@indecisivedev/openplan 0.2.0-alpha.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 t3dotgg
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,120 @@
+# Openplan
+
+Openplan publishes authenticated static HTML drafts for agents and teams. This
+source release includes a TypeScript CLI, a Node.js self-hosted runtime, and a
+complete celld Worker project.
+
+**New authenticated plans are private by default.** Public sharing is an explicit
+owner choice; configure browser identity before expecting private reads. Existing
+policies and historical legacy defaults are retained on upgrade.
+
+Start with [Getting started](./docs/README.md). Agents can use
+[`llms.txt`](./llms.txt) for setup paths, CLI commands, and verification steps.
+
+## Choose a deployment path
+
+The alpha focuses on two deployment paths:
+
+- **[Docker Compose on Linux — recommended first setup](./docs/self-hosted.md):**
+  run the app, SQLite, and SeaweedFS on one machine. The guide includes private
+  configuration generation, image builds, administrator bootstrap, browser
+  sign-in, and commands through the first verified upload and restart.
+- **[Dedicated celld](./docs/celld.md):** install on an existing healthy fleet.
+  The quickstart supports celld 0.5.1 and the legacy 0.3.x/0.4.x paths, with
+  version-specific configuration. This does not provision the fleet itself.
+
+The celld quickstart includes a neutral Wrangler configuration, protected
+variable template, D1 migrations, reload/restart requirements, readiness
+checks, bootstrap authentication, and a first upload. Do not deploy it onto a
+shared fleet that already serves another application.
+
+## Install the CLI
+
+The CLI alpha supports **Linux with Node.js 24.x**. macOS and Windows are not
+supported yet; saved credentials require Linux's `/proc` filesystem. Deployment
+guides below build from source. For an existing service, the planned npm channel
+is `@indecisivedev/openplan@next`; once the public release is published, install it with:
+
+```sh
+npm install --global @indecisivedev/openplan@next
+openplan --version
+openplan endpoint set https://openplan.example
+openplan auth login
+openplan whoami
+```
+
+For a one-off invocation, use `npx --package=@indecisivedev/openplan@next openplan --help`.
+Replace the example origin with your service. These commands describe the release
+channel and do not establish that it is published. Before publication, use the
+source build below. See [Connect the CLI](./docs/connect.md) for verification,
+key enrollment, and the first upload.
+
+The same CLI is also prepared for JSR as `@aarons7/openplan`. Once the alpha is
+published, Linux users with Deno 2.9.6 can run:
+
+```sh
+deno run -A jsr:@aarons7/openplan@0.2.0-alpha.2/cli --help
+```
+
+See the [JSR CLI guide](https://github.com/aaronS7/openplan/blob/main/jsr/README.md) for permissions, setup and runtime
+requirements. The source distribution includes both registry configurations;
+these commands do not establish that either version has been published.
+
+## Build the source CLI
+
+For a first installation, follow your deployment guide above in order; it
+includes the required builds. These are the standalone source build checks:
+
+[Node.js 24.x](https://nodejs.org/en/download) is the supported runtime for this
+alpha. Other Node.js majors are outside the support scope. Confirm
+`node --version` and `npm --version` before continuing.
+
+```sh
+npm ci
+npm run check
+```
+
+Annotation bundles are reproducible from the included client code through
+`npm run generate:annotations`.
+
+## Setup and publishing
+
+- [Connect to an existing service](./docs/connect.md): install or build the CLI, select an
+  endpoint, authenticate, and verify a first upload.
+- [Publish and update](./docs/publishing.md): static HTML sample, byte
+  verification, versions, and sharing.
+- [CLI reference](./docs/cli.md) and [configuration](./docs/configuration.md):
+  exact commands and runtime-specific variables.
+- [OpenID Connect](./docs/oidc.md): configure browser SSO with your identity provider.
+- [Troubleshooting](./docs/troubleshooting.md): recover from a failed step.
+
+## CLI credentials and upgrades
+
+CLI keys are bound to a canonical origin. Login uses masked TTY input;
+noninteractive enrollment uses `auth set --stdin --api-url <origin>`, never a
+positional key. Both verify fresh input and save only the binding. To also change
+the default, run `endpoint set <origin>` separately; the former combined behavior
+is intentionally removed. See [safe enrollment](./docs/cli.md#enroll-a-key-without-changing-the-default).
+
+Environment keys require independently configured `OPENPLAN_API_KEY_ORIGIN`;
+missing/mismatched binding fails without fallback. Default uploads require
+authentication; anonymous upload is explicit. Older global keys remain inactive.
+[Upgrade and re-enroll every client](./docs/troubleshooting.md#upgrade-and-re-enroll-older-clients)
+and retire old writers before resuming jobs. These instructions do not claim a
+live rollout or public release has been qualified or published.
+
+## Help and contributions
+
+See [Contributing](./CONTRIBUTING.md) for installation reports, bug reports,
+and proposed changes. Use [the security policy](./SECURITY.md) to report a
+vulnerability privately.
+
+## Project lineage
+
+Openplan is a fork of Postplan by Theo Browne. New interfaces use the Openplan
+name, while some Postplan identifiers remain as deprecated compatibility
+aliases. The upstream copyright notice is preserved in `LICENSE`.
+
+## License
+
+MIT

package/dist/access-policy.d.ts

@@ -0,0 +1,35 @@
+import type { Request } from "express";
+export type AccessPolicyMode = "private" | "password" | "public";
+export type ResolvedAccessMode = AccessPolicyMode | "authenticated";
+export interface AccessPolicyRecord {
+    id: string;
+    mode: AccessPolicyMode;
+    password_algorithm: string | null;
+    password_iterations: number | null;
+    password_salt: string | null;
+    password_hash: string | null;
+    credential_revision: number;
+}
+export interface AccessPolicyView {
+    mode: ResolvedAccessMode;
+    inherited: boolean;
+    legacy: boolean;
+    passwordSet: boolean;
+    policyId: string | null;
+    credentialRevision: number | null;
+}
+export interface PasswordMaterial {
+    algorithm: "pbkdf2-sha256-v1";
+    iterations: number;
+    salt: string;
+    hash: string;
+}
+export declare function nodeLegacyAccessMode(): ResolvedAccessMode;
+export declare function policyView(policy: AccessPolicyRecord | null, inherited: boolean, legacyMode: ResolvedAccessMode): AccessPolicyView;
+export declare function derivePassword(password: string): PasswordMaterial;
+export declare function verifyPassword(password: string, policy: AccessPolicyRecord): boolean;
+export declare function createUnlockToken(policy: AccessPolicyRecord, draftId: string, versionId: string): string;
+export declare function hasValidUnlock(req: Request, policy: AccessPolicyRecord, draftId: string, versionId: string, versionNumber?: number): boolean;
+export declare function unlockCookie(token: string, draftId: string, versionNumber?: number): string;
+export declare function unlockCookieName(draftId: string, versionNumber?: number): string;
+export declare function requireShareSecret(): string;

package/dist/access-policy.js

@@ -0,0 +1,107 @@
+import { pbkdf2Sync, randomBytes, timingSafeEqual } from "node:crypto";
+import { config } from "./config.js";
+import { signToken, verifyToken } from "./web-auth.js";
+const UNLOCK_TTL_SECONDS = 12 * 60 * 60;
+export function nodeLegacyAccessMode() {
+    return "public";
+}
+export function policyView(policy, inherited, legacyMode) {
+    return {
+        mode: policy?.mode || legacyMode,
+        inherited,
+        legacy: !policy,
+        passwordSet: policy?.mode === "password" && Boolean(policy.password_hash),
+        policyId: policy?.id || null,
+        credentialRevision: policy?.credential_revision ?? null
+    };
+}
+export function derivePassword(password) {
+    const secret = requireShareSecret();
+    const salt = randomBytes(16).toString("base64url");
+    return {
+        algorithm: "pbkdf2-sha256-v1",
+        iterations: config.passwordIterations,
+        salt,
+        hash: passwordHash(password, secret, salt, config.passwordIterations)
+    };
+}
+export function verifyPassword(password, policy) {
+    if (password.length > 512 ||
+        policy.mode !== "password" ||
+        policy.password_algorithm !== "pbkdf2-sha256-v1" ||
+        !policy.password_iterations ||
+        !policy.password_salt ||
+        !policy.password_hash)
+        return false;
+    const actual = Buffer.from(passwordHash(password, requireShareSecret(), policy.password_salt, policy.password_iterations), "utf8");
+    const expected = Buffer.from(policy.password_hash, "utf8");
+    return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+export function createUnlockToken(policy, draftId, versionId) {
+    return signToken({
+        draftId,
+        versionId,
+        policyId: policy.id,
+        credentialRevision: policy.credential_revision
+    }, requireShareSecret(), UNLOCK_TTL_SECONDS);
+}
+export function hasValidUnlock(req, policy, draftId, versionId, versionNumber) {
+    const header = req.get("authorization") || "";
+    const headerMatch = header.match(/^Openplan-Share\s+(.+)$/i);
+    const token = headerMatch?.[1]?.trim() || readCookie(req, unlockCookieName(draftId, versionNumber));
+    const payload = token ? verifyToken(token, requireShareSecret()) : null;
+    return isUnlockPayload(payload) &&
+        payload.draftId === draftId &&
+        payload.versionId === versionId &&
+        payload.policyId === policy.id &&
+        payload.credentialRevision === policy.credential_revision;
+}
+export function unlockCookie(token, draftId, versionNumber) {
+    const attributes = [
+        `${unlockCookieName(draftId, versionNumber)}=${encodeURIComponent(token)}`,
+        "Path=/",
+        "HttpOnly",
+        "SameSite=Lax",
+        `Max-Age=${UNLOCK_TTL_SECONDS}`
+    ];
+    if (process.env.NODE_ENV !== "development")
+        attributes.push("Secure");
+    return attributes.join("; ");
+}
+export function unlockCookieName(draftId, versionNumber) {
+    return `openplan_unlock_${draftId}_${versionNumber === undefined ? "current" : `v${versionNumber}`}`;
+}
+export function requireShareSecret() {
+    if (!config.shareSecret)
+        throw new Error("OPENPLAN_SHARE_SECRET is not configured.");
+    return config.shareSecret;
+}
+function passwordHash(password, secret, salt, iterations) {
+    return pbkdf2Sync(`${password}\0${secret}`, Buffer.from(salt, "base64url"), iterations, 32, "sha256")
+        .toString("base64url");
+}
+function readCookie(req, name) {
+    const header = req.get("cookie") || "";
+    for (const part of header.split(";")) {
+        const separator = part.indexOf("=");
+        if (separator === -1 || part.slice(0, separator).trim() !== name)
+            continue;
+        try {
+            return decodeURIComponent(part.slice(separator + 1).trim());
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function isUnlockPayload(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const payload = value;
+    return typeof payload.draftId === "string" &&
+        typeof payload.versionId === "string" &&
+        typeof payload.policyId === "string" &&
+        typeof payload.credentialRevision === "number";
+}
+//# sourceMappingURL=access-policy.js.map

package/dist/access-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policy.js","sourceRoot":"","sources":["../src/access-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAsCvD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAExC,MAAM,UAAU,oBAAoB;IAClC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAiC,EACjC,SAAkB,EAClB,UAA8B;IAE9B,OAAO;QACL,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,UAAU;QAChC,SAAS;QACT,MAAM,EAAE,CAAC,MAAM;QACf,WAAW,EAAE,MAAM,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;QACzE,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,IAAI;QAC5B,kBAAkB,EAAE,MAAM,EAAE,mBAAmB,IAAI,IAAI;KACxD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO;QACL,SAAS,EAAE,kBAAkB;QAC7B,UAAU,EAAE,MAAM,CAAC,kBAAkB;QACrC,IAAI;QACJ,IAAI,EAAE,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,kBAAkB,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAA0B;IACzE,IACE,QAAQ,CAAC,MAAM,GAAG,GAAG;QACrB,MAAM,CAAC,IAAI,KAAK,UAAU;QAC1B,MAAM,CAAC,kBAAkB,KAAK,kBAAkB;QAChD,CAAC,MAAM,CAAC,mBAAmB;QAC3B,CAAC,MAAM,CAAC,aAAa;QACrB,CAAC,MAAM,CAAC,aAAa;QACrB,OAAO,KAAK,CAAC;IACf,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CACxB,YAAY,CAAC,QAAQ,EAAE,kBAAkB,EAAE,EAAE,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,EAC9F,MAAM,CACP,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,MAA0B,EAC1B,OAAe,EACf,SAAiB;IAEjB,OAAO,SAAS,CACd;QACE,OAAO;QACP,SAAS;QACT,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,kBAAkB,EAAE,MAAM,CAAC,mBAAmB;KAC/C,EACD,kBAAkB,EAAE,EACpB,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,GAAY,EACZ,MAA0B,EAC1B,OAAe,EACf,SAAiB,EACjB,aAAsB;IAEtB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC7D,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,GAAG,EAAE,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;IACpG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,OAAO,eAAe,CAAC,OAAO,CAAC;QAC7B,OAAO,CAAC,OAAO,KAAK,OAAO;QAC3B,OAAO,CAAC,SAAS,KAAK,SAAS;QAC/B,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,EAAE;QAC9B,OAAO,CAAC,kBAAkB,KAAK,MAAM,CAAC,mBAAmB,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,OAAe,EACf,aAAsB;IAEtB,MAAM,UAAU,GAAG;QACjB,GAAG,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC1E,QAAQ;QACR,UAAU;QACV,cAAc;QACd,WAAW,kBAAkB,EAAE;KAChC,CAAC;IACF,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,aAAa;QAAE,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtE,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,aAAsB;IACtE,OAAO,mBAAmB,OAAO,IAAI,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,aAAa,EAAE,EAAE,CAAC;AACvG,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC,WAAW,CAAC;AAC5B,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY,EAAE,UAAkB;IACtF,OAAO,UAAU,CAAC,GAAG,QAAQ,KAAK,MAAM,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,QAAQ,CAAC;SAClG,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,GAAY,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI;YAAE,SAAS;QAC3E,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAG,KAAgC,CAAC;IACjD,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;QACxC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ;QACrC,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACpC,OAAO,OAAO,CAAC,kBAAkB,KAAK,QAAQ,CAAC;AACnD,CAAC"}

package/dist/access-store.d.ts

@@ -0,0 +1,33 @@
+import type { DatabaseClient } from "./database.js";
+import { type AccessPolicyMode, type AccessPolicyRecord, type AccessPolicyView, type ResolvedAccessMode } from "./access-policy.js";
+export interface DraftAccessTarget {
+    draftId: string;
+    ownerAccountId: string;
+    title: string;
+    versionId: string;
+    versionNumber: number;
+    objectKey: string;
+    contentHash: string;
+    inherited: boolean;
+    policy: AccessPolicyRecord | null;
+    mode: ResolvedAccessMode;
+}
+export interface DraftAccessOverview {
+    plan: AccessPolicyView;
+    versions: Map<number, AccessPolicyView>;
+}
+export interface AccessMutationInput {
+    accountId: string;
+    apiKeyId?: string | null;
+    draftId: string;
+    versionNumber?: number;
+    mode?: AccessPolicyMode;
+    password?: string;
+    inherit?: boolean;
+    requestId?: string | null;
+}
+export declare function createDefaultPolicy(client: DatabaseClient, accountId: string, mode: AccessPolicyMode): Promise<string>;
+export declare function findDraftAccessTarget(draftId: string, versionNumber?: number): Promise<DraftAccessTarget | null>;
+export declare function canAccountReadDraft(accountId: string, ownerAccountId: string): Promise<boolean>;
+export declare function getDraftAccessOverview(accountId: string, draftId: string): Promise<DraftAccessOverview | null>;
+export declare function setAccessPolicy(input: AccessMutationInput): Promise<AccessPolicyView | null>;

package/dist/access-store.js

@@ -0,0 +1,212 @@
+import { derivePassword, nodeLegacyAccessMode, policyView } from "./access-policy.js";
+import { newInternalId } from "./ids.js";
+import { newEventId, pool, withTransaction } from "./db.js";
+export async function createDefaultPolicy(client, accountId, mode) {
+    return insertPolicy(client, accountId, mode);
+}
+export async function findDraftAccessTarget(draftId, versionNumber) {
+    const versionClause = versionNumber === undefined
+        ? "v.id = d.current_version_id"
+        : "v.draft_id = d.id AND v.version_number = $2";
+    const values = versionNumber === undefined ? [draftId] : [draftId, versionNumber];
+    const result = await pool.query(`
+      SELECT d.id AS draft_id, d.account_id, d.title,
+             v.id AS version_id, v.version_number, v.object_key, v.content_hash,
+             v.access_policy_id AS version_policy_id,
+             COALESCE(v.access_policy_id, d.default_access_policy_id) AS effective_policy_id,
+             p.id AS policy_id, p.mode, p.password_algorithm,
+             p.password_iterations, p.password_salt, p.password_hash,
+             p.credential_revision
+      FROM drafts d
+      JOIN draft_versions v ON ${versionClause}
+      LEFT JOIN draft_access_policies p
+        ON p.id = COALESCE(v.access_policy_id, d.default_access_policy_id)
+      WHERE d.id = $1
+        AND d.deleted_at IS NULL
+        AND d.disabled_at IS NULL
+        AND v.status = 'ready'
+      LIMIT 1
+    `, values);
+    return mapTarget(result.rows[0]);
+}
+export async function canAccountReadDraft(accountId, ownerAccountId) {
+    if (accountId === ownerAccountId)
+        return true;
+    const result = await pool.query(`
+      SELECT 1 FROM account_access_grants g
+      JOIN api_keys grant_key ON grant_key.id = g.created_by_api_key_id
+        AND grant_key.revoked_at IS NULL AND grant_key.account_id = g.resource_account_id
+      WHERE viewer_account_id = $1 AND resource_account_id = $2
+      LIMIT 1
+    `, [accountId, ownerAccountId]);
+    return Boolean(result.rowCount);
+}
+export async function getDraftAccessOverview(accountId, draftId) {
+    const draft = await pool.query(`SELECT id, default_access_policy_id FROM drafts
+     WHERE id = $1 AND account_id = $2 AND deleted_at IS NULL LIMIT 1`, [draftId, accountId]);
+    const row = draft.rows[0];
+    if (!row)
+        return null;
+    const policies = await pool.query(`
+      SELECT CAST(NULL AS INTEGER) AS version_number, CAST(NULL AS TEXT) AS version_policy_id,
+             d.default_access_policy_id AS effective_policy_id,
+             p.id AS policy_id, p.mode, p.password_algorithm, p.password_iterations,
+             p.password_salt, p.password_hash, p.credential_revision
+      FROM drafts d
+      LEFT JOIN draft_access_policies p ON p.id = d.default_access_policy_id
+      WHERE d.id = $1
+      UNION ALL
+      SELECT v.version_number, v.access_policy_id AS version_policy_id,
+             COALESCE(v.access_policy_id, d.default_access_policy_id) AS effective_policy_id,
+             p.id AS policy_id, p.mode, p.password_algorithm, p.password_iterations,
+             p.password_salt, p.password_hash, p.credential_revision
+      FROM draft_versions v
+      JOIN drafts d ON d.id = v.draft_id
+      LEFT JOIN draft_access_policies p
+        ON p.id = COALESCE(v.access_policy_id, d.default_access_policy_id)
+      WHERE v.draft_id = $1 AND v.status = 'ready'
+    `, [draftId]);
+    const [planRow, ...versionRows] = policies.rows;
+    const planPolicy = policyFromRow(planRow);
+    const legacyMode = nodeLegacyAccessMode();
+    const versions = new Map();
+    for (const version of versionRows) {
+        if (version.version_number === null)
+            continue;
+        versions.set(Number(version.version_number), policyView(policyFromRow(version), version.version_policy_id === null, legacyMode));
+    }
+    return {
+        plan: policyView(planPolicy, false, legacyMode),
+        versions
+    };
+}
+export async function setAccessPolicy(input) {
+    return withTransaction(async (client) => {
+        const draft = await client.query(`SELECT id, account_id, default_access_policy_id FROM drafts
+       WHERE id = $1 AND account_id = $2 AND deleted_at IS NULL LIMIT 1`, [input.draftId, input.accountId]);
+        const owned = draft.rows[0];
+        if (!owned)
+            return null;
+        let versionId = null;
+        let previousPolicyId = owned.default_access_policy_id;
+        if (input.versionNumber !== undefined) {
+            const version = await client.query(`SELECT id, access_policy_id FROM draft_versions
+         WHERE draft_id = $1 AND version_number = $2 LIMIT 1`, [input.draftId, input.versionNumber]);
+            const versionRow = version.rows[0];
+            if (!versionRow)
+                return null;
+            versionId = versionRow.id;
+            previousPolicyId = versionRow.access_policy_id;
+            if (input.inherit) {
+                await client.query("UPDATE draft_versions SET access_policy_id = NULL WHERE id = $1", [versionId]);
+                const view = await currentPlanView(client, input.draftId, true);
+                await recordEvent(client, input, versionId, await modeForPolicy(client, previousPolicyId), view.mode, view.policyId, view.credentialRevision);
+                return view;
+            }
+        }
+        else if (input.inherit) {
+            throw new Error("Plan access cannot inherit.");
+        }
+        if (!input.mode)
+            throw new Error("Access mode is required.");
+        const previousPolicy = previousPolicyId ? await policyById(client, previousPolicyId) : null;
+        const credentialRevision = input.mode === "password" && previousPolicy?.mode === "password"
+            ? previousPolicy.credential_revision + 1
+            : 1;
+        const policyId = await insertPolicy(client, input.accountId, input.mode, input.password, credentialRevision);
+        if (versionId) {
+            await client.query("UPDATE draft_versions SET access_policy_id = $1 WHERE id = $2", [policyId, versionId]);
+        }
+        else {
+            await client.query("UPDATE drafts SET default_access_policy_id = $1, updated_at = now() WHERE id = $2", [policyId, input.draftId]);
+        }
+        const policy = await policyById(client, policyId);
+        const view = policyView(policy, false, nodeLegacyAccessMode());
+        await recordEvent(client, input, versionId, await modeForPolicy(client, previousPolicyId), view.mode, policyId, policy?.credential_revision ?? null);
+        return view;
+    });
+}
+async function insertPolicy(client, accountId, mode, password, credentialRevision = 1) {
+    if (mode === "password" && (!password || password.length < 8 || password.length > 512)) {
+        throw new Error("Password must be between 8 and 512 characters.");
+    }
+    const material = mode === "password" ? derivePassword(password) : null;
+    const id = newInternalId();
+    await client.query(`
+      INSERT INTO draft_access_policies (
+        id, mode, password_algorithm, password_iterations, password_salt,
+        password_hash, credential_revision, created_by_account_id
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+    `, [
+        id,
+        mode,
+        material?.algorithm || null,
+        material?.iterations || null,
+        material?.salt || null,
+        material?.hash || null,
+        credentialRevision,
+        accountId
+    ]);
+    return id;
+}
+async function currentPlanView(client, draftId, inherited) {
+    const result = await client.query(`SELECT d.default_access_policy_id AS effective_policy_id, p.id AS policy_id, p.*
+     FROM drafts d LEFT JOIN draft_access_policies p ON p.id = d.default_access_policy_id WHERE d.id = $1`, [draftId]);
+    return policyView(policyFromRow(result.rows[0]), inherited, nodeLegacyAccessMode());
+}
+async function policyById(client, policyId) {
+    const result = await client.query("SELECT * FROM draft_access_policies WHERE id = $1 LIMIT 1", [policyId]);
+    return policyFromRow(result.rows[0]);
+}
+async function modeForPolicy(client, policyId) {
+    if (!policyId)
+        return null;
+    const result = await client.query("SELECT mode FROM draft_access_policies WHERE id = $1", [policyId]);
+    return result.rows[0]?.mode || null;
+}
+async function recordEvent(client, input, versionId, previousMode, newMode, policyId, credentialRevision) {
+    await client.query(`INSERT INTO access_policy_events (
+       id, draft_id, draft_version_id, actor_account_id, actor_api_key_id,
+       previous_mode, new_mode, policy_id, credential_revision, request_id
+     ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`, [newEventId(), input.draftId, versionId, input.accountId, input.apiKeyId || null,
+        previousMode, newMode, policyId, credentialRevision, input.requestId || null]);
+}
+function mapTarget(row) {
+    if (!row)
+        return null;
+    const policy = policyFromRow(row);
+    return {
+        draftId: row.draft_id,
+        ownerAccountId: row.account_id,
+        title: row.title,
+        versionId: row.version_id,
+        versionNumber: Number(row.version_number),
+        objectKey: row.object_key,
+        contentHash: row.content_hash,
+        inherited: row.version_policy_id === null,
+        policy,
+        mode: policy?.mode || nodeLegacyAccessMode()
+    };
+}
+function policyFromRow(row) {
+    // Only an absent pointer is legacy. A broken explicit policy is not public.
+    if (typeof row?.effective_policy_id === "string" && (typeof row.policy_id !== "string" ||
+        (row.mode !== "private" && row.mode !== "password" && row.mode !== "public")))
+        throw new Error("Draft access policy is unavailable.");
+    if (!row || typeof row.policy_id !== "string" && typeof row.id !== "string")
+        return null;
+    const id = typeof row.policy_id === "string" ? row.policy_id : String(row.id);
+    if (row.mode !== "private" && row.mode !== "password" && row.mode !== "public")
+        return null;
+    return {
+        id,
+        mode: row.mode,
+        password_algorithm: typeof row.password_algorithm === "string" ? row.password_algorithm : null,
+        password_iterations: row.password_iterations === null || row.password_iterations === undefined
+            ? null : Number(row.password_iterations),
+        password_salt: typeof row.password_salt === "string" ? row.password_salt : null,
+        password_hash: typeof row.password_hash === "string" ? row.password_hash : null,
+        credential_revision: Number(row.credential_revision || 1)
+    };
+}
+//# sourceMappingURL=access-store.js.map

package/dist/access-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-store.js","sourceRoot":"","sources":["../src/access-store.ts"],"names":[],"mappings":"AACA,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,UAAU,EAKX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAuD5D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAsB,EACtB,SAAiB,EACjB,IAAsB;IAEtB,OAAO,YAAY,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAe,EACf,aAAsB;IAEtB,MAAM,aAAa,GAAG,aAAa,KAAK,SAAS;QAC/C,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,6CAA6C,CAAC;IAClD,MAAM,MAAM,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;;;;iCAS6B,aAAa;;;;;;;;KAQzC,EACD,MAAM,CACP,CAAC;IACF,OAAO,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,cAAsB;IACjF,IAAI,SAAS,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B;;;;;;KAMC,EACD,CAAC,SAAS,EAAE,cAAc,CAAC,CAC5B,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,SAAiB,EACjB,OAAe;IAEf,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAC5B;sEACkE,EAClE,CAAC,OAAO,EAAE,SAAS,CAAC,CACrB,CAAC;IACF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAW/B;;;;;;;;;;;;;;;;;;KAkBC,EACD,CAAC,OAAO,CAAC,CACV,CAAC;IACF,MAAM,CAAC,OAAO,EAAE,GAAG,WAAW,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA4B,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,cAAc,KAAK,IAAI;YAAE,SAAS;QAC9C,QAAQ,CAAC,GAAG,CACV,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAC9B,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,UAAU,CAAC,CACnF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC;QAC/C,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA0B;IAC9D,OAAO,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;QACtC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAC9B;wEACkE,EAClE,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CACjC,CAAC;QACF,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAExB,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,gBAAgB,GAAG,KAAK,CAAC,wBAAwB,CAAC;QACtD,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAChC;6DACqD,EACrD,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,CACrC,CAAC;YACF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7B,SAAS,GAAG,UAAU,CAAC,EAAE,CAAC;YAC1B,gBAAgB,GAAG,UAAU,CAAC,gBAAgB,CAAC;YAC/C,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,MAAM,MAAM,CAAC,KAAK,CAAC,iEAAiE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACnG,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBAChE,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBAC9I,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,MAAM,kBAAkB,GAAG,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,cAAc,EAAE,IAAI,KAAK,UAAU;YACzF,CAAC,CAAC,cAAc,CAAC,mBAAmB,GAAG,CAAC;YACxC,CAAC,CAAC,CAAC,CAAC;QACN,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,MAAM,EACN,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,QAAQ,EACd,kBAAkB,CACnB,CAAC;QACF,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,KAAK,CAAC,+DAA+D,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;QAC7G,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,KAAK,CAAC,mFAAmF,EAAE,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QACrI,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC/D,MAAM,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,gBAAgB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,mBAAmB,IAAI,IAAI,CAAC,CAAC;QACrJ,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,MAAsB,EACtB,SAAiB,EACjB,IAAsB,EACtB,QAAiB,EACjB,kBAAkB,GAAG,CAAC;IAEtB,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QACvF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,QAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxE,MAAM,EAAE,GAAG,aAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,CAAC,KAAK,CAChB;;;;;KAKC,EACD;QACE,EAAE;QACF,IAAI;QACJ,QAAQ,EAAE,SAAS,IAAI,IAAI;QAC3B,QAAQ,EAAE,UAAU,IAAI,IAAI;QAC5B,QAAQ,EAAE,IAAI,IAAI,IAAI;QACtB,QAAQ,EAAE,IAAI,IAAI,IAAI;QACtB,kBAAkB;QAClB,SAAS;KACV,CACF,CAAC;IACF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,MAAsB,EAAE,OAAe,EAAE,SAAkB;IACxF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;0GACsG,EACtG,CAAC,OAAO,CAAC,CACV,CAAC;IACF,OAAO,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,oBAAoB,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,MAAsB,EAAE,QAAgB;IAChE,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,2DAA2D,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3G,OAAO,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAsB,EAAE,QAAuB;IAC1E,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAmB,sDAAsD,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxH,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,MAAsB,EACtB,KAA0B,EAC1B,SAAwB,EACxB,YAA2B,EAC3B,OAAe,EACf,QAAuB,EACvB,kBAAiC;IAEjC,MAAM,MAAM,CAAC,KAAK,CAChB;;;wDAGoD,EACpD,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAC9E,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,CAChF,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAA+B;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,QAAQ;QACrB,cAAc,EAAE,GAAG,CAAC,UAAU;QAC9B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC;QACzC,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,SAAS,EAAE,GAAG,CAAC,iBAAiB,KAAK,IAAI;QACzC,MAAM;QACN,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,oBAAoB,EAAE;KAC7C,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAwC;IAC7D,4EAA4E;IAC5E,IAAI,OAAO,GAAG,EAAE,mBAAmB,KAAK,QAAQ,IAAI,CAClD,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QACjC,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAC7E;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzF,MAAM,EAAE,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC5F,OAAO;QACL,EAAE;QACF,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,kBAAkB,EAAE,OAAO,GAAG,CAAC,kBAAkB,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI;QAC9F,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,KAAK,IAAI,IAAI,GAAG,CAAC,mBAAmB,KAAK,SAAS;YAC5F,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,aAAa,EAAE,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QAC/E,aAAa,EAAE,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI;QAC/E,mBAAmB,EAAE,MAAM,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC"}

package/dist/admin.d.ts

@@ -0,0 +1 @@
+export declare function isAdminAccount(accountId: string | undefined | null): Promise<boolean>;

package/dist/admin.js

@@ -0,0 +1,13 @@
+import { config } from "./config.js";
+import { pool } from "./db.js";
+export async function isAdminAccount(accountId) {
+    if (!accountId)
+        return false;
+    if (config.adminAccountIds.includes(accountId))
+        return true;
+    if (config.runtimeProfile !== "self-hosted")
+        return false;
+    const result = await pool.query("SELECT is_admin FROM accounts WHERE id = $1 LIMIT 1", [accountId]);
+    return Boolean(result.rows[0]?.is_admin);
+}
+//# sourceMappingURL=admin.js.map

package/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE/B,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,SAAoC;IACvE,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,MAAM,CAAC,cAAc,KAAK,aAAa;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAC7B,qDAAqD,EACrD,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/api.d.ts

@@ -0,0 +1,2 @@
+import type { Application } from "express";
+export declare function createApp(): Application;