@data-club/ai-hub-server 0.0.1

package/dist/routes/admin/users.js

@@ -0,0 +1,374 @@
+/**
+ * `/admin/users/*` — admin + super_admin user management.
+ *
+ * Five endpoints:
+ *
+ * - `GET    /admin/users` — list every user in the deployment.
+ * - `POST   /admin/users` — create a user; the server generates a 16-char
+ *   alphanumeric password, hashes it, and returns the **plaintext exactly
+ *   once** in the response. The caller delivers it to the user out-of-band.
+ *   Sets `is_initial_password = true` so the user is forced to change on
+ *   first login (§8.5).
+ * - `PATCH  /admin/users/:id/role` — change a user's role. Uses
+ *   `applyUserRoleChangeInTx` so the shield + min-count rules are enforced
+ *   inside the transaction (no race possible).
+ * - `POST   /admin/users/:id/reset-password` — regenerate a 16-char password
+ *   for an existing user. Same return-once semantics; sets the initial-
+ *   password flag back to true. Uses `assertPasswordResetInTx` to validate
+ *   the shield + min-count rules, then performs the async Argon2 hash + write
+ *   outside the transaction (better-sqlite3 transactions are synchronous so
+ *   an Argon2 hash cannot live inside one). The narrow window between assert
+ *   and write is documented in the helper's JSDoc and is acceptable in v1.
+ * - `DELETE /admin/users/:id` — hard-delete the user. Uses
+ *   `applyUserDeletionInTx`; cascades to `session` via the FK.
+ *
+ * **Admin shield + min-count rules** are enforced by the helpers in
+ * `auth/roleRules.ts`; the handlers here just translate the helper's
+ * `TxResult` into a Response.
+ *
+ * **Admin cannot create / promote to `super_admin`.** The role enum on the
+ * POST body is filtered by caller role (admins see user / power_user /
+ * admin; super_admin sees all four). This mirrors the [05-admin-users.md]
+ * sketch's "Create User" modal.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 — admin users endpoints
+ * @see SPECIFICATIONS.md §8.1 — shield + min-count rules
+ * @see SPECIFICATIONS.md §8.5 — password reset semantics
+ * @see ui-sketches/05-admin-users.md
+ */
+import { randomBytes, randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { z } from "zod";
+import { hashPassword } from "../../auth/argon2.js";
+import { protectedRoute } from "../../auth/middleware.js";
+import { applyUserDeletionInTx, applyUserRoleChangeInTx, assertPasswordResetInTx, } from "../../auth/roleRules.js";
+import { user } from "../../db/schema.js";
+import { conflictError, errorResponse, forbidden, jsonResponse, notFound, validationError, } from "../../handlers/responses.js";
+/* ────────────────────────────────────────────────────────────────────────── */
+/*  Helpers                                                                   */
+/* ────────────────────────────────────────────────────────────────────────── */
+/**
+ * Wire-format view of a `user` row for admin listings. Excludes
+ * `password_hash` and `identity_source` (server-internal — §6.3.4).
+ *
+ * @param row - the DB row.
+ * @returns the JSON-safe response shape.
+ */
+function adminUserView(row) {
+    return {
+        id: row.id,
+        username: row.username,
+        display_name: row.displayName ?? null,
+        role: row.role,
+        is_initial_password: row.isInitialPassword,
+        theme_preference: row.themePreference ?? null,
+        created_at: row.createdAt,
+        updated_at: row.updatedAt,
+    };
+}
+/** ISO-8601 timestamp with millisecond precision. */
+function nowIso() {
+    return new Date().toISOString();
+}
+/**
+ * Generates a 16-character alphanumeric password ([A-Za-z0-9]).
+ *
+ * Uses rejection sampling against the 62-char alphabet — every char is drawn
+ * uniformly via `randomBytes`, masked to 6 bits, then discarded if the value
+ * lands in the unused `[62, 64)` range. Average overhead is ~3%.
+ *
+ * The generated password trivially satisfies the §8.5 complexity policy
+ * (letters + digits = 2 categories), so no extra validation is needed before
+ * hashing. The 16-char length is also above the §8.5 8-char minimum.
+ *
+ * @returns a fresh 16-char alphanumeric password.
+ */
+function generatePassword() {
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    const out = [];
+    while (out.length < 16) {
+        const bytes = randomBytes(32);
+        for (const b of bytes) {
+            const v = b & 0b00111111;
+            if (v < alphabet.length) {
+                out.push(alphabet[v]);
+                if (out.length === 16)
+                    break;
+            }
+        }
+    }
+    return out.join("");
+}
+/**
+ * Returns `true` if the caller's role is allowed to create / promote a user
+ * to `targetRole`. Admins cannot touch `super_admin`; super-admins can do
+ * anything.
+ *
+ * @param caller - caller role.
+ * @param targetRole - the requested role for the new (or promoted) user.
+ * @returns `true` if the operation is permitted.
+ */
+function callerCanGrantRole(caller, targetRole) {
+    if (caller === "super_admin")
+        return true;
+    if (caller === "admin")
+        return targetRole !== "super_admin";
+    return false;
+}
+/* ────────────────────────────────────────────────────────────────────────── */
+/*  GET /admin/users                                                          */
+/* ────────────────────────────────────────────────────────────────────────── */
+/**
+ * `GET /admin/users` — list every user in the deployment.
+ *
+ * `admin` and `super_admin` only; gated by `protectedRoute({ requiredRole: "admin" })`.
+ * Sorted alphabetically by username for stable rendering in the admin table.
+ *
+ * @see SPECIFICATIONS.md §6.3.4
+ * @see ui-sketches/05-admin-users.md
+ */
+export const handleListUsers = protectedRoute({ requiredRole: "admin" }, async (_req, ctx) => {
+    const rows = ctx.db.select().from(user).all();
+    // Sort client-side for a stable order regardless of insert order.
+    rows.sort((a, b) => a.username.localeCompare(b.username));
+    return jsonResponse(200, { users: rows.map(adminUserView) });
+});
+/* ────────────────────────────────────────────────────────────────────────── */
+/*  POST /admin/users                                                         */
+/* ────────────────────────────────────────────────────────────────────────── */
+/** Body for `POST /admin/users`. `role` defaults to `user` per §6.3.4. */
+const createUserSchema = z
+    .object({
+    username: z.string().min(1).max(255),
+    display_name: z.string().min(1).max(255).nullish(),
+    role: z
+        .enum(["user", "power_user", "admin", "super_admin"])
+        .optional(),
+})
+    .strict();
+/**
+ * `POST /admin/users` — create a new user with a server-generated password.
+ *
+ * The 16-char alphanumeric plaintext is returned **exactly once** in the
+ * response (`{ user, generated_password }`); the caller (admin) is expected
+ * to deliver it out-of-band per §8.5. The plaintext never appears in logs
+ * (pino's redaction policy plus we never log the field).
+ *
+ * Caller-role gates:
+ *
+ * - `admin` can create role `user` / `power_user` / `admin`.
+ * - `super_admin` can additionally create `super_admin`.
+ *
+ * On username collision returns 409 `username_taken` (not 400) — the request
+ * itself was well-formed; the conflict is with existing data.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 / §8.5
+ * @see ui-sketches/05-admin-users.md
+ */
+export const handleCreateUser = protectedRoute({ requiredRole: "admin" }, async (req, ctx, auth) => {
+    let raw;
+    try {
+        raw = await req.json();
+    }
+    catch {
+        return validationError("Request body must be valid JSON.");
+    }
+    const parsed = createUserSchema.safeParse(raw);
+    if (!parsed.success) {
+        return validationError(parsed.error.issues[0]?.message ?? "Invalid request body.");
+    }
+    const body = parsed.data;
+    const role = body.role ?? "user";
+    if (!callerCanGrantRole(auth.role, role)) {
+        return forbidden(`Caller role ${auth.role} cannot create a user with role ${role}.`);
+    }
+    const existing = ctx.db
+        .select({ id: user.id })
+        .from(user)
+        .where(eq(user.username, body.username))
+        .get();
+    if (existing) {
+        return conflictError("username_taken", "Username is already in use.");
+    }
+    const plaintext = generatePassword();
+    const passwordHash = await hashPassword(plaintext);
+    const id = randomUUID();
+    try {
+        ctx.db
+            .insert(user)
+            .values({
+            id,
+            username: body.username,
+            displayName: body.display_name ?? null,
+            passwordHash,
+            identitySource: "local",
+            isInitialPassword: true,
+            role,
+        })
+            .run();
+    }
+    catch (err) {
+        // Race against another simultaneous create with the same username.
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("UNIQUE")) {
+            return conflictError("username_taken", "Username is already in use.");
+        }
+        throw err;
+    }
+    const row = ctx.db.select().from(user).where(eq(user.id, id)).get();
+    if (!row)
+        throw new Error("Just-inserted user vanished.");
+    ctx.logger.info({
+        actor_id: auth.user.id,
+        new_user_id: row.id,
+        new_role: row.role,
+        event: "admin_user_created",
+    }, "Admin created a new user.");
+    return jsonResponse(201, {
+        user: adminUserView(row),
+        generated_password: plaintext,
+    });
+});
+/* ────────────────────────────────────────────────────────────────────────── */
+/*  PATCH /admin/users/:id/role                                                */
+/* ────────────────────────────────────────────────────────────────────────── */
+/** Body for `PATCH /admin/users/:id/role`. */
+const patchRoleSchema = z
+    .object({
+    role: z.enum(["user", "power_user", "admin", "super_admin"]),
+})
+    .strict();
+/**
+ * `PATCH /admin/users/:id/role` — change a user's role.
+ *
+ * Delegates the shield + min-count check to `applyUserRoleChangeInTx`, which
+ * re-reads the target row + super-admin count inside one transaction so a
+ * concurrent demote cannot bypass the invariants.
+ *
+ * Additional caller-role gate on top of the helper: an `admin` cannot grant
+ * the `super_admin` role on a target they could otherwise mutate (e.g.
+ * promoting a `power_user → super_admin`) — only super-admins can.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 / §8.1
+ */
+export const handlePatchUserRole = protectedRoute({ requiredRole: "admin" }, async (req, ctx, auth, params) => {
+    const id = params.id;
+    if (!id)
+        return notFound();
+    let raw;
+    try {
+        raw = await req.json();
+    }
+    catch {
+        return validationError("Request body must be valid JSON.");
+    }
+    const parsed = patchRoleSchema.safeParse(raw);
+    if (!parsed.success) {
+        return validationError(parsed.error.issues[0]?.message ?? "Invalid request body.");
+    }
+    const newRole = parsed.data.role;
+    if (!callerCanGrantRole(auth.role, newRole)) {
+        return forbidden(`Caller role ${auth.role} cannot promote a user to ${newRole}.`);
+    }
+    const result = applyUserRoleChangeInTx(ctx.db, { id: auth.user.id, role: auth.role }, id, newRole);
+    if (!result.ok) {
+        return errorResponse(result.status, result.code, result.message);
+    }
+    ctx.logger.info({
+        actor_id: auth.user.id,
+        target_id: id,
+        new_role: newRole,
+        event: "admin_role_changed",
+    }, "Admin changed a user's role.");
+    return jsonResponse(200, { user: adminUserView(result.data.updated) });
+});
+/* ────────────────────────────────────────────────────────────────────────── */
+/*  POST /admin/users/:id/reset-password                                      */
+/* ────────────────────────────────────────────────────────────────────────── */
+/**
+ * `POST /admin/users/:id/reset-password` — regenerate the user's password.
+ *
+ * Uses `assertPasswordResetInTx` to validate shield + min-count inside a
+ * transaction, then performs the async Argon2 hash + UPDATE *outside* the
+ * transaction (better-sqlite3 transactions are synchronous). The narrow
+ * window between assertion and write is acceptable in v1 — a concurrent
+ * role-mutation could in theory bypass the rule, but the worst-case is a
+ * single password reset on a user the admin shouldn't have been able to
+ * touch; the admin already had to authenticate and the new password is
+ * displayed only to them. Mitigation if this ever bites: re-verify the
+ * caller's role hasn't dropped between assertion and write.
+ *
+ * Returns `{ generated_password }` exactly once. Sets `is_initial_password =
+ * true` so the user is forced to change on their next login.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 / §8.5
+ * @see ui-sketches/05-admin-users.md
+ */
+export const handleResetUserPassword = protectedRoute({ requiredRole: "admin" }, async (_req, ctx, auth, params) => {
+    const id = params.id;
+    if (!id)
+        return notFound();
+    const result = assertPasswordResetInTx(ctx.db, { id: auth.user.id, role: auth.role }, id);
+    if (!result.ok) {
+        return errorResponse(result.status, result.code, result.message);
+    }
+    const plaintext = generatePassword();
+    const newHash = await hashPassword(plaintext);
+    const now = nowIso();
+    ctx.db
+        .update(user)
+        .set({
+        passwordHash: newHash,
+        isInitialPassword: true,
+        // Bumping `passwordChangedAt` invalidates the target's existing
+        // session JWTs (the middleware compares `iat` against this column)
+        // — the user is signed out from every device the next time their
+        // browser fires a protected request. Step 11 bugfix per the
+        // SPECIFICATIONS.md §8.5 password-reset semantics.
+        passwordChangedAt: now,
+        updatedAt: now,
+    })
+        .where(eq(user.id, id))
+        .run();
+    ctx.logger.info({
+        actor_id: auth.user.id,
+        target_id: id,
+        event: "admin_password_reset",
+    }, "Admin reset a user's password.");
+    return jsonResponse(200, { generated_password: plaintext });
+});
+/* ────────────────────────────────────────────────────────────────────────── */
+/*  DELETE /admin/users/:id                                                   */
+/* ────────────────────────────────────────────────────────────────────────── */
+/**
+ * `DELETE /admin/users/:id` — hard-delete the user.
+ *
+ * Uses `applyUserDeletionInTx`; the FK on `session.user_id` cascades, so
+ * deleting a user removes all their sessions atomically. The shield + min-
+ * count invariants apply (an admin cannot delete another admin or super
+ * admin; nobody can delete the only super admin).
+ *
+ * @see SPECIFICATIONS.md §6.3.4 / §8.1
+ */
+export const handleDeleteUser = protectedRoute({ requiredRole: "admin" }, async (_req, ctx, auth, params) => {
+    const id = params.id;
+    if (!id)
+        return notFound();
+    if (id === auth.user.id) {
+        // Defensive: even though min-count would catch the only-super_admin
+        // self-delete, we block all self-deletes outright as a usability
+        // safeguard (deleting yourself logs you out and could brick the UI).
+        return forbidden("Cannot delete your own account.");
+    }
+    const result = applyUserDeletionInTx(ctx.db, { id: auth.user.id, role: auth.role }, id);
+    if (!result.ok) {
+        return errorResponse(result.status, result.code, result.message);
+    }
+    ctx.logger.info({
+        actor_id: auth.user.id,
+        target_id: id,
+        event: "admin_user_deleted",
+    }, "Admin deleted a user.");
+    return jsonResponse(200, { deleted: { id } });
+});
+//# sourceMappingURL=users.js.map

package/dist/routes/admin/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/routes/admin/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAE1C,OAAO,EACL,aAAa,EACb,aAAa,EACb,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,eAAe,GAChB,MAAM,6BAA6B,CAAC;AAGrC,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,YAAY,EAAE,GAAG,CAAC,WAAW,IAAI,IAAI;QACrC,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,mBAAmB,EAAE,GAAG,CAAC,iBAAiB;QAC1C,gBAAgB,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;QAC7C,UAAU,EAAE,GAAG,CAAC,SAAS;QACzB,UAAU,EAAE,GAAG,CAAC,SAAS;KAC1B,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,SAAS,MAAM;IACb,OAAO,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB;IACvB,MAAM,QAAQ,GACZ,gEAAgE,CAAC;IACnE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC;YACzB,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACxB,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAW,CAAC,CAAC;gBAChC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;oBAAE,MAAM;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,MAAiB,EAAE,UAAqB;IAClE,IAAI,MAAM,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,UAAU,KAAK,aAAa,CAAC;IAC5D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,eAAe,GAAiB,cAAc,CACzD,EAAE,YAAY,EAAE,OAAO,EAAE,EACzB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;IAClB,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9C,kEAAkE;IAClE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;AAC/D,CAAC,CACF,CAAC;AAEF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE;IAClD,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;SACpD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiB,cAAc,CAC1D,EAAE,YAAY,EAAE,OAAO,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACvB,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,MAAM,IAAI,GAAc,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IAC5C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACzC,OAAO,SAAS,CACd,eAAe,IAAI,CAAC,IAAI,mCAAmC,IAAI,GAAG,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE;SACpB,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;SACvB,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;SACvC,GAAG,EAAE,CAAC;IACT,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,aAAa,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IACnD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,GAAG,CAAC,EAAE;aACH,MAAM,CAAC,IAAI,CAAC;aACZ,MAAM,CAAC;YACN,EAAE;YACF,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACtC,YAAY;YACZ,cAAc,EAAE,OAAO;YACvB,iBAAiB,EAAE,IAAI;YACvB,IAAI;SACL,CAAC;aACD,GAAG,EAAE,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,OAAO,aAAa,CAAC,gBAAgB,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAE1D,GAAG,CAAC,MAAM,CAAC,IAAI,CACb;QACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACtB,WAAW,EAAE,GAAG,CAAC,EAAE;QACnB,QAAQ,EAAE,GAAG,CAAC,IAAI;QAClB,KAAK,EAAE,oBAAoB;KAC5B,EACD,2BAA2B,CAC5B,CAAC;IAEF,OAAO,YAAY,CAAC,GAAG,EAAE;QACvB,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC;QACxB,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;AACL,CAAC,CACF,CAAC;AAEF,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAEhF,8CAA8C;AAC9C,MAAM,eAAe,GAAG,CAAC;KACtB,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;CAC7D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAiB,cAAc,CAC7D,EAAE,YAAY,EAAE,OAAO,EAAE,EACzB,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,EAAE,CAAC;IAC3B,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC,kCAAkC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,uBAAuB,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,OAAO,GAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;IAC5C,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;QAC5C,OAAO,SAAS,CACd,eAAe,IAAI,CAAC,IAAI,6BAA6B,OAAO,GAAG,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,uBAAuB,CACpC,GAAG,CAAC,EAAE,EACN,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACrC,EAAE,EACF,OAAO,CACR,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,IAAI,CACb;QACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,oBAAoB;KAC5B,EACD,8BAA8B,CAC/B,CAAC;IAEF,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC,CACF,CAAC;AAEF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAiB,cAAc,CACjE,EAAE,YAAY,EAAE,OAAO,EAAE,EACzB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,EAAE,CAAC;IAE3B,MAAM,MAAM,GAAG,uBAAuB,CACpC,GAAG,CAAC,EAAE,EACN,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACrC,EAAE,CACH,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,EAAE;SACH,MAAM,CAAC,IAAI,CAAC;SACZ,GAAG,CAAC;QACH,YAAY,EAAE,OAAO;QACrB,iBAAiB,EAAE,IAAI;QACvB,gEAAgE;QAChE,mEAAmE;QACnE,iEAAiE;QACjE,4DAA4D;QAC5D,mDAAmD;QACnD,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,GAAG;KACf,CAAC;SACD,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACtB,GAAG,EAAE,CAAC;IAET,GAAG,CAAC,MAAM,CAAC,IAAI,CACb;QACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,sBAAsB;KAC9B,EACD,gCAAgC,CACjC,CAAC;IAEF,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;AAC9D,CAAC,CACF,CAAC;AAEF,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAEhF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiB,cAAc,CAC1D,EAAE,YAAY,EAAE,OAAO,EAAE,EACzB,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;IAChC,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;IACrB,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,EAAE,CAAC;IAC3B,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACxB,oEAAoE;QACpE,iEAAiE;QACjE,qEAAqE;QACrE,OAAO,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAClC,GAAG,CAAC,EAAE,EACN,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACrC,EAAE,CACH,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CACb;QACE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE;QACtB,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,oBAAoB;KAC5B,EACD,uBAAuB,CACxB,CAAC;IACF,OAAO,YAAY,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC,CACF,CAAC"}

package/dist/routes/agents.d.ts

@@ -0,0 +1,30 @@
+/**
+ * User-facing `/agents` — the catalog the agents picker reads.
+ *
+ * Returns **non-archived** ai-hub agents only; each entry carries a
+ * `session_count` computed against the *caller's* non-archived sessions for
+ * that agent (one round-trip populates the "(N of your sessions)" subtitles
+ * on the picker — see [03-chat.md](../../../../docs/ui-sketches/03-chat.md)).
+ *
+ * The underlying Letta `agent_id` is **not** exposed here — it's an admin-only
+ * concern (`/admin/agents` returns it for editors).
+ *
+ * @see SPECIFICATIONS.md §6.3.3 — Agents (catalog)
+ */
+import type { RouteHandler } from "../handlers/types.js";
+/**
+ * `GET /agents` — every authenticated session.
+ *
+ * Returns `{ agents: [{ id, display_name, session_count }, ...] }`. Sorted by
+ * `display_name` for stable picker ordering. Excludes archived agents
+ * server-side so the user-facing picker stays focused on the working set.
+ *
+ * The `session_count` is **caller-scoped** — counted via a left-join filtered
+ * to `(session.user_id = caller.id AND session.is_archived = false)` so each
+ * user sees their own count, never another user's.
+ *
+ * @see SPECIFICATIONS.md §6.3.3 — Agents (catalog)
+ * @see ui-sketches/03-chat.md — agents picker
+ */
+export declare const handleListAgents: RouteHandler;
+//# sourceMappingURL=agents.d.ts.map

package/dist/routes/agents.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.d.ts","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEzD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,EAAE,YA8B7B,CAAC"}

package/dist/routes/agents.js

@@ -0,0 +1,55 @@
+/**
+ * User-facing `/agents` — the catalog the agents picker reads.
+ *
+ * Returns **non-archived** ai-hub agents only; each entry carries a
+ * `session_count` computed against the *caller's* non-archived sessions for
+ * that agent (one round-trip populates the "(N of your sessions)" subtitles
+ * on the picker — see [03-chat.md](../../../../docs/ui-sketches/03-chat.md)).
+ *
+ * The underlying Letta `agent_id` is **not** exposed here — it's an admin-only
+ * concern (`/admin/agents` returns it for editors).
+ *
+ * @see SPECIFICATIONS.md §6.3.3 — Agents (catalog)
+ */
+import { and, asc, eq, sql } from "drizzle-orm";
+import { protectedRoute } from "../auth/middleware.js";
+import { agent, session } from "../db/schema.js";
+import { jsonResponse } from "../handlers/responses.js";
+/**
+ * `GET /agents` — every authenticated session.
+ *
+ * Returns `{ agents: [{ id, display_name, session_count }, ...] }`. Sorted by
+ * `display_name` for stable picker ordering. Excludes archived agents
+ * server-side so the user-facing picker stays focused on the working set.
+ *
+ * The `session_count` is **caller-scoped** — counted via a left-join filtered
+ * to `(session.user_id = caller.id AND session.is_archived = false)` so each
+ * user sees their own count, never another user's.
+ *
+ * @see SPECIFICATIONS.md §6.3.3 — Agents (catalog)
+ * @see ui-sketches/03-chat.md — agents picker
+ */
+export const handleListAgents = protectedRoute({}, async (_req, ctx, auth) => {
+    const rows = ctx.db
+        .select({
+        id: agent.id,
+        displayName: agent.displayName,
+        // Count caller's non-archived sessions against this agent. The
+        // double-condition LEFT JOIN keeps agents with 0 sessions in the result.
+        sessionCount: sql `COUNT(${session.id})`.as("session_count"),
+    })
+        .from(agent)
+        .leftJoin(session, and(eq(session.agentId, agent.id), eq(session.userId, auth.user.id), eq(session.isArchived, false)))
+        .where(eq(agent.isArchived, false))
+        .groupBy(agent.id)
+        .orderBy(asc(agent.displayName))
+        .all();
+    return jsonResponse(200, {
+        agents: rows.map((r) => ({
+            id: r.id,
+            display_name: r.displayName,
+            session_count: Number(r.sessionCount),
+        })),
+    });
+});
+//# sourceMappingURL=agents.js.map

package/dist/routes/agents.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agents.js","sourceRoot":"","sources":["../../src/routes/agents.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiB,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;IACzF,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE;SAChB,MAAM,CAAC;QACN,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,+DAA+D;QAC/D,yEAAyE;QACzE,YAAY,EAAE,GAAG,CAAQ,SAAS,OAAO,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC;KACpE,CAAC;SACD,IAAI,CAAC,KAAK,CAAC;SACX,QAAQ,CACP,OAAO,EACP,GAAG,CACD,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,EAC7B,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAChC,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAC9B,CACF;SACA,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;SAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;SACjB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;SAC/B,GAAG,EAAE,CAAC;IAET,OAAO,YAAY,CAAC,GAAG,EAAE;QACvB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACvB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,YAAY,EAAE,CAAC,CAAC,WAAW;YAC3B,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;SACtC,CAAC,CAAC;KACJ,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/routes/auth.d.ts

@@ -0,0 +1,121 @@
+/**
+ * `/auth/*` route handlers.
+ *
+ * Step 3 ships the full surface:
+ *
+ * - `POST /auth/login` (Step 2) — public.
+ * - `POST /auth/change-password` — accepts session OR password-change-only
+ *   tokens. Voluntary path requires `current_password`; forced path doesn't
+ *   (the change-only token IS the auth). Enforces the §8.5 password policy
+ *   (length + complexity).
+ * - `POST /auth/logout` — server-side no-op in v1 (the React client just
+ *   discards the token).
+ * - `GET /auth/me` — returns the `{ user, deployment }` envelope per §6.3.4.
+ * - `PATCH /auth/me/preferences` — updates `user.theme_preference` (rejects
+ *   with 409 when the deployment-wide switcher is off).
+ *
+ * @see SPECIFICATIONS.md §6.3.4 — auth endpoints
+ * @see SPECIFICATIONS.md §7.6 — theme resolution
+ * @see SPECIFICATIONS.md §8.5 — Argon2id password verification + complexity
+ */
+import type { RouteHandler } from "../handlers/types.js";
+/**
+ * `POST /auth/login` — Argon2id-verifies username + password, mints either
+ * a session JWT or a 5-minute password-change-only JWT depending on the
+ * user's `is_initial_password` flag.
+ *
+ * **Generic 401 on every failure path** — wrong username, wrong password,
+ * NULL `password_hash` (the future-IdP seam test), or any malformed body.
+ * No enumeration leakage (§13.1, §8.6).
+ *
+ * On success returns `{ token, must_change_password, user, deployment }`.
+ * When `must_change_password = true`, the `deployment` block is omitted
+ * entirely (the change-only token doesn't grant deployment access) and
+ * `user.role` is omitted (the change-only token carries no role claim) —
+ * the client re-fetches `/auth/me` after the change-password handshake.
+ *
+ * Hash-upgrade-on-login (§8.5): if the stored hash was produced with weaker
+ * params than the current `ARGON2_PARAMS` baseline, we rehash and write
+ * back. Best-effort — a write failure does not fail the login.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 — `POST /auth/login`
+ * @see SPECIFICATIONS.md §8.5 — auth + hash upgrade
+ */
+export declare const handleLogin: RouteHandler;
+/**
+ * `POST /auth/change-password` — two distinct flows on one endpoint:
+ *
+ * - **Voluntary (session token):** caller supplies `current_password`; the
+ *   server Argon2id-verifies it, then hashes + writes the new password. Does
+ *   not touch `is_initial_password`. Returns a fresh session token (with the
+ *   caller's current role).
+ * - **Forced (password-change-only token):** caller does not supply
+ *   `current_password` (the change-only token already proves a successful
+ *   prior login). The server hashes + writes the new password, clears
+ *   `is_initial_password`, and returns a fresh session token. The client
+ *   transitions to the normal chat at this point.
+ *
+ * Server-side validation: the new password must satisfy the §8.5 policy —
+ * at least 8 characters AND at least two of {letters, digits, special
+ * characters}. Length-only passwords (e.g. `"12345678"`) are rejected with
+ * 400 `password_too_simple`.
+ *
+ * Mismatched current password → 401 `unauthorized` with a "current
+ * password"-mentioning message. Voluntary path with no `current_password`
+ * is rejected as a validation error (the field IS required when the caller
+ * authenticated with a session token). Forced path with a `current_password`
+ * is rejected too — that signals client confusion.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 — `POST /auth/change-password`
+ * @see SPECIFICATIONS.md §8.5 — change flows + password policy
+ */
+export declare const handleChangePassword: RouteHandler;
+/**
+ * `POST /auth/logout` — server-side no-op in v1.
+ *
+ * Per §6.3.4 and SPECIFICATIONS.md's "Implementer's call" note: v1's
+ * simplest implementation is for the client to discard its token; we don't
+ * maintain a blacklist. A future minor may add token revocation if a
+ * concrete threat model demands it. Returns 200 with a minimal body so the
+ * client has something to act on.
+ *
+ * Still routes through the protected middleware so an anonymous caller gets
+ * a 401 — that signals to the client that its token was already invalid (in
+ * which case it should already be on the login screen).
+ *
+ * @see SPECIFICATIONS.md §6.3.4
+ */
+export declare const handleLogout: RouteHandler;
+/**
+ * `GET /auth/me` — returns the `{ user, deployment }` envelope.
+ *
+ * `deployment.letta_ade_url` is included only for callers with role >=
+ * `power_user` (handled inside `buildDeploymentView`); `user`-role callers
+ * don't even see the field exists — by design (§6.3.4).
+ *
+ * The resolved theme is computed client-side from
+ * `user.theme_preference + deployment.{theme_default, theme_switcher_enabled}`
+ * per §7.6 — the server does not pre-compute it.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 — `GET /auth/me`
+ * @see SPECIFICATIONS.md §7.6 — theme resolution
+ */
+export declare const handleMe: RouteHandler;
+/**
+ * `PATCH /auth/me/preferences` — updates per-user preferences.
+ *
+ * Body: `{ theme?: "light" | "dark" }`. Empty body is a 200 no-op (returns
+ * the current `{ user, deployment }` envelope unchanged) — by an explicit
+ * decision recorded in the Step-3 prompt. Unknown keys → 400 (§13.4).
+ *
+ * Returns 409 `theme_switcher_disabled` when the deployment-wide
+ * `admin_setting.theme_switcher_enabled = false`: per §7.6 the user's
+ * stored preference is ignored while the switcher is off, and accepting a
+ * write in that state would be silently swallowed. We surface the
+ * configuration mismatch rather than pretend the write applied.
+ *
+ * @see SPECIFICATIONS.md §6.3.4 — `PATCH /auth/me/preferences`
+ * @see SPECIFICATIONS.md §7.6 — theme resolution
+ */
+export declare const handleMePreferences: RouteHandler;
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/routes/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA6BH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAczD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,WAAW,EAAE,YAgHzB,CAAC;AAcF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,oBAAoB,EAAE,YAqHlC,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,EAAE,YAEzB,CAAC;AAMH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,QAAQ,EAAE,YAWrB,CAAC;AAaH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,EAAE,YA6DjC,CAAC"}