@hyperfixation/admin 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Graham Lutz
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/budget.d.ts

@@ -0,0 +1,55 @@
+import { type RequireSession } from "@hyperfixation/auth";
+import type { Pool } from "pg";
+/** The audit row's `action`, alongside `app.pause` and `app.resume`. */
+export declare const BUDGET_SET_OPERATION = "app.budget_set";
+/** One line per change; the next gate's refusal will be asked about. */
+export declare const BUDGET_SET_MARKER = "hf-admin: budget set";
+/** A budget that is not a finite, non-negative number. Refused before any lock is taken. */
+export declare class InvalidBudget extends Error {
+    readonly period: string;
+    readonly budgetUsd: number;
+    constructor(period: string, budgetUsd: number);
+}
+/** No row for that period yet. The first gate of a month creates it; nothing else does. */
+export declare class UnknownBudgetPeriod extends Error {
+    readonly period: string;
+    constructor(period: string);
+}
+export interface SetBudgetOptions {
+    /** The `YYYY-MM` primary key. Only this row is touched. */
+    period: string;
+    budgetUsd: number;
+    /** The admin who did it. Null only for a change driven from outside a session. */
+    actorId?: string | null;
+    reason?: string;
+}
+export interface SetBudgetResult {
+    period: string;
+    /** As stored, so a caller sees what `numeric(12,4)` kept rather than what it asked for. */
+    budgetUsd: string;
+    previousBudgetUsd: string;
+    spentUsd: string;
+}
+/**
+ * Sets one period's ceiling. The next gate reads it: nothing caches the budget, so the change
+ * lands on the next `llm.run` and not on any call already past its gate.
+ *
+ * A budget **below** what the period has already spent is allowed. It is not a correction but
+ * the kill-lever: the next gate compares `spent + reserved + estimate > budget` and refuses
+ * every further call for the period, which is what an admin watching a runaway month wants.
+ * `spent_usd` is never touched — the money is spent either way.
+ *
+ * `hf_app_state.budget_usd` is not touched either: that is only the default copied into each
+ * new period, so editing it here would silently change every month to come.
+ */
+export declare function setBudget(pool: Pool, options: SetBudgetOptions): Promise<SetBudgetResult>;
+export interface SetBudgetActionOptions {
+    pool: Pool;
+    requireSession: RequireSession;
+}
+export type SetBudgetAction = (options: SetBudgetOptions) => Promise<SetBudgetResult>;
+/**
+ * The admin action, guarded like `resetSecondFactor` and taking its actor from the guarded
+ * session rather than from whatever the form said.
+ */
+export declare function createSetBudgetAction(options: SetBudgetActionOptions): SetBudgetAction;

package/dist/budget.js

@@ -0,0 +1,99 @@
+import { ADMIN_ROLE } from "@hyperfixation/auth";
+/** The audit row's `action`, alongside `app.pause` and `app.resume`. */
+export const BUDGET_SET_OPERATION = "app.budget_set";
+/** One line per change; the next gate's refusal will be asked about. */
+export const BUDGET_SET_MARKER = "hf-admin: budget set";
+/**
+ * The same row the gate locks, in the same order — this takes only that one lock, so it cannot
+ * deadlock against a gate holding `hf_run` first.
+ */
+const UPDATE_STATEMENT = "WITH before AS (SELECT period, budget_usd FROM hf_budget_period WHERE period = $1 FOR UPDATE) " +
+    "UPDATE hf_budget_period b SET budget_usd = $2::numeric FROM before " +
+    "WHERE b.period = before.period " +
+    "RETURNING before.budget_usd::text AS previous, b.budget_usd::text AS budget, " +
+    "b.spent_usd::text AS spent";
+const AUDIT_STATEMENT = "INSERT INTO hf_audit (actor_id, action, target_type, target_id, meta) " +
+    `VALUES ($1, '${BUDGET_SET_OPERATION}', 'hf_budget_period', $2, $3::jsonb)`;
+/** A budget that is not a finite, non-negative number. Refused before any lock is taken. */
+export class InvalidBudget extends Error {
+    period;
+    budgetUsd;
+    constructor(period, budgetUsd) {
+        super(`InvalidBudget: ${JSON.stringify(budgetUsd)} is not a budget for ${period}; ` +
+            "it must be a finite, non-negative number of dollars");
+        this.name = "InvalidBudget";
+        this.period = period;
+        this.budgetUsd = budgetUsd;
+    }
+}
+/** No row for that period yet. The first gate of a month creates it; nothing else does. */
+export class UnknownBudgetPeriod extends Error {
+    period;
+    constructor(period) {
+        super(`UnknownBudgetPeriod: hf_budget_period has no row for ${period}; the first gate of a ` +
+            "period creates it from hf_app_state.budget_usd");
+        this.name = "UnknownBudgetPeriod";
+        this.period = period;
+    }
+}
+/**
+ * Sets one period's ceiling. The next gate reads it: nothing caches the budget, so the change
+ * lands on the next `llm.run` and not on any call already past its gate.
+ *
+ * A budget **below** what the period has already spent is allowed. It is not a correction but
+ * the kill-lever: the next gate compares `spent + reserved + estimate > budget` and refuses
+ * every further call for the period, which is what an admin watching a runaway month wants.
+ * `spent_usd` is never touched — the money is spent either way.
+ *
+ * `hf_app_state.budget_usd` is not touched either: that is only the default copied into each
+ * new period, so editing it here would silently change every month to come.
+ */
+export async function setBudget(pool, options) {
+    if (!Number.isFinite(options.budgetUsd) || options.budgetUsd < 0) {
+        throw new InvalidBudget(options.period, options.budgetUsd);
+    }
+    const client = await pool.connect();
+    try {
+        await client.query("BEGIN");
+        const updated = await client.query(UPDATE_STATEMENT, [options.period, options.budgetUsd]);
+        const row = updated.rows[0];
+        if (row === undefined)
+            throw new UnknownBudgetPeriod(options.period);
+        await client.query(AUDIT_STATEMENT, [
+            options.actorId ?? null,
+            options.period,
+            JSON.stringify({
+                previousBudgetUsd: row.previous,
+                budgetUsd: row.budget,
+                spentUsd: row.spent,
+                reason: options.reason ?? null,
+            }),
+        ]);
+        await client.query("COMMIT");
+        const result = {
+            period: options.period,
+            budgetUsd: row.budget,
+            previousBudgetUsd: row.previous,
+            spentUsd: row.spent,
+        };
+        console.info(BUDGET_SET_MARKER, JSON.stringify(result));
+        return result;
+    }
+    catch (error) {
+        await client.query("ROLLBACK");
+        throw error;
+    }
+    finally {
+        client.release();
+    }
+}
+/**
+ * The admin action, guarded like `resetSecondFactor` and taking its actor from the guarded
+ * session rather than from whatever the form said.
+ */
+export function createSetBudgetAction(options) {
+    return async (set) => {
+        const session = await options.requireSession({ factor: "passkey", role: ADMIN_ROLE });
+        return setBudget(options.pool, { ...set, actorId: session.user.id });
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { resourceFromTable, UnknownAdminField, type AdminActionDescriptor, type AdminField, type AdminFieldKind, type AdminResource, type ResourceFromTableOptions, } from "./resource.js";
+export { usersResource, ADMIN_USERS_RESOURCE, RESET_SECOND_FACTOR_ACTION, } from "./users.js";
+export { approvalsResource, budgetPeriodsResource, runsResource, ADMIN_APPROVALS_RESOURCE, ADMIN_BUDGET_PERIODS_RESOURCE, ADMIN_RUNS_RESOURCE, SET_BUDGET_ACTION, } from "./machinery.js";
+export { createSetBudgetAction, setBudget, InvalidBudget, UnknownBudgetPeriod, BUDGET_SET_MARKER, BUDGET_SET_OPERATION, type SetBudgetAction, type SetBudgetActionOptions, type SetBudgetOptions, type SetBudgetResult, } from "./budget.js";
+export { createAdminRouter, ADMIN_BASE_PATH, type AdminActions, type AdminRoute, type AdminRouter, type AdminRouterOptions, } from "./router.js";

package/dist/index.js

@@ -0,0 +1,5 @@
+export { resourceFromTable, UnknownAdminField, } from "./resource.js";
+export { usersResource, ADMIN_USERS_RESOURCE, RESET_SECOND_FACTOR_ACTION, } from "./users.js";
+export { approvalsResource, budgetPeriodsResource, runsResource, ADMIN_APPROVALS_RESOURCE, ADMIN_BUDGET_PERIODS_RESOURCE, ADMIN_RUNS_RESOURCE, SET_BUDGET_ACTION, } from "./machinery.js";
+export { createSetBudgetAction, setBudget, InvalidBudget, UnknownBudgetPeriod, BUDGET_SET_MARKER, BUDGET_SET_OPERATION, } from "./budget.js";
+export { createAdminRouter, ADMIN_BASE_PATH, } from "./router.js";

package/dist/machinery.d.ts

@@ -0,0 +1,18 @@
+import { type AdminResource } from "./resource.js";
+export declare const ADMIN_APPROVALS_RESOURCE = "approvals";
+export declare const ADMIN_RUNS_RESOURCE = "runs";
+export declare const ADMIN_BUDGET_PERIODS_RESOURCE = "budget-periods";
+/** The action's name on the resource; `AdminRouter.actions.setBudget` runs it. */
+export declare const SET_BUDGET_ACTION = "set-budget";
+/**
+ * Read-only: a decision is the workflow's to make through `decide()`, which fences it against
+ * the run. An admin who could edit `hf_approval` directly would be deciding behind the fence.
+ */
+export declare const approvalsResource: AdminResource;
+/** Read-only for the same reason: `current_workflow_id` is the fencing token, not a field. */
+export declare const runsResource: AdminResource;
+/**
+ * The one machinery table an admin may write, and only `budget_usd` through the action.
+ * `spent_usd` is the ledger's own running total — editing it would make the gate lie.
+ */
+export declare const budgetPeriodsResource: AdminResource;

package/dist/machinery.js

@@ -0,0 +1,29 @@
+import { hfApproval, hfBudgetPeriod, hfRun } from "@hyperfixation/db";
+import { resourceFromTable } from "./resource.js";
+export const ADMIN_APPROVALS_RESOURCE = "approvals";
+export const ADMIN_RUNS_RESOURCE = "runs";
+export const ADMIN_BUDGET_PERIODS_RESOURCE = "budget-periods";
+/** The action's name on the resource; `AdminRouter.actions.setBudget` runs it. */
+export const SET_BUDGET_ACTION = "set-budget";
+/**
+ * Read-only: a decision is the workflow's to make through `decide()`, which fences it against
+ * the run. An admin who could edit `hf_approval` directly would be deciding behind the fence.
+ */
+export const approvalsResource = resourceFromTable(hfApproval, {
+    name: ADMIN_APPROVALS_RESOURCE,
+    list: ["id", "type", "status", "recordType", "recordId", "assigneeId", "createdAt"],
+});
+/** Read-only for the same reason: `current_workflow_id` is the fencing token, not a field. */
+export const runsResource = resourceFromTable(hfRun, {
+    name: ADMIN_RUNS_RESOURCE,
+    list: ["runId", "flow", "status", "attempt", "recordType", "recordId", "startedAt"],
+});
+/**
+ * The one machinery table an admin may write, and only `budget_usd` through the action.
+ * `spent_usd` is the ledger's own running total — editing it would make the gate lie.
+ */
+export const budgetPeriodsResource = resourceFromTable(hfBudgetPeriod, {
+    name: ADMIN_BUDGET_PERIODS_RESOURCE,
+    list: ["period", "budgetUsd", "spentUsd"],
+    actions: [{ name: SET_BUDGET_ACTION, label: "Set budget", scope: "row" }],
+});

package/dist/resource.d.ts

@@ -0,0 +1,62 @@
+import { type Table } from "drizzle-orm";
+/**
+ * What a UI renders a value as. Deliberately coarse: an admin list shows text, a number, a
+ * checkbox, a timestamp, or an opaque blob, and nothing here needs to know that a column is
+ * `varchar(64)` rather than `text`.
+ */
+export type AdminFieldKind = "string" | "number" | "boolean" | "date" | "json";
+export interface AdminField {
+    /** The Drizzle property name. What a caller names a field by. */
+    name: string;
+    /** The SQL column, off the metadata, so nothing downstream re-derives the snake_case form. */
+    column: string;
+    label: string;
+    kind: AdminFieldKind;
+    nullable: boolean;
+    hasDefault: boolean;
+    primaryKey: boolean;
+    unique: boolean;
+}
+export interface AdminActionDescriptor {
+    name: string;
+    label: string;
+    /** Phase 1 has one shape: an action against one row. */
+    scope: "row";
+}
+export interface AdminResource {
+    name: string;
+    /** The SQL table this resource is over. */
+    table: string;
+    primaryKey: readonly string[];
+    fields: readonly AdminField[];
+    /** Field names, in order, for the list view. A subset of `fields`. */
+    list: readonly string[];
+    /** Field names for one row. Every field unless the caller narrows it. */
+    view: readonly string[];
+    actions: readonly AdminActionDescriptor[];
+}
+/**
+ * Thrown at construction, not at render: `list` and `view` are the one hand-written part of a
+ * resource and therefore the one part a column rename can rot.
+ */
+export declare class UnknownAdminField extends Error {
+    readonly resource: string;
+    readonly field: string;
+    readonly known: readonly string[];
+    constructor(resource: string, field: string, known: readonly string[]);
+}
+export interface ResourceFromTableOptions {
+    name: string;
+    list: readonly string[];
+    /** Defaults to every field the table has. */
+    view?: readonly string[];
+    actions?: readonly AdminActionDescriptor[];
+}
+/**
+ * A resource read off the Drizzle table rather than hand-typed beside it, so the fields, their
+ * SQL columns, their nullability, defaults, primary key and uniqueness are whatever the schema
+ * currently declares. What stays declared is editorial: the resource's name, which fields the
+ * list shows and in what order, and which actions it offers — none of which the metadata knows.
+ * Those declarations are checked against the metadata here.
+ */
+export declare function resourceFromTable(table: Table, options: ResourceFromTableOptions): AdminResource;

package/dist/resource.js

@@ -0,0 +1,75 @@
+import { getTableColumns, getTableName } from "drizzle-orm";
+/**
+ * Thrown at construction, not at render: `list` and `view` are the one hand-written part of a
+ * resource and therefore the one part a column rename can rot.
+ */
+export class UnknownAdminField extends Error {
+    resource;
+    field;
+    known;
+    constructor(resource, field, known) {
+        super(`UnknownAdminField: the ${resource} resource names ${JSON.stringify(field)}, ` +
+            `which its table does not have; it has ${known.join(", ")}`);
+        this.name = "UnknownAdminField";
+        this.resource = resource;
+        this.field = field;
+        this.known = known;
+    }
+}
+const KINDS = {
+    string: "string",
+    number: "number",
+    bigint: "number",
+    boolean: "boolean",
+    date: "date",
+    json: "json",
+};
+/**
+ * An unmapped Drizzle data type degrades to text rather than refusing the whole resource:
+ * everything Postgres returns can be shown as text, and a column type nobody taught this
+ * function about is not a reason for the admin to stop existing.
+ */
+function kindOf(dataType) {
+    return KINDS[dataType] ?? "string";
+}
+/** `banReason` → "Ban reason". Generated, so a new column arrives already labelled. */
+function labelOf(name) {
+    const words = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase();
+    return words.charAt(0).toUpperCase() + words.slice(1);
+}
+/**
+ * A resource read off the Drizzle table rather than hand-typed beside it, so the fields, their
+ * SQL columns, their nullability, defaults, primary key and uniqueness are whatever the schema
+ * currently declares. What stays declared is editorial: the resource's name, which fields the
+ * list shows and in what order, and which actions it offers — none of which the metadata knows.
+ * Those declarations are checked against the metadata here.
+ */
+export function resourceFromTable(table, options) {
+    const fields = Object.entries(getTableColumns(table)).map(([name, column]) => ({
+        name,
+        column: column.name,
+        label: labelOf(name),
+        kind: kindOf(column.dataType),
+        nullable: !column.notNull,
+        hasDefault: column.hasDefault,
+        primaryKey: column.primary,
+        unique: column.isUnique ?? false,
+    }));
+    const known = fields.map((field) => field.name);
+    const checked = (names) => {
+        for (const name of names) {
+            if (!known.includes(name))
+                throw new UnknownAdminField(options.name, name, known);
+        }
+        return names;
+    };
+    return {
+        name: options.name,
+        table: getTableName(table),
+        primaryKey: fields.filter((field) => field.primaryKey).map((field) => field.name),
+        fields,
+        list: checked(options.list),
+        view: options.view === undefined ? known : checked(options.view),
+        actions: options.actions ?? [],
+    };
+}

package/dist/router.d.ts

@@ -0,0 +1,50 @@
+import { type RequireSession, type ResetSecondFactorAction } from "@hyperfixation/auth";
+import { type Registry } from "@hyperfixation/core";
+import type { Pool } from "pg";
+import { type SetBudgetAction } from "./budget.js";
+import type { AdminResource } from "./resource.js";
+/** Where the template mounts the admin. Only the default; `route()` takes what it is given. */
+export declare const ADMIN_BASE_PATH = "/admin";
+export type AdminRoute = {
+    kind: "index";
+} | {
+    kind: "list";
+    resource: AdminResource;
+} | {
+    kind: "detail";
+    resource: AdminResource;
+    id: string;
+};
+/** The admin's server actions. Each one carries its own guard. */
+export interface AdminActions {
+    resetSecondFactor: ResetSecondFactorAction;
+    setBudget: SetBudgetAction;
+}
+export interface AdminRouterOptions {
+    /** The app's own pool. The admin builds none and runs on the web request path. */
+    pool: Pool;
+    requireSession: RequireSession;
+    /** The app's own resources, beyond the built-in ones. */
+    resources?: readonly AdminResource[];
+}
+export interface AdminRouter {
+    readonly resources: Registry<AdminResource>;
+    readonly actions: AdminActions;
+    /**
+     * The catch-all's body: the segments below the mount point, guarded and resolved. `undefined`
+     * is a path the admin does not serve — the host renders its own not-found for it, the same
+     * one a refusal produces.
+     */
+    route(path?: string | readonly string[]): Promise<AdminRoute | undefined>;
+}
+/**
+ * The admin, as one guarded entry point the app's `(admin)/admin/[[...path]]` route calls.
+ *
+ * The guard runs before the path is resolved, and it runs on every route including the index.
+ * Resolving first would let `/admin/widgets` and `/admin/users` answer a stranger differently,
+ * and the difference between those two answers is a map of the admin area — the thing the 404
+ * exists to withhold. `requireSession({ factor: 'passkey', role: 'admin' })` is stated here
+ * rather than left to the route's own `pathname`, so a host that mounts the admin somewhere
+ * else still gets the admin bar.
+ */
+export declare function createAdminRouter(options: AdminRouterOptions): AdminRouter;

package/dist/router.js

@@ -0,0 +1,69 @@
+import { ADMIN_ROLE, createResetSecondFactorAction, } from "@hyperfixation/auth";
+import { createRegistry } from "@hyperfixation/core";
+import { createSetBudgetAction } from "./budget.js";
+import { approvalsResource, budgetPeriodsResource, runsResource } from "./machinery.js";
+import { usersResource } from "./users.js";
+/** Where the template mounts the admin. Only the default; `route()` takes what it is given. */
+export const ADMIN_BASE_PATH = "/admin";
+/** The framework's own tables. An app registers none of these; they come with the admin. */
+const BUILT_IN_RESOURCES = [
+    usersResource,
+    approvalsResource,
+    runsResource,
+    budgetPeriodsResource,
+];
+function segmentsOf(path) {
+    // A catch-all already hands back the segments below the mount, so an array is taken as-is —
+    // a resource named `admin` stays reachable. Only a whole pathname has the mount on the front.
+    if (typeof path !== "string")
+        return (path ?? []).filter((segment) => segment.length > 0);
+    const segments = path.split("/").filter((segment) => segment.length > 0);
+    return segments[0] === ADMIN_BASE_PATH.slice(1) ? segments.slice(1) : segments;
+}
+/**
+ * The admin, as one guarded entry point the app's `(admin)/admin/[[...path]]` route calls.
+ *
+ * The guard runs before the path is resolved, and it runs on every route including the index.
+ * Resolving first would let `/admin/widgets` and `/admin/users` answer a stranger differently,
+ * and the difference between those two answers is a map of the admin area — the thing the 404
+ * exists to withhold. `requireSession({ factor: 'passkey', role: 'admin' })` is stated here
+ * rather than left to the route's own `pathname`, so a host that mounts the admin somewhere
+ * else still gets the admin bar.
+ */
+export function createAdminRouter(options) {
+    const resources = createRegistry("admin resource");
+    for (const resource of BUILT_IN_RESOURCES)
+        resources.register(resource);
+    for (const resource of options.resources ?? [])
+        resources.register(resource);
+    return {
+        resources,
+        actions: {
+            resetSecondFactor: createResetSecondFactorAction({
+                pool: options.pool,
+                requireSession: options.requireSession,
+            }),
+            setBudget: createSetBudgetAction({
+                pool: options.pool,
+                requireSession: options.requireSession,
+            }),
+        },
+        async route(path) {
+            const segments = segmentsOf(path);
+            await options.requireSession({
+                factor: "passkey",
+                role: ADMIN_ROLE,
+                pathname: [ADMIN_BASE_PATH, ...segments].join("/"),
+            });
+            if (segments.length === 0)
+                return { kind: "index" };
+            if (segments.length > 2)
+                return undefined;
+            const resource = resources.get(segments[0]);
+            if (resource === undefined)
+                return undefined;
+            const id = segments[1];
+            return id === undefined ? { kind: "list", resource } : { kind: "detail", resource, id };
+        },
+    };
+}

package/dist/users.d.ts

@@ -0,0 +1,10 @@
+import { type AdminResource } from "./resource.js";
+export declare const ADMIN_USERS_RESOURCE = "users";
+/** The action's name on the resource; `AdminRouter.actions.resetSecondFactor` runs it. */
+export declare const RESET_SECOND_FACTOR_ACTION = "reset-second-factor";
+/**
+ * Phase 1's one resource. Every field comes off `hf_user`'s Drizzle metadata; the list is the
+ * five columns an admin scans for — who, what they are called, what they may do, whether they
+ * are shut out, and when they arrived.
+ */
+export declare const usersResource: AdminResource;

package/dist/users.js

@@ -0,0 +1,17 @@
+import { hfUser } from "@hyperfixation/db";
+import { resourceFromTable } from "./resource.js";
+export const ADMIN_USERS_RESOURCE = "users";
+/** The action's name on the resource; `AdminRouter.actions.resetSecondFactor` runs it. */
+export const RESET_SECOND_FACTOR_ACTION = "reset-second-factor";
+/**
+ * Phase 1's one resource. Every field comes off `hf_user`'s Drizzle metadata; the list is the
+ * five columns an admin scans for — who, what they are called, what they may do, whether they
+ * are shut out, and when they arrived.
+ */
+export const usersResource = resourceFromTable(hfUser, {
+    name: ADMIN_USERS_RESOURCE,
+    list: ["email", "name", "role", "banned", "createdAt"],
+    actions: [
+        { name: RESET_SECOND_FACTOR_ACTION, label: "Reset second factor", scope: "row" },
+    ],
+});

package/package.json

@@ -0,0 +1,50 @@
+{
+  "name": "@hyperfixation/admin",
+  "version": "0.1.0",
+  "license": "MIT",
+  "description": "Admin router and resource definitions generated from Drizzle metadata",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/grahamlutz/hyperfixation-core.git",
+    "directory": "packages/admin"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "!dist/**/*.test.*",
+    "!dist/test-support/**"
+  ],
+  "devDependencies": {
+    "@hyperfixation/ai": "0.1.0",
+    "@hyperfixation/eslint-config": "0.1.0",
+    "@hyperfixation/testing": "0.1.0",
+    "@microsoft/api-extractor": "^7.59.1",
+    "@types/pg": "^8.23.1",
+    "eslint": "^10.10.0"
+  },
+  "dependencies": {
+    "@hyperfixation/auth": "0.1.0",
+    "@hyperfixation/core": "0.1.0",
+    "@hyperfixation/db": "0.1.0",
+    "drizzle-orm": "^0.45.2",
+    "pg": "^8.23.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "lint": "eslint src",
+    "api-extractor": "api-extractor run",
+    "api-extractor:update": "api-extractor run --local",
+    "test": "vitest run --passWithNoTests"
+  }
+}