@antasphere/chassis-server 1.0.0

package/dist/accounts/erasure-log.d.ts

@@ -0,0 +1,66 @@
+import type { Logger } from '../logger.js';
+/**
+ * The append-only ERASURE TOMBSTONE (OPS-3, PRDCT-1357).
+ *
+ * A GDPR erasure that lives only in the database is undone by the next
+ * restore from an older dump: the subject's row comes back, their password
+ * works again, and the audit row saying they were erased is rolled back
+ * with everything else. The tombstone lives OUTSIDE the dump — one JSON
+ * line per erased user in `$DATA_DIR/erasures.jsonl` — so it survives the
+ * database swap; restore.sh carries the live volume's file forward into
+ * the restored tree, and boot REPLAYS it: any tombstoned user present in
+ * the database is deleted again, with an audit row recording the replay.
+ *
+ * The line carries the user id (the replay key) and a KEYED fingerprint of
+ * the lowercased email (a second correlation handle for operators, never
+ * the address itself — the file is the one artifact that must outlive the
+ * erasure it records). Keyed (PRDCT-1811): the file rides in the
+ * UNENCRYPTED data tarball of every backup, and a plain hash of a
+ * low-entropy value is a dictionary lookup away from the address — an
+ * off-site backup would list who asked to be forgotten. HMAC-SHA256 under
+ * the instance's auth secret (which travels only in the passphrase-
+ * encrypted config archive) keeps the operator's correlation and denies it
+ * to anyone holding the tarball alone. Rotating the auth secret changes
+ * the fingerprints written from then on; old lines keep their old key.
+ */
+export declare const ERASURE_LOG_FILE = "erasures.jsonl";
+/** What a replay did: the ids re-erased, and the tombstones it could NOT apply. */
+export interface ErasureReplay {
+    replayed: string[];
+    refused: Array<{
+        userId: string;
+        erasedAt: string;
+        cause: unknown;
+    }>;
+}
+export interface ErasureTombstone {
+    userId: string;
+    emailHash: string;
+    at: string;
+}
+export declare function emailHash(email: string, key: string): string;
+export declare class ErasureLog {
+    private readonly logger;
+    /** The fingerprint key: the resolved auth secret (never stored beside the file). */
+    private readonly fingerprintKey;
+    private readonly path;
+    constructor(dataDir: string, logger: Logger, 
+    /** The fingerprint key: the resolved auth secret (never stored beside the file). */
+    fingerprintKey: string);
+    /** Append one tombstone. Best-effort on I/O failure: loud, never blocking the erasure itself. */
+    append(user: {
+        id: string;
+        email: string;
+    }): Promise<void>;
+    /** Every tombstone on disk (malformed lines skipped, loudly). Empty when the file is absent. */
+    read(): Promise<ErasureTombstone[]>;
+    /**
+     * Replay: for every tombstoned user still (or again) present, delete them
+     * through `deleteUser` (Better Auth's cascade, the same path every GDPR
+     * surface uses) and count it. A tombstone whose delete FAILS is reported
+     * as refused, never swallowed (PRDCT-1809): the caller decides what a
+     * present-but-unerasable subject means for the boot (it refuses to serve).
+     */
+    replay(exists: (userId: string) => Promise<boolean>, deleteUser: (userId: string) => Promise<void>): Promise<ErasureReplay>;
+}
+//# sourceMappingURL=erasure-log.d.ts.map

package/dist/accounts/erasure-log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure-log.d.ts","sourceRoot":"","sources":["../../src/accounts/erasure-log.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,gBAAgB,mBAAmB,CAAC;AAEjD,mFAAmF;AACnF,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,KAAK,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,qBAAa,UAAU;IAKnB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,cAAc;IANjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAG5B,OAAO,EAAE,MAAM,EACE,MAAM,EAAE,MAAM;IAC/B,oFAAoF;IACnE,cAAc,EAAE,MAAM;IAKzC,iGAAiG;IAC3F,MAAM,CAAC,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBhE,gGAAgG;IAC1F,IAAI,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IA0BzC;;;;;;OAMG;IACG,MAAM,CACV,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,EAC5C,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,GAC5C,OAAO,CAAC,aAAa,CAAC;CAyB1B"}

package/dist/accounts/erasure-log.js

@@ -0,0 +1,117 @@
+import { createHmac } from 'node:crypto';
+import { appendFile, mkdir, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+/**
+ * The append-only ERASURE TOMBSTONE (OPS-3, PRDCT-1357).
+ *
+ * A GDPR erasure that lives only in the database is undone by the next
+ * restore from an older dump: the subject's row comes back, their password
+ * works again, and the audit row saying they were erased is rolled back
+ * with everything else. The tombstone lives OUTSIDE the dump — one JSON
+ * line per erased user in `$DATA_DIR/erasures.jsonl` — so it survives the
+ * database swap; restore.sh carries the live volume's file forward into
+ * the restored tree, and boot REPLAYS it: any tombstoned user present in
+ * the database is deleted again, with an audit row recording the replay.
+ *
+ * The line carries the user id (the replay key) and a KEYED fingerprint of
+ * the lowercased email (a second correlation handle for operators, never
+ * the address itself — the file is the one artifact that must outlive the
+ * erasure it records). Keyed (PRDCT-1811): the file rides in the
+ * UNENCRYPTED data tarball of every backup, and a plain hash of a
+ * low-entropy value is a dictionary lookup away from the address — an
+ * off-site backup would list who asked to be forgotten. HMAC-SHA256 under
+ * the instance's auth secret (which travels only in the passphrase-
+ * encrypted config archive) keeps the operator's correlation and denies it
+ * to anyone holding the tarball alone. Rotating the auth secret changes
+ * the fingerprints written from then on; old lines keep their old key.
+ */
+export const ERASURE_LOG_FILE = 'erasures.jsonl';
+export function emailHash(email, key) {
+    return createHmac('sha256', key).update(email.trim().toLowerCase()).digest('hex');
+}
+export class ErasureLog {
+    logger;
+    fingerprintKey;
+    path;
+    constructor(dataDir, logger, 
+    /** The fingerprint key: the resolved auth secret (never stored beside the file). */
+    fingerprintKey) {
+        this.logger = logger;
+        this.fingerprintKey = fingerprintKey;
+        this.path = join(dataDir, ERASURE_LOG_FILE);
+    }
+    /** Append one tombstone. Best-effort on I/O failure: loud, never blocking the erasure itself. */
+    async append(user) {
+        const line = {
+            userId: user.id,
+            emailHash: emailHash(user.email, this.fingerprintKey),
+            at: new Date().toISOString()
+        };
+        try {
+            await mkdir(join(this.path, '..'), { recursive: true });
+            await appendFile(this.path, JSON.stringify(line) + '\n', { mode: 0o600 });
+        }
+        catch (err) {
+            this.logger.error({ err, path: this.path }, 'erasure tombstone: could not append — a restore may resurrect this user');
+        }
+    }
+    /** Every tombstone on disk (malformed lines skipped, loudly). Empty when the file is absent. */
+    async read() {
+        let raw;
+        try {
+            raw = await readFile(this.path, 'utf8');
+        }
+        catch {
+            return [];
+        }
+        const out = [];
+        for (const line of raw.split('\n')) {
+            if (!line.trim())
+                continue;
+            try {
+                const parsed = JSON.parse(line);
+                if (typeof parsed.userId === 'string' && parsed.userId) {
+                    out.push({
+                        userId: parsed.userId,
+                        emailHash: String(parsed.emailHash ?? ''),
+                        at: String(parsed.at ?? '')
+                    });
+                }
+            }
+            catch {
+                this.logger.warn({ path: this.path }, 'erasure tombstone: skipping a malformed line');
+            }
+        }
+        return out;
+    }
+    /**
+     * Replay: for every tombstoned user still (or again) present, delete them
+     * through `deleteUser` (Better Auth's cascade, the same path every GDPR
+     * surface uses) and count it. A tombstone whose delete FAILS is reported
+     * as refused, never swallowed (PRDCT-1809): the caller decides what a
+     * present-but-unerasable subject means for the boot (it refuses to serve).
+     */
+    async replay(exists, deleteUser) {
+        const replayed = [];
+        const refused = [];
+        const seen = new Set();
+        for (const tomb of await this.read()) {
+            if (seen.has(tomb.userId))
+                continue;
+            seen.add(tomb.userId);
+            if (!(await exists(tomb.userId)))
+                continue;
+            try {
+                await deleteUser(tomb.userId);
+                replayed.push(tomb.userId);
+                this.logger.warn({ userId: tomb.userId, erasedAt: tomb.at }, 'erasure tombstone replayed: a previously erased user was present again (restore from an older backup?) and has been re-erased');
+            }
+            catch (err) {
+                refused.push({ userId: tomb.userId, erasedAt: tomb.at, cause: err });
+                this.logger.error({ err, userId: tomb.userId }, 'erasure tombstone: replay delete refused — the user is STILL PRESENT');
+            }
+        }
+        return { replayed, refused };
+    }
+}
+//# sourceMappingURL=erasure-log.js.map

package/dist/accounts/erasure-log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erasure-log.js","sourceRoot":"","sources":["../../src/accounts/erasure-log.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,gBAAgB,CAAC;AAcjD,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,GAAW;IAClD,OAAO,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,OAAO,UAAU;IAKF;IAEA;IANF,IAAI,CAAS;IAE9B,YACE,OAAe,EACE,MAAc;IAC/B,oFAAoF;IACnE,cAAsB;QAFtB,WAAM,GAAN,MAAM,CAAQ;QAEd,mBAAc,GAAd,cAAc,CAAQ;QAEvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC9C,CAAC;IAED,iGAAiG;IACjG,KAAK,CAAC,MAAM,CAAC,IAAmC;QAC9C,MAAM,IAAI,GAAqB;YAC7B,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,cAAc,CAAC;YACrD,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC7B,CAAC;QACF,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACxB,yEAAyE,CAC1E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gGAAgG;IAChG,KAAK,CAAC,IAAI;QACR,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,GAAG,GAAuB,EAAE,CAAC;QACnC,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA8B,CAAC;gBAC7D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBACvD,GAAG,CAAC,IAAI,CAAC;wBACP,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;wBACzC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;qBAC5B,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,8CAA8C,CAAC,CAAC;YACxF,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,MAA4C,EAC5C,UAA6C;QAE7C,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,MAAM,OAAO,GAA6B,EAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtB,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAAE,SAAS;YAC3C,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,EAC1C,+HAA+H,CAChI,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC5B,sEAAsE,CACvE,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/dist/accounts/index.d.ts

@@ -0,0 +1,6 @@
+export { AccountDeletionService, LastOwnerError, isLastOwnerDbError } from './deletion.js';
+export { ErasureLog, emailHash } from './erasure-log.js';
+export { mintRefusal } from './mint-refusal.js';
+export { isDuplicateAccountError } from './signup-duplicate.js';
+export { parseSuperadminEmails } from './superadmin.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/accounts/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/accounts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/accounts/index.js

@@ -0,0 +1,6 @@
+export { AccountDeletionService, LastOwnerError, isLastOwnerDbError } from './deletion.js';
+export { ErasureLog, emailHash } from './erasure-log.js';
+export { mintRefusal } from './mint-refusal.js';
+export { isDuplicateAccountError } from './signup-duplicate.js';
+export { parseSuperadminEmails } from './superadmin.js';
+//# sourceMappingURL=index.js.map

package/dist/accounts/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accounts/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC3F,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/accounts/mint-refusal.d.ts

@@ -0,0 +1,47 @@
+import { type Db } from '@antasphere/chassis-db';
+/**
+ * Shared refusal for the SIGN-IN-EQUIVALENT mint routes (PRDCT-1354,
+ * findings AUTH-1/AUTH-2/AUTH-8). `/members/{id}/reset-link`,
+ * `/members/{id}/change-email-link` and the demo pass mint
+ * (`POST /demo/passes`) all hand the caller a bearer credential
+ * for ANOTHER user's GLOBAL account: consuming any one of them signs the
+ * target in (LESSONS.md M6: "Consuming a change-email JWT while logged
+ * out CREATES a session for the target user"). A `user` row is
+ * instance-global, so the blast radius of a mint is every workspace that
+ * user belongs to — not just the minter's.
+ *
+ * Two target classes therefore make a mint a CROSS-TENANT takeover and
+ * are refused outright:
+ *
+ *  1. `origin='guest'` — the guest row exists for principal resolution
+ *     only (D2). It was created by the per-resource claim path for an
+ *     EXTERNAL party whose account is not this tenant's to administer;
+ *     the host tenant never owned that credential. Admins have no
+ *     recovery duty toward a guest, so there is nothing to trade away.
+ *  2. a target holding a membership in ANY OTHER workspace — the minted
+ *     credential would carry into that workspace too. "Admin of the
+ *     workspace" is not "owner of the person"; a user who works with two
+ *     tenants must never be recoverable by either one unilaterally.
+ *     Recovery for such a user is self-serve (`/request-password-reset`)
+ *     or the operator's break-glass surface.
+ *
+ * The role gate is OWNER, not admin (AUTH-8): the old guards only fired
+ * when `target.role === 'owner'`, so any admin could mint against any
+ * other admin and escalate laterally. Minting someone else's credential
+ * is an owner-level act on every route that calls this.
+ *
+ * Fail-CLOSED shape: a new route that mints a credential for another user
+ * must call this helper. Returning `null` means "no refusal found".
+ * `guestTargetMessage` is the tool's `guest_target` sentence
+ * (`copy.guestTarget`).
+ */
+export declare function mintRefusal(db: Db, guestTargetMessage: string, principal: {
+    workspaceId: string;
+}, target: {
+    userId: string;
+    origin: string;
+}): Promise<{
+    code: string;
+    message: string;
+} | null>;
+//# sourceMappingURL=mint-refusal.d.ts.map

package/dist/accounts/mint-refusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-refusal.d.ts","sourceRoot":"","sources":["../../src/accounts/mint-refusal.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,WAAW,CAC/B,EAAE,EAAE,EAAE,EACN,kBAAkB,EAAE,MAAM,EAC1B,SAAS,EAAE;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,EAClC,MAAM,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAsBnD"}

package/dist/accounts/mint-refusal.js

@@ -0,0 +1,59 @@
+import { and, eq, ne } from 'drizzle-orm';
+import { workspaceMembers } from '@antasphere/chassis-db';
+/**
+ * Shared refusal for the SIGN-IN-EQUIVALENT mint routes (PRDCT-1354,
+ * findings AUTH-1/AUTH-2/AUTH-8). `/members/{id}/reset-link`,
+ * `/members/{id}/change-email-link` and the demo pass mint
+ * (`POST /demo/passes`) all hand the caller a bearer credential
+ * for ANOTHER user's GLOBAL account: consuming any one of them signs the
+ * target in (LESSONS.md M6: "Consuming a change-email JWT while logged
+ * out CREATES a session for the target user"). A `user` row is
+ * instance-global, so the blast radius of a mint is every workspace that
+ * user belongs to — not just the minter's.
+ *
+ * Two target classes therefore make a mint a CROSS-TENANT takeover and
+ * are refused outright:
+ *
+ *  1. `origin='guest'` — the guest row exists for principal resolution
+ *     only (D2). It was created by the per-resource claim path for an
+ *     EXTERNAL party whose account is not this tenant's to administer;
+ *     the host tenant never owned that credential. Admins have no
+ *     recovery duty toward a guest, so there is nothing to trade away.
+ *  2. a target holding a membership in ANY OTHER workspace — the minted
+ *     credential would carry into that workspace too. "Admin of the
+ *     workspace" is not "owner of the person"; a user who works with two
+ *     tenants must never be recoverable by either one unilaterally.
+ *     Recovery for such a user is self-serve (`/request-password-reset`)
+ *     or the operator's break-glass surface.
+ *
+ * The role gate is OWNER, not admin (AUTH-8): the old guards only fired
+ * when `target.role === 'owner'`, so any admin could mint against any
+ * other admin and escalate laterally. Minting someone else's credential
+ * is an owner-level act on every route that calls this.
+ *
+ * Fail-CLOSED shape: a new route that mints a credential for another user
+ * must call this helper. Returning `null` means "no refusal found".
+ * `guestTargetMessage` is the tool's `guest_target` sentence
+ * (`copy.guestTarget`).
+ */
+export async function mintRefusal(db, guestTargetMessage, principal, target) {
+    if (target.origin === 'guest') {
+        return {
+            code: 'guest_target',
+            message: guestTargetMessage
+        };
+    }
+    const [foreign] = await db
+        .select({ id: workspaceMembers.id })
+        .from(workspaceMembers)
+        .where(and(eq(workspaceMembers.userId, target.userId), ne(workspaceMembers.workspaceId, principal.workspaceId)))
+        .limit(1);
+    if (foreign) {
+        return {
+            code: 'cross_workspace_target',
+            message: 'This member also belongs to another workspace — an admin-minted link would carry into it, so it is refused'
+        };
+    }
+    return null;
+}
+//# sourceMappingURL=mint-refusal.js.map

package/dist/accounts/mint-refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mint-refusal.js","sourceRoot":"","sources":["../../src/accounts/mint-refusal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAW,MAAM,wBAAwB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,EAAM,EACN,kBAA0B,EAC1B,SAAkC,EAClC,MAA0C;IAE1C,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,kBAAkB;SAC5B,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;SACnC,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CACJ,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,CACzG;SACA,KAAK,CAAC,CAAC,CAAC,CAAC;IACZ,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EACL,4GAA4G;SAC/G,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/accounts/signup-duplicate.d.ts

@@ -0,0 +1,14 @@
+/**
+ * True when a failed `signUpEmail` means "this email already has an account":
+ * either Better Auth's own pre-check (APIError USER_ALREADY_EXISTS / 422) or,
+ * in the tight concurrent-signup race where two callers pass an account lookup
+ * together, the losing INSERT's Postgres unique_violation (23505) on the user
+ * email — found anywhere down the wrapped error's `cause` chain.
+ *
+ * Shared by every public account-minting endpoint (invitation accept,
+ * collaborator claim): the existence-revealing 409 is answered ONLY here, after
+ * the caller has committed real credentials, so a credential-less probe can
+ * never read it (PRDCT-1437).
+ */
+export declare function isDuplicateAccountError(e: unknown): boolean;
+//# sourceMappingURL=signup-duplicate.d.ts.map

package/dist/accounts/signup-duplicate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-duplicate.d.ts","sourceRoot":"","sources":["../../src/accounts/signup-duplicate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,OAAO,GAAG,OAAO,CAQ3D"}

package/dist/accounts/signup-duplicate.js

@@ -0,0 +1,25 @@
+/**
+ * True when a failed `signUpEmail` means "this email already has an account":
+ * either Better Auth's own pre-check (APIError USER_ALREADY_EXISTS / 422) or,
+ * in the tight concurrent-signup race where two callers pass an account lookup
+ * together, the losing INSERT's Postgres unique_violation (23505) on the user
+ * email — found anywhere down the wrapped error's `cause` chain.
+ *
+ * Shared by every public account-minting endpoint (invitation accept,
+ * collaborator claim): the existence-revealing 409 is answered ONLY here, after
+ * the caller has committed real credentials, so a credential-less probe can
+ * never read it (PRDCT-1437).
+ */
+export function isDuplicateAccountError(e) {
+    for (let cur = e, depth = 0; cur instanceof Error && depth < 10; cur = cur.cause, depth++) {
+        const anyErr = cur;
+        if (anyErr.code === '23505')
+            return true;
+        if (anyErr.body?.code === 'USER_ALREADY_EXISTS')
+            return true;
+        if (anyErr.status === 'UNPROCESSABLE_ENTITY' || anyErr.status === 422)
+            return true;
+    }
+    return false;
+}
+//# sourceMappingURL=signup-duplicate.js.map

package/dist/accounts/signup-duplicate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-duplicate.js","sourceRoot":"","sources":["../../src/accounts/signup-duplicate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,uBAAuB,CAAC,CAAU;IAChD,KAAK,IAAI,GAAG,GAAY,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,YAAY,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,GAAG,GAAG,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC;QACnG,MAAM,MAAM,GAAG,GAAsE,CAAC;QACtF,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,EAAE,IAAI,KAAK,qBAAqB;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAsB,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/accounts/superadmin.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Break-glass superadmin recognition (ADR 010).
+ *
+ * The capability is env-derived and off by default: `SUPERADMIN_EMAILS` is a
+ * comma-separated allowlist, and a caller is superadmin ONLY when all three
+ * hold at once:
+ *
+ *   1. the request carries a Better Auth SESSION (never a machine credential —
+ *      the break-glass routes are unlisted in the fail-closed scope allowlist,
+ *      and the handlers resolve the session directly);
+ *   2. the session user's email is on the allowlist;
+ *   3. that email is VERIFIED (`user.email_verified`) — an unverified match
+ *      must never qualify, or squatting an allowlisted address would be enough.
+ *
+ * There is deliberately NO persistent DB super-role: unset/empty env means no
+ * superadmin exists and the capability is fully dormant.
+ */
+/**
+ * Parse `SUPERADMIN_EMAILS` into a lowercased set (Better Auth stores emails
+ * lowercased, so membership checks compare in that form).
+ *
+ * Throws on malformed entries so the env schema fails LOUDLY at boot — a typo
+ * must never silently disarm break-glass. `undefined` (unset/blank through
+ * `blankToUndefined`) yields the empty set: dormant.
+ */
+export declare function parseSuperadminEmails(raw: string | undefined): Set<string>;
+//# sourceMappingURL=superadmin.d.ts.map

package/dist/accounts/superadmin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"superadmin.d.ts","sourceRoot":"","sources":["../../src/accounts/superadmin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,CAAC,MAAM,CAAC,CAiB1E"}

package/dist/accounts/superadmin.js

@@ -0,0 +1,46 @@
+/**
+ * Break-glass superadmin recognition (ADR 010).
+ *
+ * The capability is env-derived and off by default: `SUPERADMIN_EMAILS` is a
+ * comma-separated allowlist, and a caller is superadmin ONLY when all three
+ * hold at once:
+ *
+ *   1. the request carries a Better Auth SESSION (never a machine credential —
+ *      the break-glass routes are unlisted in the fail-closed scope allowlist,
+ *      and the handlers resolve the session directly);
+ *   2. the session user's email is on the allowlist;
+ *   3. that email is VERIFIED (`user.email_verified`) — an unverified match
+ *      must never qualify, or squatting an allowlisted address would be enough.
+ *
+ * There is deliberately NO persistent DB super-role: unset/empty env means no
+ * superadmin exists and the capability is fully dormant.
+ */
+const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+/**
+ * Parse `SUPERADMIN_EMAILS` into a lowercased set (Better Auth stores emails
+ * lowercased, so membership checks compare in that form).
+ *
+ * Throws on malformed entries so the env schema fails LOUDLY at boot — a typo
+ * must never silently disarm break-glass. `undefined` (unset/blank through
+ * `blankToUndefined`) yields the empty set: dormant.
+ */
+export function parseSuperadminEmails(raw) {
+    const allowlist = new Set();
+    if (raw === undefined || raw.trim() === '')
+        return allowlist;
+    const entries = raw
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0);
+    if (entries.length === 0) {
+        throw new Error('SUPERADMIN_EMAILS must list at least one email address');
+    }
+    for (const entry of entries) {
+        if (!EMAIL_RE.test(entry)) {
+            throw new Error(`SUPERADMIN_EMAILS entry "${entry}" is not a valid email address`);
+        }
+        allowlist.add(entry.toLowerCase());
+    }
+    return allowlist;
+}
+//# sourceMappingURL=superadmin.js.map

package/dist/accounts/superadmin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"superadmin.js","sourceRoot":"","sources":["../../src/accounts/superadmin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAuB;IAC3D,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,MAAM,OAAO,GAAG,GAAG;SAChB,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4BAA4B,KAAK,gCAAgC,CAAC,CAAC;QACrF,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/api/apikeys.d.ts

@@ -0,0 +1,14 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import type { ScopeRoutes } from './scope-routes.js';
+import { type Db } from '@antasphere/chassis-db';
+import type { ApiKeyService } from '../apikeys/service.js';
+/**
+ * API keys are USER credentials (user-scoped credential model): the listing
+ * and the revoke are keyed on the CREATOR, not on any workspace — a key acts
+ * as its holder wherever their memberships reach, so "my keys" is the only
+ * honest scope. Mint stays sessions-only and accepts an optional workspace
+ * PIN (least privilege); revocation is creator-only (a workspace admin has
+ * no standing over another user's credential).
+ */
+export declare function registerApiKeyRoutes(api: OpenAPIHono, db: Db, service: ApiKeyService, routes: Pick<ScopeRoutes, 'apiKeysListRoute' | 'apiKeyCreateRoute' | 'apiKeyRevokeRoute'>): void;
+//# sourceMappingURL=apikeys.d.ts.map

package/dist/api/apikeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apikeys.d.ts","sourceRoot":"","sources":["../../src/api/apikeys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAA0C,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAEzF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAmB3D;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,WAAW,EAChB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC,GACxF,IAAI,CA6GN"}

package/dist/api/apikeys.js

@@ -0,0 +1,124 @@
+import { and, desc, eq } from 'drizzle-orm';
+import { apiKeys, workspaceMembers } from '@antasphere/chassis-db';
+import { sql } from 'drizzle-orm';
+import { cursorRowId, keysetBefore, pageOf } from '../pagination.js';
+import { requireAuth } from '../middleware/auth-context.js';
+const err = (code, message) => ({ error: { code, message } });
+const toWire = (k) => ({
+    id: k.id,
+    name: k.name,
+    keyId: k.keyId,
+    scopes: k.scopes,
+    workspaceId: k.workspaceId,
+    createdBy: k.createdBy,
+    createdAt: k.createdAt.toISOString(),
+    lastUsedAt: k.lastUsedAt?.toISOString() ?? null,
+    revokedAt: k.revokedAt?.toISOString() ?? null,
+    expiresAt: k.expiresAt?.toISOString() ?? null
+});
+/**
+ * API keys are USER credentials (user-scoped credential model): the listing
+ * and the revoke are keyed on the CREATOR, not on any workspace — a key acts
+ * as its holder wherever their memberships reach, so "my keys" is the only
+ * honest scope. Mint stays sessions-only and accepts an optional workspace
+ * PIN (least privilege); revocation is creator-only (a workspace admin has
+ * no standing over another user's credential).
+ */
+export function registerApiKeyRoutes(api, db, service, routes) {
+    const { apiKeysListRoute, apiKeyCreateRoute, apiKeyRevokeRoute } = routes;
+    api.use('/api-keys', requireAuth());
+    api.use('/api-keys/*', requireAuth());
+    api.openapi(apiKeysListRoute, async (c) => {
+        const principal = c.get('principal');
+        const { cursor, limit } = c.req.valid('query');
+        const cursorId = cursorRowId(cursor);
+        const rows = await db
+            .select()
+            .from(apiKeys)
+            .where(and(eq(apiKeys.createdBy, principal.userId), ...(cursorId
+            ? [
+                keysetBefore({
+                    table: apiKeys,
+                    id: apiKeys.id,
+                    createdAt: apiKeys.createdAt,
+                    // The keyset scope column (see pagination.ts): the listing
+                    // is creator-scoped, so a foreign user's cursor can never
+                    // position inside this user's ordering.
+                    workspaceId: apiKeys.createdBy,
+                    cursorId,
+                    workspace: principal.userId
+                })
+            ]
+            : [])))
+            .orderBy(desc(apiKeys.createdAt), desc(apiKeys.id))
+            .limit(limit + 1);
+        const { page, nextCursor } = pageOf(rows, limit);
+        return c.json({ apiKeys: page.map(toWire), nextCursor }, 200);
+    });
+    api.openapi(apiKeyCreateRoute, async (c) => {
+        const principal = c.get('principal');
+        // Locked rule: a key never mints a key. Sessions only.
+        if (principal.via !== 'session') {
+            return c.json(err('sessions_only', 'API keys can only be created from a browser session'), 403);
+        }
+        const body = c.req.valid('json');
+        // Optional PIN: an ACTIVE membership of the pinned workspace is required
+        // — one uniform 403 whether the workspace does not exist or the caller
+        // is not a member (no oracle about other workspaces).
+        if (body.workspaceId) {
+            const [member] = await db
+                .select({ id: workspaceMembers.id })
+                .from(workspaceMembers)
+                .where(and(eq(workspaceMembers.userId, principal.userId), eq(workspaceMembers.workspaceId, body.workspaceId), eq(workspaceMembers.isActive, true)))
+                .limit(1);
+            if (!member) {
+                return c.json(err('no_membership', 'This workspace is not available to this account'), 403);
+            }
+        }
+        // The client sends a TTL in days; the server owns the absolute expiry.
+        const expiresAt = body.expiresInDays ? new Date(Date.now() + body.expiresInDays * 86_400_000) : null;
+        const minted = await service.mint({
+            workspaceId: body.workspaceId ?? null,
+            createdBy: principal.userId,
+            name: body.name,
+            scopes: body.scopes,
+            expiresAt
+        });
+        const [row] = await db.select().from(apiKeys).where(eq(apiKeys.id, minted.id)).limit(1);
+        c.set('audit', {
+            action: 'apikey.create',
+            resourceType: 'api_key',
+            resourceId: minted.id,
+            metadata: {
+                name: body.name,
+                scopes: body.scopes,
+                workspaceId: body.workspaceId ?? null,
+                expiresAt: expiresAt?.toISOString() ?? null
+            }
+        });
+        return c.json({ apiKey: toWire(row), key: minted.key }, 201);
+    });
+    api.openapi(apiKeyRevokeRoute, async (c) => {
+        const principal = c.get('principal');
+        const { id } = c.req.valid('param');
+        // Creator-only: a key is its creator's credential. A foreign key answers
+        // the same 404 as a nonexistent one (existence is not probeable).
+        const [key] = await db
+            .select()
+            .from(apiKeys)
+            .where(and(eq(apiKeys.id, id), eq(apiKeys.createdBy, principal.userId)))
+            .limit(1);
+        if (!key)
+            return c.json(err('not_found', 'API key not found'), 404);
+        if (!key.revokedAt) {
+            await db
+                .update(apiKeys)
+                .set({ revokedAt: sql `now()` })
+                .where(eq(apiKeys.id, key.id));
+        }
+        const [updated] = await db.select().from(apiKeys).where(eq(apiKeys.id, key.id)).limit(1);
+        c.set('audit', { action: 'apikey.revoke', resourceType: 'api_key', resourceId: key.id });
+        return c.json(toWire(updated), 200);
+    });
+}
+//# sourceMappingURL=apikeys.js.map

package/dist/api/apikeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apikeys.js","sourceRoot":"","sources":["../../src/api/apikeys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AAE5C,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAwB,MAAM,wBAAwB,CAAC;AACzF,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAE5D,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;AAE9E,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC;IAC7B,EAAE,EAAE,CAAC,CAAC,EAAE;IACR,IAAI,EAAE,CAAC,CAAC,IAAI;IACZ,KAAK,EAAE,CAAC,CAAC,KAAK;IACd,MAAM,EAAE,CAAC,CAAC,MAAkB;IAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;IAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;IACtB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,WAAW,EAAE;IACpC,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,IAAI;IAC/C,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;IAC7C,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;CAC9C,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAgB,EAChB,EAAM,EACN,OAAsB,EACtB,MAAyF;IAEzF,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,GAAG,MAAM,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IACpC,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,CAAC,CAAC;IAEtC,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EACvC,GAAG,CAAC,QAAQ;YACV,CAAC,CAAC;gBACE,YAAY,CAAC;oBACX,KAAK,EAAE,OAAO;oBACd,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,2DAA2D;oBAC3D,0DAA0D;oBAC1D,wCAAwC;oBACxC,WAAW,EAAE,OAAO,CAAC,SAAS;oBAC9B,QAAQ;oBACR,SAAS,EAAE,SAAS,CAAC,MAAM;iBAC5B,CAAC;aACH;YACH,CAAC,CAAC,EAAE,CAAC,CACR,CACF;aACA,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;aAClD,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpB,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,uDAAuD;QACvD,IAAI,SAAS,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,qDAAqD,CAAC,EAAE,GAAG,CAAC,CAAC;QAClG,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACjC,yEAAyE;QACzE,uEAAuE;QACvE,sDAAsD;QACtD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,gBAAgB,CAAC,EAAE,EAAE,CAAC;iBACnC,IAAI,CAAC,gBAAgB,CAAC;iBACtB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAC7C,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,EAClD,EAAE,CAAC,gBAAgB,CAAC,QAAQ,EAAE,IAAI,CAAC,CACpC,CACF;iBACA,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,iDAAiD,CAAC,EAAE,GAAG,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QACD,uEAAuE;QACvE,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YAChC,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;YACrC,SAAS,EAAE,SAAS,CAAC,MAAM;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE;YACb,MAAM,EAAE,eAAe;YACvB,YAAY,EAAE,SAAS;YACvB,UAAU,EAAE,MAAM,CAAC,EAAE;YACrB,QAAQ,EAAE;gBACR,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI;gBACrC,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,IAAI;aAC5C;SACF,CAAC,CAAC;QACH,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;QACtC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpC,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,OAAO,CAAC;aACb,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;aACvE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,mBAAmB,CAAC,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,EAAE;iBACL,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;iBAC9B,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzF,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/api/audit.d.ts

@@ -0,0 +1,4 @@
+import type { OpenAPIHono } from '@hono/zod-openapi';
+import { type Db } from '@antasphere/chassis-db';
+export declare function registerAuditRoutes(api: OpenAPIHono, db: Db): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/api/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/api/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAGrD,OAAO,EAA+B,KAAK,EAAE,EAAE,MAAM,wBAAwB,CAAC;AAI9E,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,CA2ElE"}