@fonderie/admin 1.0.3 → 1.2.0

package/dist/index.js

@@ -1,7 +1,7 @@
 // src/module.ts
 import { readFileSync as readFileSync2 } from "fs";
-import { HTTP as HTTP2, normalizeMountPath, normalizeRequestPath as normalizeRequestPath2, setApiResponse as setApiResponse2 } from "@fonderie/core";
-import { validate, validateAdminToken } from "@fonderie/core/middlewares";
+import { HTTP as HTTP3, normalizeMountPath, normalizeRequestPath as normalizeRequestPath2, setApiResponse as setApiResponse3 } from "@fonderie/core";
+import { validate as validate2, validateAdminToken } from "@fonderie/core/middlewares";
 
 // src/doctor.ts
 function collectChecks(app, own) {
@@ -76,7 +76,9 @@ function adminLog(store, route, module) {
     const res = await next();
     const row = {
       // A scoped token names itself; X-Actor refines it; the root token is 'admin-token'.
-      actor: ctx.request.headers.get("x-actor") || (typeof ctx.meta["adminTokenName"] === "string" ? `token:${ctx.meta["adminTokenName"]}` : DEFAULT_ACTOR),
+      // An operator session names itself and cannot be overridden: X-Actor
+      // is a client-supplied label, fine for a token, not for a person.
+      actor: (typeof ctx.meta["adminOperator"] === "string" ? `operator:${ctx.meta["adminOperator"]}` : null) || (typeof ctx.meta["adminActor"] === "string" ? ctx.meta["adminActor"] : null) || ctx.request.headers.get("x-actor") || (typeof ctx.meta["adminTokenName"] === "string" ? `token:${ctx.meta["adminTokenName"]}` : DEFAULT_ACTOR),
       method: ctx.request.method,
       // Normalized, so '/x' and '/x/' are one row for one route — the same
       // path the router matched and `route` below records the pattern of.
@@ -179,11 +181,11 @@ async function migrationsReport(store, sets) {
   const everApplied = await hasMigrationHistory(store);
   const modules = [];
   let firstBehind = null;
-  for (const [name, dir] of sets) {
+  for (const [name2, dir] of sets) {
     const pending = await new InternalMigrationRunner(store, dir).pending();
     const files = classifyPending(dir, pending);
     modules.push({
-      name,
+      name: name2,
       pending: files,
       // Only a module BEFORE this one blocks it. The first module with
       // pending work blocks every module after it, and nothing blocks it.
@@ -192,12 +194,12 @@ async function migrationsReport(store, sets) {
       // destroying anything. Same rule the CLI's --check applies.
       appliable: files.length > 0 && firstBehind === null && (!everApplied || files.every((f) => f.impact === "additive"))
     });
-    if (files.length > 0 && firstBehind === null) firstBehind = name;
+    if (files.length > 0 && firstBehind === null) firstBehind = name2;
   }
   return { everApplied, modules };
 }
 async function applyModuleMigrations(store, sets, module, expect) {
-  const set = sets.find(([name]) => name === module);
+  const set = sets.find(([name2]) => name2 === module);
   if (!set) return { ok: false, reason: "NOT_FOUND" };
   const before = await migrationsReport(store, sets);
   const target = before.modules.find((m) => m.name === module);
@@ -237,13 +239,13 @@ function buildManifest(app, admin) {
     byModule.set(p.module, list);
   }
   const describing = new Set(app.adminDescriptions().map((d) => d.module));
-  const modules = report.modules.map(({ name, version }) => {
-    const problems = byModule.get(name) ?? [];
+  const modules = report.modules.map(({ name: name2, version }) => {
+    const problems = byModule.get(name2) ?? [];
     return {
-      name,
+      name: name2,
       version: version ?? null,
       readiness: { ok: !problems.some((p) => p.severity === "error"), problems },
-      describesAdmin: describing.has(name)
+      describesAdmin: describing.has(name2)
     };
   });
   return {
@@ -265,10 +267,10 @@ function environmentReport(app, env) {
   return {
     generatedAt: report.generatedAt,
     readiness: report.readiness,
-    modules: report.modules.map(({ name }) => ({ name, problems: byModule.get(name) ?? [] })),
-    env: env.map((name) => ({
-      name,
-      set: process.env[name] !== void 0 && process.env[name] !== ""
+    modules: report.modules.map(({ name: name2 }) => ({ name: name2, problems: byModule.get(name2) ?? [] })),
+    env: env.map((name2) => ({
+      name: name2,
+      set: process.env[name2] !== void 0 && process.env[name2] !== ""
     }))
   };
 }
@@ -291,7 +293,7 @@ function tokensReport(app, adminModule, issued) {
   return {
     generatedAt: report.generatedAt,
     admin: { ok: !adminProblems.some((p) => p.severity === "error"), problems: adminProblems },
-    legacy: report.modules.map(({ name }) => ({ module: name, set: legacyOwners.has(name) })).filter((e) => e.set),
+    legacy: report.modules.map(({ name: name2 }) => ({ module: name2, set: legacyOwners.has(name2) })).filter((e) => e.set),
     issued
   };
 }
@@ -302,8 +304,1022 @@ function isLegacyAdminPath(method, path) {
 }
 
 // src/tokens.ts
-import { createHash, randomBytes } from "crypto";
-import { HTTP, constantTimeEqual, setApiResponse } from "@fonderie/core";
+import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { HTTP as HTTP2, constantTimeEqual as constantTimeEqual3, setApiResponse as setApiResponse2 } from "@fonderie/core";
+
+// src/operators/http.ts
+import { HTTP, constantTimeEqual as constantTimeEqual2, setApiResponse } from "@fonderie/core";
+import { validate } from "@fonderie/core/middlewares";
+
+// src/operators/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createHmac,
+  randomBytes,
+  scrypt as scryptCb,
+  timingSafeEqual
+} from "crypto";
+import { constantTimeEqual } from "@fonderie/core";
+var STEP = 30;
+var DRIFT = 1;
+var DIGITS = 6;
+var B32 = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(buf) {
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of buf) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += B32[value >>> bits - 5 & 31];
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += B32[value << 5 - bits & 31];
+  return out;
+}
+function base32Decode(input) {
+  let bits = 0;
+  let value = 0;
+  const out = [];
+  for (const ch of input.toUpperCase().replace(/[=\s]/g, "")) {
+    const i = B32.indexOf(ch);
+    if (i === -1) continue;
+    value = value << 5 | i;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(value >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+}
+function hotp(secret, counter) {
+  const msg = Buffer.alloc(8);
+  msg.writeBigUInt64BE(BigInt(counter));
+  const mac = createHmac("sha1", base32Decode(secret)).update(msg).digest();
+  const o = (mac[19] ?? 0) & 15;
+  const bin = ((mac[o] ?? 0) & 127) << 24 | ((mac[o + 1] ?? 0) & 255) << 16 | ((mac[o + 2] ?? 0) & 255) << 8 | (mac[o + 3] ?? 0) & 255;
+  return String(bin % 10 ** DIGITS).padStart(DIGITS, "0");
+}
+var totpCounter = (now = Date.now()) => Math.floor(now / 1e3 / STEP);
+function verifyTotp(secret, code, lastUsed, now = Date.now()) {
+  const clean = code.replace(/\s/g, "");
+  if (!/^\d{6}$/.test(clean)) return null;
+  const t = totpCounter(now);
+  for (let d = -DRIFT; d <= DRIFT; d++) {
+    const step = t + d;
+    if (lastUsed !== null && step <= lastUsed) continue;
+    if (constantTimeEqual(hotp(secret, step), clean)) return step;
+  }
+  return null;
+}
+var newTotpSecret = () => base32Encode(randomBytes(20));
+function totpUri(issuer, account, secret) {
+  const q = new URLSearchParams({
+    secret,
+    issuer,
+    algorithm: "SHA1",
+    digits: String(DIGITS),
+    period: String(STEP)
+  });
+  return `otpauth://totp/${encodeURIComponent(issuer)}:${encodeURIComponent(account)}?${q}`;
+}
+function newBackupCodes(count = 10) {
+  return Array.from({ length: count }, () => {
+    const s = base32Encode(randomBytes(7)).slice(0, 10);
+    return `${s.slice(0, 5)}-${s.slice(5)}`;
+  });
+}
+var normalizeBackupCode = (code) => code.toUpperCase().replace(/[^A-Z2-7]/g, "");
+var sha256 = (s) => createHash("sha256").update(s).digest("hex");
+var N = 2 ** 15;
+var R = 8;
+var P = 1;
+var KEYLEN = 32;
+var scrypt = (password2, salt, n, r, p) => new Promise(
+  (resolve, reject) => scryptCb(
+    password2.normalize("NFKC"),
+    salt,
+    KEYLEN,
+    { N: n, r, p, maxmem: 128 * n * r * 2 },
+    (err, key) => err ? reject(err) : resolve(key)
+  )
+);
+async function hashPassword(password2) {
+  const salt = randomBytes(16);
+  const key = await scrypt(password2, salt, N, R, P);
+  return `scrypt$${N}$${R}$${P}$${salt.toString("base64")}$${key.toString("base64")}`;
+}
+async function verifyPassword(password2, stored) {
+  const [kind, n, r, p, salt, hash] = stored.split("$");
+  if (kind !== "scrypt" || !n || !r || !p || !salt || !hash) return false;
+  const expected = Buffer.from(hash, "base64");
+  const key = await scrypt(password2, Buffer.from(salt, "base64"), Number(n), Number(r), Number(p));
+  return key.length === expected.length && timingSafeEqual(key, expected);
+}
+var dummy = null;
+var dummyHash = () => {
+  dummy ??= hashPassword(randomBytes(16).toString("hex"));
+  return dummy;
+};
+function passwordProblem(password2) {
+  if (typeof password2 !== "string" || password2.length < 12) return "Use at least 12 characters.";
+  if (password2.length > 256) return "Use at most 256 characters.";
+  if (/^(.)\1+$/.test(password2)) return "That password is too easy to guess.";
+  return null;
+}
+var PREFIX = "op.v1:";
+function secretBox(keyHex) {
+  if (!keyHex) return { seal: (p) => p, open: (s) => s };
+  const key = Buffer.from(keyHex, "hex");
+  if (key.length !== 32)
+    throw new Error("[admin] operatorKey must be 32 bytes \u2014 64 hex chars (`openssl rand -hex 32`)");
+  return {
+    seal(plain) {
+      const iv = randomBytes(12);
+      const c = createCipheriv("aes-256-gcm", key, iv);
+      const data = Buffer.concat([c.update(plain, "utf8"), c.final()]);
+      return `${PREFIX}${iv.toString("hex")}:${c.getAuthTag().toString("hex")}:${data.toString("hex")}`;
+    },
+    open(stored) {
+      if (!stored.startsWith(PREFIX)) return stored;
+      const [iv, tag, data] = stored.slice(PREFIX.length).split(":");
+      if (!iv || !tag || !data) throw new Error("[admin] malformed operator secret");
+      const d = createDecipheriv("aes-256-gcm", key, Buffer.from(iv, "hex"));
+      d.setAuthTag(Buffer.from(tag, "hex"));
+      return Buffer.concat([d.update(Buffer.from(data, "hex")), d.final()]).toString("utf8");
+    }
+  };
+}
+var newOpaqueToken = (prefix) => `${prefix}_${randomBytes(32).toString("base64url")}`;
+
+// src/operators/schemas.ts
+function schema(fields, opts = {}) {
+  return {
+    safeParse(input) {
+      const fail = (path, message) => ({
+        success: false,
+        error: { issues: [{ path: [path], message }] }
+      });
+      const b = input && typeof input === "object" ? input : {};
+      const out = {};
+      for (const [key, f] of Object.entries(fields)) {
+        const v = b[key];
+        if (v === void 0 || v === null) {
+          if (f.required) return fail(key, `${key} is required`);
+          continue;
+        }
+        if (f.type === "string") {
+          if (typeof v !== "string" || v.length === 0 || v.length > f.max)
+            return fail(key, `${key} must be a string of 1\u2013${f.max} characters`);
+        } else if (f.type === "boolean") {
+          if (typeof v !== "boolean") return fail(key, `${key} must be true or false`);
+        } else if (f.type === "integer") {
+          if (!Number.isInteger(v) || v < f.min || v > f.max)
+            return fail(key, `${key} must be an integer ${f.min}\u2013${f.max}`);
+        } else if (!Array.isArray(v) || v.length === 0 || !v.every((s) => SCOPES.includes(s))) {
+          return fail(key, `${key} must be a non-empty list of ${SCOPES.join(", ")}`);
+        }
+        out[key] = v;
+      }
+      if (opts.oneOf && !opts.oneOf.some((k) => out[k] !== void 0)) {
+        return fail(opts.oneOf[0] ?? "body", `one of ${opts.oneOf.join(", ")} is required`);
+      }
+      return { success: true, data: out };
+    }
+  };
+}
+var email = { type: "string", required: true, max: 320 };
+var password = { type: "string", required: true, max: 256 };
+var name = { type: "string", max: 200 };
+var token = { type: "string", required: true, max: 200 };
+var claimSchema = schema({ email, password, name });
+var loginSchema = schema({ email, password });
+var enrollmentSchema = schema({ code: { type: "string", required: true, max: 12 } });
+var factorSchema = schema(
+  { code: { type: "string", max: 12 }, backupCode: { type: "string", max: 32 } },
+  { oneOf: ["code", "backupCode"] }
+);
+var inspectLinkSchema = schema({ token });
+var redeemLinkSchema = schema({ token, password, name });
+var inviteSchema = schema({
+  email,
+  scopes: { type: "scopes", required: true },
+  expiresInHours: { type: "integer", min: 1, max: 336 }
+});
+var updateOperatorSchema = schema({
+  scopes: { type: "scopes" },
+  name,
+  disabled: { type: "boolean" }
+});
+
+// src/operators/service.ts
+var IDLE_MS = 30 * 6e4;
+var ABSOLUTE_MS = 12 * 36e5;
+var PENDING_MS = 10 * 6e4;
+var STEP_UP_MS = 5 * 6e4;
+var INVITE_HOURS = 72;
+var RECOVERY_HOURS = 24;
+var MAX_FAILURES = 5;
+var OP_COLS = `id, email, name, password_hash AS "passwordHash", scopes, totp_secret AS "totpSecret",
+  totp_confirmed_at AS "totpConfirmedAt", totp_last_step AS "totpLastStep", backup_codes AS "backupCodes",
+  failed_attempts AS "failedAttempts", locked_until AS "lockedUntil", created_by AS "createdBy",
+  created_at AS "createdAt", last_login_at AS "lastLoginAt", disabled_at AS "disabledAt"`;
+var SESSION_COLS = `id_hash AS "idHash", operator_id AS "operatorId", stage, created_at AS "createdAt",
+  last_seen_at AS "lastSeenAt", expires_at AS "expiresAt", step_up_at AS "stepUpAt"`;
+var normalizeEmail = (e) => e.trim().toLowerCase();
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+async function operatorCount(store) {
+  const [row] = await store.query(
+    `SELECT count(*)::text AS n FROM fonderie_admin_operators`
+  );
+  return Number(row?.n ?? 0);
+}
+async function findOperator(store, by) {
+  const [row] = by.id ? await store.query(
+    `SELECT ${OP_COLS} FROM fonderie_admin_operators WHERE id = $1`,
+    [by.id]
+  ) : await store.query(
+    `SELECT ${OP_COLS} FROM fonderie_admin_operators WHERE email = $1`,
+    [normalizeEmail(by.email ?? "")]
+  );
+  return row ?? null;
+}
+async function claimFirstOperator(store, input) {
+  const passwordHash = await hashPassword(input.password);
+  return store.transaction(async (tx) => {
+    await tx.query(`SELECT pg_advisory_xact_lock(hashtext('fonderie_admin_claim'))`);
+    const [row] = await tx.query(
+      `INSERT INTO fonderie_admin_operators (email, name, password_hash, scopes, created_by)
+			 SELECT $1, $2, $3, $4, 'claim'
+			  WHERE NOT EXISTS (SELECT 1 FROM fonderie_admin_operators)
+			 RETURNING ${OP_COLS}`,
+      [normalizeEmail(input.email), input.name ?? null, passwordHash, ["read", "write", "secrets"]]
+    );
+    return row ?? null;
+  });
+}
+async function recordFailure(store, id) {
+  await store.query(
+    `UPDATE fonderie_admin_operators
+		    SET failed_attempts = failed_attempts + 1,
+		        locked_until = CASE WHEN failed_attempts + 1 >= $2
+		          THEN now() + make_interval(mins => LEAST(60, power(2, failed_attempts + 1 - $2)::int))
+		          ELSE locked_until END
+		  WHERE id = $1`,
+    [id, MAX_FAILURES]
+  );
+}
+var isLocked = (op) => op.lockedUntil !== null && new Date(op.lockedUntil).getTime() > Date.now();
+function lockMinutes(op) {
+  return op.lockedUntil ? Math.max(1, Math.ceil((new Date(op.lockedUntil).getTime() - Date.now()) / 6e4)) : 0;
+}
+async function checkPassword(store, email2, password2) {
+  const op = await findOperator(store, { email: email2 });
+  if (!op) {
+    await verifyPassword(password2, await dummyHash());
+    return { op: null, ok: false };
+  }
+  if (op.disabledAt) {
+    await verifyPassword(password2, await dummyHash());
+    return { op: null, ok: false };
+  }
+  if (isLocked(op)) return { op, ok: false, locked: true };
+  const ok = await verifyPassword(password2, op.passwordHash);
+  if (!ok) await recordFailure(store, op.id);
+  return { op, ok };
+}
+async function checkSecondFactor(store, box, op, input) {
+  if (isLocked(op)) return { ok: false };
+  if (typeof input.code === "string" && op.totpSecret) {
+    const last = op.totpLastStep === null ? null : Number(op.totpLastStep);
+    const step = verifyTotp(box.open(op.totpSecret), input.code, last);
+    if (step !== null) {
+      const rows = await store.query(
+        `UPDATE fonderie_admin_operators SET totp_last_step = $2, failed_attempts = 0, locked_until = NULL
+				  WHERE id = $1 AND (totp_last_step IS NULL OR totp_last_step < $2) RETURNING id`,
+        [op.id, step]
+      );
+      if (rows.length) return { ok: true, via: "totp" };
+    }
+  } else if (typeof input.backupCode === "string") {
+    const h = sha256(normalizeBackupCode(input.backupCode));
+    const [row] = await store.query(
+      `UPDATE fonderie_admin_operators
+			    SET backup_codes = array_remove(backup_codes, $2), failed_attempts = 0, locked_until = NULL
+			  WHERE id = $1 AND $2 = ANY(backup_codes)
+			  RETURNING coalesce(array_length(backup_codes, 1), 0) AS left`,
+      [op.id, h]
+    );
+    if (row) return { ok: true, via: "backup", backupLeft: Number(row.left ?? 0) };
+  }
+  await recordFailure(store, op.id);
+  return { ok: false };
+}
+async function enrollmentSecret(store, box, op) {
+  if (op.totpSecret && !op.totpConfirmedAt) return box.open(op.totpSecret);
+  const secret = newTotpSecret();
+  await store.query(
+    `UPDATE fonderie_admin_operators SET totp_secret = $2 WHERE id = $1 AND totp_confirmed_at IS NULL`,
+    [op.id, box.seal(secret)]
+  );
+  return secret;
+}
+async function confirmEnrollment(store, box, op, code) {
+  if (!op.totpSecret || op.totpConfirmedAt || isLocked(op)) return null;
+  const step = verifyTotp(box.open(op.totpSecret), code, null);
+  if (step === null) {
+    await recordFailure(store, op.id);
+    return null;
+  }
+  const codes = newBackupCodes();
+  await store.query(
+    `UPDATE fonderie_admin_operators
+		    SET totp_confirmed_at = now(), totp_last_step = $2, backup_codes = $3,
+		        failed_attempts = 0, locked_until = NULL, last_login_at = now()
+		  WHERE id = $1`,
+    [op.id, step, codes.map((c) => sha256(normalizeBackupCode(c)))]
+  );
+  return codes;
+}
+async function listOperators(store) {
+  const operators = await store.query(
+    `SELECT ${OP_COLS} FROM fonderie_admin_operators ORDER BY created_at`
+  );
+  const links = await store.query(
+    `SELECT id, kind, email, scopes, created_by AS "createdBy", created_at AS "createdAt", expires_at AS "expiresAt"
+		   FROM fonderie_admin_invites WHERE used_at IS NULL AND expires_at > now() ORDER BY created_at DESC`
+  );
+  return { operators: operators.map(publicOperator), links };
+}
+function publicOperator(op) {
+  return {
+    id: op.id,
+    email: op.email,
+    name: op.name,
+    scopes: op.scopes,
+    enrolled: op.totpConfirmedAt !== null,
+    backupCodesLeft: op.backupCodes.length,
+    locked: isLocked(op),
+    createdBy: op.createdBy,
+    createdAt: op.createdAt,
+    lastLoginAt: op.lastLoginAt,
+    disabledAt: op.disabledAt
+  };
+}
+async function createLink(store, input) {
+  const token2 = newOpaqueToken(input.kind === "invite" ? "fai" : "far");
+  if (input.operatorId) {
+    await store.query(
+      `UPDATE fonderie_admin_invites SET used_at = now() WHERE operator_id = $1 AND used_at IS NULL`,
+      [input.operatorId]
+    );
+  }
+  const [row] = await store.query(
+    `INSERT INTO fonderie_admin_invites (kind, token_hash, email, scopes, operator_id, created_by, expires_at)
+		 VALUES ($1, $2, $3, $4, $5, $6, now() + make_interval(hours => $7)) RETURNING id, expires_at AS "expiresAt"`,
+    [
+      input.kind,
+      sha256(token2),
+      normalizeEmail(input.email),
+      input.scopes ?? [],
+      input.operatorId ?? null,
+      input.createdBy,
+      input.hours
+    ]
+  );
+  if (!row) throw new Error("[admin] link insert returned no row");
+  return { id: row.id, token: token2, expiresAt: row.expiresAt };
+}
+async function findLink(store, token2) {
+  const [row] = await store.query(
+    `SELECT id, kind, email, scopes, operator_id AS "operatorId", created_by AS "createdBy"
+		   FROM fonderie_admin_invites WHERE token_hash = $1 AND used_at IS NULL AND expires_at > now()`,
+    [sha256(token2)]
+  );
+  return row ?? null;
+}
+async function redeemLink(store, token2, input) {
+  const passwordHash = await hashPassword(input.password);
+  return store.transaction(async (tx) => {
+    const [link] = await tx.query(
+      `UPDATE fonderie_admin_invites SET used_at = now()
+			  WHERE token_hash = $1 AND used_at IS NULL AND expires_at > now()
+			  RETURNING kind, email, scopes, operator_id AS "operatorId", created_by AS "createdBy"`,
+      [sha256(token2)]
+    );
+    if (!link) return { error: "INVALID_LINK" };
+    if (link.kind === "invite") {
+      const [op2] = await tx.query(
+        `INSERT INTO fonderie_admin_operators (email, name, password_hash, scopes, created_by)
+				 VALUES ($1, $2, $3, $4, $5) ON CONFLICT (email) DO NOTHING RETURNING ${OP_COLS}`,
+        [link.email, input.name ?? null, passwordHash, link.scopes, link.createdBy]
+      );
+      if (!op2)
+        throw Object.assign(new Error("already an operator"), { code: "ALREADY_OPERATOR" });
+      return { op: op2 };
+    }
+    const [op] = await tx.query(
+      `UPDATE fonderie_admin_operators
+			    SET password_hash = $2, totp_secret = NULL, totp_confirmed_at = NULL, totp_last_step = NULL,
+			        backup_codes = '{}', failed_attempts = 0, locked_until = NULL
+			  WHERE id = $1 AND disabled_at IS NULL RETURNING ${OP_COLS}`,
+      [link.operatorId, passwordHash]
+    );
+    if (!op) return { error: "INVALID_LINK" };
+    await tx.query(`DELETE FROM fonderie_admin_sessions WHERE operator_id = $1`, [op.id]);
+    return { op };
+  }).catch((err) => {
+    if (err.code === "ALREADY_OPERATOR")
+      return { error: "ALREADY_OPERATOR" };
+    throw err;
+  });
+}
+async function createSession(store, ctx, operatorId, stage) {
+  const id = newOpaqueToken("fas");
+  const ttl = stage === "active" ? ABSOLUTE_MS : PENDING_MS;
+  await store.query(
+    `INSERT INTO fonderie_admin_sessions (id_hash, operator_id, stage, expires_at, client_ip, user_agent)
+		 VALUES ($1, $2, $3, now() + make_interval(secs => $4), $5, $6)`,
+    [
+      sha256(id),
+      operatorId,
+      stage,
+      ttl / 1e3,
+      ctx.meta.clientIp ?? null,
+      ctx.request.headers.get("user-agent")?.slice(0, 300) ?? null
+    ]
+  );
+  return id;
+}
+async function deleteSession(store, id) {
+  await store.query(`DELETE FROM fonderie_admin_sessions WHERE id_hash = $1`, [sha256(id)]);
+}
+async function deleteOperatorSessions(store, operatorId) {
+  await store.query(`DELETE FROM fonderie_admin_sessions WHERE operator_id = $1`, [operatorId]);
+}
+async function readSession(store, id) {
+  if (!id) return null;
+  const [session] = await store.query(
+    `SELECT ${SESSION_COLS} FROM fonderie_admin_sessions WHERE id_hash = $1 AND expires_at > now()`,
+    [sha256(id)]
+  );
+  if (!session) return null;
+  if (session.stage === "active" && Date.now() - new Date(session.lastSeenAt).getTime() > IDLE_MS) {
+    await store.query(`DELETE FROM fonderie_admin_sessions WHERE id_hash = $1`, [session.idHash]);
+    return null;
+  }
+  const op = await findOperator(store, { id: session.operatorId });
+  if (!op || op.disabledAt) return null;
+  if (Date.now() - new Date(session.lastSeenAt).getTime() > 6e4) {
+    void store.query(`UPDATE fonderie_admin_sessions SET last_seen_at = now() WHERE id_hash = $1`, [
+      session.idHash
+    ]).catch(() => void 0);
+  }
+  return { session, op };
+}
+var stepUpFresh = (s) => s.stepUpAt !== null && Date.now() - new Date(s.stepUpAt).getTime() < STEP_UP_MS;
+async function markStepUp(store, idHash) {
+  await store.query(`UPDATE fonderie_admin_sessions SET step_up_at = now() WHERE id_hash = $1`, [
+    idHash
+  ]);
+}
+
+// src/operators/http.ts
+var LOCAL = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var isSecure = (ctx) => {
+  const u = new URL(ctx.request.url);
+  return !(u.protocol === "http:" && LOCAL.has(u.hostname));
+};
+var cookieName = (ctx) => isSecure(ctx) ? "__Host-fonderie_admin" : "fonderie_admin";
+function readCookie(ctx) {
+  const header = ctx.request.headers.get("cookie") ?? "";
+  const want = cookieName(ctx);
+  for (const part of header.split(";")) {
+    const i = part.indexOf("=");
+    if (i > 0 && part.slice(0, i).trim() === want)
+      return decodeURIComponent(part.slice(i + 1).trim());
+  }
+  return "";
+}
+function withCookie(res, ctx, value, maxAgeMs) {
+  const attrs = [
+    `${cookieName(ctx)}=${value}`,
+    "Path=/",
+    "HttpOnly",
+    "SameSite=Strict",
+    `Max-Age=${Math.floor(maxAgeMs / 1e3)}`
+  ];
+  if (isSecure(ctx)) attrs.push("Secure");
+  res.headers.append("set-cookie", attrs.join("; "));
+  res.headers.set("cache-control", "no-store");
+  return res;
+}
+var clearCookie = (res, ctx) => withCookie(res, ctx, "", 0);
+function sameOrigin(ctx) {
+  const origin = ctx.request.headers.get("origin");
+  const host = ctx.request.headers.get("host") ?? new URL(ctx.request.url).host;
+  if (origin) {
+    try {
+      return new URL(origin).host === host;
+    } catch {
+      return false;
+    }
+  }
+  const site = ctx.request.headers.get("sec-fetch-site");
+  return site === null || site === "same-origin";
+}
+var WINDOW_MS = 10 * 6e4;
+var PER_IP = 30;
+var attempts = /* @__PURE__ */ new Map();
+function ipLimited(ctx) {
+  const ip = ctx.meta.clientIp ?? "unknown";
+  const now = Date.now();
+  const recent = (attempts.get(ip) ?? []).filter((t) => now - t < WINDOW_MS);
+  recent.push(now);
+  attempts.set(ip, recent);
+  if (attempts.size > 1e4) attempts.clear();
+  return recent.length > PER_IP;
+}
+var body = (ctx) => ctx.meta["body"] ?? {};
+var str = (v) => typeof v === "string" ? v : "";
+var bearer = (ctx) => {
+  const h = ctx.request.headers.get("authorization") ?? "";
+  return h.startsWith("Bearer ") ? h.slice(7) : "";
+};
+var BAD_CREDENTIALS = () => setApiResponse(
+  HTTP.UNAUTHORIZED,
+  "INVALID_CREDENTIALS",
+  "That email and password do not match an operator."
+);
+var BAD_CODE = () => setApiResponse(
+  HTTP.UNAUTHORIZED,
+  "INVALID_CODE",
+  "That code did not work. Codes change every 30 seconds."
+);
+var LOCKED = (op) => setApiResponse(
+  HTTP.TOO_MANY_REQUESTS,
+  "LOCKED",
+  `Too many attempts. Try again in ${lockMinutes(op)} minute(s).`
+);
+var TOO_FAST = () => setApiResponse(
+  HTTP.TOO_MANY_REQUESTS,
+  "RATE_LIMITED",
+  "Too many attempts from this address. Wait a few minutes."
+);
+var WRONG_STAGE = () => setApiResponse(HTTP.UNAUTHORIZED, "NO_SESSION", "Start again from sign-in.");
+var CROSS_ORIGIN = () => setApiResponse(HTTP.FORBIDDEN, "CROSS_ORIGIN", "This request did not come from the admin page.");
+var stateOf = (stage) => stage === "active" ? "signed-in" : stage === "enroll" ? "needs-enrollment" : "needs-2fa";
+async function startSession(deps, ctx, op, stage, payload = {}) {
+  ctx.meta["adminOperator"] = op.email;
+  const id = await createSession(deps.store, ctx, op.id, stage);
+  const res = setApiResponse(HTTP.OK, "ADMIN_SESSION", "Session", {
+    state: stateOf(stage),
+    operator: publicOperator(op),
+    ...payload
+  });
+  return withCookie(res, ctx, id, stage === "active" ? ABSOLUTE_MS : PENDING_MS);
+}
+async function sessionAt(deps, ctx, stage) {
+  const cookie = readCookie(ctx);
+  const found = await readSession(deps.store, cookie);
+  return found && found.session.stage === stage ? { ...found, cookie } : null;
+}
+function sessionRoutes(deps) {
+  const { store, box } = deps;
+  const check = async (ctx, next) => {
+    ctx.meta["adminActor"] = "anonymous";
+    if (ctx.request.method !== "GET" && !sameOrigin(ctx)) return CROSS_ORIGIN();
+    if (ctx.request.method !== "GET" && ipLimited(ctx)) return TOO_FAST();
+    return next();
+  };
+  return [
+    [
+      "GET",
+      "/_admin/session",
+      [
+        check,
+        async (ctx) => {
+          const found = await readSession(store, readCookie(ctx));
+          const claimable = await operatorCount(store) === 0;
+          return setApiResponse(HTTP.OK, "ADMIN_SESSION", "Session", {
+            state: found ? stateOf(found.session.stage) : "signed-out",
+            operator: found ? publicOperator(found.op) : null,
+            claimable,
+            stepUpFresh: found ? stepUpFresh(found.session) : false
+          });
+        }
+      ]
+    ],
+    [
+      // The one-time claim. Needs the root token AND an empty operator table;
+      // after the first operator exists it is permanently refused.
+      "POST",
+      "/_admin/session/claim",
+      [
+        check,
+        validate(claimSchema),
+        async (ctx) => {
+          if (!constantTimeEqual2(bearer(ctx), deps.rootToken)) {
+            return setApiResponse(
+              HTTP.UNAUTHORIZED,
+              "UNAUTHORIZED",
+              "Claiming needs the root admin token."
+            );
+          }
+          const b = body(ctx);
+          const email2 = normalizeEmail(str(b["email"]));
+          if (!EMAIL_RE.test(email2))
+            return setApiResponse(HTTP.UNPROCESSABLE, "INVALID", "Enter a valid email address.");
+          const problem = passwordProblem(b["password"]);
+          if (problem) return setApiResponse(HTTP.UNPROCESSABLE, "WEAK_PASSWORD", problem);
+          const op = await claimFirstOperator(store, {
+            email: email2,
+            name: str(b["name"]) || void 0,
+            password: str(b["password"])
+          });
+          if (!op)
+            return setApiResponse(
+              HTTP.CONFLICT,
+              "ALREADY_CLAIMED",
+              "This console already has operators. Ask one for an invite."
+            );
+          return startSession(deps, ctx, op, "enroll");
+        }
+      ]
+    ],
+    [
+      "POST",
+      "/_admin/session/login",
+      [
+        check,
+        validate(loginSchema),
+        async (ctx) => {
+          const b = body(ctx);
+          const result = await checkPassword(store, str(b["email"]), str(b["password"]));
+          if (result.op && "locked" in result && result.locked) return LOCKED(result.op);
+          if (!result.ok || !result.op) return BAD_CREDENTIALS();
+          return startSession(
+            deps,
+            ctx,
+            result.op,
+            result.op.totpConfirmedAt ? "password" : "enroll"
+          );
+        }
+      ]
+    ],
+    [
+      "GET",
+      "/_admin/session/enrollment",
+      [
+        check,
+        async (ctx) => {
+          const s = await sessionAt(deps, ctx, "enroll");
+          if (!s) return WRONG_STAGE();
+          const secret = await enrollmentSecret(store, box, s.op);
+          const issuer = `Admin \xB7 ${new URL(ctx.request.url).hostname}`;
+          const res = setApiResponse(HTTP.OK, "ENROLLMENT", "Scan this with an authenticator app", {
+            secret,
+            uri: totpUri(issuer, s.op.email, secret),
+            account: s.op.email,
+            issuer
+          });
+          res.headers.set("cache-control", "no-store");
+          return res;
+        }
+      ]
+    ],
+    [
+      "POST",
+      "/_admin/session/enrollment",
+      [
+        check,
+        validate(enrollmentSchema),
+        async (ctx) => {
+          const s = await sessionAt(deps, ctx, "enroll");
+          if (!s) return WRONG_STAGE();
+          const codes = await confirmEnrollment(store, box, s.op, str(body(ctx)["code"]));
+          if (!codes) {
+            const fresh = await findOperator(store, { id: s.op.id });
+            return fresh && lockMinutes(fresh) ? LOCKED(fresh) : BAD_CODE();
+          }
+          await deleteSession(store, s.cookie);
+          const op = await findOperator(store, { id: s.op.id }) ?? s.op;
+          return startSession(deps, ctx, op, "active", { backupCodes: codes });
+        }
+      ]
+    ],
+    [
+      "POST",
+      "/_admin/session/verify",
+      [
+        check,
+        validate(factorSchema),
+        async (ctx) => {
+          const s = await sessionAt(deps, ctx, "password");
+          if (!s) return WRONG_STAGE();
+          const b = body(ctx);
+          const r = await checkSecondFactor(store, box, s.op, {
+            code: b["code"],
+            backupCode: b["backupCode"]
+          });
+          if (!r.ok) {
+            const fresh = await findOperator(store, { id: s.op.id });
+            return fresh && lockMinutes(fresh) ? LOCKED(fresh) : BAD_CODE();
+          }
+          await deleteSession(store, s.cookie);
+          await store.query(
+            `UPDATE fonderie_admin_operators SET last_login_at = now() WHERE id = $1`,
+            [s.op.id]
+          );
+          return startSession(
+            deps,
+            ctx,
+            s.op,
+            "active",
+            r.via === "backup" ? { backupCodesLeft: r.backupLeft } : {}
+          );
+        }
+      ]
+    ],
+    [
+      // A fresh code for the next five minutes of dangerous actions.
+      "POST",
+      "/_admin/session/step-up",
+      [
+        check,
+        validate(factorSchema),
+        async (ctx) => {
+          const s = await sessionAt(deps, ctx, "active");
+          if (!s) return WRONG_STAGE();
+          const b = body(ctx);
+          const r = await checkSecondFactor(store, box, s.op, {
+            code: b["code"],
+            backupCode: b["backupCode"]
+          });
+          if (!r.ok) return BAD_CODE();
+          await markStepUp(store, s.session.idHash);
+          return setApiResponse(HTTP.OK, "STEPPED_UP", "Confirmed for five minutes", {
+            stepUpFresh: true,
+            ...r.via === "backup" ? { backupCodesLeft: r.backupLeft } : {}
+          });
+        }
+      ]
+    ],
+    [
+      "DELETE",
+      "/_admin/session",
+      [
+        check,
+        async (ctx) => {
+          const cookie = readCookie(ctx);
+          if (cookie) await deleteSession(store, cookie);
+          return clearCookie(setApiResponse(HTTP.OK, "SIGNED_OUT", "Signed out"), ctx);
+        }
+      ]
+    ],
+    [
+      // What a link is for, before the person sets a password. POST so the
+      // token never sits in a URL a proxy logs.
+      "POST",
+      "/_admin/session/link/inspect",
+      [
+        check,
+        validate(inspectLinkSchema),
+        async (ctx) => {
+          const link = await findLink(store, str(body(ctx)["token"]));
+          return link ? setApiResponse(HTTP.OK, "LINK", "Link", { kind: link.kind, email: link.email }) : setApiResponse(
+            HTTP.NOT_FOUND,
+            "INVALID_LINK",
+            "This link has expired or was already used. Ask for a new one."
+          );
+        }
+      ]
+    ],
+    [
+      "POST",
+      "/_admin/session/link",
+      [
+        check,
+        validate(redeemLinkSchema),
+        async (ctx) => {
+          const b = body(ctx);
+          const problem = passwordProblem(b["password"]);
+          if (problem) return setApiResponse(HTTP.UNPROCESSABLE, "WEAK_PASSWORD", problem);
+          const r = await redeemLink(store, str(b["token"]), {
+            password: str(b["password"]),
+            name: str(b["name"]) || void 0
+          });
+          if ("error" in r) {
+            return r.error === "ALREADY_OPERATOR" ? setApiResponse(
+              HTTP.CONFLICT,
+              "ALREADY_OPERATOR",
+              "That email is already an operator. Sign in instead."
+            ) : setApiResponse(
+              HTTP.NOT_FOUND,
+              "INVALID_LINK",
+              "This link has expired or was already used. Ask for a new one."
+            );
+          }
+          return startSession(deps, ctx, r.op, "enroll");
+        }
+      ]
+    ]
+  ];
+}
+function needsStepUp(method, path, needed) {
+  const m = method.toUpperCase();
+  if (m === "GET" || m === "HEAD") return false;
+  return needed === "root" || needed === "secrets" || m === "DELETE" || /\/migrations\/[^/]+\/apply$/.test(path);
+}
+async function authorizeOperator(store, ctx, needed, stepUp) {
+  const found = await readSession(store, readCookie(ctx));
+  if (!found || found.session.stage !== "active") return null;
+  const method = ctx.request.method.toUpperCase();
+  if (method !== "GET" && method !== "HEAD" && !sameOrigin(ctx)) return CROSS_ORIGIN();
+  const scope = needed === "root" ? "secrets" : needed;
+  if (!grants(found.op.scopes, scope)) {
+    return setApiResponse(
+      HTTP.FORBIDDEN,
+      "FORBIDDEN",
+      `Your operator account lacks the '${scope}' scope`
+    );
+  }
+  ctx.meta["adminOperator"] = found.op.email;
+  if (stepUp && !stepUpFresh(found.session)) {
+    return setApiResponse(
+      HTTP.FORBIDDEN,
+      "STEP_UP_REQUIRED",
+      "Enter a code from your authenticator app to continue."
+    );
+  }
+  return "ok";
+}
+var actorOf = (ctx) => typeof ctx.meta["adminOperator"] === "string" ? `operator:${ctx.meta["adminOperator"]}` : "root-token";
+var validScopes = (v) => Array.isArray(v) && v.length > 0 && v.every((s) => SCOPES.includes(s)) ? [...new Set(v)] : null;
+function operatorAdminRoutes(deps) {
+  const { store } = deps;
+  const link = (ctx, token2) => `${deps.uiPath(ctx)}#/link/${token2}`;
+  const idOf = (ctx) => ctx.meta.params?.["id"] ?? "";
+  return [
+    [
+      "GET",
+      "/_admin/access/operators",
+      [async () => setApiResponse(HTTP.OK, "OPERATORS", "Operators", await listOperators(store))],
+      "read"
+    ],
+    [
+      "POST",
+      "/_admin/access/operators/invites",
+      [
+        validate(inviteSchema),
+        async (ctx) => {
+          const b = body(ctx);
+          const email2 = normalizeEmail(str(b["email"]));
+          if (!EMAIL_RE.test(email2))
+            return setApiResponse(HTTP.UNPROCESSABLE, "INVALID", "Enter a valid email address.");
+          const scopes = validScopes(b["scopes"]);
+          if (!scopes)
+            return setApiResponse(
+              HTTP.UNPROCESSABLE,
+              "INVALID",
+              `scopes must be a non-empty list of ${SCOPES.join(", ")}`
+            );
+          if (await findOperator(store, { email: email2 }))
+            return setApiResponse(
+              HTTP.CONFLICT,
+              "ALREADY_OPERATOR",
+              "That email is already an operator."
+            );
+          const hours = Number.isInteger(b["expiresInHours"]) ? Math.min(Math.max(b["expiresInHours"], 1), 336) : INVITE_HOURS;
+          const l = await createLink(store, {
+            kind: "invite",
+            email: email2,
+            scopes,
+            createdBy: actorOf(ctx),
+            hours
+          });
+          return setApiResponse(HTTP.CREATED, "INVITE_CREATED", "Invite link \u2014 shown once", {
+            id: l.id,
+            email: email2,
+            scopes,
+            expiresAt: l.expiresAt,
+            token: l.token,
+            url: link(ctx, l.token)
+          });
+        }
+      ],
+      "root"
+    ],
+    [
+      // Lost password or lost authenticator: a single-use link that sets a new
+      // password and makes them enroll again. Signs them out everywhere.
+      "POST",
+      "/_admin/access/operators/:id/recovery",
+      [
+        async (ctx) => {
+          const op = await findOperator(store, { id: idOf(ctx) });
+          if (!op) return setApiResponse(HTTP.NOT_FOUND, "NOT_FOUND", "No such operator");
+          await deleteOperatorSessions(store, op.id);
+          const l = await createLink(store, {
+            kind: "recovery",
+            email: op.email,
+            operatorId: op.id,
+            createdBy: actorOf(ctx),
+            hours: RECOVERY_HOURS
+          });
+          return setApiResponse(HTTP.CREATED, "RECOVERY_CREATED", "Recovery link \u2014 shown once", {
+            id: l.id,
+            email: op.email,
+            expiresAt: l.expiresAt,
+            token: l.token,
+            url: link(ctx, l.token)
+          });
+        }
+      ],
+      "root"
+    ],
+    [
+      "PUT",
+      "/_admin/access/operators/:id",
+      [
+        validate(updateOperatorSchema),
+        async (ctx) => {
+          const b = body(ctx);
+          const op = await findOperator(store, { id: idOf(ctx) });
+          if (!op) return setApiResponse(HTTP.NOT_FOUND, "NOT_FOUND", "No such operator");
+          const scopes = b["scopes"] === void 0 ? op.scopes : validScopes(b["scopes"]);
+          if (!scopes)
+            return setApiResponse(
+              HTTP.UNPROCESSABLE,
+              "INVALID",
+              `scopes must be a non-empty list of ${SCOPES.join(", ")}`
+            );
+          if (ctx.meta["adminOperator"] === op.email && !scopes.includes("secrets") && op.scopes.includes("secrets")) {
+            return setApiResponse(
+              HTTP.CONFLICT,
+              "SELF_DEMOTION",
+              "You cannot remove your own highest scope. Ask another operator."
+            );
+          }
+          const disabled = b["disabled"];
+          if (disabled === true && ctx.meta["adminOperator"] === op.email) {
+            return setApiResponse(
+              HTTP.CONFLICT,
+              "SELF_DISABLE",
+              "You cannot disable yourself. Ask another operator."
+            );
+          }
+          const [row] = await store.query(
+            `UPDATE fonderie_admin_operators
+						    SET scopes = $2, name = coalesce($3, name),
+						        disabled_at = CASE WHEN $4::boolean IS NULL THEN disabled_at WHEN $4 THEN coalesce(disabled_at, now()) ELSE NULL END
+						  WHERE id = $1
+						  RETURNING id, email, name, password_hash AS "passwordHash", scopes, totp_secret AS "totpSecret",
+						    totp_confirmed_at AS "totpConfirmedAt", totp_last_step AS "totpLastStep", backup_codes AS "backupCodes",
+						    failed_attempts AS "failedAttempts", locked_until AS "lockedUntil", created_by AS "createdBy",
+						    created_at AS "createdAt", last_login_at AS "lastLoginAt", disabled_at AS "disabledAt"`,
+            [
+              op.id,
+              scopes,
+              typeof b["name"] === "string" ? b["name"] : null,
+              typeof disabled === "boolean" ? disabled : null
+            ]
+          );
+          if (!row) return setApiResponse(HTTP.NOT_FOUND, "NOT_FOUND", "No such operator");
+          await deleteOperatorSessions(store, op.id);
+          return setApiResponse(
+            HTTP.OK,
+            "OPERATOR_UPDATED",
+            "Operator updated",
+            publicOperator(row)
+          );
+        }
+      ],
+      "root"
+    ],
+    [
+      "DELETE",
+      "/_admin/access/operators/links/:id",
+      [
+        async (ctx) => {
+          const rows = await store.query(
+            `UPDATE fonderie_admin_invites SET used_at = now() WHERE id = $1 AND used_at IS NULL RETURNING id`,
+            [idOf(ctx)]
+          );
+          return rows.length ? setApiResponse(HTTP.OK, "LINK_REVOKED", "Link revoked") : setApiResponse(HTTP.NOT_FOUND, "NOT_FOUND", "No such live link");
+        }
+      ],
+      "root"
+    ]
+  ];
+}
+
+// src/tokens.ts
 var SCOPES = ["read", "write", "secrets"];
 function scopeFor(method, path) {
   if (/\/secrets(\/|$)/.test(path)) return "secrets";
@@ -315,8 +1331,8 @@ function grants(held, needed) {
   if (held.includes("write")) return true;
   return needed === "read" && held.includes("read");
 }
-var hashToken = (token) => createHash("sha256").update(token).digest("hex");
-var mintToken = () => `fad_${randomBytes(24).toString("base64url")}`;
+var hashToken = (token2) => createHash2("sha256").update(token2).digest("hex");
+var mintToken = () => `fad_${randomBytes2(24).toString("base64url")}`;
 var COLUMNS = `id, name, scopes, created_by AS "createdBy", created_at AS "createdAt",
                  expires_at AS "expiresAt", revoked_at AS "revokedAt", last_used_at AS "lastUsedAt"`;
 async function listTokens(store) {
@@ -325,15 +1341,15 @@ async function listTokens(store) {
   );
 }
 async function issueToken(store, input) {
-  const token = mintToken();
+  const token2 = mintToken();
   const expiresAt = input.expiresInDays ? new Date(Date.now() + input.expiresInDays * 864e5) : null;
   const [record] = await store.query(
     `INSERT INTO fonderie_admin_tokens (name, token_hash, scopes, created_by, expires_at)
 		 VALUES ($1, $2, $3, $4, $5) RETURNING ${COLUMNS}`,
-    [input.name, hashToken(token), input.scopes, input.createdBy, expiresAt]
+    [input.name, hashToken(token2), input.scopes, input.createdBy, expiresAt]
   );
   if (!record) throw new Error("[admin] token insert returned no row");
-  return { token, record };
+  return { token: token2, record };
 }
 async function revokeToken(store, id) {
   const rows = await store.query(
@@ -342,29 +1358,34 @@ async function revokeToken(store, id) {
   );
   return rows.length > 0;
 }
-async function findLive(store, token) {
+async function findLive(store, token2) {
   const [row] = await store.query(
     `SELECT ${COLUMNS} FROM fonderie_admin_tokens
 		  WHERE token_hash = $1 AND revoked_at IS NULL AND (expires_at IS NULL OR expires_at > now())`,
-    [hashToken(token)]
+    [hashToken(token2)]
   );
   return row ?? null;
 }
-var bearer = (ctx) => {
+var bearer2 = (ctx) => {
   const h = ctx.request.headers.get("authorization") ?? "";
   return h.startsWith("Bearer ") ? h.slice(7) : "";
 };
-var UNAUTHORIZED = () => setApiResponse(HTTP.UNAUTHORIZED, "UNAUTHORIZED", "Missing or invalid admin token");
-function requireAdminScope(bootstrap, store, needed) {
+var UNAUTHORIZED = () => setApiResponse2(HTTP2.UNAUTHORIZED, "UNAUTHORIZED", "Missing or invalid admin token");
+function requireAdminScope(bootstrap, store, needed, opts = {}) {
   return async (ctx, next) => {
-    const token = bearer(ctx);
-    if (!token) return UNAUTHORIZED();
-    if (constantTimeEqual(token, bootstrap)) return next();
+    const token2 = bearer2(ctx);
+    if (!token2) {
+      if (!store || !opts.operators) return UNAUTHORIZED();
+      const verdict = await authorizeOperator(store, ctx, needed, opts.stepUp ?? false);
+      if (verdict === null) return UNAUTHORIZED();
+      return verdict === "ok" ? next() : verdict;
+    }
+    if (constantTimeEqual3(token2, bootstrap)) return next();
     if (needed === "root" || !store) return UNAUTHORIZED();
-    const record = await findLive(store, token);
+    const record = await findLive(store, token2);
     if (!record) return UNAUTHORIZED();
     if (!grants(record.scopes, needed)) {
-      return setApiResponse(HTTP.FORBIDDEN, "FORBIDDEN", `This token lacks the '${needed}' scope`);
+      return setApiResponse2(HTTP2.FORBIDDEN, "FORBIDDEN", `This token lacks the '${needed}' scope`);
     }
     ctx.meta["adminTokenName"] = record.name;
     void store.query(`UPDATE fonderie_admin_tokens SET last_used_at = now() WHERE id = $1`, [record.id]).catch(() => void 0);
@@ -378,8 +1399,8 @@ var issueTokenSchema = {
       error: { issues: [{ path: [path], message }] }
     });
     const b = input ?? {};
-    const name = typeof b["name"] === "string" ? b["name"].trim() : "";
-    if (!name || name.length > 100) return fail("name", "name is required (1\u2013100 chars)");
+    const name2 = typeof b["name"] === "string" ? b["name"].trim() : "";
+    if (!name2 || name2.length > 100) return fail("name", "name is required (1\u2013100 chars)");
     const scopes = b["scopes"];
     if (!Array.isArray(scopes) || scopes.length === 0 || !scopes.every((s) => SCOPES.includes(s)))
       return fail("scopes", `scopes must be a non-empty list of ${SCOPES.join(", ")}`);
@@ -389,7 +1410,7 @@ var issueTokenSchema = {
     return {
       success: true,
       data: {
-        name,
+        name: name2,
         scopes: [...new Set(scopes)],
         ...days !== void 0 ? { expiresInDays: days } : {}
       }
@@ -494,6 +1515,27 @@ box-shadow:0 1px 2px rgba(0,0,0,.06);
 .theme-switch__option:focus-within{color:var(--fonderie-text)}
 .theme-switch__option svg{flex-shrink:0}
 .theme-switch__option span{line-height:1}
+
+/* \u2500\u2500 Console chrome. Pseudo-selectors the inline-styled screens cannot carry.
+   Each one only refines: embedded without this shell, a screen loses hover
+   states and keeps working. \u2500\u2500 */
+button{transition:background-color .12s,border-color .12s,color .12s,opacity .12s}
+button:disabled{opacity:.5;cursor:default}
+.fonderie-admin-main button:not(:disabled):hover{opacity:.82}
+.fonderie-admin-main button:not(:disabled):active{opacity:.7}
+.fonderie-admin-nav-item:hover{background:color-mix(in srgb,var(--fonderie-text) 5%,transparent)!important;color:var(--fonderie-text)!important}
+.fonderie-admin-nav-item[aria-current="page"]:hover{background:color-mix(in srgb,var(--fonderie-accent) 16%,transparent)!important}
+/* Tables and lists are framed cards; the frame is the last row's rule. */
+.fonderie-admin-main tbody tr:last-child>td{border-bottom:none!important}
+.fonderie-admin-main ul>li:last-child{border-bottom:none!important}
+.fonderie-admin-main tbody tr:hover>td{background:color-mix(in srgb,var(--fonderie-text) 2.5%,transparent)}
+/* Inputs carry their border inline, so focus is a ring, not a border change. */
+input:focus-visible,select:focus-visible,textarea:focus-visible{outline:none;box-shadow:0 0 0 3px color-mix(in srgb,var(--fonderie-accent) 30%,transparent)}
+input::placeholder,textarea::placeholder{color:var(--fonderie-text-muted);opacity:.75}
+/* In the sidebar footer the switcher spans the column. */
+nav .theme-switch{display:flex;width:100%;box-sizing:border-box}
+nav .theme-switch__option{flex:1;justify-content:center;padding:5px 6px}
+@media (max-width:820px){.fonderie-admin-main>div{padding:20px 16px 48px!important}}
 `;
 var BOOT = `(function(){try{var t=localStorage.getItem('fonderie.admin.theme');if(t==='light'||t==='dark')document.documentElement.setAttribute('data-theme',t)}catch(e){}})()`;
 var uiHtml = (scriptPath) => `<!doctype html>
@@ -517,7 +1559,7 @@ var uiHtml = (scriptPath) => `<!doctype html>
 // src/module.ts
 var DEFAULT_ADMIN_PATH = "/_admin";
 var DEFAULT_CHECK_TIMEOUT_MS = 1e4;
-var ADMIN_VERSION = "1.0.3";
+var ADMIN_VERSION = "1.2.0";
 function normalizeHostPattern(host) {
   return host.trim().replace(/^[a-z][a-z0-9+.-]*:\/\//i, "").replace(/\/.*$/, "").toLowerCase();
 }
@@ -526,7 +1568,7 @@ function requireAdminHost(hosts) {
   return (ctx, next) => {
     const url = new URL(ctx.request.url);
     const ok = allowed.has(url.host.toLowerCase()) || allowed.has(url.hostname.toLowerCase());
-    return ok ? next() : Promise.resolve(setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "Not found"));
+    return ok ? next() : Promise.resolve(setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "Not found"));
   };
 }
 var AdminModule = class {
@@ -542,8 +1584,8 @@ var AdminModule = class {
   // null = answer on any hostname.
   hosts;
   install(app) {
-    const token = this.options.adminToken;
-    if (!token) return;
+    const token2 = this.options.adminToken;
+    if (!token2) return;
     app.reserve(this.path);
     const at = (p) => this.path + p.slice(DEFAULT_ADMIN_PATH.length);
     const store = this.options.store;
@@ -555,8 +1597,8 @@ var AdminModule = class {
       [
         "GET",
         "/_admin",
-        async () => setApiResponse2(
-          HTTP2.OK,
+        async () => setApiResponse3(
+          HTTP3.OK,
           "ADMIN_ATTENTION",
           "What needs attention",
           attention(app, await doctor())
@@ -565,8 +1607,8 @@ var AdminModule = class {
       [
         "GET",
         "/_admin/manifest",
-        async () => setApiResponse2(
-          HTTP2.OK,
+        async () => setApiResponse3(
+          HTTP3.OK,
           "ADMIN_MANIFEST",
           "Deployment manifest",
           buildManifest(app, { version: this.version, log: Boolean(store), host: this.hosts })
@@ -575,7 +1617,7 @@ var AdminModule = class {
       [
         "GET",
         "/_admin/doctor",
-        async () => setApiResponse2(HTTP2.OK, "ADMIN_DOCTOR", "Reconciliation checks", await doctor())
+        async () => setApiResponse3(HTTP3.OK, "ADMIN_DOCTOR", "Reconciliation checks", await doctor())
       ],
       [
         "GET",
@@ -588,8 +1630,8 @@ var AdminModule = class {
         // every deployment, built a client against admin's own report and
         // crashed the page with "a.map is not a function".
         "/_admin/environment",
-        async () => setApiResponse2(
-          HTTP2.OK,
+        async () => setApiResponse3(
+          HTTP3.OK,
           "ADMIN_ENVIRONMENT",
           "Declared vs held",
           environmentReport(app, this.options.env ?? [])
@@ -598,13 +1640,13 @@ var AdminModule = class {
       [
         "GET",
         "/_admin/routes",
-        async () => setApiResponse2(HTTP2.OK, "ADMIN_ROUTES", "Exposed routes", routesReport(app, this.name))
+        async () => setApiResponse3(HTTP3.OK, "ADMIN_ROUTES", "Exposed routes", routesReport(app, this.name))
       ],
       [
         "GET",
         "/_admin/access/tokens",
-        async () => setApiResponse2(
-          HTTP2.OK,
+        async () => setApiResponse3(
+          HTTP3.OK,
           "ADMIN_TOKENS",
           "Admin tokens",
           tokensReport(app, this.name, store ? await listTokens(store) : null)
@@ -623,7 +1665,7 @@ var AdminModule = class {
             ...limit ? { limit } : {},
             ...before ? { before } : {}
           });
-          return setApiResponse2(HTTP2.OK, "ADMIN_LOG", "Admin activity", page);
+          return setApiResponse3(HTTP3.OK, "ADMIN_LOG", "Admin activity", page);
         }
       ]);
     }
@@ -632,15 +1674,15 @@ var AdminModule = class {
         "POST",
         "/_admin/access/tokens",
         [
-          validate(issueTokenSchema),
+          validate2(issueTokenSchema),
           async (ctx) => {
-            const body = ctx.meta["body"];
+            const body2 = ctx.meta["body"];
             const createdBy = ctx.request.headers.get("x-actor") || "admin-token";
             const { token: plaintext, record } = await issueToken(store, {
-              ...body,
+              ...body2,
               createdBy
             });
-            return setApiResponse2(HTTP2.CREATED, "TOKEN_ISSUED", "Token issued \u2014 shown once", {
+            return setApiResponse3(HTTP3.CREATED, "TOKEN_ISSUED", "Token issued \u2014 shown once", {
               token: plaintext,
               ...record
             });
@@ -653,7 +1695,7 @@ var AdminModule = class {
         [
           async (ctx) => {
             const ok = await revokeToken(store, ctx.meta.params?.["id"] ?? "");
-            return ok ? setApiResponse2(HTTP2.OK, "TOKEN_REVOKED", "Token revoked") : setApiResponse2(HTTP2.NOT_FOUND, "NOT_FOUND", "No such live token");
+            return ok ? setApiResponse3(HTTP3.OK, "TOKEN_REVOKED", "Token revoked") : setApiResponse3(HTTP3.NOT_FOUND, "NOT_FOUND", "No such live token");
           }
         ]
       ]
@@ -664,8 +1706,8 @@ var AdminModule = class {
         "GET",
         "/_admin/migrations",
         [
-          async () => setApiResponse2(
-            HTTP2.OK,
+          async () => setApiResponse3(
+            HTTP3.OK,
             "MIGRATIONS",
             "Pending migrations by module",
             await migrationsReport(store, migrationSets)
@@ -676,43 +1718,43 @@ var AdminModule = class {
         "POST",
         "/_admin/migrations/:module/apply",
         [
-          validate(applyMigrationsSchema),
+          validate2(applyMigrationsSchema),
           async (ctx) => {
             const { expect } = ctx.meta["body"];
-            const name = ctx.meta.params?.["module"] ?? "";
-            const out = await applyModuleMigrations(store, migrationSets, name, expect);
+            const name2 = ctx.meta.params?.["module"] ?? "";
+            const out = await applyModuleMigrations(store, migrationSets, name2, expect);
             if (out.ok) {
-              return setApiResponse2(
-                HTTP2.OK,
+              return setApiResponse3(
+                HTTP3.OK,
                 out.reason,
-                out.reason === "MIGRATIONS_APPLIED" ? `Applied. ${out.module.pending.length} still pending in ${name}.` : `${name} is already up to date`,
+                out.reason === "MIGRATIONS_APPLIED" ? `Applied. ${out.module.pending.length} still pending in ${name2}.` : `${name2} is already up to date`,
                 out.module
               );
             }
             switch (out.reason) {
               case "NOT_FOUND":
-                return setApiResponse2(
-                  HTTP2.NOT_FOUND,
+                return setApiResponse3(
+                  HTTP3.NOT_FOUND,
                   "NOT_FOUND",
-                  `No migration set named "${name}"`
+                  `No migration set named "${name2}"`
                 );
               case "MIGRATIONS_OUT_OF_ORDER":
-                return setApiResponse2(
-                  HTTP2.CONFLICT,
+                return setApiResponse3(
+                  HTTP3.CONFLICT,
                   out.reason,
-                  `Apply "${out.blockedBy}" first \u2014 it runs before "${name}" and is behind.`,
+                  `Apply "${out.blockedBy}" first \u2014 it runs before "${name2}" and is behind.`,
                   { blockedBy: out.blockedBy }
                 );
               case "MIGRATIONS_CHANGED":
-                return setApiResponse2(
-                  HTTP2.CONFLICT,
+                return setApiResponse3(
+                  HTTP3.CONFLICT,
                   out.reason,
                   "What is pending changed since you looked. Refresh and read it again.",
                   { expected: out.expected, actual: out.actual }
                 );
               default:
-                return setApiResponse2(
-                  HTTP2.UNPROCESSABLE,
+                return setApiResponse3(
+                  HTTP3.UNPROCESSABLE,
                   out.reason,
                   "A pending migration deletes data. No down-migration brings it back \u2014 apply it through CI or `npm run migrate`, not from here.",
                   { files: out.files }
@@ -722,6 +1764,18 @@ var AdminModule = class {
         ]
       ]
     ] : [];
+    const operatorsOn = Boolean(store) && this.options.operators !== false;
+    const operatorDeps = store && operatorsOn ? {
+      store,
+      box: secretBox(this.options.operatorKey),
+      rootToken: token2,
+      // From the request, so a basePath in front of the surface is kept.
+      uiPath: (ctx) => {
+        const p = new URL(ctx.request.url).pathname;
+        const i = p.indexOf(this.path);
+        return `${i >= 0 ? p.slice(0, i + this.path.length) : this.path}/ui`;
+      }
+    } : null;
     const mounted = /* @__PURE__ */ new Map();
     const mount = (module, method, path, handlers, needed) => {
       const key = `${method.toUpperCase()} ${path}`;
@@ -732,7 +1786,11 @@ var AdminModule = class {
         );
       }
       mounted.set(key, module);
-      const guard = requireAdminScope(token, store, needed ?? scopeFor(method, path));
+      const need = needed ?? scopeFor(method, path);
+      const guard = requireAdminScope(token2, store, need, {
+        stepUp: needsStepUp(method, path, need),
+        operators: operatorsOn
+      });
       const chain = [
         // Logged first so a wrong-host attempt still leaves a row: the
         // caller learns nothing from a 404, the operator learns something.
@@ -771,20 +1829,35 @@ var AdminModule = class {
         "GET",
         scriptPath,
         ...ui(async () => {
-          const body = loadJs();
-          return body ? new Response(body, {
+          const body2 = loadJs();
+          return body2 ? new Response(body2, {
             headers: {
               "content-type": "text/javascript; charset=utf-8",
               "cache-control": "public, max-age=300"
             }
-          }) : setApiResponse2(
-            HTTP2.SERVICE_UNAVAILABLE,
+          }) : setApiResponse3(
+            HTTP3.SERVICE_UNAVAILABLE,
             "UI_NOT_BUILT",
             "This copy of @fonderie/admin has no built dashboard (dist/ui). Install the published package, or run its build."
           );
         })
       );
     }
+    if (operatorDeps && store) {
+      for (const [method, path, handlers] of sessionRoutes(operatorDeps)) {
+        const full = at(path);
+        mounted.set(`${method} ${full}`, this.name);
+        app.addRoute(
+          method,
+          full,
+          adminLog(store, full, this.name),
+          ...hostGuard ? [hostGuard] : [],
+          ...handlers
+        );
+      }
+      for (const [method, path, handlers, needed] of operatorAdminRoutes(operatorDeps))
+        mount(this.name, method, at(path), handlers, needed);
+    }
     for (const [method, path, handler] of own) mount(this.name, method, at(path), [handler]);
     for (const [method, path, handlers] of rootOnly)
       mount(this.name, method, at(path), handlers, "root");
@@ -795,7 +1868,22 @@ var AdminModule = class {
     }
   }
   checkReadiness() {
-    return validateAdminToken(this.options.adminToken, { module: this.name });
+    const problems = validateAdminToken(this.options.adminToken, { module: this.name });
+    const operatorsOn = Boolean(this.options.store) && this.options.operators !== false;
+    if (operatorsOn && this.options.operatorKey && !/^[0-9a-fA-F]{64}$/.test(this.options.operatorKey)) {
+      problems.push({
+        module: this.name,
+        severity: "error",
+        message: "operatorKey must be 64 hex characters (`openssl rand -hex 32`)"
+      });
+    } else if (operatorsOn && !this.options.operatorKey) {
+      problems.push({
+        module: this.name,
+        severity: "warning",
+        message: "operatorKey is unset \u2014 operators' authenticator secrets are stored unencrypted. Set a 64-hex operatorKey."
+      });
+    }
+    return problems;
   }
 };
 export {