@braidhq/server 0.0.1 → 0.1.0

package/dist/routes/admin.js

@@ -0,0 +1,227 @@
+import { NotFoundError } from '@braidhq/core';
+import { ServerRole, User, UserId, WorkspaceId, WorkspaceRole } from '@braidhq/schema';
+import { createRoute, OpenAPIHono, z } from '@hono/zod-openapi';
+import { requireAdmin } from '../middleware/requireAdmin.js';
+import { getUserId } from '../middleware/userId.js';
+import { NotFoundResponse, ValidationFailureResponse } from './_shared.js';
+const Invite = z.object({
+    email: z.string().email(),
+    invitedAt: z.string().datetime({ offset: true }),
+    serverRole: ServerRole,
+}).openapi('Invite');
+const InviteListResponse = z.object({
+    items: z.array(Invite),
+}).openapi('InviteListResponse');
+const InviteDraft = z.object({
+    email: z.string().email(),
+    serverRole: ServerRole.optional(),
+}).openapi('InviteDraft');
+const EmailParam = z.object({
+    email: z.string().email().openapi({ param: { name: 'email', in: 'path' } }),
+});
+const UserIdParam = z.object({
+    userId: UserId.openapi({ param: { name: 'userId', in: 'path' } }),
+});
+const AdminUserPatch = z.object({
+    serverRole: ServerRole,
+}).openapi('AdminUserPatch');
+const AdminUserWorkspace = z.object({
+    workspaceId: WorkspaceId,
+    role: WorkspaceRole,
+}).openapi('AdminUserWorkspace');
+const AdminUserView = User.extend({
+    workspaces: z.array(AdminUserWorkspace),
+}).openapi('AdminUserView');
+const UserListResponse = z.object({
+    items: z.array(AdminUserView),
+}).openapi('AdminUserListResponse');
+const listInvitesRoute = createRoute({
+    method: 'get',
+    path: '/invites',
+    operationId: 'listInvites',
+    summary: 'List pending invites. Admin only.',
+    tags: ['admin'],
+    responses: {
+        200: {
+            description: 'A list of invites.',
+            content: { 'application/json': { schema: InviteListResponse } },
+        },
+        403: {
+            description: 'Caller is not an admin.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+    },
+});
+const addInviteRoute = createRoute({
+    method: 'post',
+    path: '/invites',
+    operationId: 'addInvite',
+    summary: 'Invite an email to sign in via Google OAuth. Admin only.',
+    tags: ['admin'],
+    request: { body: { content: { 'application/json': { schema: InviteDraft } } } },
+    responses: {
+        201: {
+            description: 'The created invite.',
+            content: { 'application/json': { schema: Invite } },
+        },
+        400: ValidationFailureResponse,
+        403: {
+            description: 'Caller is not an admin.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+    },
+});
+const revokeInviteRoute = createRoute({
+    method: 'delete',
+    path: '/invites/{email}',
+    operationId: 'revokeInvite',
+    summary: 'Revoke a pending invite. Admin only. Idempotent.',
+    tags: ['admin'],
+    request: { params: EmailParam },
+    responses: {
+        204: { description: 'Invite removed (or never existed).' },
+        403: {
+            description: 'Caller is not an admin.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+    },
+});
+const listUsersRoute = createRoute({
+    method: 'get',
+    path: '/users',
+    operationId: 'listUsersAdmin',
+    summary: 'List all users on this server. Admin only.',
+    tags: ['admin'],
+    responses: {
+        200: {
+            description: 'A list of users.',
+            content: { 'application/json': { schema: UserListResponse } },
+        },
+        403: {
+            description: 'Caller is not an admin.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+    },
+});
+const updateUserRoute = createRoute({
+    method: 'patch',
+    path: '/users/{userId}',
+    operationId: 'updateUserAdmin',
+    summary: 'Flip a user\'s server role. Admin only.',
+    tags: ['admin'],
+    request: {
+        params: UserIdParam,
+        body: { content: { 'application/json': { schema: AdminUserPatch } } },
+    },
+    responses: {
+        200: {
+            description: 'The updated user.',
+            content: { 'application/json': { schema: User } },
+        },
+        404: NotFoundResponse,
+        403: {
+            description: 'Caller is not an admin.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+    },
+});
+const deleteUserRoute = createRoute({
+    method: 'delete',
+    path: '/users/{userId}',
+    operationId: 'deleteUserAdmin',
+    summary: 'Delete a user record. Admin only. Idempotent. Does NOT clean up workspace memberships referencing this userId; those rows become orphans.',
+    tags: ['admin'],
+    request: { params: UserIdParam },
+    responses: {
+        204: { description: 'User removed (or never existed).' },
+        400: {
+            description: 'Caller attempted to delete themselves.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+        403: {
+            description: 'Caller is not an admin.',
+            content: { 'application/problem+json': { schema: z.object({}).passthrough() } },
+        },
+    },
+});
+export function createAdminRouter(deps) {
+    const router = new OpenAPIHono();
+    router.use('*', requireAdmin(deps.userRegistry));
+    router.openapi(listInvitesRoute, async (context) => {
+        const items = await deps.accessPolicy.listInvites();
+        return context.json({ items }, 200);
+    });
+    router.openapi(addInviteRoute, async (context) => {
+        const draft = context.req.valid('json');
+        const created = await deps.accessPolicy.addInvite({
+            email: draft.email,
+            ...(draft.serverRole ? { serverRole: draft.serverRole } : {}),
+        });
+        return context.json(created, 201);
+    });
+    router.openapi(revokeInviteRoute, async (context) => {
+        const { email } = context.req.valid('param');
+        await deps.accessPolicy.removeInvite(email);
+        return context.body(null, 204);
+    });
+    router.openapi(listUsersRoute, async (context) => {
+        const [users, workspaces, entries] = await Promise.all([
+            deps.userRegistry.list(),
+            deps.workspaceService.list(),
+            deps.workspaceRegistry.listAllWithMembers(),
+        ]);
+        // Build rootPath → workspaceId so we can attach a human id to each
+        // membership without exposing rootPath to the client.
+        const idByRoot = new Map(workspaces.map(w => [w.rootPath, w.id]));
+        const membershipByUser = new Map();
+        for (const entry of entries) {
+            const workspaceId = idByRoot.get(entry.rootPath);
+            if (!workspaceId)
+                continue;
+            for (const member of entry.members) {
+                const list = membershipByUser.get(member.userId) ?? [];
+                list.push({ workspaceId, role: member.role });
+                membershipByUser.set(member.userId, list);
+            }
+        }
+        const items = users.map(u => ({
+            ...u,
+            workspaces: membershipByUser.get(u.id) ?? [],
+        }));
+        return context.json({ items }, 200);
+    });
+    router.openapi(updateUserRoute, async (context) => {
+        const { userId } = context.req.valid('param');
+        const patch = context.req.valid('json');
+        const existing = await deps.userRegistry.get(userId);
+        if (!existing)
+            throw new NotFoundError(`User "${userId}" not found`);
+        const updated = await deps.userRegistry.update(userId, { serverRole: patch.serverRole });
+        return context.json(updated, 200);
+    });
+    router.openapi(deleteUserRoute, async (context) => {
+        const { userId } = context.req.valid('param');
+        const callerId = getUserId(context);
+        // Don't let an admin delete themselves; a single-admin server
+        // would lock itself out otherwise.
+        if (userId === callerId) {
+            return context.json({
+                type: 'about:blank',
+                title: 'Bad Request',
+                status: 400,
+                detail: 'You cannot delete your own user record.',
+            }, 400, { 'Content-Type': 'application/problem+json' });
+        }
+        // Revoke persistent sign-in approval alongside the user record so
+        // the same email can't sneak back in next time they hit /auth/google.
+        // (They'd need a fresh invite from an admin.) Read the user first to
+        // grab their email; tolerated when missing for idempotency.
+        const existing = await deps.userRegistry.get(userId);
+        if (existing?.email)
+            await deps.accessPolicy.revokeApproval(existing.email);
+        await deps.userRegistry.delete(userId);
+        return context.body(null, 204);
+    });
+    return router;
+}
+//# sourceMappingURL=admin.js.map

package/dist/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AACtF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAA;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAA;AAE1E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,UAAU,EAAE,UAAU;CACvB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEpB,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;CACvB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAEhC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,UAAU,EAAE,UAAU,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;AAEzB,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CAC5E,CAAC,CAAA;AAEF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;CAClE,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,UAAU,EAAE,UAAU;CACvB,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE5B,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,WAAW,EAAE,WAAW;IACxB,IAAI,EAAE,aAAa;CACpB,CAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;AAEhC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;CACxC,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;AAE3B,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CAC9B,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;AASnC,MAAM,gBAAgB,GAAG,WAAW,CAAC;IACnC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,mCAAmC;IAC5C,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,oBAAoB;YACjC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE;SAChE;QACD,GAAG,EAAE;YACH,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,WAAW;IACxB,OAAO,EAAE,0DAA0D;IACnE,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE;IAC/E,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,qBAAqB;YAClC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;SACpD;QACD,GAAG,EAAE,yBAAyB;QAC9B,GAAG,EAAE;YACH,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,WAAW,CAAC;IACpC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,cAAc;IAC3B,OAAO,EAAE,kDAAkD;IAC3D,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE;IAC/B,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,oCAAoC,EAAE;QAC1D,GAAG,EAAE;YACH,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,cAAc,GAAG,WAAW,CAAC;IACjC,MAAM,EAAE,KAAK;IACb,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,gBAAgB;IAC7B,OAAO,EAAE,4CAA4C;IACrD,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,kBAAkB;YAC/B,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,EAAE;SAC9D;QACD,GAAG,EAAE;YACH,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,iBAAiB;IAC9B,OAAO,EAAE,yCAAyC;IAClD,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE;QACP,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,EAAE,EAAE;KACtE;IACD,SAAS,EAAE;QACT,GAAG,EAAE;YACH,WAAW,EAAE,mBAAmB;YAChC,OAAO,EAAE,EAAE,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;SAClD;QACD,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE;YACH,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,eAAe,GAAG,WAAW,CAAC;IAClC,MAAM,EAAE,QAAQ;IAChB,IAAI,EAAE,iBAAiB;IACvB,WAAW,EAAE,iBAAiB;IAC9B,OAAO,EAAE,2IAA2I;IACpJ,IAAI,EAAE,CAAC,OAAO,CAAC;IACf,OAAO,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE;IAChC,SAAS,EAAE;QACT,GAAG,EAAE,EAAE,WAAW,EAAE,kCAAkC,EAAE;QACxD,GAAG,EAAE;YACH,WAAW,EAAE,wCAAwC;YACrD,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;QACD,GAAG,EAAE;YACH,WAAW,EAAE,yBAAyB;YACtC,OAAO,EAAE,EAAE,0BAA0B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE;SAChF;KACF;CACF,CAAC,CAAA;AAEF,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAA;IAChC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAA;IAEhD,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAA;QACnD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAClD,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5C,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;QAC3C,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACrD,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE;YACxB,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;YAC5B,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,EAAE;SAC5C,CAAC,CAAA;QACF,mEAAmE;QACnE,sDAAsD;QACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QACjE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA4E,CAAA;QAC5G,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;YAChD,IAAI,CAAC,WAAW;gBACd,SAAQ;YACV,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;gBACtD,IAAI,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;gBAC7C,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAC3C,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5B,GAAG,CAAC;YACJ,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;SAC7C,CAAC,CAAC,CAAA;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACpD,IAAI,CAAC,QAAQ;YACX,MAAM,IAAI,aAAa,CAAC,SAAS,MAAM,aAAa,CAAC,CAAA;QACvD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAA;QACxF,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChD,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC7C,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;QACnC,8DAA8D;QAC9D,mCAAmC;QACnC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,IAAI,CACjB;gBACE,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,aAAa;gBACpB,MAAM,EAAE,GAAG;gBACX,MAAM,EAAE,yCAAyC;aAClD,EACD,GAAG,EACH,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAC/C,CAAA;QACH,CAAC;QACD,kEAAkE;QAClE,sEAAsE;QACtE,qEAAqE;QACrE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QACpD,IAAI,QAAQ,EAAE,KAAK;YACjB,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;QACxD,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACtC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/auth.d.ts

@@ -0,0 +1,33 @@
+import type { Clock } from '@braidhq/core';
+import type { AccessPolicy } from '../infrastructure/auth/AccessPolicy.js';
+import type { SessionStore } from '../infrastructure/auth/SessionStore.js';
+import type { GoogleOAuth } from '../infrastructure/oauth/GoogleOAuth.js';
+import type { UserRegistryFile } from '../infrastructure/users/UserRegistryFile.js';
+import { Hono } from 'hono';
+export interface AuthRouterDeps {
+    clock: Clock;
+    sessionStore: SessionStore;
+    accessPolicy: AccessPolicy;
+    userRegistry: UserRegistryFile;
+    /**
+     * When undefined, `/auth/google/*` respond with 503 so the operator
+     * knows the server is missing OAuth env config rather than failing
+     * silently mid-flow.
+     */
+    googleOAuth?: GoogleOAuth;
+    /**
+     * Where the Studio bundle is served from. Login redirects land here
+     * with `#token=...` in the fragment; Studio reads, stores, navigates.
+     * Defaults to the Vite dev server origin when unset.
+     */
+    studioUrl: string;
+    /**
+     * Mirrored into `/auth/config.requiresAuth` so the Studio knows
+     * whether to gate behind the Login page. `true` means anonymous
+     * sessions fall through to `local-user` — fine for embedded
+     * sidecar / dev; `false` means the Login page is mandatory.
+     */
+    localTrust: boolean;
+}
+export declare function createAuthRouter(deps: AuthRouterDeps): Hono;
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAG1C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAA;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6CAA6C,CAAA;AAEnF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAY3B,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,KAAK,CAAA;IACZ,YAAY,EAAE,YAAY,CAAA;IAC1B,YAAY,EAAE,YAAY,CAAA;IAC1B,YAAY,EAAE,gBAAgB,CAAA;IAC9B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;OAKG;IACH,UAAU,EAAE,OAAO,CAAA;CACpB;AAaD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CA4J3D"}

package/dist/routes/auth.js

@@ -0,0 +1,170 @@
+import { newUserId, NotFoundError } from '@braidhq/core';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { createOAuthState, createPkceVerifier } from '../infrastructure/oauth/GoogleOAuth.js';
+const PENDING_TTL_MS = 10 * 60 * 1000;
+const StartQuery = z.object({
+    returnTo: z.string().url().optional(),
+});
+const CallbackQuery = z.object({
+    code: z.string().min(1).optional(),
+    state: z.string().min(1).optional(),
+    error: z.string().optional(),
+    error_description: z.string().optional(),
+});
+export function createAuthRouter(deps) {
+    const router = new Hono();
+    // In-memory pending flows. A single-process server is the only
+    // supported topology in v0.2; HA / multi-process would need this in
+    // a shared store, but that's well past current scope.
+    const pending = new Map();
+    function reapExpired() {
+        const cutoff = Date.now() - PENDING_TTL_MS;
+        for (const [state, flow] of pending) {
+            if (flow.createdAt < cutoff)
+                pending.delete(state);
+        }
+    }
+    router.get('/google/start', async (context) => {
+        if (!deps.googleOAuth) {
+            return context.json({
+                title: 'Google sign-in unavailable',
+                detail: 'Server is missing BRAID_GOOGLE_CLIENT_ID / BRAID_GOOGLE_CLIENT_SECRET; ask the admin to configure them.',
+            }, 503);
+        }
+        reapExpired();
+        const parsed = StartQuery.safeParse({
+            returnTo: context.req.query('returnTo'),
+        });
+        if (!parsed.success)
+            return context.json({ title: 'Invalid returnTo' }, 400);
+        const state = createOAuthState();
+        const codeVerifier = createPkceVerifier();
+        pending.set(state, {
+            codeVerifier,
+            returnTo: parsed.data.returnTo ?? deps.studioUrl,
+            createdAt: Date.now(),
+        });
+        const url = deps.googleOAuth.buildLoginUrl({ state, codeVerifier });
+        return context.json({ authorizationUrl: url });
+    });
+    router.get('/google/callback', async (context) => {
+        if (!deps.googleOAuth)
+            return context.text('Google sign-in is not configured on this server.', 503);
+        const parsed = CallbackQuery.safeParse({
+            code: context.req.query('code'),
+            state: context.req.query('state'),
+            error: context.req.query('error'),
+            error_description: context.req.query('error_description'),
+        });
+        if (!parsed.success)
+            return context.text('Invalid callback parameters.', 400);
+        const { code, state, error, error_description: errorDescription } = parsed.data;
+        if (error || !code || !state)
+            return redirectWithError(context, deps.studioUrl, error_description_or_default(error, errorDescription));
+        const flow = pending.get(state);
+        if (!flow)
+            return redirectWithError(context, deps.studioUrl, 'Session expired before sign-in completed. Try again.');
+        pending.delete(state);
+        let profile;
+        try {
+            profile = await deps.googleOAuth.loginWithCode({ code, codeVerifier: flow.codeVerifier });
+        }
+        catch (err) {
+            return redirectWithError(context, flow.returnTo, err instanceof Error ? err.message : String(err));
+        }
+        const decision = await deps.accessPolicy.decide(profile.email);
+        if (!decision.allow)
+            return redirectWithError(context, flow.returnTo, decision.reason ?? 'Not authorized.');
+        // Resolve / create the user record. Google `sub` is stable across
+        // email changes; prefer it as the join key, fall back to email
+        // for invited users who haven't logged in before.
+        const isAdmin = deps.accessPolicy.isAdmin(profile.email);
+        let user = await deps.userRegistry.getByGoogleSub(profile.sub);
+        if (!user) {
+            const inviteRole = decision.viaInvite?.serverRole;
+            user = await deps.userRegistry.create({
+                id: newUserId(),
+                googleSub: profile.sub,
+                email: profile.email,
+                displayName: profile.displayName,
+                serverRole: isAdmin ? 'admin' : inviteRole ?? 'user',
+                createdAt: deps.clock.now(),
+            });
+            if (decision.viaInvite)
+                await deps.accessPolicy.consumeInvite(profile.email);
+        }
+        else if (isAdmin && user.serverRole !== 'admin') {
+            // BRAID_ADMIN_EMAILS was edited after this user was created.
+            // Promote on next login so re-deploying with new admin emails
+            // doesn't require manual user-table surgery.
+            user = await deps.userRegistry.update(user.id, { serverRole: 'admin' });
+        }
+        const session = await deps.sessionStore.issue(user.id);
+        const target = `${flow.returnTo}#token=${encodeURIComponent(session.token)}`;
+        return context.redirect(target, 302);
+    });
+    router.post('/logout', async (context) => {
+        const header = context.req.header('Authorization');
+        const token = header?.startsWith('Bearer ') ? header.slice('Bearer '.length).trim() : null;
+        if (token)
+            await deps.sessionStore.revoke(token);
+        return context.body(null, 204);
+    });
+    router.get('/whoami', async (context) => {
+        // `/auth/*` is in the auth middleware's PUBLIC_PREFIXES, so the
+        // Bearer header isn't validated upstream. Whoami exists precisely
+        // to identify the caller, so resolve the Bearer token here
+        // directly rather than trusting `userIdMiddleware`'s local-user
+        // fallback. Absent / invalid token → `{ user: null }`.
+        const header = context.req.header('Authorization');
+        const token = header?.startsWith('Bearer ') ? header.slice('Bearer '.length).trim() : null;
+        let userId;
+        if (token) {
+            const session = await deps.sessionStore.resolve(token);
+            userId = session?.userId;
+        }
+        // Local-trust deployments don't issue tokens — fall back to the
+        // context userId so /whoami still works there. authMiddleware
+        // wouldn't have rejected the request anyway.
+        if (!userId && deps.localTrust)
+            userId = context.get('userId');
+        if (!userId)
+            return context.json({ user: null });
+        try {
+            const user = await deps.userRegistry.get(userId);
+            return context.json({ user: user ?? null });
+        }
+        catch (err) {
+            if (err instanceof NotFoundError)
+                return context.json({ user: null });
+            throw err;
+        }
+    });
+    // Hint at the configured studio URL + auth mode so the Login page
+    // can decide whether to gate at all (local trust skips), and
+    // whether Google is actually configured (otherwise the Sign-in
+    // button leads to a 503).
+    router.get('/config', (context) => {
+        return context.json({
+            googleEnabled: deps.googleOAuth !== undefined,
+            studioUrl: deps.studioUrl,
+            requiresAuth: !deps.localTrust,
+        });
+    });
+    return router;
+}
+function redirectWithError(context, target, reason) {
+    // Use a clearly named hash key so the Studio side knows to pull the
+    // error out and surface it on the Login page.
+    const url = `${target}#auth-error=${encodeURIComponent(reason)}`;
+    return context.redirect(url, 302);
+}
+function error_description_or_default(error, description) {
+    if (description && description.length > 0)
+        return description;
+    if (error && error.length > 0)
+        return error;
+    return 'Google sign-in failed.';
+}
+//# sourceMappingURL=auth.js.map

package/dist/routes/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,wCAAwC,CAAA;AAQ7F,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AA4BrC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAEF,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAA;AAEF,MAAM,UAAU,gBAAgB,CAAC,IAAoB;IACnD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IACzB,+DAA+D;IAC/D,oEAAoE;IACpE,sDAAsD;IACtD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE9C,SAAS,WAAW;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAA;QAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,IAAI,CAAC,SAAS,GAAG,MAAM;gBACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC5C,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC,IAAI,CACjB;gBACE,KAAK,EAAE,4BAA4B;gBACnC,MAAM,EAAE,yGAAyG;aAClH,EACD,GAAG,CACJ,CAAA;QACH,CAAC;QACD,WAAW,EAAE,CAAA;QACb,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC;YAClC,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;SACxC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,EAAE,GAAG,CAAC,CAAA;QACzD,MAAM,KAAK,GAAG,gBAAgB,EAAE,CAAA;QAChC,MAAM,YAAY,GAAG,kBAAkB,EAAE,CAAA;QACzC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;YACjB,YAAY;YACZ,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS;YAChD,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC,CAAA;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAA;QACnE,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAA;IAChD,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC/C,IAAI,CAAC,IAAI,CAAC,WAAW;YACnB,OAAO,OAAO,CAAC,IAAI,CAAC,kDAAkD,EAAE,GAAG,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC;YACrC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAC/B,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YACjC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;YACjC,iBAAiB,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC;SAC1D,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,OAAO,OAAO,CAAC,IAAI,CAAC,8BAA8B,EAAE,GAAG,CAAC,CAAA;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAA;QAC/E,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAC1B,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAA;QAE1G,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAC/B,IAAI,CAAC,IAAI;YACP,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,sDAAsD,CAAC,CAAA;QAC3G,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAErB,IAAI,OAAO,CAAA;QACX,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QACpG,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QAC9D,IAAI,CAAC,QAAQ,CAAC,KAAK;YACjB,OAAO,iBAAiB,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,IAAI,iBAAiB,CAAC,CAAA;QAExF,kEAAkE;QAClE,+DAA+D;QAC/D,kDAAkD;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACxD,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;YACjD,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;gBACpC,EAAE,EAAE,SAAS,EAAE;gBACf,SAAS,EAAE,OAAO,CAAC,GAAG;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,IAAI,MAAM;gBACpD,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAe;aACzC,CAAC,CAAA;YACF,IAAI,QAAQ,CAAC,SAAS;gBACpB,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACxD,CAAC;aACI,IAAI,OAAO,IAAI,IAAI,CAAC,UAAU,KAAK,OAAO,EAAE,CAAC;YAChD,6DAA6D;YAC7D,8DAA8D;YAC9D,6CAA6C;YAC7C,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;QACzE,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,UAAU,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAA;QAC5E,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1F,IAAI,KAAK;YACP,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACvC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACtC,gEAAgE;QAChE,kEAAkE;QAClE,2DAA2D;QAC3D,gEAAgE;QAChE,uDAAuD;QACvD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAClD,MAAM,KAAK,GAAG,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QAC1F,IAAI,MAA0B,CAAA;QAC9B,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;YACtD,MAAM,GAAG,OAAO,EAAE,MAAM,CAAA;QAC1B,CAAC;QACD,gEAAgE;QAChE,8DAA8D;QAC9D,6CAA6C;QAC7C,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU;YAC5B,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAuB,CAAA;QACtD,IAAI,CAAC,MAAM;YACT,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAChD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,CAAA;QAC7C,CAAC;QACD,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,GAAG,YAAY,aAAa;gBAC9B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACrC,MAAM,GAAG,CAAA;QACX,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,kEAAkE;IAClE,6DAA6D;IAC7D,+DAA+D;IAC/D,0BAA0B;IAC1B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,aAAa,EAAE,IAAI,CAAC,WAAW,KAAK,SAAS;YAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,CAAC,IAAI,CAAC,UAAU;SAC/B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB,EAAE,MAAc,EAAE,MAAc;IACzE,oEAAoE;IACpE,8CAA8C;IAC9C,MAAM,GAAG,GAAG,GAAG,MAAM,eAAe,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAA;IAChE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAyB,EAAE,WAA+B;IAC9F,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;QACvC,OAAO,WAAW,CAAA;IACpB,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAC3B,OAAO,KAAK,CAAA;IACd,OAAO,wBAAwB,CAAA;AACjC,CAAC"}

package/dist/routes/batch.d.ts

@@ -0,0 +1,7 @@
+import type { BatchService } from '@braidhq/core';
+import { Hono } from 'hono';
+export interface BatchRouterDeps {
+    batchService: BatchService;
+}
+export declare function createBatchRouter(deps: BatchRouterDeps): Hono;
+//# sourceMappingURL=batch.d.ts.map

package/dist/routes/batch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.d.ts","sourceRoot":"","sources":["../../src/routes/batch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAGjD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAS3B,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,YAAY,CAAA;CAC3B;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CA0C7D"}

package/dist/routes/batch.js

@@ -0,0 +1,47 @@
+import { NotFoundError } from '@braidhq/core';
+import { zValidator } from '@hono/zod-validator';
+import { Hono } from 'hono';
+import { z } from 'zod';
+import { extractBearerToken } from '../middleware/auth.js';
+import { getWorkspaceId } from '../middleware/workspaceId.js';
+const StartBody = z.object({
+    autoApply: z.boolean(),
+});
+export function createBatchRouter(deps) {
+    const router = new Hono();
+    router.post('/', zValidator('json', StartBody), async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const { autoApply } = context.req.valid('json');
+        const callerToken = extractBearerToken(context);
+        const plan = await deps.batchService.start(workspaceId, {
+            autoApply,
+            ...(callerToken ? { callerToken } : {}),
+        });
+        return context.json(plan.toData(), 202);
+    });
+    router.get('/', async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const plan = await deps.batchService.getStatus(workspaceId);
+        if (!plan)
+            throw new NotFoundError(`No batch plan for workspace ${workspaceId}`);
+        return context.json(plan.toData());
+    });
+    router.post('/stop', async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        await deps.batchService.stop(workspaceId);
+        return context.body(null, 204);
+    });
+    router.post('/resume', async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const callerToken = extractBearerToken(context);
+        const plan = await deps.batchService.resume(workspaceId, callerToken ? { callerToken } : {});
+        return context.json(plan.toData(), 202);
+    });
+    router.post('/archive', async (context) => {
+        const workspaceId = getWorkspaceId(context);
+        const plan = await deps.batchService.archive(workspaceId);
+        return context.json(plan.toData());
+    });
+    return router;
+}
+//# sourceMappingURL=batch.js.map

package/dist/routes/batch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch.js","sourceRoot":"","sources":["../../src/routes/batch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAC3B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAE7D,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAA;AAMF,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,MAAM,GAAG,IAAI,IAAI,EAAE,CAAA;IAEzB,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChE,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC/C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE;YACtD,SAAS;YACT,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAA;QACF,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAChC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,WAAW,CAAC,CAAA;QAC3D,IAAI,CAAC,IAAI;YACP,MAAM,IAAI,aAAa,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAA;QACvE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACrC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACvC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QAC5F,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QACxC,MAAM,WAAW,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QACzD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;IACpC,CAAC,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/routes/clarify.d.ts

@@ -1,8 +1,9 @@
-import type { ClarifyTicketRepository, HITLService } from '@braidhq/core';
-import { Hono } from 'hono';
+import type { ClarifyTicketRepository, DecisionRepository, HITLService } from '@braidhq/core';
+import { OpenAPIHono } from '@hono/zod-openapi';
 export interface ClarifyRouterDeps {
     hitlService: HITLService;
     clarifyRepository: ClarifyTicketRepository;
+    decisionRepository: DecisionRepository;
 }
-export declare function createClarifyRouter(deps: ClarifyRouterDeps): Hono;
+export declare function createClarifyRouter(deps: ClarifyRouterDeps): OpenAPIHono;
 //# sourceMappingURL=clarify.d.ts.map

package/dist/routes/clarify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clarify.d.ts","sourceRoot":"","sources":["../../src/routes/clarify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAGzE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AA4B3B,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,WAAW,CAAA;IACxB,iBAAiB,EAAE,uBAAuB,CAAA;CAC3C;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CA6EjE"}
+{"version":3,"file":"clarify.d.ts","sourceRoot":"","sources":["../../src/routes/clarify.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAI7F,OAAO,EAAe,WAAW,EAAK,MAAM,mBAAmB,CAAA;AAwF/D,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,WAAW,CAAA;IACxB,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C,kBAAkB,EAAE,kBAAkB,CAAA;CACvC;AAiHD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,WAAW,CAsGxE"}