@paneljs/paneljs 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Divinesta
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,25 @@
+# paneljs
+
+Schema-driven admin core. Register models and serve a guarded operations UI.
+
+Install with the adapters for your stack:
+
+```bash
+npm install paneljs @paneljs/express @paneljs/prisma
+```
+
+```ts
+import { createAdmin } from "paneljs";
+import { prismaAdapter } from "@paneljs/prisma";
+import { mount } from "@paneljs/express";
+
+const admin = createAdmin({
+  adapter: prismaAdapter({ prisma }),
+  auth: { getCurrentUser },
+});
+
+admin.register("User");
+await mount(app, admin);
+```
+
+See the [repository](https://github.com/divinesta/paneljs) for docs and the example app.

package/dist/adapter.d.ts

@@ -0,0 +1,24 @@
+import type { AdminModelMeta } from "./types.js";
+/** The subset of CRUD a host ORM must implement for one model. */
+export interface ModelResource {
+    findMany(args: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    findFirst(args: Record<string, unknown>): Promise<Record<string, unknown> | null>;
+    count(args: Record<string, unknown>): Promise<number>;
+    create(args: Record<string, unknown>): Promise<Record<string, unknown>>;
+    updateMany(args: Record<string, unknown>): Promise<{
+        count: number;
+    }>;
+    deleteMany(args: Record<string, unknown>): Promise<{
+        count: number;
+    }>;
+}
+/**
+ * Host-supplied data layer. Core never imports an ORM.
+ * Prisma, TypeORM, and Drizzle each implement this.
+ */
+export interface DataAdapter {
+    /** Opaque client handed to custom action handlers. */
+    readonly client: unknown;
+    introspect(): Promise<Map<string, AdminModelMeta>>;
+    resource(meta: AdminModelMeta): ModelResource;
+}

package/dist/adapter.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter.js.map

package/dist/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":""}

package/dist/audit.d.ts

@@ -0,0 +1,5 @@
+import type { AdminAuditEvent, AdminUser, AuditConfig } from "./types.js";
+type AuditEventInput = Omit<AdminAuditEvent, "actor" | "timestamp">;
+/** Write a mutation event when the host configured an audit destination. */
+export declare function writeAuditEvent(audit: AuditConfig | undefined, adminUser: AdminUser, event: AuditEventInput): Promise<void>;
+export {};

package/dist/audit.js

@@ -0,0 +1,11 @@
+/** Write a mutation event when the host configured an audit destination. */
+export async function writeAuditEvent(audit, adminUser, event) {
+    if (!audit)
+        return;
+    await audit.write({
+        ...event,
+        actor: { id: adminUser.id, email: adminUser.email, role: adminUser.role },
+        timestamp: new Date(),
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../src/audit.ts"],"names":[],"mappings":"AAIA,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA8B,EAAE,SAAoB,EAAE,KAAsB;IAC/G,IAAI,CAAC,KAAK;QAAE,OAAO;IAEnB,MAAM,KAAK,CAAC,KAAK,CAAC;QACf,GAAG,KAAK;QACR,KAAK,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;QACzE,SAAS,EAAE,IAAI,IAAI,EAAE;KACvB,CAAC,CAAC;AACN,CAAC"}

package/dist/authMode.d.ts

@@ -0,0 +1,2 @@
+import type { AuthConfig, BuiltInAuthConfig } from "./types.js";
+export declare const isBuiltInAuth: (auth: AuthConfig) => auth is BuiltInAuthConfig;

package/dist/authMode.js

@@ -0,0 +1,2 @@
+export const isBuiltInAuth = (auth) => auth.mode === "built-in";
+//# sourceMappingURL=authMode.js.map

package/dist/authMode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authMode.js","sourceRoot":"","sources":["../src/authMode.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAgB,EAA6B,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC"}

package/dist/defaultActions.d.ts

@@ -0,0 +1,5 @@
+/** Built-in list actions supplied by the admin rather than a model config. */
+export declare const DELETE_SELECTED_ACTION: {
+    readonly name: "delete_selected";
+    readonly label: "Delete selected";
+};

package/dist/defaultActions.js

@@ -0,0 +1,6 @@
+/** Built-in list actions supplied by the admin rather than a model config. */
+export const DELETE_SELECTED_ACTION = {
+    name: "delete_selected",
+    label: "Delete selected",
+};
+//# sourceMappingURL=defaultActions.js.map

package/dist/defaultActions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"defaultActions.js","sourceRoot":"","sources":["../src/defaultActions.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACnC,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,iBAAiB;CACjB,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,18 @@
+/** A deliberate, safe error that may be returned to an admin API caller. */
+export declare class AdminApiError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+export declare class AuthenticationError extends AdminApiError {
+    constructor();
+}
+export declare class PermissionDeniedError extends AdminApiError {
+    constructor();
+}
+export declare class ModelNotFoundError extends AdminApiError {
+    constructor();
+}
+export declare class RecordNotFoundError extends AdminApiError {
+    constructor();
+}

package/dist/errors.js

@@ -0,0 +1,36 @@
+/** A deliberate, safe error that may be returned to an admin API caller. */
+export class AdminApiError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = "AdminApiError";
+    }
+}
+export class AuthenticationError extends AdminApiError {
+    constructor() {
+        super(401, "AUTHENTICATION_REQUIRED", "Authentication required");
+        this.name = "AuthenticationError";
+    }
+}
+export class PermissionDeniedError extends AdminApiError {
+    constructor() {
+        super(403, "PERMISSION_DENIED", "Permission denied");
+        this.name = "PermissionDeniedError";
+    }
+}
+export class ModelNotFoundError extends AdminApiError {
+    constructor() {
+        super(404, "MODEL_NOT_FOUND", "Model not found");
+        this.name = "ModelNotFoundError";
+    }
+}
+export class RecordNotFoundError extends AdminApiError {
+    constructor() {
+        super(404, "RECORD_NOT_FOUND", "Record not found");
+        this.name = "RecordNotFoundError";
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAEzB;IACA;IAFZ,YACY,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC/B,CAAC;CACH;AAED,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACnD;QACG,KAAK,CAAC,GAAG,EAAE,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACrC,CAAC;CACH;AAED,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACrD;QACG,KAAK,CAAC,GAAG,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACvC,CAAC;CACH;AAED,MAAM,OAAO,kBAAmB,SAAQ,aAAa;IAClD;QACG,KAAK,CAAC,GAAG,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACpC,CAAC;CACH;AAED,MAAM,OAAO,mBAAoB,SAAQ,aAAa;IACnD;QACG,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACrC,CAAC;CACH"}

package/dist/ids.d.ts

@@ -0,0 +1,3 @@
+import type { AdminModelMeta } from "./types.js";
+/** Parse a path or action id into the model's primary-key type. */
+export declare function parseRecordId(meta: AdminModelMeta, rawId: string): string | number;

package/dist/ids.js

@@ -0,0 +1,14 @@
+import { RequestValidationError } from "./validation.js";
+/** Parse a path or action id into the model's primary-key type. */
+export function parseRecordId(meta, rawId) {
+    const idField = meta.fields.find((field) => field.name === meta.idField);
+    if (idField?.type !== "number")
+        return rawId;
+    if (!/^-?(?:0|[1-9]\d*)$/.test(rawId))
+        throw new RequestValidationError(`Record ID for "${meta.name}" must be an integer.`);
+    const id = Number(rawId);
+    if (!Number.isSafeInteger(id))
+        throw new RequestValidationError(`Record ID for "${meta.name}" must be a safe integer.`);
+    return id;
+}
+//# sourceMappingURL=ids.js.map

package/dist/ids.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../src/ids.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,IAAoB,EAAE,KAAa;IAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,OAAO,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAE7C,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,kBAAkB,IAAI,CAAC,IAAI,uBAAuB,CAAC,CAAC;IAC5H,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,kBAAkB,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAC;IACxH,OAAO,EAAE,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+import type { AdminConfig, ModelConfig } from "./types.js";
+import { AdminRegistry } from "./registry.js";
+export interface Admin {
+    register(modelName: string, modelConfig?: ModelConfig): Admin;
+    initialize(): Promise<void>;
+    readonly registry: AdminRegistry;
+    readonly config: AdminConfig;
+}
+export declare function createAdmin(config: AdminConfig): Admin;
+export type { AdminConfig, ModelConfig, AdminUser, AuthConfig, BuiltInAuthConfig, ExternalAuthConfig, AdminHttpRequest, AuditConfig, AdminAuditEvent, AdminFieldMeta, AdminModelMeta, AdminFieldType, RelationKind, ModelPermissions, AdminAction, AdminFieldOverride, PaginatedResponse, SchemaResponse, } from "./types.js";
+export type { DataAdapter, ModelResource } from "./adapter.js";
+export type { ResolvedModelConfig, FullRegisteredModel } from "./registry.js";
+export { AdminRegistry } from "./registry.js";
+export { hashAdminPassword, verifyAdminPassword, verifyLoginPassword } from "./passwords.js";
+export { AdminApiError, AuthenticationError, PermissionDeniedError, ModelNotFoundError, RecordNotFoundError } from "./errors.js";
+export { RequestValidationError, isFieldVisible, isFieldWritable, isSensitiveFieldName, validateWritePayload, validateHookPayload, assertRequiredCreateFields } from "./validation.js";
+export { hasModelPermission, hasActionPermission, hasRegisteredActionPermission } from "./permissions.js";
+export type { AdminOperation } from "./permissions.js";
+export { DELETE_SELECTED_ACTION } from "./defaultActions.js";
+export { writeAuditEvent } from "./audit.js";
+export { buildSchemaResponse } from "./schema.js";
+export { parseListQuery, buildListWhere } from "./listQuery.js";
+export { parseRecordId } from "./ids.js";
+export { buildRecordSelect, buildListRecordSelect, assertSelectedRelationsAreVisible } from "./recordSelection.js";
+export { applyCreateScope, assertScopeFieldsUnchanged, buildScopedRecordWhere, collectScopeFieldNames, resolveScope } from "./scope.js";
+export { getAdminUiDist } from "./uiPath.js";
+export { isBuiltInAuth } from "./authMode.js";

package/dist/index.js

@@ -0,0 +1,40 @@
+import { AdminRegistry } from "./registry.js";
+export function createAdmin(config) {
+    const registry = new AdminRegistry();
+    let initialized = false;
+    const admin = {
+        register(modelName, modelConfig = {}) {
+            registry.register(modelName, modelConfig);
+            return admin;
+        },
+        async initialize() {
+            if (initialized)
+                return;
+            const models = await config.adapter.introspect();
+            await registry.initialize(models);
+            initialized = true;
+        },
+        get registry() {
+            return registry;
+        },
+        get config() {
+            return config;
+        },
+    };
+    return admin;
+}
+export { AdminRegistry } from "./registry.js";
+export { hashAdminPassword, verifyAdminPassword, verifyLoginPassword } from "./passwords.js";
+export { AdminApiError, AuthenticationError, PermissionDeniedError, ModelNotFoundError, RecordNotFoundError } from "./errors.js";
+export { RequestValidationError, isFieldVisible, isFieldWritable, isSensitiveFieldName, validateWritePayload, validateHookPayload, assertRequiredCreateFields } from "./validation.js";
+export { hasModelPermission, hasActionPermission, hasRegisteredActionPermission } from "./permissions.js";
+export { DELETE_SELECTED_ACTION } from "./defaultActions.js";
+export { writeAuditEvent } from "./audit.js";
+export { buildSchemaResponse } from "./schema.js";
+export { parseListQuery, buildListWhere } from "./listQuery.js";
+export { parseRecordId } from "./ids.js";
+export { buildRecordSelect, buildListRecordSelect, assertSelectedRelationsAreVisible } from "./recordSelection.js";
+export { applyCreateScope, assertScopeFieldsUnchanged, buildScopedRecordWhere, collectScopeFieldNames, resolveScope } from "./scope.js";
+export { getAdminUiDist } from "./uiPath.js";
+export { isBuiltInAuth } from "./authMode.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAS9C,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC5C,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;IACrC,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,MAAM,KAAK,GAAU;QAClB,QAAQ,CAAC,SAAiB,EAAE,cAA2B,EAAE;YACtD,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,UAAU;YACb,IAAI,WAAW;gBAAE,OAAO;YACxB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAClC,WAAW,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,IAAI,QAAQ;YACT,OAAO,QAAQ,CAAC;QACnB,CAAC;QACD,IAAI,MAAM;YACP,OAAO,MAAM,CAAC;QACjB,CAAC;KACH,CAAC;IAEF,OAAO,KAAK,CAAC;AAChB,CAAC;AAwBD,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC7F,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACjI,OAAO,EAAE,sBAAsB,EAAE,cAAc,EAAE,eAAe,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AACvL,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAE1G,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,iCAAiC,EAAE,MAAM,sBAAsB,CAAC;AACnH,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AACxI,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/listQuery.d.ts

@@ -0,0 +1,19 @@
+import type { FullRegisteredModel } from "./registry.js";
+import type { AdminModelMeta } from "./types.js";
+export type QueryValue = string | string[] | undefined;
+export type QueryMap = Record<string, QueryValue>;
+export declare function buildListWhere(scope: Record<string, unknown>, filters: Record<string, unknown>, search: Record<string, unknown> | undefined): Record<string, unknown>;
+export declare function parseListQuery(query: QueryMap, meta: AdminModelMeta, model: FullRegisteredModel, databaseProvider?: string): {
+    page: number;
+    sort: string;
+    dir: string;
+    filters: Record<string, unknown>;
+    search: {
+        OR: {
+            [x: string]: {
+                mode?: string | undefined;
+                contains: string;
+            };
+        }[];
+    } | undefined;
+};

package/dist/listQuery.js

@@ -0,0 +1,106 @@
+import { isFieldVisible, RequestValidationError } from "./validation.js";
+function getQueryValue(query, name) {
+    const value = query[name];
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== "string")
+        throw new RequestValidationError(`Query parameter "${name}" must be a single string value.`);
+    return value;
+}
+function parseFilterValue(field, value) {
+    switch (field.type) {
+        case "string":
+        case "bytes":
+            return value;
+        case "number": {
+            const number = Number(value);
+            if (!Number.isFinite(number))
+                throw new RequestValidationError(`Filter "${field.name}" must be a finite number.`);
+            return number;
+        }
+        case "boolean":
+            if (value !== "true" && value !== "false")
+                throw new RequestValidationError(`Filter "${field.name}" must be "true" or "false".`);
+            return value === "true";
+        case "datetime": {
+            const date = new Date(value);
+            if (Number.isNaN(date.getTime()))
+                throw new RequestValidationError(`Filter "${field.name}" must be an ISO date-time value.`);
+            return date;
+        }
+        case "enum":
+            if (!field.enumValues?.includes(value))
+                throw new RequestValidationError(`Filter "${field.name}" must be a valid ${field.nativeType} value.`);
+            return value;
+        case "json":
+        case "relation":
+            throw new RequestValidationError(`Filter "${field.name}" is not supported.`);
+    }
+}
+export function buildListWhere(scope, filters, search) {
+    const conditions = [scope, filters, search].filter((condition) => condition !== undefined && Object.keys(condition).length > 0);
+    if (conditions.length === 0)
+        return {};
+    if (conditions.length === 1)
+        return conditions[0] ?? {};
+    return { AND: conditions };
+}
+export function parseListQuery(query, meta, model, databaseProvider) {
+    const pageValue = Number(getQueryValue(query, "page") ?? 1);
+    if (!Number.isInteger(pageValue) || pageValue < 1)
+        throw new RequestValidationError("Query parameter \"page\" must be a positive integer.");
+    if (pageValue > 10_000)
+        throw new RequestValidationError("Query parameter \"page\" must be 10,000 or fewer.");
+    const sort = getQueryValue(query, "sort") ?? model.resolved.defaultSort.field;
+    const dir = getQueryValue(query, "dir") ?? model.resolved.defaultSort.direction;
+    const sortableFields = new Set(meta.fields.filter((field) => field.type !== "relation" && isFieldVisible(field, model.raw)).map((field) => field.name));
+    if (!sortableFields.has(sort))
+        throw new RequestValidationError(`Field "${sort}" cannot be used for sorting.`);
+    if (dir !== "asc" && dir !== "desc")
+        throw new RequestValidationError("Query parameter \"dir\" must be either \"asc\" or \"desc\".");
+    const fieldsByName = new Map(meta.fields.map((field) => [field.name, field]));
+    const filterableFields = new Set(model.resolved.listFilter.filter((fieldName) => {
+        const field = fieldsByName.get(fieldName);
+        return field !== undefined && field.type !== "relation" && isFieldVisible(field, model.raw);
+    }));
+    const filters = {};
+    const knownQueryParameters = new Set(["page", "sort", "dir", "search"]);
+    for (const [parameterName, rawValue] of Object.entries(query)) {
+        if (knownQueryParameters.has(parameterName))
+            continue;
+        if (typeof rawValue !== "string")
+            throw new RequestValidationError(`Query parameter "${parameterName}" must be a single string value.`);
+        const rangeMatch = /^(.*)_(gte|lte)$/.exec(parameterName);
+        const fieldName = rangeMatch?.[1] ?? parameterName;
+        const field = fieldsByName.get(fieldName);
+        if (!field || !filterableFields.has(fieldName))
+            throw new RequestValidationError(`Filter "${parameterName}" is not allowed for this model.`);
+        if (rangeMatch) {
+            if (field.type !== "datetime")
+                throw new RequestValidationError(`Filter "${parameterName}" is only supported for date-time fields.`);
+            const operator = rangeMatch[2];
+            if (!operator)
+                throw new RequestValidationError(`Filter "${parameterName}" is invalid.`);
+            filters[fieldName] = { ...filters[fieldName], [operator]: parseFilterValue(field, rawValue) };
+        }
+        else {
+            filters[fieldName] = parseFilterValue(field, rawValue);
+        }
+    }
+    const searchValue = getQueryValue(query, "search")?.trim();
+    if (searchValue && searchValue.length > 200)
+        throw new RequestValidationError("Query parameter \"search\" must be 200 characters or fewer.");
+    const searchFields = model.resolved.searchFields.filter((fieldName) => {
+        const field = fieldsByName.get(fieldName);
+        return field?.type === "string" && isFieldVisible(field, model.raw);
+    });
+    const search = searchValue ? {
+        OR: searchFields.map((fieldName) => ({
+            [fieldName]: { contains: searchValue, ...(databaseProvider === "postgresql" ? { mode: "insensitive" } : {}) },
+        })),
+    } : undefined;
+    if (searchValue && searchFields.length === 0)
+        throw new RequestValidationError(`Model "${meta.name}" has no searchable fields.`);
+    return { page: pageValue, sort, dir, filters, search };
+}
+//# sourceMappingURL=listQuery.js.map

package/dist/listQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listQuery.js","sourceRoot":"","sources":["../src/listQuery.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAKzE,SAAS,aAAa,CAAC,KAAe,EAAE,IAAY;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,IAAI,kCAAkC,CAAC,CAAC;IAC5H,OAAO,KAAK,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB,EAAE,KAAa;IAC3D,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACT,OAAO,KAAK,CAAC;QAChB,KAAK,QAAQ,CAAC,CAAC,CAAC;YACb,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;YAClH,OAAO,MAAM,CAAC;QACjB,CAAC;QACD,KAAK,SAAS;YACX,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO;gBAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,KAAK,CAAC,IAAI,8BAA8B,CAAC,CAAC;YACjI,OAAO,KAAK,KAAK,MAAM,CAAC;QAC3B,KAAK,UAAU,CAAC,CAAC,CAAC;YACf,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,KAAK,CAAC,IAAI,mCAAmC,CAAC,CAAC;YAC7H,OAAO,IAAI,CAAC;QACf,CAAC;QACD,KAAK,MAAM;YACR,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,KAAK,CAAC,IAAI,qBAAqB,KAAK,CAAC,UAAU,SAAS,CAAC,CAAC;YAC9I,OAAO,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU;YACZ,MAAM,IAAI,sBAAsB,CAAC,WAAW,KAAK,CAAC,IAAI,qBAAqB,CAAC,CAAC;IACnF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA8B,EAAE,OAAgC,EAAE,MAA2C;IACzI,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAwC,EAAE,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtK,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAe,EAAE,IAAoB,EAAE,KAA0B,EAAE,gBAAyB;IACxH,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,sDAAsD,CAAC,CAAC;IAC5I,IAAI,SAAS,GAAG,MAAM;QAAE,MAAM,IAAI,sBAAsB,CAAC,mDAAmD,CAAC,CAAC;IAE9G,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,CAAC;IAC9E,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,SAAS,CAAC;IAChF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxJ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,IAAI,+BAA+B,CAAC,CAAC;IAC/G,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;QAAE,MAAM,IAAI,sBAAsB,CAAC,6DAA6D,CAAC,CAAC;IAErI,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9E,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QAC7E,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,OAAO,GAA4B,EAAE,CAAC;IAC5C,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IAExE,KAAK,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7D,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;YAAE,SAAS;QACtD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,sBAAsB,CAAC,oBAAoB,aAAa,kCAAkC,CAAC,CAAC;QAExI,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,aAAa,CAAC;QACnD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,aAAa,kCAAkC,CAAC,CAAC;QAE7I,IAAI,UAAU,EAAE,CAAC;YACd,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;gBAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,aAAa,2CAA2C,CAAC,CAAC;YACrI,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,WAAW,aAAa,eAAe,CAAC,CAAC;YACzF,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,GAAI,OAAO,CAAC,SAAS,CAAyC,EAAE,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC1I,CAAC;aAAM,CAAC;YACL,OAAO,CAAC,SAAS,CAAC,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC;IAC3D,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,sBAAsB,CAAC,6DAA6D,CAAC,CAAC;IAC7I,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;QACnE,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC;QAC1B,EAAE,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YAClC,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,CAAC,gBAAgB,KAAK,YAAY,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;SAC/G,CAAC,CAAC;KACL,CAAC,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,WAAW,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,IAAI,CAAC,IAAI,6BAA6B,CAAC,CAAC;IAEjI,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC1D,CAAC"}

package/dist/passwords.d.ts

@@ -0,0 +1,4 @@
+export declare const hashAdminPassword: (password: string) => Promise<string>;
+export declare const verifyAdminPassword: (password: string, storedHash: string) => Promise<boolean>;
+/** Always performs one password derivation, including when no account exists. */
+export declare const verifyLoginPassword: (password: string, storedHash?: string) => Promise<boolean>;

package/dist/passwords.js

@@ -0,0 +1,57 @@
+import { randomBytes, scrypt as scryptCallback, timingSafeEqual } from "node:crypto";
+const passwordPrefix = "scrypt";
+const derivedKeyLength = 64;
+const defaultParameters = { cost: 131_072, blockSize: 8, parallelism: 1 };
+const maximumParameters = { cost: 131_072, blockSize: 16, parallelism: 4 };
+function isValidCost(cost) {
+    return Number.isSafeInteger(cost) && cost >= 2 && cost <= maximumParameters.cost && (cost & (cost - 1)) === 0;
+}
+function parseStoredHash(storedHash) {
+    const [prefix, costValue, blockSizeValue, parallelismValue, salt, expectedValue] = storedHash.split("$");
+    if (prefix !== passwordPrefix || !costValue || !blockSizeValue || !parallelismValue || !salt || !expectedValue)
+        return null;
+    const parameters = { cost: Number(costValue), blockSize: Number(blockSizeValue), parallelism: Number(parallelismValue) };
+    if (!isValidCost(parameters.cost)
+        || !Number.isSafeInteger(parameters.blockSize)
+        || parameters.blockSize < 1
+        || parameters.blockSize > maximumParameters.blockSize
+        || !Number.isSafeInteger(parameters.parallelism)
+        || parameters.parallelism < 1
+        || parameters.parallelism > maximumParameters.parallelism)
+        return null;
+    const expected = Buffer.from(expectedValue, "base64url");
+    if (expected.length !== derivedKeyLength)
+        return null;
+    return { salt, expected, parameters };
+}
+async function derive(password, salt, parameters) {
+    const maxmem = (128 * parameters.cost * parameters.blockSize) + (128 * parameters.blockSize * parameters.parallelism) + 1_048_576;
+    return new Promise((resolve, reject) => {
+        const options = { N: parameters.cost, r: parameters.blockSize, p: parameters.parallelism, maxmem };
+        const scryptWithOptions = scryptCallback;
+        scryptWithOptions(password, salt, derivedKeyLength, options, (error, derivedKey) => {
+            if (error)
+                reject(error);
+            else
+                resolve(derivedKey);
+        });
+    });
+}
+export const hashAdminPassword = async (password) => {
+    const salt = randomBytes(16).toString("base64url");
+    const derived = await derive(password, salt, defaultParameters);
+    return [passwordPrefix, defaultParameters.cost, defaultParameters.blockSize, defaultParameters.parallelism, salt, derived.toString("base64url")].join("$");
+};
+export const verifyAdminPassword = async (password, storedHash) => {
+    const parsed = parseStoredHash(storedHash);
+    if (!parsed)
+        return false;
+    const actual = await derive(password, parsed.salt, parsed.parameters);
+    return timingSafeEqual(parsed.expected, actual);
+};
+const dummyHash = hashAdminPassword(randomBytes(32).toString("base64url"));
+/** Always performs one password derivation, including when no account exists. */
+export const verifyLoginPassword = async (password, storedHash) => {
+    return verifyAdminPassword(password, storedHash ?? await dummyHash);
+};
+//# sourceMappingURL=passwords.js.map

package/dist/passwords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passwords.js","sourceRoot":"","sources":["../src/passwords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,IAAI,cAAc,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACrF,MAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,iBAAiB,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAC1E,MAAM,iBAAiB,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;AAY3E,SAAS,WAAW,CAAC,IAAY;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,iBAAiB,CAAC,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACxC,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,IAAI,EAAE,aAAa,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzG,IAAI,MAAM,KAAK,cAAc,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,IAAI,CAAC,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAE5H,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACzH,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC;WAC3B,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC;WAC3C,UAAU,CAAC,SAAS,GAAG,CAAC;WACxB,UAAU,CAAC,SAAS,GAAG,iBAAiB,CAAC,SAAS;WAClD,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,CAAC;WAC7C,UAAU,CAAC,WAAW,GAAG,CAAC;WAC1B,UAAU,CAAC,WAAW,GAAG,iBAAiB,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE1E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,IAAY,EAAE,UAA4B;IAC/E,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,SAAS,GAAG,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAAC;IAClI,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,EAAE,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC;QACnG,MAAM,iBAAiB,GAAG,cAA8C,CAAC;QACzE,iBAAiB,CAAC,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE;YAChF,IAAI,KAAK;gBAAE,MAAM,CAAC,KAAK,CAAC,CAAC;;gBACpB,OAAO,CAAC,UAAU,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAgB,EAAmB,EAAE;IAC1E,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAChE,OAAO,CAAC,cAAc,EAAE,iBAAiB,CAAC,IAAI,EAAE,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC9J,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,QAAgB,EAAE,UAAkB,EAAoB,EAAE;IACjG,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;IACtE,OAAO,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,iBAAiB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;AAE3E,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,QAAgB,EAAE,UAAmB,EAAoB,EAAE;IAClG,OAAO,mBAAmB,CAAC,QAAQ,EAAE,UAAU,IAAI,MAAM,SAAS,CAAC,CAAC;AACvE,CAAC,CAAC"}

package/dist/permissions.d.ts

@@ -0,0 +1,15 @@
+import type { AdminAction, AdminUser, ModelPermissions } from "./types.js";
+/** Every model operation the admin can authorize. */
+export type AdminOperation = "list" | "view" | "create" | "update" | "delete";
+/**
+ * Decide whether an authenticated admin may perform a model operation.
+ *
+ * Reads remain available to authenticated admins by default. Writes and
+ * custom actions require an explicit allowlist. A configured empty role list
+ * denies everyone except a super admin.
+ */
+export declare function hasModelPermission(adminUser: AdminUser, permissions: ModelPermissions, operation: AdminOperation): boolean;
+/** Return the configured model-level role allowlist for a named custom action. */
+export declare function hasActionPermission(adminUser: AdminUser, permissions: ModelPermissions, actionName: string): boolean;
+/** Either allowlist authorizes an action; when both are present, both must allow the role. */
+export declare function hasRegisteredActionPermission(adminUser: AdminUser, permissions: ModelPermissions, action: AdminAction): boolean;

package/dist/permissions.js

@@ -0,0 +1,36 @@
+/**
+ * Decide whether an authenticated admin may perform a model operation.
+ *
+ * Reads remain available to authenticated admins by default. Writes and
+ * custom actions require an explicit allowlist. A configured empty role list
+ * denies everyone except a super admin.
+ */
+export function hasModelPermission(adminUser, permissions, operation) {
+    if (adminUser.isSuperAdmin)
+        return true;
+    const allowedRoles = permissions[operation];
+    if (allowedRoles === undefined)
+        return operation === "list" || operation === "view";
+    return allowedRoles.includes(adminUser.role);
+}
+/** Return the configured model-level role allowlist for a named custom action. */
+export function hasActionPermission(adminUser, permissions, actionName) {
+    if (adminUser.isSuperAdmin)
+        return true;
+    const allowedRoles = permissions.actions?.[actionName];
+    if (allowedRoles === undefined)
+        return false;
+    return allowedRoles.includes(adminUser.role);
+}
+/** Either allowlist authorizes an action; when both are present, both must allow the role. */
+export function hasRegisteredActionPermission(adminUser, permissions, action) {
+    if (adminUser.isSuperAdmin)
+        return true;
+    const modelAllowedRoles = permissions.actions?.[action.name];
+    const actionAllowedRoles = action.allowedRoles;
+    if (modelAllowedRoles === undefined && actionAllowedRoles === undefined)
+        return false;
+    return (modelAllowedRoles === undefined || modelAllowedRoles.includes(adminUser.role))
+        && (actionAllowedRoles === undefined || actionAllowedRoles.includes(adminUser.role));
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AASA;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoB,EAAE,WAA6B,EAAE,SAAyB;IAC9G,IAAI,SAAS,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,SAAS,KAAK,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC;IAEpF,OAAO,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,mBAAmB,CAAC,SAAoB,EAAE,WAA6B,EAAE,UAAkB;IACxG,IAAI,SAAS,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,YAAY,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAE7C,OAAO,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,6BAA6B,CAAC,SAAoB,EAAE,WAA6B,EAAE,MAAmB;IACnH,IAAI,SAAS,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAExC,MAAM,iBAAiB,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7D,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC;IAC/C,IAAI,iBAAiB,KAAK,SAAS,IAAI,kBAAkB,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtF,OAAO,CAAC,iBAAiB,KAAK,SAAS,IAAI,iBAAiB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;WAChF,CAAC,kBAAkB,KAAK,SAAS,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3F,CAAC"}

package/dist/recordSelection.d.ts

@@ -0,0 +1,13 @@
+import type { DataAdapter } from "./adapter.js";
+import type { FullRegisteredModel } from "./registry.js";
+import type { AdminModelMeta, AdminUser } from "./types.js";
+/** Build the safe select used by detail and edit endpoints. */
+export declare function buildRecordSelect(meta: AdminModelMeta, model: FullRegisteredModel): Record<string, true | {
+    select: Record<string, true>;
+}>;
+/** Only return columns the list is configured to display, plus the primary key. */
+export declare function buildListRecordSelect(meta: AdminModelMeta, model: FullRegisteredModel): Record<string, true | {
+    select: Record<string, true>;
+}>;
+/** Verify submitted belongs-to IDs are visible under the related model's own access rules. */
+export declare function assertSelectedRelationsAreVisible(data: Record<string, unknown>, model: FullRegisteredModel, models: Map<string, FullRegisteredModel>, adapter: DataAdapter, adminUser: AdminUser): Promise<void>;