@farthershore/cli 0.3.9 → 0.3.10

package/node_modules/@farther-shore/shared-types/README.md

@@ -0,0 +1,63 @@
+# @farther-shore/shared-types
+
+Cross-repo TypeScript DTOs and Zod schemas. Published to GitHub
+Packages as `@farther-shore/shared-types`. Consumed by every other
+repo that needs to talk to `core`.
+
+For the rationale (drift becomes a TypeScript compile error, not a
+runtime bug), see [`/docs/conventions.md §11`](../docs/conventions.md#11-schema-first-via-shared-types).
+
+For agent-specific repo guidance, see [`AGENTS.md`](AGENTS.md).
+
+## Subpath layout
+
+| Subpath | Consumers | Contents |
+|---|---|---|
+| `@farther-shore/shared-types` | core (root) | shared primitives, `MeterDefinition`, `NamedWindow` |
+| `@farther-shore/shared-types/edge-kv-keys` | core publisher + gateway reader | KV key builders, payload shapes, `wrapEnvelope` / `readEnvelope`, `KV_KEY_SCHEMA_VERSION` |
+| `@farther-shore/shared-types/plans` | web-ui form, core compiler, CLI validate | `ProductSpec`, `PlanSpec`, `BuilderPlan`, the canonical Zod schemas |
+| `@farther-shore/shared-types/portal` | dev-portal | `PortalSubscriberContext`, `PortalPlan`, `PortalUsageResponse`, `PortalApiKey` |
+| `@farther-shore/shared-types/consumer` | web-ui My Subscriptions | `SubscriptionDto`, `SubscriptionsResponse` |
+| `@farther-shore/shared-types/builder-context` | web-ui builder bootstrap | `BuilderContext`, `BuilderMembership`, `PlatformPlan` |
+| `@farther-shore/shared-types/admin` | fs-admin | `PlanTemplate`, `PortalResolveResponse`, `DocsSection` |
+| `@farther-shore/shared-types/web-ui` | web-ui | `BuilderOrganization`, `Product`, `StripeStatus`, `PromoCode`, `CreateProductInput` |
+| `@farther-shore/shared-types/api` | all | `PaginatedResponse`, error response shapes |
+
+## Local dev / tests
+
+```bash
+npm install
+npm run build      # tsc → dist/
+npm test           # vitest type tests
+npm run lint
+```
+
+## Publish workflow
+
+1. Bump `version` in `package.json` (semver).
+2. Commit + push.
+3. `git tag v<x.y.z> && git push origin v<x.y.z>` — the tag triggers
+   the GitHub Actions publish workflow which pushes to GitHub
+   Packages.
+4. Bump the version in each consumer repo's `package.json` +
+   `npm install`. The version-tag is the canonical signal; pushing
+   to `main` alone does NOT publish.
+
+## Cross-repo dependencies
+
+- No imports from other internal packages.
+- Type-only — never imports runtime libraries (`zod` is a runtime
+  dep but only used for schema definitions).
+- Consumed by: `core`, `gateway`, `web-ui`, `dev-portal`, `fs-admin`,
+  `farthershore` (CLI), `sdk`, `fs-usage-consumer`, `fs-dlq-consumer`.
+
+## Adding a new type
+
+1. Add the type to the appropriate subpath module.
+2. If a new subpath is needed, add it to `package.json`'s `exports`
+   map (mirror the existing pattern).
+3. Bump version, tag, push tag.
+4. Bump consumers opportunistically.
+
+See [`/docs/conventions.md §11`](../docs/conventions.md#11-schema-first-via-shared-types)
+for the full pattern + common pitfalls.

package/node_modules/@farther-shore/shared-types/dist/admin.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Plan template — the editable scaffold an admin starts a Plan from.
+ *
+ * Returned by:
+ *   GET  /internal/admin/plan-templates           → { data: PlanTemplate[] }
+ *   GET  /internal/admin/plan-templates/:id       → PlanTemplate
+ *
+ * `_count.plans` is a relation aggregate (hydrated when the API joins the
+ * plans table). Other endpoints may omit it.
+ */
+export type PlanTemplate = {
+    id: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    sortOrder: number;
+    published: boolean;
+    defaultConfig: Record<string, unknown>;
+    exposedFields: string[];
+    createdAt: string;
+    updatedAt: string;
+    _count?: {
+        plans: number;
+    };
+};
+//# sourceMappingURL=admin.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AASA;;;;;;;;;GASG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/admin.js

@@ -0,0 +1,10 @@
+// ---------------------------------------------------------------------------
+// Admin types — internal-admin (fs-admin) DTOs served by core's
+// /internal/admin/* endpoints.
+//
+// Keep this surface narrow: only types that genuinely cross the
+// fs-admin ⇄ core boundary belong here. Internal helpers / view-model
+// shapes belong in the consuming repo.
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=admin.js.map

package/node_modules/@farther-shore/shared-types/dist/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gEAAgE;AAChE,+BAA+B;AAC/B,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,uCAAuC;AACvC,8EAA8E"}

package/node_modules/@farther-shore/shared-types/dist/analytics.d.ts

@@ -0,0 +1,229 @@
+/**
+ * analytics.ts — canonical types for the analytics domain.
+ *
+ * Lives in shared-types so core (writer), gateway (publisher),
+ * fs-usage-consumer (queue worker), and any future BI/dashboard surface
+ * all agree on one wire shape. The previous home was
+ * `core/src/services/gateway-usage-ingestion.ts`, which made cross-repo
+ * consumers re-derive the type and risk drift (gateway already had a
+ * divergent `QueueUsageEvent` for the queue payload).
+ *
+ * Three concept groups:
+ *
+ *   1. `GatewayUsageEvent` — the canonical wire shape that flows from
+ *      gateway → queue → fs-usage-consumer → core ingestion route.
+ *      Mirrors the Prisma `UsageEvent` row field-for-field where it
+ *      matters (the `rawDimsJson` column is `rawDimsUnits` here, the
+ *      `idempotencyKey` is `requestId`, etc.). The 0.21.0 superset
+ *      reconciles the gateway's richer publisher-side shape (orgId /
+ *      actorType / subjectKey / overageBehavior / environment) into
+ *      shared-types as OPTIONAL fields so existing producers and
+ *      consumers stay backward-compatible while we migrate everyone
+ *      onto the canonical contract.
+ *
+ *   2. `AnalyticsSink` — provider-agnostic interface for fan-out to an
+ *      analytics warehouse (ClickHouse / Tinybird / DuckDB / Timescale).
+ *      Implementations live in core; the interface lives here so future
+ *      cross-repo consumers (admin reports, dashboards, replay scripts)
+ *      can typecheck against one contract. Designed for best-effort
+ *      fire-and-forget — Postgres remains the source of truth for
+ *      billing.
+ *
+ *   3. `UsageRollup` — forward-compatible aggregation row shape. Not
+ *      consumed by the sink itself; published now so dashboard endpoints
+ *      added later can typecheck against the rolled-up wire format
+ *      without churning shared-types again.
+ *
+ * Runtime gate: `gatewayUsageEventSchema` mirrors `GatewayUsageEvent`
+ * with `.passthrough()` so consumers (fs-usage-consumer, core ingestion)
+ * can validate inbound queue payloads at the boundary without rejecting
+ * forward-compatible unknown fields.
+ */
+import { z } from "zod";
+import type { OverageBehavior } from "./enums.js";
+/**
+ * Canonical wire shape for usage events flowing through the pipeline.
+ *
+ * Field semantics:
+ *   - `requestId` doubles as the idempotency key — `core/src/services/
+ *     gateway-usage-ingestion.ts` uses `prisma.usageEvent.createMany`
+ *     with `skipDuplicates` against the unique `idempotencyKey` index,
+ *     so re-deliveries from the Cloudflare Queue are no-ops.
+ *   - `timestamp` is a Unix epoch in **milliseconds** (matches what
+ *     `Date.now()` produces; the ingestion route converts it to a
+ *     `Date` for `occurredAt`).
+ *   - `rawDimsUnits` is the per-metric value map (e.g.
+ *     `{ requests: 1, tokens: 42 }`). Persisted to Postgres as
+ *     `rawDimsJson` JSON.
+ *   - `apiKeyId` is nullable — internal traffic + reservation flows
+ *     don't always carry a credential.
+ *   - `environmentId` is nullable for production-scope events.
+ *   - `subscriberStatus` is a closed literal union — gateway only
+ *     publishes events for subscriptions in one of three lifecycle
+ *     states. (Pre-0.21.0 this was an open string for forward-compat
+ *     with unknown future statuses; we now require the closed set so
+ *     consumers can switch-exhaustively.)
+ *
+ * 0.21.0 superset (additive, all optional):
+ *   - `orgId` — tenant's owning Org (gateway publishes; core ingestion
+ *     denormalizes for analytics partitioning).
+ *   - `actorType` / `actorId` — who initiated the request (an org-level
+ *     service token vs. a specific end-user).
+ *   - `subjectKey` — gateway-side composed cache/dedupe key.
+ *   - `overageBehavior` — snapshot of the plan's overage policy at the
+ *     moment of measurement; lets consumers reconstruct the gating
+ *     decision without re-reading the compiled plan.
+ *   - `environment` — `'production' | 'sandbox'`. Distinct from
+ *     `environmentId` (the env-branch UUID); this is the lifecycle
+ *     channel.
+ */
+export type GatewayUsageEvent = {
+    requestId: string;
+    tenantId: string;
+    slug: string;
+    subscriptionId: string;
+    subscriberId: string;
+    apiKeyId: string | null;
+    compiledPlanId: string;
+    subscriberStatus: "ONBOARDING" | "ACTIVE" | "SUSPENDED";
+    subscriptionStatus: string;
+    productId: string;
+    statusCode: number;
+    path: string;
+    latencyMs: number;
+    rawDimsUnits: Record<string, number>;
+    reportingAttested: boolean;
+    measureContext?: Record<string, unknown>;
+    creditUnitsConsumed?: Record<string, number>;
+    timestamp: number;
+    environmentId?: string | null;
+    /** Owning org of the tenant. Gateway populates; analytics partitions on it. */
+    orgId?: string;
+    /** Whether the request was driven by an org-level token or an end-user. */
+    actorType?: "org" | "user";
+    /** Stable id of the actor (null when actorType is org-level / anonymous). */
+    actorId?: string | null;
+    /** Gateway-composed cache/dedupe key. Opaque to downstream consumers. */
+    subjectKey?: string;
+    /** Snapshot of the overage policy at measurement time. */
+    overageBehavior?: OverageBehavior;
+    /** Lifecycle channel — distinct from `environmentId` (the env-branch UUID). */
+    environment?: "production" | "sandbox";
+    /**
+     * Self-describing metadata stamped onto every event for forensics. The
+     * one field today is `gatewayVersion` — the build identifier of the
+     * `fs-gateway` worker that produced this event. Required when triaging
+     * a poison-message DLQ entry: "every malformed event came from
+     * gateway v1.42.0 → look at that release". Future fields (e.g.
+     * `regionId`, `colo`) can be added without a breaking change.
+     */
+    _meta?: {
+        gatewayVersion?: string;
+    };
+};
+/**
+ * Runtime zod schema mirroring {@link GatewayUsageEvent}. Use this at
+ * trust boundaries (queue consumer, ingestion HTTP route) to validate
+ * inbound payloads — the type alone gives no runtime guarantees.
+ *
+ * Uses `.passthrough()` (not `.strict()` / `.strip()`) so unknown fields
+ * survive the round-trip. This protects us against the staged-deploy
+ * window where gateway publishes a new optional field before the
+ * consumer side picks up the new shared-types release.
+ */
+export declare const gatewayUsageEventSchema: z.ZodObject<{
+    requestId: z.ZodString;
+    tenantId: z.ZodString;
+    slug: z.ZodString;
+    subscriptionId: z.ZodString;
+    subscriberId: z.ZodString;
+    apiKeyId: z.ZodNullable<z.ZodString>;
+    compiledPlanId: z.ZodString;
+    subscriberStatus: z.ZodEnum<{
+        ACTIVE: "ACTIVE";
+        ONBOARDING: "ONBOARDING";
+        SUSPENDED: "SUSPENDED";
+    }>;
+    subscriptionStatus: z.ZodString;
+    productId: z.ZodString;
+    statusCode: z.ZodNumber;
+    path: z.ZodString;
+    latencyMs: z.ZodNumber;
+    rawDimsUnits: z.ZodRecord<z.ZodString, z.ZodNumber>;
+    reportingAttested: z.ZodBoolean;
+    measureContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    creditUnitsConsumed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNumber>>;
+    timestamp: z.ZodNumber;
+    environmentId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    orgId: z.ZodOptional<z.ZodString>;
+    actorType: z.ZodOptional<z.ZodEnum<{
+        org: "org";
+        user: "user";
+    }>>;
+    actorId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    subjectKey: z.ZodOptional<z.ZodString>;
+    overageBehavior: z.ZodOptional<z.ZodEnum<{
+        BLOCK: "BLOCK";
+        ALLOW_AND_BILL: "ALLOW_AND_BILL";
+    }>>;
+    environment: z.ZodOptional<z.ZodEnum<{
+        production: "production";
+        sandbox: "sandbox";
+    }>>;
+    _meta: z.ZodOptional<z.ZodObject<{
+        gatewayVersion: z.ZodOptional<z.ZodString>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+/**
+ * Provider-agnostic analytics sink. Implementations fan out usage events
+ * to an analytics warehouse (currently ClickHouse-shaped, but the
+ * interface is intentionally provider-free so swapping to Tinybird /
+ * DuckDB / Timescale is a one-class change in core).
+ *
+ * Contract:
+ *   - `publishUsageEvents` is best-effort. Implementations log + swallow
+ *     transport errors; never throw to the caller (the ingestion route
+ *     must commit to Postgres regardless).
+ *   - `ping` is for `/healthz/analytics` only — must not have side
+ *     effects.
+ *   - `provider` is a stable string used in logs and health output.
+ *     Reserved values: `"null"` (the no-op default), `"clickhouse"`,
+ *     `"tinybird"`. Implementations of new providers MUST pick a
+ *     unique stable value.
+ */
+export interface AnalyticsSink {
+    /** Best-effort batch publish. Failures are logged, never thrown. */
+    publishUsageEvents(events: GatewayUsageEvent[]): Promise<void>;
+    /** Health probe for /healthz/analytics. Must be side-effect free. */
+    ping(): Promise<AnalyticsSinkPing>;
+    /** Stable provider identifier for logs + health output. */
+    readonly provider: string;
+}
+export type AnalyticsSinkPing = {
+    ok: boolean;
+    provider: string;
+    /** Wall-clock duration of the ping round-trip, when measurable. */
+    latencyMs?: number;
+    /** Short error string when `ok === false`. Never the raw stack. */
+    error?: string;
+};
+/**
+ * Hourly per-(subscription, dimension) aggregation row.
+ *
+ * Forward-compatible: the sink itself does not produce this shape —
+ * it's the wire format dashboard endpoints will return when the read
+ * path comes online. Published now so admin / dev-portal callers can
+ * typecheck against one contract without churning shared-types when
+ * the dashboards land.
+ *
+ * `hour` is an ISO-8601 timestamp truncated to the hour boundary.
+ * `dimensionKey` matches a key from `GatewayUsageEvent.rawDimsUnits`.
+ */
+export type UsageRollup = {
+    subscriptionId: string;
+    hour: string;
+    dimensionKey: string;
+    dimensionSum: number;
+    eventCount: number;
+};
+//# sourceMappingURL=analytics.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/analytics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;IACxD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE9B,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,SAAS,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC3B,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,yEAAyE;IACzE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,+EAA+E;IAC/E,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAEvC;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE;QACN,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+CpB,CAAC;AAEjB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,qEAAqE;IACrE,IAAI,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mEAAmE;IACnE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/analytics.js

@@ -0,0 +1,101 @@
+/**
+ * analytics.ts — canonical types for the analytics domain.
+ *
+ * Lives in shared-types so core (writer), gateway (publisher),
+ * fs-usage-consumer (queue worker), and any future BI/dashboard surface
+ * all agree on one wire shape. The previous home was
+ * `core/src/services/gateway-usage-ingestion.ts`, which made cross-repo
+ * consumers re-derive the type and risk drift (gateway already had a
+ * divergent `QueueUsageEvent` for the queue payload).
+ *
+ * Three concept groups:
+ *
+ *   1. `GatewayUsageEvent` — the canonical wire shape that flows from
+ *      gateway → queue → fs-usage-consumer → core ingestion route.
+ *      Mirrors the Prisma `UsageEvent` row field-for-field where it
+ *      matters (the `rawDimsJson` column is `rawDimsUnits` here, the
+ *      `idempotencyKey` is `requestId`, etc.). The 0.21.0 superset
+ *      reconciles the gateway's richer publisher-side shape (orgId /
+ *      actorType / subjectKey / overageBehavior / environment) into
+ *      shared-types as OPTIONAL fields so existing producers and
+ *      consumers stay backward-compatible while we migrate everyone
+ *      onto the canonical contract.
+ *
+ *   2. `AnalyticsSink` — provider-agnostic interface for fan-out to an
+ *      analytics warehouse (ClickHouse / Tinybird / DuckDB / Timescale).
+ *      Implementations live in core; the interface lives here so future
+ *      cross-repo consumers (admin reports, dashboards, replay scripts)
+ *      can typecheck against one contract. Designed for best-effort
+ *      fire-and-forget — Postgres remains the source of truth for
+ *      billing.
+ *
+ *   3. `UsageRollup` — forward-compatible aggregation row shape. Not
+ *      consumed by the sink itself; published now so dashboard endpoints
+ *      added later can typecheck against the rolled-up wire format
+ *      without churning shared-types again.
+ *
+ * Runtime gate: `gatewayUsageEventSchema` mirrors `GatewayUsageEvent`
+ * with `.passthrough()` so consumers (fs-usage-consumer, core ingestion)
+ * can validate inbound queue payloads at the boundary without rejecting
+ * forward-compatible unknown fields.
+ */
+import { z } from "zod";
+/**
+ * Runtime zod schema mirroring {@link GatewayUsageEvent}. Use this at
+ * trust boundaries (queue consumer, ingestion HTTP route) to validate
+ * inbound payloads — the type alone gives no runtime guarantees.
+ *
+ * Uses `.passthrough()` (not `.strict()` / `.strip()`) so unknown fields
+ * survive the round-trip. This protects us against the staged-deploy
+ * window where gateway publishes a new optional field before the
+ * consumer side picks up the new shared-types release.
+ */
+export const gatewayUsageEventSchema = z
+    .object({
+    requestId: z.string(),
+    tenantId: z.string(),
+    slug: z.string(),
+    subscriptionId: z.string(),
+    subscriberId: z.string(),
+    apiKeyId: z.string().nullable(),
+    compiledPlanId: z.string(),
+    subscriberStatus: z.enum(["ONBOARDING", "ACTIVE", "SUSPENDED"]),
+    subscriptionStatus: z.string(),
+    productId: z.string(),
+    statusCode: z.number(),
+    path: z.string(),
+    latencyMs: z.number(),
+    rawDimsUnits: z.record(z.string(), z.number()),
+    reportingAttested: z.boolean(),
+    measureContext: z.record(z.string(), z.unknown()).optional(),
+    creditUnitsConsumed: z.record(z.string(), z.number()).optional(),
+    timestamp: z.number(),
+    environmentId: z.string().nullable().optional(),
+    // --- 0.21.0 superset (all optional) ---
+    orgId: z.string().optional(),
+    actorType: z.enum(["org", "user"]).optional(),
+    actorId: z.string().nullable().optional(),
+    subjectKey: z.string().optional(),
+    overageBehavior: z.enum(["BLOCK", "ALLOW_AND_BILL"]).optional(),
+    environment: z.enum(["production", "sandbox"]).optional(),
+    // --- 0.24.0 event-pipeline-hardening (Risk 5) ---
+    // Self-describing metadata for forensics. Optional + permissive so a
+    // gateway version that ships before this field is recognized
+    // produces no validation failure (the schema is `.passthrough()` so
+    // unknown fields are preserved either way; declaring it explicitly
+    // here lets downstream code consume it via the typed shape).
+    // Swarm-1D P1 audit fix: `.passthrough()` on the inner _meta object.
+    // Without it, zod's default `.strip()` silently drops unknown fields
+    // when they reach a v0.24-pinned consumer. A future gateway shipping
+    // _meta.regionId would have it disappear from `parsed._meta` even
+    // though the outer schema's passthrough preserves it on the raw
+    // body. Mirror the outer-schema's permissive contract here.
+    _meta: z
+        .object({
+        gatewayVersion: z.string().optional(),
+    })
+        .passthrough()
+        .optional(),
+})
+    .passthrough();
+//# sourceMappingURL=analytics.js.map

package/node_modules/@farther-shore/shared-types/dist/analytics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.js","sourceRoot":"","sources":["../src/analytics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAsFxB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACrC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,gBAAgB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/D,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC9B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9C,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;IAC9B,cAAc,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,mBAAmB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IAChE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC/C,yCAAyC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IACzC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/D,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzD,mDAAmD;IACnD,qEAAqE;IACrE,6DAA6D;IAC7D,oEAAoE;IACpE,mEAAmE;IACnE,6DAA6D;IAC7D,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,kEAAkE;IAClE,gEAAgE;IAChE,4DAA4D;IAC5D,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACtC,CAAC;SACD,WAAW,EAAE;SACb,QAAQ,EAAE;CACd,CAAC;KACD,WAAW,EAAE,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/api.d.ts

@@ -0,0 +1,16 @@
+/** Standard error response from the core API */
+export type ApiErrorResponse = {
+    error: string;
+    code?: string;
+    details?: unknown;
+};
+/** Paginated list response */
+export type PaginatedResponse<T> = {
+    data: T[];
+    total: number;
+    page: number;
+    limit: number;
+};
+/** Usage summary keyed by meter dimension */
+export type UsageSummary = Record<string, number>;
+//# sourceMappingURL=api.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAIA,gDAAgD;AAChD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAAI;IACjC,IAAI,EAAE,CAAC,EAAE,CAAC;IACV,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/api.js

@@ -0,0 +1,5 @@
+// ---------------------------------------------------------------------------
+// API response envelope types — canonical shapes for all API responses
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=api.js.map

package/node_modules/@farther-shore/shared-types/dist/api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,uEAAuE;AACvE,8EAA8E"}

package/node_modules/@farther-shore/shared-types/dist/auth/permissions.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The 9 resources the builder authorization layer knows about.
+ * Each resource has a per-verb namespace below. Adding a new resource
+ * means: add a `<resource>` constant here AND a `<RESOURCE>_VERBS` array
+ * below AND wire it into core's `defaultRolePolicies()`.
+ */
+export declare const RESOURCES: {
+    readonly ORG: "org";
+    readonly TEAM: "team";
+    readonly PRODUCT: "product";
+    readonly PLAN: "plan";
+    readonly APIKEY: "apikey";
+    readonly MAKERTOKEN: "makertoken";
+    readonly BILLING: "billing";
+    readonly WEBHOOK: "webhook";
+    readonly AUDIT_LOG: "audit_log";
+};
+export type Resource = (typeof RESOURCES)[keyof typeof RESOURCES];
+/**
+ * Org-level verbs. `manage_billing` and `delete` are owner-only by default.
+ *
+ * The act of creating a brand-new org is technically a user-level action
+ * — the caller doesn't yet have a Membership row in the new org — so
+ * core enforces `org.create` on the caller's CURRENT active org (where
+ * they DO have a role). admin+owner are allowed to create new orgs,
+ * members are not.
+ */
+export declare const ORG_VERBS: readonly ["read", "create", "update", "delete", "manage_settings", "manage_billing"];
+export type OrgVerb = (typeof ORG_VERBS)[number];
+/** Team / membership verbs. */
+export declare const TEAM_VERBS: readonly ["read", "invite", "remove_member", "change_role"];
+export type TeamVerb = (typeof TEAM_VERBS)[number];
+/** Product CRUD + lifecycle. `publish` and `delete` are owner-only by default. */
+export declare const PRODUCT_VERBS: readonly ["read", "create", "update", "delete", "publish", "archive"];
+export type ProductVerb = (typeof PRODUCT_VERBS)[number];
+/** Plan CRUD + version promote. */
+export declare const PLAN_VERBS: readonly ["read", "create", "update", "delete", "promote_version"];
+export type PlanVerb = (typeof PLAN_VERBS)[number];
+/** Subscriber-facing API key management at the builder layer. */
+export declare const APIKEY_VERBS: readonly ["read", "create", "rotate", "revoke"];
+export type ApiKeyVerb = (typeof APIKEY_VERBS)[number];
+/** MakerToken (builder CI/CD machine identity) management. */
+export declare const MAKERTOKEN_VERBS: readonly ["read", "create", "rotate", "revoke"];
+export type MakerTokenVerb = (typeof MAKERTOKEN_VERBS)[number];
+/** Billing surface: builder's own subscription + per-product billing config. */
+export declare const BILLING_VERBS: readonly ["read", "manage_subscription", "refund", "change_payment_method"];
+export type BillingVerb = (typeof BILLING_VERBS)[number];
+/** Outbound webhook configuration (the URLs FartherShore POSTs events to). */
+export declare const WEBHOOK_VERBS: readonly ["read", "configure", "rotate_secret"];
+export type WebhookVerb = (typeof WEBHOOK_VERBS)[number];
+/** Audit log read + export (separate verb so SOC 2 access reviews can scope it). */
+export declare const AUDIT_LOG_VERBS: readonly ["read", "export"];
+export type AuditLogVerb = (typeof AUDIT_LOG_VERBS)[number];
+/**
+ * Resource → verb-array map. Useful for tests and tooling (matrix
+ * generators, scope validators, role-policy builders).
+ */
+export declare const VERBS_BY_RESOURCE: Record<Resource, readonly string[]>;
+/** Total verb count across all resources — sanity check for tests. */
+export declare const TOTAL_VERB_COUNT: number;
+export declare const MAKER_TOKEN_SCOPES: readonly ["products:create", "products:update", "products:publish", "products:read", "customers:read", "customers:write", "billing:checkout", "billing:manage", "entitlements:read", "entitlements:check"];
+export type MakerTokenScope = (typeof MAKER_TOKEN_SCOPES)[number];
+//# sourceMappingURL=permissions.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/auth/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAyBA;;;;;GAKG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;CAUZ,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,OAAO,SAAS,CAAC,CAAC;AAUlE;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,sFAOZ,CAAC;AACX,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjD,+BAA+B;AAC/B,eAAO,MAAM,UAAU,6DAKb,CAAC;AACX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,kFAAkF;AAClF,eAAO,MAAM,aAAa,uEAOhB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,mCAAmC;AACnC,eAAO,MAAM,UAAU,oEAMb,CAAC;AACX,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD,iEAAiE;AACjE,eAAO,MAAM,YAAY,iDAAkD,CAAC;AAC5E,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAEvD,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,iDAAkD,CAAC;AAChF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,gFAAgF;AAChF,eAAO,MAAM,aAAa,6EAKhB,CAAC;AACX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,8EAA8E;AAC9E,eAAO,MAAM,aAAa,iDAAkD,CAAC;AAC7E,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzD,oFAAoF;AACpF,eAAO,MAAM,eAAe,6BAA8B,CAAC;AAC3D,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D;;;GAGG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAUjE,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,QAG5B,CAAC;AAYF,eAAO,MAAM,kBAAkB,4MAWrB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAC"}