@fabrika/control-contract 0.8.1 → 0.9.0-cloudflare.1

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@fabrika/control-contract",
-	"version": "0.8.1",
+	"version": "0.9.0-cloudflare.1",
 	"type": "module",
 	"repository": {
 		"type": "git",
@@ -11,12 +11,13 @@
 		"access": "public"
 	},
 	"files": [
-		"src"
+		"src",
+		"types"
 	],
 	"exports": {
 		".": {
 			"bun": "./src/index.ts",
-			"types": "./src/index.ts",
+			"types": "./types/src/index.d.ts",
 			"default": "./src/index.ts"
 		}
 	},
@@ -25,8 +26,8 @@
 	},
 	"dependencies": {
 		"zod": "^3.25.76",
-		"@fabrika/auth-core": "0.8.1",
-		"@fabrika/app": "0.8.1",
-		"@fabrika/provider-contract": "0.8.1"
+		"@fabrika/auth-core": "0.9.0-cloudflare.1",
+		"@fabrika/app": "0.9.0-cloudflare.1",
+		"@fabrika/provider-contract": "0.9.0-cloudflare.1"
 	}
 }

package/src/access.ts

@@ -45,6 +45,18 @@ export const CONTROL_ACTIONS = Object.freeze({
 	MAIL_CONTENT_READ: 'mail.content.read',
 	/** Release or drop a held message, requeue a final one, and change the gate's rules. Global. */
 	MAIL_MANAGE: 'mail.manage',
+	/**
+	 * Read an application environment's data as a metadata projection: sizes, counts, state and the backup list
+	 * (ADR-0069 §2). Scoped by app/environment.
+	 */
+	DATA_READ: 'data.read',
+	/**
+	 * Read row contents, exports, backup downloads and content fields of every tenant of an environment. Checked as a
+	 * global grant only, so a grant scoped to an app never carries it: content is for the installation's operators.
+	 */
+	DATA_CONTENT_READ: 'data.content.read',
+	/** Run maintenance transitions, backups and restores, and recover an interrupted operation. Scoped by app/environment. */
+	DATA_MANAGE: 'data.manage',
 })
 
 /**

package/src/index.ts

@@ -207,9 +207,18 @@ export interface UpdateAppRequest extends AppOptionalFields {
 	repoUrl?: string
 }
 
+/**
+ * `dev` follows the workspace bound to it through its launcher, without a run (ADR-0049); at most one per application,
+ * never protected and never production. Every other environment is `standard`.
+ */
+export const APP_ENV_KINDS = ['standard', 'dev'] as const
+
+export type AppEnvKind = (typeof APP_ENV_KINDS)[number]
+
 export interface AppEnvDto {
 	appId: string
 	env: string
+	kind: AppEnvKind
 	domain: string | null
 	publicOrigin: string | null
 	/** The exact origins whose pages may call this environment's cross-origin endpoints (ADR-0022); empty lists none. */
@@ -272,6 +281,8 @@ export interface PutAppEnvRequest {
 	triggerRef?: string | null
 	/** Omitted keeps the stored value. Only a Zerops environment of an app with a GitHub connection qualifies. */
 	authoring?: boolean
+	/** Set when the environment is created, `standard` when omitted; it never changes afterwards. */
+	kind?: AppEnvKind
 	namespaceId?: string | null
 	target: ProviderEnvelopeDto
 	artifact: ProviderEnvelopeDto
@@ -385,6 +396,16 @@ export interface RemoveDeploymentNamespaceResponse {
 	readonly removed: DeploymentNamespaceDetailDto
 }
 
+/** The namespaces whose proxy rebuild `namespaces.republishAll` submitted. */
+export interface RepublishAllNamespacesResponse {
+	readonly namespaceIds: readonly string[]
+}
+
+/** The resource keys released; each was confirmed gone at the provider in the same call. */
+export interface ReleaseNamespaceClaimsResponse {
+	readonly released: readonly string[]
+}
+
 export interface PlanDeploymentNamespaceRequest {
 	id: string
 	env: string
@@ -567,6 +588,7 @@ export type {
 	PutAppEnvironmentInput,
 	PutAppSecretInput,
 	PutAppVarInput,
+	ReleaseNamespaceClaimsInput,
 	RotateTokenKeyResponse,
 	RunIdInput,
 	RunListInput,
@@ -575,3 +597,15 @@ export type {
 	TailRunInput,
 	UpdateNamespaceInput,
 } from './rpc.js'
+export type {
+	DataOperationDto,
+	DataOperationKind,
+	DataOperationListInput,
+	DataOperationResolution,
+	DataOperationState,
+	DataOperationStep,
+	MaintenanceMode,
+	RecoverDataOperationInput,
+	StartDataOperationInput,
+} from './rpc.js'
+export { DATA_OPERATION_MAX_PAGE_SIZE, dataOperationListInputSchema, recoverDataOperationInputSchema, startDataOperationInputSchema } from './rpc.js'

package/src/mail.ts

@@ -47,6 +47,8 @@ export interface MailMessageContentDto {
 	readonly replyTo?: string
 	readonly fromName?: string
 	readonly unsubscribeUrl?: string
+	/** A message of a send to many recipients, which the provider keeps apart from transactional mail. */
+	readonly broadcast?: true
 	readonly attachments: readonly MailAttachmentDto[]
 }
 

package/src/rpc.ts

@@ -1,5 +1,6 @@
 import type { RpcProcedureContract } from '@fabrika/app'
-import type { ExportDescription } from '@fabrika/auth-core'
+import type { ExportDescription, OpsContentView, OpsView } from '@fabrika/auth-core'
+import { z } from 'zod'
 import type { BuilderConnectionReceiptDto, CreateBuilderConnectionReceiptRequest, GetBuilderConnectionReceiptRequest } from './builder-connections.js'
 import type {
 	ApproveDeviceAuthorizationResult,
@@ -36,9 +37,12 @@ import type {
 	PutAppVarRequest,
 	RegisterAppRequest,
 	RegisterAppResponse,
+	ReleaseNamespaceClaimsResponse,
 	RemoveDeploymentNamespaceResponse,
+	RepublishAllNamespacesResponse,
 	RunDto,
 	RunLogResponse,
+	RunStatus,
 	RunTailResponse,
 	SetEnvironmentProtectionRequest,
 	StartGitHubSourceConnectionRequest,
@@ -119,9 +123,17 @@ export interface UpdateNamespaceInput extends NamespaceIdInput {
 	readonly namespace: UpdateDeploymentNamespaceRequest
 }
 
+/** The app environment whose claims in the namespace are released. */
+export interface ReleaseNamespaceClaimsInput extends NamespaceIdInput {
+	readonly appId: string
+	readonly env: string
+}
+
 export interface RunListInput {
 	readonly appId?: string
 	readonly env?: string
+	/** Filter before pagination, so an old queued or running deploy is not hidden by newer finished runs. */
+	readonly statuses?: RunStatus[]
 	readonly before?: string
 	readonly limit?: number
 }
@@ -207,6 +219,16 @@ export interface ControlRpcContract {
 		update: RpcProcedure<UpdateNamespaceInput, DeploymentNamespaceDetailDto>
 		/** Free a namespace id. Refused while any app environment is registered in it (backlog 73). */
 		remove: RpcProcedure<NamespaceIdInput, RemoveDeploymentNamespaceResponse>
+		/**
+		 * Republish the proxy of every ready namespace, as after a change of the installation's client logo (ADR-0066).
+		 * Returns once each rebuild is submitted; a failure is a 502 naming the namespaces to reconcile.
+		 */
+		republishAll: RpcProcedure<void, RepublishAllNamespacesResponse>
+		/**
+		 * Release one app environment's resource claims in the namespace, only when the provider confirms every claimed
+		 * resource gone. The operator deletes the resources first; fabrika deletes none (ADR-0034).
+		 */
+		releaseClaims: RpcProcedure<ReleaseNamespaceClaimsInput, ReleaseNamespaceClaimsResponse>
 	}
 	runs: {
 		list: RpcProcedure<RunListInput, CursorList<RunDto>>
@@ -249,6 +271,21 @@ export interface ControlRpcContract {
 			remove: RpcProcedure<MailRuleIdInput, OkResponse>
 		}
 	}
+	/**
+	 * An application environment's data (ADR-0069): `data.read` and `data.manage` at the coordinates,
+	 * `data.content.read` as a global grant only; every denial is the 404 of an absent environment.
+	 */
+	data: {
+		operations: {
+			list: RpcProcedure<DataOperationListInput, CursorList<DataOperationDto>>
+			get: RpcProcedure<{ operationId: string }, DataOperationDto>
+		}
+		/** The metadata view; never content. */
+		view: RpcProcedure<AppEnvironmentInput, OpsView>
+		content: RpcProcedure<AppEnvironmentInput, OpsContentView>
+		start: RpcProcedure<StartDataOperationInput, DataOperationDto>
+		recover: RpcProcedure<RecoverDataOperationInput, DataOperationDto>
+	}
 }
 
 /**
@@ -262,3 +299,90 @@ export interface DescribeConnectorRequest {
 	readonly export: string
 	readonly version: number
 }
+
+// ── Data operations (ADR-0069) ───────────────────────────────────────────────
+
+/** What an application environment's object admits (ADR-0069 §3). */
+export type MaintenanceMode = 'open' | 'read-only' | 'closed' | 'inspect'
+
+export type DataOperationKind = 'maintenance' | 'backup' | 'migrate' | 'recovery' | 'restore'
+
+/**
+ * Where an operation stands: `reconcile` reads the record and the object's published state (a recovery's first step),
+ * `restrict` publishes a generation in a restricting mode, `backup` and `verify` take and check a consistent backup,
+ * `deploy` runs the operation's own deploy, `migrate` runs the pending migrations, `resume` continues the interrupted
+ * operation from its recorded step, and `open` publishes the generation that opens the object.
+ */
+export type DataOperationStep = 'reconcile' | 'restrict' | 'backup' | 'verify' | 'deploy' | 'migrate' | 'resume' | 'open'
+
+export type DataOperationState = 'running' | 'succeeded' | 'failed'
+
+/** What a recovery does after its closed fence: resume the interrupted operation, or open the object. */
+export type DataOperationResolution = 'resume' | 'open'
+
+/**
+ * One operation as `data.read` shows it: an allowlisted projection of Control's record, with identifiers, states,
+ * codes and timestamps only. It carries no free text and no content.
+ */
+export interface DataOperationDto {
+	readonly id: string
+	readonly appId: string
+	readonly env: string
+	readonly kind: DataOperationKind
+	readonly step: DataOperationStep
+	/** The mode the operation requires of the object at its step; a successor publishes its fresh generation in it. */
+	readonly targetMode: MaintenanceMode
+	/** The latest generation the operation reserved. */
+	readonly generation: number
+	readonly state: DataOperationState
+	/** A code once it failed, never an error message. */
+	readonly errorCode: string | null
+	/** An opaque principal id (as `runActor`), never an email or label. */
+	readonly actor: string
+	readonly createdAt: number
+	readonly updatedAt: number
+	readonly finishedAt: number | null
+	/** A recovery's interrupted operation, of the same environment; `null` for every other kind. */
+	readonly recoversOperationId: string | null
+	/** A recovery's choice after its closed fence; `null` for every other kind. */
+	readonly resolution: DataOperationResolution | null
+}
+
+export const DATA_OPERATION_MAX_PAGE_SIZE = 100
+
+const nonEmpty = z.string().min(1)
+const maintenanceMode = z.enum(['open', 'read-only', 'closed', 'inspect'])
+
+/** One environment's operations, newest first; `before` is the last id of the previous page. */
+export const dataOperationListInputSchema = z.object({
+	appId: nonEmpty,
+	env: nonEmpty,
+	before: nonEmpty.optional(),
+	limit: z.number().int().min(1).max(DATA_OPERATION_MAX_PAGE_SIZE).optional(),
+}).strict()
+
+export type DataOperationListInput = z.infer<typeof dataOperationListInputSchema>
+
+/**
+ * An operation a person starts. A migration starts inside a deploy and a recovery has its own request, so neither is
+ * started here.
+ */
+export const startDataOperationInputSchema = z.discriminatedUnion('kind', [
+	z.object({ appId: nonEmpty, env: nonEmpty, kind: z.literal('maintenance'), mode: maintenanceMode }).strict(),
+	z.object({ appId: nonEmpty, env: nonEmpty, kind: z.literal('backup') }).strict(),
+])
+
+export type StartDataOperationInput = z.infer<typeof startDataOperationInputSchema>
+
+/**
+ * Recover an environment whose operation `operationId` is stuck: fence it with a fresh generation in `closed`, then
+ * resume that operation from its recorded step, or open the object at a new generation.
+ */
+export const recoverDataOperationInputSchema = z.object({
+	appId: nonEmpty,
+	env: nonEmpty,
+	operationId: nonEmpty,
+	resolution: z.enum(['resume', 'open']),
+}).strict()
+
+export type RecoverDataOperationInput = z.infer<typeof recoverDataOperationInputSchema>

package/types/src/access.d.ts

@@ -0,0 +1,68 @@
+/** IAM vocabulary shared by the Control runtime, its Access schema and the console. */
+/** Durable IAM application id of the console — a deployed identity, not configuration branding (ADR-0024). */
+export declare const CONTROL_APP_ID = "vozka";
+/**
+ * The actions Control authorizes against. AWS-IAM-style dotted strings; IAM's `permits` matches
+ * them (incl. `*` / `prefix.*` wildcards in granted roles).
+ */
+export declare const CONTROL_ACTIONS: Readonly<{
+    /** Trigger a deploy run (the manual "Deploy" button / triggerDeploy RPC). Scoped by app/environment. */
+    DEPLOY_TRIGGER: "deploy.trigger";
+    /** Read deploy runs + their logs (run history API). Scoped by app/environment. */
+    DEPLOY_READ: "deploy.read";
+    /** Manage the app registry (apps + app_envs CRUD, onboarding). Scoped by app (global to create). */
+    APP_MANAGE: "app.manage";
+    /** Manage provider-owned deployment namespaces and their lifecycle. Global because namespaces may span apps. */
+    NAMESPACE_MANAGE: "namespace.manage";
+    /**
+     * Manage SECRET VALUES + their references. Gates the app_secrets reference CRUD (scoped by app) AND
+     * writing/rotating/deleting the encrypted per-app/app-env VALUES in the vault. The value is
+     * write-only over the API; it is never returned. (Platform creds — the CF token, IAM
+     * provisioning creds — are fabrika's own Worker secrets, not managed through this action.)
+     */
+    SECRET_MANAGE: "secret.manage";
+    /** Manage the platform GitHub source connection. Global because it changes control-wide credentials. */
+    SOURCE_CONNECTION_MANAGE: "source.connection.manage";
+    /** Read the files of one's own Git workspaces on an authoring target (ADR-0049). Scoped by app/environment. */
+    SOURCE_WORKSPACE_READ: "source.workspace.read";
+    /** Create Git workspaces and commit to them on an authoring target. Scoped by app/environment. */
+    SOURCE_WORKSPACE_WRITE: "source.workspace.write";
+    /** Open a pull request from one's own workspace to the default branch. Scoped by app/environment. */
+    SOURCE_PULL_REQUEST_CREATE: "source.pull-request.create";
+    /**
+     * Approve a widening of an environment's access and change its `protected` flag (ADR-0050). Outside `deploy.*`, so
+     * the operator role does not hold it; only a human user principal in the console may use it. Scoped by app/environment.
+     */
+    ACCESS_APPROVE: "access.approve";
+    /**
+     * List relayed mail and read its metadata. Scoped by app/environment for an application's messages; an installation
+     * sender's messages need a global grant.
+     */
+    MAIL_READ: "mail.read";
+    /** Read a relayed message's recipient, subject and bodies. Global. */
+    MAIL_CONTENT_READ: "mail.content.read";
+    /** Release or drop a held message, requeue a final one, and change the gate's rules. Global. */
+    MAIL_MANAGE: "mail.manage";
+    /**
+     * Read an application environment's data as a metadata projection: sizes, counts, state and the backup list
+     * (ADR-0069 §2). Scoped by app/environment.
+     */
+    DATA_READ: "data.read";
+    /**
+     * Read row contents, exports, backup downloads and content fields of every tenant of an environment. Checked as a
+     * global grant only, so a grant scoped to an app never carries it: content is for the installation's operators.
+     */
+    DATA_CONTENT_READ: "data.content.read";
+    /** Run maintenance transitions, backups and restores, and recover an interrupted operation. Scoped by app/environment. */
+    DATA_MANAGE: "data.manage";
+}>;
+/**
+ * The scope dimensions Control authorizes within (flat + independent IAM semantics):
+ *  - `app`         — scoped to one registered app (its `id`), across every environment.
+ *  - `environment` — scoped to one environment name (e.g. only `stage`), across apps.
+ * A grant with neither scope is global.
+ */
+export declare const CONTROL_SCOPES: Readonly<{
+    APP: "app";
+    ENVIRONMENT: "environment";
+}>;

package/types/src/builder-bootstrap.d.ts

@@ -0,0 +1,41 @@
+import { z } from 'zod';
+export declare const BUILDER_APPROVAL_STORAGE_KEY = "fabrika.builder.approval.v1";
+export declare const BUILDER_AUTHORIZE_PATH = "/builder/authorize";
+export interface BuilderApprovalState {
+    readonly attemptId: string;
+    readonly approvalVerifier: string;
+    readonly expiresAt: number;
+}
+export interface BuilderInstallationDiscoveryDto {
+    readonly version: 1;
+    readonly controlOrigin: string;
+    readonly iamIssuer: string;
+    readonly provider: string;
+}
+/** Self-contained so the public capture page can embed this exact validator without external assets. */
+export declare function parseBuilderApprovalState(value: unknown, nowSeconds?: number): BuilderApprovalState | null;
+/** Accept only a credential-free installation origin, never a redirect or a repository-selected path. */
+export declare function parseBuilderPublicOrigin(value: unknown): string | null;
+export declare function parseBuilderInstallationDiscovery(value: unknown): BuilderInstallationDiscoveryDto | null;
+export declare const builderPublicOriginSchema: z.ZodEffects<z.ZodString, string, string>;
+export declare const builderInstallationDiscoverySchema: z.ZodEffects<z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    controlOrigin: z.ZodEffects<z.ZodString, string, string>;
+    iamIssuer: z.ZodEffects<z.ZodString, string, string>;
+    provider: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    version: 1;
+    controlOrigin: string;
+    iamIssuer: string;
+    provider: string;
+}, {
+    version: 1;
+    controlOrigin: string;
+    iamIssuer: string;
+    provider: string;
+}>, {
+    version: 1;
+    controlOrigin: string;
+    iamIssuer: string;
+    provider: string;
+}, unknown>;

package/types/src/builder-connections.d.ts

@@ -0,0 +1,223 @@
+import { z } from 'zod';
+import type { AppDto } from './index.js';
+export declare const BUILDER_CONNECTION_ATTEMPT_ID: RegExp;
+export declare const BUILDER_APPROVAL_VERIFIER: RegExp;
+export declare const BUILDER_CONNECTION_IDENTIFIER: RegExp;
+export interface BuilderConnectionEnvironmentDto {
+    readonly env: string;
+    readonly namespaceId: string | null;
+    readonly domain: string | null;
+    readonly publicOrigin: string | null;
+    readonly triggerRef: string | null;
+}
+export interface BuilderConnectionReceiptDto {
+    readonly version: 1;
+    readonly attemptId: string;
+    readonly provider: string;
+    readonly app: AppDto;
+    readonly environment: BuilderConnectionEnvironmentDto;
+    readonly createdAt: number;
+}
+export interface CreateBuilderConnectionReceiptRequest {
+    readonly attemptId: string;
+    readonly approvalVerifier: string;
+    readonly appId: string;
+    readonly environment: BuilderConnectionEnvironmentDto;
+}
+export interface GetBuilderConnectionReceiptRequest {
+    readonly attemptId: string;
+}
+/** Decode the persisted/wire snapshot without accepting provider envelopes or credential fields. */
+export declare function parseBuilderConnectionReceipt(value: unknown): BuilderConnectionReceiptDto;
+export declare const builderConnectionAppSchema: z.ZodEffects<z.ZodObject<{
+    id: z.ZodString;
+    repoUrl: z.ZodString;
+    defaultBranch: z.ZodString;
+    workerDir: z.ZodNullable<z.ZodString>;
+    buildCmd: z.ZodNullable<z.ZodString>;
+    configPath: z.ZodNullable<z.ZodString>;
+    githubConnectionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    githubInstallationId: z.ZodNullable<z.ZodNumber>;
+    createdAt: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    repoUrl: string;
+    defaultBranch: string;
+    workerDir: string | null;
+    buildCmd: string | null;
+    configPath: string | null;
+    githubInstallationId: number | null;
+    createdAt: number;
+    githubConnectionId?: string | null | undefined;
+}, {
+    id: string;
+    repoUrl: string;
+    defaultBranch: string;
+    workerDir: string | null;
+    buildCmd: string | null;
+    configPath: string | null;
+    githubInstallationId: number | null;
+    createdAt: number;
+    githubConnectionId?: string | null | undefined;
+}>, {
+    githubInstallationId: number | null;
+    createdAt: number;
+    githubConnectionId?: string | null | undefined;
+    id: string;
+    repoUrl: string;
+    defaultBranch: string;
+    workerDir: string | null;
+    buildCmd: string | null;
+    configPath: string | null;
+}, {
+    id: string;
+    repoUrl: string;
+    defaultBranch: string;
+    workerDir: string | null;
+    buildCmd: string | null;
+    configPath: string | null;
+    githubInstallationId: number | null;
+    createdAt: number;
+    githubConnectionId?: string | null | undefined;
+}>;
+export declare const builderConnectionEnvironmentSchema: z.ZodObject<{
+    env: z.ZodString;
+    namespaceId: z.ZodNullable<z.ZodString>;
+    domain: z.ZodNullable<z.ZodString>;
+    publicOrigin: z.ZodNullable<z.ZodString>;
+    triggerRef: z.ZodNullable<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    env: string;
+    domain: string | null;
+    publicOrigin: string | null;
+    triggerRef: string | null;
+    namespaceId: string | null;
+}, {
+    env: string;
+    domain: string | null;
+    publicOrigin: string | null;
+    triggerRef: string | null;
+    namespaceId: string | null;
+}>;
+export declare const builderConnectionReceiptSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    attemptId: z.ZodString;
+    provider: z.ZodString;
+    app: z.ZodEffects<z.ZodObject<{
+        id: z.ZodString;
+        repoUrl: z.ZodString;
+        defaultBranch: z.ZodString;
+        workerDir: z.ZodNullable<z.ZodString>;
+        buildCmd: z.ZodNullable<z.ZodString>;
+        configPath: z.ZodNullable<z.ZodString>;
+        githubConnectionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        githubInstallationId: z.ZodNullable<z.ZodNumber>;
+        createdAt: z.ZodNumber;
+    }, "strict", z.ZodTypeAny, {
+        id: string;
+        repoUrl: string;
+        defaultBranch: string;
+        workerDir: string | null;
+        buildCmd: string | null;
+        configPath: string | null;
+        githubInstallationId: number | null;
+        createdAt: number;
+        githubConnectionId?: string | null | undefined;
+    }, {
+        id: string;
+        repoUrl: string;
+        defaultBranch: string;
+        workerDir: string | null;
+        buildCmd: string | null;
+        configPath: string | null;
+        githubInstallationId: number | null;
+        createdAt: number;
+        githubConnectionId?: string | null | undefined;
+    }>, {
+        githubInstallationId: number | null;
+        createdAt: number;
+        githubConnectionId?: string | null | undefined;
+        id: string;
+        repoUrl: string;
+        defaultBranch: string;
+        workerDir: string | null;
+        buildCmd: string | null;
+        configPath: string | null;
+    }, {
+        id: string;
+        repoUrl: string;
+        defaultBranch: string;
+        workerDir: string | null;
+        buildCmd: string | null;
+        configPath: string | null;
+        githubInstallationId: number | null;
+        createdAt: number;
+        githubConnectionId?: string | null | undefined;
+    }>;
+    environment: z.ZodObject<{
+        env: z.ZodString;
+        namespaceId: z.ZodNullable<z.ZodString>;
+        domain: z.ZodNullable<z.ZodString>;
+        publicOrigin: z.ZodNullable<z.ZodString>;
+        triggerRef: z.ZodNullable<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        env: string;
+        domain: string | null;
+        publicOrigin: string | null;
+        triggerRef: string | null;
+        namespaceId: string | null;
+    }, {
+        env: string;
+        domain: string | null;
+        publicOrigin: string | null;
+        triggerRef: string | null;
+        namespaceId: string | null;
+    }>;
+    createdAt: z.ZodNumber;
+}, "strict", z.ZodTypeAny, {
+    app: {
+        githubInstallationId: number | null;
+        createdAt: number;
+        githubConnectionId?: string | null | undefined;
+        id: string;
+        repoUrl: string;
+        defaultBranch: string;
+        workerDir: string | null;
+        buildCmd: string | null;
+        configPath: string | null;
+    };
+    environment: {
+        env: string;
+        domain: string | null;
+        publicOrigin: string | null;
+        triggerRef: string | null;
+        namespaceId: string | null;
+    };
+    attemptId: string;
+    version: 1;
+    provider: string;
+    createdAt: number;
+}, {
+    app: {
+        id: string;
+        repoUrl: string;
+        defaultBranch: string;
+        workerDir: string | null;
+        buildCmd: string | null;
+        configPath: string | null;
+        githubInstallationId: number | null;
+        createdAt: number;
+        githubConnectionId?: string | null | undefined;
+    };
+    environment: {
+        env: string;
+        domain: string | null;
+        publicOrigin: string | null;
+        triggerRef: string | null;
+        namespaceId: string | null;
+    };
+    attemptId: string;
+    version: 1;
+    provider: string;
+    createdAt: number;
+}>;

package/types/src/builder-pairing.d.ts

@@ -0,0 +1,12 @@
+export type { ApproveDeviceAuthorizationResult, DenyDeviceAuthorizationResult, DeviceAuthorizationFailure, DeviceAuthorizationReceipt, DeviceAuthorizationRequest, InspectDeviceAuthorizationResult, ListOwnDeviceAuthorizationsResult, RevokeKeyResult, } from '@fabrika/auth-core';
+export interface BuilderPairingProofRequest {
+    readonly attemptId: string;
+    readonly approvalVerifier: string;
+}
+export interface ListOwnBuilderPairingsRequest {
+    readonly before?: string;
+    readonly limit?: number;
+}
+export interface RevokeBuilderPairingRequest {
+    readonly credentialId: string;
+}