@adminiumjs/meta 0.2.2-rc.0 → 0.2.3

package/dist/repos/public-api.d.ts

@@ -0,0 +1,140 @@
+/**
+ * publicScopesRepo / publicKeysRepo — the public surface's meta rows
+ * (28-public-surface.md §3.2–§3.3, migration `0014_public_surface`).
+ *
+ * Deliberately NOT part of `apiKeysRepo`. A publishable key differs from an
+ * `adm_sk_` key in two ways that both reach the storage layer: its secret is
+ * re-readable, and it must never be resolvable as an `RbacPrincipal` (D3).
+ * Sharing a repo would put both kinds one `where` clause apart, which is how a
+ * later "unify the key lookup" change would quietly break the property the
+ * whole off switch rests on.
+ */
+import type { Selectable } from 'kysely';
+import type { MetaDb } from '../connect.js';
+import type { AdminiumPublicKeysTable, AdminiumPublicScopesTable, AdminiumPublicSessionsTable } from '../schema/tables.js';
+export type PublicScope = Selectable<AdminiumPublicScopesTable>;
+export type PublicKey = Selectable<AdminiumPublicKeysTable>;
+export type PublicSession = Selectable<AdminiumPublicSessionsTable>;
+export interface CreatePublicScopeInput {
+    connectionId: string;
+    side: string;
+    name: string;
+    /** Canonical IANA zone; the compiler refuses anything else. */
+    timezone: string;
+    /** The scope document, already serialized. */
+    document: string;
+    proposedFromManifest?: string | null;
+    createdBy?: string | null;
+}
+export declare function publicScopesRepo(meta: MetaDb): {
+    create(input: CreatePublicScopeInput, at?: number): Promise<PublicScope>;
+    findById(id: string): Promise<PublicScope | null>;
+    list(): Promise<PublicScope[]>;
+    listByConnection(connectionId: string): Promise<PublicScope[]>;
+    update(id: string, patch: {
+        name?: string;
+        timezone?: string;
+        document?: string;
+    }, at?: number): Promise<boolean>;
+    /**
+     * Deleting a scope is refused while a key points at it — the FK is
+     * `restrict`, so this surfaces the constraint as `false` rather than as a
+     * driver error. Revoking the key first is the intended order, because it
+     * makes the operator see what they are about to break.
+     */
+    remove(id: string): Promise<boolean>;
+};
+export interface CreatePublicKeyInput {
+    name: string;
+    /** Display/lookup fragment, e.g. `adm_pub_4f2a91cd`. */
+    prefix: string;
+    tokenHash: string;
+    /** AES-GCM envelope of the full token — the re-readable copy. */
+    tokenEncrypted: string;
+    scopeId: string;
+    side: string;
+    /** Hosted app surface this key is bound to (29 D10), or absent/null. */
+    appKey?: string | null;
+    /** JSON array narrowing the instance origin list; `[]` = no narrowing. */
+    origins?: string[];
+    createdBy?: string | null;
+    expiresAt?: number | null;
+}
+export declare function publicKeysRepo(meta: MetaDb): {
+    create(input: CreatePublicKeyInput, at?: number): Promise<PublicKey>;
+    /**
+     * The AUTH lookup, by prefix.
+     *
+     * Returns every candidate rather than filtering on the hash in SQL, because
+     * the caller compares hashes in CONSTANT TIME. A `where tokenHash = ?`
+     * makes the database do a byte comparison whose timing an attacker can
+     * measure; the prefix is a public display fragment and leaks nothing.
+     *
+     * Revocation and expiry are NOT filtered here either — the caller decides,
+     * so it can answer every failure identically on the wire (§3.2) instead of
+     * letting "no row" and "revoked row" take different code paths.
+     */
+    findByPrefix(prefix: string): Promise<PublicKey[]>;
+    findById(id: string): Promise<PublicKey | null>;
+    listByScope(scopeId: string): Promise<PublicKey[]>;
+    /**
+     * The `surface-config.json` lookup (29 D10): the newest key for this app's
+     * side that is neither revoked nor expired. Rotation keeps the row (and so
+     * the binding); revoking the newest key falls back to the next live one, so
+     * an operator can stage a replacement before killing the old key.
+     */
+    /**
+     * The newest live key for an app whose SCOPE points at one connection.
+     *
+     * What `newestLiveByApp` answers once per app, this answers once per
+     * database — the customer half of app instances (29 D9). A customer surface
+     * has never named its connection directly and does not start now: its key
+     * names a scope and the scope names the connection, so selecting the right
+     * key IS selecting the right database, and nothing new has to be kept in
+     * sync with anything.
+     *
+     * A join, not two queries: the pair "newest, and belonging to this
+     * connection" has to be decided together, or a scope moved between
+     * connections could hand back a key that was newest but no longer relevant.
+     */
+    newestLiveByAppAndConnection(appKey: string, side: string, connectionId: string, at?: number): Promise<PublicKey | null>;
+    newestLiveByApp(appKey: string, side: string, at?: number): Promise<PublicKey | null>;
+    list(): Promise<PublicKey[]>;
+    /** Rotation: a new secret against the same row, keeping scope and origins. */
+    rotate(id: string, next: {
+        prefix: string;
+        tokenHash: string;
+        tokenEncrypted: string;
+    }, at?: number): Promise<boolean>;
+    revoke(id: string, at?: number): Promise<boolean>;
+    /** Throttled by the caller, like session and api-key touches. */
+    touchLastUsed(id: string, at?: number): Promise<void>;
+};
+export interface CreatePublicSessionInput {
+    keyId: string;
+    tokenHash: string;
+    /** The RESOLVED claim — see the table comment on why it is not re-derived. */
+    grants: string;
+    expiresAt: number;
+}
+export declare function publicSessionsRepo(meta: MetaDb): {
+    create(input: CreatePublicSessionInput, at?: number): Promise<PublicSession>;
+    /**
+     * Resolve a session token.
+     *
+     * Unlike `publicKeysRepo.findByPrefix`, matching on the hash in SQL is fine
+     * here: a session token has no public display fragment to look up by, so
+     * there is nothing to narrow on first. Expiry IS filtered, because an
+     * expired session and an unknown one are the same thing to the caller and
+     * there is no reason to carry the difference back up.
+     */
+    findValid(tokenHash: string, at?: number): Promise<PublicSession | null>;
+    touch(id: string, at?: number): Promise<void>;
+    remove(tokenHash: string): Promise<boolean>;
+    /** Housekeeping: drop everything that has lapsed. */
+    purgeExpired(at?: number): Promise<number>;
+};
+export type PublicSessionsRepo = ReturnType<typeof publicSessionsRepo>;
+export type PublicScopesRepo = ReturnType<typeof publicScopesRepo>;
+export type PublicKeysRepo = ReturnType<typeof publicKeysRepo>;
+//# sourceMappingURL=public-api.d.ts.map

package/dist/repos/public-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-api.d.ts","sourceRoot":"","sources":["../../src/repos/public-api.ts"],"names":[],"mappings":"AACA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EACV,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,yBAAyB,CAAC,CAAC;AAChE,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAEpE,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAyBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM;kBAGrB,sBAAsB,OAAM,MAAM,GAAgB,OAAO,CAAC,WAAW,CAAC;iBAiBvE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;YASzC,OAAO,CAAC,WAAW,EAAE,CAAC;mCASC,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;eAW9D,MAAM,SACH;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,OAC1D,MAAM,GACT,OAAO,CAAC,OAAO,CAAC;IASnB;;;;;OAKG;eACc,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAc7C;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM;kBAGnB,oBAAoB,OAAM,MAAM,GAAgB,OAAO,CAAC,SAAS,CAAC;IAsBtF;;;;;;;;;;;OAWG;yBACwB,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;iBAQrC,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;yBAS1B,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IASxD;;;;;OAKG;IACH;;;;;;;;;;;;;OAaG;yCAEO,MAAM,QACR,MAAM,gBACE,MAAM,OAChB,MAAM,GACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;4BAyBlB,MAAM,QACR,MAAM,OACR,MAAM,GACT,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;YAad,OAAO,CAAC,SAAS,EAAE,CAAC;IAIlC,8EAA8E;eAExE,MAAM,QACJ;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,OAC/D,MAAM,GACT,OAAO,CAAC,OAAO,CAAC;eAUF,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAUnE,iEAAiE;sBACzC,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;EAI1E;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM;kBAGvB,wBAAwB,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,CAAC;IAc9F;;;;;;;;OAQG;yBACwB,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;cAU1E,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;sBAIvC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQjD,qDAAqD;sBAC9B,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQ/D;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACvE,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACnE,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/repos/public-api.js

@@ -0,0 +1,299 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * publicScopesRepo / publicKeysRepo — the public surface's meta rows
+ * (28-public-surface.md §3.2–§3.3, migration `0014_public_surface`).
+ *
+ * Deliberately NOT part of `apiKeysRepo`. A publishable key differs from an
+ * `adm_sk_` key in two ways that both reach the storage layer: its secret is
+ * re-readable, and it must never be resolvable as an `RbacPrincipal` (D3).
+ * Sharing a repo would put both kinds one `where` clause apart, which is how a
+ * later "unify the key lookup" change would quietly break the property the
+ * whole off switch rests on.
+ */
+import { newId } from '../ids.js';
+/**
+ * A `json` column does not come back the same shape on every store.
+ *
+ * postgres and mysql hand back a PARSED value; sqlite hands back the text it
+ * stored. `PublicScope.document` is declared `string` and every caller treats
+ * it as one — `resolve.ts` calls `JSON.parse` on it, and the admin route
+ * returns it under a `z.string()` response schema — so on the two production
+ * stores that parse threw and that response failed validation, while the whole
+ * suite stayed green on sqlite. Found by CI, which runs all three; the local
+ * run skipped 334 store-gated tests.
+ *
+ * Normalising here rather than at each caller is the point of a repo layer:
+ * the driver difference is this file's business and nobody else's.
+ */
+function jsonText(value) {
+    return typeof value === "string" ? value : JSON.stringify(value);
+}
+/** One scope row, with its document normalised to text whatever the store did. */
+function scopeRow(row) {
+    return { ...row, document: jsonText(row.document) };
+}
+export function publicScopesRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('psc'),
+                connectionId: input.connectionId,
+                side: input.side,
+                name: input.name,
+                timezone: input.timezone,
+                document: input.document,
+                proposedFromManifest: input.proposedFromManifest ?? null,
+                createdBy: input.createdBy ?? null,
+                createdAt: at,
+                updatedAt: at,
+            };
+            await db.insertInto('adminium_public_scopes').values(row).execute();
+            return row;
+        },
+        async findById(id) {
+            const row = await db
+                .selectFrom('adminium_public_scopes')
+                .selectAll()
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return row === undefined ? null : scopeRow(row);
+        },
+        async list() {
+            const rows = await db
+                .selectFrom('adminium_public_scopes')
+                .selectAll()
+                .orderBy('createdAt', 'desc')
+                .execute();
+            return rows.map(scopeRow);
+        },
+        async listByConnection(connectionId) {
+            const rows = await db
+                .selectFrom('adminium_public_scopes')
+                .selectAll()
+                .where('connectionId', '=', connectionId)
+                .orderBy('createdAt', 'desc')
+                .execute();
+            return rows.map(scopeRow);
+        },
+        async update(id, patch, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_public_scopes')
+                .set({ ...patch, updatedAt: at })
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        /**
+         * Deleting a scope is refused while a key points at it — the FK is
+         * `restrict`, so this surfaces the constraint as `false` rather than as a
+         * driver error. Revoking the key first is the intended order, because it
+         * makes the operator see what they are about to break.
+         */
+        async remove(id) {
+            const attached = await db
+                .selectFrom('adminium_public_keys')
+                .select('id')
+                .where('scopeId', '=', id)
+                .executeTakeFirst();
+            if (attached !== undefined)
+                return false;
+            const res = await db
+                .deleteFrom('adminium_public_scopes')
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows) === 1;
+        },
+    };
+}
+export function publicKeysRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('pbk'),
+                name: input.name,
+                prefix: input.prefix,
+                tokenHash: input.tokenHash,
+                tokenEncrypted: input.tokenEncrypted,
+                scopeId: input.scopeId,
+                side: input.side,
+                appKey: input.appKey ?? null,
+                origins: JSON.stringify(input.origins ?? []),
+                expiresAt: input.expiresAt ?? null,
+                revokedAt: null,
+                lastUsedAt: null,
+                createdBy: input.createdBy ?? null,
+                createdAt: at,
+                updatedAt: at,
+            };
+            await db.insertInto('adminium_public_keys').values(row).execute();
+            return row;
+        },
+        /**
+         * The AUTH lookup, by prefix.
+         *
+         * Returns every candidate rather than filtering on the hash in SQL, because
+         * the caller compares hashes in CONSTANT TIME. A `where tokenHash = ?`
+         * makes the database do a byte comparison whose timing an attacker can
+         * measure; the prefix is a public display fragment and leaks nothing.
+         *
+         * Revocation and expiry are NOT filtered here either — the caller decides,
+         * so it can answer every failure identically on the wire (§3.2) instead of
+         * letting "no row" and "revoked row" take different code paths.
+         */
+        async findByPrefix(prefix) {
+            return db
+                .selectFrom('adminium_public_keys')
+                .selectAll()
+                .where('prefix', '=', prefix)
+                .execute();
+        },
+        async findById(id) {
+            const row = await db
+                .selectFrom('adminium_public_keys')
+                .selectAll()
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        async listByScope(scopeId) {
+            return db
+                .selectFrom('adminium_public_keys')
+                .selectAll()
+                .where('scopeId', '=', scopeId)
+                .orderBy('createdAt', 'desc')
+                .execute();
+        },
+        /**
+         * The `surface-config.json` lookup (29 D10): the newest key for this app's
+         * side that is neither revoked nor expired. Rotation keeps the row (and so
+         * the binding); revoking the newest key falls back to the next live one, so
+         * an operator can stage a replacement before killing the old key.
+         */
+        /**
+         * The newest live key for an app whose SCOPE points at one connection.
+         *
+         * What `newestLiveByApp` answers once per app, this answers once per
+         * database — the customer half of app instances (29 D9). A customer surface
+         * has never named its connection directly and does not start now: its key
+         * names a scope and the scope names the connection, so selecting the right
+         * key IS selecting the right database, and nothing new has to be kept in
+         * sync with anything.
+         *
+         * A join, not two queries: the pair "newest, and belonging to this
+         * connection" has to be decided together, or a scope moved between
+         * connections could hand back a key that was newest but no longer relevant.
+         */
+        async newestLiveByAppAndConnection(appKey, side, connectionId, at = Date.now()) {
+            const row = await db
+                .selectFrom('adminium_public_keys')
+                .innerJoin('adminium_public_scopes', 'adminium_public_scopes.id', 'adminium_public_keys.scopeId')
+                .selectAll('adminium_public_keys')
+                .where('adminium_public_keys.appKey', '=', appKey)
+                .where('adminium_public_keys.side', '=', side)
+                .where('adminium_public_scopes.connectionId', '=', connectionId)
+                .where('adminium_public_keys.revokedAt', 'is', null)
+                .where((eb) => eb.or([
+                eb('adminium_public_keys.expiresAt', 'is', null),
+                eb('adminium_public_keys.expiresAt', '>', at),
+            ]))
+                .orderBy('adminium_public_keys.createdAt', 'desc')
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        async newestLiveByApp(appKey, side, at = Date.now()) {
+            const row = await db
+                .selectFrom('adminium_public_keys')
+                .selectAll()
+                .where('appKey', '=', appKey)
+                .where('side', '=', side)
+                .where('revokedAt', 'is', null)
+                .where((eb) => eb.or([eb('expiresAt', 'is', null), eb('expiresAt', '>', at)]))
+                .orderBy('createdAt', 'desc')
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        async list() {
+            return db.selectFrom('adminium_public_keys').selectAll().orderBy('createdAt', 'desc').execute();
+        },
+        /** Rotation: a new secret against the same row, keeping scope and origins. */
+        async rotate(id, next, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_public_keys')
+                .set({ ...next, updatedAt: at })
+                .where('id', '=', id)
+                .where('revokedAt', 'is', null)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        async revoke(id, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_public_keys')
+                .set({ revokedAt: at, updatedAt: at })
+                .where('id', '=', id)
+                .where('revokedAt', 'is', null)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        /** Throttled by the caller, like session and api-key touches. */
+        async touchLastUsed(id, at = Date.now()) {
+            await db.updateTable('adminium_public_keys').set({ lastUsedAt: at }).where('id', '=', id).execute();
+        },
+    };
+}
+export function publicSessionsRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('pss'),
+                keyId: input.keyId,
+                tokenHash: input.tokenHash,
+                grants: input.grants,
+                expiresAt: input.expiresAt,
+                createdAt: at,
+                lastSeenAt: null,
+            };
+            await db.insertInto('adminium_public_sessions').values(row).execute();
+            return row;
+        },
+        /**
+         * Resolve a session token.
+         *
+         * Unlike `publicKeysRepo.findByPrefix`, matching on the hash in SQL is fine
+         * here: a session token has no public display fragment to look up by, so
+         * there is nothing to narrow on first. Expiry IS filtered, because an
+         * expired session and an unknown one are the same thing to the caller and
+         * there is no reason to carry the difference back up.
+         */
+        async findValid(tokenHash, at = Date.now()) {
+            const row = await db
+                .selectFrom('adminium_public_sessions')
+                .selectAll()
+                .where('tokenHash', '=', tokenHash)
+                .where('expiresAt', '>', at)
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        async touch(id, at = Date.now()) {
+            await db.updateTable('adminium_public_sessions').set({ lastSeenAt: at }).where('id', '=', id).execute();
+        },
+        async remove(tokenHash) {
+            const res = await db
+                .deleteFrom('adminium_public_sessions')
+                .where('tokenHash', '=', tokenHash)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows) > 0;
+        },
+        /** Housekeeping: drop everything that has lapsed. */
+        async purgeExpired(at = Date.now()) {
+            const res = await db
+                .deleteFrom('adminium_public_sessions')
+                .where('expiresAt', '<=', at)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows);
+        },
+    };
+}
+//# sourceMappingURL=public-api.js.map

package/dist/repos/public-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-api.js","sourceRoot":"","sources":["../../src/repos/public-api.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAuBlC;;;;;;;;;;;;;GAaG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAgB;IAChC,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA6B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACjE,MAAM,GAAG,GAAgB;gBACvB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;gBACxD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,SAAS,EAAE;iBACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,SAAS,EAAE;iBACX,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;YACzC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,SAAS,EAAE;iBACX,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;iBACxC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAA8D,EAC9D,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,wBAAwB,CAAC;iBACrC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAChC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,UAAU,CAAC,sBAAsB,CAAC;iBAClC,MAAM,CAAC,IAAI,CAAC;iBACZ,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;iBACzB,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAmBD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA2B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC/D,MAAM,GAAG,GAAc;gBACrB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI;gBAC5B,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAClE,OAAO,GAAG,CAAC;QACb,CAAC;QAED;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,OAAO,EAAE;iBACN,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,EAAE;iBACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,EAAE;iBACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAAe;YAC/B,OAAO,EAAE;iBACN,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,EAAE;iBACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;iBAC9B,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;QACf,CAAC;QAED;;;;;WAKG;QACH;;;;;;;;;;;;;WAaG;QACH,KAAK,CAAC,4BAA4B,CAChC,MAAc,EACd,IAAY,EACZ,YAAoB,EACpB,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,CACR,wBAAwB,EACxB,2BAA2B,EAC3B,8BAA8B,CAC/B;iBACA,SAAS,CAAC,sBAAsB,CAAC;iBACjC,KAAK,CAAC,6BAA6B,EAAE,GAAG,EAAE,MAAM,CAAC;iBACjD,KAAK,CAAC,2BAA2B,EAAE,GAAG,EAAE,IAAI,CAAC;iBAC7C,KAAK,CAAC,qCAAqC,EAAE,GAAG,EAAE,YAAY,CAAC;iBAC/D,KAAK,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,CAAC;iBACnD,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CACZ,EAAE,CAAC,EAAE,CAAC;gBACJ,EAAE,CAAC,gCAAgC,EAAE,IAAI,EAAE,IAAI,CAAC;gBAChD,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE,EAAE,CAAC;aAC9C,CAAC,CACH;iBACA,OAAO,CAAC,gCAAgC,EAAE,MAAM,CAAC;iBACjD,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,eAAe,CACnB,MAAc,EACd,IAAY,EACZ,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,EAAE;iBACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC;iBACxB,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;iBAC7E,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,IAAI;YACR,OAAO,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAClG,CAAC;QAED,8EAA8E;QAC9E,KAAK,CAAC,MAAM,CACV,EAAU,EACV,IAAmE,EACnE,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,sBAAsB,CAAC;iBACnC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC9C,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,sBAAsB,CAAC;iBACnC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACrC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,iEAAiE;QACjE,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACrD,MAAM,EAAE,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACtG,CAAC;KACF,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA+B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAkB;gBACzB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACxD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,SAAS,EAAE;iBACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1G,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,SAAiB;YAC5B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,qDAAqD;QACrD,KAAK,CAAC,YAAY,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YACxC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/schema/json-payloads.d.ts

@@ -16,6 +16,30 @@ export declare const recordRefSchema: z.ZodObject<{
     label: z.ZodString;
 }, z.core.$strip>;
 export type RecordRef = z.infer<typeof recordRefSchema>;
+/**
+ * Width of the denormalized `adminium_audit_log.entity_table` / `entity_id`
+ * columns (30-record-pages.md WS-A). 200 chars keeps the composite index
+ * inside MySQL's 3072-byte InnoDB cap under utf8mb4 (2 × 200 × 4 + 8).
+ */
+export declare const AUDIT_ENTITY_KEY_MAX = 200;
+/**
+ * Canonical clamp for one audit entity key part. Applied on the WRITE side
+ * (append + backfill) and again on the QUERY side, so an over-long id still
+ * matches the row it wrote — truncation is consistent, never one-sided.
+ */
+export declare function auditEntityKeyPart(value: string): string;
+/**
+ * The denormalized per-record audit key derived from a RecordRef (30 WS-A).
+ *
+ * `entityId` reproduces the canonical `:recordId` string both sides already
+ * use — `pkLabel` on the server, `rowIdOf` in the grid: a single-column PK is
+ * its stringified value, a composite PK is the JSON tuple of its values in pk
+ * insertion order (the order both writers build the map in).
+ */
+export declare function auditEntityKeyOf(ref: Pick<RecordRef, 'table' | 'pk'>): {
+    entityTable: string;
+    entityId: string;
+};
 /** The eight COMPILED locales. Still a closed set — see `builtinLocaleSchema`. */
 export declare const LOCALES: readonly ["en_US", "de_DE", "ar_EG", "zh_CN", "zh_TW", "cs_CZ", "da_DK", "fr_FR"];
 export declare const builtinLocaleSchema: z.ZodEnum<{
@@ -140,7 +164,7 @@ export declare const systemActionKeySchema: z.ZodEnum<{
  * {@link GRANTABLE_SYSTEM_ACTION_KEYS}; move a key out of here in the same
  * change that lands its first enforcement point.
  */
-export declare const RESERVED_SYSTEM_ACTION_KEYS: readonly ["automations.manage", "webhooks.manage", "manifests.manage", "sql.run"];
+export declare const RESERVED_SYSTEM_ACTION_KEYS: readonly ["automations.manage", "webhooks.manage", "sql.run"];
 export type ReservedSystemActionKey = (typeof RESERVED_SYSTEM_ACTION_KEYS)[number];
 /**
  * What a role editor / permissions surface may offer: the closed set minus
@@ -169,6 +193,7 @@ export declare const auditCategorySchema: z.ZodEnum<{
     rbac: "rbac";
     connection: "connection";
     llm: "llm";
+    "add-on": "add-on";
 }>;
 export type AuditCategory = z.infer<typeof auditCategorySchema>;
 /** `{ before, after }` images; PII-masked upstream; capped at 16 KB serialized. */
@@ -376,11 +401,11 @@ export declare const llmValidationStatusSchema: z.ZodEnum<{
  */
 export declare const llmRunStatusSchema: z.ZodEnum<{
     draft: "draft";
-    applied: "applied";
     running: "running";
     failed: "failed";
     awaiting_response: "awaiting_response";
     validated: "validated";
+    applied: "applied";
     partially_applied: "partially_applied";
     discarded: "discarded";
 }>;

package/dist/schema/json-payloads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"json-payloads.d.ts","sourceRoot":"","sources":["../../src/schema/json-payloads.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,0EAA0E;AAC1E,eAAO,MAAM,eAAe;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,kFAAkF;AAClF,eAAO,MAAM,OAAO,mFAAoF,CAAC;AACzG,eAAO,MAAM,mBAAmB;;;;;;;;;EAAkB,CAAC;AACnD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,8EAA8E;AAC9E,eAAO,MAAM,YAAY,QAAyC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,aAAgD,CAAC;AAC1E,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,eAAO,MAAM,WAAW;;;;EAAsC,CAAC;AAC/D,eAAO,MAAM,YAAY;;;;;;;;;EAAiF,CAAC;AAC3G,eAAO,MAAM,aAAa;;;EAAqC,CAAC;AAChE,eAAO,MAAM,SAAS;;;EAAyB,CAAC;AAIhD,eAAO,MAAM,gBAAgB;;;;EAA6C,CAAC;AAC3E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,gCAAgC;AAChC,eAAO,MAAM,mBAAmB,yBAAsB,CAAC;AAEvD,sFAAsF;AACtF,eAAO,MAAM,aAAa,wCAAoC,CAAC;AAI/D,eAAO,MAAM,kBAAkB;;;;EAAsC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;iBAG5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,WAAW,GAAG,aAAa,CAAC;AAE3E,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,0TAkCrB,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;EAA6B,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,mFAKO,CAAC;AAChD,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,OAAO,CACzD,eAAe,EACf,uBAAuB,CACxB,EAGA,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAS3F;AAID,eAAO,MAAM,eAAe;;;;;EAAsD,CAAC;AACnF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,mBAAmB;;;;;;;;;;;EAW9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,mFAAmF;AACnF,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAIjD,eAAO,MAAM,eAAe;;;;;;EAAqE,CAAC;AAClG,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,wCAAoC,CAAC;AAIlE,eAAO,MAAM,sBAAsB;;;;EAA0C,CAAC;AAC9E,eAAO,MAAM,0BAA0B;;;EAAiC,CAAC;AACzE,eAAO,MAAM,sBAAsB;;;;EAAiD,CAAC;AAErF,eAAO,MAAM,mBAAmB;;;;;;;iBAG9B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAKnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAiD9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;AAE7C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;EAAkC,CAAC;AACpE,eAAO,MAAM,oBAAoB;;;EAAiC,CAAC;AAInE,eAAO,MAAM,gBAAgB;;;;;;EAA6D,CAAC;AAC3F,eAAO,MAAM,cAAc;;;;;;EAAoE,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wCAAoC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,gBAAgB;;;;;;iBAM3B,CAAC;AAIH,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,eAAO,MAAM,gBAAgB;;;EAA8B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;EAAqD,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;EAS7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,yBAAsB,CAAC;AACxD,eAAO,MAAM,mBAAmB,yBAA6B,CAAC;AAC9D,eAAO,MAAM,oBAAoB;;kBAEpB,CAAC;AAEd,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;EAAwD,CAAC;AAI/F,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAM/B,CAAC;AAEH,eAAO,MAAM,sBAAsB,yBAAsB,CAAC;AAC1D,eAAO,MAAM,kBAAkB;;;EAAyB,CAAC;AAIzD,eAAO,MAAM,kBAAkB;;;;;;;;;iBAK7B,CAAC;AACH,eAAO,MAAM,kBAAkB;;;;EAAkC,CAAC;AAClE,eAAO,MAAM,kBAAkB;;;;;;EAAoE,CAAC;AAEpG,eAAO,MAAM,mBAAmB;;;;;iBAE9B,CAAC;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAI9B,CAAC;AACH,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AACH,eAAO,MAAM,kBAAkB;;;;;;;EAAiF,CAAC;AAIjH,eAAO,MAAM,cAAc;;;;;;;EAA0E,CAAC;AAItG,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,oDAA6C,CAAC;AAE5E,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,yBAAsB,CAAC;AAEvD,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AACH,eAAO,MAAM,6BAA6B;;;;kBAAqD,CAAC;AAEhG,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB;;;;iBAMpB,CAAC"}
+{"version":3,"file":"json-payloads.d.ts","sourceRoot":"","sources":["../../src/schema/json-payloads.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,0EAA0E;AAC1E,eAAO,MAAM,eAAe;;;;;iBAQ1B,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,MAAM,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC,GAAG;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAIA;AAED,kFAAkF;AAClF,eAAO,MAAM,OAAO,mFAAoF,CAAC;AACzG,eAAO,MAAM,mBAAmB;;;;;;;;;EAAkB,CAAC;AACnD,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,8EAA8E;AAC9E,eAAO,MAAM,YAAY,QAAyC,CAAC;AAEnE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY,aAAgD,CAAC;AAC1E,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,eAAO,MAAM,WAAW;;;;EAAsC,CAAC;AAC/D,eAAO,MAAM,YAAY;;;;;;;;;EAAiF,CAAC;AAC3G,eAAO,MAAM,aAAa;;;EAAqC,CAAC;AAChE,eAAO,MAAM,SAAS;;;EAAyB,CAAC;AAIhD,eAAO,MAAM,gBAAgB;;;;EAA6C,CAAC;AAC3E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,gCAAgC;AAChC,eAAO,MAAM,mBAAmB,yBAAsB,CAAC;AAEvD,sFAAsF;AACtF,eAAO,MAAM,aAAa,wCAAoC,CAAC;AAI/D,eAAO,MAAM,kBAAkB;;;;EAAsC,CAAC;AACtE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,kBAAkB;;;;;;;iBAO7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,iBAAiB;;;iBAG5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D,+DAA+D;AAC/D,eAAO,MAAM,mBAAmB;;iBAE9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,WAAW,GAAG,aAAa,CAAC;AAE3E,0EAA0E;AAC1E,eAAO,MAAM,kBAAkB,0TAkCrB,CAAC;AACX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;EAA6B,CAAC;AAEhE;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,2BAA2B,+DASO,CAAC;AAChD,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnF;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,SAAS,OAAO,CACzD,eAAe,EACf,uBAAuB,CACxB,EAGA,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,YAAY,GAAG,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAS3F;AAID,eAAO,MAAM,eAAe;;;;;EAAsD,CAAC;AACnF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;EAmB9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,mFAAmF;AACnF,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,oEAAoE;AACpE,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAIjD,eAAO,MAAM,eAAe;;;;;;EAAqE,CAAC;AAClG,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,wCAAoC,CAAC;AAIlE,eAAO,MAAM,sBAAsB;;;;EAA0C,CAAC;AAC9E,eAAO,MAAM,0BAA0B;;;EAAiC,CAAC;AACzE,eAAO,MAAM,sBAAsB;;;;EAAiD,CAAC;AAErF,eAAO,MAAM,mBAAmB;;;;;;;iBAG9B,CAAC;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;iBAKnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAiD9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;AAE7C;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB;;;;EAAkC,CAAC;AACpE,eAAO,MAAM,oBAAoB;;;EAAiC,CAAC;AAInE,eAAO,MAAM,gBAAgB;;;;;;EAA6D,CAAC;AAC3F,eAAO,MAAM,cAAc;;;;;;EAAoE,CAAC;AAEhG;;;GAGG;AACH,eAAO,MAAM,gBAAgB,wCAAoC,CAAC;AAElE,kCAAkC;AAClC,eAAO,MAAM,gBAAgB;;;;;;iBAM3B,CAAC;AAIH,eAAO,MAAM,0BAA0B;;;;iBAIrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAI9E,eAAO,MAAM,gBAAgB;;;EAA8B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;;;EAAqD,CAAC;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;EAS7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,oGAAoG;AACpG,eAAO,MAAM,oBAAoB,yBAAsB,CAAC;AACxD,eAAO,MAAM,mBAAmB,yBAA6B,CAAC;AAC9D,eAAO,MAAM,oBAAoB;;kBAEpB,CAAC;AAEd,0FAA0F;AAC1F,eAAO,MAAM,kBAAkB;;;iBAG7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAI9D,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AAEH,eAAO,MAAM,yBAAyB;;;;;EAAwD,CAAC;AAI/F,eAAO,MAAM,oBAAoB;;;;;;;;;;iBAM/B,CAAC;AAEH,eAAO,MAAM,sBAAsB,yBAAsB,CAAC;AAC1D,eAAO,MAAM,kBAAkB;;;EAAyB,CAAC;AAIzD,eAAO,MAAM,kBAAkB;;;;;;;;;iBAK7B,CAAC;AACH,eAAO,MAAM,kBAAkB;;;;EAAkC,CAAC;AAClE,eAAO,MAAM,kBAAkB;;;;;;EAAoE,CAAC;AAEpG,eAAO,MAAM,mBAAmB;;;;;iBAE9B,CAAC;AACH,eAAO,MAAM,mBAAmB;;;;;;;iBAI9B,CAAC;AACH,eAAO,MAAM,iBAAiB;;;;;iBAK5B,CAAC;AACH,eAAO,MAAM,kBAAkB;;;;;;;EAAiF,CAAC;AAIjH,eAAO,MAAM,cAAc;;;;;;;EAA0E,CAAC;AAItG,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,oDAA6C,CAAC;AAE5E,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,yBAAsB,CAAC;AAEvD,eAAO,MAAM,4BAA4B;;;;iBAIvC,CAAC;AACH,eAAO,MAAM,6BAA6B;;;;kBAAqD,CAAC;AAEhG,6EAA6E;AAC7E,eAAO,MAAM,iBAAiB;;;;iBAMpB,CAAC"}

package/dist/schema/json-payloads.js

@@ -20,6 +20,33 @@ export const recordRefSchema = z.object({
     /** Display snapshot taken at write time. */
     label: z.string(),
 });
+/**
+ * Width of the denormalized `adminium_audit_log.entity_table` / `entity_id`
+ * columns (30-record-pages.md WS-A). 200 chars keeps the composite index
+ * inside MySQL's 3072-byte InnoDB cap under utf8mb4 (2 × 200 × 4 + 8).
+ */
+export const AUDIT_ENTITY_KEY_MAX = 200;
+/**
+ * Canonical clamp for one audit entity key part. Applied on the WRITE side
+ * (append + backfill) and again on the QUERY side, so an over-long id still
+ * matches the row it wrote — truncation is consistent, never one-sided.
+ */
+export function auditEntityKeyPart(value) {
+    return value.length > AUDIT_ENTITY_KEY_MAX ? value.slice(0, AUDIT_ENTITY_KEY_MAX) : value;
+}
+/**
+ * The denormalized per-record audit key derived from a RecordRef (30 WS-A).
+ *
+ * `entityId` reproduces the canonical `:recordId` string both sides already
+ * use — `pkLabel` on the server, `rowIdOf` in the grid: a single-column PK is
+ * its stringified value, a composite PK is the JSON tuple of its values in pk
+ * insertion order (the order both writers build the map in).
+ */
+export function auditEntityKeyOf(ref) {
+    const values = Object.values(ref.pk);
+    const id = values.length === 1 ? String(values[0]) : JSON.stringify(values);
+    return { entityTable: auditEntityKeyPart(ref.table), entityId: auditEntityKeyPart(id) };
+}
 /** The eight COMPILED locales. Still a closed set — see `builtinLocaleSchema`. */
 export const LOCALES = ['en_US', 'de_DE', 'ar_EG', 'zh_CN', 'zh_TW', 'cs_CZ', 'da_DK', 'fr_FR'];
 export const builtinLocaleSchema = z.enum(LOCALES);
@@ -77,7 +104,7 @@ export const SYSTEM_ACTION_KEYS = [
     'automations.manage', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
     'webhooks.manage', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
     'api-keys.manage',
-    'manifests.manage', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
+    'manifests.manage', // add-on + micro-SaaS install/connect/uninstall (26 D3)
     'audit.read',
     'sql.run', // reserved — deferred feature, no v1 enforcement (RESERVED_SYSTEM_ACTION_KEYS)
     // M7 wave 2 — data-io (T5) + scheduled reports (T6). `exports.manage` /
@@ -119,7 +146,11 @@ export const systemActionKeySchema = z.enum(SYSTEM_ACTION_KEYS);
 export const RESERVED_SYSTEM_ACTION_KEYS = [
     'automations.manage',
     'webhooks.manage',
-    'manifests.manage',
+    // `manifests.manage` UN-RESERVED 2026-08-29 (26-add-on-runtime.md D3, 26-T05)
+    // in the same change that landed its first enforcement point — the
+    // `/api/v1/add-ons` routes. That is the rule this list documents, honoured
+    // rather than quoted: a key becomes grantable when something checks it, and
+    // not one commit earlier.
     'sql.run',
 ];
 /**
@@ -153,6 +184,14 @@ export const auditCategorySchema = z.enum([
     'automation',
     'export',
     'system',
+    // Add-on acquisition and lifecycle (32-add-on-distribution.md §4.3): catalog
+    // refresh, download, verify- and unpack-refusals, upload, staged, deleted,
+    // upgraded. Its own category rather than a `system` action because an add-on
+    // ships a server half that runs in-process (24 D13) — "what code arrived on
+    // this deployment, from where, and did anything refuse it" is the question an
+    // operator asks on its own, and it should not have to be sieved out of the
+    // system log.
+    'add-on',
 ]);
 /** `{ before, after }` images; PII-masked upstream; capped at 16 KB serialized. */
 export const auditChangesSchema = z.object({