@jini-ai/admin 0.1.0

package/dist/core/ports/identity.d.ts

@@ -0,0 +1,114 @@
+/**
+ * @file `AdminIdentityPort` — operator users, roles, and policies.
+ *
+ * The first port extracted, and the pattern-setter for the other eleven. Chosen first because it
+ * is the largest coherent generic group in the corpus (17 of `api.ts`'s 134 methods), it carries
+ * no CMS vocabulary, and the reference implementation is already CRUD-complete.
+ *
+ * ## Two things deliberately NOT in this port
+ *
+ * **Deleting a user.** The reference implementation has no route for it (its admin user routes cover create,
+ * disable, enable, update, reset-password, and grant operations, nothing else), and disable is
+ * the correct primitive for an audited system — a deleted principal orphans its audit trail.
+ * Adding `deleteUser` here would put a method on the contract that the reference implementation
+ * cannot satisfy.
+ *
+ * **An error-code enum.** Codes like `GRANT_EXCEEDS_ISSUER` and `OWNER_REQUIRED` are real and
+ * load-bearing, but their operator-facing *wording* is host-specific — see `transport/errors.ts`
+ * on why a shared code->message table is a regression. Panels read `AdminApiError.code` and map
+ * it themselves.
+ *
+ * ## `members` is a different port
+ *
+ * Operator users (who administer the site) and members (end users who signed up) are distinct
+ * populations with distinct lifecycles — the reference implementation keeps them in separate route groups and so does
+ * this. `AdminMembersPort` is separate.
+ */
+/** An operator principal. */
+export interface AdminIdentityUser {
+    readonly id: string;
+    readonly username: string;
+    readonly email?: string;
+    readonly disabled?: boolean;
+    readonly roleIds?: readonly string[];
+    readonly policyIds?: readonly string[];
+}
+/** A named bundle of policies. */
+export interface AdminRole {
+    readonly id: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly policyIds?: readonly string[];
+}
+/** A named bundle of permission strings. */
+export interface AdminPolicy {
+    readonly id: string;
+    readonly name: string;
+    readonly description?: string;
+    readonly permissions?: readonly string[];
+}
+export interface AdminIdentityPort {
+    listUsers(): Promise<readonly AdminIdentityUser[]>;
+    createUser(input: {
+        username: string;
+        password: string;
+        email?: string;
+    }): Promise<AdminIdentityUser>;
+    updateUser(id: string, patch: {
+        email?: string;
+    }): Promise<AdminIdentityUser>;
+    /** Reversible; the audited alternative to deletion. See the file header. */
+    disableUser(id: string): Promise<AdminIdentityUser>;
+    enableUser(id: string): Promise<AdminIdentityUser>;
+    resetUserPassword(id: string, input: {
+        password: string;
+    }): Promise<{
+        ok: boolean;
+    }>;
+    /**
+     * Grants a role.
+     *
+     * Expect a `GRANT_EXCEEDS_ISSUER`-class rejection when the caller does not themselves hold
+     * everything the role confers — privilege escalation via grant is the obvious attack here, and
+     * the check is server-side. A panel must not pre-filter the role list as if that were the
+     * boundary; it may hide options as an affordance, but the rejection is authoritative.
+     */
+    assignRole(userId: string, roleId: string): Promise<{
+        ok: boolean;
+    }>;
+    attachPolicy(userId: string, policyId: string): Promise<{
+        ok: boolean;
+    }>;
+    listRoles(): Promise<readonly AdminRole[]>;
+    createRole(input: {
+        name: string;
+        description?: string;
+    }): Promise<AdminRole>;
+    updateRole(id: string, patch: {
+        name?: string;
+        description?: string;
+    }): Promise<AdminRole>;
+    /** Expect a conflict rejection when the role is still referenced by a principal. */
+    deleteRole(id: string): Promise<{
+        ok: boolean;
+    }>;
+    listPolicies(): Promise<readonly AdminPolicy[]>;
+    createPolicy(input: {
+        name: string;
+        description?: string;
+    }): Promise<AdminPolicy>;
+    updatePolicy(id: string, patch: {
+        name?: string;
+        description?: string;
+    }): Promise<AdminPolicy>;
+    deletePolicy(id: string): Promise<{
+        ok: boolean;
+    }>;
+    /** Adds or removes a single permission string on a policy. Granular by design: a whole-array
+     *  replace makes two concurrent editors silently clobber each other. */
+    writePolicyPermission(policyId: string, input: {
+        permission: string;
+        granted: boolean;
+    }): Promise<AdminPolicy>;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/core/ports/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../../src/core/ports/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,6BAA6B;AAC7B,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,kCAAkC;AAClC,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED,4CAA4C;AAC5C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,IAAI,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC,CAAC;IACnD,UAAU,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC9E,4EAA4E;IAC5E,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnD,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAErF;;;;;;;OAOG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACrE,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAEzE,SAAS,IAAI,OAAO,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9E,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3F,oFAAoF;IACpF,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAEjD,YAAY,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAChD,YAAY,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/F,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACnD;4EACwE;IACxE,qBAAqB,CACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,GAC9C,OAAO,CAAC,WAAW,CAAC,CAAC;CACzB"}

package/dist/core/ports/identity.js

@@ -0,0 +1,28 @@
+/**
+ * @file `AdminIdentityPort` — operator users, roles, and policies.
+ *
+ * The first port extracted, and the pattern-setter for the other eleven. Chosen first because it
+ * is the largest coherent generic group in the corpus (17 of `api.ts`'s 134 methods), it carries
+ * no CMS vocabulary, and the reference implementation is already CRUD-complete.
+ *
+ * ## Two things deliberately NOT in this port
+ *
+ * **Deleting a user.** The reference implementation has no route for it (its admin user routes cover create,
+ * disable, enable, update, reset-password, and grant operations, nothing else), and disable is
+ * the correct primitive for an audited system — a deleted principal orphans its audit trail.
+ * Adding `deleteUser` here would put a method on the contract that the reference implementation
+ * cannot satisfy.
+ *
+ * **An error-code enum.** Codes like `GRANT_EXCEEDS_ISSUER` and `OWNER_REQUIRED` are real and
+ * load-bearing, but their operator-facing *wording* is host-specific — see `transport/errors.ts`
+ * on why a shared code->message table is a regression. Panels read `AdminApiError.code` and map
+ * it themselves.
+ *
+ * ## `members` is a different port
+ *
+ * Operator users (who administer the site) and members (end users who signed up) are distinct
+ * populations with distinct lifecycles — the reference implementation keeps them in separate route groups and so does
+ * this. `AdminMembersPort` is separate.
+ */
+export {};
+//# sourceMappingURL=identity.js.map

package/dist/core/ports/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../../src/core/ports/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/core/ports/index.d.ts

@@ -0,0 +1,21 @@
+/**
+ * @file Barrel for every `@jini-ai/admin/core` port. See `README.md` in this directory for the one
+ * port that is deliberately absent (`execution`) and why.
+ */
+export type { AdminAuthPort, AdminAuthUser } from './auth.js';
+export type { AdminMember, AdminMembersPort } from './members.js';
+export type { AdminMedia, AdminMediaPort } from './media.js';
+export type { AdminSettingsPort, SettingResolvedValue, SettingResetResponse, SettingScope, SettingValueResponse, } from './settings.js';
+export type { AdminDatabasePort, AdminLedgerRow, AdminRestorePoint, AdminRestorePointSummary, MigrateForwardResult, RestorePointCostClass, } from './database.js';
+export type { AdminDegradedBanner, AdminDisclosureResult, AdminRecoveryDeepLinkResult, AdminRecoveryPort, AdminRecoveryStatus, CategoryCount, DatabaseContextEnvelope, DegradedBannerActionKind, DegradedBannerKind, RestoreConfirmInput, RestoreExecuteInput, RestoreExecuteResult, } from './recovery.js';
+export type { AdminIntegrationDelivery, AdminIntegrationDeliverySummary, AdminIntegrationSubscription, AdminIntegrationsPort, } from './integrations.js';
+export type { AdminComment, AdminCommentsPort, AdminCommentsQueuePage, CommentModerationAction, CommentsSettings, CommentStatus, } from './comments.js';
+export type { AdminExtensionEnabledResult, AdminExtensionsPort, AdminPlugin } from './plugins.js';
+export type { AdminAnalyticsHit, AdminAnalyticsPort } from './analytics.js';
+export type { AdminWorkspace, AdminWorkspacePort } from './workspace.js';
+export type { AdminIdentityPort, AdminIdentityUser, AdminPolicy, AdminRole, } from './identity.js';
+export type { AdminSeoAnalysis, AdminSeoIssue, AdminSeoMeta, AdminSeoOpenGraph, AdminSeoOverrides, AdminSeoPort, AdminSeoRobotsDirective, AdminSeoRobotsRule, AdminSeoSettings, AdminSeoTwitterCard, SeoIssueSeverity, SeoOpenGraphType, SeoTwitterCardKind, } from './seo.js';
+export type { AdminRedirect, AdminRedirectCreateInput, AdminRedirectHitStats, AdminRedirectImportFailure, AdminRedirectImportResult, AdminRedirectListFilter, AdminRedirectsPort, AdminRedirectUpdatePatch, RedirectMatchType, RedirectSource, RedirectStatus, RedirectStatusCode, } from './redirects.js';
+export type { AdminAssignMenuLocationResult, AdminDeleteMenuResult, AdminMenu, AdminMenuBinding, AdminMenuCreateInput, AdminMenuCustomTarget, AdminMenuEntryTarget, AdminMenuItem, AdminMenuItemAttrs, AdminMenuRouteTarget, AdminMenusPort, AdminMenuTarget, AdminMenuTermTarget, AdminMenuUpdateTreeInput, AdminMenuUrlTarget, MenuStatus, NavTargetKind, } from './menus.js';
+export type { AdminFormCreateInput, AdminFormDefinition, AdminFormField, AdminFormNotifyConfig, AdminFormsPort, AdminFormSubmission, AdminFormSubmissionPage, AdminFormUpdatePatch, FormDefinitionStatus, FormFieldType, } from './forms.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/ports/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/ports/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC9D,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAClE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,oBAAoB,EACpB,YAAY,EACZ,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,mBAAmB,EACnB,qBAAqB,EACrB,2BAA2B,EAC3B,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,sBAAsB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,aAAa,GACd,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAClG,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC5E,YAAY,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEzE,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,SAAS,GACV,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,YAAY,EACZ,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,aAAa,EACb,wBAAwB,EACxB,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,uBAAuB,EACvB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,kBAAkB,GACnB,MAAM,gBAAgB,CAAC;AAExB,YAAY,EACV,6BAA6B,EAC7B,qBAAqB,EACrB,SAAS,EACT,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,eAAe,EACf,mBAAmB,EACnB,wBAAwB,EACxB,kBAAkB,EAClB,UAAU,EACV,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,GACd,MAAM,YAAY,CAAC"}

package/dist/core/ports/index.js

@@ -0,0 +1,6 @@
+/**
+ * @file Barrel for every `@jini-ai/admin/core` port. See `README.md` in this directory for the one
+ * port that is deliberately absent (`execution`) and why.
+ */
+export {};
+//# sourceMappingURL=index.js.map

package/dist/core/ports/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/ports/index.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/core/ports/integrations.d.ts

@@ -0,0 +1,81 @@
+/**
+ * @file `AdminIntegrationsPort` — outbound webhook subscriptions and their delivery history.
+ *
+ * "Integrations" here specifically means outbound webhooks (a subscription that fires HTTP calls
+ * to a target URL when a topic occurs), not a broader per-provider connector concept — the
+ * reference implementation has exactly one integration mechanism. A host that later adds other
+ * integration kinds (inbound, OAuth-connected third parties, ...) would need a wider port; this
+ * one should not be stretched to cover those by convention alone.
+ *
+ * ## `deleteIntegrationSubscription` is a soft delete
+ *
+ * Unlike `AdminMediaPort.deleteMedia` (a genuine hard purge), the reference implementation's subscription "delete" sets
+ * `status: "disabled"` and stamps a disabled timestamp for audit durability — the row is never
+ * removed, and the response echoes the now-disabled subscription rather than a bare
+ * acknowledgement. Do not render this action as irreversible in a panel; it is closer in spirit to
+ * `AdminIdentityPort.disableUser` than to a real delete. (No `restoreIntegrationSubscription`
+ * exists on the reference server to undo it from the admin UI, so a panel still should not promise
+ * a reachable undo — only that the underlying data was not destroyed.)
+ */
+/** A summary of a subscription's most recent delivery attempt — the `lastDelivery` field embedded
+ *  on `AdminIntegrationSubscription`, kept intentionally thin (the full record is
+ *  `AdminIntegrationDelivery`, fetched separately via `listIntegrationDeliveries`). */
+export interface AdminIntegrationDeliverySummary {
+    readonly id: string;
+    readonly status: "pending" | "delivering" | "delivered" | "failed" | "dead" | "canceled";
+    readonly attempts: number;
+    readonly lastResponseStatus: number | null;
+    readonly lastError: string | null;
+    readonly createdAt: string;
+    readonly deliveredAt: string | null;
+}
+export interface AdminIntegrationSubscription {
+    readonly id: string;
+    readonly label: string;
+    readonly targetUrl: string;
+    readonly topics: readonly string[];
+    readonly status: "active" | "paused" | "disabled";
+    /** Increments whenever the signing secret rotates; a host may expose this so an operator can
+     *  confirm a receiving endpoint has picked up the latest secret. */
+    readonly secretVersion: number;
+    readonly previousSecretVersion: number | null;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly disabledAt: string | null;
+    readonly lastDelivery: AdminIntegrationDeliverySummary | null;
+}
+/** One delivery attempt's full record, as listed by `listIntegrationDeliveries`. */
+export interface AdminIntegrationDelivery {
+    readonly id: string;
+    readonly subscriptionId: string;
+    /** The source event this delivery is carrying — distinct from `id`, since one event can produce
+     *  more than one delivery attempt (retries). */
+    readonly eventId: string;
+    readonly topic: string;
+    readonly status: AdminIntegrationDeliverySummary["status"];
+    readonly attempts: number;
+    readonly nextAttemptAt: string;
+    readonly lastResponseStatus: number | null;
+    readonly lastError: string | null;
+    /** Which secret version signed this attempt's payload — lets a receiving endpoint mid-rotation
+     *  determine which key to verify against. */
+    readonly signedWithVersion: number | null;
+    readonly createdAt: string;
+    readonly deliveredAt: string | null;
+    readonly deadAt: string | null;
+}
+export interface AdminIntegrationsPort {
+    listIntegrationSubscriptions(): Promise<readonly AdminIntegrationSubscription[]>;
+    createIntegrationSubscription(input: {
+        label: string;
+        targetUrl: string;
+        topics: readonly string[];
+    }): Promise<AdminIntegrationSubscription>;
+    pauseIntegrationSubscription(id: string, input: {
+        paused: boolean;
+    }): Promise<AdminIntegrationSubscription>;
+    /** Soft delete — see the file header. */
+    deleteIntegrationSubscription(id: string): Promise<AdminIntegrationSubscription>;
+    listIntegrationDeliveries(subscriptionId: string): Promise<readonly AdminIntegrationDelivery[]>;
+}
+//# sourceMappingURL=integrations.d.ts.map

package/dist/core/ports/integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.d.ts","sourceRoot":"","sources":["../../../src/core/ports/integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;uFAEuF;AACvF,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACzF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,CAAC;IAClD;wEACoE;IACpE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,+BAA+B,GAAG,IAAI,CAAC;CAC/D;AAED,oFAAoF;AACpF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC;oDACgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC;iDAC6C;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,qBAAqB;IACpC,4BAA4B,IAAI,OAAO,CAAC,SAAS,4BAA4B,EAAE,CAAC,CAAC;IACjF,6BAA6B,CAAC,KAAK,EAAE;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;KAC3B,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1C,4BAA4B,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC5G,yCAAyC;IACzC,6BAA6B,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACjF,yBAAyB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC,CAAC;CACjG"}

package/dist/core/ports/integrations.js

@@ -0,0 +1,21 @@
+/**
+ * @file `AdminIntegrationsPort` — outbound webhook subscriptions and their delivery history.
+ *
+ * "Integrations" here specifically means outbound webhooks (a subscription that fires HTTP calls
+ * to a target URL when a topic occurs), not a broader per-provider connector concept — the
+ * reference implementation has exactly one integration mechanism. A host that later adds other
+ * integration kinds (inbound, OAuth-connected third parties, ...) would need a wider port; this
+ * one should not be stretched to cover those by convention alone.
+ *
+ * ## `deleteIntegrationSubscription` is a soft delete
+ *
+ * Unlike `AdminMediaPort.deleteMedia` (a genuine hard purge), the reference implementation's subscription "delete" sets
+ * `status: "disabled"` and stamps a disabled timestamp for audit durability — the row is never
+ * removed, and the response echoes the now-disabled subscription rather than a bare
+ * acknowledgement. Do not render this action as irreversible in a panel; it is closer in spirit to
+ * `AdminIdentityPort.disableUser` than to a real delete. (No `restoreIntegrationSubscription`
+ * exists on the reference server to undo it from the admin UI, so a panel still should not promise
+ * a reachable undo — only that the underlying data was not destroyed.)
+ */
+export {};
+//# sourceMappingURL=integrations.js.map

package/dist/core/ports/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","sourceRoot":"","sources":["../../../src/core/ports/integrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG"}

package/dist/core/ports/media.d.ts

@@ -0,0 +1,74 @@
+/**
+ * @file `AdminMediaPort` — uploaded binary assets (images, video, documents) and their metadata.
+ *
+ * ## Media has a genuine hard delete; identity and members do not
+ *
+ * `AdminIdentityPort` deliberately has no `deleteUser` (disable is the audited primitive — see
+ * that file's header), and `AdminMembersPort` has no delete at all. Media is different: the
+ * reference implementation's media route group implements a real two-rung deletion ladder (`trashMedia` soft-deletes,
+ * `deleteMedia` hard-purges the row and the underlying blob) because the audit-trail argument for
+ * principals does not apply to binary assets the same way, and unbounded blob storage is a real
+ * operational cost a purely-soft-delete model would leave unaddressed. `deleteMedia` is gated by a
+ * narrower permission than `trashMedia` in the reference implementation (a `.force`-suffixed
+ * permission), and the backend rejects a purge attempt on an asset that has not been trashed first
+ * — a host should surface that rejection rather than let a caller purge directly. Once
+ * `deleteMedia` succeeds it is genuinely irreversible; do not render it with "undo" affordances.
+ *
+ * ## `mediaOriginalUrl` is synchronous and returns a URL, not a `Promise`
+ *
+ * Every other method here fetches JSON. This one does not — it hands back the byte-serving URL for
+ * an asset's original file, meant to be assigned directly to an `<img src>`/`<video src>` (or
+ * similar) so the browser issues its own authenticated, same-origin request. Wrapping it in a
+ * `Promise<string>` would force every caller through an `await` for a value that is really just
+ * string formatting. A host serves the asset's `Content-Type` sniffed from file content server
+ * side, not trusted from upload metadata — expect non-renderable content types (e.g. a sniffed
+ * HTML/SVG) to come back as a non-rendering attachment rather than inline-rendered.
+ */
+/** A previously-uploaded binary asset and its editable metadata. */
+export interface AdminMedia {
+    readonly id: string;
+    readonly title: string;
+    readonly alt: string;
+    readonly caption: string;
+    readonly credit: string;
+    /** Content hash of the stored blob — a host may use this for de-duplication or integrity checks;
+     *  not meant to be operator-facing. */
+    readonly sha256: string;
+    readonly status: "active" | "trashed";
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    readonly version: number;
+}
+export interface AdminMediaPort {
+    listMedia(): Promise<readonly AdminMedia[]>;
+    /** Synchronous URL builder, not a request — see the file header. */
+    mediaOriginalUrl(id: string): string;
+    uploadMedia(input: {
+        filename: string;
+        contentType: string;
+        dataBase64: string;
+    }, options?: {
+        alt?: string;
+        caption?: string;
+        credit?: string;
+    }): Promise<AdminMedia>;
+    updateMedia(id: string, patch: {
+        title?: string;
+        alt?: string;
+        caption?: string;
+        credit?: string;
+    }): Promise<AdminMedia>;
+    /** Soft delete — reversible via `deleteMedia`'s counterpart trash state. Safe to offer as an
+     *  undoable action in a panel. */
+    trashMedia(id: string): Promise<AdminMedia>;
+    /**
+     * Hard purge. Irreversible — see the file header. Expect a conflict-class rejection (with a
+     * referencing-entities list on the error body, per `../transport/errors.ts`'s "`body` is kept
+     * raw" decision) when the asset is still trashed-but-referenced elsewhere, and a not-found-class
+     * rejection when it has not been trashed first.
+     */
+    deleteMedia(id: string): Promise<{
+        purged: boolean;
+    }>;
+}
+//# sourceMappingURL=media.d.ts.map

package/dist/core/ports/media.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../src/core/ports/media.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,oEAAoE;AACpE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;2CACuC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,IAAI,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAC;IAC5C,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,WAAW,CACT,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,EACpE,OAAO,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAC5D,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB,WAAW,CACT,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC,UAAU,CAAC,CAAC;IACvB;sCACkC;IAClC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACvD"}

package/dist/core/ports/media.js

@@ -0,0 +1,28 @@
+/**
+ * @file `AdminMediaPort` — uploaded binary assets (images, video, documents) and their metadata.
+ *
+ * ## Media has a genuine hard delete; identity and members do not
+ *
+ * `AdminIdentityPort` deliberately has no `deleteUser` (disable is the audited primitive — see
+ * that file's header), and `AdminMembersPort` has no delete at all. Media is different: the
+ * reference implementation's media route group implements a real two-rung deletion ladder (`trashMedia` soft-deletes,
+ * `deleteMedia` hard-purges the row and the underlying blob) because the audit-trail argument for
+ * principals does not apply to binary assets the same way, and unbounded blob storage is a real
+ * operational cost a purely-soft-delete model would leave unaddressed. `deleteMedia` is gated by a
+ * narrower permission than `trashMedia` in the reference implementation (a `.force`-suffixed
+ * permission), and the backend rejects a purge attempt on an asset that has not been trashed first
+ * — a host should surface that rejection rather than let a caller purge directly. Once
+ * `deleteMedia` succeeds it is genuinely irreversible; do not render it with "undo" affordances.
+ *
+ * ## `mediaOriginalUrl` is synchronous and returns a URL, not a `Promise`
+ *
+ * Every other method here fetches JSON. This one does not — it hands back the byte-serving URL for
+ * an asset's original file, meant to be assigned directly to an `<img src>`/`<video src>` (or
+ * similar) so the browser issues its own authenticated, same-origin request. Wrapping it in a
+ * `Promise<string>` would force every caller through an `await` for a value that is really just
+ * string formatting. A host serves the asset's `Content-Type` sniffed from file content server
+ * side, not trusted from upload metadata — expect non-renderable content types (e.g. a sniffed
+ * HTML/SVG) to come back as a non-rendering attachment rather than inline-rendered.
+ */
+export {};
+//# sourceMappingURL=media.js.map

package/dist/core/ports/media.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"media.js","sourceRoot":"","sources":["../../../src/core/ports/media.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG"}

package/dist/core/ports/members.d.ts

@@ -0,0 +1,50 @@
+/**
+ * @file `AdminMembersPort` — end users who signed up on the site, as distinct from operators.
+ *
+ * Members are not principals in the `AdminIdentityPort` sense: they cannot sign in to this admin
+ * surface, they have no roles or policies, and the reference implementation keeps them in a wholly separate route group.
+ * See `identity.ts`'s file header for the fuller "why two ports" rationale.
+ *
+ * ## No `enableMember` on the contract
+ *
+ * Unlike `AdminIdentityPort`'s `disableUser`/`enableUser` pair, this port has disable only.
+ * The reference implementation's members route group has `list`, `get-by-id`,
+ * `disable`, and `request-magic-link` — no re-enable route exists. Adding `enableMember` here would
+ * put a method on the contract the reference implementation cannot satisfy. If a host needs it,
+ * that is new route-level work, not a client-side gap.
+ */
+/** An end user who signed up on the site (not an operator — see the file header). */
+export interface AdminMember {
+    readonly id: string;
+    readonly email: string;
+    readonly name?: string;
+    readonly status: "pending" | "active" | "disabled";
+    /** Set once the member has verified their email; absent until then. */
+    readonly emailVerifiedAt?: string;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+    /** Optimistic-concurrency version. Not currently required by `disableMember` — the reference
+     *  implementation's route takes only an id — but carried on the read shape for parity with the other versioned
+     *  entities in this package, and in case a future disable route adds the guard. */
+    readonly version: number;
+}
+export interface AdminMembersPort {
+    listMembers(): Promise<readonly AdminMember[]>;
+    getMember(id: string): Promise<AdminMember>;
+    /** No `enableMember` counterpart — see the file header. */
+    disableMember(id: string): Promise<AdminMember>;
+    /**
+     * Sends a passwordless sign-in link to the given address. Always resolves `{ delivered: true }`
+     * regardless of whether the address belongs to a real member — an enumeration-safe response, not
+     * a bug. `redirectPath` is where the link lands the member after it is followed; a host that
+     * ignores it falls back to its own default landing location.
+     */
+    requestMemberMagicLink(input: {
+        email: string;
+    }, options?: {
+        redirectPath?: string;
+    }): Promise<{
+        delivered: true;
+    }>;
+}
+//# sourceMappingURL=members.d.ts.map

package/dist/core/ports/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../../src/core/ports/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,qFAAqF;AACrF,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;IACnD,uEAAuE;IACvE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;uFAEmF;IACnF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC5C,2DAA2D;IAC3D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAChD;;;;;OAKG;IACH,sBAAsB,CACpB,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EACxB,OAAO,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,GAClC,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CACjC"}

package/dist/core/ports/members.js

@@ -0,0 +1,17 @@
+/**
+ * @file `AdminMembersPort` — end users who signed up on the site, as distinct from operators.
+ *
+ * Members are not principals in the `AdminIdentityPort` sense: they cannot sign in to this admin
+ * surface, they have no roles or policies, and the reference implementation keeps them in a wholly separate route group.
+ * See `identity.ts`'s file header for the fuller "why two ports" rationale.
+ *
+ * ## No `enableMember` on the contract
+ *
+ * Unlike `AdminIdentityPort`'s `disableUser`/`enableUser` pair, this port has disable only.
+ * The reference implementation's members route group has `list`, `get-by-id`,
+ * `disable`, and `request-magic-link` — no re-enable route exists. Adding `enableMember` here would
+ * put a method on the contract the reference implementation cannot satisfy. If a host needs it,
+ * that is new route-level work, not a client-side gap.
+ */
+export {};
+//# sourceMappingURL=members.js.map

package/dist/core/ports/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../../src/core/ports/members.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG"}