@antasphere/chassis-contract 0.0.0-stage → 1.0.0

package/dist/schemas/projects.d.ts

@@ -0,0 +1,232 @@
+import { z } from 'zod';
+/**
+ * A PROJECT is a subgroup of a workspace: a name, a description, members with
+ * a role, and the tool's resources linked to it. The chassis owns the
+ * concept; what a project HOLDS is the tool's (its own link table, its own
+ * routes). A project is archived, never deleted.
+ */
+/**
+ * The three project roles, each one containing the one before it:
+ *  - `viewer`: reads the project and what is linked to it;
+ *  - `editor`: viewer + writes what is linked to it, links resources of their own;
+ *  - `manager`: editor + edits the project, archives it, manages its members.
+ * A workspace owner or admin acts as a manager on every project.
+ */
+export declare const projectRoleSchema: z.ZodEnum<{
+    manager: "manager";
+    editor: "editor";
+    viewer: "viewer";
+}>;
+export type ProjectRole = z.infer<typeof projectRoleSchema>;
+/** True when `role` is `min` or contains it (`manager` ≥ `editor` ≥ `viewer`). */
+export declare function projectRoleAtLeast(role: ProjectRole, min: ProjectRole): boolean;
+/**
+ * Serialized size cap for a project's owner-defined metadata object, in
+ * JSON.stringify characters (an environment-free proxy for bytes: the
+ * contract runs in browsers and Node alike).
+ */
+export declare const PROJECT_METADATA_MAX_LENGTH: number;
+/**
+ * Owner-defined structured metadata: a plain JSON object, opaque to the
+ * server beyond shape and size. This is the tool's and the integrator's seam,
+ * the reason no tool ever needs a column on the project. PATCH replaces the
+ * whole object; merge is a client concern.
+ */
+export declare const projectMetadataSchema: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+export declare const projectSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    archivedAt: z.ZodNullable<z.ZodString>;
+    createdBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+    myRole: z.ZodEnum<{
+        manager: "manager";
+        editor: "editor";
+        viewer: "viewer";
+    }>;
+    memberCount: z.ZodNumber;
+}, z.core.$strip>;
+export type Project = z.infer<typeof projectSchema>;
+export declare const projectsListSchema: z.ZodObject<{
+    projects: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+        archivedAt: z.ZodNullable<z.ZodString>;
+        createdBy: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+        myRole: z.ZodEnum<{
+            manager: "manager";
+            editor: "editor";
+            viewer: "viewer";
+        }>;
+        memberCount: z.ZodNumber;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ProjectsList = z.infer<typeof projectsListSchema>;
+/** `false` (the default) = the live projects, `true` = the archived ones, `all` = both. */
+export declare const projectsArchivedFilterSchema: z.ZodEnum<{
+    false: "false";
+    true: "true";
+    all: "all";
+}>;
+export type ProjectsArchivedFilter = z.infer<typeof projectsArchivedFilterSchema>;
+export declare const projectsListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    archived: z.ZodDefault<z.ZodEnum<{
+        false: "false";
+        true: "true";
+        all: "all";
+    }>>;
+}, z.core.$strip>;
+export declare const projectCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type ProjectCreate = z.infer<typeof projectCreateSchema>;
+export declare const projectUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, z.core.$strip>;
+export type ProjectUpdate = z.infer<typeof projectUpdateSchema>;
+/**
+ * A project's members are people AND teams, each with a role (PRDCT-2794):
+ * one list, told apart by `kind`. A team entry's role is what every active
+ * non-guest member of the team holds through it; a person's effective role
+ * is the highest of their own entry and their teams' entries. `kind` is
+ * `person` on every entry that predates teams, so a reader that never asked
+ * for teams still reads what it did.
+ */
+export declare const projectPersonMemberSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"person">;
+    userId: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        manager: "manager";
+        editor: "editor";
+        viewer: "viewer";
+    }>;
+    addedBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type ProjectPersonMember = z.infer<typeof projectPersonMemberSchema>;
+export declare const projectTeamMemberSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"team">;
+    teamId: z.ZodString;
+    slug: z.ZodString;
+    name: z.ZodString;
+    membersCount: z.ZodNumber;
+    hubTeamId: z.ZodNullable<z.ZodString>;
+    role: z.ZodEnum<{
+        manager: "manager";
+        editor: "editor";
+        viewer: "viewer";
+    }>;
+    addedBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type ProjectTeamMember = z.infer<typeof projectTeamMemberSchema>;
+export declare const projectMemberSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"person">;
+    userId: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        manager: "manager";
+        editor: "editor";
+        viewer: "viewer";
+    }>;
+    addedBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"team">;
+    teamId: z.ZodString;
+    slug: z.ZodString;
+    name: z.ZodString;
+    membersCount: z.ZodNumber;
+    hubTeamId: z.ZodNullable<z.ZodString>;
+    role: z.ZodEnum<{
+        manager: "manager";
+        editor: "editor";
+        viewer: "viewer";
+    }>;
+    addedBy: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>], "kind">;
+export type ProjectMember = z.infer<typeof projectMemberSchema>;
+export declare const projectMembersListSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"person">;
+        userId: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            manager: "manager";
+            editor: "editor";
+            viewer: "viewer";
+        }>;
+        addedBy: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"team">;
+        teamId: z.ZodString;
+        slug: z.ZodString;
+        name: z.ZodString;
+        membersCount: z.ZodNumber;
+        hubTeamId: z.ZodNullable<z.ZodString>;
+        role: z.ZodEnum<{
+            manager: "manager";
+            editor: "editor";
+            viewer: "viewer";
+        }>;
+        addedBy: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>], "kind">>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type ProjectMembersList = z.infer<typeof projectMembersListSchema>;
+/**
+ * Add one of the workspace's OWN active members, named by user id or by
+ * email, or one of the workspace's teams by its id: exactly one of the three.
+ * No invitation, no claim token, no account is ever minted here.
+ */
+export declare const projectMemberAddSchema: z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodEmail>;
+    teamId: z.ZodOptional<z.ZodUUID>;
+    role: z.ZodEnum<{
+        manager: "manager";
+        editor: "editor";
+        viewer: "viewer";
+    }>;
+}, z.core.$strip>;
+export type ProjectMemberAdd = z.infer<typeof projectMemberAddSchema>;
+export declare const projectMemberRoleSchema: z.ZodObject<{
+    role: z.ZodEnum<{
+        manager: "manager";
+        editor: "editor";
+        viewer: "viewer";
+    }>;
+}, z.core.$strip>;
+export type ProjectMemberRoleUpdate = z.infer<typeof projectMemberRoleSchema>;
+/** A user id is Better Auth's text id, never a uuid: bounded free text, no control characters. */
+export declare const projectMemberParamsSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    userId: z.ZodString;
+}, z.core.$strip>;
+/** `{id}` the project and `{teamId}` the team, both uuids. */
+export declare const projectTeamParamsSchema: z.ZodObject<{
+    id: z.ZodUUID;
+    teamId: z.ZodUUID;
+}, z.core.$strip>;
+//# sourceMappingURL=projects.d.ts.map

package/dist/schemas/projects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.d.ts","sourceRoot":"","sources":["../../src/schemas/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;GAKG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB;;;;EAA0C,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAI5D,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,WAAW,GAAG,OAAO,CAE/E;AAED;;;;GAIG;AACH,eAAO,MAAM,2BAA2B,QAAY,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,wCAGjC,CAAC;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;iBAaxB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAEpD,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;iBAG7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,2FAA2F;AAC3F,eAAO,MAAM,4BAA4B;;;;EAAmC,CAAC;AAC7E,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,eAAO,MAAM,uBAAuB;;;;;;;;iBAElC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAIhE,eAAO,MAAM,mBAAmB;;;;iBAS5B,CAAC;AACL,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;iBAQpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;iBAgBlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;2BAG9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGnC,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;iBAS/B,CAAC;AACL,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,uBAAuB;;;;;;iBAAwC,CAAC;AAC7E,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E,kGAAkG;AAClG,eAAO,MAAM,yBAAyB;;;iBAGpC,CAAC;AAEH,8DAA8D;AAC9D,eAAO,MAAM,uBAAuB;;;iBAA+C,CAAC"}

package/dist/schemas/projects.js

@@ -0,0 +1,140 @@
+import { z } from 'zod';
+import { cursorPageQuerySchema, noControlChars, opaqueJsonChecks, plainText } from './common.js';
+/**
+ * A PROJECT is a subgroup of a workspace: a name, a description, members with
+ * a role, and the tool's resources linked to it. The chassis owns the
+ * concept; what a project HOLDS is the tool's (its own link table, its own
+ * routes). A project is archived, never deleted.
+ */
+/**
+ * The three project roles, each one containing the one before it:
+ *  - `viewer`: reads the project and what is linked to it;
+ *  - `editor`: viewer + writes what is linked to it, links resources of their own;
+ *  - `manager`: editor + edits the project, archives it, manages its members.
+ * A workspace owner or admin acts as a manager on every project.
+ */
+export const projectRoleSchema = z.enum(['manager', 'editor', 'viewer']);
+const PROJECT_ROLE_RANK = { viewer: 0, editor: 1, manager: 2 };
+/** True when `role` is `min` or contains it (`manager` ≥ `editor` ≥ `viewer`). */
+export function projectRoleAtLeast(role, min) {
+    return PROJECT_ROLE_RANK[role] >= PROJECT_ROLE_RANK[min];
+}
+/**
+ * Serialized size cap for a project's owner-defined metadata object, in
+ * JSON.stringify characters (an environment-free proxy for bytes: the
+ * contract runs in browsers and Node alike).
+ */
+export const PROJECT_METADATA_MAX_LENGTH = 16 * 1024;
+/**
+ * Owner-defined structured metadata: a plain JSON object, opaque to the
+ * server beyond shape and size. This is the tool's and the integrator's seam,
+ * the reason no tool ever needs a column on the project. PATCH replaces the
+ * whole object; merge is a client concern.
+ */
+export const projectMetadataSchema = opaqueJsonChecks(z.record(z.string(), z.unknown())).refine((v) => JSON.stringify(v).length <= PROJECT_METADATA_MAX_LENGTH, `metadata must serialize to at most ${PROJECT_METADATA_MAX_LENGTH} characters`);
+export const projectSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    description: z.string().nullable(),
+    metadata: z.record(z.string(), z.unknown()),
+    /** Set while the project is archived: out of the default list, read-only. */
+    archivedAt: z.string().nullable(),
+    createdBy: z.string().nullable(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+    /** The CALLER's effective role (`manager` for a workspace owner or admin). */
+    myRole: projectRoleSchema,
+    memberCount: z.number().int()
+});
+export const projectsListSchema = z.object({
+    projects: z.array(projectSchema),
+    nextCursor: z.string().nullable()
+});
+/** `false` (the default) = the live projects, `true` = the archived ones, `all` = both. */
+export const projectsArchivedFilterSchema = z.enum(['false', 'true', 'all']);
+export const projectsListQuerySchema = cursorPageQuerySchema.extend({
+    archived: projectsArchivedFilterSchema.default('false')
+});
+export const projectCreateSchema = z.object({
+    name: plainText(1, 200),
+    description: plainText(0, 2000).optional(),
+    metadata: projectMetadataSchema.optional()
+});
+// Every field optional, so an empty body is refused HERE (an empty drizzle
+// `.set({})` is a Postgres error, not a client mistake answered 400).
+export const projectUpdateSchema = z
+    .object({
+    name: plainText(1, 200).optional(),
+    /** `null` clears the description. */
+    description: plainText(0, 2000).nullable().optional(),
+    metadata: projectMetadataSchema.optional()
+})
+    .refine((v) => v.name !== undefined || v.description !== undefined || v.metadata !== undefined, {
+    error: 'at least one of name, description or metadata is required'
+});
+/**
+ * A project's members are people AND teams, each with a role (PRDCT-2794):
+ * one list, told apart by `kind`. A team entry's role is what every active
+ * non-guest member of the team holds through it; a person's effective role
+ * is the highest of their own entry and their teams' entries. `kind` is
+ * `person` on every entry that predates teams, so a reader that never asked
+ * for teams still reads what it did.
+ */
+export const projectPersonMemberSchema = z.object({
+    kind: z.literal('person'),
+    userId: z.string(),
+    email: z.string(),
+    name: z.string(),
+    role: projectRoleSchema,
+    addedBy: z.string().nullable(),
+    createdAt: z.string()
+});
+export const projectTeamMemberSchema = z.object({
+    kind: z.literal('team'),
+    teamId: z.string(),
+    slug: z.string(),
+    name: z.string(),
+    /**
+     * How many seats the team holds here, the account site's count. A
+     * deactivated member keeps their seat (a pause) and holds nothing through
+     * it until reactivated; the team's page shows each seat's state.
+     */
+    membersCount: z.number().int(),
+    /** The hub's team id when the team is the account site's projection; null for the tool's own. */
+    hubTeamId: z.string().nullable(),
+    role: projectRoleSchema,
+    addedBy: z.string().nullable(),
+    createdAt: z.string()
+});
+export const projectMemberSchema = z.discriminatedUnion('kind', [
+    projectPersonMemberSchema,
+    projectTeamMemberSchema
+]);
+export const projectMembersListSchema = z.object({
+    members: z.array(projectMemberSchema),
+    nextCursor: z.string().nullable()
+});
+/**
+ * Add one of the workspace's OWN active members, named by user id or by
+ * email, or one of the workspace's teams by its id: exactly one of the three.
+ * No invitation, no claim token, no account is ever minted here.
+ */
+export const projectMemberAddSchema = z
+    .object({
+    userId: plainText(1, 200).optional(),
+    email: z.email().optional(),
+    teamId: z.uuid().optional(),
+    role: projectRoleSchema
+})
+    .refine((v) => [v.userId, v.email, v.teamId].filter((k) => k !== undefined).length === 1, {
+    error: 'exactly one of userId, email or teamId is required'
+});
+export const projectMemberRoleSchema = z.object({ role: projectRoleSchema });
+/** A user id is Better Auth's text id, never a uuid: bounded free text, no control characters. */
+export const projectMemberParamsSchema = z.object({
+    id: z.uuid(),
+    userId: noControlChars(z.string().min(1).max(200))
+});
+/** `{id}` the project and `{teamId}` the team, both uuids. */
+export const projectTeamParamsSchema = z.object({ id: z.uuid(), teamId: z.uuid() });
+//# sourceMappingURL=projects.js.map

package/dist/schemas/projects.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projects.js","sourceRoot":"","sources":["../../src/schemas/projects.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEjG;;;;;GAKG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE,MAAM,iBAAiB,GAAgC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAE5F,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,IAAiB,EAAE,GAAgB;IACpE,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,EAAE,GAAG,IAAI,CAAC;AAErD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,MAAM,CAC7F,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,2BAA2B,EAC9D,sCAAsC,2BAA2B,aAAa,CAC/E,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,6EAA6E;IAC7E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,8EAA8E;IAC9E,MAAM,EAAE,iBAAiB;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;CAC9B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAG7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC,MAAM,CAAC;IAClE,QAAQ,EAAE,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC;CACxD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;IACvB,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE;IAC1C,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAC;AAGH,2EAA2E;AAC3E,sEAAsE;AACtE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClC,qCAAqC;IACrC,WAAW,EAAE,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACrD,QAAQ,EAAE,qBAAqB,CAAC,QAAQ,EAAE;CAC3C,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE;IAC9F,KAAK,EAAE,2DAA2D;CACnE,CAAC,CAAC;AAGL;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB;;;;OAIG;IACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC9B,iGAAiG;IACjG,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,IAAI,EAAE,iBAAiB;IACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC9D,yBAAyB;IACzB,uBAAuB;CACxB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,MAAM,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,iBAAiB;CACxB,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE;IACxF,KAAK,EAAE,oDAAoD;CAC5D,CAAC,CAAC;AAGL,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;AAG7E,kGAAkG;AAClG,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE;IACZ,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;CACnD,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC"}

package/dist/schemas/scope.d.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+/**
+ * The scope vocabulary is the TOOL's identity (`products:read`, …), so the
+ * chassis never spells one: a tool hands its scopes to
+ * `defineChassisContract({ scopes })` (../define.ts) and gets back the enum
+ * and every schema that carries it.
+ */
+export type ScopeTuple = readonly [string, ...string[]];
+/** The zod enum over a tool's scopes — exactly what `z.enum([...scopes])` builds. */
+export type ScopeSchema<TScope extends string> = z.ZodEnum<{
+    [K in TScope]: K;
+}>;
+export declare function defineScopeSchema<const TScopes extends ScopeTuple>(scopes: TScopes): ScopeSchema<TScopes[number]>;
+//# sourceMappingURL=scope.d.ts.map

package/dist/schemas/scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.d.ts","sourceRoot":"","sources":["../../src/schemas/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;AAExD,qFAAqF;AACrF,MAAM,MAAM,WAAW,CAAC,MAAM,SAAS,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC;KAAG,CAAC,IAAI,MAAM,GAAG,CAAC;CAAE,CAAC,CAAC;AAEjF,wBAAgB,iBAAiB,CAAC,KAAK,CAAC,OAAO,SAAS,UAAU,EAChE,MAAM,EAAE,OAAO,GACd,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAE9B"}

package/dist/schemas/scope.js

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+export function defineScopeSchema(scopes) {
+    return z.enum(scopes);
+}
+//# sourceMappingURL=scope.js.map

package/dist/schemas/scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope.js","sourceRoot":"","sources":["../../src/schemas/scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAaxB,MAAM,UAAU,iBAAiB,CAC/B,MAAe;IAEf,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAA4C,CAAC;AACnE,CAAC"}

package/dist/schemas/setup.d.ts

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+/**
+ * POST /api/v1/setup — one-shot first-boot wizard: creates the owner user
+ * and, on the OSS edition, the instance's FIRST workspace (later ones come
+ * from `POST /workspaces`). Guarded by the
+ * singleton instance_settings row (second attempt → 410) and, optionally, a
+ * SETUP_TOKEN. On the CLOUD edition setup creates NO workspace (the
+ * response's `workspaceId` is null): every cloud workspace is a hub-org
+ * projection, so the operator bootstrap mints a verified, break-glass
+ * capable USER only (internal/federation.md, user-scoped federation).
+ */
+export declare const setupRequestSchema: z.ZodObject<{
+    instanceName: z.ZodString;
+    owner: z.ZodObject<{
+        email: z.ZodEmail;
+        name: z.ZodString;
+        password: z.ZodString;
+    }, z.core.$strip>;
+    setupToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SetupRequest = z.infer<typeof setupRequestSchema>;
+export declare const setupResponseSchema: z.ZodObject<{
+    instanceId: z.ZodString;
+    workspaceId: z.ZodNullable<z.ZodString>;
+    ownerUserId: z.ZodString;
+}, z.core.$strip>;
+export type SetupResponse = z.infer<typeof setupResponseSchema>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/schemas/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/schemas/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;iBAQ7B,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,mBAAmB;;;;iBAK9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/setup.js

@@ -0,0 +1,28 @@
+import { z } from 'zod';
+import { plainText } from './common.js';
+/**
+ * POST /api/v1/setup — one-shot first-boot wizard: creates the owner user
+ * and, on the OSS edition, the instance's FIRST workspace (later ones come
+ * from `POST /workspaces`). Guarded by the
+ * singleton instance_settings row (second attempt → 410) and, optionally, a
+ * SETUP_TOKEN. On the CLOUD edition setup creates NO workspace (the
+ * response's `workspaceId` is null): every cloud workspace is a hub-org
+ * projection, so the operator bootstrap mints a verified, break-glass
+ * capable USER only (internal/federation.md, user-scoped federation).
+ */
+export const setupRequestSchema = z.object({
+    instanceName: plainText(1, 120),
+    owner: z.object({
+        email: z.email(),
+        name: plainText(1, 120),
+        password: z.string().min(12).max(256)
+    }),
+    setupToken: z.string().optional()
+});
+export const setupResponseSchema = z.object({
+    instanceId: z.string(),
+    /** The first workspace (oss); null on cloud — no workspace is created there. */
+    workspaceId: z.string().nullable(),
+    ownerUserId: z.string()
+});
+//# sourceMappingURL=setup.js.map

package/dist/schemas/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/schemas/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;QAChB,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;QACvB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACtC,CAAC;IACF,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,gFAAgF;IAChF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC"}

package/dist/schemas/sso-connect.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+/**
+ * CLI cross-tool connect (cloud edition only — internal/federation.md P5):
+ *
+ *   POST /sso/cli-connect — exchange a hub-minted 120 s JWT for an API key
+ *
+ * The counterpart of the hub's H3 `POST /sso/tool-token`: `antasphere login`
+ * mints a hub API key once; the hub exchanges it for a short-lived RS256 JWT
+ * (`aud` = THIS instance's resource URL, `purpose: 'sso-connect'`, unique
+ * `jti`) PLUS a one-time raw offline-grant refresh token (`hubRefreshToken`,
+ * scopes `offline_access account:read` — the HUB mints it, so it carries no
+ * `orgs:create`: a CLI connect REPLACES the stored grant, and the person's
+ * next workspace creation answers `hub_reauth_required` until they sign in
+ * with the browser again), and this endpoint turns the pair
+ * into an ordinary USER-scoped local API key — no tool-specific login, and
+ * the stored grant drives the same live as-the-user hub org reads as a
+ * browser SSO login's. PUBLIC path (the hub JWT IS the credential),
+ * rate-limited, jti one-time-use. Registered ONLY on EDITION=cloud; an oss
+ * instance answers 404 (the route does not exist there).
+ *
+ * The response reuses the CLI-auth completion shape (`CliAuthCompleted`) —
+ * the tool's read + write scopes, never its export scope, full key
+ * shown exactly once; `workspaceId` is null (user-scoped, unpinned).
+ */
+export declare const ssoCliConnectSchema: z.ZodObject<{
+    token: z.ZodString;
+    hubRefreshToken: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SsoCliConnect = z.infer<typeof ssoCliConnectSchema>;
+//# sourceMappingURL=sso-connect.d.ts.map

package/dist/schemas/sso-connect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connect.d.ts","sourceRoot":"","sources":["../../src/schemas/sso-connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,mBAAmB;;;iBAY9B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/schemas/sso-connect.js

@@ -0,0 +1,38 @@
+import { z } from 'zod';
+/**
+ * CLI cross-tool connect (cloud edition only — internal/federation.md P5):
+ *
+ *   POST /sso/cli-connect — exchange a hub-minted 120 s JWT for an API key
+ *
+ * The counterpart of the hub's H3 `POST /sso/tool-token`: `antasphere login`
+ * mints a hub API key once; the hub exchanges it for a short-lived RS256 JWT
+ * (`aud` = THIS instance's resource URL, `purpose: 'sso-connect'`, unique
+ * `jti`) PLUS a one-time raw offline-grant refresh token (`hubRefreshToken`,
+ * scopes `offline_access account:read` — the HUB mints it, so it carries no
+ * `orgs:create`: a CLI connect REPLACES the stored grant, and the person's
+ * next workspace creation answers `hub_reauth_required` until they sign in
+ * with the browser again), and this endpoint turns the pair
+ * into an ordinary USER-scoped local API key — no tool-specific login, and
+ * the stored grant drives the same live as-the-user hub org reads as a
+ * browser SSO login's. PUBLIC path (the hub JWT IS the credential),
+ * rate-limited, jti one-time-use. Registered ONLY on EDITION=cloud; an oss
+ * instance answers 404 (the route does not exist there).
+ *
+ * The response reuses the CLI-auth completion shape (`CliAuthCompleted`) —
+ * the tool's read + write scopes, never its export scope, full key
+ * shown exactly once; `workspaceId` is null (user-scoped, unpinned).
+ */
+export const ssoCliConnectSchema = z.object({
+    /** The hub-minted exchange JWT (compact JWS — three base64url segments). */
+    token: z.string().min(20).max(4096),
+    /**
+     * The raw one-time offline-grant refresh token from the SAME H3 response
+     * (`hubRefreshToken`). Stored encrypted on the account row — it is what
+     * keeps a headless CLI user's org reads LIVE between browser logins.
+     * Optional on the wire for older clients, but a connect that carries none
+     * is refused unless a prior grant already exists (a key must never be
+     * minted born-dead).
+     */
+    hubRefreshToken: z.string().min(20).max(512).optional()
+});
+//# sourceMappingURL=sso-connect.js.map

package/dist/schemas/sso-connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-connect.js","sourceRoot":"","sources":["../../src/schemas/sso-connect.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,4EAA4E;IAC5E,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACnC;;;;;;;OAOG;IACH,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACxD,CAAC,CAAC"}

package/dist/schemas/sso-logout.d.ts

@@ -0,0 +1,17 @@
+import { z } from 'zod';
+/**
+ * POST /api/v1/sso/logout (cloud edition ONLY — oss answers the JSON 404
+ * terminator): the single-logout server leg. The server has ALREADY revoked
+ * the local session and cleared the shared hint cookie by the time this
+ * body arrives; `url` is the hub RP-initiated-logout URL the browser must
+ * now VISIT to end the hub anchor session (it lands back on
+ * `/login?signed_out=1`). `null` = no hub leg was possible (no stored
+ * id_token, a pre-flip sid-less one, hub unreachable) — the client goes to
+ * `/login?signed_out=1` directly; the LOCAL signout already happened either
+ * way.
+ */
+export declare const ssoLogoutResponseSchema: z.ZodObject<{
+    url: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type SsoLogoutResponse = z.infer<typeof ssoLogoutResponseSchema>;
+//# sourceMappingURL=sso-logout.d.ts.map

package/dist/schemas/sso-logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-logout.d.ts","sourceRoot":"","sources":["../../src/schemas/sso-logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,eAAO,MAAM,uBAAuB;;iBAElC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC"}

package/dist/schemas/sso-logout.js

@@ -0,0 +1,16 @@
+import { z } from 'zod';
+/**
+ * POST /api/v1/sso/logout (cloud edition ONLY — oss answers the JSON 404
+ * terminator): the single-logout server leg. The server has ALREADY revoked
+ * the local session and cleared the shared hint cookie by the time this
+ * body arrives; `url` is the hub RP-initiated-logout URL the browser must
+ * now VISIT to end the hub anchor session (it lands back on
+ * `/login?signed_out=1`). `null` = no hub leg was possible (no stored
+ * id_token, a pre-flip sid-less one, hub unreachable) — the client goes to
+ * `/login?signed_out=1` directly; the LOCAL signout already happened either
+ * way.
+ */
+export const ssoLogoutResponseSchema = z.object({
+    url: z.string().nullable()
+});
+//# sourceMappingURL=sso-logout.js.map

package/dist/schemas/sso-logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-logout.js","sourceRoot":"","sources":["../../src/schemas/sso-logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3B,CAAC,CAAC"}