@harborclient/team-hub 0.3.0 → 0.4.1

package/dist/cli.js

@@ -358,6 +358,7 @@ var USERS_COLLECTION = "users";
 var API_TOKENS_COLLECTION = "apiTokens";
 var COLLECTIONS_COLLECTION = "collections";
 var ENVIRONMENTS_COLLECTION = "environments";
+var SNIPPETS_COLLECTION = "snippets";
 var FOLDERS_COLLECTION = "folders";
 var REQUESTS_COLLECTION = "requests";
 var AUDIT_LOG_COLLECTION = "auditLog";
@@ -384,7 +385,8 @@ function createSystemUserInput() {
     name: SYSTEM_USER_NAME,
     role: "admin",
     collectionAccess: [],
-    environmentAccess: []
+    environmentAccess: [],
+    snippetAccess: []
   };
 }
 
@@ -398,7 +400,7 @@ var firestoreConfigSchema = z2.object({
 
 // src/db/firestore/utils.ts
 function parseAuditEntityType(value) {
-  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "folder" || value === "request") {
+  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -427,6 +429,7 @@ function mapFirestoreUser(id, data) {
     role: data.role,
     collectionAccess: data.collectionAccess,
     environmentAccess: data.environmentAccess,
+    snippetAccess: data.snippetAccess ?? [],
     llmAccess: data.llmAccess ?? false,
     llmModels: data.llmModels ?? [],
     llmMonthlyTokenLimit: data.llmMonthlyTokenLimit ?? null,
@@ -492,6 +495,20 @@ function mapFirestoreEnvironment(id, data) {
     deletionLocked: data.deletionLocked ?? false
   };
 }
+function mapFirestoreSnippet(id, data) {
+  return {
+    id,
+    name: data.name,
+    code: data.code,
+    scope: data.scope,
+    sortOrder: data.sortOrder,
+    createdAt: data.createdAt,
+    updatedAt: data.updatedAt ?? data.createdAt,
+    createdByUserId: data.createdByUserId ?? null,
+    updatedByUserId: data.updatedByUserId ?? null,
+    deletionLocked: data.deletionLocked ?? false
+  };
+}
 function mapFirestoreFolder(id, data) {
   return {
     id,
@@ -699,6 +716,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
   async migrate() {
     await this.ensureSystemUser();
     await this.migrateOrphanTokensToBootstrapUser();
+    await this.migrateSnippetAccessBackfill();
   }
   /**
    * Returns the stable identifier of the internal system user, when provisioned.
@@ -745,6 +763,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       role: input.role,
       collectionAccess: input.collectionAccess,
       environmentAccess: input.environmentAccess,
+      snippetAccess: input.snippetAccess,
       llmAccess: input.llmAccess ?? false,
       llmModels: input.llmModels ?? [],
       llmMonthlyTokenLimit: input.llmMonthlyTokenLimit ?? null,
@@ -816,6 +835,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
     const role = input.role ?? existing.role;
     const collectionAccess = input.collectionAccess ?? existing.collectionAccess;
     const environmentAccess = input.environmentAccess ?? existing.environmentAccess;
+    const snippetAccess = input.snippetAccess ?? existing.snippetAccess;
     const llmAccess = input.llmAccess ?? existing.llmAccess;
     const llmModels = input.llmModels ?? existing.llmModels;
     const llmMonthlyTokenLimit = input.llmMonthlyTokenLimit !== void 0 ? input.llmMonthlyTokenLimit : existing.llmMonthlyTokenLimit;
@@ -825,6 +845,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       role,
       collectionAccess,
       environmentAccess,
+      snippetAccess,
       llmAccess,
       llmModels,
       llmMonthlyTokenLimit,
@@ -879,7 +900,8 @@ var FirestoreDatabase = class _FirestoreDatabase {
           name: BOOTSTRAP_USER_NAME,
           role: "user",
           collectionAccess: ["*"],
-          environmentAccess: ["*"]
+          environmentAccess: ["*"],
+          snippetAccess: ["*"]
         },
         systemUserId
       );
@@ -893,6 +915,37 @@ var FirestoreDatabase = class _FirestoreDatabase {
       await batch.commit();
     }
   }
+  /**
+   * Grants wildcard snippet access to user accounts that already have wildcard collection access.
+   */
+  async migrateSnippetAccessBackfill() {
+    const client = this.requireClient();
+    const snapshot = await client.collection(USERS_COLLECTION).where("role", "==", "user").get();
+    if (snapshot.docs.length === 0) {
+      return;
+    }
+    let batch = client.batch();
+    let batchSize = 0;
+    for (const doc of snapshot.docs) {
+      const data = doc.data();
+      if ((data.snippetAccess?.length ?? 0) > 0) {
+        continue;
+      }
+      if (!data.collectionAccess?.includes("*")) {
+        continue;
+      }
+      batch.update(doc.ref, { snippetAccess: ["*"] });
+      batchSize += 1;
+      if (batchSize >= WRITE_BATCH_LIMIT) {
+        await batch.commit();
+        batch = client.batch();
+        batchSize = 0;
+      }
+    }
+    if (batchSize > 0) {
+      await batch.commit();
+    }
+  }
   /**
    * Inserts a new API token document.
    *
@@ -1250,6 +1303,129 @@ var FirestoreDatabase = class _FirestoreDatabase {
       updatedByUserId: actingUserId
     });
   }
+  /**
+   * Lists all snippets ordered by sort order then name.
+   */
+  async listSnippets() {
+    const snapshot = await this.requireClient().collection(SNIPPETS_COLLECTION).get();
+    return snapshot.docs.map((doc) => mapFirestoreSnippet(doc.id, doc.data())).sort((left, right) => {
+      if (left.sortOrder !== right.sortOrder) {
+        return left.sortOrder - right.sortOrder;
+      }
+      return left.name.localeCompare(right.name);
+    });
+  }
+  /**
+   * Creates a new snippet with the given fields.
+   *
+   * @param name - Display name for the snippet.
+   * @param code - JavaScript source for the snippet.
+   * @param scope - Execution scope for the snippet.
+   * @param actingUserId - User performing the create action.
+   */
+  async createSnippet(name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const id = randomUUID2();
+    const now = /* @__PURE__ */ new Date();
+    const existing = await this.listSnippets();
+    const maxOrder = existing.reduce((max, snippet) => Math.max(max, snippet.sortOrder), -1);
+    const data = {
+      name: trimmedName,
+      code,
+      scope,
+      sortOrder: maxOrder + 1,
+      createdAt: now,
+      updatedAt: now,
+      createdByUserId: actingUserId,
+      updatedByUserId: actingUserId,
+      deletionLocked: false
+    };
+    await this.requireClient().collection(SNIPPETS_COLLECTION).doc(id).set(data);
+    await this.recordAuditEntry(actingUserId, "create", "snippet", id);
+    return mapFirestoreSnippet(id, data);
+  }
+  /**
+   * Updates a snippet's name, code, and scope. Sort order is left unchanged.
+   *
+   * @param actingUserId - User performing the update action.
+   */
+  async updateSnippet(id, name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const updatedAt = /* @__PURE__ */ new Date();
+    const docRef = this.requireClient().collection(SNIPPETS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Snippet not found");
+    }
+    const existing = snapshot.data();
+    const updated = {
+      ...existing,
+      name: trimmedName,
+      code,
+      scope,
+      updatedAt,
+      updatedByUserId: actingUserId
+    };
+    await docRef.update({
+      name: trimmedName,
+      code,
+      scope,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    return mapFirestoreSnippet(id, updated);
+  }
+  /**
+   * Deletes a snippet.
+   *
+   * @param id - Snippet ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteSnippet(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "snippet", id);
+    await this.requireClient().collection(SNIPPETS_COLLECTION).doc(id).delete();
+  }
+  /**
+   * Finds a snippet by stable identifier.
+   *
+   * @param id - Snippet ID to look up.
+   */
+  async findSnippetById(id) {
+    const snapshot = await this.requireClient().collection(SNIPPETS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreSnippet(id, snapshot.data());
+  }
+  /**
+   * Updates whether non-admin users may delete a snippet.
+   *
+   * @param id - Snippet ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the snippet.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setSnippetDeletionLocked(id, deletionLocked, actingUserId) {
+    const docRef = this.requireClient().collection(SNIPPETS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Snippet not found");
+    }
+    const updatedAt = /* @__PURE__ */ new Date();
+    await docRef.update({
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const existing = snapshot.data();
+    return mapFirestoreSnippet(id, {
+      ...existing,
+      deletionLocked,
+      updatedAt,
+      updatedByUserId: actingUserId
+    });
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -1716,6 +1892,7 @@ var FirestoreDatabase = class _FirestoreDatabase {
       role: input.role,
       collectionAccess: input.collectionAccess,
       environmentAccess: input.environmentAccess,
+      snippetAccess: input.snippetAccess,
       llmAccess: false,
       llmModels: [],
       llmMonthlyTokenLimit: null,
@@ -1799,7 +1976,7 @@ function parseAuditAction(value) {
   throw new Error(`Invalid audit action: ${value}`);
 }
 function parseAuditEntityType2(value) {
-  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "folder" || value === "request") {
+  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -1876,6 +2053,26 @@ function mapEnvironmentSqlRow(row) {
     deletionLocked: Boolean(row.deletion_locked)
   };
 }
+function parseSnippetScope(value) {
+  if (value === "pre-request" || value === "post-request" || value === "any") {
+    return value;
+  }
+  throw new Error(`Invalid snippet scope: ${value}`);
+}
+function mapSnippetSqlRow(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    code: row.code,
+    scope: parseSnippetScope(row.scope),
+    sortOrder: row.sort_order,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at ?? row.created_at,
+    createdByUserId: row.created_by_user_id ?? null,
+    updatedByUserId: row.updated_by_user_id ?? null,
+    deletionLocked: Boolean(row.deletion_locked)
+  };
+}
 function mapFolderSqlRow(row) {
   return {
     id: row.id,
@@ -1960,6 +2157,22 @@ CREATE TABLE IF NOT EXISTS environments (
   FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
 )
 `.trim();
+var SNIPPETS_MIGRATION_SQL = `
+CREATE TABLE IF NOT EXISTS snippets (
+  id VARCHAR(36) PRIMARY KEY,
+  name VARCHAR(255) NOT NULL,
+  code LONGTEXT NOT NULL,
+  scope VARCHAR(32) NOT NULL DEFAULT 'any',
+  sort_order INT NOT NULL DEFAULT 0,
+  created_at DATETIME NOT NULL,
+  updated_at DATETIME NOT NULL,
+  created_by_user_id VARCHAR(36) NULL,
+  updated_by_user_id VARCHAR(36) NULL,
+  deletion_locked TINYINT(1) NOT NULL DEFAULT 0,
+  FOREIGN KEY (created_by_user_id) REFERENCES users(id) ON DELETE SET NULL,
+  FOREIGN KEY (updated_by_user_id) REFERENCES users(id) ON DELETE SET NULL
+)
+`.trim();
 var FOLDERS_MIGRATION_SQL = `
 CREATE TABLE IF NOT EXISTS folders (
   id VARCHAR(36) PRIMARY KEY,
@@ -2009,6 +2222,7 @@ CREATE TABLE IF NOT EXISTS users (
   role VARCHAR(16) NOT NULL,
   collection_access LONGTEXT NOT NULL,
   environment_access LONGTEXT NOT NULL,
+  snippet_access LONGTEXT NOT NULL,
   created_at DATETIME NOT NULL,
   updated_at DATETIME NOT NULL,
   created_by_user_id VARCHAR(36) NULL,
@@ -2124,11 +2338,23 @@ var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL = `
 ALTER TABLE environments
   ADD COLUMN IF NOT EXISTS deletion_locked TINYINT(1) NOT NULL DEFAULT 0;
 `.trim();
+var USERS_SNIPPET_ACCESS_MIGRATION_SQL = `
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS snippet_access LONGTEXT NOT NULL DEFAULT '[]';
+`.trim();
+var USERS_SNIPPET_ACCESS_BACKFILL_SQL = `
+UPDATE users
+SET snippet_access = '["*"]'
+WHERE role = 'user'
+  AND snippet_access = '[]'
+  AND collection_access LIKE '%"*"%';
+`.trim();
 var MYSQL_MIGRATIONS = [
   USERS_MIGRATION_SQL,
   API_TOKENS_MIGRATION_SQL,
   COLLECTIONS_MIGRATION_SQL,
   ENVIRONMENTS_MIGRATION_SQL,
+  SNIPPETS_MIGRATION_SQL,
   FOLDERS_MIGRATION_SQL,
   REQUESTS_MIGRATION_SQL,
   AUDIT_LOG_MIGRATION_SQL,
@@ -2146,7 +2372,9 @@ var MYSQL_MIGRATIONS = [
   LLM_USAGE_MIGRATION_SQL,
   LLM_USAGE_LOG_MIGRATION_SQL,
   COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL,
-  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL,
+  USERS_SNIPPET_ACCESS_MIGRATION_SQL,
+  USERS_SNIPPET_ACCESS_BACKFILL_SQL
 ];
 
 // src/db/mysql/schemas.ts
@@ -2190,6 +2418,7 @@ function mapUserSqlRow(row) {
     role: parseUserRole(row.role),
     collectionAccess: parseAccessList(row.collection_access),
     environmentAccess: parseAccessList(row.environment_access),
+    snippetAccess: parseAccessList(row.snippet_access),
     llmAccess: Boolean(row.llm_access),
     llmModels: parseAccessList(row.llm_models),
     llmMonthlyTokenLimit: row.llm_monthly_token_limit,
@@ -2202,9 +2431,10 @@ function mapUserSqlRow(row) {
 function serializeAccessList(access) {
   return JSON.stringify(access);
 }
-var USER_SELECT_COLUMNS = `id, name, role, collection_access, environment_access, llm_access, llm_models, llm_monthly_token_limit, created_at, updated_at, created_by_user_id, updated_by_user_id`;
+var USER_SELECT_COLUMNS = `id, name, role, collection_access, environment_access, snippet_access, llm_access, llm_models, llm_monthly_token_limit, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var COLLECTION_SELECT_COLUMNS = `id, name, variables, headers, auth, pre_request_script, post_request_script, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
 var ENVIRONMENT_SELECT_COLUMNS = `id, name, variables, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
+var SNIPPET_SELECT_COLUMNS = `id, name, code, scope, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id, deletion_locked`;
 var FOLDER_SELECT_COLUMNS = `id, collection_id, name, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var REQUEST_SELECT_COLUMNS = `id, collection_id, folder_id, name, method, url, headers, params, auth, body, body_type, pre_request_script, post_request_script, comment, sort_order, created_at, updated_at, created_by_user_id, updated_by_user_id`;
 var API_TOKEN_SELECT_COLUMNS = `id, user_id, name, token_hash, token_prefix, created_at, last_used_at, revoked_at, created_by_user_id, updated_by_user_id`;
@@ -2247,6 +2477,7 @@ var LLM_USAGE_SELECT_COLUMNS = `id, user_id, period, prompt_tokens, completion_t
 // src/db/mysql/MysqlDatabase.ts
 var COLLECTION_SELECT = `SELECT ${COLLECTION_SELECT_COLUMNS} FROM collections`;
 var ENVIRONMENT_SELECT = `SELECT ${ENVIRONMENT_SELECT_COLUMNS} FROM environments`;
+var SNIPPET_SELECT = `SELECT ${SNIPPET_SELECT_COLUMNS} FROM snippets`;
 var USER_SELECT = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
@@ -2384,6 +2615,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -2391,13 +2623,14 @@ var MysqlDatabase = class _MysqlDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
         trimmedName,
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         input.llmAccess ? 1 : 0,
         serializeAccessList(input.llmModels ?? []),
         input.llmMonthlyTokenLimit ?? null,
@@ -2470,6 +2703,7 @@ var MysqlDatabase = class _MysqlDatabase {
     const role = input.role ?? existing.role;
     const collectionAccess = input.collectionAccess ?? existing.collectionAccess;
     const environmentAccess = input.environmentAccess ?? existing.environmentAccess;
+    const snippetAccess = input.snippetAccess ?? existing.snippetAccess;
     const llmAccess = input.llmAccess ?? existing.llmAccess;
     const llmModels = input.llmModels ?? existing.llmModels;
     const llmMonthlyTokenLimit = input.llmMonthlyTokenLimit !== void 0 ? input.llmMonthlyTokenLimit : existing.llmMonthlyTokenLimit;
@@ -2480,6 +2714,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role = ?,
         collection_access = ?,
         environment_access = ?,
+        snippet_access = ?,
         llm_access = ?,
         llm_models = ?,
         llm_monthly_token_limit = ?,
@@ -2491,6 +2726,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role,
         serializeAccessList(collectionAccess),
         serializeAccessList(environmentAccess),
+        serializeAccessList(snippetAccess),
         llmAccess ? 1 : 0,
         serializeAccessList(llmModels),
         llmMonthlyTokenLimit,
@@ -2552,7 +2788,8 @@ var MysqlDatabase = class _MysqlDatabase {
           name: BOOTSTRAP_USER_NAME,
           role: "user",
           collectionAccess: ["*"],
-          environmentAccess: ["*"]
+          environmentAccess: ["*"],
+          snippetAccess: ["*"]
         },
         systemUserId
       );
@@ -2967,6 +3204,143 @@ var MysqlDatabase = class _MysqlDatabase {
     }
     return mapEnvironmentSqlRow(row);
   }
+  /**
+   * Lists all snippets ordered by sort order then name.
+   */
+  async listSnippets() {
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} ORDER BY sort_order ASC, name ASC`
+    );
+    return rows.map(mapSnippetSqlRow);
+  }
+  /**
+   * Creates a new snippet with the given fields.
+   *
+   * @param name - Display name for the snippet.
+   * @param code - JavaScript source for the snippet.
+   * @param scope - Execution scope for the snippet.
+   * @param actingUserId - User performing the create action.
+   */
+  async createSnippet(name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const id = randomUUID3();
+    const now = /* @__PURE__ */ new Date();
+    const maxRows = await this.queryRows(
+      "SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM snippets"
+    );
+    const maxOrder = maxRows[0]?.max_order ?? -1;
+    await this.executeStatement(
+      `INSERT INTO snippets (
+        id,
+        name,
+        code,
+        scope,
+        sort_order,
+        created_at,
+        updated_at,
+        created_by_user_id,
+        updated_by_user_id,
+        deletion_locked
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [id, trimmedName, code, scope, maxOrder + 1, now, now, actingUserId, actingUserId, 0]
+    );
+    await this.recordAuditEntry(actingUserId, "create", "snippet", id);
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Snippet not found after insert");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Updates a snippet's name, code, and scope. Sort order is left unchanged.
+   *
+   * @param actingUserId - User performing the update action.
+   */
+  async updateSnippet(id, name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE snippets
+      SET name = ?,
+        code = ?,
+        scope = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [trimmedName, code, scope, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Deletes a snippet.
+   *
+   * @param id - Snippet ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteSnippet(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "snippet", id);
+    await this.executeStatement("DELETE FROM snippets WHERE id = ?", [id]);
+  }
+  /**
+   * Finds a snippet by stable identifier.
+   *
+   * @param id - Snippet ID to look up.
+   */
+  async findSnippetById(id) {
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    return row ? mapSnippetSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a snippet.
+   *
+   * @param id - Snippet ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the snippet.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setSnippetDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.executeStatement(
+      `UPDATE snippets
+      SET deletion_locked = ?,
+        updated_at = ?,
+        updated_by_user_id = ?
+      WHERE id = ?`,
+      [deletionLocked ? 1 : 0, updatedAt, actingUserId, id]
+    );
+    if ((result.affectedRows ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const rows = await this.queryRows(
+      `${SNIPPET_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
   /**
    * Lists all saved requests in a collection.
    *
@@ -3529,6 +3903,7 @@ var MysqlDatabase = class _MysqlDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -3536,13 +3911,14 @@ var MysqlDatabase = class _MysqlDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
       [
         id,
         trimmedName,
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         0,
         serializeAccessList([]),
         null,
@@ -3671,6 +4047,20 @@ CREATE TABLE IF NOT EXISTS environments (
   updated_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL
 );
 `.trim();
+var SNIPPETS_MIGRATION_SQL2 = `
+CREATE TABLE IF NOT EXISTS snippets (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  code TEXT NOT NULL DEFAULT '',
+  scope TEXT NOT NULL DEFAULT 'any' CHECK (scope IN ('pre-request', 'post-request', 'any')),
+  sort_order INT NOT NULL DEFAULT 0,
+  created_at TIMESTAMPTZ NOT NULL,
+  updated_at TIMESTAMPTZ NOT NULL,
+  created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+  updated_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
+  deletion_locked BOOLEAN NOT NULL DEFAULT FALSE
+);
+`.trim();
 var FOLDERS_MIGRATION_SQL2 = `
 CREATE TABLE IF NOT EXISTS folders (
   id TEXT PRIMARY KEY,
@@ -3716,6 +4106,7 @@ CREATE TABLE IF NOT EXISTS users (
   role TEXT NOT NULL CHECK (role IN ('admin', 'user')),
   collection_access TEXT NOT NULL DEFAULT '[]',
   environment_access TEXT NOT NULL DEFAULT '[]',
+  snippet_access TEXT NOT NULL DEFAULT '[]',
   created_at TIMESTAMPTZ NOT NULL,
   updated_at TIMESTAMPTZ NOT NULL,
   created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL,
@@ -3827,11 +4218,23 @@ var ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2 = `
 ALTER TABLE environments
   ADD COLUMN IF NOT EXISTS deletion_locked BOOLEAN NOT NULL DEFAULT FALSE;
 `.trim();
+var USERS_SNIPPET_ACCESS_MIGRATION_SQL2 = `
+ALTER TABLE users
+  ADD COLUMN IF NOT EXISTS snippet_access TEXT NOT NULL DEFAULT '[]';
+`.trim();
+var USERS_SNIPPET_ACCESS_BACKFILL_SQL2 = `
+UPDATE users
+SET snippet_access = '["*"]'
+WHERE role = 'user'
+  AND snippet_access = '[]'
+  AND collection_access LIKE '%"*"%';
+`.trim();
 var POSTGRES_MIGRATIONS = [
   USERS_MIGRATION_SQL2,
   API_TOKENS_MIGRATION_SQL2,
   COLLECTIONS_MIGRATION_SQL2,
   ENVIRONMENTS_MIGRATION_SQL2,
+  SNIPPETS_MIGRATION_SQL2,
   FOLDERS_MIGRATION_SQL2,
   REQUESTS_MIGRATION_SQL2,
   AUDIT_LOG_MIGRATION_SQL2,
@@ -3849,7 +4252,9 @@ var POSTGRES_MIGRATIONS = [
   LLM_USAGE_MIGRATION_SQL2,
   LLM_USAGE_LOG_MIGRATION_SQL2,
   COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL2,
-  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2
+  ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2,
+  USERS_SNIPPET_ACCESS_MIGRATION_SQL2,
+  USERS_SNIPPET_ACCESS_BACKFILL_SQL2
 ];
 
 // src/db/postgres/schemas.ts
@@ -3873,6 +4278,7 @@ var postgresConfigSchema = z4.object({
 var { Pool } = pg;
 var COLLECTION_SELECT2 = `SELECT ${COLLECTION_SELECT_COLUMNS} FROM collections`;
 var ENVIRONMENT_SELECT2 = `SELECT ${ENVIRONMENT_SELECT_COLUMNS} FROM environments`;
+var SNIPPET_SELECT2 = `SELECT ${SNIPPET_SELECT_COLUMNS} FROM snippets`;
 var USER_SELECT2 = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT2 = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT2 = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
@@ -4013,6 +4419,7 @@ var PostgresDatabase = class _PostgresDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -4020,7 +4427,7 @@ var PostgresDatabase = class _PostgresDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
       RETURNING ${USER_SELECT_COLUMNS}`,
       [
         id,
@@ -4028,6 +4435,7 @@ var PostgresDatabase = class _PostgresDatabase {
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         input.llmAccess ?? false,
         serializeAccessList(input.llmModels ?? []),
         input.llmMonthlyTokenLimit ?? null,
@@ -4092,6 +4500,7 @@ var PostgresDatabase = class _PostgresDatabase {
     const role = input.role ?? existing.role;
     const collectionAccess = input.collectionAccess ?? existing.collectionAccess;
     const environmentAccess = input.environmentAccess ?? existing.environmentAccess;
+    const snippetAccess = input.snippetAccess ?? existing.snippetAccess;
     const llmAccess = input.llmAccess ?? existing.llmAccess;
     const llmModels = input.llmModels ?? existing.llmModels;
     const llmMonthlyTokenLimit = input.llmMonthlyTokenLimit !== void 0 ? input.llmMonthlyTokenLimit : existing.llmMonthlyTokenLimit;
@@ -4102,17 +4511,19 @@ var PostgresDatabase = class _PostgresDatabase {
         role = $2,
         collection_access = $3,
         environment_access = $4,
-        llm_access = $5,
-        llm_models = $6,
-        llm_monthly_token_limit = $7,
-        updated_at = $8,
-        updated_by_user_id = $9
-      WHERE id = $10`,
+        snippet_access = $5,
+        llm_access = $6,
+        llm_models = $7,
+        llm_monthly_token_limit = $8,
+        updated_at = $9,
+        updated_by_user_id = $10
+      WHERE id = $11`,
       [
         name,
         role,
         serializeAccessList(collectionAccess),
         serializeAccessList(environmentAccess),
+        serializeAccessList(snippetAccess),
         llmAccess,
         serializeAccessList(llmModels),
         llmMonthlyTokenLimit,
@@ -4174,7 +4585,8 @@ var PostgresDatabase = class _PostgresDatabase {
           name: BOOTSTRAP_USER_NAME,
           role: "user",
           collectionAccess: ["*"],
-          environmentAccess: ["*"]
+          environmentAccess: ["*"],
+          snippetAccess: ["*"]
         },
         systemUserId
       );
@@ -4571,39 +4983,163 @@ var PostgresDatabase = class _PostgresDatabase {
     return mapEnvironmentSqlRow(row);
   }
   /**
-   * Lists all saved requests in a collection.
-   *
-   * @param collectionId - Collection to query.
+   * Lists all snippets ordered by sort order then name.
    */
-  async listRequests(collectionId) {
+  async listSnippets() {
     const result = await this.query(
-      `${REQUEST_SELECT2} WHERE collection_id = $1 ORDER BY sort_order ASC, name ASC`,
-      [collectionId]
+      `${SNIPPET_SELECT2} ORDER BY sort_order ASC, name ASC`
     );
-    return result.rows.map(mapRequestSqlRow);
-  }
-  /**
-   * Finds a saved request by id.
-   *
-   * @param id - Request identifier to look up.
-   */
-  async findRequestById(id) {
-    const result = await this.query(`${REQUEST_SELECT2} WHERE id = $1 LIMIT 1`, [id]);
-    const row = result.rows[0];
-    return row ? mapRequestSqlRow(row) : null;
+    return result.rows.map(mapSnippetSqlRow);
   }
   /**
-   * Inserts a new request or updates an existing one.
+   * Creates a new snippet with the given fields.
    *
-   * @param input - Request fields to persist.
-   * @param actingUserId - User performing the save action.
+   * @param name - Display name for the snippet.
+   * @param code - JavaScript source for the snippet.
+   * @param scope - Execution scope for the snippet.
+   * @param actingUserId - User performing the create action.
    */
-  async saveRequest(input, actingUserId) {
-    const trimmedName = trimRequiredName(input.name, "Request name");
-    const headers = JSON.stringify(input.headers);
-    const params = JSON.stringify(input.params);
-    const auth = JSON.stringify(input.auth);
-    const folderId = input.folderId ?? null;
+  async createSnippet(name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const id = randomUUID4();
+    const now = /* @__PURE__ */ new Date();
+    const maxResult = await this.query(
+      "SELECT COALESCE(MAX(sort_order), -1) AS max_order FROM snippets"
+    );
+    const maxOrder = maxResult.rows[0]?.max_order ?? -1;
+    const result = await this.query(
+      `INSERT INTO snippets (
+        id,
+        name,
+        code,
+        scope,
+        sort_order,
+        created_at,
+        updated_at,
+        created_by_user_id,
+        updated_by_user_id
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+      RETURNING ${SNIPPET_SELECT_COLUMNS}`,
+      [id, trimmedName, code, scope, maxOrder + 1, now, now, actingUserId, actingUserId]
+    );
+    const row = result.rows[0];
+    if (!row) {
+      throw new Error("Snippet not found after insert");
+    }
+    await this.recordAuditEntry(actingUserId, "create", "snippet", id);
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Updates a snippet's name, code, and scope. Sort order is left unchanged.
+   *
+   * @param actingUserId - User performing the update action.
+   */
+  async updateSnippet(id, name, code, scope, actingUserId) {
+    const trimmedName = trimRequiredName(name, "Snippet name");
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE snippets
+      SET name = $1,
+        code = $2,
+        scope = $3,
+        updated_at = $4,
+        updated_by_user_id = $5
+      WHERE id = $6`,
+      [trimmedName, code, scope, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const selectResult = await this.query(`${SNIPPET_SELECT2} WHERE id = $1`, [id]);
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Deletes a snippet.
+   *
+   * @param id - Snippet ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteSnippet(id, actingUserId) {
+    await this.recordAuditEntry(actingUserId, "delete", "snippet", id);
+    await this.query("DELETE FROM snippets WHERE id = $1", [id]);
+  }
+  /**
+   * Finds a snippet by stable identifier.
+   *
+   * @param id - Snippet ID to look up.
+   */
+  async findSnippetById(id) {
+    const result = await this.query(`${SNIPPET_SELECT2} WHERE id = $1`, [id]);
+    const row = result.rows[0];
+    return row ? mapSnippetSqlRow(row) : null;
+  }
+  /**
+   * Updates whether non-admin users may delete a snippet.
+   *
+   * @param id - Snippet ID to update.
+   * @param deletionLocked - When true, user-role tokens cannot delete the snippet.
+   * @param actingUserId - Admin user performing the update.
+   */
+  async setSnippetDeletionLocked(id, deletionLocked, actingUserId) {
+    const updatedAt = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `UPDATE snippets
+      SET deletion_locked = $1,
+        updated_at = $2,
+        updated_by_user_id = $3
+      WHERE id = $4`,
+      [deletionLocked, updatedAt, actingUserId, id]
+    );
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Snippet not found");
+    }
+    await this.recordAuditEntry(actingUserId, "update", "snippet", id);
+    const selectResult = await this.query(`${SNIPPET_SELECT2} WHERE id = $1`, [id]);
+    const row = selectResult.rows[0];
+    if (!row) {
+      throw new Error("Snippet not found");
+    }
+    return mapSnippetSqlRow(row);
+  }
+  /**
+   * Lists all saved requests in a collection.
+   *
+   * @param collectionId - Collection to query.
+   */
+  async listRequests(collectionId) {
+    const result = await this.query(
+      `${REQUEST_SELECT2} WHERE collection_id = $1 ORDER BY sort_order ASC, name ASC`,
+      [collectionId]
+    );
+    return result.rows.map(mapRequestSqlRow);
+  }
+  /**
+   * Finds a saved request by id.
+   *
+   * @param id - Request identifier to look up.
+   */
+  async findRequestById(id) {
+    const result = await this.query(`${REQUEST_SELECT2} WHERE id = $1 LIMIT 1`, [id]);
+    const row = result.rows[0];
+    return row ? mapRequestSqlRow(row) : null;
+  }
+  /**
+   * Inserts a new request or updates an existing one.
+   *
+   * @param input - Request fields to persist.
+   * @param actingUserId - User performing the save action.
+   */
+  async saveRequest(input, actingUserId) {
+    const trimmedName = trimRequiredName(input.name, "Request name");
+    const headers = JSON.stringify(input.headers);
+    const params = JSON.stringify(input.params);
+    const auth = JSON.stringify(input.auth);
+    const folderId = input.folderId ?? null;
     const now = /* @__PURE__ */ new Date();
     if (folderId != null) {
       const folderResult = await this.query(
@@ -5127,6 +5663,7 @@ var PostgresDatabase = class _PostgresDatabase {
         role,
         collection_access,
         environment_access,
+        snippet_access,
         llm_access,
         llm_models,
         llm_monthly_token_limit,
@@ -5134,13 +5671,14 @@ var PostgresDatabase = class _PostgresDatabase {
         updated_at,
         created_by_user_id,
         updated_by_user_id
-      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12)`,
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
       [
         id,
         SYSTEM_USER_NAME,
         input.role,
         serializeAccessList(input.collectionAccess),
         serializeAccessList(input.environmentAccess),
+        serializeAccessList(input.snippetAccess),
         false,
         serializeAccessList([]),
         null,
@@ -5440,21 +5978,26 @@ function normalizeLlmForRole(role, llmAccess, llmModels) {
     llmModels
   };
 }
-function normalizeAccessForRole(role, collectionAccess, environmentAccess) {
+function normalizeAccessForRole(role, collectionAccess, environmentAccess, snippetAccess) {
   if (role === "admin") {
-    if (collectionAccess.length > 0 || environmentAccess.length > 0) {
-      throw new ValidationError("Admin users cannot have collection or environment access.");
+    if (collectionAccess.length > 0 || environmentAccess.length > 0 || snippetAccess.length > 0) {
+      throw new ValidationError(
+        "Admin users cannot have collection, environment, or snippet access."
+      );
     }
     return {
       collectionAccess: [],
-      environmentAccess: []
+      environmentAccess: [],
+      snippetAccess: []
     };
   }
   validateAccessList(collectionAccess);
   validateAccessList(environmentAccess);
+  validateAccessList(snippetAccess);
   return {
     collectionAccess,
-    environmentAccess
+    environmentAccess,
+    snippetAccess
   };
 }
 function findUnknownAccessIds(access, knownIds) {
@@ -5480,6 +6023,9 @@ function validateSubmittedAccessLists(submitted, catalogs) {
         "environment"
       );
     }
+    if (submitted.snippetAccess !== void 0) {
+      validateKnownAccessIds(submitted.snippetAccess, catalogs.knownSnippetIds, "snippet");
+    }
   }
   if (submitted.llmModels !== void 0 && catalogs.knownLlmModelIds !== null) {
     validateKnownAccessIds(submitted.llmModels, catalogs.knownLlmModelIds, "LLM model");
@@ -5493,6 +6039,9 @@ function buildAccessListWarnings(stored, catalogs) {
   for (const id of findUnknownAccessIds(stored.environmentAccess, catalogs.knownEnvironmentIds)) {
     warnings.push(`Unknown environment id "${id}".`);
   }
+  for (const id of findUnknownAccessIds(stored.snippetAccess, catalogs.knownSnippetIds)) {
+    warnings.push(`Unknown snippet id "${id}".`);
+  }
   if (catalogs.knownLlmModelIds !== null) {
     for (const id of findUnknownAccessIds(stored.llmModels, catalogs.knownLlmModelIds)) {
       warnings.push(`Unknown LLM model id "${id}".`);
@@ -5500,10 +6049,11 @@ function buildAccessListWarnings(stored, catalogs) {
   }
   return warnings;
 }
-function buildAccessCatalogIds(collections, environments, llmModelIds) {
+function buildAccessCatalogIds(collections, environments, snippets, llmModelIds) {
   return {
     knownCollectionIds: new Set(collections.map((collection) => collection.id)),
     knownEnvironmentIds: new Set(environments.map((environment) => environment.id)),
+    knownSnippetIds: new Set(snippets.map((snippet) => snippet.id)),
     knownLlmModelIds: llmModelIds === null ? null : new Set(llmModelIds)
   };
 }
@@ -5511,7 +6061,8 @@ function buildAdminUserUpdateInput(existing, body) {
   const role = body.role ?? existing.role;
   const collectionAccess = role === "admin" ? [] : body.collectionAccess ?? existing.collectionAccess;
   const environmentAccess = role === "admin" ? [] : body.environmentAccess ?? existing.environmentAccess;
-  const access = normalizeAccessForRole(role, collectionAccess, environmentAccess);
+  const snippetAccess = role === "admin" ? [] : body.snippetAccess ?? existing.snippetAccess;
+  const access = normalizeAccessForRole(role, collectionAccess, environmentAccess, snippetAccess);
   const llmAccess = role === "admin" ? false : body.llmAccess ?? existing.llmAccess;
   const llmModels = role === "admin" ? [] : body.llmModels ?? existing.llmModels;
   const llm = normalizeLlmForRole(role, llmAccess, llmModels);
@@ -5520,6 +6071,7 @@ function buildAdminUserUpdateInput(existing, body) {
     role: body.role,
     collectionAccess: access.collectionAccess,
     environmentAccess: access.environmentAccess,
+    snippetAccess: access.snippetAccess,
     llmAccess: llm.llmAccess,
     llmModels: llm.llmModels,
     llmMonthlyTokenLimit: body.llmMonthlyTokenLimit
@@ -5528,7 +6080,13 @@ function buildAdminUserUpdateInput(existing, body) {
 function buildAdminUserCreateInput(body) {
   const collectionAccess = body.collectionAccess ?? [];
   const environmentAccess = body.environmentAccess ?? [];
-  const access = normalizeAccessForRole(body.role, collectionAccess, environmentAccess);
+  const snippetAccess = body.snippetAccess ?? [];
+  const access = normalizeAccessForRole(
+    body.role,
+    collectionAccess,
+    environmentAccess,
+    snippetAccess
+  );
   const llmAccess = body.role === "admin" ? false : body.llmAccess ?? false;
   const llmModels = body.role === "admin" ? [] : body.llmModels ?? [];
   const llm = normalizeLlmForRole(body.role, llmAccess, llmModels);
@@ -5537,6 +6095,7 @@ function buildAdminUserCreateInput(body) {
     role: body.role,
     collectionAccess: access.collectionAccess ?? [],
     environmentAccess: access.environmentAccess ?? [],
+    snippetAccess: access.snippetAccess ?? [],
     llmAccess: llm.llmAccess ?? false,
     llmModels: llm.llmModels ?? [],
     llmMonthlyTokenLimit: body.llmMonthlyTokenLimit ?? null
@@ -5635,6 +6194,7 @@ function printUser(user, usage) {
   console.log(`  role: ${user.role}`);
   console.log(`  collection access: ${formatAccessList(user.collectionAccess)}`);
   console.log(`  environment access: ${formatAccessList(user.environmentAccess)}`);
+  console.log(`  snippet access: ${formatAccessList(user.snippetAccess)}`);
   console.log(`  llm access: ${user.llmAccess ? "enabled" : "disabled"}`);
   console.log(`  llm models: ${formatAccessList(user.llmModels)}`);
   console.log(
@@ -5654,13 +6214,15 @@ function printCreatedApiToken(user, record, secret) {
   console.log(secret);
 }
 async function loadAccessCatalogs(db, llm) {
-  const [collections, environments] = await Promise.all([
+  const [collections, environments, snippets] = await Promise.all([
     db.listCollections(),
-    db.listEnvironments()
+    db.listEnvironments(),
+    db.listSnippets()
   ]);
   return buildAccessCatalogIds(
     collections,
     environments,
+    snippets,
     llm ? listHubOfferedModels(llm).map((model) => model.id) : null
   );
 }
@@ -5686,7 +6248,12 @@ async function userCreateCommand(options) {
   const config = loadServerConfig(options.config);
   const db = createDatabase(config.db);
   const access = mapValidationError(
-    () => normalizeAccessForRole(options.role, options.collectionAccess, options.environmentAccess)
+    () => normalizeAccessForRole(
+      options.role,
+      options.collectionAccess,
+      options.environmentAccess,
+      options.snippetAccess
+    )
   );
   await db.connect();
   const actingUserId = await requireSystemUserId(db);
@@ -5700,6 +6267,7 @@ async function userCreateCommand(options) {
       role: options.role,
       collectionAccess: access.collectionAccess,
       environmentAccess: access.environmentAccess,
+      snippetAccess: access.snippetAccess,
       llmModels
     },
     catalogs
@@ -5710,6 +6278,7 @@ async function userCreateCommand(options) {
       role: options.role,
       collectionAccess: access.collectionAccess ?? [],
       environmentAccess: access.environmentAccess ?? [],
+      snippetAccess: access.snippetAccess ?? [],
       llmAccess: llm.llmAccess,
       llmModels: llm.llmModels,
       llmMonthlyTokenLimit: options.llmMonthlyTokens ?? null
@@ -5747,6 +6316,7 @@ async function userListCommand(options) {
         {
           collectionAccess: user.collectionAccess,
           environmentAccess: user.environmentAccess,
+          snippetAccess: user.snippetAccess,
           llmModels: user.llmModels
         },
         catalogs
@@ -5776,6 +6346,7 @@ async function userShowCommand(options) {
       {
         collectionAccess: user.collectionAccess,
         environmentAccess: user.environmentAccess,
+        snippetAccess: user.snippetAccess,
         llmModels: user.llmModels
       },
       catalogs
@@ -5797,8 +6368,9 @@ async function userUpdateCommand(options) {
   const role = options.role ?? existing.role;
   const collectionAccess = options.collectionAccess ?? (options.role === "admin" ? [] : existing.collectionAccess);
   const environmentAccess = options.environmentAccess ?? (options.role === "admin" ? [] : existing.environmentAccess);
+  const snippetAccess = options.snippetAccess ?? (options.role === "admin" ? [] : existing.snippetAccess);
   const access = mapValidationError(
-    () => normalizeAccessForRole(role, collectionAccess, environmentAccess)
+    () => normalizeAccessForRole(role, collectionAccess, environmentAccess, snippetAccess)
   );
   const llmAccess = role === "admin" ? false : options.llmAccess ?? existing.llmAccess;
   const llmModels = role === "admin" ? [] : options.llmModels ?? existing.llmModels;
@@ -5809,6 +6381,7 @@ async function userUpdateCommand(options) {
       role,
       collectionAccess: options.collectionAccess,
       environmentAccess: options.environmentAccess,
+      snippetAccess: options.snippetAccess,
       llmModels: options.llmModels
     },
     catalogs
@@ -5818,6 +6391,7 @@ async function userUpdateCommand(options) {
     role: options.role,
     collectionAccess: access.collectionAccess,
     environmentAccess: access.environmentAccess,
+    snippetAccess: access.snippetAccess,
     llmAccess: llm.llmAccess,
     llmModels: llm.llmModels,
     llmMonthlyTokenLimit: options.llmMonthlyTokens !== void 0 ? options.llmMonthlyTokens : void 0
@@ -5901,6 +6475,11 @@ function registerUserCommand(program, handlers = {}) {
     "Environment id or * (repeatable)",
     parseAccessFlag,
     []
+  ).option(
+    "--snippet-access <id>",
+    "Snippet id or * (repeatable)",
+    parseAccessFlag,
+    []
   ).option("--llm-access", "Enable hub-proxied LLM access for the user").option("--llm-model <id>", "LLM model id or * (repeatable)", parseAccessFlag, []).option("--llm-monthly-tokens <count>", "Monthly LLM token limit", parseMonthlyTokenLimit).action(
     /**
      * Runs the user create subcommand after merging global CLI options.
@@ -5935,6 +6514,11 @@ function registerUserCommand(program, handlers = {}) {
     "Replacement environment id or * (repeatable)",
     parseAccessFlag,
     []
+  ).option(
+    "--snippet-access <id>",
+    "Replacement snippet id or * (repeatable)",
+    parseAccessFlag,
+    []
   ).option("--llm-access", "Enable hub-proxied LLM access for the user").option("--no-llm-access", "Disable hub-proxied LLM access for the user").option(
     "--llm-model <id>",
     "Replacement LLM model id or * (repeatable)",
@@ -5950,6 +6534,7 @@ function registerUserCommand(program, handlers = {}) {
         ...merged,
         collectionAccess: (options.collectionAccess ?? []).length > 0 ? options.collectionAccess : void 0,
         environmentAccess: (options.environmentAccess ?? []).length > 0 ? options.environmentAccess : void 0,
+        snippetAccess: (options.snippetAccess ?? []).length > 0 ? options.snippetAccess : void 0,
         llmModels: (() => {
           const llmModels = readLlmModelsOption(options);
           return llmModels.length > 0 ? llmModels : void 0;
@@ -6067,6 +6652,9 @@ function canListCollections(user) {
 function canListEnvironments(user) {
   return canUseDataApi(user) || canUseManagementApi(user);
 }
+function canListSnippets(user) {
+  return canUseDataApi(user) || canUseManagementApi(user);
+}
 function hasWildcardAccess(access) {
   return access.includes("*");
 }
@@ -6088,6 +6676,15 @@ function canAccessEnvironment(user, environmentId) {
   }
   return user.environmentAccess.includes(environmentId);
 }
+function canAccessSnippet(user, snippetId) {
+  if (user.role === "admin") {
+    return false;
+  }
+  if (hasWildcardAccess(user.snippetAccess)) {
+    return true;
+  }
+  return user.snippetAccess.includes(snippetId);
+}
 function canDeleteCollection(user, collection) {
   return canUseDataApi(user) && canAccessCollection(user, collection.id) && collection.createdByUserId === user.id && !collection.deletionLocked;
 }
@@ -6100,6 +6697,9 @@ function canCreateCollection(user) {
 function canCreateEnvironment(user) {
   return user.role === "user" && hasWildcardAccess(user.environmentAccess);
 }
+function canCreateSnippet(user) {
+  return user.role === "user" && hasWildcardAccess(user.snippetAccess);
+}
 function filterAccessibleCollections(user, collections) {
   if (user.role === "admin" || hasWildcardAccess(user.collectionAccess)) {
     return collections;
@@ -6114,6 +6714,13 @@ function filterAccessibleEnvironments(user, environments) {
   const allowed = new Set(user.environmentAccess);
   return environments.filter((environment) => allowed.has(environment.id));
 }
+function filterAccessibleSnippets(user, snippets) {
+  if (user.role === "admin" || hasWildcardAccess(user.snippetAccess)) {
+    return snippets;
+  }
+  const allowed = new Set(user.snippetAccess);
+  return snippets.filter((snippet) => allowed.has(snippet.id));
+}
 function canUseLlm(user) {
   return user.role !== "admin" && user.llmAccess;
 }
@@ -6258,7 +6865,7 @@ function denyUnlessAllowed(reply, allowed) {
 }
 
 // src/server/routes/schemas/admin.ts
-import { z as z8 } from "zod/v4";
+import { z as z9 } from "zod/v4";
 
 // src/server/routes/schemas/auth.ts
 import { z as z6 } from "zod/v4";
@@ -6325,247 +6932,154 @@ var llmUsageSummaryResponseSchema = z7.object({
   limit: z7.number().int().positive().nullable()
 });
 
-// src/server/routes/schemas/admin.ts
-var adminResourceOptionSchema = z8.object({
+// src/server/routes/schemas/entities.ts
+import { z as z8 } from "zod/v4";
+var collectionRecordSchema = z8.object({
   id: z8.string(),
   name: z8.string(),
+  variables: z8.array(variableSchema),
+  headers: z8.array(keyValueSchema),
+  auth: authConfigSchema,
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable(),
   deletionLocked: z8.boolean()
 });
-var adminEntityConfigSchema = z8.object({
+var environmentRecordSchema = z8.object({
   id: z8.string(),
   name: z8.string(),
+  variables: z8.array(variableSchema),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable(),
   deletionLocked: z8.boolean()
 });
-var updateAdminCollectionBodySchema = z8.object({
-  deletionLocked: z8.boolean()
-});
-var updateAdminEnvironmentBodySchema = z8.object({
-  deletionLocked: z8.boolean()
-});
-var listAdminCollectionsResponseSchema = z8.object({
-  collections: z8.array(adminResourceOptionSchema)
-});
-var listAdminEnvironmentsResponseSchema = z8.object({
-  environments: z8.array(adminResourceOptionSchema)
-});
-var listAdminLlmModelsResponseSchema = listLlmModelsResponseSchema;
-var hubUserRecordSchema = z8.object({
+var snippetScopeSchema = z8.enum(["pre-request", "post-request", "any"]);
+var snippetRecordSchema = z8.object({
   id: z8.string(),
   name: z8.string(),
-  role: userRoleSchema,
-  collectionAccess: z8.array(z8.string()),
-  environmentAccess: z8.array(z8.string()),
-  llmAccess: z8.boolean(),
-  llmModels: z8.array(z8.string()),
-  llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable(),
+  code: z8.string(),
+  scope: snippetScopeSchema,
+  sortOrder: z8.number().int(),
   createdAt: timestampSchema,
-  updatedAt: timestampSchema
-});
-var adminUserListEntrySchema = hubUserRecordSchema.extend({
-  warnings: z8.array(z8.string())
-});
-var listAdminUsersResponseSchema = z8.object({
-  users: z8.array(adminUserListEntrySchema)
-});
-var updateAdminUserBodySchema = z8.object({
-  name: z8.string().trim().min(1).optional(),
-  role: userRoleSchema.optional(),
-  collectionAccess: z8.array(z8.string()).optional(),
-  environmentAccess: z8.array(z8.string()).optional(),
-  llmAccess: z8.boolean().optional(),
-  llmModels: z8.array(z8.string()).optional(),
-  llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable().optional()
-});
-var createAdminUserBodySchema = z8.object({
-  name: z8.string().trim().min(1),
-  role: userRoleSchema,
-  collectionAccess: z8.array(z8.string()).optional(),
-  environmentAccess: z8.array(z8.string()).optional(),
-  llmAccess: z8.boolean().optional(),
-  llmModels: z8.array(z8.string()).optional(),
-  llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable().optional()
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable(),
+  deletionLocked: z8.boolean()
 });
-var hubApiTokenRecordSchema = z8.object({
+var folderRecordSchema = z8.object({
   id: z8.string(),
-  userId: z8.string(),
+  collectionId: z8.string(),
   name: z8.string(),
-  tokenPrefix: z8.string(),
-  createdAt: timestampSchema,
-  lastUsedAt: timestampSchema.nullable(),
-  revokedAt: timestampSchema.nullable()
-});
-var createAdminUserResponseSchema = z8.object({
-  user: hubUserRecordSchema,
-  token: hubApiTokenRecordSchema,
-  secret: z8.string()
-});
-var createAdminTokenBodySchema = z8.object({
-  name: z8.string().trim().min(1)
-});
-var createdApiTokenResponseSchema = z8.object({
-  token: hubApiTokenRecordSchema,
-  secret: z8.string()
-});
-var listAdminTokensResponseSchema = z8.object({
-  tokens: z8.array(hubApiTokenRecordSchema)
-});
-var reloadConfigSectionResultSchema = z8.object({
-  section: z8.enum(["db", "redis", "llm", "plugins", "server"]),
-  status: z8.enum(["reloaded", "unchanged", "failed", "restart-required"]),
-  error: z8.string().optional()
-});
-var reloadConfigResponseSchema = z8.object({
-  sections: z8.array(reloadConfigSectionResultSchema),
-  fatalError: z8.string().optional()
-});
-function serializeHubUser(user) {
-  return {
-    id: user.id,
-    name: user.name,
-    role: user.role,
-    collectionAccess: user.collectionAccess,
-    environmentAccess: user.environmentAccess,
-    llmAccess: user.llmAccess,
-    llmModels: user.llmModels,
-    llmMonthlyTokenLimit: user.llmMonthlyTokenLimit,
-    createdAt: user.createdAt.toISOString(),
-    updatedAt: user.updatedAt.toISOString()
-  };
-}
-function serializeApiToken(token) {
-  return {
-    id: token.id,
-    userId: token.userId,
-    name: token.name,
-    tokenPrefix: token.tokenPrefix,
-    createdAt: token.createdAt.toISOString(),
-    lastUsedAt: token.lastUsedAt ? token.lastUsedAt.toISOString() : null,
-    revokedAt: token.revokedAt ? token.revokedAt.toISOString() : null
-  };
-}
-
-// src/server/routes/schemas/entities.ts
-import { z as z9 } from "zod/v4";
-var collectionRecordSchema = z9.object({
-  id: z9.string(),
-  name: z9.string(),
-  variables: z9.array(variableSchema),
-  headers: z9.array(keyValueSchema),
-  auth: authConfigSchema,
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
-  createdAt: timestampSchema,
-  updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable(),
-  deletionLocked: z9.boolean()
-});
-var environmentRecordSchema = z9.object({
-  id: z9.string(),
-  name: z9.string(),
-  variables: z9.array(variableSchema),
-  createdAt: timestampSchema,
-  updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable(),
-  deletionLocked: z9.boolean()
-});
-var folderRecordSchema = z9.object({
-  id: z9.string(),
-  collectionId: z9.string(),
-  name: z9.string(),
-  sortOrder: z9.number().int(),
+  sortOrder: z8.number().int(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable()
 });
-var savedRequestRecordSchema = z9.object({
-  id: z9.string(),
-  collectionId: z9.string(),
-  name: z9.string(),
+var savedRequestRecordSchema = z8.object({
+  id: z8.string(),
+  collectionId: z8.string(),
+  name: z8.string(),
   method: httpMethodSchema,
-  url: z9.string(),
-  headers: z9.array(keyValueSchema),
-  params: z9.array(keyValueSchema),
+  url: z8.string(),
+  headers: z8.array(keyValueSchema),
+  params: z8.array(keyValueSchema),
   auth: authConfigSchema,
-  body: z9.string(),
+  body: z8.string(),
   bodyType: bodyTypeSchema,
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
-  comment: z9.string(),
-  folderId: z9.string().nullable(),
-  sortOrder: z9.number().int(),
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
+  comment: z8.string(),
+  folderId: z8.string().nullable(),
+  sortOrder: z8.number().int(),
   createdAt: timestampSchema,
   updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable()
 });
-var createCollectionBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var createCollectionBodySchema = z8.object({
+  name: z8.string().trim().min(1)
 });
-var updateCollectionBodySchema = z9.object({
-  name: z9.string().trim().min(1),
-  variables: z9.array(variableSchema),
-  headers: z9.array(keyValueSchema),
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
+var updateCollectionBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  variables: z8.array(variableSchema),
+  headers: z8.array(keyValueSchema),
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
   auth: authConfigSchema
 });
-var createEnvironmentBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var createEnvironmentBodySchema = z8.object({
+  name: z8.string().trim().min(1)
 });
-var updateEnvironmentBodySchema = z9.object({
-  name: z9.string().trim().min(1),
-  variables: z9.array(variableSchema)
+var updateEnvironmentBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  variables: z8.array(variableSchema)
 });
-var createFolderBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var createSnippetBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  code: z8.string().default(""),
+  scope: snippetScopeSchema.default("any")
 });
-var renameFolderBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var updateSnippetBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  code: z8.string(),
+  scope: snippetScopeSchema
 });
-var reorderFoldersBodySchema = z9.object({
-  orderedFolderIds: z9.array(z9.string().trim().min(1))
+var createFolderBodySchema = z8.object({
+  name: z8.string().trim().min(1)
 });
-var saveRequestBodySchema = z9.object({
-  name: z9.string().trim().min(1),
+var renameFolderBodySchema = z8.object({
+  name: z8.string().trim().min(1)
+});
+var reorderFoldersBodySchema = z8.object({
+  orderedFolderIds: z8.array(z8.string().trim().min(1))
+});
+var saveRequestBodySchema = z8.object({
+  name: z8.string().trim().min(1),
   method: httpMethodSchema,
-  url: z9.string(),
-  headers: z9.array(keyValueSchema),
-  params: z9.array(keyValueSchema),
+  url: z8.string(),
+  headers: z8.array(keyValueSchema),
+  params: z8.array(keyValueSchema),
   auth: authConfigSchema,
-  body: z9.string(),
+  body: z8.string(),
   bodyType: bodyTypeSchema,
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
-  comment: z9.string(),
-  folderId: z9.string().nullable().optional()
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
+  comment: z8.string(),
+  folderId: z8.string().nullable().optional()
 });
 var updateSaveRequestBodySchema = saveRequestBodySchema.extend({
-  collectionId: z9.string().trim().min(1)
+  collectionId: z8.string().trim().min(1)
 });
-var reorderRequestsBodySchema = z9.object({
-  folderId: z9.string().nullable(),
-  orderedRequestIds: z9.array(z9.string().trim().min(1))
+var reorderRequestsBodySchema = z8.object({
+  folderId: z8.string().nullable(),
+  orderedRequestIds: z8.array(z8.string().trim().min(1))
 });
-var moveRequestBodySchema = z9.object({
-  folderId: z9.string().nullable(),
-  index: z9.number().int().min(0)
+var moveRequestBodySchema = z8.object({
+  folderId: z8.string().nullable(),
+  index: z8.number().int().min(0)
 });
-var listCollectionsResponseSchema = z9.object({
-  collections: z9.array(collectionRecordSchema)
+var listCollectionsResponseSchema = z8.object({
+  collections: z8.array(collectionRecordSchema)
 });
-var listEnvironmentsResponseSchema = z9.object({
-  environments: z9.array(environmentRecordSchema)
+var listEnvironmentsResponseSchema = z8.object({
+  environments: z8.array(environmentRecordSchema)
 });
-var listFoldersResponseSchema = z9.object({
-  folders: z9.array(folderRecordSchema)
+var listSnippetsResponseSchema = z8.object({
+  snippets: z8.array(snippetRecordSchema)
 });
-var listRequestsResponseSchema = z9.object({
-  requests: z9.array(savedRequestRecordSchema)
+var listFoldersResponseSchema = z8.object({
+  folders: z8.array(folderRecordSchema)
 });
-var emptyResponseSchema = z9.null();
+var listRequestsResponseSchema = z8.object({
+  requests: z8.array(savedRequestRecordSchema)
+});
+var emptyResponseSchema = z8.null();
 function serializeCollection(record) {
   return {
     ...record,
@@ -6580,6 +7094,13 @@ function serializeEnvironment(record) {
     updatedAt: record.updatedAt.toISOString()
   };
 }
+function serializeSnippet(record) {
+  return {
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
+  };
+}
 function serializeFolder(record) {
   return {
     ...record,
@@ -6595,18 +7116,167 @@ function serializeSavedRequest(record) {
   };
 }
 
-// src/server/routes/admin.ts
-function sendLlmUnavailable(reply) {
-  return reply.code(503).send({
-    error: "LLM support is not configured on this Team Hub."
-  });
-}
-function denySystemUserTarget(reply, existing, systemUserId) {
-  if (!isSystemUser(existing, systemUserId)) {
-    return false;
+// src/server/routes/schemas/admin.ts
+var adminResourceOptionSchema = z9.object({
+  id: z9.string(),
+  name: z9.string(),
+  deletionLocked: z9.boolean()
+});
+var adminEntityConfigSchema = z9.object({
+  id: z9.string(),
+  name: z9.string(),
+  deletionLocked: z9.boolean()
+});
+var updateAdminCollectionBodySchema = z9.object({
+  deletionLocked: z9.boolean()
+});
+var updateAdminEnvironmentBodySchema = z9.object({
+  deletionLocked: z9.boolean()
+});
+var updateAdminSnippetBodySchema = z9.object({
+  name: z9.string().trim().min(1).optional(),
+  code: z9.string().optional(),
+  scope: snippetScopeSchema.optional(),
+  deletionLocked: z9.boolean().optional()
+}).superRefine((body, ctx) => {
+  const hasContentFields = body.name !== void 0 || body.code !== void 0 || body.scope !== void 0;
+  const hasFullContent = body.name !== void 0 && body.code !== void 0 && body.scope !== void 0;
+  if (hasContentFields && !hasFullContent) {
+    ctx.addIssue({
+      code: "custom",
+      message: "name, code, and scope must be provided together"
+    });
   }
-  void reply.code(403).send(errorResponseSchema.parse({ error: "Forbidden" }));
-  return true;
+  if (!hasContentFields && body.deletionLocked === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Provide snippet content (name, code, scope) and/or deletionLocked"
+    });
+  }
+});
+var createAdminSnippetBodySchema = createSnippetBodySchema;
+var listAdminCollectionsResponseSchema = z9.object({
+  collections: z9.array(adminResourceOptionSchema)
+});
+var listAdminEnvironmentsResponseSchema = z9.object({
+  environments: z9.array(adminResourceOptionSchema)
+});
+var listAdminSnippetsResponseSchema = z9.object({
+  snippets: z9.array(snippetRecordSchema)
+});
+var adminSnippetRecordSchema = snippetRecordSchema;
+var listAdminLlmModelsResponseSchema = listLlmModelsResponseSchema;
+var hubUserRecordSchema = z9.object({
+  id: z9.string(),
+  name: z9.string(),
+  role: userRoleSchema,
+  collectionAccess: z9.array(z9.string()),
+  environmentAccess: z9.array(z9.string()),
+  snippetAccess: z9.array(z9.string()),
+  llmAccess: z9.boolean(),
+  llmModels: z9.array(z9.string()),
+  llmMonthlyTokenLimit: z9.number().int().nonnegative().nullable(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema
+});
+var adminUserListEntrySchema = hubUserRecordSchema.extend({
+  warnings: z9.array(z9.string())
+});
+var listAdminUsersResponseSchema = z9.object({
+  users: z9.array(adminUserListEntrySchema)
+});
+var updateAdminUserBodySchema = z9.object({
+  name: z9.string().trim().min(1).optional(),
+  role: userRoleSchema.optional(),
+  collectionAccess: z9.array(z9.string()).optional(),
+  environmentAccess: z9.array(z9.string()).optional(),
+  snippetAccess: z9.array(z9.string()).optional(),
+  llmAccess: z9.boolean().optional(),
+  llmModels: z9.array(z9.string()).optional(),
+  llmMonthlyTokenLimit: z9.number().int().nonnegative().nullable().optional()
+});
+var createAdminUserBodySchema = z9.object({
+  name: z9.string().trim().min(1),
+  role: userRoleSchema,
+  collectionAccess: z9.array(z9.string()).optional(),
+  environmentAccess: z9.array(z9.string()).optional(),
+  snippetAccess: z9.array(z9.string()).optional(),
+  llmAccess: z9.boolean().optional(),
+  llmModels: z9.array(z9.string()).optional(),
+  llmMonthlyTokenLimit: z9.number().int().nonnegative().nullable().optional()
+});
+var hubApiTokenRecordSchema = z9.object({
+  id: z9.string(),
+  userId: z9.string(),
+  name: z9.string(),
+  tokenPrefix: z9.string(),
+  createdAt: timestampSchema,
+  lastUsedAt: timestampSchema.nullable(),
+  revokedAt: timestampSchema.nullable()
+});
+var createAdminUserResponseSchema = z9.object({
+  user: hubUserRecordSchema,
+  token: hubApiTokenRecordSchema,
+  secret: z9.string()
+});
+var createAdminTokenBodySchema = z9.object({
+  name: z9.string().trim().min(1)
+});
+var createdApiTokenResponseSchema = z9.object({
+  token: hubApiTokenRecordSchema,
+  secret: z9.string()
+});
+var listAdminTokensResponseSchema = z9.object({
+  tokens: z9.array(hubApiTokenRecordSchema)
+});
+var reloadConfigSectionResultSchema = z9.object({
+  section: z9.enum(["db", "redis", "llm", "plugins", "server"]),
+  status: z9.enum(["reloaded", "unchanged", "failed", "restart-required"]),
+  error: z9.string().optional()
+});
+var reloadConfigResponseSchema = z9.object({
+  sections: z9.array(reloadConfigSectionResultSchema),
+  fatalError: z9.string().optional()
+});
+function serializeHubUser(user) {
+  return {
+    id: user.id,
+    name: user.name,
+    role: user.role,
+    collectionAccess: user.collectionAccess,
+    environmentAccess: user.environmentAccess,
+    snippetAccess: user.snippetAccess,
+    llmAccess: user.llmAccess,
+    llmModels: user.llmModels,
+    llmMonthlyTokenLimit: user.llmMonthlyTokenLimit,
+    createdAt: user.createdAt.toISOString(),
+    updatedAt: user.updatedAt.toISOString()
+  };
+}
+function serializeApiToken(token) {
+  return {
+    id: token.id,
+    userId: token.userId,
+    name: token.name,
+    tokenPrefix: token.tokenPrefix,
+    createdAt: token.createdAt.toISOString(),
+    lastUsedAt: token.lastUsedAt ? token.lastUsedAt.toISOString() : null,
+    revokedAt: token.revokedAt ? token.revokedAt.toISOString() : null
+  };
+}
+
+// src/server/routes/admin.ts
+function sendLlmUnavailable(reply) {
+  return reply.code(503).send({
+    error: "LLM support is not configured on this Team Hub."
+  });
+}
+function denySystemUserTarget(reply, existing, systemUserId) {
+  if (!isSystemUser(existing, systemUserId)) {
+    return false;
+  }
+  void reply.code(403).send(errorResponseSchema.parse({ error: "Forbidden" }));
+  return true;
 }
 function denySelfUserTarget(reply, targetUserId, actorUserId) {
   if (targetUserId !== actorUserId) {
@@ -6648,14 +7318,16 @@ async function registerAdminRoutes(app, options) {
         }
         const systemUserId = db.getSystemUserId();
         const llm = getLlm();
-        const [users, collections, environments] = await Promise.all([
+        const [users, collections, environments, snippets] = await Promise.all([
           db.listUsers(),
           db.listCollections(),
-          db.listEnvironments()
+          db.listEnvironments(),
+          db.listSnippets()
         ]);
         const catalogs = buildAccessCatalogIds(
           collections,
           environments,
+          snippets,
           llm ? listHubOfferedModels(llm).map((model) => model.id) : null
         );
         return reply.send({
@@ -6665,6 +7337,7 @@ async function registerAdminRoutes(app, options) {
               {
                 collectionAccess: record.collectionAccess,
                 environmentAccess: record.environmentAccess,
+                snippetAccess: record.snippetAccess,
                 llmModels: record.llmModels
               },
               catalogs
@@ -6701,13 +7374,15 @@ async function registerAdminRoutes(app, options) {
         }
         const input = buildAdminUserCreateInput(request.body);
         const llm = getLlm();
-        const [collections, environments] = await Promise.all([
+        const [collections, environments, snippets] = await Promise.all([
           db.listCollections(),
-          db.listEnvironments()
+          db.listEnvironments(),
+          db.listSnippets()
         ]);
         const catalogs = buildAccessCatalogIds(
           collections,
           environments,
+          snippets,
           llm ? listHubOfferedModels(llm).map((model) => model.id) : null
         );
         validateSubmittedAccessLists(
@@ -6715,6 +7390,7 @@ async function registerAdminRoutes(app, options) {
             role: request.body.role,
             collectionAccess: request.body.collectionAccess,
             environmentAccess: request.body.environmentAccess,
+            snippetAccess: request.body.snippetAccess,
             llmModels: request.body.llmModels
           },
           catalogs
@@ -6877,6 +7553,70 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "GET",
+    url: "/admin/snippets",
+    schema: {
+      response: {
+        200: listAdminSnippetsResponseSchema,
+        403: errorResponseSchema
+      }
+    },
+    /**
+     * Lists all snippets for operator user management.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const snippets = await db.listSnippets();
+        return reply.send({
+          snippets: snippets.map((snippet) => serializeSnippet(snippet))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "POST",
+    url: "/admin/snippets",
+    schema: {
+      body: createAdminSnippetBodySchema,
+      response: {
+        201: adminSnippetRecordSchema,
+        403: errorResponseSchema
+      }
+    },
+    /**
+     * Creates a snippet through the management API.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const snippet = await db.createSnippet(
+          request.body.name,
+          request.body.code,
+          request.body.scope,
+          user.id
+        );
+        return reply.code(201).send(serializeSnippet(snippet));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "DELETE",
     url: "/admin/collections/:id",
@@ -6947,6 +7687,84 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a snippet regardless of deletion lock state.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const snippet = await db.findSnippetById(request.params.id);
+        if (!snippet) {
+          void reply.code(404).send({ error: "Snippet not found" });
+          return;
+        }
+        await db.deleteSnippet(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/admin/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateAdminSnippetBodySchema,
+      response: {
+        200: adminSnippetRecordSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates snippet content and/or admin configuration.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const existing = await db.findSnippetById(request.params.id);
+        if (!existing) {
+          void reply.code(404).send({ error: "Snippet not found" });
+          return;
+        }
+        let snippet = existing;
+        const { name, code, scope, deletionLocked } = request.body;
+        if (name !== void 0 && code !== void 0 && scope !== void 0) {
+          snippet = await db.updateSnippet(request.params.id, name, code, scope, user.id);
+        }
+        if (deletionLocked !== void 0) {
+          snippet = await db.setSnippetDeletionLocked(request.params.id, deletionLocked, user.id);
+        }
+        return reply.send(serializeSnippet(snippet));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "PUT",
     url: "/admin/collections/:id",
@@ -7127,13 +7945,15 @@ async function registerAdminRoutes(app, options) {
         const input = buildAdminUserUpdateInput(existing, request.body);
         const role = request.body.role ?? existing.role;
         const llm = getLlm();
-        const [collections, environments] = await Promise.all([
+        const [collections, environments, snippets] = await Promise.all([
           db.listCollections(),
-          db.listEnvironments()
+          db.listEnvironments(),
+          db.listSnippets()
         ]);
         const catalogs = buildAccessCatalogIds(
           collections,
           environments,
+          snippets,
           llm ? listHubOfferedModels(llm).map((model) => model.id) : null
         );
         validateSubmittedAccessLists(
@@ -7141,6 +7961,7 @@ async function registerAdminRoutes(app, options) {
             role,
             collectionAccess: request.body.collectionAccess,
             environmentAccess: request.body.environmentAccess,
+            snippetAccess: request.body.snippetAccess,
             llmModels: request.body.llmModels
           },
           catalogs
@@ -7677,6 +8498,150 @@ async function registerEnvironmentRoutes(app, db) {
   });
 }
 
+// src/server/routes/snippets.ts
+async function registerSnippetRoutes(app, db) {
+  const routes = app.withTypeProvider();
+  routes.route({
+    method: "GET",
+    url: "/snippets",
+    schema: {
+      response: {
+        200: listSnippetsResponseSchema
+      }
+    },
+    /**
+     * Lists all snippets ordered by sort order then name.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canListSnippets(user))) {
+          return;
+        }
+        const snippets = await db.listSnippets();
+        return reply.send({
+          snippets: filterAccessibleSnippets(user, snippets).map(
+            (snippet) => serializeSnippet(snippet)
+          )
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "POST",
+    url: "/snippets",
+    schema: {
+      body: createSnippetBodySchema,
+      response: {
+        200: snippetRecordSchema,
+        400: errorResponseSchema
+      }
+    },
+    /**
+     * Creates a new snippet with the given display name and content.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user) && canCreateSnippet(user))) {
+          return;
+        }
+        const snippet = await db.createSnippet(
+          request.body.name,
+          request.body.code,
+          request.body.scope,
+          user.id
+        );
+        return reply.send(serializeSnippet(snippet));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "PUT",
+    url: "/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      body: updateSnippetBodySchema,
+      response: {
+        200: snippetRecordSchema,
+        400: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Updates a snippet's name, code, and scope. Sort order is preserved.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user) && canAccessSnippet(user, request.params.id))) {
+          return;
+        }
+        const snippet = await db.updateSnippet(
+          request.params.id,
+          request.body.name,
+          request.body.code,
+          request.body.scope,
+          user.id
+        );
+        return reply.send(serializeSnippet(snippet));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "DELETE",
+    url: "/snippets/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a snippet by id.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user) && canAccessSnippet(user, request.params.id))) {
+          return;
+        }
+        const snippet = await db.findSnippetById(request.params.id);
+        if (!snippet) {
+          void reply.code(404).send({ error: "Snippet not found" });
+          return;
+        }
+        if (snippet.deletionLocked) {
+          throw new DeletionLockedError("snippet");
+        }
+        await db.deleteSnippet(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+}
+
 // src/server/routes/folders.ts
 async function registerFolderRoutes(app, db) {
   const routes = app.withTypeProvider();
@@ -8778,6 +9743,7 @@ async function registerProtectedRoutes(app, options) {
   });
   await registerCollectionRoutes(app, options.db);
   await registerEnvironmentRoutes(app, options.db);
+  await registerSnippetRoutes(app, options.db);
   await registerFolderRoutes(app, options.db);
   await registerRequestRoutes(app, options.db);
   await registerLlmRoutes(app, { db: options.db, getLlm: options.getLlm });