@plumix/core 0.1.0

package/dist/rpc/procedures/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/index.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUb,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC"}

package/dist/rpc/procedures/auth/index.js

@@ -0,0 +1,21 @@
+import { allowedDomainsRouter } from "./allowed-domains/index.js";
+import { apiTokensRouter } from "./api-tokens/index.js";
+import { credentialsRouter } from "./credentials/index.js";
+import { deviceFlowRouter } from "./device-flow/index.js";
+import { loginLinks } from "./login-links.js";
+import { mailerRouter } from "./mailer/index.js";
+import { oauthProviders } from "./oauth-providers.js";
+import { session } from "./session.js";
+import { sessionsRouter } from "./sessions/index.js";
+export const authRouter = {
+    session,
+    oauthProviders,
+    loginLinks,
+    allowedDomains: allowedDomainsRouter,
+    credentials: credentialsRouter,
+    sessions: sessionsRouter,
+    mailer: mailerRouter,
+    apiTokens: apiTokensRouter,
+    deviceFlow: deviceFlowRouter,
+};
+//# sourceMappingURL=index.js.map

package/dist/rpc/procedures/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,OAAO;IACP,cAAc;IACd,UAAU;IACV,cAAc,EAAE,oBAAoB;IACpC,WAAW,EAAE,iBAAiB;IAC9B,QAAQ,EAAE,cAAc;IACxB,MAAM,EAAE,YAAY;IACpB,SAAS,EAAE,eAAe;IAC1B,UAAU,EAAE,gBAAgB;CACpB,CAAC"}

package/dist/rpc/procedures/auth/login-links.d.ts

@@ -0,0 +1,66 @@
+export declare const loginLinks: import("@orpc/server").DecoratedProcedure<import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContext, import("@orpc/server").Schema<unknown, unknown>, import("@orpc/server").Schema<{
+    id: string;
+    label: string;
+    href: string;
+}[], {
+    id: string;
+    label: string;
+    href: string;
+}[]>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=login-links.d.ts.map

package/dist/rpc/procedures/auth/login-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-links.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/login-links.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAMtB,CAAC"}

package/dist/rpc/procedures/auth/login-links.js

@@ -0,0 +1,14 @@
+import { base } from "../../base.js";
+// Public — used by the login screen to render plugin-shipped sign-in
+// buttons (SAML, Microsoft, custom SSO). Driven purely by the plugin
+// registry, resolved at app build time; no DB call. Pairs with
+// `oauthProviders` (which surfaces config-driven OAuth entries) — the
+// admin renders both lists. The `id` is `${pluginId}:${key}` — a
+// globally-unique stable React key derived from the plugin attribution
+// the registrar already records.
+export const loginLinks = base.handler(({ context }) => context.plugins.loginLinks.map((link) => ({
+    id: `${link.registeredBy}:${link.key}`,
+    label: link.label,
+    href: link.href,
+})));
+//# sourceMappingURL=login-links.js.map

package/dist/rpc/procedures/auth/login-links.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-links.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/login-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,qEAAqE;AACrE,qEAAqE;AACrE,+DAA+D;AAC/D,sEAAsE;AACtE,iEAAiE;AACjE,uEAAuE;AACvE,iCAAiC;AACjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxC,EAAE,EAAE,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE;IACtC,KAAK,EAAE,IAAI,CAAC,KAAK;IACjB,IAAI,EAAE,IAAI,CAAC,IAAI;CAChB,CAAC,CAAC,CACJ,CAAC"}

package/dist/rpc/procedures/auth/mailer/index.d.ts

@@ -0,0 +1,66 @@
+export declare const mailerRouter: {
+    readonly testSend: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+        readonly to: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").ToLowerCaseAction, import("valibot").EmailAction<string, undefined>, import("valibot").MaxLengthAction<string, 255, undefined>]>;
+    }, undefined>, import("@orpc/server").Schema<{
+        ok: true;
+    }, {
+        ok: true;
+    }>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+        readonly UNAUTHORIZED: {
+            readonly message: "Authentication required";
+        };
+        readonly BAD_REQUEST: {
+            readonly message: "Invalid input";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly FORBIDDEN: {
+            readonly message: "Permission denied";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly capability: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly NOT_FOUND: {
+            readonly message: "Resource not found";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly kind: import("valibot").StringSchema<undefined>;
+                readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+            }, undefined>;
+        };
+        readonly CONFLICT: {
+            readonly message: "Resource conflict";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly reason: import("valibot").StringSchema<undefined>;
+                readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly PAYLOAD_TOO_LARGE: {
+            readonly message: "Payload too large";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly limit: import("valibot").NumberSchema<undefined>;
+                readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+            }, undefined>;
+        };
+        readonly UNSUPPORTED_MEDIA_TYPE: {
+            readonly message: "Unsupported media type";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly mime: import("valibot").StringSchema<undefined>;
+            }, undefined>;
+        };
+        readonly INVALID_BLOCK_CONTENT: {
+            readonly message: "Block content failed registry validation";
+            readonly data: import("valibot").ObjectSchema<{
+                readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                    readonly code: import("valibot").StringSchema<undefined>;
+                    readonly message: import("valibot").StringSchema<undefined>;
+                    readonly path: import("valibot").StringSchema<undefined>;
+                    readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                    readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                }, undefined>, undefined>;
+            }, undefined>;
+        };
+    }>, Record<never, never>>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/rpc/procedures/auth/mailer/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/mailer/index.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAEf,CAAC"}

package/dist/rpc/procedures/auth/mailer/index.js

@@ -0,0 +1,5 @@
+import { testSend } from "./test-send.js";
+export const mailerRouter = {
+    testSend,
+};
+//# sourceMappingURL=index.js.map

package/dist/rpc/procedures/auth/mailer/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/mailer/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,QAAQ;CACA,CAAC"}

package/dist/rpc/procedures/auth/mailer/schemas.d.ts

@@ -0,0 +1,5 @@
+import * as v from "valibot";
+export declare const mailerTestSendInputSchema: v.ObjectSchema<{
+    readonly to: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.ToLowerCaseAction, v.EmailAction<string, undefined>, v.MaxLengthAction<string, 255, undefined>]>;
+}, undefined>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/rpc/procedures/auth/mailer/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/mailer/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,eAAO,MAAM,yBAAyB;;aAQpC,CAAC"}

package/dist/rpc/procedures/auth/mailer/schemas.js

@@ -0,0 +1,5 @@
+import * as v from "valibot";
+export const mailerTestSendInputSchema = v.object({
+    to: v.pipe(v.string(), v.trim(), v.toLowerCase(), v.email(), v.maxLength(255)),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/rpc/procedures/auth/mailer/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/mailer/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,IAAI,CACR,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,IAAI,EAAE,EACR,CAAC,CAAC,WAAW,EAAE,EACf,CAAC,CAAC,KAAK,EAAE,EACT,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CACjB;CACF,CAAC,CAAC"}

package/dist/rpc/procedures/auth/mailer/test-send.d.ts

@@ -0,0 +1,64 @@
+export declare const testSend: import("@orpc/server").DecoratedProcedure<import("@orpc/server").MergedInitialContext<import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContextBase<typeof import("../../../../db/schema/index.js")> & import("../../../../index.js").AppContextExtensions & Record<never, never>, import("../../../../index.js").AppContext>, import("@orpc/server").MergedCurrentContext<import("../../../../index.js").AppContext, import("../../../../index.js").AuthenticatedAppContext<typeof import("../../../../db/schema/index.js")>>, import("valibot").ObjectSchema<{
+    readonly to: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<undefined>, import("valibot").TrimAction, import("valibot").ToLowerCaseAction, import("valibot").EmailAction<string, undefined>, import("valibot").MaxLengthAction<string, 255, undefined>]>;
+}, undefined>, import("@orpc/server").Schema<{
+    ok: true;
+}, {
+    ok: true;
+}>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=test-send.d.ts.map

package/dist/rpc/procedures/auth/mailer/test-send.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-send.d.ts","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/mailer/test-send.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA6BjB,CAAC"}

package/dist/rpc/procedures/auth/mailer/test-send.js

@@ -0,0 +1,44 @@
+import { authenticated } from "../../../authenticated.js";
+import { base } from "../../../base.js";
+import { mailerTestSendInputSchema } from "./schemas.js";
+const CAPABILITY = "settings:manage";
+// Operator sanity check: send a one-shot test email through the
+// configured mailer adapter. Used post-deploy to confirm the magic-link
+// flow will actually deliver. Distinct from the magic-link request
+// path — that one swallows mailer failures (always-success contract);
+// this one reports the mailer's error verbatim so the operator can
+// debug the adapter.
+//
+// Capability-gated to `settings:manage` (admin-equivalent in the
+// default RBAC) — the recipient is operator-supplied input, so we
+// don't want every authed user able to fire emails.
+export const testSend = base
+    .use(authenticated)
+    .input(mailerTestSendInputSchema)
+    .handler(async ({ input, context, errors }) => {
+    if (!context.auth.can(CAPABILITY)) {
+        throw errors.FORBIDDEN({ data: { capability: CAPABILITY } });
+    }
+    if (!context.mailer) {
+        throw errors.CONFLICT({ data: { reason: "mailer_not_configured" } });
+    }
+    try {
+        await context.mailer.send({
+            to: input.to,
+            subject: "Plumix mailer test",
+            text: `This is a test message from Plumix.\n` +
+                `\n` +
+                `If you can read this, your mailer adapter is wired up correctly ` +
+                `and magic-link sign-in / invite emails will reach recipients.\n`,
+        });
+    }
+    catch (err) {
+        // Surface the underlying error so the operator can debug their
+        // adapter — distinct from the magic-link request flow which
+        // intentionally swallows for the always-success contract.
+        context.logger.warn("mailer_test_send_failed", { error: err });
+        throw errors.CONFLICT({ data: { reason: "mailer_send_failed" } });
+    }
+    return { ok: true };
+});
+//# sourceMappingURL=test-send.js.map

package/dist/rpc/procedures/auth/mailer/test-send.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-send.js","sourceRoot":"","sources":["../../../../../src/rpc/procedures/auth/mailer/test-send.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,UAAU,GAAG,iBAAiB,CAAC;AAErC,gEAAgE;AAChE,wEAAwE;AACxE,mEAAmE;AACnE,sEAAsE;AACtE,mEAAmE;AACnE,qBAAqB;AACrB,EAAE;AACF,iEAAiE;AACjE,kEAAkE;AAClE,oDAAoD;AACpD,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI;KACzB,GAAG,CAAC,aAAa,CAAC;KAClB,KAAK,CAAC,yBAAyB,CAAC;KAChC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;IAC5C,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;YACxB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,OAAO,EAAE,oBAAoB;YAC7B,IAAI,EACF,uCAAuC;gBACvC,IAAI;gBACJ,kEAAkE;gBAClE,iEAAiE;SACpE,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,+DAA+D;QAC/D,4DAA4D;QAC5D,0DAA0D;QAC1D,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/D,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;AAC/B,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/auth/oauth-providers.d.ts

@@ -0,0 +1,59 @@
+import type { OAuthProviderSummary } from "../../../runtime/app.js";
+export declare const oauthProviders: import("@orpc/server").DecoratedProcedure<import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContext, import("@orpc/server").Schema<unknown, unknown>, import("@orpc/server").Schema<readonly OAuthProviderSummary[], readonly OAuthProviderSummary[]>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=oauth-providers.d.ts.map

package/dist/rpc/procedures/auth/oauth-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-providers.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/oauth-providers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAQpE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAE1B,CAAC"}

package/dist/rpc/procedures/auth/oauth-providers.js

@@ -0,0 +1,8 @@
+import { base } from "../../base.js";
+// Public — used by the login screen to render provider buttons. Driven
+// purely by config (resolved at app build time); no DB call. Returning
+// `[]` means "passkey-only", which the admin already knows how to
+// render. Each entry carries `key` (URL path segment) and `label`
+// (human-readable) so the admin doesn't need a separate lookup table.
+export const oauthProviders = base.handler(({ context }) => context.oauthProviders);
+//# sourceMappingURL=oauth-providers.js.map

package/dist/rpc/procedures/auth/oauth-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-providers.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/oauth-providers.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,kEAAkE;AAClE,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CACxC,CAAC,EAAE,OAAO,EAAE,EAAmC,EAAE,CAAC,OAAO,CAAC,cAAc,CACzE,CAAC"}

package/dist/rpc/procedures/auth/schemas.d.ts

@@ -0,0 +1,27 @@
+import * as v from "valibot";
+export declare const authSessionOutputSchema: v.ObjectSchema<{
+    readonly user: v.NullableSchema<v.ObjectSchema<{
+        readonly id: v.SchemaWithPipe<readonly [v.NumberSchema<undefined>, v.IntegerAction<number, undefined>, v.MinValueAction<number, 1, undefined>, v.MaxValueAction<number, number, undefined>]>;
+        readonly email: v.StringSchema<undefined>;
+        readonly name: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly avatarUrl: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+        readonly role: v.PicklistSchema<readonly ["subscriber", "contributor", "author", "editor", "admin"], undefined>;
+        /**
+         * Effective capability names granted to this user — core + derived
+         * post-type/taxonomy caps + plugin-defined caps, resolved server-side
+         * from the role hierarchy. The admin uses this to gate nav items and
+         * UI actions without re-implementing the role → capability mapping.
+         */
+        readonly capabilities: v.ArraySchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
+    /**
+     * True when the instance has zero users — the admin UI should route to
+     * the first-admin bootstrap screen instead of the sign-in form. False
+     * whenever `user` is non-null (an authed caller means at least one
+     * user exists).
+     */
+    readonly needsBootstrap: v.BooleanSchema<undefined>;
+}, undefined>;
+export type AuthSessionOutput = v.InferOutput<typeof authSessionOutputSchema>;
+export type AuthSessionUser = NonNullable<AuthSessionOutput["user"]>;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/rpc/procedures/auth/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAoB7B,eAAO,MAAM,uBAAuB;;;;;;;QATlC;;;;;WAKG;;;IAMH;;;;;OAKG;;aAEH,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAC9E,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC"}

package/dist/rpc/procedures/auth/schemas.js

@@ -0,0 +1,28 @@
+import * as v from "valibot";
+import { USER_ROLES } from "../../../db/schema/users.js";
+import { idParam } from "../../validation.js";
+const sessionUserSchema = v.object({
+    id: idParam,
+    email: v.string(),
+    name: v.nullable(v.string()),
+    avatarUrl: v.nullable(v.string()),
+    role: v.picklist(USER_ROLES),
+    /**
+     * Effective capability names granted to this user — core + derived
+     * post-type/taxonomy caps + plugin-defined caps, resolved server-side
+     * from the role hierarchy. The admin uses this to gate nav items and
+     * UI actions without re-implementing the role → capability mapping.
+     */
+    capabilities: v.array(v.string()),
+});
+export const authSessionOutputSchema = v.object({
+    user: v.nullable(sessionUserSchema),
+    /**
+     * True when the instance has zero users — the admin UI should route to
+     * the first-admin bootstrap screen instead of the sign-in form. False
+     * whenever `user` is non-null (an authed caller means at least one
+     * user exists).
+     */
+    needsBootstrap: v.boolean(),
+});
+//# sourceMappingURL=schemas.js.map

package/dist/rpc/procedures/auth/schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/schemas.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,OAAO;IACX,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;IAC5B;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACnC;;;;;OAKG;IACH,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC"}

package/dist/rpc/procedures/auth/session.d.ts

@@ -0,0 +1,78 @@
+export declare const session: import("@orpc/server").DecoratedProcedure<import("../../../index.js").AppContextBase<typeof import("../../../db/schema/index.js")> & import("../../../index.js").AppContextExtensions & Record<never, never>, import("../../../index.js").AppContext, import("@orpc/server").Schema<unknown, unknown>, import("@orpc/server").Schema<{
+    user: {
+        id: number;
+        email: string;
+        name: string | null;
+        avatarUrl: string | null;
+        role: "subscriber" | "contributor" | "author" | "editor" | "admin";
+        capabilities: string[];
+    } | null;
+    needsBootstrap: boolean;
+}, {
+    user: {
+        id: number;
+        email: string;
+        name: string | null;
+        avatarUrl: string | null;
+        role: "subscriber" | "contributor" | "author" | "editor" | "admin";
+        capabilities: string[];
+    } | null;
+    needsBootstrap: boolean;
+}>, import("@orpc/server").MergedErrorMap<Record<never, never>, {
+    readonly UNAUTHORIZED: {
+        readonly message: "Authentication required";
+    };
+    readonly BAD_REQUEST: {
+        readonly message: "Invalid input";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly FORBIDDEN: {
+        readonly message: "Permission denied";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly capability: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly NOT_FOUND: {
+        readonly message: "Resource not found";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly kind: import("valibot").StringSchema<undefined>;
+            readonly id: import("valibot").UnionSchema<[import("valibot").StringSchema<undefined>, import("valibot").NumberSchema<undefined>], undefined>;
+        }, undefined>;
+    };
+    readonly CONFLICT: {
+        readonly message: "Resource conflict";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly reason: import("valibot").StringSchema<undefined>;
+            readonly key: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly PAYLOAD_TOO_LARGE: {
+        readonly message: "Payload too large";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly limit: import("valibot").NumberSchema<undefined>;
+            readonly received: import("valibot").OptionalSchema<import("valibot").NumberSchema<undefined>, undefined>;
+        }, undefined>;
+    };
+    readonly UNSUPPORTED_MEDIA_TYPE: {
+        readonly message: "Unsupported media type";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly mime: import("valibot").StringSchema<undefined>;
+        }, undefined>;
+    };
+    readonly INVALID_BLOCK_CONTENT: {
+        readonly message: "Block content failed registry validation";
+        readonly data: import("valibot").ObjectSchema<{
+            readonly issues: import("valibot").ArraySchema<import("valibot").ObjectSchema<{
+                readonly code: import("valibot").StringSchema<undefined>;
+                readonly message: import("valibot").StringSchema<undefined>;
+                readonly path: import("valibot").StringSchema<undefined>;
+                readonly nodeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly attributeName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+                readonly markName: import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>;
+            }, undefined>, undefined>;
+        }, undefined>;
+    };
+}>, Record<never, never>>;
+//# sourceMappingURL=session.d.ts.map

package/dist/rpc/procedures/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/session.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBAuBnB,CAAC"}

package/dist/rpc/procedures/auth/session.js

@@ -0,0 +1,32 @@
+import { readSessionCookie } from "../../../auth/cookies.js";
+import { capabilitiesForRole } from "../../../auth/rbac.js";
+import { validateSession } from "../../../auth/sessions.js";
+import { users } from "../../../db/schema/users.js";
+import { base } from "../../base.js";
+// Public (no `authenticated` middleware). This is the admin's boot probe: it
+// returns the current user when a valid session cookie is present, otherwise
+// null — and tells the UI whether the instance needs bootstrapping so we can
+// route to /bootstrap vs /login without a separate round-trip.
+export const session = base.handler(async ({ context }) => {
+    const token = readSessionCookie(context.request);
+    if (token) {
+        const validated = await validateSession(context.db, token);
+        if (validated) {
+            const { id, email, name, avatarUrl, role } = validated.user;
+            return {
+                user: {
+                    id,
+                    email,
+                    name,
+                    avatarUrl,
+                    role,
+                    capabilities: [...capabilitiesForRole(role, context.plugins)],
+                },
+                needsBootstrap: false,
+            };
+        }
+    }
+    const userCount = await context.db.$count(users);
+    return { user: null, needsBootstrap: userCount === 0 };
+});
+//# sourceMappingURL=session.js.map

package/dist/rpc/procedures/auth/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../../src/rpc/procedures/auth/session.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAErC,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CACjC,KAAK,EAAE,EAAE,OAAO,EAAE,EAA8B,EAAE;IAChD,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3D,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC;YAC5D,OAAO;gBACL,IAAI,EAAE;oBACJ,EAAE;oBACF,KAAK;oBACL,IAAI;oBACJ,SAAS;oBACT,IAAI;oBACJ,YAAY,EAAE,CAAC,GAAG,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;iBAC9D;gBACD,cAAc,EAAE,KAAK;aACtB,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,KAAK,CAAC,EAAE,CAAC;AACzD,CAAC,CACF,CAAC"}