBy = null, at = Date.now()) {
+            const existing = await db
+                .selectFrom('adminium_user_roles')
+                .select('userId')
+                .where('userId', '=', userId)
+                .where('roleId', '=', roleId)
+                .executeTakeFirst();
+            if (existing)
+                return;
+            await db
+                .insertInto('adminium_user_roles')
+                .values({ userId, roleId, grantedBy, createdAt: at })
+                .execute();
+        },
+        async removeFromUser(userId, roleId) {
+            const res = await db
+                .deleteFrom('adminium_user_roles')
+                .where('userId', '=', userId)
+                .where('roleId', '=', roleId)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows) === 1;
+        },
+        async rolesForUser(userId) {
+            const rows = await db
+                .selectFrom('adminium_user_roles')
+                .innerJoin('adminium_roles', 'adminium_roles.id', 'adminium_user_roles.roleId')
+                .selectAll('adminium_roles')
+                .where('adminium_user_roles.userId', '=', userId)
+                .orderBy('adminium_roles.slug', 'asc')
+                .execute();
+            return rows.map(mapRole);
+        },
+    };
+}
+//# sourceMappingURL=roles.js.map

package/dist/repos/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/repos/roles.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAmBhD,SAAS,OAAO,CAAC,GAAmC;IAClD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAsB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC1D,MAAM,GAAG,GAAG;gBACV,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;gBACpD,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAqC,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAY;YAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1G,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACtG,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAChE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAC5B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,4CAA4C;QAC5C,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,MAAc,EAAE,YAA2B,IAAI,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACzG,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,EAAE;iBACL,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACpD,OAAO,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,MAAc;YACjD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,4BAA4B,CAAC;iBAC9E,SAAS,CAAC,gBAAgB,CAAC;iBAC3B,KAAK,CAAC,4BAA4B,EAAE,GAAG,EAAE,MAAM,CAAC;iBAChD,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC;iBACrC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/scheduled-reports.d.ts

@@ -0,0 +1,73 @@
+/**
+ * scheduledReportsRepo — adminium_scheduled_reports (07-meta-store.md §3.24):
+ * one row per recurring report. The row stores WHAT and WHEN (`schedule` per
+ * `reportScheduleSchema`, `recipients`, `format`) plus the run bookkeeping
+ * (`last_run_at` / `next_run_at`); computing `next_run_at` from the schedule
+ * fields is the SERVER's job (croner lives there — apps/server/src/reports/),
+ * so the repo persists timestamps it is handed and never parses cron.
+ *
+ * `format` keeps the §3.24 `pdf | png` vocabulary even though the v1 runner
+ * delivers a data snapshot (no headless browser) — the stored intent survives
+ * the day rendering arrives, and the UI explains the degradation rather than
+ * hiding it (documented deviation in the M7 reports track).
+ */
+import { z } from 'zod';
+import type { MetaDb } from '../connect.js';
+import { reportFormatSchema, reportScheduleSchema } from '../schema/json-payloads.js';
+export type ReportSchedule = z.infer<typeof reportScheduleSchema>;
+export type ReportFormat = z.infer<typeof reportFormatSchema>;
+export interface ScheduledReport {
+    id: string;
+    pageId: string;
+    name: string;
+    schedule: ReportSchedule;
+    recipients: string[];
+    format: ReportFormat;
+    enabled: boolean;
+    lastRunAt: number | null;
+    nextRunAt: number | null;
+    createdBy: string | null;
+    createdAt: number;
+    updatedAt: number;
+}
+export interface CreateScheduledReportInput {
+    pageId: string;
+    name: string;
+    schedule: ReportSchedule;
+    recipients: string[];
+    format: ReportFormat;
+    enabled?: boolean | undefined;
+    /** Computed by the caller (croner) — null parks the schedule. */
+    nextRunAt: number | null;
+    createdBy?: string | null | undefined;
+}
+export interface UpdateScheduledReportInput {
+    name?: string | undefined;
+    pageId?: string | undefined;
+    schedule?: ReportSchedule | undefined;
+    recipients?: string[] | undefined;
+    format?: ReportFormat | undefined;
+    enabled?: boolean | undefined;
+    /** Recompute + pass whenever `schedule`/`enabled` changes. */
+    nextRunAt?: number | null | undefined;
+}
+export declare function scheduledReportsRepo(meta: MetaDb): {
+    findById: (id: string) => Promise<ScheduledReport | null>;
+    create(input: CreateScheduledReportInput, at?: number): Promise<ScheduledReport>;
+    /** Newest first; `createdBy` scopes to one user (the "mine" list). */
+    list(opts?: {
+        createdBy?: string;
+        limit?: number;
+    }): Promise<ScheduledReport[]>;
+    update(id: string, patch: UpdateScheduledReportInput, at?: number): Promise<ScheduledReport | null>;
+    remove(id: string): Promise<boolean>;
+    /** Stamp a completed run and park the next one (the report-run job). */
+    recordRun(id: string, run: {
+        lastRunAt: number;
+        nextRunAt: number | null;
+    }): Promise<boolean>;
+    /** Enabled reports whose `next_run_at` has passed — the poll's worklist. */
+    listDue(at?: number): Promise<ScheduledReport[]>;
+};
+export type ScheduledReportsRepo = ReturnType<typeof scheduledReportsRepo>;
+//# sourceMappingURL=scheduled-reports.d.ts.map

package/dist/repos/scheduled-reports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-reports.d.ts","sourceRoot":"","sources":["../../src/repos/scheduled-reports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EACL,kBAAkB,EAElB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAIpC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,iEAAiE;IACjE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAmBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM;mBAGnB,MAAM,KAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;kBAY9C,0BAA0B,OAAM,MAAM,GAAgB,OAAO,CAAC,eAAe,CAAC;IAmBlG,sEAAsE;gBACrD;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,eAAe,EAAE,CAAC;eAYnF,MAAM,SACH,0BAA0B,OAC7B,MAAM,GACT,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;eAoBjB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ1C,wEAAwE;kBAElE,MAAM,OACL;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACnD,OAAO,CAAC,OAAO,CAAC;IASnB,4EAA4E;iBAC1D,MAAM,GAAgB,OAAO,CAAC,eAAe,EAAE,CAAC;EAYrE;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/repos/scheduled-reports.js

@@ -0,0 +1,132 @@
+/**
+ * scheduledReportsRepo — adminium_scheduled_reports (07-meta-store.md §3.24):
+ * one row per recurring report. The row stores WHAT and WHEN (`schedule` per
+ * `reportScheduleSchema`, `recipients`, `format`) plus the run bookkeeping
+ * (`last_run_at` / `next_run_at`); computing `next_run_at` from the schedule
+ * fields is the SERVER's job (croner lives there — apps/server/src/reports/),
+ * so the repo persists timestamps it is handed and never parses cron.
+ *
+ * `format` keeps the §3.24 `pdf | png` vocabulary even though the v1 runner
+ * delivers a data snapshot (no headless browser) — the stored intent survives
+ * the day rendering arrives, and the UI explains the degradation rather than
+ * hiding it (documented deviation in the M7 reports track).
+ */
+import { z } from 'zod';
+import { newId } from '../ids.js';
+import { reportFormatSchema, reportRecipientsSchema, reportScheduleSchema, } from '../schema/json-payloads.js';
+import { affected, packJson, readBool, readJson, writeBool } from './util.js';
+function decode(row) {
+    return {
+        id: row.id,
+        pageId: row.pageId,
+        name: row.name,
+        schedule: reportScheduleSchema.parse(readJson(row.schedule)),
+        recipients: reportRecipientsSchema.parse(readJson(row.recipients)),
+        format: reportFormatSchema.parse(row.format),
+        enabled: readBool(row.enabled),
+        lastRunAt: row.lastRunAt,
+        nextRunAt: row.nextRunAt,
+        createdBy: row.createdBy,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt,
+    };
+}
+export function scheduledReportsRepo(meta) {
+    const { db } = meta;
+    async function findById(id) {
+        const row = await db
+            .selectFrom('adminium_scheduled_reports')
+            .selectAll()
+            .where('id', '=', id)
+            .executeTakeFirst();
+        return row ? decode(row) : null;
+    }
+    return {
+        findById,
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('rep'),
+                pageId: input.pageId,
+                name: input.name,
+                schedule: packJson(reportScheduleSchema.parse(input.schedule)),
+                recipients: packJson(reportRecipientsSchema.parse(input.recipients)),
+                format: reportFormatSchema.parse(input.format),
+                enabled: writeBool(meta, input.enabled ?? true),
+                lastRunAt: null,
+                nextRunAt: input.nextRunAt,
+                createdBy: input.createdBy ?? null,
+                createdAt: at,
+                updatedAt: at,
+            };
+            await db.insertInto('adminium_scheduled_reports').values(row).execute();
+            return decode(row);
+        },
+        /** Newest first; `createdBy` scopes to one user (the "mine" list). */
+        async list(opts = {}) {
+            let query = db.selectFrom('adminium_scheduled_reports').selectAll();
+            if (opts.createdBy !== undefined)
+                query = query.where('createdBy', '=', opts.createdBy);
+            const rows = await query
+                .orderBy('createdAt', 'desc')
+                .orderBy('id', 'desc')
+                .limit(opts.limit ?? 100)
+                .execute();
+            return rows.map(decode);
+        },
+        async update(id, patch, at = Date.now()) {
+            const set = { updatedAt: at };
+            if (patch.name !== undefined)
+                set['name'] = patch.name;
+            if (patch.pageId !== undefined)
+                set['pageId'] = patch.pageId;
+            if (patch.schedule !== undefined)
+                set['schedule'] = packJson(reportScheduleSchema.parse(patch.schedule));
+            if (patch.recipients !== undefined) {
+                set['recipients'] = packJson(reportRecipientsSchema.parse(patch.recipients));
+            }
+            if (patch.format !== undefined)
+                set['format'] = reportFormatSchema.parse(patch.format);
+            if (patch.enabled !== undefined)
+                set['enabled'] = writeBool(meta, patch.enabled);
+            if (patch.nextRunAt !== undefined)
+                set['nextRunAt'] = patch.nextRunAt;
+            const res = await db
+                .updateTable('adminium_scheduled_reports')
+                .set(set)
+                .where('id', '=', id)
+                .executeTakeFirst();
+            if (affected(res.numUpdatedRows) === 0)
+                return null;
+            return findById(id);
+        },
+        async remove(id) {
+            const res = await db
+                .deleteFrom('adminium_scheduled_reports')
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return affected(res.numDeletedRows) === 1;
+        },
+        /** Stamp a completed run and park the next one (the report-run job). */
+        async recordRun(id, run) {
+            const res = await db
+                .updateTable('adminium_scheduled_reports')
+                .set({ lastRunAt: run.lastRunAt, nextRunAt: run.nextRunAt, updatedAt: run.lastRunAt })
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return affected(res.numUpdatedRows) === 1;
+        },
+        /** Enabled reports whose `next_run_at` has passed — the poll's worklist. */
+        async listDue(at = Date.now()) {
+            const rows = await db
+                .selectFrom('adminium_scheduled_reports')
+                .selectAll()
+                .where('enabled', '=', writeBool(meta, true))
+                .where('nextRunAt', 'is not', null)
+                .where('nextRunAt', '<=', at)
+                .orderBy('nextRunAt', 'asc')
+                .execute();
+            return rows.map(decode);
+        },
+    };
+}
+//# sourceMappingURL=scheduled-reports.js.map

package/dist/repos/scheduled-reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduled-reports.js","sourceRoot":"","sources":["../../src/repos/scheduled-reports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA2C9E,SAAS,MAAM,CAAC,GAA8C;IAC5D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5D,UAAU,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,UAAU,CAAC,4BAA4B,CAAC;aACxC,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,gBAAgB,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,OAAO;QACL,QAAQ;QAER,KAAK,CAAC,MAAM,CAAC,KAAiC,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACrE,MAAM,GAAG,GAAG;gBACV,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC9D,UAAU,EAAE,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACpE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9C,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;gBAC/C,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC,GAA2D,CAAC,CAAC;QAC7E,CAAC;QAED,sEAAsE;QACtE,KAAK,CAAC,IAAI,CAAC,OAA+C,EAAE;YAC1D,IAAI,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC;YACpE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,KAAK;iBACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;iBACrB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;iBACxB,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAAiC,EACjC,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAA4B,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,GAAG,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;YACtE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,4BAA4B,CAAC;iBACzC,GAAG,CAAC,GAAG,CAAC;iBACR,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,4BAA4B,CAAC;iBACxC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,cAAoC,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QAED,wEAAwE;QACxE,KAAK,CAAC,SAAS,CACb,EAAU,EACV,GAAoD;YAEpD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,4BAA4B,CAAC;iBACzC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;iBACrF,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,4BAA4B,CAAC;iBACxC,SAAS,EAAE;iBACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;iBAC5C,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;iBAClC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;iBAC5B,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/sessions.d.ts

@@ -0,0 +1,33 @@
+/**
+ * sessionsRepo — adminium_sessions (07-meta-store.md §3.5).
+ * Cookie tokens are opaque; only their SHA-256 hex is stored (hashing in server).
+ */
+import type { Selectable } from 'kysely';
+import type { MetaDb } from '../connect.js';
+import type { AdminiumSessionsTable } from '../schema/tables.js';
+/** `last_seen_at` updates are throttled to at most one per this interval (§3.5). */
+export declare const SESSION_TOUCH_INTERVAL_MS = 60000;
+export type Session = Selectable<AdminiumSessionsTable>;
+export interface CreateSessionInput {
+    userId: string;
+    tokenHash: string;
+    expiresAt: number;
+    ip?: string | null;
+    userAgent?: string | null;
+}
+export declare function sessionsRepo(meta: MetaDb): {
+    create(input: CreateSessionInput, at?: number): Promise<Session>;
+    /** A session is valid when un-revoked and unexpired at `at`. */
+    findValidByTokenHash(tokenHash: string, at?: number): Promise<Session | null>;
+    /**
+     * Throttled `last_seen_at` bump: writes only when the previous value is at
+     * least {@link SESSION_TOUCH_INTERVAL_MS} old. Returns true when written.
+     */
+    touch(sessionId: string, at?: number): Promise<boolean>;
+    revoke(sessionId: string, at?: number): Promise<boolean>;
+    revokeAllForUser(userId: string, at?: number): Promise<number>;
+    /** Retention §8 `sessions` policy: expired, or revoked > 24 h ago. */
+    gc(at?: number): Promise<number>;
+};
+export type SessionsRepo = ReturnType<typeof sessionsRepo>;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/repos/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/repos/sessions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM;kBAGjB,kBAAkB,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAgBlF,gEAAgE;oCAC1B,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAW/F;;;OAGG;qBACoB,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;sBAUjD,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;6BAU3C,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;IAUhF,sEAAsE;YACzD,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQrD;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/repos/sessions.js

@@ -0,0 +1,79 @@
+/**
+ * sessionsRepo — adminium_sessions (07-meta-store.md §3.5).
+ * Cookie tokens are opaque; only their SHA-256 hex is stored (hashing in server).
+ */
+import { newId } from '../ids.js';
+import { DAY_MS } from './util.js';
+/** `last_seen_at` updates are throttled to at most one per this interval (§3.5). */
+export const SESSION_TOUCH_INTERVAL_MS = 60_000;
+export function sessionsRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('sess'),
+                tokenHash: input.tokenHash,
+                userId: input.userId,
+                createdAt: at,
+                expiresAt: input.expiresAt,
+                lastSeenAt: at,
+                ip: input.ip ?? null,
+                userAgent: input.userAgent ?? null,
+                revokedAt: null,
+            };
+            await db.insertInto('adminium_sessions').values(row).execute();
+            return row;
+        },
+        /** A session is valid when un-revoked and unexpired at `at`. */
+        async findValidByTokenHash(tokenHash, at = Date.now()) {
+            const row = await db
+                .selectFrom('adminium_sessions')
+                .selectAll()
+                .where('tokenHash', '=', tokenHash)
+                .where('revokedAt', 'is', null)
+                .where('expiresAt', '>', at)
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        /**
+         * Throttled `last_seen_at` bump: writes only when the previous value is at
+         * least {@link SESSION_TOUCH_INTERVAL_MS} old. Returns true when written.
+         */
+        async touch(sessionId, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_sessions')
+                .set({ lastSeenAt: at })
+                .where('id', '=', sessionId)
+                .where('lastSeenAt', '<=', at - SESSION_TOUCH_INTERVAL_MS)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        async revoke(sessionId, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_sessions')
+                .set({ revokedAt: at })
+                .where('id', '=', sessionId)
+                .where('revokedAt', 'is', null)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        async revokeAllForUser(userId, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_sessions')
+                .set({ revokedAt: at })
+                .where('userId', '=', userId)
+                .where('revokedAt', 'is', null)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows);
+        },
+        /** Retention §8 `sessions` policy: expired, or revoked > 24 h ago. */
+        async gc(at = Date.now()) {
+            const res = await db
+                .deleteFrom('adminium_sessions')
+                .where((eb) => eb.or([eb('expiresAt', '<', at), eb('revokedAt', '<', at - DAY_MS)]))
+                .executeTakeFirst();
+            return Number(res.numDeletedRows);
+        },
+    };
+}
+//# sourceMappingURL=sessions.js.map

package/dist/repos/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/repos/sessions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC;AAYhD,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAyB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC7D,MAAM,GAAG,GAAY;gBACnB,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;gBACjB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,EAAE;gBACd,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,IAAI;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,IAAI;aAChB,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAC/D,OAAO,GAAG,CAAC;QACb,CAAC;QAED,gEAAgE;QAChE,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,SAAS,EAAE;iBACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACpD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,mBAAmB,CAAC;iBAChC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;iBACvB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,GAAG,yBAAyB,CAAC;iBACzD,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACrD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,mBAAmB,CAAC;iBAChC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACtB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC;iBAC3B,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC5D,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,mBAAmB,CAAC;iBAChC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACtB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;QAED,sEAAsE;QACtE,KAAK,CAAC,EAAE,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YAC9B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,mBAAmB,CAAC;iBAC/B,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACnF,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/settings.d.ts

@@ -0,0 +1,25 @@
+/**
+ * settingsRepo — adminium_settings (07-meta-store.md §3.2, §7.1).
+ * Stores explicit overrides only; reads resolve `stored ?? registry default`.
+ */
+import type { MetaDb } from '../connect.js';
+import { type SettingKey, type SettingValue } from '../schema/settings-registry.js';
+export declare class UnknownSettingError extends Error {
+    name: string;
+    constructor(key: string);
+}
+export declare function settingsRepo(meta: MetaDb): {
+    /** Registry default merged with the stored override, validated on the way out. */
+    get<K extends SettingKey>(key: K): Promise<SettingValue<K>>;
+    /** Validate and upsert an explicit override. */
+    set<K extends SettingKey>(key: K, value: SettingValue<K>, opts?: {
+        updatedBy?: string | null;
+        at?: number;
+    }): Promise<void>;
+    /** Remove an override — the key falls back to the registry default. */
+    unset(key: SettingKey): Promise<boolean>;
+    /** Explicit overrides only (validated); unknown/stale keys are skipped. */
+    overrides(): Promise<Partial<Record<SettingKey, unknown>>>;
+};
+export type SettingsRepo = ReturnType<typeof settingsRepo>;
+//# sourceMappingURL=settings.d.ts.map

package/dist/repos/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../src/repos/settings.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,YAAY,EAClB,MAAM,gCAAgC,CAAC;AAGxC,qBAAa,mBAAoB,SAAQ,KAAK;IACnC,IAAI,SAAyB;gBAC1B,GAAG,EAAE,MAAM;CAGxB;AAMD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM;IAGrC,kFAAkF;QACxE,CAAC,SAAS,UAAU,OAAO,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAQjE,gDAAgD;QACtC,CAAC,SAAS,UAAU,OACvB,CAAC,SACC,YAAY,CAAC,CAAC,CAAC,SAChB;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAC/C,OAAO,CAAC,IAAI,CAAC;IAuBhB,uEAAuE;eACtD,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC;IAM9C,2EAA2E;iBACxD,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;EAWnE;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/repos/settings.js

@@ -0,0 +1,73 @@
+/**
+ * settingsRepo — adminium_settings (07-meta-store.md §3.2, §7.1).
+ * Stores explicit overrides only; reads resolve `stored ?? registry default`.
+ */
+import { SETTINGS_REGISTRY, isSettingKey, } from '../schema/settings-registry.js';
+import { MetaValidationError, packJson, readJson } from './util.js';
+export class UnknownSettingError extends Error {
+    name = 'UnknownSettingError';
+    constructor(key) {
+        super(`unknown settings key: ${JSON.stringify(key)}`);
+    }
+}
+function assertKey(key) {
+    if (!isSettingKey(key))
+        throw new UnknownSettingError(key);
+}
+export function settingsRepo(meta) {
+    const { db } = meta;
+    return {
+        /** Registry default merged with the stored override, validated on the way out. */
+        async get(key) {
+            assertKey(key);
+            const def = SETTINGS_REGISTRY[key];
+            const row = await db.selectFrom('adminium_settings').selectAll().where('key', '=', key).executeTakeFirst();
+            if (!row)
+                return def.default;
+            return def.schema.parse(readJson(row.value));
+        },
+        /** Validate and upsert an explicit override. */
+        async set(key, value, opts = {}) {
+            assertKey(key);
+            const def = SETTINGS_REGISTRY[key];
+            const parsed = def.schema.safeParse(value);
+            if (!parsed.success) {
+                throw new MetaValidationError(`invalid value for setting ${key}`, parsed.error.issues);
+            }
+            const at = opts.at ?? Date.now();
+            const packed = packJson(parsed.data);
+            const updatedBy = opts.updatedBy ?? null;
+            const res = await db
+                .updateTable('adminium_settings')
+                .set({ value: packed, updatedAt: at, updatedBy })
+                .where('key', '=', key)
+                .executeTakeFirst();
+            if (Number(res.numUpdatedRows) === 0) {
+                await db
+                    .insertInto('adminium_settings')
+                    .values({ key, value: packed, updatedAt: at, updatedBy })
+                    .execute();
+            }
+        },
+        /** Remove an override — the key falls back to the registry default. */
+        async unset(key) {
+            assertKey(key);
+            const res = await db.deleteFrom('adminium_settings').where('key', '=', key).executeTakeFirst();
+            return Number(res.numDeletedRows) === 1;
+        },
+        /** Explicit overrides only (validated); unknown/stale keys are skipped. */
+        async overrides() {
+            const rows = await db.selectFrom('adminium_settings').selectAll().execute();
+            const out = {};
+            for (const row of rows) {
+                if (!isSettingKey(row.key))
+                    continue;
+                const parsed = SETTINGS_REGISTRY[row.key].schema.safeParse(readJson(row.value));
+                if (parsed.success)
+                    out[row.key] = parsed.data;
+            }
+            return out;
+        },
+    };
+}
+//# sourceMappingURL=settings.js.map

package/dist/repos/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../src/repos/settings.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EACL,iBAAiB,EACjB,YAAY,GAGb,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEpE,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,IAAI,GAAG,qBAAqB,CAAC;IACtC,YAAY,GAAW;QACrB,KAAK,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACxD,CAAC;CACF;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,kFAAkF;QAClF,KAAK,CAAC,GAAG,CAAuB,GAAM;YACpC,SAAS,CAAC,GAAG,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC3G,IAAI,CAAC,GAAG;gBAAE,OAAO,GAAG,CAAC,OAA0B,CAAC;YAChD,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAoB,CAAC;QAClE,CAAC;QAED,gDAAgD;QAChD,KAAK,CAAC,GAAG,CACP,GAAM,EACN,KAAsB,EACtB,OAAmD,EAAE;YAErD,SAAS,CAAC,GAAG,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,GAAG,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,mBAAmB,CAAC;iBAChC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;iBAChD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC;iBACtB,gBAAgB,EAAE,CAAC;YACtB,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,EAAE;qBACL,UAAU,CAAC,mBAAmB,CAAC;qBAC/B,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;qBACxD,OAAO,EAAE,CAAC;YACf,CAAC;QACH,CAAC;QAED,uEAAuE;QACvE,KAAK,CAAC,KAAK,CAAC,GAAe;YACzB,SAAS,CAAC,GAAG,CAAC,CAAC;YACf,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC/F,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,2EAA2E;QAC3E,KAAK,CAAC,SAAS;YACb,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,CAAC;YAC5E,MAAM,GAAG,GAAyC,EAAE,CAAC;YACrD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;oBAAE,SAAS;gBACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;gBAChF,IAAI,MAAM,CAAC,OAAO;oBAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;YACjD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}