@farthershore/cli 0.3.8 → 0.3.10

package/node_modules/@farther-shore/shared-types/dist/index.js

@@ -0,0 +1,24 @@
+export * from "./enums.js";
+export * from "./metering.js";
+export * from "./limits.js";
+export * from "./entitlements.js";
+export * from "./billing.js";
+export * from "./base.js";
+export * from "./projections.js";
+export * from "./api.js";
+export * from "./format.js";
+export * from "./web-ui.js";
+export * from "./builder-context.js";
+export * from "./portal.js";
+export * from "./admin.js";
+export * from "./consumer.js";
+export * from "./edge-kv-keys.js";
+export * from "./pricing-model.js";
+export * from "./scope-matcher.js";
+export * from "./service-auth.js";
+export * from "./analytics.js";
+export * from "./dlq.js";
+export * from "./auth/permissions.js";
+export * from "./webhooks/events.js";
+export * from "./webhooks/migration.js";
+//# sourceMappingURL=index.js.map

package/node_modules/@farther-shore/shared-types/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC;AACjC,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,UAAU,CAAC;AACzB,cAAc,uBAAuB,CAAC;AACtC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/limits.d.ts

@@ -0,0 +1,24 @@
+export type LimitDimension = string;
+export type NamedWindow = {
+    type: "named";
+    name: "second" | "minute" | "hour" | "day" | "week" | "month";
+};
+export type CustomWindow = {
+    type: "custom";
+    seconds: number;
+    label?: string;
+};
+export type LimitWindowSpec = NamedWindow | CustomWindow;
+export type PlanLimitRule = {
+    dimension: LimitDimension;
+    window: LimitWindowSpec;
+    capacity: number;
+    enforcement?: "enforce" | "track";
+};
+export type NamedPlanLimitRule = {
+    dimension: LimitDimension;
+    window: NamedWindow;
+    capacity: number;
+    enforcement?: "enforce" | "track";
+};
+//# sourceMappingURL=limits.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC;AAEpC,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,CAAC;CAC/D,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,QAAQ,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,YAAY,CAAC;AAEzD,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,eAAe,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAE,cAAc,CAAC;IAC1B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;CACnC,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/limits.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// Plan limit rules — rate limiting and quota configuration
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=limits.js.map

package/node_modules/@farther-shore/shared-types/dist/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../src/limits.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E"}

package/node_modules/@farther-shore/shared-types/dist/logger.d.ts

@@ -0,0 +1,67 @@
+import { type Logger } from "pino";
+export type CreateLoggerOptions = {
+    /**
+     * Short, stable identifier for the service — appears in every log line
+     * as `service`. Pick once per repo ("farthershore-core", "fs-admin", etc.).
+     */
+    service: string;
+    /**
+     * Extra static fields merged into pino's `base`. Useful for env, region,
+     * commit SHA — anything you'd want on every log entry.
+     */
+    base?: Record<string, unknown>;
+};
+/**
+ * Run `fn` inside a log-context scope. Every `logger.*` call that fires
+ * inside `fn` (including nested async work) automatically includes the
+ * fields in `context`.
+ *
+ * Composes with outer scopes: fields from the outer scope are preserved;
+ * fields in the new scope override on collision.
+ *
+ * @example
+ *   // Express middleware
+ *   runWithLogContext({ requestId }, () => next());
+ */
+export declare function runWithLogContext<T>(context: Record<string, unknown>, fn: () => T): T;
+/**
+ * Merge additional fields into the current log-context scope. No-op when
+ * called outside a `runWithLogContext` scope (nothing to mutate).
+ *
+ * Use this when context becomes available partway through a request —
+ * e.g. `userId` after auth resolves, `organizationId` after routing.
+ */
+export declare function addLogContext(partial: Record<string, unknown>): void;
+/**
+ * Read the current log-context scope (for manual inspection, rarely
+ * needed). Returns `{}` when called outside any scope.
+ */
+export declare function getLogContext(): Record<string, unknown>;
+/**
+ * Paths always redacted from every log record produced by `createLogger`.
+ * Pino replaces matched values with `"[REDACTED]"`.
+ *
+ * The set covers:
+ *   - HTTP auth headers (Authorization, Cookie, Set-Cookie) at top level
+ *     and under common wrappers (`headers.*`, `req.headers.*`, any `*.x`).
+ *   - Credentials + tokens that callsites might log accidentally
+ *     (password, token, apiKey, secret, stripe_secret_key, etc.).
+ *
+ * Pino's path syntax uses dots and supports `*` as a SINGLE-level wildcard.
+ * Multi-level wildcards aren't supported — so `a.*.x` matches `a.foo.x` but
+ * NOT `a.foo.bar.x`. Add deeper paths via the `LOG_REDACT` env var when you
+ * discover a real leak.
+ */
+export declare const DEFAULT_REDACT_PATHS: readonly string[];
+/**
+ * Build a pino logger honoring `LOG_LEVEL`, `LOG_FORMAT`, and the
+ * AsyncLocalStorage-backed log context.
+ *
+ * @example
+ *   // core/src/services/logger.ts
+ *   import { createLogger } from "@farther-shore/shared-types/logger";
+ *   export const logger = createLogger({ service: "farthershore-core" });
+ */
+export declare function createLogger(opts: CreateLoggerOptions): Logger;
+export type { Logger } from "pino";
+//# sourceMappingURL=logger.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAiEA,OAAa,EAAE,KAAK,MAAM,EAAsB,MAAM,MAAM,CAAC;AAE7D,MAAM,MAAM,mBAAmB,GAAG;IAChC;;;OAGG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC,CAAC;AA2BF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EACjC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,EAAE,EAAE,MAAM,CAAC,GACV,CAAC,CAGH;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAIpE;AAED;;;GAGG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvD;AAMD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EA6CjD,CAAC;AAoBF;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,MAAM,CA2C9D;AAED,YAAY,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/logger.js

@@ -0,0 +1,252 @@
+// ---------------------------------------------------------------------------
+// Shared logger factory
+//
+// Single source of truth for how Farther Shore Node services construct their
+// pino logger. Every Node service should call `createLogger({ service })`
+// once at boot and reuse the returned instance. That keeps `LOG_LEVEL` /
+// `LOG_FORMAT` behavior identical across services and removes a small but
+// real drift surface.
+//
+// NOT for Cloudflare Workers — Workers have their own logging primitives
+// (console.log → `wrangler tail`). Don't import this into a Worker bundle;
+// pino pulls node-specific APIs.
+//
+// Environment variables honored
+// ---------------------------------------------------------------------------
+//   LOG_LEVEL   pino level — one of trace|debug|info|warn|error|fatal|silent.
+//               Default: "info". Set per-service on Railway/etc. as desired.
+//
+//   LOG_FORMAT  "pretty" → human-readable via pino-pretty (colorized, nice
+//               timestamps) when pino-pretty is resolvable in the consumer's
+//               node_modules; falls through to JSON otherwise. Anything else
+//               (or unset) → JSON (pino default). JSON is always correct in
+//               prod; "pretty" is a dev ergonomic.
+//
+// Per-request log context (AsyncLocalStorage)
+// ---------------------------------------------------------------------------
+//   `createLogger` wires pino's `mixin` hook to an AsyncLocalStorage store,
+//   so any fields placed in the store are automatically merged into every
+//   `logger.*(...)` call that fires inside a `runWithLogContext(...)` scope.
+//
+//   Typical wiring — open a scope on every inbound request:
+//
+//     // request-id middleware
+//     runWithLogContext({ requestId }, () => next());
+//
+//   Later, enrich the scope with values resolved during the request:
+//
+//     // inside a route handler, after auth
+//     addLogContext({ userId, organizationId });
+//
+//   From that point on, every `logger.info(...)` / `logger.error(...)` in
+//   that request's async tree includes requestId, userId, organizationId —
+//   no callsite change needed.
+//
+//   Outside a `runWithLogContext` scope, the mixin returns `{}` and logs
+//   look identical to un-contextualized output. Safe to call anywhere.
+//
+// Redaction (secrets / PII)
+// ---------------------------------------------------------------------------
+//   A baseline set of secret-shaped fields is redacted on every log record
+//   — see `DEFAULT_REDACT_PATHS` below. Matched values are replaced with
+//   `"[REDACTED]"` so downstream tools still see consistent log shapes.
+//
+//   LOG_REDACT  comma-separated list of ADDITIONAL paths to redact, on top
+//               of the defaults. Defaults always apply — there's no way to
+//               disable them. Path syntax is pino's: dot-separated with
+//               `*` as a single-level wildcard.
+//
+//   Examples:
+//     LOG_REDACT=githubToken,stripeWebhookSecret
+//     LOG_REDACT=req.body.ssn,req.body.card.*
+// ---------------------------------------------------------------------------
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createRequire } from "node:module";
+import pino from "pino";
+const requireFn = createRequire(import.meta.url);
+/**
+ * Returns the resolved path to pino-pretty if it's installed, or null.
+ * Synchronous so `createLogger` itself can stay synchronous.
+ */
+function resolvePinoPretty() {
+    try {
+        return requireFn.resolve("pino-pretty");
+    }
+    catch {
+        return null;
+    }
+}
+// ---------------------------------------------------------------------------
+// Per-request context store
+// ---------------------------------------------------------------------------
+/**
+ * Process-wide store that every logger built by `createLogger` reads from
+ * on each log call. One instance — shared across services in the same
+ * process — so nested contexts compose cleanly.
+ */
+const logContextStore = new AsyncLocalStorage();
+/**
+ * Run `fn` inside a log-context scope. Every `logger.*` call that fires
+ * inside `fn` (including nested async work) automatically includes the
+ * fields in `context`.
+ *
+ * Composes with outer scopes: fields from the outer scope are preserved;
+ * fields in the new scope override on collision.
+ *
+ * @example
+ *   // Express middleware
+ *   runWithLogContext({ requestId }, () => next());
+ */
+export function runWithLogContext(context, fn) {
+    const outer = logContextStore.getStore() ?? {};
+    return logContextStore.run({ ...outer, ...context }, fn);
+}
+/**
+ * Merge additional fields into the current log-context scope. No-op when
+ * called outside a `runWithLogContext` scope (nothing to mutate).
+ *
+ * Use this when context becomes available partway through a request —
+ * e.g. `userId` after auth resolves, `organizationId` after routing.
+ */
+export function addLogContext(partial) {
+    const store = logContextStore.getStore();
+    if (!store)
+        return;
+    Object.assign(store, partial);
+}
+/**
+ * Read the current log-context scope (for manual inspection, rarely
+ * needed). Returns `{}` when called outside any scope.
+ */
+export function getLogContext() {
+    return logContextStore.getStore() ?? {};
+}
+// ---------------------------------------------------------------------------
+// Redaction
+// ---------------------------------------------------------------------------
+/**
+ * Paths always redacted from every log record produced by `createLogger`.
+ * Pino replaces matched values with `"[REDACTED]"`.
+ *
+ * The set covers:
+ *   - HTTP auth headers (Authorization, Cookie, Set-Cookie) at top level
+ *     and under common wrappers (`headers.*`, `req.headers.*`, any `*.x`).
+ *   - Credentials + tokens that callsites might log accidentally
+ *     (password, token, apiKey, secret, stripe_secret_key, etc.).
+ *
+ * Pino's path syntax uses dots and supports `*` as a SINGLE-level wildcard.
+ * Multi-level wildcards aren't supported — so `a.*.x` matches `a.foo.x` but
+ * NOT `a.foo.bar.x`. Add deeper paths via the `LOG_REDACT` env var when you
+ * discover a real leak.
+ */
+export const DEFAULT_REDACT_PATHS = [
+    // Flat — logger.info({ authorization: "..." })
+    "authorization",
+    "cookie",
+    "set-cookie",
+    "password",
+    "newPassword",
+    "currentPassword",
+    "token",
+    "refreshToken",
+    "accessToken",
+    "sessionToken",
+    "apiKey",
+    "api_key",
+    "secret",
+    "clientSecret",
+    "client_secret",
+    "webhookSecret",
+    "webhook_secret",
+    "privateKey",
+    "private_key",
+    "stripeSecretKey",
+    "stripe_secret_key",
+    "githubToken",
+    "github_token",
+    // One level of nesting — logger.info({ headers: { authorization: ... } })
+    // or logger.info({ req: { authorization: ... } }) etc.
+    "*.authorization",
+    "*.cookie",
+    "*.set-cookie",
+    "*.password",
+    "*.token",
+    "*.apiKey",
+    "*.api_key",
+    "*.secret",
+    // Common pino-http-style shapes we might log explicitly
+    "headers.authorization",
+    "headers.cookie",
+    "headers.set-cookie",
+    "req.headers.authorization",
+    "req.headers.cookie",
+    "req.headers.set-cookie",
+    "res.headers['set-cookie']",
+];
+/**
+ * Resolve the full redact path list by merging defaults with the optional
+ * `LOG_REDACT` env var (comma-separated, whitespace ignored). Defaults are
+ * non-removable by design — the env var can only extend.
+ */
+function resolveRedactPaths() {
+    const extra = (process.env.LOG_REDACT ?? "")
+        .split(",")
+        .map((p) => p.trim())
+        .filter(Boolean);
+    // Preserve order: defaults first, then additions; dedupe.
+    return Array.from(new Set([...DEFAULT_REDACT_PATHS, ...extra]));
+}
+// ---------------------------------------------------------------------------
+// Factory
+// ---------------------------------------------------------------------------
+/**
+ * Build a pino logger honoring `LOG_LEVEL`, `LOG_FORMAT`, and the
+ * AsyncLocalStorage-backed log context.
+ *
+ * @example
+ *   // core/src/services/logger.ts
+ *   import { createLogger } from "@farther-shore/shared-types/logger";
+ *   export const logger = createLogger({ service: "farthershore-core" });
+ */
+export function createLogger(opts) {
+    const level = process.env.LOG_LEVEL ?? "info";
+    const wantsPretty = process.env.LOG_FORMAT === "pretty";
+    const config = {
+        level,
+        // Explicit `service` wins over anything the caller puts in `base`.
+        // The service name is the primary identity of the logger and should be
+        // set once per repo — accidental shadowing via `base: { service: ... }`
+        // is a footgun, not a feature.
+        base: { ...opts.base, service: opts.service },
+        // Every log call pulls the current AsyncLocalStorage store and merges
+        // it into the record. Empty outside a `runWithLogContext` scope.
+        //
+        // IMPORTANT: return a shallow copy. Pino merges the per-call bindings
+        // object into the value returned from mixin() — returning the store
+        // by reference would let pino mutate the store with fields from each
+        // log call, poisoning every subsequent log in the same scope.
+        mixin() {
+            const store = logContextStore.getStore();
+            return store ? { ...store } : {};
+        },
+        // Paths listed here are replaced with `"[REDACTED]"` on every log
+        // record pino emits. Defaults + operator extensions via LOG_REDACT.
+        redact: {
+            paths: resolveRedactPaths(),
+            censor: "[REDACTED]",
+        },
+    };
+    if (wantsPretty && resolvePinoPretty()) {
+        // Only wire the transport when pino-pretty is actually available in
+        // the consumer's module tree. Worker threads that pino spins up for
+        // transports need pino-pretty resolvable from the same tree — the
+        // check above uses this file's require, but node's resolution rules
+        // apply uniformly when consumers install pino-pretty as a devDep.
+        config.transport = {
+            target: "pino-pretty",
+            options: { colorize: true, translateTime: "HH:MM:ss.l" },
+        };
+    }
+    return pino(config);
+}
+//# sourceMappingURL=logger.js.map

package/node_modules/@farther-shore/shared-types/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,wBAAwB;AACxB,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,sBAAsB;AACtB,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,iCAAiC;AACjC,EAAE;AACF,gCAAgC;AAChC,8EAA8E;AAC9E,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,mDAAmD;AACnD,EAAE;AACF,8CAA8C;AAC9C,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,6EAA6E;AAC7E,EAAE;AACF,4DAA4D;AAC5D,EAAE;AACF,+BAA+B;AAC/B,sDAAsD;AACtD,EAAE;AACF,qEAAqE;AACrE,EAAE;AACF,4CAA4C;AAC5C,iDAAiD;AACjD,EAAE;AACF,0EAA0E;AAC1E,2EAA2E;AAC3E,+BAA+B;AAC/B,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,EAAE;AACF,4BAA4B;AAC5B,8EAA8E;AAC9E,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,wEAAwE;AACxE,gDAAgD;AAChD,EAAE;AACF,cAAc;AACd,iDAAiD;AACjD,8CAA8C;AAC9C,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,IAAyC,MAAM,MAAM,CAAC;AAe7D,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAEjD;;;GAGG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,eAAe,GAAG,IAAI,iBAAiB,EAA2B,CAAC;AAEzE;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAgC,EAChC,EAAW;IAEX,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/C,OAAO,eAAe,CAAC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,OAAgC;IAC5D,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,CAAC;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,+CAA+C;IAC/C,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,aAAa;IACb,iBAAiB;IACjB,OAAO;IACP,cAAc;IACd,aAAa;IACb,cAAc;IACd,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,mBAAmB;IACnB,aAAa;IACb,cAAc;IAEd,0EAA0E;IAC1E,uDAAuD;IACvD,iBAAiB;IACjB,UAAU;IACV,cAAc;IACd,YAAY;IACZ,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IAEV,wDAAwD;IACxD,uBAAuB;IACvB,gBAAgB;IAChB,oBAAoB;IACpB,2BAA2B;IAC3B,oBAAoB;IACpB,wBAAwB;IACxB,2BAA2B;CAC5B,CAAC;AAEF;;;;GAIG;AACH,SAAS,kBAAkB;IACzB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;SACzC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,0DAA0D;IAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAyB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC;IAExD,MAAM,MAAM,GAAkB;QAC5B,KAAK;QACL,mEAAmE;QACnE,uEAAuE;QACvE,wEAAwE;QACxE,+BAA+B;QAC/B,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;QAC7C,sEAAsE;QACtE,iEAAiE;QACjE,EAAE;QACF,sEAAsE;QACtE,oEAAoE;QACpE,qEAAqE;QACrE,8DAA8D;QAC9D,KAAK;YACH,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,EAAE,CAAC;YACzC,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,CAAC;QACD,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,EAAE;YACN,KAAK,EAAE,kBAAkB,EAAE;YAC3B,MAAM,EAAE,YAAY;SACrB;KACF,CAAC;IAEF,IAAI,WAAW,IAAI,iBAAiB,EAAE,EAAE,CAAC;QACvC,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,CAAC,SAAS,GAAG;YACjB,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE;SACzD,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/metering.d.ts

@@ -0,0 +1,18 @@
+export type MeterDefinition = {
+    key: string;
+    display: string;
+    type: "built-in" | "custom";
+    unit?: string;
+};
+export type PricingTier = {
+    upToAmount: number | null;
+    unitPrice: number;
+    flatPrice?: number;
+};
+export type PricingMode = "graduated" | "volume";
+export type MeteredDimension = {
+    dimension: string;
+    includedUnits: number;
+    overagePerUnitMicrocents: number;
+};
+//# sourceMappingURL=metering.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/metering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metering.d.ts","sourceRoot":"","sources":["../src/metering.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,UAAU,GAAG,QAAQ,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,QAAQ,CAAC;AAEjD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,wBAAwB,EAAE,MAAM,CAAC;CAClC,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/metering.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// Metering and pricing types
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=metering.js.map

package/node_modules/@farther-shore/shared-types/dist/metering.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metering.js","sourceRoot":"","sources":["../src/metering.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E"}

package/node_modules/@farther-shore/shared-types/dist/plans/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./limits-schema.js";
+export * from "./spec.js";
+export * from "./projections.js";
+//# sourceMappingURL=index.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/plans/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/plans/index.ts"],"names":[],"mappings":"AAeA,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/plans/index.js

@@ -0,0 +1,18 @@
+// ---------------------------------------------------------------------------
+// @farther-shore/shared-types/plans — Plan entity contract
+//
+// Single source of truth for the Plan input shape (`planSpecSchema`) and its
+// derived projections (`BuilderPlan`, `PortalPlanProjection`). Imported by:
+//
+//   - core (route validators, product-compiler, plan-service)
+//   - web-ui (plan form via react-hook-form + zodResolver)
+//   - dev-portal (read projection)
+//   - farthershore CLI (validate command)
+//
+// Drift between any of those surfaces becomes a TypeScript / Zod compile
+// error rather than a silent runtime bug.
+// ---------------------------------------------------------------------------
+export * from "./limits-schema.js";
+export * from "./spec.js";
+export * from "./projections.js";
+//# sourceMappingURL=index.js.map

package/node_modules/@farther-shore/shared-types/dist/plans/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/plans/index.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,2DAA2D;AAC3D,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,8DAA8D;AAC9D,2DAA2D;AAC3D,mCAAmC;AACnC,0CAA0C;AAC1C,EAAE;AACF,yEAAyE;AACzE,0CAA0C;AAC1C,8EAA8E;AAE9E,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC;AAC1B,cAAc,kBAAkB,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/plans/limits-schema.d.ts

@@ -0,0 +1,80 @@
+import { z } from "zod";
+export declare const limitDimensionSchema: z.ZodString;
+export declare const namedWindowSchema: z.ZodObject<{
+    type: z.ZodLiteral<"named">;
+    name: z.ZodEnum<{
+        second: "second";
+        minute: "minute";
+        hour: "hour";
+        day: "day";
+        week: "week";
+        month: "month";
+    }>;
+}, z.core.$strip>;
+export declare const customWindowSchema: z.ZodObject<{
+    type: z.ZodLiteral<"custom">;
+    seconds: z.ZodNumber;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const limitWindowSpecSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"named">;
+    name: z.ZodEnum<{
+        second: "second";
+        minute: "minute";
+        hour: "hour";
+        day: "day";
+        week: "week";
+        month: "month";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    type: z.ZodLiteral<"custom">;
+    seconds: z.ZodNumber;
+    label: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>], "type">;
+export declare const planLimitRuleSchema: z.ZodObject<{
+    dimension: z.ZodString;
+    window: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"named">;
+        name: z.ZodEnum<{
+            second: "second";
+            minute: "minute";
+            hour: "hour";
+            day: "day";
+            week: "week";
+            month: "month";
+        }>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"custom">;
+        seconds: z.ZodNumber;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "type">;
+    capacity: z.ZodNumber;
+    enforcement: z.ZodOptional<z.ZodEnum<{
+        enforce: "enforce";
+        track: "track";
+    }>>;
+}, z.core.$strip>;
+export declare const planLimitsSchema: z.ZodArray<z.ZodObject<{
+    dimension: z.ZodString;
+    window: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"named">;
+        name: z.ZodEnum<{
+            second: "second";
+            minute: "minute";
+            hour: "hour";
+            day: "day";
+            week: "week";
+            month: "month";
+        }>;
+    }, z.core.$strip>, z.ZodObject<{
+        type: z.ZodLiteral<"custom">;
+        seconds: z.ZodNumber;
+        label: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>], "type">;
+    capacity: z.ZodNumber;
+    enforcement: z.ZodOptional<z.ZodEnum<{
+        enforce: "enforce";
+        track: "track";
+    }>>;
+}, z.core.$strip>>;
+//# sourceMappingURL=limits-schema.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/plans/limits-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits-schema.d.ts","sourceRoot":"","sources":["../../src/plans/limits-schema.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,oBAAoB,aAAoB,CAAC;AAMtD,eAAO,MAAM,iBAAiB;;;;;;;;;;iBAG5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;;iBAI7B,CAAC;AAEH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;2BAGhC,CAAC;AAMH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;iBAK9B,CAAC;AAMH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;kBAAuC,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/plans/limits-schema.js

@@ -0,0 +1,50 @@
+// ---------------------------------------------------------------------------
+// Plan-limit Zod schemas — the runtime validators for the rate-limit / quota
+// rules carried inside `PlanSpec.limits[]`.
+//
+// Plain TypeScript shapes for these (PlanLimitRule, NamedWindow, etc.) have
+// lived in `../limits.ts` since the package's first release. They are
+// structurally identical to `z.infer<typeof planLimitRuleSchema>`, so this
+// file deliberately exports schemas only — keeping the existing types as the
+// single naming source and avoiding a duplicate-export collision through
+// `index.ts`.
+//
+// Source: copied verbatim from `core/src/validation/plan-limits.ts` so the
+// YAML compiler, route validators, UI form, and CLI all parse against the
+// same rules.
+// ---------------------------------------------------------------------------
+import { z } from "zod";
+// ---------------------------------------------------------------------------
+// Dimension — the resource being metered / limited
+// ---------------------------------------------------------------------------
+export const limitDimensionSchema = z.string().min(1);
+// ---------------------------------------------------------------------------
+// Window — either a well-known named period or a custom duration in seconds
+// ---------------------------------------------------------------------------
+export const namedWindowSchema = z.object({
+    type: z.literal("named"),
+    name: z.enum(["second", "minute", "hour", "day", "week", "month"]),
+});
+export const customWindowSchema = z.object({
+    type: z.literal("custom"),
+    seconds: z.number().int().positive(),
+    label: z.string().optional(),
+});
+export const limitWindowSpecSchema = z.discriminatedUnion("type", [
+    namedWindowSchema,
+    customWindowSchema,
+]);
+// ---------------------------------------------------------------------------
+// Rule — a single limit entry (dimension + window + capacity)
+// ---------------------------------------------------------------------------
+export const planLimitRuleSchema = z.object({
+    dimension: limitDimensionSchema,
+    window: limitWindowSpecSchema,
+    capacity: z.number().nonnegative(),
+    enforcement: z.enum(["enforce", "track"]).optional(),
+});
+// ---------------------------------------------------------------------------
+// Array of rules — the shape stored in Plan.limits
+// ---------------------------------------------------------------------------
+export const planLimitsSchema = z.array(planLimitRuleSchema).max(20);
+//# sourceMappingURL=limits-schema.js.map

package/node_modules/@farther-shore/shared-types/dist/plans/limits-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits-schema.js","sourceRoot":"","sources":["../../src/plans/limits-schema.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,6EAA6E;AAC7E,4CAA4C;AAC5C,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,2EAA2E;AAC3E,6EAA6E;AAC7E,yEAAyE;AACzE,cAAc;AACd,EAAE;AACF,2EAA2E;AAC3E,0EAA0E;AAC1E,cAAc;AACd,8EAA8E;AAE9E,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtD,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;CACnE,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAChE,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH,8EAA8E;AAC9E,8DAA8D;AAC9D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,SAAS,EAAE,oBAAoB;IAC/B,MAAM,EAAE,qBAAqB;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE;IAClC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE;CACrD,CAAC,CAAC;AAEH,8EAA8E;AAC9E,mDAAmD;AACnD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/plans/projections.d.ts

@@ -0,0 +1,42 @@
+import type { PlanType } from "../enums.js";
+import type { PlanSpec } from "./spec.js";
+/**
+ * Web-UI builder dashboard projection. Extends `PlanSpec` with server-owned
+ * fields so the form can render existing plans and the API can serialize
+ * row state back to the UI.
+ *
+ * Replaces the deprecated `Plan` from `../web-ui.ts` and `BuilderPlan` from
+ * `../projections.ts`. Both retain `@deprecated` JSDoc until shared-types
+ * 0.16.0 removes them.
+ */
+export type BuilderPlan = PlanSpec & {
+    /** Logical Plan.id — paired with PlanSpec.key. NOT CompiledPlan.id. */
+    id: string;
+    productId: string;
+    /** null on production envs (the root product); set on env-scoped plans. */
+    environmentId: string | null;
+    /** Mirrors `Plan.status === "ACTIVE"` for backward compat with UI checks. */
+    isActive: boolean;
+    createdAt: string;
+};
+/**
+ * Dev-portal read projection. A consumer doesn't need server-only knobs
+ * (e.g. `archive`, `selfServeEnabled`, `overageBehavior`); we expose only
+ * the fields they actually render. Adds a flattened `monthlyPriceCents` and
+ * legacy `type` for backwards compatibility with v0.14.x portals.
+ *
+ * The `id` here is the immutable `CompiledPlan.id` (the runtime pointer the
+ * gateway authenticates against), NOT the logical `Plan.id` used in
+ * BuilderPlan. Never compare them directly.
+ */
+export type PortalPlanProjection = Pick<PlanSpec, "key" | "name" | "description" | "details" | "limits" | "meteredDimensions" | "featureGates"> & {
+    /** Immutable CompiledPlan.id — the runtime pointer for entitlement KV. */
+    compiledPlanId: string;
+    /** Flattened from PlanSpec.pricing for portal display. */
+    monthlyPriceCents: number;
+    /** Legacy enum mirror of pricing.model — kept for backward compatibility. */
+    type: PlanType;
+    /** Flattened from PlanSpec.pricing.trialDays. */
+    trialDays: number | null;
+};
+//# sourceMappingURL=projections.d.ts.map