covara 0.0.1 → 0.6.0

package/dist/ui/middleware.js

@@ -0,0 +1,1175 @@
+import { Hono } from "hono";
+import { eq, and, count, getTableColumns } from "drizzle-orm";
+import { getResourceSchema, getSchemaInfo, getAllResourcesForDisplay } from "./schema-registry.js";
+import { createResourceFilter } from "../resource/filter.js";
+import { createPagination, decodeCursorLegacy, parseOrderBy } from "../resource/pagination.js";
+import { readJsonBody } from "../server/request.js";
+import { readEnv } from "../server/env.js";
+import { createAdminAuthMiddleware, getAdminAuditLog, detectEnvironment, setAdminAuditSink, } from "./admin-auth.js";
+import { createDataExplorerRoutes } from "./data-explorer.js";
+import { createTaskMonitorRoutes } from "./task-monitor.js";
+import { createKVInspectorRoutes } from "./kv-inspector.js";
+import { layout } from "./html/layout.js";
+import * as pages from "./html/pages/index.js";
+import { html, escapeHtml } from "./html/utils.js";
+import { emptyState } from "./html/components/index.js";
+const requestLogs = [];
+const errorLogs = [];
+const MAX_LOGS = 500;
+const MAX_AUDIT_EXPORT = 1000;
+export const logRequest = (log) => {
+    requestLogs.unshift(log);
+    if (requestLogs.length > MAX_LOGS)
+        requestLogs.pop();
+};
+export const logError = (log) => {
+    errorLogs.unshift(log);
+    if (errorLogs.length > MAX_LOGS)
+        errorLogs.pop();
+};
+export const createAdminUI = (config = {}) => {
+    const router = new Hono();
+    const basePath = config.basePath || "/__covara";
+    const title = config.title || "Covara Admin";
+    const mode = config.security?.mode ?? detectEnvironment();
+    // Admin auth middleware for protected routes
+    const adminAuth = createAdminAuthMiddleware(config.security ?? {});
+    if (config.security?.auditSink) {
+        setAdminAuditSink(config.security.auditSink);
+    }
+    // Gate the entire admin surface (UI pages, partials, and JSON APIs) behind
+    // the admin auth check so it cannot be reached without passing authn/authz.
+    router.use("/ui", adminAuth);
+    router.use("/ui/*", adminAuth);
+    router.use("/api", adminAuth);
+    router.use("/api/*", adminAuth);
+    router.use("/admin", adminAuth);
+    router.use("/admin/*", adminAuth);
+    // Mount sub-routers for new features
+    if (config.dataExplorer?.enabled !== false) {
+        const dataExplorerRouter = createDataExplorerRoutes(config.dataExplorer ?? {}, config.security ?? {});
+        router.use("/api/explorer", adminAuth);
+        router.use("/api/explorer/*", adminAuth);
+        router.route("/api/explorer", dataExplorerRouter);
+    }
+    if (config.taskMonitor?.enabled) {
+        const taskMonitorRouter = createTaskMonitorRoutes(config.taskMonitor);
+        router.use("/api/tasks", adminAuth);
+        router.use("/api/tasks/*", adminAuth);
+        router.route("/api/tasks", taskMonitorRouter);
+    }
+    if (config.kvInspector?.enabled) {
+        const kvInspectorRouter = createKVInspectorRoutes(config.kvInspector, config.security ?? {});
+        router.use("/api/kv", adminAuth);
+        router.use("/api/kv/*", adminAuth);
+        router.route("/api/kv", kvInspectorRouter);
+    }
+    // Admin audit log endpoint
+    router.get("/api/admin-audit", adminAuth, (c) => {
+        const limit = parseInt(String(c.req.query("limit"))) || 100;
+        const offset = parseInt(String(c.req.query("offset"))) || 0;
+        const entries = getAdminAuditLog(limit, offset);
+        return c.json({ entries, mode });
+    });
+    // Admin audit export endpoint
+    router.get("/api/admin-audit/export", adminAuth, (c) => {
+        const format = c.req.query("format") || 'json';
+        const entries = getAdminAuditLog(1000, 0);
+        if (format === 'csv') {
+            const headers = ['timestamp', 'userId', 'userEmail', 'operation', 'resource', 'resourceId', 'reason'];
+            const csvRows = [headers.join(',')];
+            for (const entry of entries) {
+                const row = headers.map(h => {
+                    const val = entry[h];
+                    if (val === undefined || val === null)
+                        return '';
+                    const str = String(val);
+                    return str.includes(',') || str.includes('"') ? `"${str.replace(/"/g, '""')}"` : str;
+                });
+                csvRows.push(row.join(','));
+            }
+            c.header('Content-Type', 'text/csv');
+            c.header('Content-Disposition', 'attachment; filename="audit-log.csv"');
+            return c.body(csvRows.join('\n'));
+        }
+        else {
+            c.header('Content-Disposition', 'attachment; filename="audit-log.json"');
+            return c.json(entries);
+        }
+    });
+    // Canonical JSON audit export endpoint (authz-gated via /admin/* router.use above)
+    router.get("/admin/audit/export", adminAuth, (c) => {
+        const entries = getAdminAuditLog(MAX_AUDIT_EXPORT, 0);
+        c.header("Content-Disposition", 'attachment; filename="audit-log.json"');
+        return c.json({ entries, mode, exportedAt: new Date().toISOString() });
+    });
+    // Environment info endpoint
+    router.get("/api/environment", (c) => {
+        const dataExplorerEnabled = config.dataExplorer?.enabled !== false;
+        const dataExplorerReadOnly = config.dataExplorer?.readOnly ?? (mode === "production" ? true : false);
+        return c.json({
+            mode,
+            version: readEnv("npm_package_version") ?? "unknown",
+            features: {
+                dataExplorer: dataExplorerEnabled,
+                dataExplorerReadOnly,
+                taskMonitor: config.taskMonitor?.enabled ?? false,
+                kvInspector: config.kvInspector?.enabled ?? false,
+                authRequired: config.security?.auth?.disabled !== true,
+            },
+        });
+    });
+    // API endpoints
+    router.get("/api/resources", (c) => {
+        const resources = getAllResourcesForDisplay();
+        return c.json({ resources });
+    });
+    router.get("/api/metrics", (c) => {
+        if (!config.metricsCollector) {
+            return c.json({ metrics: [], enabled: false });
+        }
+        const recent = config.metricsCollector.getRecent(200);
+        const slow = config.metricsCollector.getSlow(500);
+        return c.json({ metrics: recent, slowQueries: slow, enabled: true });
+    });
+    router.get("/api/requests", (c) => {
+        return c.json({ requests: requestLogs.slice(0, 200) });
+    });
+    router.get("/api/errors", (c) => {
+        return c.json({ errors: errorLogs.slice(0, 100) });
+    });
+    router.get("/api/changelog", async (c) => {
+        if (!config.changelog) {
+            return c.json({ entries: [], currentSeq: 0, enabled: false });
+        }
+        try {
+            const currentSeq = await config.changelog.getCurrentSequence();
+            const entries = await config.changelog.getEntries(Math.max(0, currentSeq - 50), 50);
+            return c.json({ entries, currentSeq, enabled: true });
+        }
+        catch {
+            return c.json({ entries: [], currentSeq: 0, enabled: false });
+        }
+    });
+    router.get("/api/subscriptions", (c) => {
+        if (!config.getActiveSubscriptions) {
+            return c.json({ subscriptions: [], enabled: false });
+        }
+        return c.json({ subscriptions: config.getActiveSubscriptions(), enabled: true });
+    });
+    router.post("/api/query", async (c) => {
+        const { resource, filter, limit = 10 } = (await readJsonBody(c));
+        try {
+            const url = `${resource}?filter=${encodeURIComponent(filter || "")}&limit=${limit}`;
+            return c.json({ url, note: "Execute this query via the main API" });
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
+    });
+    // User management API endpoints
+    router.get("/api/users", async (c) => {
+        if (!config.userManager) {
+            return c.json({ users: [], total: 0, enabled: false });
+        }
+        try {
+            const limit = parseInt(String(c.req.query("limit"))) || 50;
+            const offset = parseInt(String(c.req.query("offset"))) || 0;
+            const result = await config.userManager.listUsers(limit, offset);
+            return c.json({ ...result, enabled: true });
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 500);
+        }
+    });
+    router.get("/api/users/:id", async (c) => {
+        if (!config.userManager) {
+            return c.json({ error: "User management not configured" }, 501);
+        }
+        try {
+            const userId = c.req.param("id");
+            const user = await config.userManager.getUser(userId);
+            if (!user) {
+                return c.json({ error: "User not found" }, 404);
+            }
+            return c.json({ user });
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 500);
+        }
+    });
+    router.post("/api/users", async (c) => {
+        if (!config.userManager) {
+            return c.json({ error: "User management not configured" }, 501);
+        }
+        try {
+            const body = (await readJsonBody(c));
+            const user = await config.userManager.createUser(body);
+            return c.json({ user }, 201);
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
+    });
+    router.patch("/api/users/:id", async (c) => {
+        if (!config.userManager) {
+            return c.json({ error: "User management not configured" }, 501);
+        }
+        try {
+            const userId = c.req.param("id");
+            const body = (await readJsonBody(c));
+            const user = await config.userManager.updateUser(userId, body);
+            return c.json({ user });
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
+    });
+    router.delete("/api/users/:id", async (c) => {
+        if (!config.userManager) {
+            return c.json({ error: "User management not configured" }, 501);
+        }
+        try {
+            const userId = c.req.param("id");
+            await config.userManager.deleteUser(userId);
+            return c.body(null, 204);
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
+    });
+    // Session management API endpoints
+    router.get("/api/sessions", async (c) => {
+        if (!config.sessionManager) {
+            return c.json({ sessions: [], enabled: false });
+        }
+        try {
+            const limit = parseInt(String(c.req.query("limit"))) || 50;
+            const sessions = await config.sessionManager.listSessions(limit);
+            return c.json({ sessions, enabled: true });
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 500);
+        }
+    });
+    router.get("/api/sessions/user/:userId", async (c) => {
+        if (!config.sessionManager) {
+            return c.json({ error: "Session management not configured" }, 501);
+        }
+        try {
+            const userId = c.req.param("userId");
+            const sessions = await config.sessionManager.getSessionsByUser(userId);
+            return c.json({ sessions });
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 500);
+        }
+    });
+    router.post("/api/sessions", async (c) => {
+        if (!config.sessionManager) {
+            return c.json({ error: "Session management not configured" }, 501);
+        }
+        try {
+            const { userId, expiresIn } = (await readJsonBody(c));
+            if (!userId) {
+                return c.json({ error: "userId is required" }, 400);
+            }
+            const session = await config.sessionManager.createSession(userId, expiresIn);
+            return c.json({ session }, 201);
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
+    });
+    router.delete("/api/sessions/:id", async (c) => {
+        if (!config.sessionManager) {
+            return c.json({ error: "Session management not configured" }, 501);
+        }
+        try {
+            const sessionId = c.req.param("id");
+            await config.sessionManager.revokeSession(sessionId);
+            return c.body(null, 204);
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
+    });
+    router.delete("/api/sessions/user/:userId", async (c) => {
+        if (!config.sessionManager) {
+            return c.json({ error: "Session management not configured" }, 501);
+        }
+        try {
+            const userId = c.req.param("userId");
+            const count = await config.sessionManager.revokeAllUserSessions(userId);
+            return c.json({ revokedCount: count });
+        }
+        catch (e) {
+            return c.json({ error: e.message }, 400);
+        }
+    });
+    // Problem details documentation
+    router.get("/problems/:type", (c) => {
+        const problemDocs = {
+            "not-found": {
+                title: "Resource Not Found",
+                description: "The requested resource does not exist or you do not have permission to access it.",
+                solutions: [
+                    "Verify the resource ID is correct",
+                    "Check that the resource exists in the database",
+                    "Ensure you have read permissions for this resource",
+                    "If using auth scopes, verify your scope includes this resource"
+                ]
+            },
+            "validation-error": {
+                title: "Validation Error",
+                description: "The request body failed validation against the schema.",
+                solutions: [
+                    "Check the required fields are present",
+                    "Verify field types match the schema",
+                    "Review the 'errors' array in the response for specific issues",
+                    "Use the Schema Viewer to see field requirements"
+                ]
+            },
+            "unauthorized": {
+                title: "Unauthorized",
+                description: "Authentication is required to access this resource.",
+                solutions: [
+                    "Include a valid authentication token",
+                    "Check if your session has expired",
+                    "Verify the auth middleware is configured correctly"
+                ]
+            },
+            "forbidden": {
+                title: "Forbidden",
+                description: "You do not have permission to perform this operation.",
+                solutions: [
+                    "Check your user role and permissions",
+                    "Verify the auth scope allows this operation",
+                    "Contact an administrator for access"
+                ]
+            },
+            "rate-limit-exceeded": {
+                title: "Rate Limit Exceeded",
+                description: "Too many requests in the current time window.",
+                solutions: [
+                    "Wait before making more requests",
+                    "Check the Retry-After header for wait time",
+                    "Consider implementing request batching",
+                    "Review rate limit configuration"
+                ]
+            },
+            "batch-limit-exceeded": {
+                title: "Batch Limit Exceeded",
+                description: "The batch operation exceeds the configured limit.",
+                solutions: [
+                    "Reduce the number of items in the batch",
+                    "Check the batch limits in resource configuration",
+                    "Split the operation into multiple smaller batches"
+                ]
+            },
+            "filter-parse-error": {
+                title: "Filter Parse Error",
+                description: "The filter expression could not be parsed.",
+                solutions: [
+                    "Check the filter syntax",
+                    "Use the Filter Tester to validate expressions",
+                    "Ensure strings are properly quoted",
+                    "Review supported operators"
+                ]
+            },
+            "internal-error": {
+                title: "Internal Server Error",
+                description: "An unexpected error occurred on the server.",
+                solutions: [
+                    "Check the server logs for details",
+                    "Review the Error Log in the admin panel",
+                    "If the issue persists, report it with the request ID"
+                ]
+            },
+            "conflict": {
+                title: "Conflict",
+                description: "The request conflicts with the current state of the resource.",
+                solutions: [
+                    "Check if the resource was modified by another request",
+                    "Refetch the resource and retry",
+                    "Use ETag headers for optimistic concurrency control"
+                ]
+            },
+            "precondition-failed": {
+                title: "Precondition Failed",
+                description: "The resource was modified since you last fetched it (ETag mismatch).",
+                solutions: [
+                    "Refetch the resource to get the latest ETag",
+                    "Update your If-Match header with the new ETag",
+                    "Retry the operation with the updated data"
+                ]
+            },
+            "cursor-invalid": {
+                title: "Invalid Cursor",
+                description: "The pagination cursor is malformed or incompatible.",
+                solutions: [
+                    "Request a fresh first page without a cursor",
+                    "Ensure the cursor was not modified",
+                    "Check if the orderBy parameters match the original request",
+                    "Verify the API version matches the cursor version"
+                ]
+            },
+            "cursor-expired": {
+                title: "Cursor Expired",
+                description: "The pagination cursor has expired and can no longer be used.",
+                solutions: [
+                    "Request a fresh first page without a cursor",
+                    "Cursors expire after a period of inactivity",
+                    "Consider caching results if pagination takes a long time"
+                ]
+            },
+            "idempotency-mismatch": {
+                title: "Idempotency Mismatch",
+                description: "The idempotency key was already used with different request parameters.",
+                solutions: [
+                    "Use a new unique idempotency key for different requests",
+                    "If retrying the same request, ensure body and path match exactly",
+                    "Idempotency keys are tied to specific request signatures"
+                ]
+            },
+            "unsupported-version": {
+                title: "Unsupported Client Version",
+                description: "The client version is below the minimum supported version.",
+                solutions: [
+                    "Upgrade your client library to a newer version",
+                    "Check the minVersion field in the response",
+                    "Review the changelog for breaking changes"
+                ]
+            },
+            "unknown-error": {
+                title: "Unknown Error",
+                description: "An unrecognized error occurred.",
+                solutions: [
+                    "Check the server logs for details",
+                    "Review the request ID in the response",
+                    "Contact support with the error details"
+                ]
+            }
+        };
+        const problemType = c.req.param("type");
+        const doc = problemDocs[problemType] || {
+            title: "Unknown Error",
+            description: "An unrecognized error type.",
+            solutions: ["Check the API documentation", "Review server logs"]
+        };
+        return c.json(doc);
+    });
+    // Helper to get layout props
+    const getLayoutProps = (activePage) => ({
+        title,
+        mode,
+        activePage,
+    });
+    // Helper to check if this is an HTMX request
+    const isHtmxRequest = (c) => c.req.header('hx-request') === 'true';
+    // Helper to send HTML response (full page or fragment for HTMX)
+    const sendHtml = (c, activePage, content) => {
+        if (isHtmxRequest(c)) {
+            return c.html(content);
+        }
+        return c.html(layout(getLayoutProps(activePage), content));
+    };
+    // ============================================
+    // HTMX UI Routes - Full Page Renders
+    // ============================================
+    // Dashboard
+    router.get("/ui", async (c) => {
+        const resources = getAllResourcesForDisplay();
+        const recentRequests = requestLogs.slice(0, 10).map(r => ({
+            id: r.id,
+            method: r.method,
+            path: r.path,
+            status: r.status,
+            duration: r.duration,
+            timestamp: new Date(r.timestamp).toISOString(),
+        }));
+        let currentSeq = 0;
+        let changelogCount = 0;
+        if (config.changelog) {
+            try {
+                currentSeq = await config.changelog.getCurrentSequence();
+                changelogCount = currentSeq;
+            }
+            catch { }
+        }
+        const subscriptions = config.getActiveSubscriptions?.() || [];
+        const content = pages.dashboardPage({
+            stats: {
+                resources: resources.length,
+                requests: requestLogs.length,
+                errors: errorLogs.length,
+                subscriptions: subscriptions.length,
+                changelog: changelogCount,
+            },
+            recentRequests,
+            mode,
+        });
+        return sendHtml(c, 'dashboard', content);
+    });
+    router.get("/ui/dashboard", (c) => {
+        // Redirect to main UI
+        return c.redirect(`${basePath}/ui`, 302);
+    });
+    // Resources
+    router.get("/ui/resources", (c) => {
+        const resources = getAllResourcesForDisplay();
+        const content = pages.resourcesPage({ resources });
+        return sendHtml(c, 'resources', content);
+    });
+    // Data Explorer
+    router.get("/ui/data-explorer", (c) => {
+        const resources = getAllResourcesForDisplay().map(r => r.name);
+        const readOnly = config.dataExplorer?.readOnly ?? (mode === "production");
+        const content = pages.dataExplorerPage({
+            resources,
+            readOnly,
+            mode,
+        });
+        return sendHtml(c, 'data-explorer', content);
+    });
+    // Requests
+    router.get("/ui/requests", (c) => {
+        const requests = requestLogs.slice(0, 200).map(r => ({
+            id: r.id,
+            method: r.method,
+            path: r.path,
+            status: r.status,
+            duration: r.duration,
+            timestamp: new Date(r.timestamp).toISOString(),
+            error: r.error,
+        }));
+        const content = pages.requestsPage({ requests });
+        return sendHtml(c, 'requests', content);
+    });
+    // Errors
+    router.get("/ui/errors", (c) => {
+        const errors = errorLogs.slice(0, 100).map(e => ({
+            id: e.id,
+            status: e.statusCode,
+            path: e.path,
+            message: e.error,
+            stack: e.stack,
+            timestamp: new Date(e.timestamp).toISOString(),
+        }));
+        const content = pages.errorsPage({ errors });
+        return sendHtml(c, 'errors', content);
+    });
+    // Users
+    router.get("/ui/users", async (c) => {
+        let users = [];
+        let totalCount = 0;
+        if (config.userManager) {
+            try {
+                const result = await config.userManager.listUsers(50, 0);
+                users = result.users;
+                totalCount = result.total;
+            }
+            catch { }
+        }
+        const content = pages.usersPage({ users, totalCount });
+        return sendHtml(c, 'users', content);
+    });
+    // Sessions
+    router.get("/ui/sessions", async (c) => {
+        let sessions = [];
+        if (config.sessionManager) {
+            try {
+                sessions = await config.sessionManager.listSessions(100);
+            }
+            catch { }
+        }
+        const content = pages.sessionsPage({
+            sessions,
+            totalCount: sessions.length,
+        });
+        return sendHtml(c, 'sessions', content);
+    });
+    // Subscriptions
+    router.get("/ui/subscriptions", (c) => {
+        const subscriptions = config.getActiveSubscriptions?.() || [];
+        const byResource = {};
+        for (const sub of subscriptions) {
+            byResource[sub.resource] = (byResource[sub.resource] || 0) + 1;
+        }
+        const content = pages.subscriptionsPage({
+            subscriptions,
+            stats: {
+                active: subscriptions.length,
+                totalEvents: subscriptions.reduce((sum, s) => sum + (s.eventCount || 0), 0),
+                byResource,
+            },
+        });
+        return sendHtml(c, 'subscriptions', content);
+    });
+    // Changelog
+    router.get("/ui/changelog", async (c) => {
+        let entries = [];
+        const stats = { total: 0, creates: 0, updates: 0, deletes: 0, currentSeq: 0 };
+        if (config.changelog) {
+            try {
+                stats.currentSeq = await config.changelog.getCurrentSequence();
+                entries = await config.changelog.getEntries(Math.max(0, stats.currentSeq - 100), 100);
+                stats.total = entries.length;
+                for (const e of entries) {
+                    if (e.operation === 'create')
+                        stats.creates++;
+                    else if (e.operation === 'update')
+                        stats.updates++;
+                    else if (e.operation === 'delete')
+                        stats.deletes++;
+                }
+            }
+            catch { }
+        }
+        const content = pages.changelogPage({ entries, stats });
+        return sendHtml(c, 'changelog', content);
+    });
+    // Tasks
+    router.get("/ui/tasks", async (c) => {
+        const content = pages.tasksPage({
+            stats: { pending: 0, scheduled: 0, running: 0, completed: 0, failed: 0, dlq: 0 },
+            scheduled: [],
+            dlq: [],
+            workers: [],
+        });
+        return sendHtml(c, 'tasks', content);
+    });
+    // KV Inspector
+    router.get("/ui/kv-inspector", (c) => {
+        const enabled = config.kvInspector?.enabled ?? false;
+        const readOnly = config.kvInspector?.readOnly ?? (mode === "production");
+        const content = pages.kvInspectorPage({ enabled, readOnly, mode });
+        return sendHtml(c, 'kv-inspector', content);
+    });
+    // Admin Audit
+    router.get("/ui/admin-audit", (c) => {
+        const entries = getAdminAuditLog(100, 0);
+        const content = pages.adminAuditPage({ entries });
+        return sendHtml(c, 'admin-audit', content);
+    });
+    // Filter Tester
+    router.get("/ui/filter-tester", (c) => {
+        const resources = getAllResourcesForDisplay().map(r => r.name);
+        const content = pages.filterTesterPage({ resources });
+        return sendHtml(c, 'filter-tester', content);
+    });
+    // API Explorer
+    router.get("/ui/api-explorer", (c) => {
+        const resources = getAllResourcesForDisplay();
+        const endpoints = [];
+        for (const resource of resources) {
+            const caps = resource.capabilities || {};
+            // GET list
+            endpoints.push({
+                method: 'GET',
+                path: resource.name,
+                description: `List ${resource.name} with filtering and pagination`,
+                parameters: [
+                    { name: 'filter', in: 'query', type: 'string', description: 'RSQL filter expression' },
+                    { name: 'limit', in: 'query', type: 'number', description: 'Max results (default: 50)' },
+                    { name: 'cursor', in: 'query', type: 'string', description: 'Pagination cursor' },
+                    { name: 'orderBy', in: 'query', type: 'string', description: 'Sort field:direction' },
+                ],
+            });
+            // GET single
+            endpoints.push({
+                method: 'GET',
+                path: `${resource.name}/:id`,
+                description: `Get a single ${resource.name} by ID`,
+                parameters: [
+                    { name: 'id', in: 'path', type: 'string', required: true },
+                ],
+            });
+            if (caps.enableCreate) {
+                endpoints.push({
+                    method: 'POST',
+                    path: resource.name,
+                    description: `Create a new ${resource.name}`,
+                    requestBody: { contentType: 'application/json' },
+                });
+            }
+            if (caps.enableUpdate) {
+                endpoints.push({
+                    method: 'PATCH',
+                    path: `${resource.name}/:id`,
+                    description: `Update a ${resource.name}`,
+                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
+                    requestBody: { contentType: 'application/json' },
+                });
+            }
+            if (caps.enableDelete) {
+                endpoints.push({
+                    method: 'DELETE',
+                    path: `${resource.name}/:id`,
+                    description: `Delete a ${resource.name}`,
+                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
+                });
+            }
+        }
+        const content = pages.apiExplorerPage({ endpoints, baseUrl: '' });
+        return sendHtml(c, 'api-explorer', content);
+    });
+    // ============================================
+    // HTMX Partial Routes - For dynamic updates
+    // ============================================
+    // Empty fragment (for closing modals, etc.)
+    router.get("/ui/empty", (c) => {
+        return c.html('');
+    });
+    // Request list partial
+    router.get("/ui/requests/list", (c) => {
+        let requests = requestLogs.slice(0, 200);
+        const method = c.req.query("method");
+        const status = c.req.query("status");
+        const path = c.req.query("path");
+        if (method) {
+            requests = requests.filter(r => r.method === method);
+        }
+        if (status === 'success') {
+            requests = requests.filter(r => r.status >= 200 && r.status < 400);
+        }
+        else if (status === 'error') {
+            requests = requests.filter(r => r.status >= 400);
+        }
+        if (path) {
+            requests = requests.filter(r => r.path.includes(path));
+        }
+        const mapped = requests.map(r => ({
+            id: r.id,
+            method: r.method,
+            path: r.path,
+            status: r.status,
+            duration: r.duration,
+            timestamp: new Date(r.timestamp).toISOString(),
+            error: r.error,
+        }));
+        return c.html(pages.requestList(mapped));
+    });
+    // Request detail partial
+    router.get("/ui/requests/:id", (c) => {
+        const id = c.req.param("id");
+        const request = requestLogs.find(r => r.id === id);
+        if (!request) {
+            return c.html(emptyState('✕', 'Request not found', 'The request may have been purged from logs'));
+        }
+        return c.html(pages.requestDetail({
+            request: {
+                id: request.id,
+                method: request.method,
+                path: request.path,
+                status: request.status,
+                duration: request.duration,
+                timestamp: new Date(request.timestamp).toISOString(),
+                error: request.error,
+                headers: request.headers,
+                body: request.requestBody,
+                response: request.responseBody,
+            },
+        }));
+    });
+    // Users list partial
+    router.get("/ui/users/list", async (c) => {
+        if (!config.userManager) {
+            return c.html(pages.usersList([]));
+        }
+        try {
+            const search = c.req.query("search");
+            const result = await config.userManager.listUsers(50, 0);
+            let users = result.users;
+            if (search) {
+                const term = search.toLowerCase();
+                users = users.filter((u) => u.email?.toLowerCase().includes(term) ||
+                    u.name?.toLowerCase().includes(term));
+            }
+            return c.html(pages.usersList(users));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // User create form partial
+    router.get("/ui/users/new", (c) => {
+        return c.html(pages.userForm());
+    });
+    // User detail partial
+    router.get("/ui/users/:id", async (c) => {
+        if (!config.userManager) {
+            return c.html(emptyState('✕', 'User management not configured', ''));
+        }
+        try {
+            const id = c.req.param("id");
+            const user = await config.userManager.getUser(id);
+            if (!user) {
+                return c.html(emptyState('✕', 'User not found', ''));
+            }
+            let sessions = [];
+            if (config.sessionManager) {
+                try {
+                    sessions = await config.sessionManager.getSessionsByUser(id);
+                }
+                catch { }
+            }
+            return c.html(pages.userDetail({ user: { ...user, sessions } }));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // Session create form partial
+    router.get("/ui/sessions/new", async (c) => {
+        let users = [];
+        if (config.userManager) {
+            try {
+                const result = await config.userManager.listUsers(100, 0);
+                users = result.users.map((u) => ({ id: u.id, email: u.email }));
+            }
+            catch { }
+        }
+        return c.html(pages.sessionForm({ users }));
+    });
+    // Sessions list partial
+    router.get("/ui/sessions/list", async (c) => {
+        if (!config.sessionManager) {
+            return c.html(pages.sessionsList([]));
+        }
+        try {
+            const sessions = await config.sessionManager.listSessions(100);
+            return c.html(pages.sessionsList(sessions));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // Subscriptions list partial
+    router.get("/ui/subscriptions/list", (c) => {
+        const subscriptions = config.getActiveSubscriptions?.() || [];
+        return c.html(pages.subscriptionsList(subscriptions));
+    });
+    // Changelog list partial
+    router.get("/ui/changelog/list", async (c) => {
+        if (!config.changelog) {
+            return c.html(pages.changelogList([]));
+        }
+        try {
+            const resource = c.req.query("resource");
+            const fromSeq = parseInt(c.req.query("fromSeq") ?? "") || 0;
+            const currentSeq = await config.changelog.getCurrentSequence();
+            let entries = await config.changelog.getEntries(fromSeq || Math.max(0, currentSeq - 100), 100);
+            if (resource) {
+                entries = entries.filter((e) => e.resource?.includes(resource));
+            }
+            return c.html(pages.changelogList(entries));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // Changelog detail partial
+    router.get("/ui/changelog/:seq", async (c) => {
+        if (!config.changelog) {
+            return c.html(emptyState('✕', 'Changelog not configured', ''));
+        }
+        try {
+            const seq = parseInt(c.req.param("seq"));
+            const entries = await config.changelog.getEntries(seq, 1);
+            const entry = entries[0];
+            if (!entry) {
+                return c.html(emptyState('✕', 'Entry not found', ''));
+            }
+            return c.html(pages.changelogDetail({ entry }));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // Audit list partial
+    router.get("/ui/audit/list", (c) => {
+        let entries = getAdminAuditLog(100, 0);
+        const operation = c.req.query("operation");
+        const user = c.req.query("user");
+        if (operation) {
+            entries = entries.filter(e => e.operation?.includes(operation));
+        }
+        if (user) {
+            entries = entries.filter(e => e.userEmail?.toLowerCase().includes(user.toLowerCase()) ||
+                e.userId?.includes(user));
+        }
+        return c.html(pages.auditList(entries));
+    });
+    // Audit detail partial
+    router.get("/ui/audit/:index", (c) => {
+        const index = parseInt(c.req.param("index"));
+        const entries = getAdminAuditLog(100, 0);
+        const entry = entries[index];
+        if (!entry) {
+            return c.html(emptyState('✕', 'Entry not found', ''));
+        }
+        return c.html(pages.auditDetail({ entry }));
+    });
+    // KV keys partial
+    router.get("/ui/kv/keys", (c) => {
+        if (!config.kvInspector?.enabled) {
+            return c.html(emptyState('⛁', 'KV Inspector Disabled', ''));
+        }
+        const readOnly = config.kvInspector?.readOnly ?? (mode === "production");
+        // This would need to be implemented with actual KV access
+        // For now, return empty
+        return c.html(pages.kvKeysList({ keys: [], readOnly }));
+    });
+    // KV value partial
+    router.get("/ui/kv/value/:key", (c) => {
+        if (!config.kvInspector?.enabled) {
+            return c.html(emptyState('⛁', 'KV Inspector Disabled', ''));
+        }
+        const key = decodeURIComponent(c.req.param("key"));
+        const readOnly = config.kvInspector?.readOnly ?? (mode === "production");
+        // This would need to be implemented with actual KV access
+        return c.html(pages.kvValueView({
+            key,
+            type: 'string',
+            value: '',
+            readOnly,
+        }));
+    });
+    // Data explorer partials
+    router.get("/ui/data/resources", (c) => {
+        const resources = getAllResourcesForDisplay().map(r => r.name);
+        const readOnly = config.dataExplorer?.readOnly ?? (mode === "production");
+        return c.html(pages.resourceSelector({ resources, readOnly }));
+    });
+    // Data table partial for a resource
+    router.get("/ui/data/:resource/table", async (c) => {
+        const resource = c.req.param("resource");
+        const filter = c.req.query("filter") || '';
+        const limit = parseInt(c.req.query("limit") ?? "") || 50;
+        const cursor = c.req.query("cursor") || '';
+        const orderBy = c.req.query("orderBy") || '';
+        const readOnly = config.dataExplorer?.readOnly ?? (mode === "production");
+        try {
+            const schemaInfo = getSchemaInfo(resource);
+            if (!schemaInfo) {
+                return c.html(emptyState('✕', 'Resource not found', `Resource '${resource}' is not registered`));
+            }
+            const entry = getResourceSchema(resource);
+            if (!entry) {
+                return c.html(emptyState('✕', 'Resource not found', ''));
+            }
+            const db = entry.db;
+            const schema = entry.schema;
+            const idColumnName = entry.idColumn.name;
+            const filterer = createResourceFilter(schema, {});
+            const pagination = createPagination(schema, entry.idColumn, {
+                defaultLimit: 20,
+                maxLimit: config.dataExplorer?.maxLimit ?? 100,
+            });
+            const orderByFields = parseOrderBy(orderBy || idColumnName);
+            let sqlFilter;
+            if (filter) {
+                sqlFilter = filterer.convert(filter);
+            }
+            let query = db.select().from(schema);
+            if (sqlFilter) {
+                query = query.where(sqlFilter);
+            }
+            if (cursor) {
+                const cursorData = decodeCursorLegacy(cursor);
+                if (cursorData) {
+                    const cursorCondition = pagination.buildCursorCondition(cursorData, orderByFields);
+                    if (cursorCondition) {
+                        query = query.where(sqlFilter ? and(sqlFilter, cursorCondition) : cursorCondition);
+                    }
+                }
+            }
+            const orderByClauses = pagination.buildOrderBy(orderByFields);
+            if (orderByClauses.length > 0) {
+                query = query.orderBy(...orderByClauses);
+            }
+            query = query.limit(limit + 1);
+            const items = await query;
+            // Get total count
+            const [countResult] = await db
+                .select({ count: count() })
+                .from(schema)
+                .where(sqlFilter);
+            const totalCount = countResult?.count ?? 0;
+            const result = pagination.processResults(items, limit, idColumnName, orderByFields, totalCount);
+            return c.html(pages.dataTable({
+                resource,
+                schema: schemaInfo,
+                items: result.items,
+                totalCount: result.totalCount,
+                hasMore: result.hasMore,
+                nextCursor: result.nextCursor ?? undefined,
+                filter,
+                orderBy: orderBy || undefined,
+                limit,
+                readOnly,
+            }));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // Row detail partial
+    router.get("/ui/data/:resource/row/:id", async (c) => {
+        const resource = c.req.param("resource");
+        const id = c.req.param("id");
+        try {
+            const entry = getResourceSchema(resource);
+            if (!entry) {
+                return c.html(emptyState('✕', 'Resource not found', ''));
+            }
+            const db = entry.db;
+            const schema = entry.schema;
+            const columns = getTableColumns(schema);
+            const idColumn = columns[entry.idColumn.name];
+            const [item] = await db.select().from(schema).where(eq(idColumn, id));
+            if (!item) {
+                return c.html(emptyState('✕', 'Record not found', ''));
+            }
+            return c.html(pages.recordDetail({ resource, item: item }));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // Edit form partial
+    router.get("/ui/data/:resource/edit/:id", async (c) => {
+        const resource = c.req.param("resource");
+        const id = c.req.param("id");
+        const readOnly = config.dataExplorer?.readOnly ?? (mode === "production");
+        if (readOnly) {
+            return c.html(emptyState('⚠', 'Read-only mode', 'Data editing is disabled in this environment'));
+        }
+        try {
+            const entry = getResourceSchema(resource);
+            const schemaInfo = getSchemaInfo(resource);
+            if (!entry || !schemaInfo) {
+                return c.html(emptyState('✕', 'Resource not found', ''));
+            }
+            const db = entry.db;
+            const schema = entry.schema;
+            const columns = getTableColumns(schema);
+            const idColumn = columns[entry.idColumn.name];
+            const [item] = await db.select().from(schema).where(eq(idColumn, id));
+            if (!item) {
+                return c.html(emptyState('✕', 'Record not found', ''));
+            }
+            return c.html(pages.recordForm({
+                resource,
+                schema: schemaInfo,
+                item: item,
+                isEdit: true,
+            }));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // New record form partial
+    router.get("/ui/data/new", (c) => {
+        const resource = c.req.query("resource");
+        const readOnly = config.dataExplorer?.readOnly ?? (mode === "production");
+        if (readOnly) {
+            return c.html(emptyState('⚠', 'Read-only mode', 'Data editing is disabled in this environment'));
+        }
+        if (!resource) {
+            return c.html(emptyState('⚠', 'No resource selected', 'Select a resource first'));
+        }
+        try {
+            const schemaInfo = getSchemaInfo(resource);
+            if (!schemaInfo) {
+                return c.html(emptyState('✕', 'Resource not found', ''));
+            }
+            return c.html(pages.recordForm({
+                resource,
+                schema: schemaInfo,
+                isEdit: false,
+            }));
+        }
+        catch (e) {
+            return c.html(html `<div class="alert alert-error">${escapeHtml(e.message)}</div>`);
+        }
+    });
+    // Filter tester parse partial
+    router.post("/ui/filter/parse", async (c) => {
+        const body = await c.req.parseBody();
+        const filter = typeof body.filter === "string" ? body.filter : '';
+        try {
+            // Use createResourceFilter with a minimal dummy to parse the filter
+            // This validates the syntax without needing a real schema
+            const dummySchema = {};
+            const filterer = createResourceFilter(dummySchema, {});
+            // compile() returns the parsed AST and throws on syntax errors
+            const ast = filterer.compile(filter);
+            return c.html(pages.filterParseResult({ filter, ast: ast.toString() }));
+        }
+        catch (e) {
+            return c.html(pages.filterParseResult({ filter, error: e.message }));
+        }
+    });
+    // API explorer endpoint detail partial
+    router.get("/ui/api-explorer/endpoint/:index", (c) => {
+        const index = parseInt(c.req.param("index"));
+        const resources = getAllResourcesForDisplay();
+        const endpoints = [];
+        for (const resource of resources) {
+            const caps = resource.capabilities || {};
+            endpoints.push({
+                method: 'GET',
+                path: resource.name,
+                description: `List ${resource.name} with filtering and pagination`,
+                parameters: [
+                    { name: 'filter', in: 'query', type: 'string', description: 'RSQL filter expression' },
+                    { name: 'limit', in: 'query', type: 'number', description: 'Max results (default: 50)' },
+                    { name: 'cursor', in: 'query', type: 'string', description: 'Pagination cursor' },
+                    { name: 'orderBy', in: 'query', type: 'string', description: 'Sort field:direction' },
+                ],
+            });
+            endpoints.push({
+                method: 'GET',
+                path: `${resource.name}/:id`,
+                description: `Get a single ${resource.name} by ID`,
+                parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
+            });
+            if (caps.enableCreate) {
+                endpoints.push({
+                    method: 'POST',
+                    path: resource.name,
+                    description: `Create a new ${resource.name}`,
+                    requestBody: { contentType: 'application/json' },
+                });
+            }
+            if (caps.enableUpdate) {
+                endpoints.push({
+                    method: 'PATCH',
+                    path: `${resource.name}/:id`,
+                    description: `Update a ${resource.name}`,
+                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
+                    requestBody: { contentType: 'application/json' },
+                });
+            }
+            if (caps.enableDelete) {
+                endpoints.push({
+                    method: 'DELETE',
+                    path: `${resource.name}/:id`,
+                    description: `Delete a ${resource.name}`,
+                    parameters: [{ name: 'id', in: 'path', type: 'string', required: true }],
+                });
+            }
+        }
+        const endpoint = endpoints[index];
+        if (!endpoint) {
+            return c.html(emptyState('✕', 'Endpoint not found', ''));
+        }
+        return c.html(pages.endpointDetail({ endpoint, baseUrl: '' }));
+    });
+    return router;
+};
+export default createAdminUI;
+//# sourceMappingURL=middleware.js.map