ldrouter 1.5.1

package/dist/server/providers/index.js

@@ -0,0 +1,89 @@
+// Upstream provider adapters: OpenAI-compatible + Anthropic-compatible.
+function buildHeaders(cfg, extra) {
+    const h = {
+        'content-type': 'application/json',
+        'user-agent': 'latedev-router/0.1',
+        ...cfg.customHeaders,
+        ...(extra ?? {}),
+    };
+    if (cfg.type === 'openai')
+        h['authorization'] = `Bearer ${cfg.apiKey}`;
+    else
+        h['x-api-key'] = cfg.apiKey;
+    return h;
+}
+async function fetchWithTimeout(url, init, totalTimeoutMs) {
+    const ctl = new AbortController();
+    const timer = setTimeout(() => ctl.abort(), totalTimeoutMs);
+    try {
+        return await fetch(url, { ...init, signal: ctl.signal });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+export async function probeProvider(cfg) {
+    const start = Date.now();
+    try {
+        const url = cfg.type === 'openai' ? `${stripSlash(cfg.baseUrl)}/v1/models` : `${stripSlash(cfg.baseUrl)}/v1/models`;
+        const res = await fetchWithTimeout(url, { method: 'GET', headers: buildHeaders(cfg) }, cfg.totalTimeoutMs);
+        const latency = Date.now() - start;
+        if (res.ok) {
+            const body = (await res.json());
+            const count = Array.isArray(body) ? body.length : Array.isArray(body.data) ? body.data.length : 0;
+            return { ok: true, detail: `Connected (${res.status})`, latencyMs: latency, modelCount: count };
+        }
+        return { ok: false, detail: `HTTP ${res.status}`, latencyMs: latency };
+    }
+    catch (e) {
+        return { ok: false, detail: e.message, latencyMs: Date.now() - start };
+    }
+}
+export async function discoverProviderModels(cfg) {
+    if (cfg.type === 'openai')
+        return discoverOpenAI(cfg);
+    return discoverAnthropic(cfg);
+}
+async function discoverOpenAI(cfg) {
+    const all = [];
+    let url = `${stripSlash(cfg.baseUrl)}/v1/models`;
+    while (url) {
+        const res = await fetchWithTimeout(url, { method: 'GET', headers: buildHeaders(cfg) }, cfg.totalTimeoutMs);
+        if (!res.ok)
+            throw new Error(`Provider returned HTTP ${res.status}`);
+        const body = (await res.json());
+        for (const m of body.data ?? []) {
+            all.push({
+                upstreamId: m.id,
+                displayName: m.id,
+                capabilities: inferOpenAICapabilities(m.id),
+            });
+        }
+        break; // OpenAI list models is not paginated by default; if upstream returns next, we could follow.
+    }
+    return all;
+}
+async function discoverAnthropic(_cfg) {
+    // Anthropic has no public model listing API; provide best-effort common defaults.
+    // In production deployments, admins add models manually or via custom discovery.
+    return [
+        { upstreamId: 'claude-3-5-sonnet-latest', displayName: 'Claude 3.5 Sonnet', capabilities: { chat: true, streaming: true, tools: true, image_input: true } },
+        { upstreamId: 'claude-3-5-haiku-latest', displayName: 'Claude 3.5 Haiku', capabilities: { chat: true, streaming: true, tools: true } },
+        { upstreamId: 'claude-3-opus-latest', displayName: 'Claude 3 Opus', capabilities: { chat: true, streaming: true, tools: true, image_input: true } },
+    ];
+}
+function inferOpenAICapabilities(id) {
+    const lower = id.toLowerCase();
+    return {
+        chat: true,
+        streaming: true,
+        tools: !(lower.includes('embedding') || lower.includes('whisper') || lower.includes('dall-e') || lower.includes('tts')),
+        image_input: lower.includes('vision') || lower.includes('gpt-4o') || lower.includes('4-vision') || lower.includes('claude'),
+        structured_output: lower.includes('gpt-4') || lower.includes('gpt-3.5') || lower.includes('o1') || lower.includes('claude'),
+        reasoning: lower.includes('o1') || lower.includes('o3') || lower.includes('reasoning'),
+    };
+}
+function stripSlash(u) {
+    return u.endsWith('/') ? u.slice(0, -1) : u;
+}
+export { buildHeaders, fetchWithTimeout, stripSlash };

package/dist/server/routes/admin/aliases.js

@@ -0,0 +1,98 @@
+// Admin API: model aliases CRUD.
+import { z } from 'zod';
+import { eq } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { uuid, slugify } from '../../auth/ids.js';
+import { GatewayError } from '../../errors.js';
+const AliasCreate = z.object({
+    alias: z.string().min(1).max(64),
+    targetKind: z.enum(['model', 'combo']),
+    targetId: z.string(),
+    enabled: z.boolean().optional(),
+});
+const AliasUpdate = AliasCreate.partial().extend({ id: z.string() });
+export async function registerAliasRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/aliases', async () => {
+        const db = getDb();
+        const rows = db.select().from(schema.modelAliases).all();
+        const models = db.select().from(schema.models).all();
+        const combos = db.select().from(schema.combos).all();
+        const modelMap = new Map(models.map((m) => [m.id, m]));
+        const comboMap = new Map(combos.map((c) => [c.id, c]));
+        return {
+            aliases: rows.map((a) => ({
+                id: a.id,
+                alias: a.alias,
+                targetKind: a.targetKind,
+                targetId: a.targetId,
+                targetName: a.targetKind === 'model' ? modelMap.get(a.targetId)?.publicModelId : comboMap.get(a.targetId)?.publicModelId,
+                enabled: a.enabled,
+            })),
+        };
+    });
+    app.post('/api/admin/aliases', async (req) => {
+        const body = AliasCreate.parse(req.body);
+        const db = getDb();
+        const alias = slugify(body.alias);
+        // Verify target exists and is enabled
+        if (body.targetKind === 'model') {
+            const m = db.select().from(schema.models).where(eq(schema.models.id, body.targetId)).get();
+            if (!m)
+                throw new GatewayError('invalid_request_error', 'Target model not found', { status: 400 });
+            if (db.select().from(schema.modelAliases).where(eq(schema.modelAliases.alias, alias)).get()) {
+                throw new GatewayError('invalid_request_error', 'Alias already in use', { status: 400 });
+            }
+            if (db.select().from(schema.models).where(eq(schema.models.publicModelId, alias)).get()) {
+                throw new GatewayError('invalid_request_error', 'Alias shadows a physical model ID', { status: 400 });
+            }
+        }
+        else {
+            const c = db.select().from(schema.combos).where(eq(schema.combos.id, body.targetId)).get();
+            if (!c)
+                throw new GatewayError('invalid_request_error', 'Target combo not found', { status: 400 });
+            if (db.select().from(schema.modelAliases).where(eq(schema.modelAliases.alias, alias)).get()) {
+                throw new GatewayError('invalid_request_error', 'Alias already in use', { status: 400 });
+            }
+        }
+        const id = uuid();
+        db.insert(schema.modelAliases).values({ id, alias, targetKind: body.targetKind, targetId: body.targetId, enabled: body.enabled ?? true }).run();
+        recordAudit({ action: 'alias.create', success: true, targetType: 'alias', targetId: id, targetName: alias, ip: req.ip });
+        return { id, alias };
+    });
+    app.patch('/api/admin/aliases', async (req) => {
+        const body = AliasUpdate.parse(req.body);
+        const db = getDb();
+        const a = db.select().from(schema.modelAliases).where(eq(schema.modelAliases.id, body.id)).get();
+        if (!a)
+            throw new GatewayError('invalid_request_error', 'Alias not found', { status: 404 });
+        const update = { updatedAt: new Date().toISOString(), configVersion: a.configVersion + 1 };
+        if (body.alias)
+            update.alias = slugify(body.alias);
+        if (body.targetKind)
+            update.targetKind = body.targetKind;
+        if (body.targetId)
+            update.targetId = body.targetId;
+        if (body.enabled !== undefined)
+            update.enabled = body.enabled;
+        db.update(schema.modelAliases).set(update).where(eq(schema.modelAliases.id, body.id)).run();
+        const { invalidateCacheFor } = await import('../../caching/store.js');
+        invalidateCacheFor('alias', body.id);
+        recordAudit({ action: 'alias.update', success: true, targetType: 'alias', targetId: body.id, targetName: a.alias, ip: req.ip });
+        return { ok: true };
+    });
+    app.delete('/api/admin/aliases/:id', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const a = db.select().from(schema.modelAliases).where(eq(schema.modelAliases.id, id)).get();
+        if (!a)
+            throw new GatewayError('invalid_request_error', 'Alias not found', { status: 404 });
+        db.delete(schema.modelAliases).where(eq(schema.modelAliases.id, id)).run();
+        const { invalidateCacheFor } = await import('../../caching/store.js');
+        invalidateCacheFor('alias', id);
+        recordAudit({ action: 'alias.delete', success: true, targetType: 'alias', targetId: id, targetName: a.alias, ip: req.ip });
+        return { ok: true };
+    });
+}

package/dist/server/routes/admin/api-keys.js

@@ -0,0 +1,194 @@
+// Admin API: API key management (ld-.. keys).
+import { z } from 'zod';
+import { eq } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { generateApiKeySecret, sha256Hex, uuid } from '../../auth/ids.js';
+import { encryptSecret, decryptSecret } from '../../auth/crypto.js';
+import { GatewayError } from '../../errors.js';
+const PermEntry = z.object({ targetKind: z.enum(['model', 'combo', 'alias']), targetId: z.string() });
+const IPRule = z.object({ mode: z.enum(['allow', 'deny']), cidr: z.string().min(1).max(64) });
+const ApiKeyCreate = z.object({
+    name: z.string().min(1).max(128),
+    enabled: z.boolean().optional(),
+    secret: z.string().min(1).max(256).optional(),
+    expiresAt: z.string().nullable().optional(),
+    allowAllModels: z.boolean().optional(),
+    permissions: z.array(PermEntry).optional(),
+    ipRules: z.array(IPRule).optional(),
+    rpmLimit: z.number().int().min(1).nullable().optional(),
+    tpmLimit: z.number().int().min(1).nullable().optional(),
+    dailyTokenLimit: z.number().int().min(1).nullable().optional(),
+    monthlyTokenLimit: z.number().int().min(1).nullable().optional(),
+    maxConcurrent: z.number().int().min(1).nullable().optional(),
+    maxOutputTokensPerRequest: z.number().int().min(1).nullable().optional(),
+    cacheOverrideEnabled: z.boolean().nullable().optional(),
+});
+const ApiKeyUpdate = ApiKeyCreate.partial().extend({ id: z.string() });
+export async function registerApiKeyRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/api-keys', async () => {
+        const db = getDb();
+        const rows = db.select().from(schema.apiKeys).all();
+        const perms = db.select().from(schema.apiKeyModelPermissions).all();
+        return {
+            apiKeys: rows.map((k) => ({
+                id: k.id,
+                name: k.name,
+                keyPrefix: k.keyPrefix,
+                enabled: k.enabled,
+                expiresAt: k.expiresAt,
+                lastUsedAt: k.lastUsedAt,
+                allowAllModels: k.allowAllModels,
+                modelScopeCount: perms.filter((p) => p.apiKeyId === k.id).length,
+                rpmLimit: k.rpmLimit,
+                tpmLimit: k.tpmLimit,
+                concurrencyLimit: k.maxConcurrent,
+                secret: k.keySecretEncrypted && k.keySecretNonce
+                    ? decryptSecret({ ciphertext: k.keySecretEncrypted, nonce: k.keySecretNonce, version: k.keySecretVersion ?? 1 })
+                    : null,
+            })),
+        };
+    });
+    app.get('/api/admin/api-keys/:id', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const k = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.id, id)).get();
+        if (!k)
+            throw new GatewayError('invalid_request_error', 'API key not found', { status: 404 });
+        const perms = db.select().from(schema.apiKeyModelPermissions).where(eq(schema.apiKeyModelPermissions.apiKeyId, id)).all();
+        const ipRules = db.select().from(schema.apiKeyIpRules).where(eq(schema.apiKeyIpRules.apiKeyId, id)).all();
+        return {
+            apiKey: {
+                id: k.id,
+                name: k.name,
+                keyPrefix: k.keyPrefix,
+                enabled: k.enabled,
+                expiresAt: k.expiresAt,
+                allowAllModels: k.allowAllModels,
+                permissions: perms,
+                ipRules,
+                rpmLimit: k.rpmLimit,
+                tpmLimit: k.tpmLimit,
+                dailyTokenLimit: k.dailyTokenLimit,
+                monthlyTokenLimit: k.monthlyTokenLimit,
+                maxConcurrent: k.maxConcurrent,
+                maxOutputTokensPerRequest: k.maxOutputTokensPerRequest,
+                cacheOverrideEnabled: k.cacheOverrideEnabled,
+                secret: k.keySecretEncrypted && k.keySecretNonce
+                    ? decryptSecret({ ciphertext: k.keySecretEncrypted, nonce: k.keySecretNonce, version: k.keySecretVersion ?? 1 })
+                    : null,
+            },
+        };
+    });
+    app.post('/api/admin/api-keys', async (req) => {
+        const body = ApiKeyCreate.parse(req.body);
+        const db = getDb();
+        // Custom secret if provided, else auto-generate
+        const secret = body.secret && body.secret.trim().length > 0
+            ? body.secret.trim()
+            : generateApiKeySecret();
+        const id = uuid();
+        const keyPrefix = secret.slice(0, 11);
+        const keyDigest = sha256Hex(secret);
+        const enc = encryptSecret(secret);
+        db.insert(schema.apiKeys).values({
+            id,
+            name: body.name,
+            keyPrefix,
+            keyDigest,
+            keySecretEncrypted: enc.ciphertext,
+            keySecretNonce: enc.nonce,
+            keySecretVersion: enc.version,
+            enabled: body.enabled ?? true,
+            expiresAt: body.expiresAt ?? null,
+            allowAllModels: body.allowAllModels ?? false,
+            rpmLimit: body.rpmLimit ?? null,
+            tpmLimit: body.tpmLimit ?? null,
+            dailyTokenLimit: body.dailyTokenLimit ?? null,
+            monthlyTokenLimit: body.monthlyTokenLimit ?? null,
+            maxConcurrent: body.maxConcurrent ?? null,
+            maxOutputTokensPerRequest: body.maxOutputTokensPerRequest ?? null,
+            cacheOverrideEnabled: body.cacheOverrideEnabled ?? null,
+        }).run();
+        if (body.permissions) {
+            for (const p of body.permissions) {
+                db.insert(schema.apiKeyModelPermissions).values({ id: uuid(), apiKeyId: id, targetKind: p.targetKind, targetId: p.targetId }).run();
+            }
+        }
+        if (body.ipRules) {
+            for (const r of body.ipRules) {
+                db.insert(schema.apiKeyIpRules).values({ id: uuid(), apiKeyId: id, mode: r.mode, cidr: r.cidr }).run();
+            }
+        }
+        recordAudit({ action: 'api_key.create', success: true, targetType: 'api_key', targetId: id, targetName: body.name, ip: req.ip, metadata: { permissions: body.permissions?.length ?? 0, custom: body.secret ? true : false } });
+        return { id, name: body.name, secret, keyPrefix };
+    });
+    app.patch('/api/admin/api-keys', async (req) => {
+        const body = ApiKeyUpdate.parse(req.body);
+        const db = getDb();
+        const k = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.id, body.id)).get();
+        if (!k)
+            throw new GatewayError('invalid_request_error', 'API key not found', { status: 404 });
+        const update = { updatedAt: new Date().toISOString() };
+        if (body.name)
+            update.name = body.name;
+        if (body.enabled !== undefined)
+            update.enabled = body.enabled;
+        if (body.expiresAt !== undefined)
+            update.expiresAt = body.expiresAt;
+        if (body.allowAllModels !== undefined)
+            update.allowAllModels = body.allowAllModels;
+        if (body.rpmLimit !== undefined)
+            update.rpmLimit = body.rpmLimit;
+        if (body.tpmLimit !== undefined)
+            update.tpmLimit = body.tpmLimit;
+        if (body.dailyTokenLimit !== undefined)
+            update.dailyTokenLimit = body.dailyTokenLimit;
+        if (body.monthlyTokenLimit !== undefined)
+            update.monthlyTokenLimit = body.monthlyTokenLimit;
+        if (body.maxConcurrent !== undefined)
+            update.maxConcurrent = body.maxConcurrent;
+        if (body.maxOutputTokensPerRequest !== undefined)
+            update.maxOutputTokensPerRequest = body.maxOutputTokensPerRequest;
+        if (body.cacheOverrideEnabled !== undefined)
+            update.cacheOverrideEnabled = body.cacheOverrideEnabled;
+        db.update(schema.apiKeys).set(update).where(eq(schema.apiKeys.id, body.id)).run();
+        if (body.permissions) {
+            db.delete(schema.apiKeyModelPermissions).where(eq(schema.apiKeyModelPermissions.apiKeyId, body.id)).run();
+            for (const p of body.permissions) {
+                db.insert(schema.apiKeyModelPermissions).values({ id: uuid(), apiKeyId: body.id, targetKind: p.targetKind, targetId: p.targetId }).run();
+            }
+        }
+        if (body.ipRules) {
+            db.delete(schema.apiKeyIpRules).where(eq(schema.apiKeyIpRules.apiKeyId, body.id)).run();
+            for (const r of body.ipRules) {
+                db.insert(schema.apiKeyIpRules).values({ id: uuid(), apiKeyId: body.id, mode: r.mode, cidr: r.cidr }).run();
+            }
+        }
+        recordAudit({ action: 'api_key.update', success: true, targetType: 'api_key', targetId: body.id, targetName: k.name, ip: req.ip });
+        return { ok: true };
+    });
+    app.post('/api/admin/api-keys/:id/revoke', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const k = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.id, id)).get();
+        if (!k)
+            throw new GatewayError('invalid_request_error', 'API key not found', { status: 404 });
+        db.update(schema.apiKeys).set({ enabled: false, updatedAt: new Date().toISOString() }).where(eq(schema.apiKeys.id, id)).run();
+        recordAudit({ action: 'api_key.revoke', success: true, targetType: 'api_key', targetId: id, targetName: k.name, ip: req.ip });
+        return { ok: true };
+    });
+    app.delete('/api/admin/api-keys/:id', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const k = db.select().from(schema.apiKeys).where(eq(schema.apiKeys.id, id)).get();
+        if (!k)
+            throw new GatewayError('invalid_request_error', 'API key not found', { status: 404 });
+        // Soft-delete: keep name/prefix snapshot for history; mark disabled
+        db.update(schema.apiKeys).set({ enabled: false, updatedAt: new Date().toISOString(), name: `${k.name} (deleted ${new Date().toISOString().slice(0, 10)})` }).where(eq(schema.apiKeys.id, id)).run();
+        recordAudit({ action: 'api_key.delete', success: true, targetType: 'api_key', targetId: id, targetName: k.name, ip: req.ip });
+        return { ok: true };
+    });
+}

package/dist/server/routes/admin/audit.js

@@ -0,0 +1,19 @@
+// Admin API: audit logs.
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { queryAudit } from '../../db/repositories/audit.js';
+export async function registerAuditRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/audit', async (req) => {
+        const q = req.query;
+        const { rows, total } = queryAudit({
+            from: q.from,
+            to: q.to,
+            action: q.action,
+            success: q.success === undefined ? undefined : q.success === 'true',
+            search: q.search,
+            limit: q.limit ? Number(q.limit) : undefined,
+            offset: q.offset ? Number(q.offset) : undefined,
+        });
+        return { total, rows };
+    });
+}

package/dist/server/routes/admin/auth.js

@@ -0,0 +1,124 @@
+import { z } from 'zod';
+import argon2 from 'argon2';
+import { getDb, schema } from '../../db/index.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { uuid, generateSessionToken, sha256Hex } from '../../auth/ids.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { GatewayError } from '../../errors.js';
+const LoginBody = z.object({
+    username: z.string().min(1).max(64),
+    password: z.string().min(1).max(256),
+    totp: z.string().regex(/^\d{6}$/).optional(),
+    recoveryCode: z.string().optional(),
+});
+const SessionCookie = 'ld_session';
+const COOKIE_MAX_AGE = 60 * 60 * 12; // 12h
+function sessionExpiry() {
+    return new Date(Date.now() + COOKIE_MAX_AGE * 1000).toISOString();
+}
+export async function registerAuthRoutes(app) {
+    app.post('/api/admin/login', {
+        config: { rateLimit: { max: 5, timeWindow: '1 minute' } },
+    }, async (req, reply) => {
+        const body = LoginBody.parse(req.body);
+        const db = getDb();
+        const account = db.select().from(schema.adminAccount).get();
+        if (!account)
+            throw new GatewayError('authentication_error', 'Invalid credentials', { status: 401 });
+        const ok = await argon2.verify(account.passwordHash, body.password);
+        db.insert(schema.loginAttempts).values({
+            id: uuid(),
+            username: body.username,
+            ip: req.ip,
+            success: ok,
+        }).run();
+        if (!ok) {
+            recordAudit({ action: 'admin.login', success: false, ip: req.ip, targetName: body.username });
+            throw new GatewayError('authentication_error', 'Invalid credentials', { status: 401 });
+        }
+        if (account.totpEnabled) {
+            if (body.recoveryCode) {
+                // Verify against any unused recovery code
+                const codes = db.select().from(schema.adminRecoveryCodes).where(sql `admin_id = ${account.id} AND used_at IS NULL`).all();
+                let matched = false;
+                for (const c of codes) {
+                    if (await argon2.verify(c.codeHash, body.recoveryCode)) {
+                        db.update(schema.adminRecoveryCodes).set({ usedAt: new Date().toISOString() }).where(sql `id = ${c.id}`).run();
+                        matched = true;
+                        break;
+                    }
+                }
+                if (!matched) {
+                    recordAudit({ action: 'admin.login', success: false, ip: req.ip, targetName: body.username, metadata: { reason: 'recovery_code' } });
+                    throw new GatewayError('authentication_error', 'Invalid recovery code', { status: 401 });
+                }
+            }
+            else if (body.totp) {
+                const ok2 = await verifyTotp(account, body.totp);
+                if (!ok2) {
+                    recordAudit({ action: 'admin.login', success: false, ip: req.ip, targetName: body.username, metadata: { reason: 'totp' } });
+                    throw new GatewayError('authentication_error', 'Invalid TOTP', { status: 401 });
+                }
+            }
+            else {
+                // TOTP required, not provided
+                reply.code(401).send({ error: { type: 'totp_required', message: 'TOTP code required' } });
+                return;
+            }
+        }
+        // Issue session
+        const token = generateSessionToken();
+        const id = uuid();
+        db.insert(schema.adminSessions).values({
+            id,
+            tokenDigest: sha256Hex(token),
+            expiresAt: sessionExpiry(),
+            ip: req.ip,
+            userAgent: (req.headers['user-agent'] ?? '').toString().slice(0, 256),
+        }).run();
+        db.update(schema.adminAccount).set({ lastLoginAt: new Date().toISOString() }).where(sql `id = ${account.id}`).run();
+        recordAudit({ action: 'admin.login', success: true, ip: req.ip, targetType: 'admin', targetId: account.id, targetName: account.username });
+        reply.setCookie(SessionCookie, token, {
+            path: '/',
+            httpOnly: true,
+            sameSite: 'lax',
+            secure: req.protocol === 'https',
+            maxAge: COOKIE_MAX_AGE,
+        });
+        return { ok: true, username: account.username, totpEnabled: account.totpEnabled };
+    });
+    app.post('/api/admin/logout', async (req, reply) => {
+        const token = req.cookies[SessionCookie];
+        if (token) {
+            const digest = sha256Hex(token);
+            const db = getDb();
+            db.delete(schema.adminSessions).where(sql `token_digest = ${digest}`).run();
+        }
+        reply.clearCookie(SessionCookie, { path: '/' });
+        return { ok: true };
+    });
+    app.get('/api/admin/me', { preHandler: requireAdminAuth }, async (req) => {
+        const account = req.adminAccount;
+        return {
+            id: account.id,
+            username: account.username,
+            totpEnabled: account.totpEnabled,
+        };
+    });
+}
+async function verifyTotp(account, code) {
+    if (!account.totpSecretEncrypted || !account.totpSecretNonce)
+        return false;
+    // Lazy-load to avoid breaking things if crypto module not yet ready
+    const { decryptSecret } = await import('../../auth/crypto.js');
+    const speakeasy = await import('speakeasy');
+    const payload = { ciphertext: account.totpSecretEncrypted, nonce: account.totpSecretNonce, version: 1 };
+    try {
+        const secret = decryptSecret({ ciphertext: payload.ciphertext, nonce: payload.nonce, version: 1 });
+        return speakeasy.authenticator.verify({ token: code, secret, window: 1 });
+    }
+    catch {
+        return false;
+    }
+}
+import { sql } from 'drizzle-orm';

package/dist/server/routes/admin/backup.js

@@ -0,0 +1,113 @@
+// Admin API: database backup / restore.
+import fs from 'node:fs';
+import path from 'node:path';
+import zlib from 'node:zlib';
+import crypto from 'node:crypto';
+import { getDb } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { loadConfig } from '../../config/index.js';
+import { getSettings } from '../../db/repositories/settings.js';
+import { GatewayError } from '../../errors.js';
+const BACKUP_VERSION = 1;
+const APP_VERSION = '0.1.0';
+export async function registerBackupRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.post('/api/admin/backup/create', async (req, reply) => {
+        const cfg = loadConfig();
+        const temp = path.join(cfg.dataDir, `.backup-${Date.now()}.sqlite`);
+        const Database = (await import('better-sqlite3')).default;
+        const source = new Database(cfg.dbFile, { readonly: true });
+        try {
+            await source.backup(temp);
+        }
+        finally {
+            source.close();
+        }
+        const buf = fs.readFileSync(temp);
+        fs.unlinkSync(temp);
+        const compressed = zlib.gzipSync(buf, { level: 6 });
+        const checksum = crypto.createHash('sha256').update(compressed).digest('hex');
+        const settings = getSettings();
+        const envelope = {
+            format: 'latedev-backup',
+            version: BACKUP_VERSION,
+            appVersion: APP_VERSION,
+            schemaVersion: settings.schemaVersion,
+            masterKeyConfigured: settings.masterKeyConfigured,
+            createdAt: new Date().toISOString(),
+            payload: compressed.toString('base64'),
+            checksum,
+        };
+        const envBuf = Buffer.from(JSON.stringify(envelope), 'utf8');
+        const fileName = `latedev-backup-${new Date().toISOString().replace(/[:.]/g, '-')}.ldb.json`;
+        reply.header('content-type', 'application/json');
+        reply.header('content-disposition', `attachment; filename="${fileName}"`);
+        recordAudit({ action: 'db.backup_download', success: true, ip: req.ip, metadata: { sizeBytes: envBuf.length, checksum } });
+        return reply.send(envBuf);
+    });
+    app.post('/api/admin/backup/restore', async (req, reply) => {
+        const cfg = loadConfig();
+        // Expect raw JSON envelope in body
+        let envelope;
+        try {
+            envelope = req.body;
+            if (!envelope || envelope.format !== 'latedev-backup')
+                throw new Error('not a backup envelope');
+        }
+        catch {
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'invalid_envelope' } });
+            throw new GatewayError('invalid_request_error', 'Invalid backup file format', { status: 400 });
+        }
+        if (envelope.version > BACKUP_VERSION) {
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'future_version', version: envelope.version } });
+            throw new GatewayError('invalid_request_error', `Backup version ${envelope.version} is not supported (max ${BACKUP_VERSION})`, { status: 400 });
+        }
+        const compressed = Buffer.from(envelope.payload, 'base64');
+        const checksum = crypto.createHash('sha256').update(compressed).digest('hex');
+        if (checksum !== envelope.checksum) {
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'checksum_mismatch' } });
+            throw new GatewayError('invalid_request_error', 'Backup checksum mismatch', { status: 400 });
+        }
+        let buf;
+        try {
+            buf = zlib.gunzipSync(compressed);
+        }
+        catch {
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'decompress_failed' } });
+            throw new GatewayError('invalid_request_error', 'Backup decompression failed', { status: 400 });
+        }
+        // Validate SQLite header
+        if (!(buf[0] === 0x53 && buf[1] === 0x51 && buf[2] === 0x4c && buf[3] === 0x69 && buf[4] === 0x74 && buf[5] === 0x65)) {
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'not_sqlite' } });
+            throw new GatewayError('invalid_request_error', 'Backup does not contain a valid SQLite database', { status: 400 });
+        }
+        // Snapshot current DB before restore
+        const db = getDb();
+        void db;
+        const snapshot = path.join(cfg.dataDir, `pre-restore-${Date.now()}.sqlite`);
+        const Database = (await import('better-sqlite3')).default;
+        const live = new Database(cfg.dbFile);
+        try {
+            await live.backup(snapshot);
+        }
+        catch (e) {
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'snapshot_failed', err: String(e) } });
+            throw new GatewayError('gateway_error', 'Could not snapshot current database', { status: 500 });
+        }
+        // Atomic replace
+        const liveDb = cfg.dbFile;
+        const tempDb = `${liveDb}.restore-${Date.now()}`;
+        fs.writeFileSync(tempDb, buf);
+        try {
+            fs.renameSync(tempDb, liveDb);
+        }
+        catch (e) {
+            fs.unlinkSync(tempDb);
+            recordAudit({ action: 'db.restore', success: false, ip: req.ip, metadata: { reason: 'rename_failed', err: String(e) } });
+            throw new GatewayError('gateway_error', 'Restore atomic replace failed', { status: 500 });
+        }
+        recordAudit({ action: 'db.restore', success: true, ip: req.ip, metadata: { schemaVersion: envelope.schemaVersion } });
+        return reply.code(200).send({ ok: true, message: 'Restore completed. Please restart the gateway for changes to take effect.' });
+    });
+}