@abloatai/transaction 0.37.0

package/dist/webhooks/events.d.ts

@@ -0,0 +1,44 @@
+/**
+ * A webhook event delivered to a customer's endpoint, representing a single
+ * committed change to a row. {@link deltaToWebhookEvent} produces it, and the
+ * recipient verifies the delivery signature before trusting its contents.
+ */
+export interface AbloWebhookEvent {
+    /** A stable, unique event identifier equal to `String(syncId)`. Use it to
+     *  deduplicate deliveries. */
+    readonly id: string;
+    /** The event type, formatted as `<model>.<verb>`, such as `"report.updated"`.
+     *  Branch on this to route the event. */
+    readonly type: string;
+    /** The name of the model whose row changed, such as `"Report"`. */
+    readonly model: string;
+    /** The identifier of the row that changed. */
+    readonly objectId: string;
+    /** The change's position in the transaction log, increasing monotonically.
+     *  Order events by this value. */
+    readonly syncId: number;
+    /** The row as it stands after the change, or `null` when the change was a
+     *  delete. */
+    readonly data: Record<string, unknown> | null;
+    /** The time the change was committed, as an ISO 8601 timestamp. */
+    readonly createdAt: string;
+}
+/** The minimal delta shape {@link deltaToWebhookEvent} reads; a full server-side
+ *  delta record satisfies it. */
+export interface WebhookSourceDelta {
+    readonly id: number;
+    readonly actionType: string;
+    readonly modelName: string;
+    readonly modelId: string;
+    /** The row payload: an already-parsed object, a raw JSON string, or `null`. */
+    readonly data: Record<string, unknown> | string | null;
+    readonly createdAt: string;
+}
+/**
+ * Converts a committed delta into an {@link AbloWebhookEvent}. Returns `null`
+ * when the delta records an internal permission or group change rather than a
+ * row-level change, in which case the caller emits no webhook. The mapping is
+ * deterministic: the event id and timestamp come directly from the delta.
+ */
+export declare function deltaToWebhookEvent(delta: WebhookSourceDelta): AbloWebhookEvent | null;
+//# sourceMappingURL=events.d.ts.map

package/dist/webhooks/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/webhooks/events.ts"],"names":[],"mappings":"AA8BA;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B;kCAC8B;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;6CACyC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;sCACkC;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;kBACc;IACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC9C,mEAAmE;IACnE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;iCACiC;AACjC,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,GAAG,IAAI,CAAC;IACvD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAUD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,kBAAkB,GAAG,gBAAgB,GAAG,IAAI,CAatF"}

package/dist/webhooks/events.js

@@ -0,0 +1,43 @@
+/**
+ * Maps each delta action code to the verb that appears in an event type. Only
+ * the row-level create, update, delete, archive, and unarchive actions produce a
+ * webhook. The remaining action codes describe internal permission and
+ * visibility changes and are deliberately absent, so {@link deltaToWebhookEvent}
+ * returns `null` for them.
+ */
+const ACTION_VERB = {
+    I: 'created',
+    U: 'updated',
+    D: 'deleted',
+    A: 'archived',
+    V: 'unarchived',
+};
+function parseRow(data) {
+    if (data == null)
+        return null;
+    if (typeof data === 'string') {
+        return data === '' ? null : JSON.parse(data);
+    }
+    return data;
+}
+/**
+ * Converts a committed delta into an {@link AbloWebhookEvent}. Returns `null`
+ * when the delta records an internal permission or group change rather than a
+ * row-level change, in which case the caller emits no webhook. The mapping is
+ * deterministic: the event id and timestamp come directly from the delta.
+ */
+export function deltaToWebhookEvent(delta) {
+    const verb = ACTION_VERB[delta.actionType];
+    if (!verb)
+        return null; // an internal permission or group change, not a customer event
+    return {
+        id: String(delta.id),
+        type: `${delta.modelName.toLowerCase()}.${verb}`,
+        model: delta.modelName,
+        objectId: delta.modelId,
+        syncId: delta.id,
+        data: parseRow(delta.data),
+        createdAt: delta.createdAt,
+    };
+}
+//# sourceMappingURL=events.js.map

package/dist/webhooks/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/webhooks/events.ts"],"names":[],"mappings":"AAeA;;;;;;GAMG;AACH,MAAM,WAAW,GAA6C;IAC5D,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,YAAY;CAChB,CAAC;AAwCF,SAAS,QAAQ,CAAC,IAAgC;IAChD,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,UAA6B,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,+DAA+D;IAEvF,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,IAAI,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,IAAI,EAAE;QAChD,KAAK,EAAE,KAAK,CAAC,SAAS;QACtB,QAAQ,EAAE,KAAK,CAAC,OAAO;QACvB,MAAM,EAAE,KAAK,CAAC,EAAE;QAChB,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;AACJ,CAAC"}

package/dist/webhooks/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * The public entry point for webhooks. Import {@link AbloWebhookEvent} to type
+ * your event handler, and use {@link deltaToWebhookEvent} to turn a committed
+ * change from the transaction log into an event to deliver. This module does not
+ * verify signatures and ships no cryptography; recipients verify deliveries with
+ * a standard webhooks library.
+ */
+export { deltaToWebhookEvent, type AbloWebhookEvent, type WebhookSourceDelta, } from './events.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/webhooks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,mBAAmB,EACnB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC"}

package/dist/webhooks/index.js

@@ -0,0 +1,9 @@
+/**
+ * The public entry point for webhooks. Import {@link AbloWebhookEvent} to type
+ * your event handler, and use {@link deltaToWebhookEvent} to turn a committed
+ * change from the transaction log into an event to deliver. This module does not
+ * verify signatures and ships no cryptography; recipients verify deliveries with
+ * a standard webhooks library.
+ */
+export { deltaToWebhookEvent, } from './events.js';
+//# sourceMappingURL=index.js.map

package/dist/webhooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/webhooks/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,mBAAmB,GAGpB,MAAM,aAAa,CAAC"}

package/dist/wire/accountResponses.d.ts

@@ -0,0 +1,463 @@
+/**
+ * What the ACCOUNT routes answer with — the surface you reach through the
+ * `ablo` CLI rather than through a model: `GET /v1/projects`, `GET /api/schema`,
+ * `GET /v1/logs`, `GET /v1/usage`.
+ *
+ * These are the shapes the server, the CLI, and the MCP server all have to
+ * agree on. Before this module each of them spelled the shape out again — the
+ * server inline in `c.json({ … })`, the others in hand-written interfaces — so
+ * a renamed field broke a consumer at runtime with nothing failing in between.
+ *
+ * None of these endpoints appear in the published OpenAPI contract yet (they
+ * sit in the spec test's `NOT_YET_PUBLISHED` set). Deriving the spec from these
+ * schemas is what removes them from it.
+ */
+import { z } from 'zod';
+import type { SyncDeltaAction } from './delta.js';
+/**
+ * One project — an app's own schema, data planes, and keys. `default` marks the
+ * organization's implicit project, whose id is the organization's own.
+ */
+export declare const projectResponseSchema: z.ZodObject<{
+    object: z.ZodLiteral<"project">;
+    id: z.ZodString;
+    slug: z.ZodString;
+    name: z.ZodString;
+    default: z.ZodBoolean;
+    created_at: z.ZodString;
+}, z.core.$strip>;
+export type ProjectResponse = z.infer<typeof projectResponseSchema>;
+/**
+ * `GET /v1/projects`.
+ *
+ * Note what this is NOT: the canonical {@link ListEnvelope}. An org's projects
+ * are returned whole, so the route emits `data` with no `has_more`/`next_cursor`
+ * beside it. That divergence is real and this schema states it rather than
+ * describing a pagination the endpoint does not implement — adding the two
+ * fields is an API change, not a documentation fix.
+ */
+export declare const projectListResponseSchema: z.ZodObject<{
+    object: z.ZodLiteral<"list">;
+    data: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        object: z.ZodLiteral<"project">;
+        id: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        default: z.ZodBoolean;
+        created_at: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ProjectListResponse = z.infer<typeof projectListResponseSchema>;
+/** One minted key, returned exactly once — the plaintext is never readable again. */
+export declare const provisionedKeySchema: z.ZodObject<{
+    apiKey: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ProvisionedKey = z.infer<typeof provisionedKeySchema>;
+/**
+ * What the CLI device flow gets back once a browser approval is exchanged for
+ * credentials: the sandbox key `ablo push` authors with, and the restricted
+ * production key that only observes.
+ *
+ * `project` is the project both keys are scoped to, resolved SERVER-SIDE from
+ * the requested slug — null means the organization's default. The server's
+ * answer is authoritative because it is what resolved the slug to an id, so the
+ * CLI stores keys under the project named here rather than the one it asked
+ * for.
+ */
+export declare const provisionKeyResponseSchema: z.ZodObject<{
+    test: z.ZodObject<{
+        apiKey: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+    live: z.ZodOptional<z.ZodObject<{
+        apiKey: z.ZodString;
+        expiresAt: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    organizationId: z.ZodOptional<z.ZodString>;
+    organizationSlug: z.ZodOptional<z.ZodString>;
+    project: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ProvisionKeyResponse = z.infer<typeof provisionKeyResponseSchema>;
+/**
+ * A model's declared conflict disposition as it travels on the wire, keyed by
+ * committer kind.
+ *
+ * Spelled here rather than imported from the policy layer, which states the same
+ * three members as a TypeScript interface: `wire/` holds runtime-validatable
+ * schemas, and it is the protocol leaf — everything depends on it and it depends
+ * on nothing. The check that the two never drift therefore lives on the policy
+ * side of that edge, next to the interface, in `../policy/types.ts`.
+ */
+export declare const conflictAxisWireSchema: z.ZodObject<{
+    user: z.ZodOptional<z.ZodEnum<{
+        reject: "reject";
+        overwrite: "overwrite";
+        notify: "notify";
+    }>>;
+    agent: z.ZodOptional<z.ZodEnum<{
+        reject: "reject";
+        overwrite: "overwrite";
+        notify: "notify";
+    }>>;
+    system: z.ZodOptional<z.ZodEnum<{
+        reject: "reject";
+        overwrite: "overwrite";
+        notify: "notify";
+    }>>;
+}, z.core.$strip>;
+/** One model in the deployed schema, as the schema read reports it. */
+export declare const schemaModelResponseSchema: z.ZodObject<{
+    key: z.ZodString;
+    typename: z.ZodString;
+    conflict: z.ZodNullable<z.ZodObject<{
+        user: z.ZodOptional<z.ZodEnum<{
+            reject: "reject";
+            overwrite: "overwrite";
+            notify: "notify";
+        }>>;
+        agent: z.ZodOptional<z.ZodEnum<{
+            reject: "reject";
+            overwrite: "overwrite";
+            notify: "notify";
+        }>>;
+        system: z.ZodOptional<z.ZodEnum<{
+            reject: "reject";
+            overwrite: "overwrite";
+            notify: "notify";
+        }>>;
+    }, z.core.$strip>>;
+    hash: z.ZodString;
+    fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        type: z.ZodEnum<{
+            string: "string";
+            number: "number";
+            boolean: "boolean";
+            date: "date";
+            enum: "enum";
+            json: "json";
+        }>;
+        isOptional: z.ZodBoolean;
+        isIndexed: z.ZodBoolean;
+        column: z.ZodOptional<z.ZodString>;
+        enumValues: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    }, z.core.$strip>>>;
+    relations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        type: z.ZodEnum<{
+            belongsTo: "belongsTo";
+            hasMany: "hasMany";
+            hasOne: "hasOne";
+        }>;
+        target: z.ZodString;
+        foreignKey: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type SchemaModelResponse = z.infer<typeof schemaModelResponseSchema>;
+/**
+ * `GET /api/schema` — the schema active on the caller's plane.
+ *
+ * A discriminated union because the two answers carry different fields, and the
+ * difference is the one a caller must act on: `active: false` means nothing has
+ * been pushed to this plane, so `models` is empty and `ablo push` is the fix.
+ * Reporting that as an inactive artifact with absent metadata, rather than as
+ * optional fields on one shape, is what stops a consumer from reading a missing
+ * `version` as a version of zero.
+ */
+export declare const schemaReadResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    active: z.ZodLiteral<false>;
+    environment: z.ZodString;
+    project: z.ZodNullable<z.ZodString>;
+    models: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        typename: z.ZodString;
+        conflict: z.ZodNullable<z.ZodObject<{
+            user: z.ZodOptional<z.ZodEnum<{
+                reject: "reject";
+                overwrite: "overwrite";
+                notify: "notify";
+            }>>;
+            agent: z.ZodOptional<z.ZodEnum<{
+                reject: "reject";
+                overwrite: "overwrite";
+                notify: "notify";
+            }>>;
+            system: z.ZodOptional<z.ZodEnum<{
+                reject: "reject";
+                overwrite: "overwrite";
+                notify: "notify";
+            }>>;
+        }, z.core.$strip>>;
+        hash: z.ZodString;
+        fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            type: z.ZodEnum<{
+                string: "string";
+                number: "number";
+                boolean: "boolean";
+                date: "date";
+                enum: "enum";
+                json: "json";
+            }>;
+            isOptional: z.ZodBoolean;
+            isIndexed: z.ZodBoolean;
+            column: z.ZodOptional<z.ZodString>;
+            enumValues: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+        }, z.core.$strip>>>;
+        relations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            type: z.ZodEnum<{
+                belongsTo: "belongsTo";
+                hasMany: "hasMany";
+                hasOne: "hasOne";
+            }>;
+            target: z.ZodString;
+            foreignKey: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>, z.ZodObject<{
+    active: z.ZodLiteral<true>;
+    environment: z.ZodString;
+    project: z.ZodNullable<z.ZodString>;
+    models: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        typename: z.ZodString;
+        conflict: z.ZodNullable<z.ZodObject<{
+            user: z.ZodOptional<z.ZodEnum<{
+                reject: "reject";
+                overwrite: "overwrite";
+                notify: "notify";
+            }>>;
+            agent: z.ZodOptional<z.ZodEnum<{
+                reject: "reject";
+                overwrite: "overwrite";
+                notify: "notify";
+            }>>;
+            system: z.ZodOptional<z.ZodEnum<{
+                reject: "reject";
+                overwrite: "overwrite";
+                notify: "notify";
+            }>>;
+        }, z.core.$strip>>;
+        hash: z.ZodString;
+        fields: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            type: z.ZodEnum<{
+                string: "string";
+                number: "number";
+                boolean: "boolean";
+                date: "date";
+                enum: "enum";
+                json: "json";
+            }>;
+            isOptional: z.ZodBoolean;
+            isIndexed: z.ZodBoolean;
+            column: z.ZodOptional<z.ZodString>;
+            enumValues: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+        }, z.core.$strip>>>;
+        relations: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            type: z.ZodEnum<{
+                belongsTo: "belongsTo";
+                hasMany: "hasMany";
+                hasOne: "hasOne";
+            }>;
+            target: z.ZodString;
+            foreignKey: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+    schemaId: z.ZodString;
+    version: z.ZodNumber;
+    hash: z.ZodString;
+    pushedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>], "active">;
+export type SchemaReadResponse = z.infer<typeof schemaReadResponseSchema>;
+/**
+ * What a log reader calls each kind of entry.
+ *
+ * The log carries the full delta vocabulary, not just writes, so this has a
+ * word for every one of them — a reader should never be shown the stored
+ * letter. The eight are the plain-language face of {@link SyncDeltaAction}.
+ */
+export declare const logOpSchema: z.ZodEnum<{
+    update: "update";
+    create: "create";
+    delete: "delete";
+    archive: "archive";
+    revive: "revive";
+    visible: "visible";
+    group_added: "group_added";
+    group_removed: "group_removed";
+}>;
+export type LogOp = z.infer<typeof logOpSchema>;
+/**
+ * The stored action letter, as a log reader sees it.
+ *
+ * Typed against {@link SyncDeltaAction} so it is total by construction: adding
+ * a ninth action to the vocabulary stops this compiling until it has a word.
+ * The alternative — a lookup with a fallback — is what let `A` reach callers
+ * as the bare letter "a".
+ */
+export declare const LOG_OP_BY_ACTION: Readonly<Record<SyncDeltaAction, LogOp>>;
+/** One entry in the log: what changed, and who changed it. */
+export declare const logEventSchema: z.ZodObject<{
+    object: z.ZodLiteral<"log_event">;
+    id: z.ZodNumber;
+    at: z.ZodString;
+    model: z.ZodString;
+    op: z.ZodEnum<{
+        update: "update";
+        create: "create";
+        delete: "delete";
+        archive: "archive";
+        revive: "revive";
+        visible: "visible";
+        group_added: "group_added";
+        group_removed: "group_removed";
+    }>;
+    recordId: z.ZodString;
+    actor: z.ZodNullable<z.ZodString>;
+    delta: z.ZodOptional<z.ZodObject<{
+        id: z.ZodNumber;
+        data: z.ZodNullable<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodString]>>;
+        actionType: z.ZodEnum<{
+            I: "I";
+            U: "U";
+            D: "D";
+            A: "A";
+            V: "V";
+            C: "C";
+            G: "G";
+            S: "S";
+        }>;
+        modelName: z.ZodString;
+        modelId: z.ZodString;
+        previousData: z.ZodOptional<z.ZodNullable<z.ZodUnion<readonly [z.ZodRecord<z.ZodString, z.ZodUnknown>, z.ZodString]>>>;
+        createdAt: z.ZodString;
+        actor: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            kind: z.ZodEnum<{
+                user: "user";
+                agent: "agent";
+                system: "system";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strip>>>;
+        onBehalfOf: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            kind: z.ZodEnum<{
+                user: "user";
+                agent: "agent";
+                system: "system";
+            }>;
+            id: z.ZodString;
+        }, z.core.$strip>>>;
+        capabilityId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        confirmationState: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
+            auto: "auto";
+            previewed: "previewed";
+            approved: "approved";
+            required_human_approval: "required_human_approval";
+            auto_historical: "auto_historical";
+        }>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type LogEvent = z.infer<typeof logEventSchema>;
+/**
+ * One day's usage. `results` is one row per `group_by` combination, carrying
+ * the requested dimensions plus `total` and `count`; with no `group_by` it is a
+ * single ungrouped row. The keys therefore depend on the request, which is why
+ * the row stays open rather than claiming a fixed shape.
+ *
+ * `total` arrives as a string — it is a bigint in the database, and JSON has no
+ * lossless number for it.
+ */
+export declare const usageBucketSchema: z.ZodObject<{
+    starting_at: z.ZodString;
+    ending_at: z.ZodString;
+    results: z.ZodReadonly<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+}, z.core.$strip>;
+export type UsageBucket = z.infer<typeof usageBucketSchema>;
+/**
+ * One of the org's keys, as a management surface may show it.
+ *
+ * Everything here is safe to display: the prefix identifies a key without being
+ * one. There is deliberately no field for the key itself — plaintext exists only
+ * in the response to the mint that created it, and the store keeps a SHA-256
+ * hash, so no later read can return it.
+ */
+export declare const controlKeySchema: z.ZodObject<{
+    id: z.ZodString;
+    keyPrefix: z.ZodString;
+    label: z.ZodNullable<z.ZodString>;
+    kind: z.ZodString;
+    scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    projectId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ControlKey = z.infer<typeof controlKeySchema>;
+/**
+ * `GET /v1/dashboard/keys` — the org's live, hand-managed keys.
+ *
+ * Like the project list, this is not the canonical {@link ListEnvelope}: it
+ * answers with a bare `keys` array. Stated as it is rather than as the envelope
+ * it resembles.
+ */
+export declare const controlKeyListResponseSchema: z.ZodObject<{
+    keys: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        keyPrefix: z.ZodString;
+        label: z.ZodNullable<z.ZodString>;
+        kind: z.ZodString;
+        scopes: z.ZodReadonly<z.ZodArray<z.ZodString>>;
+        createdAt: z.ZodString;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        projectId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ControlKeyListResponse = z.infer<typeof controlKeyListResponseSchema>;
+/**
+ * `POST /v1/dashboard/keys` — the mint.
+ *
+ * `plaintext` is the only place the secret ever appears. The store keeps a
+ * SHA-256 hash, so nothing can return it again: a consumer that reads the wrong
+ * field name here does not get an error, it gets `undefined`, and the key is
+ * gone. That is the whole reason this shape is defined once rather than
+ * described at each end.
+ */
+export declare const keyMintedResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodNullable<z.ZodString>;
+    keyPrefix: z.ZodString;
+    createdAt: z.ZodString;
+    createdBy: z.ZodNullable<z.ZodString>;
+    projectId: z.ZodNullable<z.ZodString>;
+    plaintext: z.ZodString;
+}, z.core.$strip>;
+export type KeyMintedResponse = z.infer<typeof keyMintedResponseSchema>;
+/**
+ * `DELETE /v1/dashboard/keys/:id`. `activeSessionsClosed` reports how many live
+ * connections the revocation cut, so a caller can see it took effect on sessions
+ * already open rather than only on future ones. A second revoke of the same key
+ * is not an error — it answers `alreadyRevoked` and closes nothing.
+ */
+export declare const keyRevokedResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    revoked: z.ZodLiteral<true>;
+    revokedAt: z.ZodOptional<z.ZodString>;
+    alreadyRevoked: z.ZodOptional<z.ZodBoolean>;
+    activeSessionsClosed: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type KeyRevokedResponse = z.infer<typeof keyRevokedResponseSchema>;
+/** `GET /v1/usage` — daily buckets, shaped after a usage report. */
+export declare const usageReportResponseSchema: z.ZodObject<{
+    object: z.ZodLiteral<"usage_report">;
+    buckets: z.ZodReadonly<z.ZodArray<z.ZodObject<{
+        starting_at: z.ZodString;
+        ending_at: z.ZodString;
+        results: z.ZodReadonly<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodUnknown>>>;
+    }, z.core.$strip>>>;
+    has_more: z.ZodBoolean;
+    data_freshness_seconds: z.ZodNumber;
+}, z.core.$strip>;
+export type UsageReportResponse = z.infer<typeof usageReportResponseSchema>;
+//# sourceMappingURL=accountResponses.d.ts.map

package/dist/wire/accountResponses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accountResponses.d.ts","sourceRoot":"","sources":["../../src/wire/accountResponses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;;;;;;iBAOhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;iBAGpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,qFAAqF;AACrF,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;iBAMrC,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAE9E;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBAIjC,CAAC;AAEH,uEAAuE;AACvE,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAwCpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E;;;;;;;;;GASG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAiBnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;EAStB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEhD;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,KAAK,CAAC,CASrE,CAAC;AAEF,8DAA8D;AAC9D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBzB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD;;;;;;;;GAQG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;iBAY3B,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;iBAEvC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;iBASlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB;;;;;;iBAMnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,oEAAoE;AACpE,eAAO,MAAM,yBAAyB;;;;;;;;;iBAMpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}