@antasphere/chassis-contract 0.0.0-stage → 1.0.1

package/dist/schemas/instance.js

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+import { KNOWN_AUTH_METHODS } from '../seams.js';
+import { toolEntitlementsSchema } from '../entitlements.js';
+/**
+ * GET /api/v1/instance — unauthenticated, cacheable discovery. This is what
+ * CLIs and MCP clients read to route: which auth methods exist, whether
+ * first-boot setup is still pending, and what the instance is.
+ */
+export const instanceInfoSchema = z.object({
+    name: z.string(),
+    instanceId: z.string().nullable(),
+    edition: z.string(),
+    version: z.string(),
+    apiVersion: z.literal('v1'),
+    setupRequired: z.boolean(),
+    auth: z.object({
+        // Open enum (ADR 003): the enum documents the known vocabulary, the
+        // string branch keeps older clients parsing newer instances. Clients
+        // ignore entries they do not recognize.
+        methods: z.array(z.enum(KNOWN_AUTH_METHODS).or(z.string())),
+        passwordReset: z.boolean(),
+        emailChange: z.boolean(),
+        twoFactor: z.boolean(),
+        /**
+         * Hub SSO client hints (cloud edition ONLY — absent on oss, where the
+         * discovery wire shape stays byte-identical). The hint cookie is a
+         * dashboard-side HINT for the silent auto-connect (attempt vs don't),
+         * NEVER a security input: the hub sets it, this tool reads it
+         * client-side and clears it on logout / login_required
+         * (internal/federation.md, cross-repo contract).
+         */
+        sso: z
+            .object({
+            hintCookieName: z.string(),
+            hintCookieDomain: z.string()
+        })
+            .optional()
+    }),
+    features: z.object({
+        mcp: z.boolean(),
+        oauth: z.boolean(),
+        files: z.boolean()
+    }),
+    /**
+     * `true` while the operator's DEMO_SIGN_IN switch is on (self-hosted
+     * edition only): demo links sign people in here, and the dashboard shows
+     * every signed-in person a banner saying so. ABSENT otherwise, never false,
+     * so an instance without the switch serves the same discovery bytes as
+     * before it existed.
+     */
+    demoSignIn: z.boolean().optional(),
+    /**
+     * `true` when this cloud instance is a RESTRICTED tool (the operator's
+     * TOOL_RESTRICTED switch, PRDCT-2947): organizations that open it are
+     * granted by Antasphere, and `POST /workspaces` refuses here. A CLI reads
+     * it to say so before offering to create one. ABSENT otherwise, never
+     * false, so the self-hosted discovery bytes are unchanged.
+     */
+    restricted: z.boolean().optional(),
+    /**
+     * What this version of the tool declares for the billing rail (its priced
+     * actions with their default credits, its limits and features per tier):
+     * the hub seeds its price book and its plan entitlements from it, staff
+     * read what a version declares, and a client reads the limit it will be
+     * held to (the CLI's upfront refusal with the right number). Optional on
+     * the wire so a client keeps parsing an instance from before the rail.
+     */
+    entitlements: toolEntitlementsSchema.optional()
+});
+//# sourceMappingURL=instance.js.map

package/dist/schemas/instance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/schemas/instance.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,oEAAoE;QACpE,qEAAqE;QACrE,wCAAwC;QACxC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;QACxB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;QACtB;;;;;;;WAOG;QACH,GAAG,EAAE,CAAC;aACH,MAAM,CAAC;YACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;YAC1B,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE;SAC7B,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QACjB,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;QAChB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;KACnB,CAAC;IACF;;;;;;OAMG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;;;OAMG;IACH,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC;;;;;;;OAOG;IACH,YAAY,EAAE,sBAAsB,CAAC,QAAQ,EAAE;CAChD,CAAC,CAAC"}

package/dist/schemas/invitations.d.ts

@@ -0,0 +1,100 @@
+import { z } from 'zod';
+export declare const invitationSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    role: z.ZodEnum<{
+        owner: "owner";
+        admin: "admin";
+        member: "member";
+    }>;
+    invitedBy: z.ZodString;
+    expiresAt: z.ZodString;
+    acceptedAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type InvitationInfo = z.infer<typeof invitationSchema>;
+export declare const invitationsListSchema: z.ZodObject<{
+    invitations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        role: z.ZodEnum<{
+            owner: "owner";
+            admin: "admin";
+            member: "member";
+        }>;
+        invitedBy: z.ZodString;
+        expiresAt: z.ZodString;
+        acceptedAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const invitationCreateSchema: z.ZodObject<{
+    email: z.ZodEmail;
+    role: z.ZodDefault<z.ZodEnum<{
+        owner: "owner";
+        admin: "admin";
+        member: "member";
+    }>>;
+}, z.core.$strip>;
+export type InvitationCreate = z.infer<typeof invitationCreateSchema>;
+/**
+ * The copyable acceptance link is ALWAYS returned — SMTP is never required
+ * to get a teammate in. `emailSent` says whether a mail also went out.
+ */
+export declare const invitationCreatedSchema: z.ZodObject<{
+    invitation: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        role: z.ZodEnum<{
+            owner: "owner";
+            admin: "admin";
+            member: "member";
+        }>;
+        invitedBy: z.ZodString;
+        expiresAt: z.ZodString;
+        acceptedAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>;
+    acceptUrl: z.ZodString;
+    emailSent: z.ZodBoolean;
+}, z.core.$strip>;
+export type InvitationCreated = z.infer<typeof invitationCreatedSchema>;
+/**
+ * Deliberately carries NO account-existence signal (the collaborator-lookup
+ * rule, PRDCT-1437): an admin who creates an invitation naming any address
+ * holds the copyable accept URL, so the lookup was an instance-global
+ * account oracle. The accept page offers sign-in and create-account
+ * neutrally; the accept endpoint answers `account_exists` when a create
+ * collides.
+ */
+export declare const invitationLookupSchema: z.ZodObject<{
+    email: z.ZodString;
+    role: z.ZodEnum<{
+        owner: "owner";
+        admin: "admin";
+        member: "member";
+    }>;
+    workspaceName: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type InvitationLookup = z.infer<typeof invitationLookupSchema>;
+export declare const invitationAcceptSchema: z.ZodObject<{
+    token: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    password: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type InvitationAccept = z.infer<typeof invitationAcceptSchema>;
+export declare const invitationAcceptedSchema: z.ZodObject<{
+    workspaceId: z.ZodString;
+    userId: z.ZodString;
+    role: z.ZodEnum<{
+        owner: "owner";
+        admin: "admin";
+        member: "member";
+    }>;
+}, z.core.$strip>;
+//# sourceMappingURL=invitations.d.ts.map

package/dist/schemas/invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.d.ts","sourceRoot":"","sources":["../../src/schemas/invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;iBAS3B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE9D,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;iBAGhC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;iBAGjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE;;;GAGG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;iBAIlC,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;;;;;GAOG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,sBAAsB;;;;iBAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,wBAAwB;;;;;;;;iBAInC,CAAC"}

package/dist/schemas/invitations.js

@@ -0,0 +1,55 @@
+import { z } from 'zod';
+import { plainText, workspaceRoleSchema } from './common.js';
+export const invitationSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    role: workspaceRoleSchema,
+    invitedBy: z.string(),
+    expiresAt: z.string(),
+    acceptedAt: z.string().nullable(),
+    revokedAt: z.string().nullable(),
+    createdAt: z.string()
+});
+export const invitationsListSchema = z.object({
+    invitations: z.array(invitationSchema),
+    nextCursor: z.string().nullable()
+});
+export const invitationCreateSchema = z.object({
+    email: z.email(),
+    role: workspaceRoleSchema.default('member')
+});
+/**
+ * The copyable acceptance link is ALWAYS returned — SMTP is never required
+ * to get a teammate in. `emailSent` says whether a mail also went out.
+ */
+export const invitationCreatedSchema = z.object({
+    invitation: invitationSchema,
+    acceptUrl: z.string(),
+    emailSent: z.boolean()
+});
+/**
+ * Deliberately carries NO account-existence signal (the collaborator-lookup
+ * rule, PRDCT-1437): an admin who creates an invitation naming any address
+ * holds the copyable accept URL, so the lookup was an instance-global
+ * account oracle. The accept page offers sign-in and create-account
+ * neutrally; the accept endpoint answers `account_exists` when a create
+ * collides.
+ */
+export const invitationLookupSchema = z.object({
+    email: z.string(),
+    role: workspaceRoleSchema,
+    workspaceName: z.string(),
+    expiresAt: z.string()
+});
+export const invitationAcceptSchema = z.object({
+    token: z.string().min(16),
+    /** Required when the invited email has no account yet. */
+    name: plainText(1, 120).optional(),
+    password: z.string().min(12).max(256).optional()
+});
+export const invitationAcceptedSchema = z.object({
+    workspaceId: z.string(),
+    userId: z.string(),
+    role: workspaceRoleSchema
+});
+//# sourceMappingURL=invitations.js.map

package/dist/schemas/invitations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invitations.js","sourceRoot":"","sources":["../../src/schemas/invitations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,mBAAmB;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC,QAAQ,CAAC;CAC5C,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,UAAU,EAAE,gBAAgB;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;CACvB,CAAC,CAAC;AAGH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,mBAAmB;IACzB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IACzB,0DAA0D;IAC1D,IAAI,EAAE,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,mBAAmB;CAC1B,CAAC,CAAC"}

package/dist/schemas/me.d.ts

@@ -0,0 +1,81 @@
+import { z } from 'zod';
+import type { ScopeSchema } from './scope.js';
+/**
+ * POST /api/v1/me/onboarding/dismiss (cloud edition ONLY; sessions only —
+ * machines 403 fail-closed via the scope allowlist, oss answers the JSON
+ * 404 terminator): records the explicit dismissal that flips
+ * `firstRunPending` to false, permanently (upsert; an earlier dismissal
+ * timestamp is preserved). Idempotent — dismissing twice is a no-op.
+ */
+export declare const onboardingDismissedSchema: z.ZodObject<{
+    dismissed: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export type OnboardingDismissed = z.infer<typeof onboardingDismissedSchema>;
+/** `/me` reports the credential's scopes, so it is built per tool (../define.ts). */
+export declare function defineMeSchemas<TScope extends string>(scopeSchema: ScopeSchema<TScope>): {
+    meResponseSchema: z.ZodObject<{
+        user: z.ZodObject<{
+            id: z.ZodString;
+            email: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>;
+        workspace: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            hubOrigin: z.ZodBoolean;
+            look: z.ZodObject<{
+                theme: z.ZodNullable<z.ZodString>;
+                pattern: z.ZodNullable<z.ZodString>;
+                field: z.ZodNullable<z.ZodNumber>;
+                grain: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        role: z.ZodNullable<z.ZodEnum<{
+            owner: "owner";
+            admin: "admin";
+            member: "member";
+        }>>;
+        origin: z.ZodNullable<z.ZodEnum<{
+            local: "local";
+            hub: "hub";
+            guest: "guest";
+        }>>;
+        via: z.ZodEnum<{
+            session: "session";
+            api_key: "api_key";
+            oauth: "oauth";
+        }>;
+        scopes: z.ZodNullable<z.ZodArray<ScopeSchema<TScope>>>;
+        apiKeyExpiresAt: z.ZodNullable<z.ZodString>;
+        workspaces: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+            role: z.ZodEnum<{
+                owner: "owner";
+                admin: "admin";
+                member: "member";
+            }>;
+            hubOrigin: z.ZodBoolean;
+            centralAccountId: z.ZodNullable<z.ZodString>;
+            look: z.ZodObject<{
+                theme: z.ZodNullable<z.ZodString>;
+                pattern: z.ZodNullable<z.ZodString>;
+                field: z.ZodNullable<z.ZodNumber>;
+                grain: z.ZodNullable<z.ZodNumber>;
+            }, z.core.$strip>;
+            suspended: z.ZodBoolean;
+            default: z.ZodBoolean;
+        }, z.core.$strip>>;
+        activeWorkspaceId: z.ZodNullable<z.ZodString>;
+        hubManageUrl: z.ZodNullable<z.ZodString>;
+        canCreateWorkspace: z.ZodBoolean;
+        firstRunPending: z.ZodOptional<z.ZodBoolean>;
+        ssoOnly: z.ZodOptional<z.ZodBoolean>;
+        hubDenied: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>>>;
+        hubNoAccessUrl: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>;
+};
+//# sourceMappingURL=me.d.ts.map

package/dist/schemas/me.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.d.ts","sourceRoot":"","sources":["../../src/schemas/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAG9C;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB;;iBAEpC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAE5E,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,MAAM,SAAS,MAAM,EAAE,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqKtF"}

package/dist/schemas/me.js

@@ -0,0 +1,178 @@
+import { z } from 'zod';
+import { workspaceRoleSchema } from './common.js';
+import { workspaceLookSchema } from './workspaces.js';
+/**
+ * POST /api/v1/me/onboarding/dismiss (cloud edition ONLY; sessions only —
+ * machines 403 fail-closed via the scope allowlist, oss answers the JSON
+ * 404 terminator): records the explicit dismissal that flips
+ * `firstRunPending` to false, permanently (upsert; an earlier dismissal
+ * timestamp is preserved). Idempotent — dismissing twice is a no-op.
+ */
+export const onboardingDismissedSchema = z.object({
+    dismissed: z.literal(true)
+});
+/** `/me` reports the credential's scopes, so it is built per tool (../define.ts). */
+export function defineMeSchemas(scopeSchema) {
+    /**
+     * GET /api/v1/me — the resolved AuthContext of the calling principal,
+     * whichever credential path it arrived on. The whoami for humans, keys, and
+     * (later) OAuth tokens alike; also the MCP get_me tool's backing endpoint.
+     *
+     * ZERO-MEMBERSHIP sessions answer 200 too (user-scoped federation): a LIVE
+     * session whose user holds no active membership — the cloud operator before
+     * break-glass, a hub user whose last org was removed — gets
+     * `{ workspaces: [], workspace: null, activeWorkspaceId: null, role: null,
+     * origin: null, via: 'session' }` instead of a 401, so the dashboard can
+     * render the no-organization zero state instead of a login bounce. Machine
+     * credentials never see this shape: a key/token whose user has no active
+     * membership fails resolution (401) before the route runs.
+     */
+    const meResponseSchema = z.object({
+        user: z.object({
+            id: z.string(),
+            email: z.string(),
+            name: z.string()
+        }),
+        /**
+         * The ACTIVE workspace this request resolved to (= activeWorkspaceId).
+         * Null ONLY for the zero-membership session state described above.
+         */
+        workspace: z
+            .object({
+            id: z.string(),
+            name: z.string(),
+            /**
+             * True when this workspace is the lazy projection of a hub org (cloud
+             * edition, internal/federation.md) — its MEMBERSHIP is managed at the hub,
+             * so clients hide local member/invitation management and link out
+             * (P7). Derived from `centralAccountId IS NOT NULL`; the raw hub org
+             * id is deliberately never exposed. Always false on oss.
+             */
+            hubOrigin: z.boolean(),
+            /** The workspace's look, a fact of the workspace (schemas/workspaces.ts). */
+            look: workspaceLookSchema
+        })
+            .nullable(),
+        /** Null only in the zero-membership session state. */
+        role: workspaceRoleSchema.nullable(),
+        /**
+         * How the caller's membership of the ACTIVE workspace came to exist
+         * (mirrors Principal.origin): 'local' = setup/invitation, 'hub' = SSO
+         * projection (cloud), 'guest' = a per-resource collaborator (D2) — clients
+         * hide the guest-forbidden workspace surfaces (resource creation, files,
+         * member roster, export) for 'guest'. Null only in the zero-membership
+         * session state.
+         */
+        origin: z.enum(['local', 'hub', 'guest']).nullable(),
+        via: z.enum(['session', 'api_key', 'oauth']),
+        scopes: z.array(scopeSchema).nullable(),
+        /** Expiry of the presented API key; null for sessions/OAuth or non-expiring keys. */
+        apiKeyExpiresAt: z.string().nullable(),
+        /**
+         * The workspaces this credential can name (user-scoped credential model):
+         * EVERY credential kind — session, API key, OAuth bearer — lists ALL of
+         * the user's active memberships; the target workspace is a per-request
+         * parameter (X-Workspace-Id), never baked into the credential. Clients
+         * MUST read the `default` flag to find the selector-less default — never
+         * assume index 0.
+         */
+        workspaces: z.array(z.object({
+            id: z.string(),
+            name: z.string(),
+            role: workspaceRoleSchema,
+            /** Same semantics as `workspace.hubOrigin`, per listed workspace. */
+            hubOrigin: z.boolean(),
+            /**
+             * The id of the hub organization this workspace projects (cloud
+             * edition), null on a local workspace and always on self-hosted. It
+             * is the person's own organization id, the one the account site
+             * shows them, and it is what `--org <hub org id or name>` resolves
+             * against: a request may name a workspace by this id in
+             * X-Workspace-Id as well as by `id` (PRDCT-2947).
+             */
+            centralAccountId: z.string().nullable(),
+            /** Each workspace's look, so the switcher's tiles carry them (schemas/workspaces.ts). */
+            look: workspaceLookSchema,
+            /**
+             * The hub asserted this org suspended (cloud edition): it stays
+             * VISIBLE here but requests into it are refused. Always false on oss
+             * and on local workspaces.
+             */
+            suspended: z.boolean(),
+            /**
+             * The user's default workspace — what a request naming no workspace
+             * resolves to. At most one entry carries it; when none does, the
+             * deterministic fallback (oldest active membership) applies.
+             */
+            default: z.boolean()
+        })),
+        /**
+         * The workspace THIS request resolved to — what X-Workspace-Id selects.
+         * Null only in the zero-membership session state.
+         */
+        activeWorkspaceId: z.string().nullable(),
+        /**
+         * Where membership of the ACTIVE workspace is managed when it is
+         * hub-origin (the hub account console, e.g. https://account.antasphere.com)
+         * — the dashboard's link-out target (P7). Also set for the CLOUD
+         * zero-membership session state (the "create an organization at
+         * Antasphere" CTA target). null on oss and on local (non-projected)
+         * workspaces.
+         */
+        hubManageUrl: z.string().nullable(),
+        /**
+         * Whether `POST /workspaces` would be accepted for this caller RIGHT NOW
+         * (PRDCT-2444 / PRDCT-2443) — the one flag the dashboard keys its "new
+         * workspace" entry off, on both editions, never the edition itself. True
+         * only for a SESSION whose user is not guest-only, while the operator's
+         * `MAX_WORKSPACES_PER_USER` dial is not 0; on self-hosted the user must
+         * also own fewer workspaces than that cap, on cloud they must also hold a
+         * live Antasphere link (the organization is created there, as them).
+         * Always false for API keys and OAuth bearers. STAYS TRUE on cloud for a
+         * person whose stored sign-in predates workspace creation (the route then
+         * answers 401 `hub_reauth_required`): the creation is one sign-in away,
+         * and false would hide the entry from them for good. Advisory: the route
+         * re-judges everything, and on cloud the hub's own cap is only known once
+         * asked.
+         */
+        canCreateWorkspace: z.boolean(),
+        /**
+         * First-run welcome still owed (SL-6). CLOUD + SESSION callers ONLY —
+         * absent on oss and for every machine credential. TOOL-LOCAL and
+         * retry-safe semantics: true iff NO user_onboarding row with a dismissal
+         * exists (`NOT EXISTS (row WHERE dismissed_at IS NOT NULL)`), so a lost
+         * first-login write still shows the welcome and only an explicit
+         * POST /me/onboarding/dismiss (or the deploy backfill) ever hides it.
+         * The hub's advisory `tool_first_login` claim plays no part.
+         */
+        firstRunPending: z.boolean().optional(),
+        /**
+         * The hint-watch discriminator (SL-4/SL-6). CLOUD + SESSION callers ONLY
+         * — absent on oss and for machine credentials. True iff the user's ONLY
+         * way in is hub SSO: they hold an `antasphere` account row AND no local
+         * credential (password) account row. A break-glass-capable operator has
+         * a credential account and is therefore NEVER ssoOnly — the dashboard's
+         * hint-watch may auto-sign-out ssoOnly users when the hub hint cookie
+         * disappears, and must never sign out an operator.
+         */
+        ssoOnly: z.boolean().optional(),
+        /**
+         * The organizations the person belongs to at Antasphere that do NOT open
+         * this tool to them (the organization lets only some of its teams use
+         * it). CLOUD + SESSION callers only; absent on the self-hosted edition
+         * and for machine credentials, and a reader treats an absent field as
+         * none (an older server never sends it). A hint for the refusal page,
+         * read from the hub's last answer as the person: the hub is the truth,
+         * never this list.
+         */
+        hubDenied: z.array(z.object({ id: z.string(), name: z.string() })).optional(),
+        /**
+         * The Antasphere page that lists whom to ask for this tool (the owners
+         * and admins of the refusing organization), ready-made with the tool's
+         * client id. CLOUD + SESSION callers only; absent otherwise.
+         */
+        hubNoAccessUrl: z.string().optional()
+    });
+    return { meResponseSchema };
+}
+//# sourceMappingURL=me.js.map

package/dist/schemas/me.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"me.js","sourceRoot":"","sources":["../../src/schemas/me.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;CAC3B,CAAC,CAAC;AAGH,qFAAqF;AACrF,MAAM,UAAU,eAAe,CAAwB,WAAgC;IACrF;;;;;;;;;;;;;OAaG;IACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;QAChC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;YACb,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;YACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACjB,CAAC;QACF;;;WAGG;QACH,SAAS,EAAE,CAAC;aACT,MAAM,CAAC;YACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB;;;;;;eAMG;YACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;YACtB,6EAA6E;YAC7E,IAAI,EAAE,mBAAmB;SAC1B,CAAC;aACD,QAAQ,EAAE;QACb,sDAAsD;QACtD,IAAI,EAAE,mBAAmB,CAAC,QAAQ,EAAE;QACpC;;;;;;;WAOG;QACH,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;QACpD,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE;QACvC,qFAAqF;QACrF,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACtC;;;;;;;WAOG;QACH,UAAU,EAAE,CAAC,CAAC,KAAK,CACjB,CAAC,CAAC,MAAM,CAAC;YACP,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;YACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,mBAAmB;YACzB,qEAAqE;YACrE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;YACtB;;;;;;;eAOG;YACH,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;YACvC,yFAAyF;YACzF,IAAI,EAAE,mBAAmB;YACzB;;;;eAIG;YACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;YACtB;;;;eAIG;YACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;SACrB,CAAC,CACH;QACD;;;WAGG;QACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACxC;;;;;;;WAOG;QACH,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC;;;;;;;;;;;;;;WAcG;QACH,kBAAkB,EAAE,CAAC,CAAC,OAAO,EAAE;QAC/B;;;;;;;;WAQG;QACH,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QACvC;;;;;;;;WAQG;QACH,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAC/B;;;;;;;;WAQG;QACH,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7E;;;;WAIG;QACH,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC,CAAC;IAEH,OAAO,EAAE,gBAAgB,EAAE,CAAC;AAC9B,CAAC"}

package/dist/schemas/members.d.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+export declare const memberSchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodString;
+    role: z.ZodEnum<{
+        owner: "owner";
+        admin: "admin";
+        member: "member";
+    }>;
+    isActive: z.ZodBoolean;
+    createdAt: z.ZodString;
+    lastSeenAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type Member = z.infer<typeof memberSchema>;
+export declare const membersListSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodString;
+        role: z.ZodEnum<{
+            owner: "owner";
+            admin: "admin";
+            member: "member";
+        }>;
+        isActive: z.ZodBoolean;
+        createdAt: z.ZodString;
+        lastSeenAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const memberUpdateSchema: z.ZodObject<{
+    role: z.ZodOptional<z.ZodEnum<{
+        owner: "owner";
+        admin: "admin";
+        member: "member";
+    }>>;
+    isActive: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type MemberUpdate = z.infer<typeof memberUpdateSchema>;
+/** Admin-generated password reset link for a member (the SMTP-free recovery path). */
+export declare const memberResetLinkSchema: z.ZodObject<{
+    resetUrl: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type MemberResetLink = z.infer<typeof memberResetLinkSchema>;
+/** Admin-generated email change link for a member (the SMTP-free email-change path). */
+export declare const memberChangeEmailLinkRequestSchema: z.ZodObject<{
+    newEmail: z.ZodEmail;
+}, z.core.$strip>;
+export type MemberChangeEmailLinkRequest = z.infer<typeof memberChangeEmailLinkRequestSchema>;
+export declare const memberChangeEmailLinkSchema: z.ZodObject<{
+    verifyUrl: z.ZodString;
+    newEmail: z.ZodString;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+export type MemberChangeEmailLink = z.infer<typeof memberChangeEmailLinkSchema>;
+//# sourceMappingURL=members.d.ts.map

package/dist/schemas/members.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.d.ts","sourceRoot":"","sources":["../../src/schemas/members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;iBASvB,CAAC;AACH,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAElD,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;iBAG5B,CAAC;AAMH,eAAO,MAAM,kBAAkB;;;;;;;iBAO3B,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,sFAAsF;AACtF,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wFAAwF;AACxF,eAAO,MAAM,kCAAkC;;iBAE7C,CAAC;AACH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,2BAA2B;;;;iBAItC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC"}

package/dist/schemas/members.js

@@ -0,0 +1,43 @@
+import { z } from 'zod';
+import { workspaceRoleSchema } from './common.js';
+export const memberSchema = z.object({
+    id: z.string(),
+    userId: z.string(),
+    email: z.string(),
+    name: z.string(),
+    role: workspaceRoleSchema,
+    isActive: z.boolean(),
+    createdAt: z.string(),
+    lastSeenAt: z.string().nullable()
+});
+export const membersListSchema = z.object({
+    members: z.array(memberSchema),
+    nextCursor: z.string().nullable()
+});
+// Both fields optional, so an empty body must be refused HERE: `{}` used to
+// pass validation and build an empty drizzle `.set({})`, which Postgres
+// refuses — an anonymous-shaped 500 for a plain client mistake (FUZZ-5,
+// PRDCT-1358).
+export const memberUpdateSchema = z
+    .object({
+    role: workspaceRoleSchema.optional(),
+    isActive: z.boolean().optional()
+})
+    .refine((v) => v.role !== undefined || v.isActive !== undefined, {
+    error: 'at least one of role or isActive is required'
+});
+/** Admin-generated password reset link for a member (the SMTP-free recovery path). */
+export const memberResetLinkSchema = z.object({
+    resetUrl: z.string(),
+    expiresAt: z.string()
+});
+/** Admin-generated email change link for a member (the SMTP-free email-change path). */
+export const memberChangeEmailLinkRequestSchema = z.object({
+    newEmail: z.email()
+});
+export const memberChangeEmailLinkSchema = z.object({
+    verifyUrl: z.string(),
+    newEmail: z.string(),
+    expiresAt: z.string()
+});
+//# sourceMappingURL=members.js.map

package/dist/schemas/members.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"members.js","sourceRoot":"","sources":["../../src/schemas/members.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,wEAAwE;AACxE,wEAAwE;AACxE,eAAe;AACf,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,mBAAmB,CAAC,QAAQ,EAAE;IACpC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,QAAQ,KAAK,SAAS,EAAE;IAC/D,KAAK,EAAE,8CAA8C;CACtD,CAAC,CAAC;AAGL,sFAAsF;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC;AAGH,wFAAwF;AACxF,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,MAAM,CAAC;IACzD,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE;CACpB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAC"}