@paneljs/paneljs 0.1.0

package/dist/schema.js

@@ -0,0 +1,59 @@
+import { hasModelPermission, hasRegisteredActionPermission } from "./permissions.js";
+import { DELETE_SELECTED_ACTION } from "./defaultActions.js";
+import { isFieldVisible, isFieldWritable } from "./validation.js";
+export function buildSchemaResponse(registry, options) {
+    const { adminUser, siteName, basePath, authMode } = options;
+    return {
+        identity: {
+            id: adminUser.id,
+            email: adminUser.email,
+            role: adminUser.role,
+            isSuperAdmin: adminUser.isSuperAdmin,
+        },
+        authMode,
+        siteName,
+        basePath,
+        models: registry
+            .getAll()
+            .filter(({ resolved }) => hasModelPermission(adminUser, resolved.permissions, "list"))
+            .map(({ meta, resolved, raw }) => {
+            const visibleFields = meta.fields
+                .filter((field) => isFieldVisible(field, raw))
+                .map((field) => ({ ...field, isReadOnly: field.isReadOnly || !isFieldWritable(field, raw, adminUser) }));
+            const visibleFieldNames = new Set(visibleFields.map((field) => field.name));
+            const canDelete = hasModelPermission(adminUser, resolved.permissions, "delete");
+            const customActions = (raw.actions ?? [])
+                .filter((action) => hasRegisteredActionPermission(adminUser, resolved.permissions, action))
+                .map(({ name, label }) => ({ name, label }));
+            const actions = canDelete ? [DELETE_SELECTED_ACTION, ...customActions] : customActions;
+            return {
+                meta: {
+                    ...meta,
+                    fields: visibleFields,
+                    searchableFields: meta.searchableFields.filter((fieldName) => visibleFieldNames.has(fieldName)),
+                    filterableFields: meta.filterableFields.filter((fieldName) => visibleFieldNames.has(fieldName)),
+                },
+                config: {
+                    listDisplay: resolved.listDisplay.filter((fieldName) => visibleFieldNames.has(fieldName)),
+                    listFilter: resolved.listFilter.filter((fieldName) => visibleFieldNames.has(fieldName)),
+                    searchFields: resolved.searchFields.filter((fieldName) => visibleFieldNames.has(fieldName)),
+                    defaultSort: resolved.defaultSort,
+                    perPage: resolved.perPage,
+                    permissions: {
+                        list: hasModelPermission(adminUser, resolved.permissions, "list"),
+                        view: hasModelPermission(adminUser, resolved.permissions, "view"),
+                        create: hasModelPermission(adminUser, resolved.permissions, "create"),
+                        update: hasModelPermission(adminUser, resolved.permissions, "update"),
+                        delete: canDelete,
+                        actions: {
+                            [DELETE_SELECTED_ACTION.name]: canDelete,
+                            ...Object.fromEntries((raw.actions ?? []).map((action) => [action.name, hasRegisteredActionPermission(adminUser, resolved.permissions, action)])),
+                        },
+                    },
+                    actions,
+                },
+            };
+        }),
+    };
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAG7D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElE,MAAM,UAAU,mBAAmB,CAChC,QAAuB,EACvB,OAAwG;IAExG,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;IAE5D,OAAO;QACJ,QAAQ,EAAE;YACP,EAAE,EAAE,SAAS,CAAC,EAAE;YAChB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,IAAI,EAAE,SAAS,CAAC,IAAI;YACpB,YAAY,EAAE,SAAS,CAAC,YAAY;SACtC;QACD,QAAQ;QACR,QAAQ;QACR,QAAQ;QACR,MAAM,EAAE,QAAQ;aACZ,MAAM,EAAE;aACR,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;aACrF,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE;YAC9B,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM;iBAC7B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;iBAC7C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5G,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YAChF,MAAM,aAAa,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;iBACrC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,6BAA6B,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;iBAC1F,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YAEvF,OAAO;gBACJ,IAAI,EAAE;oBACH,GAAG,IAAI;oBACP,MAAM,EAAE,aAAa;oBACrB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC/F,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;iBACjG;gBACD,MAAM,EAAE;oBACL,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACzF,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBACvF,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;oBAC3F,WAAW,EAAE,QAAQ,CAAC,WAAW;oBACjC,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,WAAW,EAAE;wBACV,IAAI,EAAE,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;wBACjE,IAAI,EAAE,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;wBACjE,MAAM,EAAE,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;wBACrE,MAAM,EAAE,kBAAkB,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC;wBACrE,MAAM,EAAE,SAAS;wBACjB,OAAO,EAAE;4BACN,CAAC,sBAAsB,CAAC,IAAI,CAAC,EAAE,SAAS;4BACxC,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;yBACnJ;qBACH;oBACD,OAAO;iBACT;aACH,CAAC;QACL,CAAC,CAAC;KACP,CAAC;AACL,CAAC"}

package/dist/scope.d.ts

@@ -0,0 +1,31 @@
+import type { AdminUser, ModelConfig } from "./types.js";
+/** A Prisma-compatible where fragment returned by a model scope function. */
+export type ScopeFilter = Record<string, unknown>;
+/**
+ * Resolve a model's tenant or ownership scope for an authenticated admin.
+ *
+ * Scope is always returned as a separate `AND` clause. Spreading the scope
+ * into an ID condition would allow overlapping keys to overwrite one another.
+ */
+export declare function resolveScope(config: ModelConfig, adminUser: AdminUser): Promise<ScopeFilter>;
+/**
+ * Combine a scope with a record identifier without allowing either condition
+ * to replace the other. Routes should use this for detail, update, and delete
+ * lookups—not just list queries.
+ */
+export declare function buildScopedRecordWhere(scope: ScopeFilter, idField: string, id: unknown): ScopeFilter;
+/**
+ * Apply a simple tenant/ownership scope to newly created data. This prevents
+ * callers from creating a record inside another tenant by submitting a
+ * different foreign key. Complex Prisma predicates are safe for reads and
+ * mutations, but cannot be converted into create data automatically.
+ */
+export declare function applyCreateScope(data: Record<string, unknown>, scope: ScopeFilter): Record<string, unknown>;
+/** Prevent a caller from moving a record out of its authorized scope. */
+export declare function assertScopeFieldsUnchanged(data: Record<string, unknown>, scope: ScopeFilter): void;
+/**
+ * Return every scalar field named by a Prisma where tree.  This deliberately
+ * errs on the side of locking too much: an update must never be able to alter
+ * a value that a nested AND/OR/NOT predicate uses to establish its scope.
+ */
+export declare function collectScopeFieldNames(scope: ScopeFilter): Set<string>;

package/dist/scope.js

@@ -0,0 +1,86 @@
+import { RequestValidationError } from "./validation.js";
+/**
+ * Resolve a model's tenant or ownership scope for an authenticated admin.
+ *
+ * Scope is always returned as a separate `AND` clause. Spreading the scope
+ * into an ID condition would allow overlapping keys to overwrite one another.
+ */
+export async function resolveScope(config, adminUser) {
+    const scope = (await config.scope?.(adminUser)) ?? {};
+    assertNoUndefinedScopeValues(scope);
+    return scope;
+}
+function assertNoUndefinedScopeValues(value, path = []) {
+    if (value === undefined) {
+        const label = path.length ? path.join(".") : "scope";
+        throw new RequestValidationError(`Scope field "${label}" resolved to undefined. Return a concrete value or a match-nothing fallback instead.`);
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => assertNoUndefinedScopeValues(item, [...path, String(index)]));
+        return;
+    }
+    if (value === null || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(value)) {
+        assertNoUndefinedScopeValues(child, [...path, key]);
+    }
+}
+/**
+ * Combine a scope with a record identifier without allowing either condition
+ * to replace the other. Routes should use this for detail, update, and delete
+ * lookups—not just list queries.
+ */
+export function buildScopedRecordWhere(scope, idField, id) {
+    return {
+        AND: [scope, { [idField]: id }],
+    };
+}
+/**
+ * Apply a simple tenant/ownership scope to newly created data. This prevents
+ * callers from creating a record inside another tenant by submitting a
+ * different foreign key. Complex Prisma predicates are safe for reads and
+ * mutations, but cannot be converted into create data automatically.
+ */
+export function applyCreateScope(data, scope) {
+    const scopedData = { ...data };
+    for (const [fieldName, value] of Object.entries(scope)) {
+        if (value !== null && typeof value === "object") {
+            throw new RequestValidationError(`Cannot apply complex scope field "${fieldName}" when creating a record. Use a simple equality scope or a beforeCreate hook.`);
+        }
+        if (scopedData[fieldName] !== undefined && scopedData[fieldName] !== value) {
+            throw new RequestValidationError(`Create payload conflicts with the configured scope for field "${fieldName}".`);
+        }
+        scopedData[fieldName] = value;
+    }
+    return scopedData;
+}
+/** Prevent a caller from moving a record out of its authorized scope. */
+export function assertScopeFieldsUnchanged(data, scope) {
+    for (const fieldName of collectScopeFieldNames(scope)) {
+        if (data[fieldName] !== undefined) {
+            throw new RequestValidationError(`Field "${fieldName}" is controlled by the configured scope and cannot be updated through the admin.`);
+        }
+    }
+}
+/**
+ * Return every scalar field named by a Prisma where tree.  This deliberately
+ * errs on the side of locking too much: an update must never be able to alter
+ * a value that a nested AND/OR/NOT predicate uses to establish its scope.
+ */
+export function collectScopeFieldNames(scope) {
+    const names = new Set();
+    const visit = (value) => {
+        if (Array.isArray(value))
+            return void value.forEach(visit);
+        if (value === null || typeof value !== "object")
+            return;
+        for (const [key, child] of Object.entries(value)) {
+            if (key !== "AND" && key !== "OR" && key !== "NOT")
+                names.add(key);
+            visit(child);
+        }
+    };
+    visit(scope);
+    return names;
+}
+//# sourceMappingURL=scope.js.map

package/dist/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../src/scope.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AASzD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAmB,EAAE,SAAoB;IACzE,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACtD,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC;AAChB,CAAC;AAED,SAAS,4BAA4B,CAAC,KAAc,EAAE,OAAiB,EAAE;IACtE,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrD,MAAM,IAAI,sBAAsB,CAAC,gBAAgB,KAAK,uFAAuF,CAAC,CAAC;IAClJ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,OAAO;IACV,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO;IAExD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC3E,4BAA4B,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACvD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkB,EAAE,OAAe,EAAE,EAAW;IACpF,OAAO;QACJ,GAAG,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC;KACjC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6B,EAAE,KAAkB;IAC/E,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IAE/B,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/C,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,SAAS,+EAA+E,CAAC,CAAC;QACnK,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;YAC1E,MAAM,IAAI,sBAAsB,CAAC,iEAAiE,SAAS,IAAI,CAAC,CAAC;QACpH,CAAC;QAED,UAAU,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IACjC,CAAC;IAED,OAAO,UAAU,CAAC;AACrB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,0BAA0B,CAAC,IAA6B,EAAE,KAAkB;IACzF,KAAK,MAAM,SAAS,IAAI,sBAAsB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,sBAAsB,CAAC,UAAU,SAAS,kFAAkF,CAAC,CAAC;QAC3I,CAAC;IACJ,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAkB;IACtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,EAAE;QAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO;QACxD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC3E,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACnE,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACJ,CAAC,CAAC;IACF,KAAK,CAAC,KAAK,CAAC,CAAC;IACb,OAAO,KAAK,CAAC;AAChB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,189 @@
+import type { DataAdapter } from "./adapter.js";
+export type AdminFieldType = "string" | "number" | "boolean" | "datetime" | "json" | "enum" | "relation" | "bytes";
+export type RelationKind = "belongsTo" | "hasMany" | "manyToMany" | "hasOne";
+export interface AdminFieldMeta {
+    name: string;
+    type: AdminFieldType;
+    /** The ORM's native type name, e.g. Prisma "DateTime". */
+    nativeType: string;
+    isId: boolean;
+    isRequired: boolean;
+    isUnique: boolean;
+    isReadOnly: boolean;
+    isList: boolean;
+    isFilterable: boolean;
+    isSearchable: boolean;
+    defaultValue: unknown;
+    enumValues?: string[];
+    relation?: {
+        model: string;
+        kind: RelationKind;
+        relationName: string;
+        foreignKeyFields: string[];
+        onDelete?: string | null;
+        displayField: string;
+    } | null;
+}
+export interface AdminModelMeta {
+    name: string;
+    pluralName: string;
+    /** Property used to select this model on the ORM client. */
+    clientKey: string;
+    fields: AdminFieldMeta[];
+    idField: string;
+    displayField: string;
+    searchableFields: string[];
+    filterableFields: string[];
+    timestamps: {
+        createdAt?: string;
+        updatedAt?: string;
+    };
+}
+export interface AdminUser {
+    id: string;
+    email: string;
+    username?: string;
+    role: string;
+    isSuperAdmin: boolean;
+    institutionId?: string;
+    tenantId?: string;
+    metadata?: Record<string, unknown>;
+}
+export interface AdminAction {
+    name: string;
+    label: string;
+    handler: (params: {
+        ids: Array<string | number>;
+        adminUser: AdminUser;
+        client: unknown;
+        where: Record<string, unknown>;
+    }) => Promise<{
+        message: string;
+    }>;
+    allowedRoles?: string[];
+}
+export interface AdminFieldOverride {
+    exclude?: boolean;
+    expose?: boolean;
+    readOnly?: boolean;
+    writeRoles?: string[];
+}
+export interface ModelPermissions {
+    list?: string[];
+    view?: string[];
+    create?: string[];
+    update?: string[];
+    delete?: string[];
+    actions?: Record<string, string[]>;
+}
+export interface ModelConfig {
+    listDisplay?: string[];
+    listFilter?: string[];
+    searchFields?: string[];
+    defaultSort?: {
+        field: string;
+        direction: "asc" | "desc";
+    };
+    perPage?: number;
+    fields?: Record<string, AdminFieldOverride>;
+    actions?: AdminAction[];
+    permissions?: ModelPermissions;
+    scope?: (adminUser: AdminUser) => Promise<Record<string, unknown>>;
+    beforeCreate?: (data: Record<string, unknown>) => Promise<Record<string, unknown>>;
+    afterCreate?: (record: Record<string, unknown>) => Promise<void>;
+    beforeUpdate?: (id: string, data: Record<string, unknown>) => Promise<Record<string, unknown>>;
+    afterUpdate?: (record: Record<string, unknown>) => Promise<void>;
+    beforeDelete?: (id: string) => Promise<void>;
+    afterDelete?: (id: string) => Promise<void>;
+    displayField?: string;
+    pluralName?: string;
+}
+/** Minimal request shape so core auth types do not import Express. */
+export interface AdminHttpRequest {
+    headers: Record<string, string | string[] | undefined>;
+    get?(name: string): string | undefined;
+    ip?: string;
+}
+export interface ExternalAuthConfig {
+    mode?: "external";
+    getCurrentUser: (req: AdminHttpRequest) => Promise<AdminUser | null>;
+}
+export interface BuiltInAuthConfig {
+    mode: "built-in";
+    identifier: "email" | "username";
+    userModel?: string;
+    sessionModel?: string;
+    sessionTtlSeconds?: number;
+    secureCookies?: boolean;
+    loginRateLimit?: false | {
+        windowMs?: number;
+        maxAttempts?: number;
+    };
+}
+export type AuthConfig = ExternalAuthConfig | BuiltInAuthConfig;
+export interface AdminAuditEvent {
+    type: "create" | "update" | "delete" | "action";
+    modelName: string;
+    recordIds: Array<string | number>;
+    actor: {
+        id: string;
+        email: string;
+        role: string;
+    };
+    timestamp: Date;
+    metadata?: Record<string, string | number | boolean | null>;
+}
+export interface AuditConfig {
+    write(event: AdminAuditEvent): Promise<void>;
+}
+export interface AdminConfig {
+    adapter: DataAdapter;
+    auth: AuthConfig;
+    audit?: AuditConfig;
+    basePath?: string;
+    siteName?: string;
+    databaseProvider?: "postgresql" | "mysql" | "sqlite" | "sqlserver" | "mongodb";
+}
+export interface PaginatedResponse<T> {
+    records: T[];
+    total: number;
+    page: number;
+    perPage: number;
+    totalPages: number;
+}
+export interface SchemaResponse {
+    identity: {
+        id: string;
+        email: string;
+        role: string;
+        isSuperAdmin: boolean;
+    };
+    authMode: "built-in" | "external";
+    models: Array<{
+        meta: AdminModelMeta;
+        config: {
+            listDisplay: string[];
+            listFilter: string[];
+            searchFields: string[];
+            defaultSort: {
+                field: string;
+                direction: "asc" | "desc";
+            };
+            perPage: number;
+            permissions: {
+                list: boolean;
+                view: boolean;
+                create: boolean;
+                update: boolean;
+                delete: boolean;
+                actions: Record<string, boolean>;
+            };
+            actions: Array<{
+                name: string;
+                label: string;
+            }>;
+        };
+    }>;
+    siteName: string;
+    basePath: string;
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/uiPath.d.ts

@@ -0,0 +1,2 @@
+/** Absolute path to the pre-built admin SPA (`ui/dist`). */
+export declare function getAdminUiDist(): string;

package/dist/uiPath.js

@@ -0,0 +1,7 @@
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+/** Absolute path to the pre-built admin SPA (`ui/dist`). */
+export function getAdminUiDist() {
+    return resolve(dirname(fileURLToPath(import.meta.url)), "../ui/dist");
+}
+//# sourceMappingURL=uiPath.js.map

package/dist/uiPath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uiPath.js","sourceRoot":"","sources":["../src/uiPath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,4DAA4D;AAC5D,MAAM,UAAU,cAAc;IAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;AACzE,CAAC"}

package/dist/validation.d.ts

@@ -0,0 +1,29 @@
+import type { AdminFieldMeta, AdminModelMeta, AdminUser, ModelConfig } from "./types.js";
+import { AdminApiError } from "./errors.js";
+/** An error a route can safely return to an API caller. */
+export declare class RequestValidationError extends AdminApiError {
+    constructor(message: string);
+}
+/**
+ * Conservative name matching for data that should not appear in an admin by
+ * accident. Developers can make a deliberate exception with `{ expose: true }`.
+ */
+export declare function isSensitiveFieldName(name: string): boolean;
+/** True when a field may be included in the admin's schema or a form. */
+export declare function isFieldVisible(field: AdminFieldMeta, config: ModelConfig): boolean;
+/**
+ * Return the scalar fields the admin may accept on create or update. Relation
+ * writes are intentionally excluded from the first CRUD release.
+ */
+export declare function getWritableFields(meta: AdminModelMeta, config: ModelConfig): AdminFieldMeta[];
+/** True when the current administrator can modify this otherwise writable field. */
+export declare function isFieldWritable(field: AdminFieldMeta, config: ModelConfig, adminUser: AdminUser): boolean;
+/** Ensure Prisma never turns a user omission into an opaque 500 response. */
+export declare function assertRequiredCreateFields(meta: AdminModelMeta, config: ModelConfig, adminUser: AdminUser, data: Record<string, unknown>): void;
+/** Validate trusted hook output without applying caller permissions or visibility. */
+export declare function validateHookPayload(meta: AdminModelMeta, body: unknown): Record<string, unknown>;
+/**
+ * Reject unknown, hidden, read-only, and incorrectly typed write properties.
+ * The returned object is safe to pass to the scalar-only Prisma CRUD layer.
+ */
+export declare function validateWritePayload(meta: AdminModelMeta, config: ModelConfig, adminUser: AdminUser, body: unknown): Record<string, unknown>;

package/dist/validation.js

@@ -0,0 +1,147 @@
+import { AdminApiError } from "./errors.js";
+// ============================================================
+// REQUEST VALIDATION
+// ============================================================
+/** An error a route can safely return to an API caller. */
+export class RequestValidationError extends AdminApiError {
+    constructor(message) {
+        super(400, "VALIDATION_ERROR", message);
+        this.name = "RequestValidationError";
+    }
+}
+/**
+ * Conservative name matching for data that should not appear in an admin by
+ * accident. Developers can make a deliberate exception with `{ expose: true }`.
+ */
+export function isSensitiveFieldName(name) {
+    return /password|token|secret|api[_-]?key|credential|private[_-]?key/i.test(name);
+}
+/** True when a field may be included in the admin's schema or a form. */
+export function isFieldVisible(field, config) {
+    const override = config.fields?.[field.name];
+    if (override?.exclude)
+        return false;
+    if (isSensitiveFieldName(field.name))
+        return override?.expose === true;
+    return true;
+}
+/**
+ * Return the scalar fields the admin may accept on create or update. Relation
+ * writes are intentionally excluded from the first CRUD release.
+ */
+export function getWritableFields(meta, config) {
+    return meta.fields.filter((field) => isFieldWritableByConfiguration(field, config));
+}
+function isFieldWritableByConfiguration(field, config) {
+    const override = config.fields?.[field.name];
+    return isFieldVisible(field, config) && field.type !== "relation" && !field.isList && !field.isReadOnly && !override?.readOnly;
+}
+/** True when the current administrator can modify this otherwise writable field. */
+export function isFieldWritable(field, config, adminUser) {
+    if (!isFieldWritableByConfiguration(field, config))
+        return false;
+    const writeRoles = config.fields?.[field.name]?.writeRoles;
+    if (adminUser.isSuperAdmin)
+        return true;
+    if (writeRoles !== undefined)
+        return writeRoles.includes(adminUser.role);
+    return !/^(role|isactive|issuperadmin)$/i.test(field.name);
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function assertFieldValue(field, value) {
+    if (value === null) {
+        if (field.isRequired)
+            throw new RequestValidationError(`Field "${field.name}" cannot be null.`);
+        return;
+    }
+    switch (field.type) {
+        case "string":
+        case "bytes":
+            if (typeof value !== "string")
+                throw new RequestValidationError(`Field "${field.name}" must be a string.`);
+            return;
+        case "number":
+            if (field.nativeType === "Decimal" || field.nativeType === "BigInt") {
+                if (typeof value !== "string" || !/^-?\d+(?:\.\d+)?$/.test(value))
+                    throw new RequestValidationError(`Field "${field.name}" must be a decimal string.`);
+                return;
+            }
+            if (typeof value !== "number" || !Number.isFinite(value))
+                throw new RequestValidationError(`Field "${field.name}" must be a finite number.`);
+            return;
+        case "boolean":
+            if (typeof value !== "boolean")
+                throw new RequestValidationError(`Field "${field.name}" must be a boolean.`);
+            return;
+        case "datetime":
+            if (typeof value !== "string" || Number.isNaN(Date.parse(value)))
+                throw new RequestValidationError(`Field "${field.name}" must be an ISO date-time string.`);
+            return;
+        case "enum":
+            if (typeof value !== "string" || !field.enumValues?.includes(value))
+                throw new RequestValidationError(`Field "${field.name}" must be a valid ${field.nativeType} value.`);
+            return;
+        case "json":
+            if (!isJsonValue(value))
+                throw new RequestValidationError(`Field "${field.name}" must be valid JSON data.`);
+            return;
+        case "relation":
+            throw new RequestValidationError(`Relation field "${field.name}" is not supported for writes yet.`);
+    }
+}
+function isJsonValue(value, depth = 0) {
+    if (depth > 20)
+        return false;
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return true;
+    if (typeof value === "number")
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.length <= 1_000 && value.every((entry) => isJsonValue(entry, depth + 1));
+    return isPlainObject(value) && Object.keys(value).length <= 1_000 && Object.values(value).every((entry) => isJsonValue(entry, depth + 1));
+}
+/** Ensure Prisma never turns a user omission into an opaque 500 response. */
+export function assertRequiredCreateFields(meta, config, adminUser, data) {
+    for (const field of meta.fields) {
+        if (field.type === "relation" || field.isList || field.isReadOnly || !field.isRequired || field.defaultValue !== null)
+            continue;
+        if (data[field.name] === undefined)
+            throw new RequestValidationError(`Field "${field.name}" is required.`);
+    }
+}
+/** Validate trusted hook output without applying caller permissions or visibility. */
+export function validateHookPayload(meta, body) {
+    if (!isPlainObject(body))
+        throw new RequestValidationError("Hook output must be a JSON object.");
+    const fieldsByName = new Map(meta.fields.filter((field) => field.type !== "relation" && !field.isList && !field.isReadOnly).map((field) => [field.name, field]));
+    const data = {};
+    for (const [fieldName, value] of Object.entries(body)) {
+        const field = fieldsByName.get(fieldName);
+        if (!field)
+            throw new RequestValidationError(`Hook output field "${fieldName}" cannot be written.`);
+        assertFieldValue(field, value);
+        data[fieldName] = value;
+    }
+    return data;
+}
+/**
+ * Reject unknown, hidden, read-only, and incorrectly typed write properties.
+ * The returned object is safe to pass to the scalar-only Prisma CRUD layer.
+ */
+export function validateWritePayload(meta, config, adminUser, body) {
+    if (!isPlainObject(body))
+        throw new RequestValidationError("Request body must be a JSON object.");
+    const writableByName = new Map(getWritableFields(meta, config).filter((field) => isFieldWritable(field, config, adminUser)).map((field) => [field.name, field]));
+    const data = {};
+    for (const [fieldName, value] of Object.entries(body)) {
+        const field = writableByName.get(fieldName);
+        if (!field)
+            throw new RequestValidationError(`Field "${fieldName}" cannot be written through the admin.`);
+        assertFieldValue(field, value);
+        data[fieldName] = value;
+    }
+    return data;
+}
+//# sourceMappingURL=validation.js.map

package/dist/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,+DAA+D;AAC/D,qBAAqB;AACrB,+DAA+D;AAE/D,2DAA2D;AAC3D,MAAM,OAAO,sBAAuB,SAAQ,aAAa;IACtD,YAAY,OAAe;QACxB,KAAK,CAAC,GAAG,EAAE,kBAAkB,EAAE,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACxC,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC9C,OAAO,+DAA+D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,KAAqB,EAAE,MAAmB;IACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,QAAQ,EAAE,OAAO;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACvE,OAAO,IAAI,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAoB,EAAE,MAAmB;IACxE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAqB,EAAE,MAAmB;IAC/E,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7C,OAAO,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAClI,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,KAAqB,EAAE,MAAmB,EAAE,SAAoB;IAC7F,IAAI,CAAC,8BAA8B,CAAC,KAAK,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3D,IAAI,SAAS,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACzE,OAAO,CAAC,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAqB,EAAE,KAAc;IAC5D,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAClB,IAAI,KAAK,CAAC,UAAU;YAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,mBAAmB,CAAC,CAAC;QAChG,OAAO;IACV,CAAC;IAED,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,QAAQ,CAAC;QACd,KAAK,OAAO;YACT,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,qBAAqB,CAAC,CAAC;YAC3G,OAAO;QACV,KAAK,QAAQ;YACV,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;oBAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,6BAA6B,CAAC,CAAC;gBACvJ,OAAO;YACV,CAAC;YACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;YAC7I,OAAO;QACV,KAAK,SAAS;YACX,IAAI,OAAO,KAAK,KAAK,SAAS;gBAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,sBAAsB,CAAC,CAAC;YAC7G,OAAO;QACV,KAAK,UAAU;YACZ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,oCAAoC,CAAC,CAAC;YAC7J,OAAO;QACV,KAAK,MAAM;YACR,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,qBAAqB,KAAK,CAAC,UAAU,SAAS,CAAC,CAAC;YAC1K,OAAO;QACV,KAAK,MAAM;YACR,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,4BAA4B,CAAC,CAAC;YAC5G,OAAO;QACV,KAAK,UAAU;YACZ,MAAM,IAAI,sBAAsB,CAAC,mBAAmB,KAAK,CAAC,IAAI,oCAAoC,CAAC,CAAC;IAC1G,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC3C,IAAI,KAAK,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IAChH,OAAO,aAAa,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;AAC7I,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CAAC,IAAoB,EAAE,MAAmB,EAAE,SAAoB,EAAE,IAA6B;IACtI,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI;YAAE,SAAS;QAChI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,KAAK,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC9G,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,mBAAmB,CAAC,IAAoB,EAAE,IAAa;IACpE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,oCAAoC,CAAC,CAAC;IACjG,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACjK,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAsB,CAAC,sBAAsB,SAAS,sBAAsB,CAAC,CAAC;QACpG,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAoB,EAAE,MAAmB,EAAE,SAAoB,EAAE,IAAa;IAChH,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,qCAAqC,CAAC,CAAC;IAElG,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;IACjK,MAAM,IAAI,GAA4B,EAAE,CAAC;IAEzC,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,sBAAsB,CAAC,UAAU,SAAS,wCAAwC,CAAC,CAAC;QAE1G,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IAC3B,CAAC;IAED,OAAO,IAAI,CAAC;AACf,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@paneljs/paneljs",
+  "version": "0.1.0",
+  "description": "Schema-driven admin panel core. Register models, serve a guarded operations UI.",
+  "license": "MIT",
+  "type": "module",
+  "author": "Divinesta",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/divinesta/paneljs.git",
+    "directory": "packages/paneljs"
+  },
+  "bugs": {
+    "url": "https://github.com/divinesta/paneljs/issues"
+  },
+  "homepage": "https://github.com/divinesta/paneljs",
+  "keywords": [
+    "admin",
+    "admin-panel",
+    "express",
+    "prisma",
+    "crud"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist",
+    "ui/dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": "^20.19 || ^22.12 || >=24.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^22.15.3",
+    "typescript": "5.9.2"
+  },
+  "scripts": {
+    "build": "pnpm --dir ui build && tsc -p tsconfig.build.json",
+    "dev": "pnpm --dir ui dev",
+    "lint": "echo \"paneljs: no lint yet\"",
+    "check-types": "tsc --noEmit -p tsconfig.json"
+  }
+}