gazetta 0.6.0 → 0.8.0

package/dist/admin-api/schemas/archive.js

@@ -0,0 +1,93 @@
+/**
+ * Zod schemas for /api/{pages,fragments}/:name/{archive,unarchive,purge}
+ * routes — single source of truth for request/response shapes per
+ * MCP discipline (see feature-design-process.md non-foundational
+ * disciplines + testing-plan.md Priority 3.2).
+ *
+ * The 409 purge-blocked response carries a structured resolution
+ * body (per design-soft-delete.md Q4 H1 lock) that the admin UI
+ * consumes to drive the resolve modal.
+ */
+import { z } from 'zod';
+/**
+ * POST /api/{kind}/:name/archive body. `aliasOf` is optional —
+ * absent means pure soft-delete (the runtime emits 410 Gone for
+ * pages and the renderer throws ArchivedNoAliasError for fragments).
+ */
+export const ArchiveRequestSchema = z.object({
+    /** Live target name to redirect to. Pages: name resolves via
+     *  `deriveRoute`. Fragments: referenced as `@name` at compose time. */
+    aliasOf: z.string().min(1).optional(),
+});
+/** Standard ok response with the archived item's name. */
+export const ArchiveResponseSchema = z.object({
+    ok: z.literal(true),
+    name: z.string(),
+    archivedAt: z.string(),
+    aliasOf: z.string().optional(),
+});
+export const UnarchiveResponseSchema = z.object({
+    ok: z.literal(true),
+    name: z.string(),
+});
+/** Reference one alias-pointer in a 409 DELETE_BLOCKED body. */
+export const AliasPointerSchema = z.object({
+    kind: z.enum(['page', 'fragment']),
+    name: z.string(),
+});
+/** Reference one live ref in a 409 DELETE_BLOCKED body. */
+export const LiveRefSchema = z.object({
+    kind: z.enum(['page', 'fragment']),
+    name: z.string(),
+});
+/**
+ * 409 response body when purge is blocked by aliases or live refs.
+ * Per design-soft-delete.md Q4 H1: refusal returns this structured
+ * shape so the admin UI can drive the resolve modal (re-target
+ * aliases / drop alias / cascade-purge / resolve refs / try again).
+ */
+export const PurgeBlockedSchema = z.object({
+    code: z.literal('DELETE_BLOCKED'),
+    aliases: z.array(AliasPointerSchema),
+    liveRefs: z.array(LiveRefSchema),
+});
+export const PurgeResponseSchema = z.object({
+    ok: z.literal(true),
+    name: z.string(),
+});
+/**
+ * 409 body when an archive-without-aliasOf is attempted on an item
+ * that still has live refs (P8 save-handler check per
+ * design-soft-delete.md Q11). Refusal preserves the invariant that
+ * archived-no-alias items render 410 — which would silently break
+ * any live reference. Author resolves by either setting `aliasOf`
+ * on the archive request OR removing live refs first. Admin
+ * `?force=true` bypasses with audit metadata recording the bypass.
+ */
+export const ArchiveHasLiveRefsSchema = z.object({
+    code: z.literal('ARCHIVE_HAS_LIVE_REFS'),
+    liveRefs: z.array(LiveRefSchema),
+});
+/**
+ * Body for PATCH /api/{kind}/:name/alias. Edits an existing
+ * archive's `aliasOf` field — set to a string to point at a live
+ * target, or `null` to drop the alias (pure soft-delete).
+ *
+ * Used by Cut 12's purge-blocked resolution modal: when archives
+ * point at a name the author wants to purge, the modal offers
+ * "Drop alias" (aliasOf: null) per design-soft-delete.md Q4 H1.
+ *
+ * Only valid on archived items; live items' aliasOf is meaningless
+ * (the field is implicitly stripped on unarchive). Returns 409 when
+ * called on a live item.
+ */
+export const SetAliasRequestSchema = z.object({
+    /** New alias target. `null` strips the alias (pure soft-delete). */
+    aliasOf: z.string().min(1).nullable(),
+});
+export const SetAliasResponseSchema = z.object({
+    ok: z.literal(true),
+    name: z.string(),
+    aliasOf: z.string().optional(),
+});
+//# sourceMappingURL=archive.js.map

package/dist/admin-api/schemas/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../../src/admin-api/schemas/archive.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C;2EACuE;IACvE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAGF,0DAA0D;AAC1D,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AAGF,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AAGF,2DAA2D;AAC3D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AAGF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC;IACpC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACjC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IACxC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;CACjC,CAAC,CAAA;AAGF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,oEAAoE;IACpE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAA"}

package/dist/admin-api/schemas/assets.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Zod schemas + typed errors for asset-domain HTTP contracts.
+ *
+ * Thin transport envelopes around the domain-owned shapes. The `AssetRef`
+ * schema lives in `../../assets/refs.ts` (domain); this module wraps it
+ * in HTTP-shaped responses and re-exports the domain error classes so
+ * both server and admin client can import them from a single place.
+ *
+ * Single source of truth. The server throws `AssetInUseError` from the
+ * asset domain; the route adapter serializes via `AssetInUseResponseSchema`;
+ * the admin client parses the 409 body into the same `AssetInUseError`
+ * class. No parallel client-only copy.
+ */
+import { z } from 'zod';
+export { AssetRefSchema } from '../../assets/refs.js';
+export type { AssetRef } from '../../assets/refs.js';
+export { AssetInUseError, AssetKindMismatchError, AssetManifestCorruptError, AssetManifestNotFoundError, AssetMimeMismatchError, AssetMimeUnsupportedError, AssetNameCollisionError, AssetNameInvalidError, AssetNameReservedError, AssetPathTraversalError, AssetPreprocessError, AssetSizeExceededError, AssetStorageError, AssetValidationError, AssetVariantGenerationError, type AssetErrorCode, } from '../../assets/errors.js';
+/**
+ * Body of a 409 response on DELETE /api/assets/:name — emitted when the
+ * asset is still referenced by at least one page or fragment. `refs` is
+ * the exact usage list the server found; the client renders it verbatim.
+ */
+export declare const AssetInUseResponseSchema: z.ZodObject<{
+    code: z.ZodLiteral<"ASSET_IN_USE">;
+    message: z.ZodString;
+    assetName: z.ZodString;
+    refs: z.ZodArray<z.ZodObject<{
+        source: z.ZodEnum<{
+            page: "page";
+            fragment: "fragment";
+        }>;
+        path: z.ZodString;
+        componentPath: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AssetInUseResponse = z.infer<typeof AssetInUseResponseSchema>;
+/**
+ * Body of a 409 response on POST /api/assets/:name/rename-to/:newName —
+ * emitted when `newName` already maps to an existing asset. The author
+ * either picks a different name or uses replace-and-delete to merge.
+ */
+export declare const AssetNameCollisionResponseSchema: z.ZodObject<{
+    code: z.ZodLiteral<"ASSET_NAME_COLLISION">;
+    message: z.ZodString;
+    newName: z.ZodString;
+}, z.core.$strip>;
+export type AssetNameCollisionResponse = z.infer<typeof AssetNameCollisionResponseSchema>;
+/**
+ * Body of a 200 response on POST /api/assets/:name/suggest-alt — the AI
+ * adapter's structured suggestion. `refused: true` means the model
+ * declined; consumers display `refusalReason` instead of auto-filling
+ * the alt input. Refusals are NOT errors — the API call succeeded.
+ *
+ * 503 (no adapter / unsupported MIME) and 502 (adapter call failed)
+ * use the generic `{ code, message }` shape — see `AIErrorCode` in
+ * `ai/errors.ts` for the code values.
+ */
+export declare const SuggestAltResponseSchema: z.ZodObject<{
+    text: z.ZodString;
+    refused: z.ZodBoolean;
+    refusalReason: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SuggestAltResponse = z.infer<typeof SuggestAltResponseSchema>;
+//# sourceMappingURL=assets.d.ts.map

package/dist/admin-api/schemas/assets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.d.ts","sourceRoot":"","sources":["../../../src/admin-api/schemas/assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACrD,YAAY,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAKpD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,EAC3B,KAAK,cAAc,GACpB,MAAM,wBAAwB,CAAA;AAE/B;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;iBAKnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAEzE;;;;GAIG;AACH,eAAO,MAAM,gCAAgC;;;;iBAI3C,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAA;AAEzF;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/admin-api/schemas/assets.js

@@ -0,0 +1,59 @@
+/**
+ * Zod schemas + typed errors for asset-domain HTTP contracts.
+ *
+ * Thin transport envelopes around the domain-owned shapes. The `AssetRef`
+ * schema lives in `../../assets/refs.ts` (domain); this module wraps it
+ * in HTTP-shaped responses and re-exports the domain error classes so
+ * both server and admin client can import them from a single place.
+ *
+ * Single source of truth. The server throws `AssetInUseError` from the
+ * asset domain; the route adapter serializes via `AssetInUseResponseSchema`;
+ * the admin client parses the 409 body into the same `AssetInUseError`
+ * class. No parallel client-only copy.
+ */
+import { z } from 'zod';
+import { AssetRefSchema } from '../../assets/refs.js';
+// Re-export the domain schema + type so admin-api consumers can get
+// everything they need from this barrel without reaching into the domain.
+export { AssetRefSchema } from '../../assets/refs.js';
+// Re-export the typed error hierarchy. The admin client imports
+// `AssetInUseError` from here and uses `instanceof` to branch; the server
+// throws the same class. One identity across the wire.
+export { AssetInUseError, AssetKindMismatchError, AssetManifestCorruptError, AssetManifestNotFoundError, AssetMimeMismatchError, AssetMimeUnsupportedError, AssetNameCollisionError, AssetNameInvalidError, AssetNameReservedError, AssetPathTraversalError, AssetPreprocessError, AssetSizeExceededError, AssetStorageError, AssetValidationError, AssetVariantGenerationError, } from '../../assets/errors.js';
+/**
+ * Body of a 409 response on DELETE /api/assets/:name — emitted when the
+ * asset is still referenced by at least one page or fragment. `refs` is
+ * the exact usage list the server found; the client renders it verbatim.
+ */
+export const AssetInUseResponseSchema = z.object({
+    code: z.literal('ASSET_IN_USE'),
+    message: z.string(),
+    assetName: z.string(),
+    refs: z.array(AssetRefSchema),
+});
+/**
+ * Body of a 409 response on POST /api/assets/:name/rename-to/:newName —
+ * emitted when `newName` already maps to an existing asset. The author
+ * either picks a different name or uses replace-and-delete to merge.
+ */
+export const AssetNameCollisionResponseSchema = z.object({
+    code: z.literal('ASSET_NAME_COLLISION'),
+    message: z.string(),
+    newName: z.string(),
+});
+/**
+ * Body of a 200 response on POST /api/assets/:name/suggest-alt — the AI
+ * adapter's structured suggestion. `refused: true` means the model
+ * declined; consumers display `refusalReason` instead of auto-filling
+ * the alt input. Refusals are NOT errors — the API call succeeded.
+ *
+ * 503 (no adapter / unsupported MIME) and 502 (adapter call failed)
+ * use the generic `{ code, message }` shape — see `AIErrorCode` in
+ * `ai/errors.ts` for the code values.
+ */
+export const SuggestAltResponseSchema = z.object({
+    text: z.string(),
+    refused: z.boolean(),
+    refusalReason: z.string().nullable(),
+});
+//# sourceMappingURL=assets.js.map

package/dist/admin-api/schemas/assets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assets.js","sourceRoot":"","sources":["../../../src/admin-api/schemas/assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAErD,oEAAoE;AACpE,0EAA0E;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAGrD,gEAAgE;AAChE,0EAA0E;AAC1E,uDAAuD;AACvD,OAAO,EACL,eAAe,EACf,sBAAsB,EACtB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACtB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,2BAA2B,GAE5B,MAAM,wBAAwB,CAAA;AAE/B;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC;IAC/B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;CAC9B,CAAC,CAAA;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC,MAAM,CAAC;IACvD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAA;AAGF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAA"}

package/dist/admin-api/schemas/audit.d.ts

@@ -0,0 +1,175 @@
+/**
+ * Zod schemas for `/api/audit*` endpoints.
+ *
+ * The query endpoint returns events from all configured queryable
+ * providers; external-sink providers (no `query()`) contribute their
+ * `queryUrl()` deep-link instead. Per design-audit.md "Audit drawer
+ * — query semantics", the response carries both arrays so the
+ * drawer can render the four states (history-only, mixed, external-
+ * only-with-link, external-only-no-link) deterministically.
+ *
+ * The schemas mirror the runtime types in `audit/types.ts`. We
+ * re-declare them here as Zod (not `z.infer` from a runtime type)
+ * because the wire shape is what's contract-tested; the runtime
+ * types and the Zod schemas could legitimately diverge at the wire
+ * boundary (e.g., `metadata` is `Record<string, unknown>` at runtime
+ * but the Zod schema validates it as `z.record(z.unknown())` so
+ * unparseable JSON gets rejected with a clear 400 instead of
+ * silently flowing through as `unknown`).
+ */
+import { z } from 'zod';
+export declare const AuditActionSchema: z.ZodEnum<{
+    delete: "delete";
+    save: "save";
+    publish: "publish";
+    restore: "restore";
+    "configure-roles": "configure-roles";
+    "hook-fired": "hook-fired";
+    archive: "archive";
+    unarchive: "unarchive";
+    purge: "purge";
+    rename: "rename";
+}>;
+export type AuditActionWire = z.infer<typeof AuditActionSchema>;
+export declare const AuditOutcomeSchema: z.ZodEnum<{
+    success: "success";
+    "hook-cancelled": "hook-cancelled";
+    timeout: "timeout";
+    "validation-failed": "validation-failed";
+    forbidden: "forbidden";
+    unauthenticated: "unauthenticated";
+}>;
+export type AuditOutcomeWire = z.infer<typeof AuditOutcomeSchema>;
+export declare const AuditScopeKindSchema: z.ZodEnum<{
+    site: "site";
+    page: "page";
+    fragment: "fragment";
+    asset: "asset";
+}>;
+export type AuditScopeKindWire = z.infer<typeof AuditScopeKindSchema>;
+export declare const AuditActorSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodOptional<z.ZodString>;
+    role: z.ZodString;
+    trustMode: z.ZodString;
+}, z.core.$strip>;
+export type AuditActorWire = z.infer<typeof AuditActorSchema>;
+export declare const AuditScopeSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        site: "site";
+        page: "page";
+        fragment: "fragment";
+        asset: "asset";
+    }>;
+    name: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AuditScopeWire = z.infer<typeof AuditScopeSchema>;
+export declare const AuditEventSchema: z.ZodObject<{
+    timestamp: z.ZodString;
+    actor: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodOptional<z.ZodString>;
+        role: z.ZodString;
+        trustMode: z.ZodString;
+    }, z.core.$strip>;
+    action: z.ZodEnum<{
+        delete: "delete";
+        save: "save";
+        publish: "publish";
+        restore: "restore";
+        "configure-roles": "configure-roles";
+        "hook-fired": "hook-fired";
+        archive: "archive";
+        unarchive: "unarchive";
+        purge: "purge";
+        rename: "rename";
+    }>;
+    outcome: z.ZodEnum<{
+        success: "success";
+        "hook-cancelled": "hook-cancelled";
+        timeout: "timeout";
+        "validation-failed": "validation-failed";
+        forbidden: "forbidden";
+        unauthenticated: "unauthenticated";
+    }>;
+    scope: z.ZodObject<{
+        kind: z.ZodEnum<{
+            site: "site";
+            page: "page";
+            fragment: "fragment";
+            asset: "asset";
+        }>;
+        name: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    sourceIp: z.ZodOptional<z.ZodString>;
+    userAgent: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type AuditEventWire = z.infer<typeof AuditEventSchema>;
+/**
+ * Reference to an external-sink provider whose events live elsewhere.
+ * The drawer renders these as deep-links beside the inline events
+ * list. `url` is null when the provider has neither `query()` nor a
+ * usable `queryUrl()` — the drawer surfaces "configured but not
+ * queryable" so operators see what's wired up even when there's
+ * nothing inline.
+ */
+export declare const AuditExternalSinkSchema: z.ZodObject<{
+    name: z.ZodString;
+    url: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AuditExternalSinkWire = z.infer<typeof AuditExternalSinkSchema>;
+/**
+ * Response body for `GET /api/audit`. Carries inline events from
+ * queryable providers + sink references for external-only providers.
+ * The drawer composes both into one user-facing surface.
+ */
+export declare const AuditQueryResponseSchema: z.ZodObject<{
+    events: z.ZodArray<z.ZodObject<{
+        timestamp: z.ZodString;
+        actor: z.ZodObject<{
+            id: z.ZodString;
+            email: z.ZodOptional<z.ZodString>;
+            role: z.ZodString;
+            trustMode: z.ZodString;
+        }, z.core.$strip>;
+        action: z.ZodEnum<{
+            delete: "delete";
+            save: "save";
+            publish: "publish";
+            restore: "restore";
+            "configure-roles": "configure-roles";
+            "hook-fired": "hook-fired";
+            archive: "archive";
+            unarchive: "unarchive";
+            purge: "purge";
+            rename: "rename";
+        }>;
+        outcome: z.ZodEnum<{
+            success: "success";
+            "hook-cancelled": "hook-cancelled";
+            timeout: "timeout";
+            "validation-failed": "validation-failed";
+            forbidden: "forbidden";
+            unauthenticated: "unauthenticated";
+        }>;
+        scope: z.ZodObject<{
+            kind: z.ZodEnum<{
+                site: "site";
+                page: "page";
+                fragment: "fragment";
+                asset: "asset";
+            }>;
+            name: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+        sourceIp: z.ZodOptional<z.ZodString>;
+        userAgent: z.ZodOptional<z.ZodString>;
+        metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strip>>;
+    externalSinks: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AuditQueryResponseWire = z.infer<typeof AuditQueryResponseSchema>;
+//# sourceMappingURL=audit.d.ts.map

package/dist/admin-api/schemas/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/admin-api/schemas/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,iBAAiB;;;;;;;;;;;EAY5B,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE/D,eAAO,MAAM,kBAAkB;;;;;;;EAO7B,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEjE,eAAO,MAAM,oBAAoB;;;;;EAAgD,CAAA;AACjF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAErE,eAAO,MAAM,gBAAgB;;;;;iBAK3B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAE7D,eAAO,MAAM,gBAAgB;;;;;;;;iBAG3B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAE7D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAS3B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAE7D;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;iBASlC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE3E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAInC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA"}

package/dist/admin-api/schemas/audit.js

@@ -0,0 +1,91 @@
+/**
+ * Zod schemas for `/api/audit*` endpoints.
+ *
+ * The query endpoint returns events from all configured queryable
+ * providers; external-sink providers (no `query()`) contribute their
+ * `queryUrl()` deep-link instead. Per design-audit.md "Audit drawer
+ * — query semantics", the response carries both arrays so the
+ * drawer can render the four states (history-only, mixed, external-
+ * only-with-link, external-only-no-link) deterministically.
+ *
+ * The schemas mirror the runtime types in `audit/types.ts`. We
+ * re-declare them here as Zod (not `z.infer` from a runtime type)
+ * because the wire shape is what's contract-tested; the runtime
+ * types and the Zod schemas could legitimately diverge at the wire
+ * boundary (e.g., `metadata` is `Record<string, unknown>` at runtime
+ * but the Zod schema validates it as `z.record(z.unknown())` so
+ * unparseable JSON gets rejected with a clear 400 instead of
+ * silently flowing through as `unknown`).
+ */
+import { z } from 'zod';
+export const AuditActionSchema = z.enum([
+    'save',
+    'publish',
+    'delete',
+    'restore',
+    'configure-roles',
+    'hook-fired',
+    // Soft-delete extensions per design-soft-delete.md Q8 (M4 lock).
+    'archive',
+    'unarchive',
+    'purge',
+    'rename',
+]);
+export const AuditOutcomeSchema = z.enum([
+    'success',
+    'forbidden',
+    'validation-failed',
+    'unauthenticated',
+    'hook-cancelled',
+    'timeout',
+]);
+export const AuditScopeKindSchema = z.enum(['page', 'fragment', 'asset', 'site']);
+export const AuditActorSchema = z.object({
+    id: z.string(),
+    email: z.string().optional(),
+    role: z.string(),
+    trustMode: z.string(),
+});
+export const AuditScopeSchema = z.object({
+    kind: AuditScopeKindSchema,
+    name: z.string().optional(),
+});
+export const AuditEventSchema = z.object({
+    timestamp: z.string(),
+    actor: AuditActorSchema,
+    action: AuditActionSchema,
+    outcome: AuditOutcomeSchema,
+    scope: AuditScopeSchema,
+    sourceIp: z.string().optional(),
+    userAgent: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+});
+/**
+ * Reference to an external-sink provider whose events live elsewhere.
+ * The drawer renders these as deep-links beside the inline events
+ * list. `url` is null when the provider has neither `query()` nor a
+ * usable `queryUrl()` — the drawer surfaces "configured but not
+ * queryable" so operators see what's wired up even when there's
+ * nothing inline.
+ */
+export const AuditExternalSinkSchema = z.object({
+    /** Provider name (matches `AuditProvider.name`). */
+    name: z.string(),
+    /**
+     * Operator-facing deep-link to the external sink's console, when
+     * available. `null` when `queryUrl()` returned null or wasn't
+     * implemented.
+     */
+    url: z.string().nullable(),
+});
+/**
+ * Response body for `GET /api/audit`. Carries inline events from
+ * queryable providers + sink references for external-only providers.
+ * The drawer composes both into one user-facing surface.
+ */
+export const AuditQueryResponseSchema = z.object({
+    events: z.array(AuditEventSchema),
+    /** External sinks whose events are NOT in the inline events array. */
+    externalSinks: z.array(AuditExternalSinkSchema),
+});
+//# sourceMappingURL=audit.js.map

package/dist/admin-api/schemas/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/admin-api/schemas/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC;IACtC,MAAM;IACN,SAAS;IACT,QAAQ;IACR,SAAS;IACT,iBAAiB;IACjB,YAAY;IACZ,iEAAiE;IACjE,SAAS;IACT,WAAW;IACX,OAAO;IACP,QAAQ;CACT,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC;IACvC,SAAS;IACT,WAAW;IACX,mBAAmB;IACnB,iBAAiB;IACjB,gBAAgB;IAChB,SAAS;CACV,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAGjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,gBAAgB;IACvB,MAAM,EAAE,iBAAiB;IACzB,OAAO,EAAE,kBAAkB;IAC3B,KAAK,EAAE,gBAAgB;IACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvD,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,oDAAoD;IACpD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB;;;;OAIG;IACH,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAA;AAGF;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACjC,sEAAsE;IACtE,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;CAChD,CAAC,CAAA"}

package/dist/admin-api/schemas/error.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Shared shape for admin-API error responses.
+ *
+ * Most error responses follow `{ code: ErrorCode, message: string }`.
+ * Error classes that carry typed extras (`STALE` carries `current` +
+ * `currentEtag`; `VALIDATION_FAILED` carries `issues`) declare their
+ * own schema in the relevant route module — those schemas extend the
+ * base shape, they don't replace it.
+ *
+ * # Why this exists
+ *
+ * Per `docs/audits/test-quality-with-ai.md` cycle 1: error-shape
+ * tautology was the highest-leverage finding. Tests asserted on
+ * status code only; mutation testing showed `code: 'BAD_REQUEST'`
+ * survives mutation to `code: ''` because no test asserts on the
+ * body's `code` field. The fix is structural — assert against the
+ * schema, not the observed shape.
+ *
+ * # Usage
+ *
+ * Tests assert on error responses through `ErrorResponseSchema`:
+ *
+ *   const body = ErrorResponseSchema.parse(await res.json())
+ *   expect(body.code).toBe('BAD_REQUEST')
+ *
+ * `parse` (not `safeParse`) is intentional — a malformed error body
+ * is itself a regression. Failing to round-trip through the schema
+ * is the assertion.
+ *
+ * # Extending
+ *
+ * Routes that emit a typed error variant declare a discriminated
+ * schema in their own module (e.g. `StaleResponseSchema` in
+ * `pages.ts`). The base `ErrorCodeSchema` enum lists every code
+ * the admin-API may emit; extend it when new error classes ship.
+ */
+import { z } from 'zod';
+/**
+ * Closed enum of every error code the admin-API emits.
+ *
+ * Adding a new error class = one new entry here + a route-module
+ * extension if the error carries typed extras. Keeping the enum
+ * closed prevents drift: a route that returns `code: 'NEW_THING'`
+ * without updating this enum fails schema validation in tests, which
+ * surfaces the missing entry before it ships.
+ */
+export declare const ErrorCodeSchema: z.ZodEnum<{
+    ASSET_MANIFEST_NOT_FOUND: "ASSET_MANIFEST_NOT_FOUND";
+    AI_ADAPTER_UNAVAILABLE: "AI_ADAPTER_UNAVAILABLE";
+    AI_ADAPTER_FAILED: "AI_ADAPTER_FAILED";
+    STALE: "STALE";
+    VALIDATION_FAILED: "VALIDATION_FAILED";
+    HOOK_CANCELLED: "HOOK_CANCELLED";
+    NOT_FOUND: "NOT_FOUND";
+    UNAUTHENTICATED: "UNAUTHENTICATED";
+    FORBIDDEN: "FORBIDDEN";
+    ARCHIVED_NAME_CONFLICT: "ARCHIVED_NAME_CONFLICT";
+    PUBLISH_AUDIT_FAILED: "PUBLISH_AUDIT_FAILED";
+    BAD_REQUEST: "BAD_REQUEST";
+}>;
+export type ErrorCode = z.infer<typeof ErrorCodeSchema>;
+/**
+ * Base error-response shape. Every admin-API error response
+ * round-trips through this OR a route-specific extension of it.
+ *
+ * Optional fields:
+ *   - `message` — human-readable; present on every error today, but
+ *     marked optional because the closed-enum `code` is the stable
+ *     contract; future error classes might omit `message` if the
+ *     code alone carries enough information.
+ *   - `missing` — `FORBIDDEN` responses carry the missing capability
+ *     list per `design-auth-rbac.md` Q3 lock; reserved at the base
+ *     so test assertions don't have to discriminate by code first.
+ */
+export declare const ErrorResponseSchema: z.ZodObject<{
+    code: z.ZodEnum<{
+        ASSET_MANIFEST_NOT_FOUND: "ASSET_MANIFEST_NOT_FOUND";
+        AI_ADAPTER_UNAVAILABLE: "AI_ADAPTER_UNAVAILABLE";
+        AI_ADAPTER_FAILED: "AI_ADAPTER_FAILED";
+        STALE: "STALE";
+        VALIDATION_FAILED: "VALIDATION_FAILED";
+        HOOK_CANCELLED: "HOOK_CANCELLED";
+        NOT_FOUND: "NOT_FOUND";
+        UNAUTHENTICATED: "UNAUTHENTICATED";
+        FORBIDDEN: "FORBIDDEN";
+        ARCHIVED_NAME_CONFLICT: "ARCHIVED_NAME_CONFLICT";
+        PUBLISH_AUDIT_FAILED: "PUBLISH_AUDIT_FAILED";
+        BAD_REQUEST: "BAD_REQUEST";
+    }>;
+    message: z.ZodOptional<z.ZodString>;
+    missing: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type ErrorResponse = z.infer<typeof ErrorResponseSchema>;
+//# sourceMappingURL=error.d.ts.map

package/dist/admin-api/schemas/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../src/admin-api/schemas/error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;EAa1B,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAEvD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;iBAI9B,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA"}