@connextar/house 0.17.0 → 0.19.0

package/dist/admin/bootstrap.d.ts

@@ -0,0 +1,80 @@
+import { type AdminAuditEvent, type AdminAuditScope, type AdminAuditSink } from "./audit.js";
+/**
+ * Grant — or revoke — the first administrator, from a script.
+ *
+ * Nothing inside a product can make an administrator, deliberately: sign-up cannot ask for the flag and no screen
+ * grants it to yourself. That leaves exactly one gap, a fresh deployment with nobody to open the door, and every app
+ * closes it with a script. AltEd's and PM Tool's disagreed on the part that matters:
+ *
+ * - **An administrator already exists → refused**, unless forced. A second one is ordinary work for the first,
+ *   through a screen where it is audited and attributed. Both.
+ * - **The account must already have two-factor on → refused otherwise** (PM Tool). An administrator account without a
+ *   second factor can be enrolled by whoever first holds its mailbox or a session, and the code they enrolled would
+ *   then open administration. So the person signs up and turns two-factor on first, then this is run. AltEd promoted
+ *   anybody, and created the account if it was missing.
+ * - **The account must exist, be verified, and not be deleted** (PM Tool). An unverified row may be somebody else's
+ *   sign-up with this address and a password of their choosing.
+ * - **Every run is recorded** — the grant, the revoke, and the refusal. AltEd recorded its grant; PM Tool nothing.
+ *
+ * `allowWithoutTwoFactor` is the documented first-run escape, for a deployment whose only way to turn two-factor on is
+ * behind administration. It works only while there is no administrator at all, and the event says it was used.
+ * `adminAccess` still refuses that administrator until they turn two-factor on and sign in with it.
+ */
+export interface BootstrapUser {
+    id: string;
+    email: string;
+    name?: string | null;
+    isAdmin: boolean;
+    /** Omit when the app has no verification step. */
+    emailVerified?: boolean | null;
+    /** Soft-deleted. */
+    deleted?: boolean | null;
+}
+export interface BootstrapAdminDeps {
+    /** By email, lower-cased. */
+    findUser(email: string): Promise<BootstrapUser | null | undefined>;
+    /** Administrators that exist now, not counting deleted accounts. */
+    countAdmins(): Promise<number>;
+    setAdmin(userId: string, isAdmin: boolean): Promise<void>;
+    twoFactorEnabled(userId: string): Promise<boolean | null | undefined>;
+    audit: AdminAuditSink;
+}
+export interface BootstrapAdminRequest {
+    email: string;
+    /** Grant although an administrator exists. */
+    force?: boolean;
+    /** Take the standing away instead. */
+    revoke?: boolean;
+    /** The first-run escape. See above. */
+    allowWithoutTwoFactor?: boolean;
+    /** The standing's name in the event: `"platform-admin"`, `"ADMIN"`. Default `"admin"`. */
+    standing?: string;
+    /** What the account had before, in the event. Default `"user"`. */
+    previousStanding?: string;
+    /** Default platform. */
+    scope?: AdminAuditScope;
+    /** The script's name in the event. Default `"bootstrap-admin"`. */
+    via?: string;
+}
+export type BootstrapRefusalReason = "invalid-email" | "no-account" | "deleted" | "unverified" | "already-admin" | "not-admin" | "admin-exists" | "two-factor-off" | "escape-not-first-run";
+export type BootstrapAdminResult = {
+    ok: true;
+    outcome: "granted" | "revoked";
+    user: BootstrapUser;
+    message: string;
+    event: AdminAuditEvent;
+} | {
+    ok: false;
+    reason: BootstrapRefusalReason;
+    message: string;
+    event: AdminAuditEvent;
+};
+export declare function bootstrapAdmin(deps: BootstrapAdminDeps, request: BootstrapAdminRequest): Promise<BootstrapAdminResult>;
+/**
+ * The script's arguments: `you@example.com`, `--force`, `--revoke`, `--allow-without-two-factor`. Anything else
+ * starting with `--` is an error, so a typo never quietly grants without the flag that was meant.
+ */
+export declare function bootstrapAdminArgs(argv: readonly string[]): BootstrapAdminRequest & {
+    rest: string[];
+};
+//# sourceMappingURL=bootstrap.d.ts.map

package/dist/admin/bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/admin/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC/B,oBAAoB;IACpB,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,6BAA6B;IAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACnE,oEAAoE;IACpE,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE,KAAK,EAAE,cAAc,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sCAAsC;IACtC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wBAAwB;IACxB,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,MAAM,sBAAsB,GAC9B,eAAe,GACf,YAAY,GACZ,SAAS,GACT,YAAY,GACZ,eAAe,GACf,WAAW,GACX,cAAc,GACd,gBAAgB,GAChB,sBAAsB,CAAC;AAE3B,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,SAAS,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,GAC1G;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAA;CAAE,CAAC;AAE3F,wBAAsB,cAAc,CAClC,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAwH/B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,qBAAqB,GAAG;IAAE,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAYtG"}

package/dist/admin/bootstrap.js

@@ -0,0 +1,106 @@
+import { roleChanged } from "./audit.js";
+export async function bootstrapAdmin(deps, request) {
+    const email = request.email?.trim().toLowerCase() ?? "";
+    const standing = request.standing ?? "admin";
+    const previous = request.previousStanding ?? "user";
+    const via = request.via ?? "bootstrap-admin";
+    const scope = request.scope ?? { kind: "platform" };
+    async function refuse(reason, message, user) {
+        const event = {
+            action: "admin.bootstrap_refused",
+            actor: null,
+            scope,
+            entity: { type: "user", id: user?.id ?? null },
+            summary: `Refused to ${request.revoke ? "revoke" : "grant"} ${standing} for ${email || "(no email)"} (${via}): ${reason}`.slice(0, 300),
+            changes: { reason, email, revoke: !!request.revoke, force: !!request.force, via },
+            at: new Date(),
+        };
+        await record(event);
+        return { ok: false, reason, message, event };
+    }
+    async function record(event) {
+        try {
+            await deps.audit(event);
+        }
+        catch (error) {
+            // A script is run by a person watching it: say so loudly, rather than swallow it as a request would.
+            throw new Error(`[admin] ${event.action} could not be recorded in the audit trail: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+        }
+    }
+    if (!email || !/^[^\s@]+@[^\s@]+$/.test(email)) {
+        return refuse("invalid-email", "Give the email address of the account to make an administrator.");
+    }
+    const user = await deps.findUser(email);
+    if (!user) {
+        return refuse("no-account", `No account for ${email}. They sign up first, turn on two-factor authentication in their security settings, then run this again.`);
+    }
+    if (user.deleted)
+        return refuse("deleted", `${email} belongs to a deleted account. Restore it first.`, user);
+    if (request.revoke) {
+        if (!user.isAdmin)
+            return refuse("not-admin", `${email} is not an administrator.`, user);
+        await deps.setAdmin(user.id, false);
+        const event = roleChanged({ actor: null, target: user, from: standing, to: previous, scope, via });
+        await record(event);
+        return { ok: true, outcome: "revoked", user, message: `${email} is no longer an administrator.`, event };
+    }
+    if (user.isAdmin)
+        return refuse("already-admin", `${email} is already an administrator. Nothing was changed.`, user);
+    if (user.emailVerified === false) {
+        return refuse("unverified", `${email} has not been verified. Sign in once with a link to that address, then run this again.`, user);
+    }
+    const admins = await deps.countAdmins();
+    if (admins > 0 && !request.force) {
+        return refuse("admin-exists", `This deployment already has ${admins} administrator${admins === 1 ? "" : "s"}. Grant further administrators ` +
+            "from the screen built for it, where the change is audited. Pass --force only if you are locked out.", user);
+    }
+    const twoFactor = (await deps.twoFactorEnabled(user.id)) === true;
+    const escape = !twoFactor && request.allowWithoutTwoFactor === true;
+    if (!twoFactor) {
+        if (!request.allowWithoutTwoFactor) {
+            return refuse("two-factor-off", `${email} hasn't turned on two-factor authentication. They turn it on first, then run this again.`, user);
+        }
+        if (admins > 0) {
+            return refuse("escape-not-first-run", "--allow-without-two-factor is only for the first administrator of a deployment, and this one has one.", user);
+        }
+    }
+    await deps.setAdmin(user.id, true);
+    const event = roleChanged({
+        actor: null,
+        target: user,
+        from: previous,
+        to: standing,
+        scope,
+        via,
+        changes: { forced: !!request.force, ...(escape ? { withoutTwoFactor: true } : {}) },
+    });
+    await record(event);
+    return {
+        ok: true,
+        outcome: "granted",
+        user,
+        message: escape
+            ? `${email} is now an administrator, without two-factor (first-run escape). Administration stays closed to them until they turn it on and sign in with it.`
+            : `${email} is now an administrator. They sign in with their password and code, or a passkey, to open administration.`,
+        event,
+    };
+}
+/**
+ * The script's arguments: `you@example.com`, `--force`, `--revoke`, `--allow-without-two-factor`. Anything else
+ * starting with `--` is an error, so a typo never quietly grants without the flag that was meant.
+ */
+export function bootstrapAdminArgs(argv) {
+    const flags = new Set(["--force", "--revoke", "--allow-without-two-factor"]);
+    const unknown = argv.filter((arg) => arg.startsWith("--") && !flags.has(arg));
+    if (unknown.length)
+        throw new Error(`Unknown option${unknown.length === 1 ? "" : "s"}: ${unknown.join(", ")}`);
+    const [email = "", ...rest] = argv.filter((arg) => !arg.startsWith("--"));
+    return {
+        email,
+        force: argv.includes("--force"),
+        revoke: argv.includes("--revoke"),
+        allowWithoutTwoFactor: argv.includes("--allow-without-two-factor"),
+        rest,
+    };
+}
+//# sourceMappingURL=bootstrap.js.map

package/dist/admin/bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/admin/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAmE,MAAM,YAAY,CAAC;AA8E1G,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAwB,EACxB,OAA8B;IAE9B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,iBAAiB,CAAC;IAC7C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,IAAI,EAAE,UAAmB,EAAE,CAAC;IAE7D,KAAK,UAAU,MAAM,CACnB,MAA8B,EAC9B,OAAe,EACf,IAA2B;QAE3B,MAAM,KAAK,GAAoB;YAC7B,MAAM,EAAE,yBAAyB;YACjC,KAAK,EAAE,IAAI;YACX,KAAK;YACL,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,IAAI,EAAE;YAC9C,OAAO,EACL,cAAc,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,IAAI,QAAQ,QAAQ,KAAK,IAAI,YAAY,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC,KAAK,CACpH,CAAC,EACD,GAAG,CACJ;YACH,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE;YACjF,EAAE,EAAE,IAAI,IAAI,EAAE;SACf,CAAC;QACF,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,KAAsB;QAC1C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qGAAqG;YACrG,MAAM,IAAI,KAAK,CACb,WAAW,KAAK,CAAC,MAAM,8CAA8C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC7H,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO,MAAM,CAAC,eAAe,EAAE,iEAAiE,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,MAAM,CACX,YAAY,EACZ,kBAAkB,KAAK,0GAA0G,CAClI,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,SAAS,EAAE,GAAG,KAAK,kDAAkD,EAAE,IAAI,CAAC,CAAC;IAE7G,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC,WAAW,EAAE,GAAG,KAAK,2BAA2B,EAAE,IAAI,CAAC,CAAC;QACzF,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,iCAAiC,EAAE,KAAK,EAAE,CAAC;IAC3G,CAAC;IAED,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,GAAG,KAAK,oDAAoD,EAAE,IAAI,CAAC,CAAC;IACrH,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,EAAE,CAAC;QACjC,OAAO,MAAM,CACX,YAAY,EACZ,GAAG,KAAK,wFAAwF,EAChG,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;IACxC,IAAI,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO,MAAM,CACX,cAAc,EACd,+BAA+B,MAAM,iBAAiB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,iCAAiC;YAC5G,qGAAqG,EACvG,IAAI,CACL,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;IAClE,MAAM,MAAM,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,qBAAqB,KAAK,IAAI,CAAC;IACpE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;YACnC,OAAO,MAAM,CACX,gBAAgB,EAChB,GAAG,KAAK,0FAA0F,EAClG,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YACf,OAAO,MAAM,CACX,sBAAsB,EACtB,uGAAuG,EACvG,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,WAAW,CAAC;QACxB,KAAK,EAAE,IAAI;QACX,MAAM,EAAE,IAAI;QACZ,IAAI,EAAE,QAAQ;QACd,EAAE,EAAE,QAAQ;QACZ,KAAK;QACL,GAAG;QACH,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACpF,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC;IACpB,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE,SAAS;QAClB,IAAI;QACJ,OAAO,EAAE,MAAM;YACb,CAAC,CAAC,GAAG,KAAK,iJAAiJ;YAC3J,CAAC,CAAC,GAAG,KAAK,4GAA4G;QACxH,KAAK;KACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAuB;IACxD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,4BAA4B,CAAC,CAAC,CAAC;IAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,MAAM,CAAC,KAAK,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC/B,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;QACjC,qBAAqB,EAAE,IAAI,CAAC,QAAQ,CAAC,4BAA4B,CAAC;QAClE,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/admin/client-index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * `@connextar/house/admin/client` — the refusal notice and the "view as" banner, on the shared theme tokens. Imports
+ * nothing of the server half at runtime: the refusal's type only.
+ */
+export { ADMIN_REFUSAL_ACTION_LABELS, ADMIN_REFUSAL_NOTICE_CLASS_NAMES, ADMIN_REFUSAL_TITLES, AdminRefusalNotice, VIEWING_AS_BANNER_CLASS_NAMES, VIEWING_AS_BANNER_LABELS, ViewingAsBanner, type AdminRefusalNoticeClassNames, type AdminRefusalNoticeProps, type ViewingAsBannerClassNames, type ViewingAsBannerLabels, type ViewingAsBannerProps, } from "./client.js";
+export type { AdminRefusal, AdminRefusalReason } from "./access.js";
+//# sourceMappingURL=client-index.d.ts.map

package/dist/admin/client-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-index.d.ts","sourceRoot":"","sources":["../../src/admin/client-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAChC,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,EACf,KAAK,4BAA4B,EACjC,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC9B,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,GAC1B,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC"}

package/dist/admin/client-index.js

@@ -0,0 +1,6 @@
+/**
+ * `@connextar/house/admin/client` — the refusal notice and the "view as" banner, on the shared theme tokens. Imports
+ * nothing of the server half at runtime: the refusal's type only.
+ */
+export { ADMIN_REFUSAL_ACTION_LABELS, ADMIN_REFUSAL_NOTICE_CLASS_NAMES, ADMIN_REFUSAL_TITLES, AdminRefusalNotice, VIEWING_AS_BANNER_CLASS_NAMES, VIEWING_AS_BANNER_LABELS, ViewingAsBanner, } from "./client.js";
+//# sourceMappingURL=client-index.js.map

package/dist/admin/client-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-index.js","sourceRoot":"","sources":["../../src/admin/client-index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,2BAA2B,EAC3B,gCAAgC,EAChC,oBAAoB,EACpB,kBAAkB,EAClB,6BAA6B,EAC7B,wBAAwB,EACxB,eAAe,GAMhB,MAAM,aAAa,CAAC"}

package/dist/admin/client.d.ts

@@ -0,0 +1,72 @@
+import * as React from "react";
+import type { AdminRefusal, AdminRefusalReason } from "./access.js";
+/** What the notice's link says, per reason. */
+export declare const ADMIN_REFUSAL_ACTION_LABELS: Record<AdminRefusalReason, string>;
+export declare const ADMIN_REFUSAL_TITLES: Record<AdminRefusalReason, string>;
+export interface AdminRefusalNoticeClassNames {
+    root: string;
+    icon: string;
+    body: string;
+    title: string;
+    message: string;
+    action: string;
+}
+/** The house look, on the shared theme tokens. */
+export declare const ADMIN_REFUSAL_NOTICE_CLASS_NAMES: AdminRefusalNoticeClassNames;
+export interface AdminRefusalNoticeProps {
+    /** From `adminAccess().check()`, `adminRefusalFromParam(searchParams.admin)`, or a refused route's answer. */
+    refusal: Pick<AdminRefusal, "reason" | "message" | "fixHref"> | null | undefined;
+    /** The link's words, per reason. */
+    labels?: Partial<Record<AdminRefusalReason, string>>;
+    /** The heading, per reason. */
+    titles?: Partial<Record<AdminRefusalReason, string>>;
+    className?: string;
+    classNames?: Partial<AdminRefusalNoticeClassNames>;
+}
+/**
+ * Why administration is refused, in the same words the routes refuse with, and the one thing to do about it. Draws
+ * nothing without a refusal, so a settings page can render it unconditionally from its `?admin=` parameter.
+ */
+export declare function AdminRefusalNotice({ refusal, labels, titles, className, classNames }: AdminRefusalNoticeProps): React.JSX.Element | null;
+export interface ViewingAsBannerClassNames {
+    root: string;
+    icon: string;
+    message: string;
+    until: string;
+    stop: string;
+}
+export declare const VIEWING_AS_BANNER_CLASS_NAMES: ViewingAsBannerClassNames;
+export interface ViewingAsBannerLabels {
+    /** Default: "You’re viewing as {name}. Nothing can be changed until you stop." */
+    message: (name: string) => string;
+    /** Default: "Ends at {time}". */
+    until: (time: string) => string;
+    stop: string;
+    stopping: string;
+    /** The error toast's title when stopping fails. */
+    failed: string;
+}
+export declare const VIEWING_AS_BANNER_LABELS: ViewingAsBannerLabels;
+export interface ViewingAsBannerProps {
+    /** The person being viewed. */
+    name: string;
+    /** When the view lapses on its own. */
+    expiresAt?: Date | string | null;
+    /**
+     * End the view — `DELETE /api/admin/view-as`, then a reload or `router.refresh()`. Throw to refuse: the banner stays
+     * and the reason is reported through the app's `ActionFeedbackProvider`.
+     */
+    onStop: () => void | Promise<void>;
+    labels?: Partial<ViewingAsBannerLabels>;
+    /** For the end time. Default the browser's. */
+    locale?: string;
+    timeZone?: string;
+    className?: string;
+    classNames?: Partial<ViewingAsBannerClassNames>;
+}
+/**
+ * Above every page while a view is in force, and it cannot be dismissed: the only way to make it go is to stop.
+ * Loud on purpose — the screens below look exactly like the person's own.
+ */
+export declare function ViewingAsBanner({ name, expiresAt, onStop, labels, locale, timeZone, className, classNames, }: ViewingAsBannerProps): React.JSX.Element;
+//# sourceMappingURL=client.d.ts.map

package/dist/admin/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/admin/client.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAI/B,OAAO,KAAK,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEpE,+CAA+C;AAC/C,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAO1E,CAAC;AAEF,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAOnE,CAAC;AAEF,MAAM,WAAW,4BAA4B;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,kDAAkD;AAClD,eAAO,MAAM,gCAAgC,EAAE,4BAQ9C,CAAC;AAEF,MAAM,WAAW,uBAAuB;IACtC,8GAA8G;IAC9G,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACjF,oCAAoC;IACpC,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,+BAA+B;IAC/B,MAAM,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC,4BAA4B,CAAC,CAAC;CACpD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,EAAE,uBAAuB,4BAmB7G;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,eAAO,MAAM,6BAA6B,EAAE,yBAM3C,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAClC,iCAAiC;IACjC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,eAAO,MAAM,wBAAwB,EAAE,qBAMtC,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC;;;OAGG;IACH,MAAM,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;CACjD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,SAAS,EACT,UAAU,GACX,EAAE,oBAAoB,qBAoCtB"}

package/dist/admin/client.js

@@ -0,0 +1,90 @@
+"use client";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Eye, ShieldAlert } from "lucide-react";
+import * as React from "react";
+import { cx } from "../internal/cx.js";
+import { useActionReporter } from "../ux/feedback.js";
+/** What the notice's link says, per reason. */
+export const ADMIN_REFUSAL_ACTION_LABELS = {
+    "signed-out": "Sign in",
+    "session-ended": "Sign in again",
+    "not-admin": "Go back",
+    "two-factor-off": "Set up two-factor",
+    "sign-in-without-second-factor": "Sign in with your code",
+    "viewing-as": "Stop viewing",
+};
+export const ADMIN_REFUSAL_TITLES = {
+    "signed-out": "You’re signed out",
+    "session-ended": "This sign-in has ended",
+    "not-admin": "Administrators only",
+    "two-factor-off": "Administration needs two-factor",
+    "sign-in-without-second-factor": "Sign in with your second factor",
+    "viewing-as": "You’re viewing as somebody else",
+};
+/** The house look, on the shared theme tokens. */
+export const ADMIN_REFUSAL_NOTICE_CLASS_NAMES = {
+    root: "flex items-start gap-3 rounded-lg border border-destructive/40 bg-destructive/5 p-4 text-sm",
+    icon: "mt-0.5 size-4 shrink-0 text-destructive",
+    body: "flex min-w-0 flex-1 flex-col gap-1",
+    title: "font-medium text-foreground",
+    message: "text-muted-foreground",
+    action: "mt-1 inline-flex w-fit items-center rounded-md border border-border px-2.5 py-1 text-xs font-medium text-foreground transition-colors hover:bg-muted focus-visible:ring-2 focus-visible:ring-ring focus-visible:outline-none",
+};
+/**
+ * Why administration is refused, in the same words the routes refuse with, and the one thing to do about it. Draws
+ * nothing without a refusal, so a settings page can render it unconditionally from its `?admin=` parameter.
+ */
+export function AdminRefusalNotice({ refusal, labels, titles, className, classNames }) {
+    if (!refusal)
+        return null;
+    const c = { ...ADMIN_REFUSAL_NOTICE_CLASS_NAMES, ...classNames };
+    const title = titles?.[refusal.reason] ?? ADMIN_REFUSAL_TITLES[refusal.reason];
+    const label = labels?.[refusal.reason] ?? ADMIN_REFUSAL_ACTION_LABELS[refusal.reason];
+    return (_jsxs("div", { role: "alert", "data-reason": refusal.reason, className: cx(c.root, className), children: [_jsx(ShieldAlert, { "aria-hidden": "true", className: c.icon }), _jsxs("div", { className: c.body, children: [_jsx("p", { className: c.title, children: title }), _jsx("p", { className: c.message, children: refusal.message }), refusal.fixHref ? (_jsx("a", { href: refusal.fixHref, className: c.action, children: label })) : null] })] }));
+}
+export const VIEWING_AS_BANNER_CLASS_NAMES = {
+    root: "sticky top-0 z-50 flex flex-wrap items-center justify-center gap-x-3 gap-y-1 border-b border-primary/30 bg-primary px-4 py-2 text-sm text-primary-foreground print:hidden",
+    icon: "size-4 shrink-0",
+    message: "font-medium",
+    until: "text-primary-foreground/80",
+    stop: "inline-flex items-center rounded-md border border-primary-foreground/40 px-2.5 py-0.5 text-xs font-medium transition-colors hover:bg-primary-foreground/10 focus-visible:ring-2 focus-visible:ring-primary-foreground focus-visible:outline-none disabled:pointer-events-none disabled:opacity-60",
+};
+export const VIEWING_AS_BANNER_LABELS = {
+    message: (name) => `You’re viewing as ${name}. Nothing can be changed until you stop.`,
+    until: (time) => `Ends at ${time}`,
+    stop: "Stop viewing",
+    stopping: "Stopping…",
+    failed: "Could not stop viewing",
+};
+/**
+ * Above every page while a view is in force, and it cannot be dismissed: the only way to make it go is to stop.
+ * Loud on purpose — the screens below look exactly like the person's own.
+ */
+export function ViewingAsBanner({ name, expiresAt, onStop, labels, locale, timeZone, className, classNames, }) {
+    const c = { ...VIEWING_AS_BANNER_CLASS_NAMES, ...classNames };
+    const words = { ...VIEWING_AS_BANNER_LABELS, ...labels };
+    const report = useActionReporter();
+    const [stopping, setStopping] = React.useState(false);
+    const until = expiresAt ? new Date(expiresAt) : null;
+    const time = until && !Number.isNaN(until.getTime())
+        ? until.toLocaleTimeString(locale, { hour: "numeric", minute: "2-digit", ...(timeZone ? { timeZone } : {}) })
+        : null;
+    async function stop() {
+        setStopping(true);
+        try {
+            await onStop();
+        }
+        catch (error) {
+            report({
+                tone: "error",
+                title: words.failed,
+                ...(error instanceof Error && error.message ? { description: error.message } : {}),
+            });
+        }
+        finally {
+            setStopping(false);
+        }
+    }
+    return (_jsxs("div", { role: "status", "aria-live": "polite", "data-viewing-as": "", className: cx(c.root, className), children: [_jsx(Eye, { "aria-hidden": "true", className: c.icon }), _jsx("span", { className: c.message, children: words.message(name) }), time ? _jsx("span", { className: c.until, children: words.until(time) }) : null, _jsx("button", { type: "button", className: c.stop, onClick: () => void stop(), disabled: stopping, "aria-busy": stopping, children: stopping ? words.stopping : words.stop })] }));
+}
+//# sourceMappingURL=client.js.map

package/dist/admin/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/admin/client.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAE/B,OAAO,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAGtD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,2BAA2B,GAAuC;IAC7E,YAAY,EAAE,SAAS;IACvB,eAAe,EAAE,eAAe;IAChC,WAAW,EAAE,SAAS;IACtB,gBAAgB,EAAE,mBAAmB;IACrC,+BAA+B,EAAE,wBAAwB;IACzD,YAAY,EAAE,cAAc;CAC7B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAuC;IACtE,YAAY,EAAE,mBAAmB;IACjC,eAAe,EAAE,wBAAwB;IACzC,WAAW,EAAE,qBAAqB;IAClC,gBAAgB,EAAE,iCAAiC;IACnD,+BAA+B,EAAE,iCAAiC;IAClE,YAAY,EAAE,iCAAiC;CAChD,CAAC;AAWF,kDAAkD;AAClD,MAAM,CAAC,MAAM,gCAAgC,GAAiC;IAC5E,IAAI,EAAE,6FAA6F;IACnG,IAAI,EAAE,yCAAyC;IAC/C,IAAI,EAAE,oCAAoC;IAC1C,KAAK,EAAE,6BAA6B;IACpC,OAAO,EAAE,uBAAuB;IAChC,MAAM,EACJ,8NAA8N;CACjO,CAAC;AAaF;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAA2B;IAC5G,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAiC,EAAE,GAAG,gCAAgC,EAAE,GAAG,UAAU,EAAE,CAAC;IAC/F,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,2BAA2B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtF,OAAO,CACL,eAAK,IAAI,EAAC,OAAO,iBAAc,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,aAC7E,KAAC,WAAW,mBAAa,MAAM,EAAC,SAAS,EAAE,CAAC,CAAC,IAAI,GAAI,EACrD,eAAK,SAAS,EAAE,CAAC,CAAC,IAAI,aACpB,YAAG,SAAS,EAAE,CAAC,CAAC,KAAK,YAAG,KAAK,GAAK,EAClC,YAAG,SAAS,EAAE,CAAC,CAAC,OAAO,YAAG,OAAO,CAAC,OAAO,GAAK,EAC7C,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CACjB,YAAG,IAAI,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,YAC1C,KAAK,GACJ,CACL,CAAC,CAAC,CAAC,IAAI,IACJ,IACF,CACP,CAAC;AACJ,CAAC;AAUD,MAAM,CAAC,MAAM,6BAA6B,GAA8B;IACtE,IAAI,EAAE,2KAA2K;IACjL,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,aAAa;IACtB,KAAK,EAAE,4BAA4B;IACnC,IAAI,EAAE,mSAAmS;CAC1S,CAAC;AAaF,MAAM,CAAC,MAAM,wBAAwB,GAA0B;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,IAAI,0CAA0C;IACtF,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,EAAE;IAClC,IAAI,EAAE,cAAc;IACpB,QAAQ,EAAE,WAAW;IACrB,MAAM,EAAE,wBAAwB;CACjC,CAAC;AAoBF;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAC9B,IAAI,EACJ,SAAS,EACT,MAAM,EACN,MAAM,EACN,MAAM,EACN,QAAQ,EACR,SAAS,EACT,UAAU,GACW;IACrB,MAAM,CAAC,GAA8B,EAAE,GAAG,6BAA6B,EAAE,GAAG,UAAU,EAAE,CAAC;IACzF,MAAM,KAAK,GAA0B,EAAE,GAAG,wBAAwB,EAAE,GAAG,MAAM,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;IACnC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACrD,MAAM,IAAI,GACR,KAAK,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC7G,CAAC,CAAC,IAAI,CAAC;IAEX,KAAK,UAAU,IAAI;QACjB,WAAW,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC;gBACL,IAAI,EAAE,OAAO;gBACb,KAAK,EAAE,KAAK,CAAC,MAAM;gBACnB,GAAG,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnF,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,CACL,eAAK,IAAI,EAAC,QAAQ,eAAW,QAAQ,qBAAiB,EAAE,EAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,aACvF,KAAC,GAAG,mBAAa,MAAM,EAAC,SAAS,EAAE,CAAC,CAAC,IAAI,GAAI,EAC7C,eAAM,SAAS,EAAE,CAAC,CAAC,OAAO,YAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAQ,EACvD,IAAI,CAAC,CAAC,CAAC,eAAM,SAAS,EAAE,CAAC,CAAC,KAAK,YAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAQ,CAAC,CAAC,CAAC,IAAI,EACnE,iBAAQ,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,KAAK,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,eAAa,QAAQ,YACzG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAChC,IACL,CACP,CAAC;AACJ,CAAC"}

package/dist/admin/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `@connextar/house/admin` — the server half of administration: who may use it, "view as", the audit event shape and
+ * the bootstrap script's rules. Imports no Better Auth and no Prisma — every lookup is injected — and nothing but
+ * `node:crypto`, so an app with its own auth (Canisters) takes the decision, the audit shape and "view as" as they
+ * are. The Better Auth plugin that records second-factor sign-ins is `@connextar/house/admin/second-factor`; the
+ * notice and the banner are `@connextar/house/admin/client`; the guard-coverage sweep is `@connextar/house/admin/testing`.
+ */
+export { ADMIN_REFUSAL_REASONS, AdminRefusalError, DEFAULT_ADMIN_REFUSAL_WORDS, adminAccess, adminRefusal, adminRefusalFromParam, assertAdminAccess, decideAdminAccess, type AdminAccess, type AdminAccessDecision, type AdminAccessFacts, type AdminAccessLookups, type AdminAccessOptions, type AdminRefusal, type AdminRefusalReason, type AdminRefusalWording, type AdminRefusalWords, type SignedIn, } from "./access.js";
+export { PLATFORM_SCOPE, SUMMARY_MAX, adminSignedIn, emitSafely, platformAction, requestMeta, roleChanged, viewAsStarted, viewAsStopped, type AdminAuditActor, type AdminAuditEvent, type AdminAuditScope, type AdminAuditSink, type AdminSignInMethod, type AuditLogger, type RequestMeta, } from "./audit.js";
+export { bootstrapAdmin, bootstrapAdminArgs, type BootstrapAdminDeps, type BootstrapAdminRequest, type BootstrapAdminResult, type BootstrapRefusalReason, type BootstrapUser, } from "./bootstrap.js";
+export { DEFAULT_ADMIN_PROOF_PREFIX, adminProofIdentifier, isLiveProof, sessionProofReader, type AuthWithProofs, type ProofRow, } from "./proof.js";
+export { PRISMA_WRITE_OPERATIONS, allowWhileViewing, refuseWhileViewingAs, viewAs, viewAsWriteGuard, viewingAsGate, viewingAsMessage, type CookieJar, type MaybeViewing, type PrismaOperationParams, type RealAdmin, type RefuseWhileViewingAsOptions, type ViewAs, type ViewAsCookieOptions, type ViewAsOptions, type ViewAsStartRefusal, type ViewAsStartResult, type ViewAsWriteGuardOptions, type ViewingAs, type ViewingAsGate, type ViewingAsGateOptions, type ViewingLookup, } from "./view-as.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/admin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,2BAA2B,EAC3B,WAAW,EACX,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,EACb,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,oBAAoB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,GACnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,WAAW,EACX,kBAAkB,EAClB,KAAK,cAAc,EACnB,KAAK,QAAQ,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,EACN,gBAAgB,EAChB,aAAa,EACb,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,2BAA2B,EAChC,KAAK,MAAM,EACX,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,oBAAoB,EACzB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC"}

package/dist/admin/index.js

@@ -0,0 +1,13 @@
+/**
+ * `@connextar/house/admin` — the server half of administration: who may use it, "view as", the audit event shape and
+ * the bootstrap script's rules. Imports no Better Auth and no Prisma — every lookup is injected — and nothing but
+ * `node:crypto`, so an app with its own auth (Canisters) takes the decision, the audit shape and "view as" as they
+ * are. The Better Auth plugin that records second-factor sign-ins is `@connextar/house/admin/second-factor`; the
+ * notice and the banner are `@connextar/house/admin/client`; the guard-coverage sweep is `@connextar/house/admin/testing`.
+ */
+export { ADMIN_REFUSAL_REASONS, AdminRefusalError, DEFAULT_ADMIN_REFUSAL_WORDS, adminAccess, adminRefusal, adminRefusalFromParam, assertAdminAccess, decideAdminAccess, } from "./access.js";
+export { PLATFORM_SCOPE, SUMMARY_MAX, adminSignedIn, emitSafely, platformAction, requestMeta, roleChanged, viewAsStarted, viewAsStopped, } from "./audit.js";
+export { bootstrapAdmin, bootstrapAdminArgs, } from "./bootstrap.js";
+export { DEFAULT_ADMIN_PROOF_PREFIX, adminProofIdentifier, isLiveProof, sessionProofReader, } from "./proof.js";
+export { PRISMA_WRITE_OPERATIONS, allowWhileViewing, refuseWhileViewingAs, viewAs, viewAsWriteGuard, viewingAsGate, viewingAsMessage, } from "./view-as.js";
+//# sourceMappingURL=index.js.map

package/dist/admin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/admin/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,2BAA2B,EAC3B,WAAW,EACX,YAAY,EACZ,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,GAWlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,cAAc,EACd,WAAW,EACX,aAAa,EACb,UAAU,EACV,cAAc,EACd,WAAW,EACX,WAAW,EACX,aAAa,EACb,aAAa,GAQd,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,cAAc,EACd,kBAAkB,GAMnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,WAAW,EACX,kBAAkB,GAGnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,oBAAoB,EACpB,MAAM,EACN,gBAAgB,EAChB,aAAa,EACb,gBAAgB,GAgBjB,MAAM,cAAc,CAAC"}

package/dist/admin/proof.d.ts

@@ -0,0 +1,34 @@
+/**
+ * The record that says a session was made with a second factor — shared by the Better Auth plugin that writes it
+ * (`@connextar/house/admin/second-factor`) and `adminAccess`, which reads it. Nothing here imports Better Auth: the
+ * reader takes the instance structurally, so `@connextar/house/admin` loads in an app without it.
+ *
+ * It is a row in Better Auth's own `verification` table — `<prefix><session id>`, the user's id as its value,
+ * expiring with the session it was written for — the table, and the shape, Better Auth keeps its trusted-device
+ * records in. Six apps wrote one each, under three prefixes; an app adopting the shared plugin passes its own prefix,
+ * so the sessions it already recorded keep counting.
+ */
+/** AltEd's and PharmaLine's prefix. Quickie's is `operator-second-factor-`; senco's, PM Tool's and FB Web's `second-factor-session:`. */
+export declare const DEFAULT_ADMIN_PROOF_PREFIX = "admin-second-factor:";
+export declare const adminProofIdentifier: (prefix: string, sessionId: string) => string;
+/** A `verification` row, as Better Auth's internal adapter answers it. */
+export interface ProofRow {
+    value: string;
+    expiresAt: Date | string;
+}
+/** The part of a Better Auth instance the reader needs: `auth.$context` and its internal adapter. */
+export interface AuthWithProofs {
+    $context: PromiseLike<{
+        internalAdapter: {
+            findVerificationValue(identifier: string): Promise<ProofRow | null | undefined>;
+        };
+    }>;
+}
+/** Whether a row is a live proof for this user: it names them and has not expired. */
+export declare function isLiveProof(row: ProofRow | null | undefined, userId: string, now?: number): boolean;
+/**
+ * `sessionProven(sessionId, userId)` read from the plugin's record through Better Auth's own adapter, so it agrees
+ * with the plugin about where and how the record is stored.
+ */
+export declare function sessionProofReader(auth: AuthWithProofs, recordPrefix?: string): (sessionId: string, userId: string) => Promise<boolean>;
+//# sourceMappingURL=proof.d.ts.map

package/dist/admin/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","sourceRoot":"","sources":["../../src/admin/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yIAAyI;AACzI,eAAO,MAAM,0BAA0B,yBAAyB,CAAC;AAEjE,eAAO,MAAM,oBAAoB,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,WAA4B,CAAC;AAEnG,0EAA0E;AAC1E,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;CAC1B;AAED,qGAAqG;AACrG,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,WAAW,CAAC;QACpB,eAAe,EAAE;YAAE,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,GAAG,SAAS,CAAC,CAAA;SAAE,CAAC;KACtG,CAAC,CAAC;CACJ;AAID,sFAAsF;AACtF,wBAAgB,WAAW,CAAC,GAAG,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAEvG;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,YAAY,GAAE,MAAmC,IAC1F,WAAW,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC,OAAO,CAAC,CAKnE"}

package/dist/admin/proof.js

@@ -0,0 +1,30 @@
+/**
+ * The record that says a session was made with a second factor — shared by the Better Auth plugin that writes it
+ * (`@connextar/house/admin/second-factor`) and `adminAccess`, which reads it. Nothing here imports Better Auth: the
+ * reader takes the instance structurally, so `@connextar/house/admin` loads in an app without it.
+ *
+ * It is a row in Better Auth's own `verification` table — `<prefix><session id>`, the user's id as its value,
+ * expiring with the session it was written for — the table, and the shape, Better Auth keeps its trusted-device
+ * records in. Six apps wrote one each, under three prefixes; an app adopting the shared plugin passes its own prefix,
+ * so the sessions it already recorded keep counting.
+ */
+/** AltEd's and PharmaLine's prefix. Quickie's is `operator-second-factor-`; senco's, PM Tool's and FB Web's `second-factor-session:`. */
+export const DEFAULT_ADMIN_PROOF_PREFIX = "admin-second-factor:";
+export const adminProofIdentifier = (prefix, sessionId) => `${prefix}${sessionId}`;
+const toTime = (value) => (value instanceof Date ? value.getTime() : new Date(value).getTime());
+/** Whether a row is a live proof for this user: it names them and has not expired. */
+export function isLiveProof(row, userId, now = Date.now()) {
+    return !!row && row.value === userId && toTime(row.expiresAt) > now;
+}
+/**
+ * `sessionProven(sessionId, userId)` read from the plugin's record through Better Auth's own adapter, so it agrees
+ * with the plugin about where and how the record is stored.
+ */
+export function sessionProofReader(auth, recordPrefix = DEFAULT_ADMIN_PROOF_PREFIX) {
+    return async (sessionId, userId) => {
+        const context = await auth.$context;
+        const row = await context.internalAdapter.findVerificationValue(adminProofIdentifier(recordPrefix, sessionId));
+        return isLiveProof(row, userId);
+    };
+}
+//# sourceMappingURL=proof.js.map

package/dist/admin/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../../src/admin/proof.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,yIAAyI;AACzI,MAAM,CAAC,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAEjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,EAAE,CAAC;AAenG,MAAM,MAAM,GAAG,CAAC,KAAoB,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAE/G,sFAAsF;AACtF,MAAM,UAAU,WAAW,CAAC,GAAgC,EAAE,MAAc,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5F,OAAO,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoB,EAAE,eAAuB,0BAA0B;IACxG,OAAO,KAAK,EAAE,SAAiB,EAAE,MAAc,EAAoB,EAAE;QACnE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,qBAAqB,CAAC,oBAAoB,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/G,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC"}

package/dist/admin/second-factor-index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `@connextar/house/admin/second-factor` — the Better Auth plugin that records which administrators' sessions were
+ * made with a second factor, and refuses an administrator's factor change from a session that wasn't. Its own entry
+ * point so `@connextar/house/admin` stays free of Better Auth for an app with its own auth.
+ */
+export { ADMIN_PASSKEY_ADD_PATHS, ADMIN_PROVING_PATHS, ADMIN_SECOND_FACTOR_ERROR_CODES, ADMIN_SECOND_FACTOR_SESSIONS_ID, ADMIN_TWO_FACTOR_CHANGE_PATHS, adminSecondFactorSessions, type AdminSecondFactorSessionsOptions, type AdminSignIn, } from "./second-factor.js";
+export { DEFAULT_ADMIN_PROOF_PREFIX, adminProofIdentifier, sessionProofReader } from "./proof.js";
+//# sourceMappingURL=second-factor-index.d.ts.map

package/dist/admin/second-factor-index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-index.d.ts","sourceRoot":"","sources":["../../src/admin/second-factor-index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,+BAA+B,EAC/B,+BAA+B,EAC/B,6BAA6B,EAC7B,yBAAyB,EACzB,KAAK,gCAAgC,EACrC,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/admin/second-factor-index.js

@@ -0,0 +1,8 @@
+/**
+ * `@connextar/house/admin/second-factor` — the Better Auth plugin that records which administrators' sessions were
+ * made with a second factor, and refuses an administrator's factor change from a session that wasn't. Its own entry
+ * point so `@connextar/house/admin` stays free of Better Auth for an app with its own auth.
+ */
+export { ADMIN_PASSKEY_ADD_PATHS, ADMIN_PROVING_PATHS, ADMIN_SECOND_FACTOR_ERROR_CODES, ADMIN_SECOND_FACTOR_SESSIONS_ID, ADMIN_TWO_FACTOR_CHANGE_PATHS, adminSecondFactorSessions, } from "./second-factor.js";
+export { DEFAULT_ADMIN_PROOF_PREFIX, adminProofIdentifier, sessionProofReader } from "./proof.js";
+//# sourceMappingURL=second-factor-index.js.map

package/dist/admin/second-factor-index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"second-factor-index.js","sourceRoot":"","sources":["../../src/admin/second-factor-index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,+BAA+B,EAC/B,+BAA+B,EAC/B,6BAA6B,EAC7B,yBAAyB,GAG1B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}