@cat-factory/contracts 0.6.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Igor Savin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/accounts.d.ts

@@ -0,0 +1,103 @@
+import * as v from 'valibot';
+export declare const accountTypeSchema: v.PicklistSchema<["personal", "org"], undefined>;
+export type AccountType = v.InferOutput<typeof accountTypeSchema>;
+export declare const accountRoleSchema: v.PicklistSchema<["admin", "developer", "product"], undefined>;
+export type AccountRole = v.InferOutput<typeof accountRoleSchema>;
+/** A member's combinable role set (at least one role). */
+export declare const accountRolesSchema: v.SchemaWithPipe<readonly [v.ArraySchema<v.PicklistSchema<["admin", "developer", "product"], undefined>, undefined>, v.MinLengthAction<("admin" | "developer" | "product")[], 1, undefined>]>;
+export type AccountRoles = v.InferOutput<typeof accountRolesSchema>;
+/** An account as exposed to clients, annotated with the caller's role in it. */
+export declare const accountSchema: v.ObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly type: v.PicklistSchema<["personal", "org"], undefined>;
+    readonly name: v.StringSchema<undefined>;
+    /** The GitHub org/user login this account maps to, when known. */
+    readonly githubAccountLogin: v.NullableSchema<v.StringSchema<undefined>, undefined>;
+    readonly createdAt: v.NumberSchema<undefined>;
+    /** The signed-in caller's roles in this account (`null` in the auth-disabled path). */
+    readonly roles: v.NullableSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.PicklistSchema<["admin", "developer", "product"], undefined>, undefined>, v.MinLengthAction<("admin" | "developer" | "product")[], 1, undefined>]>, undefined>;
+    /**
+     * The cloud provider new services in this account default to (a service may
+     * override it). Absent means the built-in {@link DEFAULT_CLOUD_PROVIDER}
+     * (`cloudflare`).
+     */
+    readonly defaultCloudProvider: v.OptionalSchema<v.PicklistSchema<["cloudflare", "docker", "aws", "gcp", "azure", "custom"], undefined>, undefined>;
+}, undefined>;
+export type Account = v.InferOutput<typeof accountSchema>;
+/** A member of an account. */
+export declare const accountMemberSchema: v.ObjectSchema<{
+    readonly accountId: v.StringSchema<undefined>;
+    readonly userId: v.StringSchema<undefined>;
+    readonly roles: v.SchemaWithPipe<readonly [v.ArraySchema<v.PicklistSchema<["admin", "developer", "product"], undefined>, undefined>, v.MinLengthAction<("admin" | "developer" | "product")[], 1, undefined>]>;
+    readonly createdAt: v.NumberSchema<undefined>;
+    /** Display details of the member (resolved from the users table), when available. */
+    readonly name: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
+    readonly email: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
+    readonly avatarUrl: v.OptionalSchema<v.NullableSchema<v.StringSchema<undefined>, undefined>, undefined>;
+}, undefined>;
+export type AccountMember = v.InferOutput<typeof accountMemberSchema>;
+/** Create a shared org account (the caller becomes its first owner). */
+export declare const createAccountSchema: v.ObjectSchema<{
+    readonly name: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    /** Optional GitHub org login this account maps to. */
+    readonly githubAccountLogin: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 120, undefined>]>, undefined>;
+}, undefined>;
+export type CreateAccountInput = v.InferOutput<typeof createAccountSchema>;
+/** Update an account's settings (today: its default cloud provider for new services). */
+export declare const updateAccountSchema: v.ObjectSchema<{
+    readonly defaultCloudProvider: v.OptionalSchema<v.PicklistSchema<["cloudflare", "docker", "aws", "gcp", "azure", "custom"], undefined>, undefined>;
+}, undefined>;
+export type UpdateAccountInput = v.InferOutput<typeof updateAccountSchema>;
+/** Add a member to an account by their internal user id. */
+export declare const addMemberSchema: v.ObjectSchema<{
+    readonly userId: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    readonly roles: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.PicklistSchema<["admin", "developer", "product"], undefined>, undefined>, v.MinLengthAction<("admin" | "developer" | "product")[], 1, undefined>]>, undefined>;
+}, undefined>;
+export type AddMemberInput = v.InferOutput<typeof addMemberSchema>;
+/** Set a member's role set (admin-only). */
+export declare const setMemberRolesSchema: v.ObjectSchema<{
+    readonly roles: v.SchemaWithPipe<readonly [v.ArraySchema<v.PicklistSchema<["admin", "developer", "product"], undefined>, undefined>, v.MinLengthAction<("admin" | "developer" | "product")[], 1, undefined>]>;
+}, undefined>;
+export type SetMemberRolesInput = v.InferOutput<typeof setMemberRolesSchema>;
+export declare const invitationStatusSchema: v.PicklistSchema<["pending", "accepted", "revoked"], undefined>;
+export type InvitationStatus = v.InferOutput<typeof invitationStatusSchema>;
+/** An account invitation as exposed to clients (never carries the raw token). */
+export declare const accountInvitationSchema: v.ObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly accountId: v.StringSchema<undefined>;
+    readonly email: v.StringSchema<undefined>;
+    readonly roles: v.SchemaWithPipe<readonly [v.ArraySchema<v.PicklistSchema<["admin", "developer", "product"], undefined>, undefined>, v.MinLengthAction<("admin" | "developer" | "product")[], 1, undefined>]>;
+    readonly status: v.PicklistSchema<["pending", "accepted", "revoked"], undefined>;
+    readonly invitedBy: v.StringSchema<undefined>;
+    readonly expiresAt: v.NumberSchema<undefined>;
+    readonly createdAt: v.NumberSchema<undefined>;
+}, undefined>;
+export type AccountInvitation = v.InferOutput<typeof accountInvitationSchema>;
+/** Invite a teammate by email into an org account. */
+export declare const createInvitationSchema: v.ObjectSchema<{
+    readonly email: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.EmailAction<string, undefined>, v.MaxLengthAction<string, 320, undefined>]>;
+    readonly roles: v.OptionalSchema<v.SchemaWithPipe<readonly [v.ArraySchema<v.PicklistSchema<["admin", "developer", "product"], undefined>, undefined>, v.MinLengthAction<("admin" | "developer" | "product")[], 1, undefined>]>, undefined>;
+}, undefined>;
+export type CreateInvitationInput = v.InferOutput<typeof createInvitationSchema>;
+export declare const emailProviderKindSchema: v.PicklistSchema<["sendgrid", "resend"], undefined>;
+export type EmailProviderKind = v.InferOutput<typeof emailProviderKindSchema>;
+/** Safe email-connection metadata exposed to clients (never the API key). */
+export declare const emailConnectionSchema: v.ObjectSchema<{
+    readonly provider: v.PicklistSchema<["sendgrid", "resend"], undefined>;
+    readonly fromAddress: v.StringSchema<undefined>;
+    readonly connectedAt: v.NumberSchema<undefined>;
+}, undefined>;
+export type EmailConnection = v.InferOutput<typeof emailConnectionSchema>;
+/** Connect (or replace) an account's email sender. */
+export declare const connectEmailSchema: v.ObjectSchema<{
+    readonly provider: v.PicklistSchema<["sendgrid", "resend"], undefined>;
+    readonly apiKey: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 500, undefined>]>;
+    readonly fromAddress: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.EmailAction<string, undefined>, v.MaxLengthAction<string, 320, undefined>]>;
+}, undefined>;
+export type ConnectEmailInput = v.InferOutput<typeof connectEmailSchema>;
+/** Send a test email through a connected account sender. */
+export declare const testEmailSchema: v.ObjectSchema<{
+    readonly to: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.EmailAction<string, undefined>, v.MaxLengthAction<string, 320, undefined>]>;
+}, undefined>;
+export type TestEmailInput = v.InferOutput<typeof testEmailSchema>;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAU5B,eAAO,MAAM,iBAAiB,kDAAkC,CAAA;AAChE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAOjE,eAAO,MAAM,iBAAiB,gEAAgD,CAAA;AAC9E,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEjE,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,+LAAqD,CAAA;AACpF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAEnE,gFAAgF;AAChF,eAAO,MAAM,aAAa;;;;IAIxB,kEAAkE;;;IAGlE,uFAAuF;;IAEvF;;;;OAIG;;aAEH,CAAA;AACF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,aAAa,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,eAAO,MAAM,mBAAmB;;;;;IAK9B,qFAAqF;;;;aAIrF,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAIrE,wEAAwE;AACxE,eAAO,MAAM,mBAAmB;;IAE9B,sDAAsD;;aAEtD,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE1E,yFAAyF;AACzF,eAAO,MAAM,mBAAmB;;aAE9B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE1E,4DAA4D;AAC5D,eAAO,MAAM,eAAe;;;aAG1B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,eAAe,CAAC,CAAA;AAElE,4CAA4C;AAC5C,eAAO,MAAM,oBAAoB;;aAE/B,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAI5E,eAAO,MAAM,sBAAsB,iEAAiD,CAAA;AACpF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAE3E,iFAAiF;AACjF,eAAO,MAAM,uBAAuB;;;;;;;;;aASlC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E,sDAAsD;AACtD,eAAO,MAAM,sBAAsB;;;aAGjC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,sBAAsB,CAAC,CAAA;AAIhF,eAAO,MAAM,uBAAuB,qDAAqC,CAAA;AACzE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E,6EAA6E;AAC7E,eAAO,MAAM,qBAAqB;;;;aAIhC,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEzE,sDAAsD;AACtD,eAAO,MAAM,kBAAkB;;;;aAI7B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,kBAAkB,CAAC,CAAA;AAExE,4DAA4D;AAC5D,eAAO,MAAM,eAAe;;aAE1B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,eAAe,CAAC,CAAA"}

package/dist/accounts.js

@@ -0,0 +1,102 @@
+import * as v from 'valibot';
+import { cloudProviderSchema } from './provisioning.js';
+// ---------------------------------------------------------------------------
+// Account tenancy wire contracts. An account is the tenant that owns workspaces:
+// either a single user's `personal` account or an `org` shared by many engineers.
+// Memberships map GitHub users to accounts with a role. A GitHub App installation
+// is bound to an account, so every workspace in it can link the account's repos.
+// ---------------------------------------------------------------------------
+export const accountTypeSchema = v.picklist(['personal', 'org']);
+// Combinable account roles. `admin` may modify anything about the org account
+// (settings, members, invitations, account-scoped credentials); `developer` is the
+// default and grants no special powers; `product` people can be set as a task's
+// responsible person and are notified when requirement review flags findings. A member
+// holds a SET of these (e.g. an admin who is also a product owner).
+export const accountRoleSchema = v.picklist(['admin', 'developer', 'product']);
+/** A member's combinable role set (at least one role). */
+export const accountRolesSchema = v.pipe(v.array(accountRoleSchema), v.minLength(1));
+/** An account as exposed to clients, annotated with the caller's role in it. */
+export const accountSchema = v.object({
+    id: v.string(),
+    type: accountTypeSchema,
+    name: v.string(),
+    /** The GitHub org/user login this account maps to, when known. */
+    githubAccountLogin: v.nullable(v.string()),
+    createdAt: v.number(),
+    /** The signed-in caller's roles in this account (`null` in the auth-disabled path). */
+    roles: v.nullable(accountRolesSchema),
+    /**
+     * The cloud provider new services in this account default to (a service may
+     * override it). Absent means the built-in {@link DEFAULT_CLOUD_PROVIDER}
+     * (`cloudflare`).
+     */
+    defaultCloudProvider: v.optional(cloudProviderSchema),
+});
+/** A member of an account. */
+export const accountMemberSchema = v.object({
+    accountId: v.string(),
+    userId: v.string(),
+    roles: accountRolesSchema,
+    createdAt: v.number(),
+    /** Display details of the member (resolved from the users table), when available. */
+    name: v.optional(v.nullable(v.string())),
+    email: v.optional(v.nullable(v.string())),
+    avatarUrl: v.optional(v.nullable(v.string())),
+});
+// ---- Request bodies -------------------------------------------------------
+/** Create a shared org account (the caller becomes its first owner). */
+export const createAccountSchema = v.object({
+    name: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(120)),
+    /** Optional GitHub org login this account maps to. */
+    githubAccountLogin: v.optional(v.pipe(v.string(), v.trim(), v.maxLength(120))),
+});
+/** Update an account's settings (today: its default cloud provider for new services). */
+export const updateAccountSchema = v.object({
+    defaultCloudProvider: v.optional(cloudProviderSchema),
+});
+/** Add a member to an account by their internal user id. */
+export const addMemberSchema = v.object({
+    userId: v.pipe(v.string(), v.minLength(1)),
+    roles: v.optional(accountRolesSchema),
+});
+/** Set a member's role set (admin-only). */
+export const setMemberRolesSchema = v.object({
+    roles: accountRolesSchema,
+});
+// ---- Invitations ----------------------------------------------------------
+export const invitationStatusSchema = v.picklist(['pending', 'accepted', 'revoked']);
+/** An account invitation as exposed to clients (never carries the raw token). */
+export const accountInvitationSchema = v.object({
+    id: v.string(),
+    accountId: v.string(),
+    email: v.string(),
+    roles: accountRolesSchema,
+    status: invitationStatusSchema,
+    invitedBy: v.string(),
+    expiresAt: v.number(),
+    createdAt: v.number(),
+});
+/** Invite a teammate by email into an org account. */
+export const createInvitationSchema = v.object({
+    email: v.pipe(v.string(), v.trim(), v.email(), v.maxLength(320)),
+    roles: v.optional(accountRolesSchema),
+});
+// ---- Email sender connection (per-account, UI-onboarded) ------------------
+export const emailProviderKindSchema = v.picklist(['sendgrid', 'resend']);
+/** Safe email-connection metadata exposed to clients (never the API key). */
+export const emailConnectionSchema = v.object({
+    provider: emailProviderKindSchema,
+    fromAddress: v.string(),
+    connectedAt: v.number(),
+});
+/** Connect (or replace) an account's email sender. */
+export const connectEmailSchema = v.object({
+    provider: emailProviderKindSchema,
+    apiKey: v.pipe(v.string(), v.minLength(1), v.maxLength(500)),
+    fromAddress: v.pipe(v.string(), v.trim(), v.email(), v.maxLength(320)),
+});
+/** Send a test email through a connected account sender. */
+export const testEmailSchema = v.object({
+    to: v.pipe(v.string(), v.trim(), v.email(), v.maxLength(320)),
+});
+//# sourceMappingURL=accounts.js.map

package/dist/accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.js","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAEvD,8EAA8E;AAC9E,iFAAiF;AACjF,kFAAkF;AAClF,kFAAkF;AAClF,iFAAiF;AACjF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAA;AAGhE,8EAA8E;AAC9E,mFAAmF;AACnF,gFAAgF;AAChF,uFAAuF;AACvF,oEAAoE;AACpE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAA;AAG9E,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;AAGpF,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,iBAAiB;IACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,kEAAkE;IAClE,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,uFAAuF;IACvF,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;IACrC;;;;OAIG;IACH,oBAAoB,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACtD,CAAC,CAAA;AAGF,8BAA8B;AAC9B,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,KAAK,EAAE,kBAAkB;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,qFAAqF;IACrF,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;CAC9C,CAAC,CAAA;AAGF,8EAA8E;AAE9E,wEAAwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACpE,sDAAsD;IACtD,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;CAC/E,CAAC,CAAA;AAGF,yFAAyF;AACzF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,oBAAoB,EAAE,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC;CACtD,CAAC,CAAA;AAGF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;CACtC,CAAC,CAAA;AAGF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,kBAAkB;CAC1B,CAAC,CAAA;AAGF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;AAGpF,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,kBAAkB;IACzB,MAAM,EAAE,sBAAsB;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AAGF,sDAAsD;AACtD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC;CACtC,CAAC,CAAA;AAGF,8EAA8E;AAE9E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;AAGzE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,QAAQ,EAAE,uBAAuB;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAA;AAGF,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,uBAAuB;IACjC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC5D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;CACvE,CAAC,CAAA;AAGF,4DAA4D;AAC5D,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;CAC9D,CAAC,CAAA"}

package/dist/agent-config.d.ts

@@ -0,0 +1,77 @@
+import * as v from 'valibot';
+/** One selectable choice for a `select`-typed config descriptor. */
+export declare const agentConfigOptionSchema: v.ObjectSchema<{
+    /** The value persisted on the block when this option is chosen. */
+    readonly value: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** Human label shown in the picker. */
+    readonly label: v.StringSchema<undefined>;
+}, undefined>;
+export type AgentConfigOption = v.InferOutput<typeof agentConfigOptionSchema>;
+/**
+ * A single configuration parameter an agent kind contributes. `id` is a stable,
+ * globally-unique key (conventionally namespaced by the kind, e.g.
+ * `tester.environment`) used both as the descriptor key and as the key under
+ * which the chosen value is stored in {@link agentConfigValuesSchema}. `type` is a
+ * picklist for forward-compatibility — only `select` exists today, but a future
+ * `text`/`number`/`boolean` descriptor slots in here without a shape change.
+ */
+export declare const agentConfigDescriptorSchema: v.ObjectSchema<{
+    /** Stable, globally-unique id, e.g. `tester.environment`. Also the value-map key. */
+    readonly id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** The agent kind that contributes (and owns the freeze of) this config. */
+    readonly agentKind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** Human label shown next to the field. */
+    readonly label: v.StringSchema<undefined>;
+    /** One-line explanation shown under the field. */
+    readonly description: v.StringSchema<undefined>;
+    /** The control type. Only `select` today; designed to grow. */
+    readonly type: v.PicklistSchema<["select"], undefined>;
+    /** The choices for a `select` descriptor. */
+    readonly options: v.ArraySchema<v.ObjectSchema<{
+        /** The value persisted on the block when this option is chosen. */
+        readonly value: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Human label shown in the picker. */
+        readonly label: v.StringSchema<undefined>;
+    }, undefined>, undefined>;
+    /** The value used when the task has made no explicit choice. */
+    readonly default: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+}, undefined>;
+export type AgentConfigDescriptor = v.InferOutput<typeof agentConfigDescriptorSchema>;
+/** The full catalog of config descriptors, attached to the workspace snapshot. */
+export declare const agentConfigCatalogSchema: v.ArraySchema<v.ObjectSchema<{
+    /** Stable, globally-unique id, e.g. `tester.environment`. Also the value-map key. */
+    readonly id: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** The agent kind that contributes (and owns the freeze of) this config. */
+    readonly agentKind: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+    /** Human label shown next to the field. */
+    readonly label: v.StringSchema<undefined>;
+    /** One-line explanation shown under the field. */
+    readonly description: v.StringSchema<undefined>;
+    /** The control type. Only `select` today; designed to grow. */
+    readonly type: v.PicklistSchema<["select"], undefined>;
+    /** The choices for a `select` descriptor. */
+    readonly options: v.ArraySchema<v.ObjectSchema<{
+        /** The value persisted on the block when this option is chosen. */
+        readonly value: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+        /** Human label shown in the picker. */
+        readonly label: v.StringSchema<undefined>;
+    }, undefined>, undefined>;
+    /** The value used when the task has made no explicit choice. */
+    readonly default: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>;
+}, undefined>, undefined>;
+export type AgentConfigCatalog = v.InferOutput<typeof agentConfigCatalogSchema>;
+/**
+ * The selected configuration values on a block: a plain map from descriptor id to
+ * the chosen value. Sparse — only ids the user has explicitly set are present;
+ * everything else resolves to the descriptor's `default` at read time.
+ */
+export declare const agentConfigValuesSchema: v.RecordSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>, v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MaxLengthAction<string, 400, undefined>]>, undefined>;
+export type AgentConfigValues = v.InferOutput<typeof agentConfigValuesSchema>;
+/** Parse-or-throw a block's stored agent-config values. */
+export declare function parseAgentConfigValues(value: unknown): AgentConfigValues;
+/**
+ * Resolve a single descriptor's effective value for a block: the explicit choice
+ * if present and valid, else the descriptor's default.
+ */
+export declare function resolveAgentConfigValue(descriptor: AgentConfigDescriptor, values: AgentConfigValues | undefined): string;
+//# sourceMappingURL=agent-config.d.ts.map

package/dist/agent-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-config.d.ts","sourceRoot":"","sources":["../src/agent-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAqB5B,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;IAClC,mEAAmE;;IAEnE,uCAAuC;;aAEvC,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B;IACtC,qFAAqF;;IAErF,4EAA4E;;IAE5E,2CAA2C;;IAE3C,kDAAkD;;IAElD,+DAA+D;;IAE/D,6CAA6C;;QA1B7C,mEAAmE;;QAEnE,uCAAuC;;;IA0BvC,gEAAgE;;aAEhE,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF,kFAAkF;AAClF,eAAO,MAAM,wBAAwB;IAlBnC,qFAAqF;;IAErF,4EAA4E;;IAE5E,2CAA2C;;IAE3C,kDAAkD;;IAElD,+DAA+D;;IAE/D,6CAA6C;;QA1B7C,mEAAmE;;QAEnE,uCAAuC;;;IA0BvC,gEAAgE;;yBAMU,CAAA;AAC5E,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAE/E;;;;GAIG;AAMH,eAAO,MAAM,uBAAuB,0QAGnC,CAAA;AACD,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAE7E,2DAA2D;AAC3D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAExE;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,UAAU,EAAE,qBAAqB,EACjC,MAAM,EAAE,iBAAiB,GAAG,SAAS,GACpC,MAAM,CAIR"}

package/dist/agent-config.js

@@ -0,0 +1,78 @@
+import * as v from 'valibot';
+import { agentKindSchema } from './primitives.js';
+// ---------------------------------------------------------------------------
+// Agent configuration-contribution contracts.
+//
+// Agents (built-in or custom) may *contribute* task-level configuration
+// parameters they care about — e.g. the `tester` agent contributes whether it
+// runs the suite against an ephemeral environment or stands the dependencies up
+// locally. When a pipeline is selected for a task, the union of the contributions
+// of that pipeline's agent kinds is surfaced as editable fields on task creation
+// and in the inspector. Each value is editable until the contributing agent's
+// pipeline step starts, at which point it freezes.
+//
+// The descriptor catalog is STATIC metadata derived from the registered agent
+// kinds (see `@cat-factory/agents` `configContributionsFor`), attached to the
+// workspace snapshot. The selected VALUES live on the block (`Block.agentConfig`),
+// a plain id→value map. This mirrors how the model/fragment/merge-preset catalogs
+// are served read-only while the per-block selection is persisted on the block.
+// ---------------------------------------------------------------------------
+/** One selectable choice for a `select`-typed config descriptor. */
+export const agentConfigOptionSchema = v.object({
+    /** The value persisted on the block when this option is chosen. */
+    value: v.pipe(v.string(), v.minLength(1)),
+    /** Human label shown in the picker. */
+    label: v.string(),
+});
+/**
+ * A single configuration parameter an agent kind contributes. `id` is a stable,
+ * globally-unique key (conventionally namespaced by the kind, e.g.
+ * `tester.environment`) used both as the descriptor key and as the key under
+ * which the chosen value is stored in {@link agentConfigValuesSchema}. `type` is a
+ * picklist for forward-compatibility — only `select` exists today, but a future
+ * `text`/`number`/`boolean` descriptor slots in here without a shape change.
+ */
+export const agentConfigDescriptorSchema = v.object({
+    /** Stable, globally-unique id, e.g. `tester.environment`. Also the value-map key. */
+    id: v.pipe(v.string(), v.minLength(1)),
+    /** The agent kind that contributes (and owns the freeze of) this config. */
+    agentKind: agentKindSchema,
+    /** Human label shown next to the field. */
+    label: v.string(),
+    /** One-line explanation shown under the field. */
+    description: v.string(),
+    /** The control type. Only `select` today; designed to grow. */
+    type: v.picklist(['select']),
+    /** The choices for a `select` descriptor. */
+    options: v.array(agentConfigOptionSchema),
+    /** The value used when the task has made no explicit choice. */
+    default: v.pipe(v.string(), v.minLength(1)),
+});
+/** The full catalog of config descriptors, attached to the workspace snapshot. */
+export const agentConfigCatalogSchema = v.array(agentConfigDescriptorSchema);
+/**
+ * The selected configuration values on a block: a plain map from descriptor id to
+ * the chosen value. Sparse — only ids the user has explicitly set are present;
+ * everything else resolves to the descriptor's `default` at read time.
+ */
+// Keys are descriptor ids (e.g. `tester.environment`) and values are short option
+// values; both are length-capped so a stray client can't persist an unbounded map.
+// Values are NOT validated against the descriptor catalog here (the contracts layer
+// can't see the runtime-registered descriptors) — `resolveAgentConfigValue` falls
+// back to the descriptor default for any unknown/invalid value at read time.
+export const agentConfigValuesSchema = v.record(v.pipe(v.string(), v.minLength(1), v.maxLength(120)), v.pipe(v.string(), v.maxLength(400)));
+/** Parse-or-throw a block's stored agent-config values. */
+export function parseAgentConfigValues(value) {
+    return v.parse(agentConfigValuesSchema, value);
+}
+/**
+ * Resolve a single descriptor's effective value for a block: the explicit choice
+ * if present and valid, else the descriptor's default.
+ */
+export function resolveAgentConfigValue(descriptor, values) {
+    const chosen = values?.[descriptor.id];
+    if (chosen && descriptor.options.some((o) => o.value === chosen))
+        return chosen;
+    return descriptor.default;
+}
+//# sourceMappingURL=agent-config.js.map

package/dist/agent-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-config.js","sourceRoot":"","sources":["../src/agent-config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,8EAA8E;AAC9E,8CAA8C;AAC9C,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,gFAAgF;AAChF,kFAAkF;AAClF,iFAAiF;AACjF,8EAA8E;AAC9E,mDAAmD;AACnD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,mFAAmF;AACnF,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAE9E,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,mEAAmE;IACnE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzC,uCAAuC;IACvC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,qFAAqF;IACrF,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACtC,4EAA4E;IAC5E,SAAS,EAAE,eAAe;IAC1B,2CAA2C;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,kDAAkD;IAClD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,+DAA+D;IAC/D,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC5B,6CAA6C;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,uBAAuB,CAAC;IACzC,gEAAgE;IAChE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;CAC5C,CAAC,CAAA;AAGF,kFAAkF;AAClF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAA;AAG5E;;;;GAIG;AACH,kFAAkF;AAClF,mFAAmF;AACnF,oFAAoF;AACpF,kFAAkF;AAClF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAC7C,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EACpD,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CACrC,CAAA;AAGD,2DAA2D;AAC3D,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,OAAO,CAAC,CAAC,KAAK,CAAC,uBAAuB,EAAE,KAAK,CAAC,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,UAAiC,EACjC,MAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACtC,IAAI,MAAM,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC;QAAE,OAAO,MAAM,CAAA;IAC/E,OAAO,UAAU,CAAC,OAAO,CAAA;AAC3B,CAAC"}

package/dist/api-keys.d.ts

@@ -0,0 +1,44 @@
+import * as v from 'valibot';
+/** The scope a stored API key belongs to. */
+export declare const apiKeyScopeSchema: v.PicklistSchema<["account", "workspace", "user"], undefined>;
+export type ApiKeyScope = v.InferOutput<typeof apiKeyScopeSchema>;
+/** The direct providers that own a poolable API key. */
+export declare const apiKeyProviderSchema: v.PicklistSchema<["openai", "anthropic", "qwen", "deepseek", "moonshot", "openrouter", "litellm"], undefined>;
+export type ApiKeyProvider = v.InferOutput<typeof apiKeyProviderSchema>;
+/** One pool key as exposed to clients — metadata + usage, never the secret. */
+export declare const apiKeySchema: v.ObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly scope: v.PicklistSchema<["account", "workspace", "user"], undefined>;
+    readonly scopeId: v.StringSchema<undefined>;
+    readonly provider: v.PicklistSchema<["openai", "anthropic", "qwen", "deepseek", "moonshot", "openrouter", "litellm"], undefined>;
+    readonly label: v.StringSchema<undefined>;
+    readonly createdAt: v.NumberSchema<undefined>;
+    readonly lastUsedAt: v.NullableSchema<v.NumberSchema<undefined>, undefined>;
+    /** Rolling-window usage so the UI can show load and rotation fairness. */
+    readonly inputTokens: v.NumberSchema<undefined>;
+    readonly outputTokens: v.NumberSchema<undefined>;
+    readonly requestCount: v.NumberSchema<undefined>;
+}, undefined>;
+export type ApiKey = v.InferOutput<typeof apiKeySchema>;
+export declare const apiKeyListSchema: v.ArraySchema<v.ObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly scope: v.PicklistSchema<["account", "workspace", "user"], undefined>;
+    readonly scopeId: v.StringSchema<undefined>;
+    readonly provider: v.PicklistSchema<["openai", "anthropic", "qwen", "deepseek", "moonshot", "openrouter", "litellm"], undefined>;
+    readonly label: v.StringSchema<undefined>;
+    readonly createdAt: v.NumberSchema<undefined>;
+    readonly lastUsedAt: v.NullableSchema<v.NumberSchema<undefined>, undefined>;
+    /** Rolling-window usage so the UI can show load and rotation fairness. */
+    readonly inputTokens: v.NumberSchema<undefined>;
+    readonly outputTokens: v.NumberSchema<undefined>;
+    readonly requestCount: v.NumberSchema<undefined>;
+}, undefined>, undefined>;
+export type ApiKeyList = v.InferOutput<typeof apiKeyListSchema>;
+/** Add a key to a pool. `key` is write-only (the raw secret). */
+export declare const addApiKeySchema: v.ObjectSchema<{
+    readonly provider: v.PicklistSchema<["openai", "anthropic", "qwen", "deepseek", "moonshot", "openrouter", "litellm"], undefined>;
+    readonly label: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 120, undefined>]>;
+    readonly key: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MinLengthAction<string, 1, undefined>]>;
+}, undefined>;
+export type AddApiKeyInput = v.InferOutput<typeof addApiKeySchema>;
+//# sourceMappingURL=api-keys.d.ts.map

package/dist/api-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.d.ts","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAc5B,6CAA6C;AAC7C,eAAO,MAAM,iBAAiB,+DAA+C,CAAA;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAEjE,wDAAwD;AACxD,eAAO,MAAM,oBAAoB,+GAW/B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEvE,+EAA+E;AAC/E,eAAO,MAAM,YAAY;;;;;;;;IAQvB,0EAA0E;;;;aAI1E,CAAA;AACF,MAAM,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,YAAY,CAAC,CAAA;AAEvD,eAAO,MAAM,gBAAgB;;;;;;;;IAP3B,0EAA0E;;;;yBAOvB,CAAA;AACrD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAE/D,iEAAiE;AACjE,eAAO,MAAM,eAAe;;;;aAI1B,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,eAAe,CAAC,CAAA"}

package/dist/api-keys.js

@@ -0,0 +1,49 @@
+import * as v from 'valibot';
+// ---------------------------------------------------------------------------
+// Direct-provider API-key wire contracts.
+//
+// Vendor API keys (OpenAI/Anthropic/Qwen/DeepSeek/Moonshot) are onboarded via the
+// UI and stored encrypted in the DB, replacing the old deployment-env onboarding.
+// A key lives at one of three SCOPES — account, workspace, or user. Within a
+// workspace the candidate pool is the union of the workspace's keys, its owning
+// account's keys, and the run initiator's own user keys; keys are leased with
+// usage-aware rotation. The raw key is write-only — encrypted at rest and never
+// returned; only metadata + rolling-window usage is exposed back to clients.
+// ---------------------------------------------------------------------------
+/** The scope a stored API key belongs to. */
+export const apiKeyScopeSchema = v.picklist(['account', 'workspace', 'user']);
+/** The direct providers that own a poolable API key. */
+export const apiKeyProviderSchema = v.picklist([
+    'openai',
+    'anthropic',
+    'qwen',
+    'deepseek',
+    'moonshot',
+    // OpenAI-compatible aggregator/gateway providers: OpenRouter (a single hosted gateway
+    // to 300+ models) and LiteLLM (an operator-hosted gateway; its base URL comes from the
+    // deployment's LITELLM_BASE_URL). Both resolve via the shared OpenAI-compatible path.
+    'openrouter',
+    'litellm',
+]);
+/** One pool key as exposed to clients — metadata + usage, never the secret. */
+export const apiKeySchema = v.object({
+    id: v.string(),
+    scope: apiKeyScopeSchema,
+    scopeId: v.string(),
+    provider: apiKeyProviderSchema,
+    label: v.string(),
+    createdAt: v.number(),
+    lastUsedAt: v.nullable(v.number()),
+    /** Rolling-window usage so the UI can show load and rotation fairness. */
+    inputTokens: v.number(),
+    outputTokens: v.number(),
+    requestCount: v.number(),
+});
+export const apiKeyListSchema = v.array(apiKeySchema);
+/** Add a key to a pool. `key` is write-only (the raw secret). */
+export const addApiKeySchema = v.object({
+    provider: apiKeyProviderSchema,
+    label: v.pipe(v.string(), v.trim(), v.minLength(1), v.maxLength(120)),
+    key: v.pipe(v.string(), v.trim(), v.minLength(1)),
+});
+//# sourceMappingURL=api-keys.js.map

package/dist/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../src/api-keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,0CAA0C;AAC1C,EAAE;AACF,kFAAkF;AAClF,kFAAkF;AAClF,6EAA6E;AAC7E,gFAAgF;AAChF,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAE9E,6CAA6C;AAC7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAA;AAG7E,wDAAwD;AACxD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC7C,QAAQ;IACR,WAAW;IACX,MAAM;IACN,UAAU;IACV,UAAU;IACV,sFAAsF;IACtF,uFAAuF;IACvF,sFAAsF;IACtF,YAAY;IACZ,SAAS;CACV,CAAC,CAAA;AAGF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,iBAAiB;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,oBAAoB;IAC9B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,0EAA0E;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;AAGrD,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,QAAQ,EAAE,oBAAoB;IAC9B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;CAClD,CAAC,CAAA"}

package/dist/auth.d.ts

@@ -0,0 +1,24 @@
+import * as v from 'valibot';
+export declare const signupSchema: v.ObjectSchema<{
+    readonly email: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.EmailAction<string, undefined>, v.MaxLengthAction<string, 320, undefined>]>;
+    readonly password: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 8, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+    readonly name: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.MaxLengthAction<string, 120, undefined>]>, undefined>;
+    /** Optional invitation token to redeem on signup (grants org membership). */
+    readonly invite: v.OptionalSchema<v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>]>, undefined>;
+}, undefined>;
+export type SignupInput = v.InferOutput<typeof signupSchema>;
+export declare const passwordLoginSchema: v.ObjectSchema<{
+    readonly email: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.TrimAction, v.EmailAction<string, undefined>, v.MaxLengthAction<string, 320, undefined>]>;
+    readonly password: v.SchemaWithPipe<readonly [v.StringSchema<undefined>, v.MinLengthAction<string, 1, undefined>, v.MaxLengthAction<string, 200, undefined>]>;
+}, undefined>;
+export type PasswordLoginInput = v.InferOutput<typeof passwordLoginSchema>;
+/** What `GET /auth/config` reports so the SPA renders the right login controls. */
+export interface AuthProvidersConfig {
+    enabled: boolean;
+    providers: {
+        github: boolean;
+        password: boolean;
+        google: boolean;
+    };
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAK5B,eAAO,MAAM,YAAY;;;;IAIvB,6EAA6E;;aAE7E,CAAA;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,YAAY,CAAC,CAAA;AAE5D,eAAO,MAAM,mBAAmB;;;aAG9B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE1E,mFAAmF;AACnF,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CACnE"}

package/dist/auth.js

@@ -0,0 +1,15 @@
+import * as v from 'valibot';
+// Wire contracts for the email/password + invite auth flows. OAuth flows are pure
+// browser redirects, so they need no request body schema.
+export const signupSchema = v.object({
+    email: v.pipe(v.string(), v.trim(), v.email(), v.maxLength(320)),
+    password: v.pipe(v.string(), v.minLength(8), v.maxLength(200)),
+    name: v.optional(v.pipe(v.string(), v.trim(), v.maxLength(120))),
+    /** Optional invitation token to redeem on signup (grants org membership). */
+    invite: v.optional(v.pipe(v.string(), v.minLength(1))),
+});
+export const passwordLoginSchema = v.object({
+    email: v.pipe(v.string(), v.trim(), v.email(), v.maxLength(320)),
+    password: v.pipe(v.string(), v.minLength(1), v.maxLength(200)),
+});
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,kFAAkF;AAClF,0DAA0D;AAE1D,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC9D,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;CACvD,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAChE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;CAC/D,CAAC,CAAA"}