@adminiumjs/meta 0.1.0-rc.1

package/dist/schema/json-payloads.js

@@ -0,0 +1,340 @@
+/**
+ * Zod schemas for the JSON payloads stored in adminium_* json columns
+ * (07-meta-store.md §3). Repos validate every JSON write against these —
+ * an invalid payload never reaches the database (acceptance #7).
+ *
+ * Page config (`adminium_pages.config`) is deliberately opaque here: the
+ * envelope schema is owned by `@adminium/engine/config` and validated at the
+ * server route layer (§3.17); `pagesRepo` persists already-validated JSON.
+ */
+import { z } from 'zod';
+// --- shared -----------------------------------------------------------------
+/** §5.3 soft reference to a source record — never a cross-boundary FK. */
+export const recordRefSchema = z.object({
+    connectionId: z.string(),
+    /** Qualified source name, e.g. `public.orders`. */
+    table: z.string(),
+    /** Full PK map — supports composite keys. */
+    pk: z.record(z.string(), z.unknown()),
+    /** Display snapshot taken at write time. */
+    label: z.string(),
+});
+export const LOCALES = ['en_US', 'de_DE', 'ar_EG', 'zh_CN', 'zh_TW', 'cs_CZ', 'da_DK', 'fr_FR'];
+export const localeSchema = z.enum(LOCALES);
+export const themeSchema = z.enum(['light', 'dark', 'system']);
+export const accentSchema = z.enum(['indigo', 'blue', 'teal', 'violet', 'rose', 'red', 'orange', 'black']);
+export const densitySchema = z.enum(['comfortable', 'compact']);
+export const dirSchema = z.enum(['ltr', 'rtl']);
+// --- users / prefs (§3.3, §3.4) ----------------------------------------------
+export const userStatusSchema = z.enum(['active', 'invited', 'suspended']);
+/** Array of argon2id hashes. */
+export const recoveryCodesSchema = z.array(z.string());
+/** Non-theming client state: sidebar collapse, last-visited page, dismissed hints. */
+export const uiStateSchema = z.record(z.string(), z.unknown());
+// --- rbac (§3.9) --------------------------------------------------------------
+export const resourceKindSchema = z.enum(['table', 'page', 'system']);
+export const tableActionsSchema = z.object({
+    read: z.boolean(),
+    create: z.boolean(),
+    update: z.boolean(),
+    delete: z.boolean(),
+    export: z.boolean(),
+    import: z.boolean(),
+});
+export const pageActionsSchema = z.object({
+    view: z.boolean(),
+    edit: z.boolean(),
+});
+/** resource_ref IS the action; the value is a single grant. */
+export const systemActionsSchema = z.object({
+    allowed: z.boolean(),
+});
+/** v1 closed set of system action keys (§3.9), extended per milestone. */
+export const SYSTEM_ACTION_KEYS = [
+    'users.manage',
+    'roles.manage',
+    'settings.manage',
+    'connections.manage',
+    'schema.remap',
+    'llm.run',
+    'automations.manage', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
+    'webhooks.manage', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
+    'api-keys.manage',
+    'manifests.manage', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
+    'audit.read',
+    'sql.run', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
+    // M7 wave 2 — data-io (T5) + scheduled reports (T6). `exports.manage` /
+    // `imports.manage` gate seeing/downloading OTHER users' artifacts (lists are
+    // mine-only without them); `reports.manage` gates the scheduled-reports
+    // admin verbs. Email templates deliberately add NO key: PUT rides the
+    // existing `settings.manage` (T6 supersedes the builders track's assumption).
+    'exports.manage',
+    'imports.manage',
+    'reports.manage',
+    // Jobs visibility/management (08 §2.17): `jobs.read` gates GET /jobs and
+    // reading/subscribing to OTHER users' jobs (owners always see their own via
+    // the payload.userId convention); `jobs.manage` gates POST /jobs and
+    // cancelling other users' jobs. Enforced by routes/jobs and the realtime
+    // hub's jobs:<id> channel authorizer.
+    'jobs.read',
+    'jobs.manage',
+];
+export const systemActionKeySchema = z.enum(SYSTEM_ACTION_KEYS);
+/**
+ * Reserved keys — deferred features (automations, webhooks, manifest
+ * administration, raw-SQL console; deferred per the v1-free pivot,
+ * workplan/17-deferred-monetization.md) with ZERO enforcement points in v1:
+ * no route or realtime authorizer checks them. They stay in
+ * {@link SYSTEM_ACTION_KEYS} because the grammar is a closed set that stored
+ * grants round-trip through (removing a key would orphan persisted
+ * `adminium_role_permissions` rows and break forward-compat), but no
+ * permissions UI may OFFER them — letting an admin grant a key nothing checks
+ * is misleading security UI. Author grantable lists from
+ * {@link GRANTABLE_SYSTEM_ACTION_KEYS}; move a key out of here in the same
+ * change that lands its first enforcement point.
+ */
+export const RESERVED_SYSTEM_ACTION_KEYS = [
+    'automations.manage',
+    'webhooks.manage',
+    'manifests.manage',
+    'sql.run',
+];
+/**
+ * What a role editor / permissions surface may offer: the closed set minus
+ * {@link RESERVED_SYSTEM_ACTION_KEYS}. Derived, so the two lists cannot
+ * drift. (No dashboard roles page exists yet — apps/dashboard has no
+ * `@adminium/meta` dependency — so when that page or its catalog endpoint
+ * lands, THIS is the list it must be fed, not `SYSTEM_ACTION_KEYS`.)
+ */
+export const GRANTABLE_SYSTEM_ACTION_KEYS = SYSTEM_ACTION_KEYS.filter((key) => !RESERVED_SYSTEM_ACTION_KEYS.includes(key));
+export function permissionActionsSchemaFor(kind) {
+    switch (kind) {
+        case 'table':
+            return tableActionsSchema;
+        case 'page':
+            return pageActionsSchema;
+        case 'system':
+            return systemActionsSchema;
+    }
+}
+// --- audit (§3.11) -------------------------------------------------------------
+export const actorKindSchema = z.enum(['user', 'api-key', 'system', 'automation']);
+export const auditCategorySchema = z.enum([
+    'auth',
+    'data',
+    'schema',
+    'settings',
+    'rbac',
+    'connection',
+    'llm',
+    'automation',
+    'export',
+    'system',
+]);
+/** `{ before, after }` images; PII-masked upstream; capped at 16 KB serialized. */
+export const auditChangesSchema = z.object({
+    before: z.record(z.string(), z.unknown()).nullish(),
+    after: z.record(z.string(), z.unknown()).nullish(),
+    _truncated: z.literal(true).optional(),
+});
+/** Serialized-size cap for `adminium_audit_log.changes` (§3.11). */
+export const AUDIT_CHANGES_MAX_BYTES = 16 * 1024;
+// --- jobs (§3.12) ---------------------------------------------------------------
+export const jobStatusSchema = z.enum(['pending', 'running', 'succeeded', 'failed', 'cancelled']);
+/** Kind-specific; the worker validates the concrete shape. */
+export const jobPayloadSchema = z.record(z.string(), z.unknown());
+// --- connections (§3.13) ---------------------------------------------------------
+export const connectionEngineSchema = z.enum(['postgres', 'mysql', 'sqlite']);
+export const connectionSourceKindSchema = z.enum(['dsn', 'schema-file']);
+export const connectionStatusSchema = z.enum(['unconfigured', 'connected', 'error']);
+export const connectionSslSchema = z.object({
+    mode: z.enum(['require', 'verify-full', 'disable']),
+    caFileId: z.string().nullish(),
+});
+export const connectionSettingsSchema = z.object({
+    includedTables: z.array(z.string()).optional(),
+    intent: z.enum(['full-admin', 'read-only-analytics', 'crud', 'support-console']).optional(),
+    highVolumeUnchecked: z.boolean().optional(),
+    placeholderRows: z.boolean().optional(),
+});
+// --- schema overrides (§3.15): one row = one op ----------------------------------
+const toneSchema = z.string();
+export const overridePatchSchema = z.discriminatedUnion('op', [
+    // Labels are min(1): the engine's `TableModel.label` forbids '' and an empty
+    // rename is meaningless (the remap UI drops the op instead of staging '').
+    // Rejecting at write time keeps §3.15 last-write-wins + user>llm provenance
+    // free of empty-string special cases on the read path.
+    z.object({
+        op: z.literal('table.label'),
+        value: z.object({
+            label: z.string().min(1),
+            labelPlural: z.string().optional(),
+            icon: z.string().optional(),
+        }),
+    }),
+    z.object({ op: z.literal('table.exclude'), value: z.object({ excluded: z.boolean() }) }),
+    z.object({ op: z.literal('table.keyField'), value: z.object({ column: z.string() }) }),
+    z.object({ op: z.literal('column.label'), value: z.object({ label: z.string().min(1) }) }),
+    z.object({
+        op: z.literal('column.semanticType'),
+        value: z.object({ semanticType: z.string(), currency: z.string().optional() }),
+    }),
+    z.object({
+        op: z.literal('column.enumLabels'),
+        value: z.object({
+            labels: z.record(z.string(), z.string()),
+            tones: z.record(z.string(), toneSchema).optional(),
+        }),
+    }),
+    z.object({
+        op: z.literal('column.pii'),
+        value: z.object({ masked: z.boolean(), kind: z.string().optional() }),
+    }),
+    z.object({ op: z.literal('column.hidden'), value: z.object({ hidden: z.boolean() }) }),
+    z.object({
+        op: z.literal('relation.add'),
+        value: z.object({
+            fromColumn: z.string(),
+            toTable: z.string(),
+            toColumn: z.string(),
+            cardinality: z.enum(['many-to-one', 'one-to-one', 'one-to-many', 'many-to-many']),
+        }),
+    }),
+    z.object({
+        op: z.literal('relation.remove'),
+        value: z.object({ fromColumn: z.string(), toTable: z.string() }),
+    }),
+    z.object({
+        op: z.literal('relation.label'),
+        value: z.object({ fromColumn: z.string(), label: z.string() }),
+    }),
+]);
+export const overrideOriginSchema = z.enum(['user', 'llm']);
+export const overrideStatusSchema = z.enum(['active', 'disabled']);
+// --- pages (§3.16/§3.17) -----------------------------------------------------------
+export const pageOriginSchema = z.enum(['generated', 'user', 'manifest', 'system', 'llm']);
+export const navGroupSchema = z.enum(['workspace', 'library', 'planning', 'people', 'account']);
+/**
+ * Opaque: envelope validation is owned by `@adminium/engine/config` and runs
+ * at the server route layer before the repo is called (§3.17).
+ */
+export const pageConfigSchema = z.record(z.string(), z.unknown());
+/** Saved-view payload (§3.18). */
+export const viewConfigSchema = z.object({
+    filters: z.array(z.unknown()).optional(),
+    sort: z.unknown().optional(),
+    visibleColumns: z.array(z.string()).optional(),
+    grouping: z.unknown().nullish(),
+    widgetState: z.record(z.string(), z.unknown()).optional(),
+});
+// --- notifications (§3.20/§3.21) ----------------------------------------------------
+export const notificationChannelsSchema = z.object({
+    inApp: z.boolean(),
+    email: z.boolean(),
+    push: z.boolean(),
+});
+// --- llm runs (§3.19 / 06-llm-assist.md §7.4) -----------------------------------------
+export const llmRunModeSchema = z.enum(['provider', 'byo']);
+/**
+ * `validation_status` — the outcome of the LAST response validation, kept from
+ * 0006 as a secondary signal (drives the "some suggestions dropped" hint in the
+ * run-history UI). Orthogonal to the run-lifecycle `status` machine below, which
+ * 0007 adds as the authoritative state.
+ */
+export const llmValidationStatusSchema = z.enum(['pending', 'valid', 'partial', 'invalid']);
+/**
+ * `status` — the authoritative run-lifecycle machine (06-llm-assist.md §7.4).
+ * Transitions (enforced by the server run-service, not the repo):
+ *   draft → running | awaiting_response
+ *   running | awaiting_response → validated | failed | discarded
+ *   validated → applied | partially_applied | discarded
+ *   applied | partially_applied | failed | discarded → (terminal, immutable)
+ */
+export const llmRunStatusSchema = z.enum([
+    'draft',
+    'running',
+    'awaiting_response',
+    'validated',
+    'applied',
+    'partially_applied',
+    'failed',
+    'discarded',
+]);
+/** Builder inputs echoed onto the run (§4.1) — opaque here, validated upstream by `buildPrompt`. */
+export const llmRunSectionsSchema = z.array(z.string());
+export const llmRunLocalesSchema = z.array(z.string()).min(1);
+export const llmRunSamplingSchema = z
+    .object({ maxValuesPerColumn: z.number().int().positive() })
+    .nullable();
+/** `review` — accepted/rejected suggestion-id lists persisted across re-review (§8.3). */
+export const llmRunReviewSchema = z.object({
+    accepted: z.array(z.string()),
+    rejected: z.array(z.string()),
+});
+// --- automations (§3.22/§3.23) --------------------------------------------------------
+export const automationTriggerSchema = z.object({
+    event: z.string(),
+    table: z.string().nullish(),
+    schedule: z.string().nullish(),
+});
+export const automationGraphSchema = z.object({
+    nodes: z.array(z.unknown()),
+    edges: z.array(z.unknown()),
+});
+export const automationRunStatusSchema = z.enum(['running', 'succeeded', 'failed', 'skipped']);
+// --- scheduled reports (§3.24) ---------------------------------------------------------
+export const reportScheduleSchema = z.object({
+    frequency: z.enum(['daily', 'weekly', 'monthly']),
+    dayOfWeek: z.number().int().min(0).max(6).nullish(),
+    dayOfMonth: z.number().int().min(1).max(31).nullish(),
+    time: z.string(),
+    timezone: z.string(),
+});
+export const reportRecipientsSchema = z.array(z.string());
+export const reportFormatSchema = z.enum(['pdf', 'png']);
+// --- exports / imports (§3.25/§3.26) ------------------------------------------------------
+export const exportSourceSchema = z.object({
+    kind: z.enum(['table', 'view', 'page']),
+    table: z.string().nullish(),
+    viewId: z.string().nullish(),
+    filters: z.array(z.unknown()).optional(),
+});
+export const exportFormatSchema = z.enum(['csv', 'json', 'xlsx']);
+export const exportStatusSchema = z.enum(['processing', 'ready', 'failed', 'cancelled', 'expired']);
+export const importMappingSchema = z.object({
+    columns: z.array(z.object({ from: z.string(), to: z.string().nullable() })),
+});
+export const importOptionsSchema = z.object({
+    mode: z.enum(['insert', 'upsert']).optional(),
+    matchColumn: z.string().nullish(),
+    skipInvalid: z.boolean().optional(),
+});
+export const importStatsSchema = z.object({
+    total: z.number().int(),
+    inserted: z.number().int().optional(),
+    updated: z.number().int().optional(),
+    skipped: z.number().int().optional(),
+});
+export const importStatusSchema = z.enum(['validating', 'ready', 'running', 'succeeded', 'failed', 'cancelled']);
+// --- files (§3.27) --------------------------------------------------------------------------
+export const fileKindSchema = z.enum(['upload', 'export', 'import', 'branding', 'schema', 'archive']);
+// --- email templates / webhooks / flags / manifests (§3.28–§3.32) -----------------------------
+/** Block array — the concrete block schema is owned by 09-generated-app.md §email-editor. */
+export const emailBlocksSchema = z.array(z.record(z.string(), z.unknown()));
+/** Event keys, same grammar as automations (`record.created`, `export.ready`, `*`). */
+export const webhookEventsSchema = z.array(z.string());
+export const featureFlagEnvironmentSchema = z.object({
+    enabled: z.boolean(),
+    rollout: z.number().min(0).max(100),
+    rules: z.array(z.unknown()),
+});
+export const featureFlagEnvironmentsSchema = z.record(z.string(), featureFlagEnvironmentSchema);
+/** Envelope only — the full manifest spec is frozen in 13-marketplace.md. */
+export const manifestDocSchema = z
+    .object({
+    key: z.string(),
+    name: z.string(),
+    version: z.string(),
+})
+    .loose();
+//# sourceMappingURL=json-payloads.js.map

package/dist/schema/json-payloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json-payloads.js","sourceRoot":"","sources":["../../src/schema/json-payloads.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+EAA+E;AAE/E,0EAA0E;AAC1E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,mDAAmD;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,6CAA6C;IAC7C,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IACrC,4CAA4C;IAC5C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AACzG,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAG5C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3G,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAChE,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhD,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAG3E,gCAAgC;AAChC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEvD,sFAAsF;AACtF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAE/D,iFAAiF;AAEjF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGtE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CAClB,CAAC,CAAC;AAGH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC;AAKH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,oBAAoB;IACpB,cAAc;IACd,SAAS;IACT,oBAAoB,EAAE,+EAA+E;IACrG,iBAAiB,EAAE,+EAA+E;IAClG,iBAAiB;IACjB,kBAAkB,EAAE,+EAA+E;IACnG,YAAY;IACZ,SAAS,EAAE,+EAA+E;IAC1F,wEAAwE;IACxE,6EAA6E;IAC7E,wEAAwE;IACxE,sEAAsE;IACtE,8EAA8E;IAC9E,gBAAgB;IAChB,gBAAgB;IAChB,gBAAgB;IAChB,yEAAyE;IACzE,4EAA4E;IAC5E,qEAAqE;IACrE,yEAAyE;IACzE,sCAAsC;IACtC,WAAW;IACX,aAAa;CACL,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,SAAS;CACoC,CAAC;AAGhD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAGnC,kBAAkB,CAAC,MAAM,CAC7B,CAAC,GAAG,EAA4D,EAAE,CAChE,CAAE,2BAAiD,CAAC,QAAQ,CAAC,GAAG,CAAC,CACpE,CAAC;AAEF,MAAM,UAAU,0BAA0B,CAAC,IAAkB;IAC3D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC;QAC5B,KAAK,MAAM;YACT,OAAO,iBAAiB,CAAC;QAC3B,KAAK,QAAQ;YACX,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,kFAAkF;AAElF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAGnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC;IACxC,MAAM;IACN,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,YAAY;IACZ,KAAK;IACL,YAAY;IACZ,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAGH,mFAAmF;AACnF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACnD,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IAClD,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEjD,mFAAmF;AAEnF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAGlG,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAElE,oFAAoF;AAEpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAC9E,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC;AACzE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAErF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,qBAAqB,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3F,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC3C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAGH,oFAAoF;AAEpF,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;AAE9B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IAC5D,6EAA6E;IAC7E,2EAA2E;IAC3E,4EAA4E;IAC5E,uDAAuD;IACvD,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACxB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;SAC5B,CAAC;KACH,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;IACxF,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1F,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;QACpC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC/E,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC;QAClC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;YACxC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE;SACnD,CAAC;KACH,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;QAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KACtE,CAAC;IACF,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;QAC7B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;YACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;YACpB,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,CAAC,CAAC;SAClF,CAAC;KACH,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAChC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KACjE,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC/D,CAAC;CACH,CAAC,CAAC;AAIH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;AAEnE,sFAAsF;AAEtF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEhG;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAElE,kCAAkC;AAClC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC5B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC;AAEH,uFAAuF;AAEvF,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;CAClB,CAAC,CAAC;AAGH,yFAAyF;AAEzF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;AAE5F;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,OAAO;IACP,SAAS;IACT,mBAAmB;IACnB,WAAW;IACX,SAAS;IACT,mBAAmB;IACnB,QAAQ;IACR,WAAW;CACZ,CAAC,CAAC;AAGH,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;KAC3D,QAAQ,EAAE,CAAC;AAEd,0FAA0F;AAC1F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC;AAGH,yFAAyF;AAEzF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAE/F,0FAA0F;AAE1F,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACjD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE;IACnD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE;IACrD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEzD,6FAA6F;AAE7F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAClE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAEpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;CAC5E,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;IACjC,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;AAEjH,+FAA+F;AAE/F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AAEtG,iGAAiG;AAEjG,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AAE5E,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEvD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5B,CAAC,CAAC;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,4BAA4B,CAAC,CAAC;AAEhG,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC;KACD,KAAK,EAAE,CAAC"}

package/dist/schema/settings-registry.d.ts

@@ -0,0 +1,187 @@
+/**
+ * Settings registry (07-meta-store.md §7.1): every global settings key with
+ * its Zod schema, code default, and secret flag. `adminium_settings` stores
+ * explicit overrides only — unset keys fall back to these defaults, so new
+ * releases can change defaults without data migrations.
+ */
+import { z } from 'zod';
+export interface SettingDef<T = unknown> {
+    schema: z.ZodType<T>;
+    default: T;
+    /** Sensitive fields stored encrypted; redacted in API reads (write-only from the UI). */
+    secret?: boolean;
+    /**
+     * May this key travel in a config bundle (`adminium export-zip`)?
+     *
+     * DEFAULT FALSE — the flag is opt-IN, so a key added by a future wave is NOT
+     * exportable until someone reads this comment and decides it is. That default
+     * is the point. The export used to name the *non*-portable keys instead
+     * (`INSTANCE_IDENTITY_SETTINGS`, a deny-list of two), and it rotted inside the
+     * same wave that added it: `system.superAdminCreatedAt` — the once-only
+     * first-boot CLAIM whose mere presence permanently closes `/setup/*` — was not
+     * on it, so a full-instance bundle carried the claim into fresh installs and
+     * bricked them (zero users, setup closed forever, no account creatable). See
+     * `apps/server/src/export/redaction.ts`, whose own header argues exactly this:
+     * a deny-list rots, an allow-list fails closed.
+     *
+     * The bar for `portable: true` is "this is CONFIGURATION the operator authored
+     * and would want on another instance" — not instance identity, not a bootstrap
+     * claim, not anything whose meaning is "something already happened here".
+     */
+    portable?: boolean;
+    description: string;
+}
+/**
+ * One row of the desktop capability grant table (11-electron.md §12).
+ *
+ * A grant is the record that an installed micro-SaaS manifest was consented to a
+ * host capability — `{ manifestId, capabilityId }` is its identity, `grantedAt`
+ * its audit trail. The desktop `CapabilityHost` reads these to decide whether a
+ * `capabilities.invoke` (§4) may reach a provider; a call with no matching grant
+ * is refused with `CAPABILITY_NOT_GRANTED`. The dashboard's consent step writes
+ * one and its revoke control removes one.
+ *
+ * Bounds, not free strings: `capabilityId` is a dotted id from a closed host
+ * vocabulary (`printer.escpos`, …) and `manifestId` a reverse-DNS app id, so both
+ * are short. This is the meta-store boundary; the route validates `capabilityId`
+ * against the known set on top of it.
+ */
+export declare const capabilityGrantSchema: z.ZodObject<{
+    manifestId: z.ZodString;
+    capabilityId: z.ZodString;
+    grantedAt: z.ZodNumber;
+}, z.core.$strip>;
+export declare const capabilityGrantsSchema: z.ZodArray<z.ZodObject<{
+    manifestId: z.ZodString;
+    capabilityId: z.ZodString;
+    grantedAt: z.ZodNumber;
+}, z.core.$strip>>;
+/** One consented desktop capability grant (11-electron.md §12). */
+export type CapabilityGrant = z.infer<typeof capabilityGrantSchema>;
+export declare const SETTINGS_REGISTRY: {
+    readonly 'appearance.theme': SettingDef<"light" | "dark" | "system">;
+    readonly 'appearance.accent': SettingDef<"indigo" | "blue" | "teal" | "violet" | "rose" | "red" | "orange" | "black">;
+    readonly 'appearance.density': SettingDef<"comfortable" | "compact">;
+    readonly 'locale.default': SettingDef<"en_US" | "de_DE" | "ar_EG" | "zh_CN" | "zh_TW" | "cs_CZ" | "da_DK" | "fr_FR">;
+    readonly 'branding.appName': SettingDef<string>;
+    readonly 'branding.logoFileId': SettingDef<string | null>;
+    readonly 'branding.faviconFileId': SettingDef<string | null>;
+    readonly 'auth.sessionTtlHours': SettingDef<number>;
+    readonly 'auth.require2fa': SettingDef<boolean>;
+    readonly 'auth.allowSignup': SettingDef<boolean>;
+    readonly 'auth.passwordMinLength': SettingDef<number>;
+    readonly 'email.smtp': SettingDef<{
+        host: string;
+        port: number;
+        user: string;
+        passEncrypted: string;
+        from: string;
+        secure: boolean;
+    } | null>;
+    readonly 'llm.provider': SettingDef<"anthropic" | "openai" | "openai-compatible" | "ollama" | "adminium-managed" | null>;
+    readonly 'llm.apiKey': SettingDef<string | null>;
+    readonly 'llm.model': SettingDef<string | null>;
+    readonly 'llm.baseUrl': SettingDef<string | null>;
+    readonly 'llm.maxOutputTokens': SettingDef<number | null>;
+    readonly 'retention.auditLogDays': SettingDef<number>;
+    readonly 'retention.exportsDays': SettingDef<number>;
+    readonly 'retention.webhookDeliveriesDays': SettingDef<number>;
+    readonly 'retention.automationRunsDays': SettingDef<number>;
+    readonly 'retention.notificationsDays': SettingDef<number>;
+    readonly 'retention.llmRunsDays': SettingDef<number>;
+    readonly 'retention.jobsDays': SettingDef<number>;
+    readonly 'retention.auditArchive': SettingDef<boolean>;
+    readonly 'telemetry.enabled': SettingDef<boolean>;
+    readonly 'updates.checkEnabled': SettingDef<boolean>;
+    /**
+     * The desktop shell's §5 "Skip login on this computer" answer, mirrored out of
+     * `<userData>/config.json` (11-electron.md §2.3 `singleUser`) at every boot by
+     * the composition root. `POST /api/v1/auth/desktop-session` reads THIS — the
+     * route refuses while it is false, which is what the "Require login on this
+     * device" toggle turns off.
+     *
+     * NAMING: §5 spells the key `desktop.single_user`. This registry's convention
+     * is `<domain>.<camelCase>` for all 30 of its siblings, and the key is a TS
+     * literal type here rather than a string in a doc, so it follows the code.
+     *
+     * DEFAULT FALSE — i.e. "ask for the password" — even though §2.3's `config.json`
+     * default is `true` and §6 step 3's checkbox ships ticked. That is not a
+     * contradiction, because THIS DEFAULT IS ONLY EVER REACHED WHEN THE MIRROR DID
+     * NOT RUN. When the desktop shell passes `ADMINIUM_DESKTOP_SINGLE_USER`, every
+     * boot overwrites this row with the user's real answer and the default is dead
+     * code; the only world where it decides anything is one where the wrapper
+     * failed to tell the server what the user chose.
+     *
+     * In that world the two candidate defaults fail in opposite directions:
+     *
+     *   true  ⇒ a user who explicitly turned ON "Require login on this device" is
+     *           silently auto-logged-in anyway. The control fails OPEN, against
+     *           exactly the threat it exists for (someone else at this keyboard),
+     *           and nothing anywhere says so.
+     *   false ⇒ auto-login stops working and the user sees the standard login
+     *           screen. A visible missing convenience, and their password still
+     *           opens the app.
+     *
+     * A broken promise about a password beats a broken promise about a shortcut, so
+     * the unmirrored case fails closed and loudly rather than open and silently.
+     *
+     * NEVER portable: it is per-DEVICE policy. A bundle that carried it would
+     * answer "may this machine skip its login?" using another machine's answer.
+     */
+    readonly 'desktop.singleUser': SettingDef<boolean>;
+    /**
+     * The desktop capability grant table (11-electron.md §12). Written by the
+     * consent step on manifest install and cleared by its revoke control; read by
+     * the main-process `CapabilityHost` on every `capabilities.invoke` to gate a
+     * call against a real, revocable grant.
+     *
+     * NAMING: §12 spells the `adminium_settings` key `desktop.capability_grants`.
+     * This registry's convention is `<domain>.<camelCase>` — the same override
+     * `desktop.singleUser` makes over §5's `desktop.single_user`, and for the same
+     * reason: the key is a TS literal type here, so it follows the code.
+     *
+     * NEVER portable: a grant is a per-DEVICE authorization to touch THIS machine's
+     * hardware. A bundle that carried it would silently pre-authorize an app to
+     * reach a receipt printer on a machine whose owner never consented.
+     */
+    readonly 'desktop.capabilityGrants': SettingDef<{
+        manifestId: string;
+        capabilityId: string;
+        grantedAt: number;
+    }[]>;
+    readonly 'system.instanceId': SettingDef<string | null>;
+    readonly 'system.bootstrappedAt': SettingDef<number | null>;
+    /**
+     * The first-super-admin CLAIM (M10-T04). Its row's PRESENCE — not its value —
+     * is the once-only gate: `createFirstSuperAdmin` INSERTs it inside the same
+     * transaction that creates the user, so the `key` PRIMARY KEY makes a second
+     * (or concurrent) bootstrap attempt fail atomically on every dialect. Never
+     * `set()` this key from application code.
+     *
+     * NEVER portable, for the same reason it is never `set()`: importing it into
+     * an instance with zero users closes `/setup/*` (409) forever, so no super
+     * admin can be created and nobody can log in. The instance is scrap.
+     */
+    readonly 'system.superAdminCreatedAt': SettingDef<number | null>;
+    /**
+     * The bundle FORMAT version of this store. Not portable: the target records
+     * its own, and the version a bundle was written at already travels in the
+     * manifest (`BundleManifest.configVersion`), which is what replay reads.
+     * Copying the source's value would let an old bundle silently downgrade the
+     * number a newer target reports about itself.
+     */
+    readonly 'system.configVersion': SettingDef<number>;
+};
+export type SettingsRegistry = typeof SETTINGS_REGISTRY;
+export type SettingKey = keyof SettingsRegistry;
+export type SettingValue<K extends SettingKey> = SettingsRegistry[K] extends SettingDef<infer T> ? T : never;
+export declare const SETTING_KEYS: SettingKey[];
+export declare function isSettingKey(key: string): key is SettingKey;
+export declare function isSecretSettingKey(key: SettingKey): boolean;
+/**
+ * True when the registry declares `key` safe to carry in a config bundle.
+ * Opt-in, so an undeclared (i.e. new) key is never exported — see
+ * {@link SettingDef.portable}.
+ */
+export declare function isPortableSettingKey(key: SettingKey): boolean;
+//# sourceMappingURL=settings-registry.d.ts.map

package/dist/schema/settings-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings-registry.d.ts","sourceRoot":"","sources":["../../src/schema/settings-registry.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,MAAM,WAAW,UAAU,CAAC,CAAC,GAAG,OAAO;IACrC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,OAAO,EAAE,CAAC,CAAC;IACX,yFAAyF;IACzF,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAwCD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAC;AACH,eAAO,MAAM,sBAAsB;;;;kBAAiC,CAAC;AAErE,mEAAmE;AACnE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAuC5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;;IAEH;;;;;;;;;;;;;;OAcG;;;;;;;;IAQH;;;;;;;;;;OAUG;;IAEH;;;;;;OAMG;;CAEK,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG,OAAO,iBAAiB,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC;AAChD,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,UAAU,IAAI,gBAAgB,CAAC,CAAC,CAAC,SAAS,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAE7G,eAAO,MAAM,YAAY,EAAqC,UAAU,EAAE,CAAC;AAE3E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,IAAI,UAAU,CAE3D;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAE3D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAE7D"}