@discover-cloud/shared 1.2.8 → 1.3.0

package/dist/dtos/auth-service.dto.d.ts

@@ -1,31 +1,25 @@
-import { AccountStatus } from "../enums";
 /**
- * AUTH SERVICE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────────
- * Internal data shapes produced by the auth service.
- *
- * SECURITY RULE: DTOs containing secrets (token, hash fields) must NEVER
- * be returned directly in HTTP responses. They exist so internal service
- * methods have typed return values — mappers are responsible for stripping
- * secrets before anything reaches the wire.
- *
- * Secret fields are annotated with  // SECRET — internal use only
- * to make accidental exposure visible at a glance during code review.
+ * @file account.dto.ts
+ * @description Transport-safe DTOs for Account domain entities.
  */
 export interface AccountDto {
     id: string;
     email: string;
     isVerified: boolean;
-    status: AccountStatus;
+    status: string;
+    mfaEnabled: boolean;
+    lastLoginAt: string | null;
     createdAt: string;
     updatedAt: string;
 }
-export interface EmailVerificationDto {
+export interface SessionDto {
     id: string;
     accountId: string;
-    token: string;
+    familyId: string;
+    ipAddress: string | null;
+    userAgent: string | null;
+    device: string | null;
     expiresAt: string;
-    isUsed: boolean;
     createdAt: string;
 }
 export interface OAuthIdentityDto {
@@ -34,24 +28,76 @@ export interface OAuthIdentityDto {
     provider: string;
     providerId: string;
     createdAt: string;
+}
+export interface ServiceClientDto {
+    id: string;
+    serviceId: string;
+    name: string;
+    scopes: string[];
+    isActive: boolean;
+    lastUsedAt: string | null;
+    rotatedAt: string | null;
+    expiresAt: string | null;
+    createdById: string | null;
+    createdAt: string;
     updatedAt: string;
 }
-export interface PasswordResetDto {
+export interface PlatformPermissionDto {
     id: string;
-    accountId: string;
-    token: string;
-    expiresAt: string;
-    isUsed: boolean;
+    key: string;
+    resource: string;
+    action: string;
+    category: string;
+    description: string | null;
+    serviceOwner: string | null;
+    dangerous: boolean;
     createdAt: string;
 }
-export interface SessionDto {
+export interface PlatformRoleDto {
+    id: string;
+    name: string;
+    type: string;
+    category: string;
+    isProtected: boolean;
+    createdById: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface PlatformRoleWithPermissionsDto extends PlatformRoleDto {
+    permissions: PlatformPermissionDto[];
+}
+export interface PlatformRoleAssignmentDto {
     id: string;
     accountId: string;
-    expiresAt: string;
+    roleId: string;
+    status: string;
+    assignedById: string | null;
+    revokedById: string | null;
     revokedAt: string | null;
-    ipAddress: string | null;
-    userAgent: string | null;
-    device: string | null;
+    role?: PlatformRoleDto;
     createdAt: string;
     updatedAt: string;
 }
+export interface AuthTokensDto {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+export interface LoginResponseDto {
+    tokens: AuthTokensDto;
+    account: AccountDto;
+    mfaRequired: false;
+}
+export interface MfaRequiredResponseDto {
+    mfaRequired: true;
+    mfaToken: string;
+}
+export type LoginOrMfaResponseDto = LoginResponseDto | MfaRequiredResponseDto;
+export interface MfaSetupDto {
+    secret: string;
+    otpauthUrl: string;
+    qrCodeDataUrl: string;
+}
+export interface MfaBackupCodesDto {
+    backupCodes: string[];
+}

package/dist/dtos/auth-service.dto.js

@@ -1,2 +1,6 @@
 "use strict";
+/**
+ * @file account.dto.ts
+ * @description Transport-safe DTOs for Account domain entities.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/cloud-service.dto.d.ts

@@ -1,31 +1,16 @@
-import { CloudProvider, CloudAccountStatus, AwsAuthMethod, GcpAuthMethod, AzureAuthMethod, SyncStatus, SyncType } from "../enums";
 /**
- * CLOUD SERVICE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────────
- * Shapes produced and consumed by the cloud service.
- *
- * Date handling:
- *   JSON has no Date type. Domain models use Date internally; these DTOs
- *   are the serialised form at the HTTP boundary — all timestamps are ISO 8601 strings.
- *
- * Credential handling:
- *   CloudAccountDto intentionally omits encryptedCredentials — credentials
- *   are write-only. The connect DTOs accept credentials as `unknown` because
- *   the shape differs per provider and per authMethod; Zod schemas in the
- *   cloud service validate the concrete shape at runtime.
- *
- * SyncJobDto:
- *   Read-only. Sync jobs are created internally by the scheduler and exposed
- *   for status polling only — clients never POST a sync job directly.
- *
- * Provider push DTOs (CloudCostRecordDto, CloudResourceDto, CloudBudgetDto):
- *   Used when cloud-service pushes collected data to insights-service.
- *   They include cloudAccountId for scoping — insights-service uses this to
- *   associate records with the correct account without re-fetching.
+ * @file cloud-service.dto.ts
+ * @description Data transfer objects (DTOs) for cloud accounts,
+ * sync jobs, provider ingestion, and insights communication.
  */
+import { CloudProvider, CloudAccountStatus, AwsAuthMethod, GcpAuthMethod, AzureAuthMethod, SyncStatus, SyncType } from "../enums";
+/** Public representation of a connected cloud account. */
 export interface CloudAccountDto {
     id: string;
-    userId: string;
+    /** Workspace that owns this cloud account. */
+    workspaceId: string;
+    /** User who originally connected this account. */
+    createdBy: string;
     alias: string;
     provider: CloudProvider;
     status: CloudAccountStatus;
@@ -36,24 +21,25 @@ export interface CloudAccountDto {
     createdAt: string;
     updatedAt: string;
 }
-/** Credential payload for a new AWS cloud account connection. */
+/** Request payload to connect a new AWS account. */
 export interface ConnectAwsAccountDto {
     alias: string;
     authMethod: AwsAuthMethod;
     credentials: unknown;
 }
-/** Credential payload for a new GCP cloud account connection. */
+/** Request payload to connect a new GCP account. */
 export interface ConnectGcpAccountDto {
     alias: string;
     authMethod: GcpAuthMethod;
     credentials: unknown;
 }
-/** Credential payload for a new Azure cloud account connection. */
+/** Request payload to connect a new Azure account. */
 export interface ConnectAzureAccountDto {
     alias: string;
     authMethod: AzureAuthMethod;
     credentials: unknown;
 }
+/** Metadata tracking a single cloud synchronization job. */
 export interface SyncJobDto {
     id: string;
     cloudAccountId: string;
@@ -68,6 +54,42 @@ export interface SyncJobDto {
     createdAt: string;
     updatedAt: string;
 }
+/** Consolidated collection metrics normalized from a cloud provider. */
+export interface ProviderFetchResultDto {
+    costs: ProviderCostDto[];
+    resources: ProviderResourceDto[];
+    budgets: ProviderBudgetDto[];
+}
+/** Normalized cost record details fetched from a cloud provider. */
+export interface ProviderCostDto {
+    service: string;
+    region: string;
+    amount: number;
+    currency: string;
+    periodStart: string;
+    periodEnd: string;
+    usageType: string;
+}
+/** Normalized resource metadata details fetched from a cloud provider. */
+export interface ProviderResourceDto {
+    resourceType: string;
+    resourceId: string;
+    region: string;
+    name: string | null;
+    status: string;
+    tags: Record<string, string>;
+    metadata: Record<string, unknown>;
+}
+/** Normalized budget configuration fetched from a cloud provider. */
+export interface ProviderBudgetDto {
+    name: string;
+    limitAmount: number;
+    currency: string;
+    period: string;
+    actualSpend?: number;
+    forecastSpend?: number;
+}
+/** Enriched cost record details pushed to the insights service. */
 export interface CloudCostRecordDto {
     cloudAccountId: string;
     provider: CloudProvider;
@@ -79,6 +101,7 @@ export interface CloudCostRecordDto {
     periodEnd: string;
     usageType: string;
 }
+/** Enriched resource metadata details pushed to the insights service. */
 export interface CloudResourceDto {
     cloudAccountId: string;
     provider: CloudProvider;
@@ -90,6 +113,7 @@ export interface CloudResourceDto {
     tags: Record<string, string>;
     metadata: Record<string, unknown>;
 }
+/** Enriched budget configuration details pushed to the insights service. */
 export interface CloudBudgetDto {
     cloudAccountId: string;
     name: string;

package/dist/dtos/cloud-service.dto.js

@@ -1,2 +1,7 @@
 "use strict";
+/**
+ * @file cloud-service.dto.ts
+ * @description Data transfer objects (DTOs) for cloud accounts,
+ * sync jobs, provider ingestion, and insights communication.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/insights-service.dto.d.ts

@@ -1,22 +1,12 @@
-import { CloudProvider } from "../enums";
 /**
- * INSIGHTS SERVICE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────────────
- * Four groups of types, each with a distinct role:
- *
- * Push payloads   — cloud-service → insights-service (internal HTTP).
- *                   Carry raw provider data collected during a sync job.
- *
- * Record DTOs     — insights-service → frontend (public HTTP).
- *                   Stored/enriched records returned to clients.
- *                   All timestamps are ISO 8601 strings (JSON has no Date).
+ * @file insights-service.dto.ts
+ * @description Data transfer objects (DTOs) for cost tracking, cloud resource inventory,
+ * budgets, and aggregated analytics reports in the Insights Service.
  *
- * Query DTO       — internal query params passed between service layers.
- *                   Never crosses an HTTP boundary — Date is fine here.
- *
- * Summary DTOs    — assembled aggregations with no corresponding domain
- *                   model or mapper. Built directly from DB query results.
+ * All push payloads and query DTOs are scoped to a workspaceId — the sole
+ * multi-tenancy discriminator. userId / organizationId have been removed.
  */
+import { CloudProvider } from "../enums";
 export interface PushCostItem {
     service: string;
     region: string;
@@ -45,25 +35,28 @@ export interface PushBudgetItem {
 }
 export interface PushCostPayload {
     cloudAccountId: string;
-    userId: string;
+    /** Workspace that owns this data — the sole tenancy scope. */
+    workspaceId: string;
     provider: CloudProvider;
     costs: PushCostItem[];
 }
 export interface PushResourcePayload {
     cloudAccountId: string;
-    userId: string;
+    /** Workspace that owns this data — the sole tenancy scope. */
+    workspaceId: string;
     provider: CloudProvider;
     resources: PushResourceItem[];
 }
 export interface PushBudgetPayload {
     cloudAccountId: string;
-    userId: string;
+    /** Workspace that owns this data — the sole tenancy scope. */
+    workspaceId: string;
     budgets: PushBudgetItem[];
 }
 export interface CostRecordDto {
     id: string;
     cloudAccountId: string;
-    userId: string;
+    workspaceId: string;
     provider: CloudProvider;
     service: string;
     region: string;
@@ -77,7 +70,7 @@ export interface CostRecordDto {
 export interface ResourceRecordDto {
     id: string;
     cloudAccountId: string;
-    userId: string;
+    workspaceId: string;
     provider: CloudProvider;
     resourceType: string;
     resourceId: string;
@@ -91,7 +84,7 @@ export interface ResourceRecordDto {
 export interface BudgetRecordDto {
     id: string;
     cloudAccountId: string;
-    userId: string;
+    workspaceId: string;
     name: string;
     limitAmount: number;
     currency: string;
@@ -104,13 +97,11 @@ export interface BudgetRecordDto {
     recordedAt: string;
 }
 /**
- * CostQueryDto
- * Used by the insights-service query layer internally.
- * Date fields are fine here — this never reaches JSON serialisation.
- * If this ever needs to cross HTTP, convert from/to to ISO 8601 strings.
+ * Parameter model for cost queries.
+ * Scoped to a workspaceId — callers must always provide this.
  */
 export interface CostQueryDto {
-    userId?: string;
+    workspaceId: string;
     cloudAccountId?: string;
     provider?: CloudProvider;
     from?: Date;

package/dist/dtos/insights-service.dto.js

@@ -1,2 +1,10 @@
 "use strict";
+/**
+ * @file insights-service.dto.ts
+ * @description Data transfer objects (DTOs) for cost tracking, cloud resource inventory,
+ * budgets, and aggregated analytics reports in the Insights Service.
+ *
+ * All push payloads and query DTOs are scoped to a workspaceId — the sole
+ * multi-tenancy discriminator. userId / organizationId have been removed.
+ */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/response.dto.d.ts

@@ -1,25 +1,6 @@
 /**
- * RESPONSE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────
- * Shared HTTP response shapes used across all services.
- * Every response — success or error — is wrapped in the ApiSuccessResponse
- * or ApiErrorResponse envelope so clients have a consistent shape to key on.
- *
- * Envelope shape:
- *   {
- *     success: true,
- *     data: T,
- *     meta: { requestId, timestamp }
- *   }
- *   or
- *   {
- *     success: false,
- *     error: { code, message, details? },
- *     meta: { requestId, timestamp }
- *   }
- *
- * The success() and failure() utils in shared/utils construct these
- * envelopes — don't build them manually in controllers.
+ * @file response.dto.ts
+ * @description Shared HTTP response envelopes, pagination models, and generic response contracts.
  */
 export interface ApiMeta {
     requestId: string;
@@ -39,39 +20,9 @@ export interface ApiErrorResponse {
     };
     meta: ApiMeta;
 }
-/**
- * TokensResponseDto
- * Returned on successful login or token refresh.
- *
- * accessToken  — short-lived JWT returned in the response body.
- * refreshToken — long-lived token sent as an HttpOnly cookie by the auth
- *                service; it is intentionally absent from this DTO.
- *                Mobile clients that cannot use cookies should request a
- *                separate endpoint that returns the refresh token explicitly.
- */
-export interface TokensResponseDto {
-    accessToken: string;
-}
-/**
- * MessageResponseDto
- * Use for simple confirmations where no structured data is needed.
- * Example: { message: "Email verification sent" }
- */
 export interface MessageResponseDto {
     message: string;
 }
-/**
- * ActionResponseDto
- * Use when the client needs a machine-readable signal of what happened,
- * e.g. for polling loops, event-driven UIs, or audit trails.
- *
- * action  — stable machine-readable identifier, e.g. "account.suspended"
- * message — human-readable description for display or logging
- *
- * Boolean-only DTOs (LoggedOutResponseDto, SuspendedResponseDto, etc.)
- * are intentionally collapsed into this shape — a boolean that is always
- * true on a 200 response carries no additional information.
- */
 export interface ActionResponseDto {
     action: string;
     message: string;
@@ -84,42 +35,14 @@ export interface PaginationMeta {
     hasNext: boolean;
     hasPrev: boolean;
 }
-/**
- * PaginatedResponseDto
- * Wrap paginated list results in this before passing to success().
- *
- * Usage:
- *   success<PaginatedResponseDto<CloudAccountDto>>(res, req, {
- *     items: accounts,
- *     pagination: { page, pageSize, totalItems, totalPages, hasNext, hasPrev },
- *   });
- */
 export interface PaginatedResponseDto<T> {
     items: T[];
     pagination: PaginationMeta;
 }
-/**
- * LoginResultDto
- * Internal auth service response returned after successful login.
- *
- * The optional cookie metadata allows controllers or gateways
- * to apply refresh-token cookies without coupling shared DTOs
- * to a specific HTTP framework.
- */
-export interface CookieMetadataDto {
-    httpOnly?: boolean;
-    secure?: boolean;
-    sameSite?: boolean | "strict" | "lax" | "none";
-    maxAge?: number;
-    path?: string;
-    domain?: string;
-}
-export interface LoginResultCookieDto {
-    name: string;
-    value: string;
-    options: CookieMetadataDto;
+export interface AuthTokenDto {
+    accessToken: string;
 }
-export interface LoginResultDto {
-    tokens: TokensResponseDto;
-    cookie?: LoginResultCookieDto;
+export interface MachineTokenDto {
+    accessToken: string;
+    expiresIn: number;
 }

package/dist/dtos/response.dto.js

@@ -1,25 +1,6 @@
 "use strict";
 /**
- * RESPONSE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────
- * Shared HTTP response shapes used across all services.
- * Every response — success or error — is wrapped in the ApiSuccessResponse
- * or ApiErrorResponse envelope so clients have a consistent shape to key on.
- *
- * Envelope shape:
- *   {
- *     success: true,
- *     data: T,
- *     meta: { requestId, timestamp }
- *   }
- *   or
- *   {
- *     success: false,
- *     error: { code, message, details? },
- *     meta: { requestId, timestamp }
- *   }
- *
- * The success() and failure() utils in shared/utils construct these
- * envelopes — don't build them manually in controllers.
+ * @file response.dto.ts
+ * @description Shared HTTP response envelopes, pagination models, and generic response contracts.
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/dtos/user-service.dto.d.ts

@@ -1,11 +1,4 @@
-import { OrganizationRole, MembershipStatus, OrganizationStatus, Theme, Currency } from "../enums";
-/**
- * USER SERVICE DTOs  (@discover-cloud/shared)
- * ─────────────────────────────────────────────
- * Shapes returned by the user service over HTTP.
- * All timestamps are ISO 8601 strings — JSON has no Date type.
- * Domain models use Date internally; mappers convert at the boundary.
- */
+import { Currency, Theme, OrganizationStatus, MembershipStatus, WorkspaceType, RoleType, RoleCategory, RoleAssignmentStatus, InviteScopeType, InviteStatus, AlertRuleOperator, AlertRuleMetric, NotificationChannelType } from '../enums';
 export interface UserDto {
     id: string;
     email: string;
@@ -19,23 +12,27 @@ export interface UserProfileDto {
     avatarUrl: string | null;
     jobTitle: string | null;
     bio: string | null;
-    timezone: string | null;
-    locale: string;
     country: string | null;
     pronouns: string | null;
+    phoneNumber: string | null;
     createdAt: string;
     updatedAt: string;
 }
 export interface UserPreferencesDto {
     id: string;
     userId: string;
+    locale: string;
+    timezone: string;
     theme: Theme;
-    language: string;
     currency: Currency;
-    emailAlerts: boolean;
+    emailNotifications: boolean;
     createdAt: string;
     updatedAt: string;
 }
+export interface UserWithProfileDto extends UserDto {
+    profile: UserProfileDto | null;
+    preferences: UserPreferencesDto | null;
+}
 export interface OrganizationDto {
     id: string;
     name: string;
@@ -45,12 +42,120 @@ export interface OrganizationDto {
     updatedAt: string;
     deletedAt: string | null;
 }
+export interface OrganizationWithMembersCountDto extends OrganizationDto {
+    membersCount: number;
+}
 export interface OrganizationMemberDto {
     id: string;
     userId: string;
     organizationId: string;
-    role: OrganizationRole;
     status: MembershipStatus;
     createdAt: string;
     updatedAt: string;
 }
+export interface WorkspaceDto {
+    id: string;
+    name: string;
+    slug: string;
+    type: WorkspaceType;
+    ownerUserId: string | null;
+    organizationId: string | null;
+    createdAt: string;
+    updatedAt: string;
+    deletedAt: string | null;
+}
+export interface WorkspaceMemberDto {
+    id: string;
+    workspaceId: string;
+    userId: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface PermissionDto {
+    id: string;
+    key: string;
+    resource: string;
+    action: string;
+    description: string | null;
+    serviceOwner: string;
+    dangerous: boolean;
+    createdAt: string;
+}
+export interface RoleDto {
+    id: string;
+    name: string;
+    type: RoleType;
+    category: RoleCategory;
+    organizationId: string | null;
+    isProtected: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface RoleWithPermissionsDto extends RoleDto {
+    permissions: PermissionDto[];
+}
+export interface WorkspaceMemberWithRolesDto {
+    member: WorkspaceMemberDto;
+    user: UserDto;
+    roles: RoleDto[];
+}
+export interface RoleAssignmentDto {
+    id: string;
+    userId: string;
+    roleId: string;
+    scopeType: string;
+    organizationId: string | null;
+    workspaceId: string | null;
+    status: RoleAssignmentStatus;
+    role?: RoleDto;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface InviteDto {
+    id: string;
+    email: string;
+    token: string;
+    userId: string | null;
+    scopeType: InviteScopeType;
+    organizationId: string | null;
+    workspaceId: string | null;
+    roleId: string;
+    status: InviteStatus;
+    invitedById: string;
+    invitedAt: string;
+    expiresAt: string;
+    acceptedAt: string | null;
+    rejectedAt: string | null;
+    revokedById: string | null;
+    revokedAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface AlertRuleDto {
+    id: string;
+    workspaceId: string;
+    createdById: string;
+    name: string;
+    metric: AlertRuleMetric;
+    operator: AlertRuleOperator;
+    threshold: number;
+    thresholdCurrency: Currency | null;
+    isActive: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface AlertRuleChannelDto {
+    id: string;
+    alertRuleId: string;
+    type: NotificationChannelType;
+    destination: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface AlertRuleWithChannelsDto extends AlertRuleDto {
+    channels: AlertRuleChannelDto[];
+}
+export interface ProvisionUserResponseDto {
+    user: UserWithProfileDto;
+    personalWorkspace: WorkspaceDto;
+}