@vertebr/admin 0.9.0 → 0.10.0

package/dist/runtime/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.VertebrBadRequestError = exports.VertebrEnvError = exports.VertebrNotFoundError = exports.VertebrAuthError = void 0;
+exports.VertebrConflictError = exports.VertebrForbiddenError = exports.VertebrBadRequestError = exports.VertebrEnvError = exports.VertebrNotFoundError = exports.VertebrAuthError = void 0;
 class VertebrAuthError extends Error {
     statusCode = 401;
     constructor(message = "Unauthorized") {
@@ -33,4 +33,20 @@ class VertebrBadRequestError extends Error {
     }
 }
 exports.VertebrBadRequestError = VertebrBadRequestError;
+class VertebrForbiddenError extends Error {
+    statusCode = 403;
+    constructor(message = "Forbidden") {
+        super(message);
+        this.name = "VertebrForbiddenError";
+    }
+}
+exports.VertebrForbiddenError = VertebrForbiddenError;
+class VertebrConflictError extends Error {
+    statusCode = 409;
+    constructor(message = "Conflict") {
+        super(message);
+        this.name = "VertebrConflictError";
+    }
+}
+exports.VertebrConflictError = VertebrConflictError;
 //# sourceMappingURL=errors.js.map

package/dist/runtime/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/runtime/errors.ts"],"names":[],"mappings":";;;AAAA,MAAa,gBAAiB,SAAQ,KAAK;IAChC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,cAAc;QAClC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAND,4CAMC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IACpC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,WAAW;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAND,oDAMC;AAED,MAAa,eAAgB,SAAQ,KAAK;IAC/B,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAND,0CAMC;AAED,MAAa,sBAAuB,SAAQ,KAAK;IACtC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,aAAa;QACjC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAND,wDAMC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/runtime/errors.ts"],"names":[],"mappings":";;;AAAA,MAAa,gBAAiB,SAAQ,KAAK;IAChC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,cAAc;QAClC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAND,4CAMC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IACpC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,WAAW;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAND,oDAMC;AAED,MAAa,eAAgB,SAAQ,KAAK;IAC/B,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,qBAAqB;QACzC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAND,0CAMC;AAED,MAAa,sBAAuB,SAAQ,KAAK;IACtC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,aAAa;QACjC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAND,wDAMC;AAED,MAAa,qBAAsB,SAAQ,KAAK;IACrC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,WAAW;QAC/B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAND,sDAMC;AAED,MAAa,oBAAqB,SAAQ,KAAK;IACpC,UAAU,GAAG,GAAG,CAAC;IAC1B,YAAY,OAAO,GAAG,UAAU;QAC9B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAND,oDAMC"}

package/dist/runtime/services/access.d.ts

@@ -0,0 +1,14 @@
+import type { HandlerContext } from "../../schema";
+import type { AccessDefinition, VertebrCapability } from "../types/access";
+import type { AdminState } from "./state";
+export declare const ALL_CAPABILITY = "*";
+export declare function resolveCapabilities(access: AccessDefinition | null | undefined, ctx: HandlerContext): Promise<string[]>;
+export declare function hasCapability(capabilities: string[] | undefined, required: VertebrCapability | VertebrCapability[]): boolean;
+export declare function assertCapability(ctx: HandlerContext, required: VertebrCapability | VertebrCapability[], message?: string): void;
+export declare function accessFeatures(state: AdminState): {
+    audit: boolean;
+    revisions: boolean;
+    jobs: boolean;
+    health: boolean;
+};
+//# sourceMappingURL=access.d.ts.map

package/dist/runtime/services/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/runtime/services/access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC3E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,EAC3C,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,MAAM,EAAE,CAAC,CAanB;AAED,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,EAClC,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,GAChD,OAAO,CAKT;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE,iBAAiB,GAAG,iBAAiB,EAAE,EACjD,OAAO,CAAC,EAAE,MAAM,GACf,IAAI,CAON;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU;;;;;EAO/C"}

package/dist/runtime/services/access.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ALL_CAPABILITY = void 0;
+exports.resolveCapabilities = resolveCapabilities;
+exports.hasCapability = hasCapability;
+exports.assertCapability = assertCapability;
+exports.accessFeatures = accessFeatures;
+const errors_1 = require("../errors");
+exports.ALL_CAPABILITY = "*";
+async function resolveCapabilities(access, ctx) {
+    if (!access)
+        return [exports.ALL_CAPABILITY];
+    if (access.resolve) {
+        return (await access.resolve(ctx)).map(String);
+    }
+    const roles = ctx.user?.roles ?? [];
+    const caps = new Set();
+    for (const role of roles) {
+        const list = access.roleCapabilities?.[role];
+        if (!list)
+            continue;
+        for (const cap of list)
+            caps.add(cap);
+    }
+    return [...caps];
+}
+function hasCapability(capabilities, required) {
+    if (!capabilities?.length)
+        return true;
+    if (capabilities.includes(exports.ALL_CAPABILITY))
+        return true;
+    const needed = Array.isArray(required) ? required : [required];
+    return needed.some((cap) => capabilities.includes(cap));
+}
+function assertCapability(ctx, required, message) {
+    if (!hasCapability(ctx.capabilities, required)) {
+        const needed = Array.isArray(required) ? required.join(" | ") : required;
+        throw new errors_1.VertebrForbiddenError(message ?? `Missing capability: ${needed}`);
+    }
+}
+function accessFeatures(state) {
+    return {
+        audit: Boolean(state.auditDef),
+        revisions: Boolean(state.revisionDef),
+        jobs: Boolean(state.jobsDef),
+        health: Boolean(state.healthDef),
+    };
+}
+//# sourceMappingURL=access.js.map

package/dist/runtime/services/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/runtime/services/access.ts"],"names":[],"mappings":";;;AAOA,kDAgBC;AAED,sCAQC;AAED,4CAWC;AAED,wCAOC;AAvDD,sCAAkD;AAKrC,QAAA,cAAc,GAAG,GAAG,CAAC;AAE3B,KAAK,UAAU,mBAAmB,CACvC,MAA2C,EAC3C,GAAmB;IAEnB,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,sBAAc,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,KAAK,MAAM,GAAG,IAAI,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAgB,aAAa,CAC3B,YAAkC,EAClC,QAAiD;IAEjD,IAAI,CAAC,YAAY,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,YAAY,CAAC,QAAQ,CAAC,sBAAc,CAAC;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC/D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,gBAAgB,CAC9B,GAAmB,EACnB,QAAiD,EACjD,OAAgB;IAEhB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACzE,MAAM,IAAI,8BAAqB,CAC7B,OAAO,IAAI,uBAAuB,MAAM,EAAE,CAC3C,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAgB,cAAc,CAAC,KAAiB;IAC9C,OAAO;QACL,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QACrC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC;KACjC,CAAC;AACJ,CAAC"}

package/dist/runtime/services/audit.d.ts

@@ -0,0 +1,16 @@
+import type { HandlerContext } from "../../schema";
+import type { AuditRecordInput } from "../types/audit";
+import type { VertebrEvent } from "../types/events";
+import type { AdminState } from "./state";
+export declare function recordAudit(state: AdminState, ctx: HandlerContext, input: AuditRecordInput): Promise<void>;
+export declare function emitEvent(state: AdminState, ctx: HandlerContext, event: VertebrEvent): Promise<void>;
+export declare function actorFromCtx(ctx: HandlerContext): string | null;
+export declare function eventActor(ctx: HandlerContext): {
+    uid: string;
+} | null;
+/** Fire audit + event after a successful mutation. */
+export declare function afterMutation(state: AdminState, ctx: HandlerContext, opts: {
+    audit?: AuditRecordInput;
+    event?: VertebrEvent;
+}): Promise<void>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/runtime/services/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/runtime/services/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAEV,gBAAgB,EACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,wBAAsB,WAAW,CAC/B,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,gBAAgB,GACtB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,cAAc,EACnB,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,cAAc,GAAG,MAAM,GAAG,IAAI,CAE/D;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,cAAc;;SAE7C;AAED,sDAAsD;AACtD,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE;IACJ,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,KAAK,CAAC,EAAE,YAAY,CAAC;CACtB,GACA,OAAO,CAAC,IAAI,CAAC,CAGf"}

package/dist/runtime/services/audit.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.recordAudit = recordAudit;
+exports.emitEvent = emitEvent;
+exports.actorFromCtx = actorFromCtx;
+exports.eventActor = eventActor;
+exports.afterMutation = afterMutation;
+async function recordAudit(state, ctx, input) {
+    const def = state.auditDef;
+    if (!def)
+        return;
+    try {
+        await def.record(input, ctx);
+    }
+    catch {
+        // Never fail the primary mutation because audit write failed.
+    }
+}
+async function emitEvent(state, ctx, event) {
+    const onEvent = state.options.onEvent;
+    if (!onEvent)
+        return;
+    try {
+        await onEvent(event, ctx);
+    }
+    catch {
+        // Host side-effects must not roll back the primary op.
+    }
+}
+function actorFromCtx(ctx) {
+    return ctx.user?.uid ?? null;
+}
+function eventActor(ctx) {
+    return ctx.user?.uid ? { uid: ctx.user.uid } : null;
+}
+/** Fire audit + event after a successful mutation. */
+async function afterMutation(state, ctx, opts) {
+    if (opts.audit)
+        await recordAudit(state, ctx, opts.audit);
+    if (opts.event)
+        await emitEvent(state, ctx, opts.event);
+}
+//# sourceMappingURL=audit.js.map

package/dist/runtime/services/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/runtime/services/audit.ts"],"names":[],"mappings":";;AAQA,kCAYC;AAED,8BAYC;AAED,oCAEC;AAED,gCAEC;AAGD,sCAUC;AA/CM,KAAK,UAAU,WAAW,CAC/B,KAAiB,EACjB,GAAmB,EACnB,KAAuB;IAEvB,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO;IACjB,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,KAAiB,EACjB,GAAmB,EACnB,KAAmB;IAEnB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,uDAAuD;IACzD,CAAC;AACH,CAAC;AAED,SAAgB,YAAY,CAAC,GAAmB;IAC9C,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED,SAAgB,UAAU,CAAC,GAAmB;IAC5C,OAAO,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtD,CAAC;AAED,sDAAsD;AAC/C,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,GAAmB,EACnB,IAGC;IAED,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/runtime/services/environment.d.ts

@@ -1,7 +1,10 @@
 import type { HandlerContext } from "../../schema";
 import type { AdminState } from "./state";
 export declare function resolveEnv(state: AdminState, request: unknown): string;
-export declare function assertAuth(state: AdminState, request: unknown, envId: string): Promise<void>;
+export declare function assertAuth(state: AdminState, request: unknown, envId: string): Promise<{
+    user: HandlerContext["user"];
+    capabilities: string[];
+}>;
 export declare function withEnvContext<T>(state: AdminState, request: unknown, run: (ctx: HandlerContext) => Promise<T> | T): Promise<T>;
 /** Public storefront reads — resolve env, no auth. */
 export declare function withPublicEnvContext<T>(state: AdminState, request: unknown, run: (ctx: HandlerContext) => Promise<T> | T): Promise<T>;

package/dist/runtime/services/environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/runtime/services/environment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CActE;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CA0Cf;AAED,wBAAsB,cAAc,CAAC,CAAC,EACpC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC3C,OAAO,CAAC,CAAC,CAAC,CASZ;AAED,sDAAsD;AACtD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC3C,OAAO,CAAC,CAAC,CAAC,CAQZ"}
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/runtime/services/environment.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAE1C,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,MAAM,CActE;AAED,wBAAsB,UAAU,CAC9B,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC;IAAE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAkDnE;AAED,wBAAsB,cAAc,CAAC,CAAC,EACpC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC3C,OAAO,CAAC,CAAC,CAAC,CAeZ;AAED,sDAAsD;AACtD,wBAAsB,oBAAoB,CAAC,CAAC,EAC1C,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC3C,OAAO,CAAC,CAAC,CAAC,CAQZ"}

package/dist/runtime/services/environment.js

@@ -8,6 +8,7 @@ const constants_1 = require("../constants");
 const errors_1 = require("../errors");
 const auth_1 = require("../utils/auth");
 const http_1 = require("../utils/http");
+const access_1 = require("./access");
 function resolveEnv(state, request) {
     const headers = request.headers;
     const header = (0, http_1.headerValue)(headers, constants_1.VERTEBR_ENV_HEADER);
@@ -54,11 +55,24 @@ async function assertAuth(state, request, envId) {
     if (!allowed) {
         throw new errors_1.VertebrAuthError();
     }
+    const partialCtx = {
+        env: envId,
+        request,
+        user,
+    };
+    const capabilities = await (0, access_1.resolveCapabilities)(state.accessDef, partialCtx);
+    return { user, capabilities };
 }
 async function withEnvContext(state, request, run) {
     const env = resolveEnv(state, request);
-    await assertAuth(state, request, env);
-    const ctx = { env, request, query: (0, http_1.requestQuery)(request) };
+    const { user, capabilities } = await assertAuth(state, request, env);
+    const ctx = {
+        env,
+        request,
+        query: (0, http_1.requestQuery)(request),
+        user,
+        capabilities,
+    };
     const execute = () => Promise.resolve(run(ctx));
     if (state.options.onEnvironment) {
         return state.options.onEnvironment(env, execute);

package/dist/runtime/services/environment.js.map

@@ -1 +1 @@
-{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/runtime/services/environment.ts"],"names":[],"mappings":";;AAOA,gCAcC;AAED,gCA8CC;AAED,wCAaC;AAGD,oDAYC;AAnGD,4CAAkD;AAClD,sCAA8D;AAE9D,wCAA+C;AAC/C,wCAA0D;AAG1D,SAAgB,UAAU,CAAC,KAAiB,EAAE,OAAgB;IAC5D,MAAM,OAAO,GACX,OACD,CAAC,OAAO,CAAC;IACV,MAAM,MAAM,GAAG,IAAA,kBAAW,EAAC,OAAO,EAAE,8BAAkB,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,wBAAe,CACvB,wBAAwB,GAAG,uBAAuB,KAAK,CAAC,YAAY;aACjE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;aACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,KAAiB,EACjB,OAAgB,EAChB,KAAa;IAEb,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,wBAAe,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO;QACrC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC;IACjC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,yBAAgB,CAAC,uCAAuC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,yBAAgB,CACxB,iBAAiB,OAAO,CAAC,QAAQ,IAAI,QAAQ,qBAAqB,WAAW,CAAC,EAAE,GAAG,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,yBAAgB,CACxB,0BAA0B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;QACtD,GAAG,EAAE,KAAK;QACV,IAAI;QACJ,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,yBAAgB,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,OAAgB,EAChB,GAA4C;IAE5C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,GAAG,GAAmB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,mBAAY,EAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,sDAAsD;AAC/C,KAAK,UAAU,oBAAoB,CACxC,KAAiB,EACjB,OAAgB,EAChB,GAA4C;IAE5C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,GAAG,GAAmB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,mBAAY,EAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/runtime/services/environment.ts"],"names":[],"mappings":";;AAQA,gCAcC;AAED,gCAsDC;AAED,wCAmBC;AAGD,oDAYC;AAlHD,4CAAkD;AAClD,sCAA8D;AAE9D,wCAA+C;AAC/C,wCAA0D;AAC1D,qCAA+C;AAG/C,SAAgB,UAAU,CAAC,KAAiB,EAAE,OAAgB;IAC5D,MAAM,OAAO,GACX,OACD,CAAC,OAAO,CAAC;IACV,MAAM,MAAM,GAAG,IAAA,kBAAW,EAAC,OAAO,EAAE,8BAAkB,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,wBAAe,CACvB,wBAAwB,GAAG,uBAAuB,KAAK,CAAC,YAAY;aACjE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;aACtB,IAAI,CAAC,IAAI,CAAC,EAAE,CAChB,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,KAAiB,EACjB,OAAgB,EAChB,KAAa;IAEb,MAAM,WAAW,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC;IACzE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,wBAAe,CAAC,wBAAwB,KAAK,GAAG,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO;QACrC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC;IACjC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,yBAAgB,CAAC,uCAAuC,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,aAAa,IAAI,WAAW,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC7D,MAAM,IAAI,yBAAgB,CACxB,iBAAiB,OAAO,CAAC,QAAQ,IAAI,QAAQ,qBAAqB,WAAW,CAAC,EAAE,GAAG,CACpF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,yBAAgB,CACxB,0BAA0B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrD,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;QACtD,GAAG,EAAE,KAAK;QACV,IAAI;QACJ,WAAW;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,yBAAgB,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,UAAU,GAAmB;QACjC,GAAG,EAAE,KAAK;QACV,OAAO;QACP,IAAI;KACL,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,IAAA,4BAAmB,EAAC,KAAK,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAChC,CAAC;AAEM,KAAK,UAAU,cAAc,CAClC,KAAiB,EACjB,OAAgB,EAChB,GAA4C;IAE5C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrE,MAAM,GAAG,GAAmB;QAC1B,GAAG;QACH,OAAO;QACP,KAAK,EAAE,IAAA,mBAAY,EAAC,OAAO,CAAC;QAC5B,IAAI;QACJ,YAAY;KACb,CAAC;IACF,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC;AAED,sDAAsD;AAC/C,KAAK,UAAU,oBAAoB,CACxC,KAAiB,EACjB,OAAgB,EAChB,GAA4C;IAE5C,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,GAAG,GAAmB,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAA,mBAAY,EAAC,OAAO,CAAC,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAChC,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC"}

package/dist/runtime/services/state.d.ts

@@ -2,6 +2,12 @@ import type { ConfigStore } from "../../store";
 import type { FieldSchema, FontLibraryDefinition, GalleryDefinition } from "../../schema";
 import type { AdminEnvironment, ConfigDefinition, ControlDefinition, CreateAdminOptions, MetricsDefinition, ResourceDefinition, MailDefinition } from "../types";
 import type { AddonCategory } from "../types/addon";
+import type { AccessDefinition } from "../types/access";
+import type { AuditDefinition } from "../types/audit";
+import type { EnvironmentSyncDefinition } from "../types/sync";
+import type { RevisionStore } from "../types/revisions";
+import type { JobsDefinition } from "../types/jobs";
+import type { HealthDefinition } from "../types/health";
 export type ControlMeta = {
     public: boolean;
     store: ConfigStore;
@@ -12,7 +18,6 @@ export type ControlMeta = {
     description?: string;
     category?: AddonCategory;
 };
-import type { EnvironmentSyncDefinition } from "../types/sync";
 /** Mutable registry used by handlers after `createAdmin()`. */
 export type AdminState = {
     options: CreateAdminOptions;
@@ -29,5 +34,10 @@ export type AdminState = {
     fontLibraryDef: FontLibraryDefinition | null;
     mailDef: MailDefinition | null;
     syncDef: EnvironmentSyncDefinition | null;
+    accessDef: AccessDefinition | null;
+    auditDef: AuditDefinition | null;
+    revisionDef: RevisionStore | null;
+    jobsDef: JobsDefinition | null;
+    healthDef: HealthDefinition | null;
 };
 //# sourceMappingURL=state.d.ts.map

package/dist/runtime/services/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/runtime/services/state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE/D,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAAC;CAC3C,CAAC"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/runtime/services/state.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAC1F,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,EACf,MAAM,UAAU,CAAC;AAElB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,WAAW,CAAC;IACnB,QAAQ,CAAC,EAAE,iBAAiB,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B,CAAC;AAEF,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,kBAAkB,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,kBAAkB,EAAE,CAAC;IAChC,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,YAAY,EAAE,gBAAgB,EAAE,CAAC;IACjC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACtC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC7C,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC1C,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;IACjC,WAAW,EAAE,aAAa,GAAG,IAAI,CAAC;IAClC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACpC,CAAC"}

package/dist/runtime/types/access.d.ts

@@ -0,0 +1,28 @@
+import type { HandlerContext } from "../../schema";
+/**
+ * Capability ids used to gate admin panels and mutations.
+ * Hosts may also pass custom strings via `roleCapabilities` / `resolve`.
+ */
+export type VertebrCapability = "overview.read" | "resource.read" | "resource.write" | "resource.delete" | "resource.action" | "config.read" | "config.write" | "config.publish" | "addon.read" | "addon.write" | "addon.publish" | "emails.read" | "emails.send" | "emails.schedule" | "sync.run" | "payments.read" | "payments.refund" | "audit.read" | "gallery.read" | "gallery.write" | "fonts.read" | "fonts.write" | "jobs.read" | "health.read" | string;
+export type AccessDefinition = {
+    /**
+     * Map IdP role → capability ids.
+     * Union of matching roles is used when `resolve` is omitted.
+     */
+    roleCapabilities?: Record<string, VertebrCapability[]>;
+    /**
+     * Custom resolver. When set, takes precedence over `roleCapabilities`.
+     * Return `["*"]` for full access.
+     */
+    resolve?: (ctx: HandlerContext) => VertebrCapability[] | Promise<VertebrCapability[]>;
+};
+export type AccessCatalogMeta = {
+    capabilities: string[];
+    features: {
+        audit: boolean;
+        revisions: boolean;
+        jobs: boolean;
+        health: boolean;
+    };
+};
+//# sourceMappingURL=access.d.ts.map

package/dist/runtime/types/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;;GAGG;AACH,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,iBAAiB,GACjB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,gBAAgB,GAChB,YAAY,GACZ,aAAa,GACb,eAAe,GACf,aAAa,GACb,aAAa,GACb,iBAAiB,GACjB,UAAU,GACV,eAAe,GACf,iBAAiB,GACjB,YAAY,GACZ,cAAc,GACd,eAAe,GACf,YAAY,GACZ,aAAa,GACb,WAAW,GACX,aAAa,GACb,MAAM,CAAC;AAEX,MAAM,MAAM,gBAAgB,GAAG;IAC7B;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACvD;;;OAGG;IACH,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,cAAc,KAChB,iBAAiB,EAAE,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,EAAE;QACR,KAAK,EAAE,OAAO,CAAC;QACf,SAAS,EAAE,OAAO,CAAC;QACnB,IAAI,EAAE,OAAO,CAAC;QACd,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;CACH,CAAC"}

package/dist/runtime/types/access.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=access.js.map

package/dist/runtime/types/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../../src/runtime/types/access.ts"],"names":[],"mappings":""}

package/dist/runtime/types/actions.d.ts

@@ -4,6 +4,8 @@ export type ActionInputField = FieldType | FieldSchema;
 export type ResourceAction<T = unknown> = {
     label: string;
     input?: Record<string, ActionInputField>;
+    /** When true, also available as a bulk action on selected rows. */
+    bulk?: boolean;
     run: (row: T, input: Record<string, unknown> | undefined, ctx: HandlerContext) => Promise<unknown> | unknown;
 };
 /** Resource-level action (no row) — e.g. seed test data. */

package/dist/runtime/types/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3E,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,WAAW,CAAC;AAEvD,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,OAAO,IAAI;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzC,GAAG,EAAE,CACH,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzC,GAAG,EAAE,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC,CAAC"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/actions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE3E,wEAAwE;AACxE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,WAAW,CAAC;AAEvD,MAAM,MAAM,cAAc,CAAC,CAAC,GAAG,OAAO,IAAI;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzC,mEAAmE;IACnE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,GAAG,EAAE,CACH,GAAG,EAAE,CAAC,EACN,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC,CAAC;AAEF,4DAA4D;AAC5D,MAAM,MAAM,oBAAoB,GAAG;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzC,GAAG,EAAE,CACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC1C,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC,CAAC"}

package/dist/runtime/types/admin.d.ts

@@ -1,12 +1,19 @@
 import type { GalleryDefinition, FontLibraryDefinition } from "../../schema";
+import type { AccessDefinition } from "./access";
 import type { AdminAuth, AdminEnvironment } from "./auth";
+import type { AuditDefinition } from "./audit";
 import type { ConfigDefinition, ControlDefinition, PageDefinition } from "./config";
+import type { VertebrEvent } from "./events";
+import type { HealthDefinition } from "./health";
+import type { JobsDefinition } from "./jobs";
 import type { LayoutDefinition } from "./layout";
 import type { MailDefinition } from "./mail";
 import type { MetricsDefinition } from "./metrics";
 import type { ResourceDefinition } from "./resource";
+import type { RevisionStore } from "./revisions";
 import type { EnvironmentSyncDefinition } from "./sync";
 import type { AddonDefinition } from "./addon";
+import type { HandlerContext } from "../../schema";
 export type Connector = {
     id: string;
     register: (admin: Admin) => void;
@@ -37,6 +44,18 @@ export type CreateAdminOptions = {
     onEnvironment?: <T>(env: string, run: () => Promise<T> | T) => Promise<T> | T;
     /** Host context for sales/enterprise installs. Admin chrome stays Vertebr-branded. */
     appearance?: AdminAppearance;
+    /**
+     * Role → capability map (and/or custom resolve).
+     * When omitted, authenticated users get full access after env auth.
+     */
+    access?: AccessDefinition;
+    /** Host-backed revision history for controls/pages/addons. */
+    revisions?: RevisionStore;
+    /**
+     * Fire after successful mutations. Host may enqueue webhooks/queues.
+     * Errors are swallowed so side-effects never roll back the primary op.
+     */
+    onEvent?: (event: VertebrEvent, ctx: HandlerContext) => void | Promise<void>;
 };
 export type Admin = {
     resource: <T = unknown>(def: ResourceDefinition<T>) => Admin;
@@ -83,11 +102,21 @@ export type Admin = {
      * Appears under Add-ons in the sidebar; gated on `enabled` for public API.
      */
     addon: (def: AddonDefinition) => Admin;
+    /** Host-backed audit log (Activity-style board under Analytics). */
+    audit: (def: AuditDefinition) => Admin;
+    /** Host-backed async jobs (poll after actions return `{ jobId }`). */
+    jobs: (def: JobsDefinition) => Admin;
+    /** Host-backed health checks for the top-bar / overview strip. */
+    health: (def: HealthDefinition) => Admin;
     /** Server-side read of a registered config/control (auth not applied). */
     readConfig: (id: string, env: string) => Promise<Record<string, unknown>>;
     use: (connector: Connector) => Admin;
     routes: () => AdminRoute[];
     hapiRoutes: () => HapiCompatibleRoute[];
+    /** Express Router mounting API + SPA (requires `express` peer at runtime). */
+    expressRouter: () => unknown;
+    /** Fastify plugin registering API + SPA (requires `fastify` peer at runtime). */
+    fastifyPlugin: () => unknown;
     resources: () => ResourceDefinition[];
     configs: () => ConfigDefinition[];
     environments: () => AdminEnvironment[];

package/dist/runtime/types/admin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,QAAQ,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAE/C,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,oDAAoD;IACpD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,CAAC,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KACtB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,sFAAsF;IACtF,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;IAC7D,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC;IACzC;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,KAAK,CAAC;IAC3C;;;OAGG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAC;IACrC;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC;IACzC,2CAA2C;IAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,KAAK,CAAC;IAC3C;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,KAAK,CAAC;IAC3C;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,KAAK,CAAC;IACnD;;;OAGG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAC;IACrC;;;OAGG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,yBAAyB,KAAK,KAAK,CAAC;IAChD;;;OAGG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC;IACvC,0EAA0E;IAC1E,UAAU,EAAE,CACV,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,KACR,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,KAAK,CAAC;IACrC,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,mBAAmB,EAAE,CAAC;IACxC,SAAS,EAAE,MAAM,kBAAkB,EAAE,CAAC;IACtC,OAAO,EAAE,MAAM,gBAAgB,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,gBAAgB,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;QAEtB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACvE,CAAC"}
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACpF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAC;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,QAAQ,CAAC;AACxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,MAAM,SAAS,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CAClC,CAAC;AAEF,iFAAiF;AACjF,MAAM,MAAM,eAAe,GAAG;IAC5B,kFAAkF;IAClF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,YAAY,CAAC,EAAE,gBAAgB,EAAE,CAAC;IAClC,oDAAoD;IACpD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,CAAC,EAChB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KACtB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpB,sFAAsF;IACtF,UAAU,CAAC,EAAE,eAAe,CAAC;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,8DAA8D;IAC9D,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,EAAE,CACR,KAAK,EAAE,YAAY,EACnB,GAAG,EAAE,cAAc,KAChB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,EAAE,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;IAC7D,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC;IACzC;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,KAAK,CAAC;IAC3C;;;OAGG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAC;IACrC;;;OAGG;IACH,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC;IACzC,2CAA2C;IAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,KAAK,CAAC;IAC3C;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,KAAK,KAAK,CAAC;IAC3C;;;OAGG;IACH,WAAW,EAAE,CAAC,GAAG,EAAE,qBAAqB,KAAK,KAAK,CAAC;IACnD;;;OAGG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAC;IACrC;;;OAGG;IACH,IAAI,EAAE,CAAC,GAAG,EAAE,yBAAyB,KAAK,KAAK,CAAC;IAChD;;;OAGG;IACH,KAAK,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC;IACvC,oEAAoE;IACpE,KAAK,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,KAAK,CAAC;IACvC,sEAAsE;IACtE,IAAI,EAAE,CAAC,GAAG,EAAE,cAAc,KAAK,KAAK,CAAC;IACrC,kEAAkE;IAClE,MAAM,EAAE,CAAC,GAAG,EAAE,gBAAgB,KAAK,KAAK,CAAC;IACzC,0EAA0E;IAC1E,UAAU,EAAE,CACV,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,KACR,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACtC,GAAG,EAAE,CAAC,SAAS,EAAE,SAAS,KAAK,KAAK,CAAC;IACrC,MAAM,EAAE,MAAM,UAAU,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,mBAAmB,EAAE,CAAC;IACxC,8EAA8E;IAC9E,aAAa,EAAE,MAAM,OAAO,CAAC;IAC7B,iFAAiF;IACjF,aAAa,EAAE,MAAM,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,kBAAkB,EAAE,CAAC;IACtC,OAAO,EAAE,MAAM,gBAAgB,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,gBAAgB,EAAE,CAAC;CACxC,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CAC3D,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;QAEtB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;KACpB,CAAC;IACF,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACvE,CAAC"}

package/dist/runtime/types/audit.d.ts

@@ -0,0 +1,35 @@
+import type { HandlerContext } from "../../schema";
+export type AuditTargetType = "config" | "resource" | "sync" | "mail" | "gallery" | "font" | "payment" | "job" | string;
+export type AuditEntry = {
+    id: string;
+    at: string;
+    env: string;
+    actor: string | null;
+    action: string;
+    targetType: AuditTargetType;
+    targetId: string;
+    summary: string;
+    meta?: Record<string, unknown>;
+};
+export type AuditRecordInput = {
+    action: string;
+    targetType: AuditTargetType;
+    targetId: string;
+    summary: string;
+    meta?: Record<string, unknown>;
+};
+export type AuditListOptions = {
+    limit?: number;
+    cursor?: string;
+    targetType?: string;
+    targetId?: string;
+};
+export type AuditListResult = {
+    items: AuditEntry[];
+    cursor?: string;
+};
+export type AuditDefinition = {
+    list: (opts: AuditListOptions, ctx: HandlerContext) => Promise<AuditListResult> | AuditListResult;
+    record: (entry: AuditRecordInput, ctx: HandlerContext) => Promise<AuditEntry> | AuditEntry;
+};
+//# sourceMappingURL=audit.d.ts.map

package/dist/runtime/types/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/audit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,MAAM,eAAe,GACvB,QAAQ,GACR,UAAU,GACV,MAAM,GACN,MAAM,GACN,SAAS,GACT,MAAM,GACN,SAAS,GACT,KAAK,GACL,MAAM,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,eAAe,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,CACJ,IAAI,EAAE,gBAAgB,EACtB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;IAChD,MAAM,EAAE,CACN,KAAK,EAAE,gBAAgB,EACvB,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,UAAU,CAAC,GAAG,UAAU,CAAC;CACvC,CAAC"}

package/dist/runtime/types/audit.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=audit.js.map

package/dist/runtime/types/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/runtime/types/audit.ts"],"names":[],"mappings":""}

package/dist/runtime/types/auth.d.ts

@@ -28,6 +28,12 @@ export type EnvironmentAuthConfig = {
             messagingSenderId?: string;
         };
         methods?: Array<"email" | "google">;
+    } | {
+        /**
+         * Host supplies tokens via `getAccessToken` / embed props.
+         * Vertebr shell skips built-in Firebase login UI.
+         */
+        provider: "custom";
     };
 };
 export type AdminEnvironment = {

package/dist/runtime/types/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EAAE;QACP,QAAQ,EAAE,UAAU,CAAC;QACrB,MAAM,EAAE;YACN,MAAM,EAAE,MAAM,CAAC;YACf,UAAU,EAAE,MAAM,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC;YAClB,KAAK,EAAE,MAAM,CAAC;YACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;QACF,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;KACrC,CAAC;CACH,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrC,gEAAgE;IAChE,IAAI,CAAC,EAAE,qBAAqB,CAAC;CAC9B,CAAC;AAEF,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,gBAAgB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,gEAAgE;IAChE,OAAO,CAAC,EAAE,CACR,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,WAAW,GAAG,IAAI,CAAC;IACtD;;;OAGG;IACH,KAAK,EAAE,CACL,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,oEAAoE;IACpE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,6DAA6D;IAC7D,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;OAGG;IACH,MAAM,CAAC,EACH;QACE,QAAQ,EAAE,UAAU,CAAC;QACrB,MAAM,EAAE;YACN,MAAM,EAAE,MAAM,CAAC;YACf,UAAU,EAAE,MAAM,CAAC;YACnB,SAAS,EAAE,MAAM,CAAC;YAClB,KAAK,EAAE,MAAM,CAAC;YACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;SAC5B,CAAC;QACF,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC;KACrC,GACD;QACE;;;WAGG;QACH,QAAQ,EAAE,QAAQ,CAAC;KACpB,CAAC;CACP,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,IAAI,CAAC,EAAE,SAAS,GAAG,MAAM,GAAG,QAAQ,CAAC;IACrC,gEAAgE;IAChE,IAAI,CAAC,EAAE,qBAAqB,CAAC;CAC9B,CAAC;AAEF,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,qBAAqB,CAAC,QAAQ,CAAC,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,gBAAgB,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,gEAAgE;IAChE,OAAO,CAAC,EAAE,CACR,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,WAAW,GAAG,IAAI,CAAC;IACtD;;;OAGG;IACH,KAAK,EAAE,CACL,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,WAAW,KACb,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;CACjC,CAAC"}

package/dist/runtime/types/events.d.ts

@@ -0,0 +1,63 @@
+export type VertebrEventActor = {
+    uid: string;
+} | null;
+export type VertebrEvent = {
+    type: "config.saved";
+    controlId: string;
+    env: string;
+    actor: VertebrEventActor;
+    revisionId?: string;
+    published?: boolean;
+} | {
+    type: "config.published";
+    controlId: string;
+    env: string;
+    actor: VertebrEventActor;
+    revisionId: string;
+} | {
+    type: "config.restored";
+    controlId: string;
+    env: string;
+    actor: VertebrEventActor;
+    revisionId: string;
+} | {
+    type: "resource.written";
+    resourceId: string;
+    rowId: string;
+    op: "create" | "update" | "delete";
+    env: string;
+    actor: VertebrEventActor;
+} | {
+    type: "resource.action";
+    resourceId: string;
+    rowId?: string;
+    actionId: string;
+    env: string;
+    actor: VertebrEventActor;
+    jobId?: string;
+} | {
+    type: "sync.completed";
+    from: string;
+    to: string[];
+    ok: boolean;
+    env: string;
+    actor: VertebrEventActor;
+} | {
+    type: "mail.sent";
+    templateId?: string;
+    env: string;
+    actor: VertebrEventActor;
+} | {
+    type: "gallery.changed";
+    op: "upload" | "delete";
+    itemId?: string;
+    env: string;
+    actor: VertebrEventActor;
+} | {
+    type: "font.changed";
+    op: "upload" | "import" | "delete";
+    itemId?: string;
+    env: string;
+    actor: VertebrEventActor;
+};
+//# sourceMappingURL=events.d.ts.map

package/dist/runtime/types/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/events.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;CACb,GAAG,IAAI,CAAC;AAET,MAAM,MAAM,YAAY,GACpB;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GACD;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,EAAE,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,EAAE,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;CAC1B,GACD;IACE,IAAI,EAAE,cAAc,CAAC;IACrB,EAAE,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,iBAAiB,CAAC;CAC1B,CAAC"}

package/dist/runtime/types/events.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=events.js.map

package/dist/runtime/types/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../../src/runtime/types/events.ts"],"names":[],"mappings":""}

package/dist/runtime/types/health.d.ts

@@ -0,0 +1,18 @@
+import type { HandlerContext } from "../../schema";
+export type HealthStatus = "ok" | "warn" | "error";
+export type HealthCheck = {
+    id: string;
+    label: string;
+    status: HealthStatus;
+    detail?: string;
+    checkedAt?: string;
+};
+export type HealthDefinition = {
+    load: (ctx: HandlerContext) => Promise<HealthCheck[]> | HealthCheck[];
+};
+export type HealthResponse = {
+    ok: boolean;
+    checks: HealthCheck[];
+    environment: string;
+};
+//# sourceMappingURL=health.d.ts.map

package/dist/runtime/types/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/runtime/types/health.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,IAAI,GAAG,MAAM,GAAG,OAAO,CAAC;AAEnD,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,YAAY,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,CACJ,GAAG,EAAE,cAAc,KAChB,OAAO,CAAC,WAAW,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC"}

package/dist/runtime/types/health.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=health.js.map

package/dist/runtime/types/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/runtime/types/health.ts"],"names":[],"mappings":""}