@farthershore/cli 0.3.9 → 0.3.10

package/node_modules/@farther-shore/shared-types/dist/auth/permissions.js

@@ -0,0 +1,143 @@
+// ---------------------------------------------------------------------------
+// Canonical scope grammar + verb namespace.
+//
+// This module is the cross-repo source of truth for the resource/verb
+// grammar that powers RBAC across FartherShore. core re-exports these
+// symbols from `core/src/services/authorization/permissions.ts` and
+// `core/src/services/workspaces.ts` for backward compat.
+//
+// Future: SDK + fs-admin should validate scope strings (e.g. on
+// maker-token issuance and Casbin policy authoring) against the constants
+// exported here, instead of accepting free-form strings. That keeps the
+// scope vocabulary closed and lets us extend the grammar without
+// silently accepting typos.
+//
+// Notes:
+//   - Only the namespace constants live here. Role bundles
+//     (`defaultRolePolicies`), `ALL_READ_VERBS`, and `ADMIN_DENY_LIST`
+//     are core-only enforcement logic and stay in core.
+//   - Casbin enforcement still uses regexMatch on the action field, so
+//     any string matching `<resource>.<verb>` is technically a legal
+//     action. The namespace below is the canonical set; routes calling
+//     enforcement helpers should always pass a tuple drawn from these
+//     constants, not a free-form string.
+// ---------------------------------------------------------------------------
+/**
+ * The 9 resources the builder authorization layer knows about.
+ * Each resource has a per-verb namespace below. Adding a new resource
+ * means: add a `<resource>` constant here AND a `<RESOURCE>_VERBS` array
+ * below AND wire it into core's `defaultRolePolicies()`.
+ */
+export const RESOURCES = {
+    ORG: "org",
+    TEAM: "team",
+    PRODUCT: "product",
+    PLAN: "plan",
+    APIKEY: "apikey",
+    MAKERTOKEN: "makertoken",
+    BILLING: "billing",
+    WEBHOOK: "webhook",
+    AUDIT_LOG: "audit_log",
+};
+// ---------------------------------------------------------------------------
+// Per-resource verb namespaces.
+//
+// Each `<RESOURCE>_VERBS` is the closed set of actions the platform knows
+// how to enforce for that resource. The `<Resource>Verb` types extract
+// the union so callers get autocomplete + compile-time errors on typos.
+// ---------------------------------------------------------------------------
+/**
+ * Org-level verbs. `manage_billing` and `delete` are owner-only by default.
+ *
+ * The act of creating a brand-new org is technically a user-level action
+ * — the caller doesn't yet have a Membership row in the new org — so
+ * core enforces `org.create` on the caller's CURRENT active org (where
+ * they DO have a role). admin+owner are allowed to create new orgs,
+ * members are not.
+ */
+export const ORG_VERBS = [
+    "read",
+    "create",
+    "update",
+    "delete",
+    "manage_settings",
+    "manage_billing",
+];
+/** Team / membership verbs. */
+export const TEAM_VERBS = [
+    "read",
+    "invite",
+    "remove_member",
+    "change_role",
+];
+/** Product CRUD + lifecycle. `publish` and `delete` are owner-only by default. */
+export const PRODUCT_VERBS = [
+    "read",
+    "create",
+    "update",
+    "delete",
+    "publish",
+    "archive",
+];
+/** Plan CRUD + version promote. */
+export const PLAN_VERBS = [
+    "read",
+    "create",
+    "update",
+    "delete",
+    "promote_version",
+];
+/** Subscriber-facing API key management at the builder layer. */
+export const APIKEY_VERBS = ["read", "create", "rotate", "revoke"];
+/** MakerToken (builder CI/CD machine identity) management. */
+export const MAKERTOKEN_VERBS = ["read", "create", "rotate", "revoke"];
+/** Billing surface: builder's own subscription + per-product billing config. */
+export const BILLING_VERBS = [
+    "read",
+    "manage_subscription",
+    "refund",
+    "change_payment_method",
+];
+/** Outbound webhook configuration (the URLs FartherShore POSTs events to). */
+export const WEBHOOK_VERBS = ["read", "configure", "rotate_secret"];
+/** Audit log read + export (separate verb so SOC 2 access reviews can scope it). */
+export const AUDIT_LOG_VERBS = ["read", "export"];
+/**
+ * Resource → verb-array map. Useful for tests and tooling (matrix
+ * generators, scope validators, role-policy builders).
+ */
+export const VERBS_BY_RESOURCE = {
+    [RESOURCES.ORG]: ORG_VERBS,
+    [RESOURCES.TEAM]: TEAM_VERBS,
+    [RESOURCES.PRODUCT]: PRODUCT_VERBS,
+    [RESOURCES.PLAN]: PLAN_VERBS,
+    [RESOURCES.APIKEY]: APIKEY_VERBS,
+    [RESOURCES.MAKERTOKEN]: MAKERTOKEN_VERBS,
+    [RESOURCES.BILLING]: BILLING_VERBS,
+    [RESOURCES.WEBHOOK]: WEBHOOK_VERBS,
+    [RESOURCES.AUDIT_LOG]: AUDIT_LOG_VERBS,
+};
+/** Total verb count across all resources — sanity check for tests. */
+export const TOTAL_VERB_COUNT = Object.values(VERBS_BY_RESOURCE).reduce((sum, verbs) => sum + verbs.length, 0);
+// ---------------------------------------------------------------------------
+// MakerToken scope grammar.
+//
+// MakerTokens are CI/CD machine identities. Their scopes are the
+// coarse-grained `domain:action` strings issuers can pin onto a token
+// at creation time. Tier mapping (READONLY / WRITE / ADMIN) is enforced
+// in core; the closed set itself lives here so SDK + fs-admin can
+// validate scope strings without reaching into core.
+// ---------------------------------------------------------------------------
+export const MAKER_TOKEN_SCOPES = [
+    "products:create",
+    "products:update",
+    "products:publish",
+    "products:read",
+    "customers:read",
+    "customers:write",
+    "billing:checkout",
+    "billing:manage",
+    "entitlements:read",
+    "entitlements:check",
+];
+//# sourceMappingURL=permissions.js.map

package/node_modules/@farther-shore/shared-types/dist/auth/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/auth/permissions.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4CAA4C;AAC5C,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,oEAAoE;AACpE,yDAAyD;AACzD,EAAE;AACF,gEAAgE;AAChE,0EAA0E;AAC1E,wEAAwE;AACxE,iEAAiE;AACjE,4BAA4B;AAC5B,EAAE;AACF,SAAS;AACT,2DAA2D;AAC3D,uEAAuE;AACvE,wDAAwD;AACxD,uEAAuE;AACvE,qEAAqE;AACrE,uEAAuE;AACvE,sEAAsE;AACtE,yCAAyC;AACzC,8EAA8E;AAE9E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;CACd,CAAC;AAIX,8EAA8E;AAC9E,gCAAgC;AAChC,EAAE;AACF,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,iBAAiB;IACjB,gBAAgB;CACR,CAAC;AAGX,+BAA+B;AAC/B,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,MAAM;IACN,QAAQ;IACR,eAAe;IACf,aAAa;CACL,CAAC;AAGX,kFAAkF;AAClF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,SAAS;CACD,CAAC;AAGX,mCAAmC;AACnC,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,iBAAiB;CACT,CAAC;AAGX,iEAAiE;AACjE,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG5E,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAGhF,gFAAgF;AAChF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM;IACN,qBAAqB;IACrB,QAAQ;IACR,uBAAuB;CACf,CAAC;AAGX,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,WAAW,EAAE,eAAe,CAAU,CAAC;AAG7E,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAU,CAAC;AAG3D;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAwC;IACpE,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,SAAS;IAC1B,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU;IAC5B,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa;IAClC,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU;IAC5B,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY;IAChC,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,gBAAgB;IACxC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa;IAClC,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa;IAClC,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,eAAe;CACvC,CAAC;AAEF,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,CACrE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,EAClC,CAAC,CACF,CAAC;AAEF,8EAA8E;AAC9E,4BAA4B;AAC5B,EAAE;AACF,iEAAiE;AACjE,sEAAsE;AACtE,wEAAwE;AACxE,kEAAkE;AAClE,qDAAqD;AACrD,8EAA8E;AAE9E,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,iBAAiB;IACjB,iBAAiB;IACjB,kBAAkB;IAClB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,kBAAkB;IAClB,gBAAgB;IAChB,mBAAmB;IACnB,oBAAoB;CACZ,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/base.d.ts

@@ -0,0 +1,18 @@
+import type { PlanType, ProductStatus, SubscriberStatus } from "./enums.js";
+export type ProductBase = {
+    id: string;
+    name: string;
+    status: ProductStatus;
+};
+export type PlanBase = {
+    id: string;
+    name: string;
+    type: PlanType;
+    monthlyPriceCents: number;
+};
+export type SubscriberBase = {
+    id: string;
+    productId: string;
+    status: SubscriberStatus;
+};
+//# sourceMappingURL=base.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.d.ts","sourceRoot":"","sources":["../src/base.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE5E,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,gBAAgB,CAAC;CAC1B,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/base.js

@@ -0,0 +1,6 @@
+// ---------------------------------------------------------------------------
+// Base interfaces — minimal fields present in ALL repo projections.
+// Each repo extends these locally with its own API-specific fields.
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=base.js.map

package/node_modules/@farther-shore/shared-types/dist/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../src/base.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,oEAAoE;AACpE,oEAAoE;AACpE,8EAA8E"}

package/node_modules/@farther-shore/shared-types/dist/billing.d.ts

@@ -0,0 +1,58 @@
+export type SubscriptionStatus = "active" | "past_due" | "scheduled_downgrade" | "suspended" | "cancelled";
+export type NormalizedBillingEvent = {
+    kind: "checkout_completed";
+    subscriberId: string;
+    productId: string;
+    /** Logical `Plan.id` — the namespace builders pick from. */
+    planId: string;
+    priceVersionId?: string;
+    subscriptionRef: string;
+    customerRef: string;
+    trialEnd?: number | null;
+    timestamp: number;
+} | {
+    kind: "subscription_updated";
+    subscriptionRef: string;
+    subscriberId?: string;
+    cancelAtPeriodEnd: boolean;
+    periodEnd: Date | null;
+    status?: string;
+    timestamp: number;
+} | {
+    kind: "subscription_cancelled";
+    subscriptionRef: string;
+    subscriberId?: string;
+    timestamp: number;
+} | {
+    kind: "payment_succeeded";
+    subscriptionRef: string;
+    subscriberId?: string;
+    timestamp: number;
+} | {
+    kind: "payment_failed";
+    subscriptionRef: string;
+    subscriberId?: string;
+    invoiceBillingReason?: string;
+    timestamp: number;
+} | {
+    kind: "subscription_incomplete";
+    subscriptionRef: string;
+    subscriberId?: string;
+    timestamp: number;
+} | {
+    kind: "invoice_voided";
+    subscriberId?: string;
+    subscriptionRef?: string;
+    timestamp: number;
+} | {
+    kind: "dispute_created";
+    chargeRef: string;
+    amount: number;
+    timestamp: number;
+} | {
+    kind: "refund_completed";
+    refundRef: string;
+    amount: number;
+    timestamp: number;
+};
+//# sourceMappingURL=billing.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/billing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,UAAU,GACV,qBAAqB,GACrB,WAAW,GACX,WAAW,CAAC;AAEhB,MAAM,MAAM,sBAAsB,GAC9B;IACE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,sBAAsB,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,wBAAwB,CAAC;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,yBAAyB,CAAC;IAChC,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,gBAAgB,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/billing.js

@@ -0,0 +1,9 @@
+// ---------------------------------------------------------------------------
+// Billing types — subscription status and normalized events
+//
+// v0.14.2 — `consumerId` renamed to `subscriberId` on all NormalizedBillingEvent
+// variants. `planId` on `checkout_completed` remains as the logical
+// `Plan.id` (the namespace builders pick from when selecting a plan).
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=billing.js.map

package/node_modules/@farther-shore/shared-types/dist/billing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,4DAA4D;AAC5D,EAAE;AACF,iFAAiF;AACjF,oEAAoE;AACpE,sEAAsE;AACtE,8EAA8E"}

package/node_modules/@farther-shore/shared-types/dist/builder-context.d.ts

@@ -0,0 +1,33 @@
+import type { BuilderOrganization } from "./web-ui.js";
+export type BuilderMembership = {
+    organization: BuilderOrganization;
+    role: string;
+};
+export type PlatformFeatures = {
+    team: boolean;
+};
+export type PlatformPlan = {
+    slug: string;
+    name: string;
+    displayOrder: number;
+    monthlyPriceCents: number;
+    limits: Record<string, number>;
+    features: string[];
+    marketingFeatures: string[];
+    checkoutLink: string | null;
+};
+export type BuilderContext = {
+    user: {
+        id: string;
+        clerkUserId: string;
+    };
+    personalOrganization: BuilderOrganization;
+    activeOrganization: BuilderOrganization;
+    memberships: BuilderMembership[];
+    shouldPersistActiveOrganization: boolean;
+    platformTier?: string | null;
+    features?: PlatformFeatures | null;
+    platformPlans?: PlatformPlan[];
+    platformUsage?: Record<string, number>;
+};
+//# sourceMappingURL=builder-context.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/builder-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-context.d.ts","sourceRoot":"","sources":["../src/builder-context.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,YAAY,EAAE,mBAAmB,CAAC;IAClC,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,OAAO,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAC;QACX,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,oBAAoB,EAAE,mBAAmB,CAAC;IAC1C,kBAAkB,EAAE,mBAAmB,CAAC;IACxC,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACjC,+BAA+B,EAAE,OAAO,CAAC;IACzC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACnC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/builder-context.js

@@ -0,0 +1,6 @@
+// ---------------------------------------------------------------------------
+// Builder context types — bootstrap payload returned by core API when the
+// web-ui server-side code initializes a builder session.
+// ---------------------------------------------------------------------------
+export {};
+//# sourceMappingURL=builder-context.js.map

package/node_modules/@farther-shore/shared-types/dist/builder-context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builder-context.js","sourceRoot":"","sources":["../src/builder-context.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,0EAA0E;AAC1E,yDAAyD;AACzD,8EAA8E"}

package/node_modules/@farther-shore/shared-types/dist/consumer.d.ts

@@ -0,0 +1,162 @@
+import type { SubscriptionOwnerType } from "./enums.js";
+/**
+ * Stripe-shaped status of the underlying BillingSubscription provider row.
+ * Narrow; prefer `subscriptionLifecycle` for UX decisions.
+ *
+ * Distinct from the wider {@link ./billing.js#SubscriptionStatus} used by
+ * NormalizedBillingEvent (lowercase, different value set). This one is the
+ * DTO-shaped status surfaced to end users.
+ */
+export type ConsumerSubscriptionStatus = "INCOMPLETE" | "ACTIVE" | "PAST_DUE" | "CANCELED";
+/**
+ * Closed set of well-known lifecycle values the platform emits today.
+ *
+ *   - "ACTIVE"                : current plan is in effect
+ *   - "SCHEDULED_TRANSITION"  : a plan transition is queued
+ *   - "PAST_DUE"              : payment failed, grace period
+ *   - "SUSPENDED"             : access blocked
+ *   - "CANCELLED"             : fully canceled
+ */
+export type KnownSubscriptionLifecycleState = "ACTIVE" | "SCHEDULED_TRANSITION" | "PAST_DUE" | "SUSPENDED" | "CANCELLED";
+/**
+ * Richer domain lifecycle stored on `Subscription.lifecycle`. Union of
+ * the well-known values plus an open `string` branch so builder-defined
+ * states (e.g. `SOFT_CANCELLED`, `DUNNING`) can be introduced without a
+ * migration.
+ *
+ * The `(string & {})` idiom is a TypeScript trick: it preserves literal
+ * autocomplete + typo detection for {@link KnownSubscriptionLifecycleState}
+ * while still accepting arbitrary strings at runtime.
+ *
+ * UIs MUST handle unknown values with an EXPLICIT fallback — call
+ * {@link fallbackLifecycleState} from a switch's `default` arm rather
+ * than silently routing to "ACTIVE".
+ */
+export type SubscriptionLifecycleState = KnownSubscriptionLifecycleState | (string & {});
+/**
+ * Explicit fallback for unknown lifecycle values. UIs SHOULD call this
+ * from their switch's `default` arm so the decision to collapse an
+ * unknown lifecycle onto "ACTIVE" is made visibly, not implicitly.
+ *
+ * The argument is kept for forward compatibility (future refinements
+ * may want to pivot on the unknown value); today it is ignored.
+ */
+export declare function fallbackLifecycleState(_value: string): KnownSubscriptionLifecycleState;
+/**
+ * Populated when the user has a queued plan change or cancellation that
+ * hasn't taken effect yet. Rendered as "Downgrades to {planName} on
+ * {effectiveAt}" or "Cancels on {effectiveAt}" in the UI.
+ *
+ * Mirrors the three `scheduledTransition*` columns on Subscription.
+ */
+export type ScheduledPlanTransition = {
+    /** Target CompiledPlan id (immutable version pointer). */
+    compiledPlanId: string;
+    /** Denormalized target plan name for display. */
+    planName: string;
+    /** PlanType enum passthrough (FREE / FLAT_RATE / METERED / …). */
+    planType: string;
+    /** ISO 8601 — when the transition goes into effect. */
+    effectiveAt: string;
+    /** Transition kind for plan-to-plan moves. */
+    kind: "DOWNGRADE" | "UPGRADE" | "SIDEGRADE";
+};
+export type ScheduledCancellationTransition = {
+    /** Cancellation has no target compiled plan. */
+    compiledPlanId: null;
+    /** Cancellation has no target plan metadata. */
+    planName: null;
+    /** Cancellation has no target plan metadata. */
+    planType: null;
+    /** ISO 8601 — when the cancellation goes into effect. */
+    effectiveAt: string;
+    kind: "CANCEL";
+};
+export type ScheduledTransition = ScheduledPlanTransition | ScheduledCancellationTransition;
+export type SubscriptionDto = {
+    /** Subscription.id — unique across all products */
+    subscriptionId: string;
+    productId: string;
+    /** Prefers Product.displayName, falls back to Product.name */
+    productName: string;
+    productLogoUrl: string | null;
+    productPrimaryColor: string | null;
+    /** e.g. "widgets.farthershore.io" — used for a "Open dev portal" link */
+    runtimeHostname: string | null;
+    /** Portal hostname (e.g. "weather.farthershore.io") — where the
+     * end-user-facing dev-portal lives. Distinct from runtimeHostname
+     * which is the API gateway domain. */
+    portalHostname?: string | null;
+    /** CompiledPlan.id (immutable version pointer). */
+    compiledPlanId: string;
+    /** Denormalized CompiledPlan.planKey for logging/debug. */
+    planKey: string;
+    /** Human-readable plan name from CompiledPlan.displayName. */
+    planName: string;
+    /** PlanType enum passthrough (FREE / FLAT_RATE / METERED / …) */
+    planType: string;
+    planMonthlyPriceCents: number | null;
+    status: ConsumerSubscriptionStatus;
+    /** ISO 8601 */
+    currentPeriodStart: string | null;
+    /** ISO 8601 */
+    currentPeriodEnd: string | null;
+    cancelAtPeriodEnd: boolean;
+    /** ISO 8601 — from the parent Subscriber */
+    trialEndsAt: string | null;
+    /** ISO 8601 — when the user last requested cancellation, if any */
+    canceledAt: string | null;
+    /** Only set for non-production subscriptions (v1 filters these out by default) */
+    environment: {
+        id: string;
+        name: string;
+        slug: string;
+    } | null;
+    /** Organization ownership for API subscriptions. */
+    ownerType: SubscriptionOwnerType;
+    ownerOrganizationId: string | null;
+    ownerName: string | null;
+    /**
+     * Richer domain state. Prefer this over `status` for UX branching. The
+     * type is `KnownSubscriptionLifecycleState | (string & {})` — switch
+     * on the known values and pass unknowns through
+     * {@link fallbackLifecycleState} in your `default` arm.
+     */
+    subscriptionLifecycle: SubscriptionLifecycleState;
+    /** Non-null when a plan change is queued but not yet effective. */
+    scheduledTransition: ScheduledTransition | null;
+    /** Derived: `planType === "FREE"` or `planMonthlyPriceCents === 0`. */
+    isFreeTier: boolean;
+    /** true iff BillingCustomer exists AND the product isn't discontinued */
+    canManageInStripe: boolean;
+    /** true unless the subscription is already fully canceled, suspended, or discontinued */
+    canCancel: boolean;
+    /** true when there's a pending cancellation or downgrade the user can undo */
+    canUnscheduleCancellation: boolean;
+    /** true when the subscription is canceled but the product still exists and can be re-subscribed to */
+    canRestore: boolean;
+    /** Product archived / no longer available */
+    isDiscontinued: boolean;
+};
+export type SubscriptionsResponse = {
+    subscriptions: SubscriptionDto[];
+};
+export type ConsumerPortalSessionRequest = {
+    /** Absolute https URL the user returns to after closing the Stripe portal */
+    returnUrl?: string;
+};
+export type ConsumerPortalSessionResponse = {
+    url: string;
+};
+/**
+ * Response shape for the three action endpoints:
+ *   POST /consumer/subscriptions/:id/cancel
+ *   POST /consumer/subscriptions/:id/unschedule-cancellation
+ *   POST /consumer/subscriptions/:id/restore
+ *
+ * The fresh DTO lets the client patch state in place without a round-trip GET.
+ */
+export type SubscriptionActionResponse = {
+    subscription: SubscriptionDto;
+};
+//# sourceMappingURL=consumer.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/consumer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer.d.ts","sourceRoot":"","sources":["../src/consumer.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAClC,YAAY,GACZ,QAAQ,GACR,UAAU,GACV,UAAU,CAAC;AAEf;;;;;;;;GAQG;AACH,MAAM,MAAM,+BAA+B,GACvC,QAAQ,GACR,sBAAsB,GACtB,UAAU,GACV,WAAW,GACX,WAAW,CAAC;AAEhB;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,0BAA0B,GAClC,+BAA+B,GAC/B,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,GACb,+BAA+B,CAIjC;AAED;;;;;;GAMG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACpC,0DAA0D;IAC1D,cAAc,EAAE,MAAM,CAAC;IACvB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,IAAI,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,+BAA+B,GAAG;IAC5C,gDAAgD;IAChD,cAAc,EAAE,IAAI,CAAC;IACrB,gDAAgD;IAChD,QAAQ,EAAE,IAAI,CAAC;IACf,gDAAgD;IAChD,QAAQ,EAAE,IAAI,CAAC;IACf,yDAAyD;IACzD,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,QAAQ,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,uBAAuB,GACvB,+BAA+B,CAAC;AAEpC,MAAM,MAAM,eAAe,GAAG;IAC5B,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,yEAAyE;IACzE,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B;;0CAEsC;IACtC,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAE/B,mDAAmD;IACnD,cAAc,EAAE,MAAM,CAAC;IACvB,2DAA2D;IAC3D,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IAErC,MAAM,EAAE,0BAA0B,CAAC;IACnC,eAAe;IACf,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,eAAe;IACf,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,4CAA4C;IAC5C,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mEAAmE;IACnE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kFAAkF;IAClF,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAE/D,oDAAoD;IACpD,SAAS,EAAE,qBAAqB,CAAC;IACjC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAIzB;;;;;OAKG;IACH,qBAAqB,EAAE,0BAA0B,CAAC;IAClD,mEAAmE;IACnE,mBAAmB,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAChD,uEAAuE;IACvE,UAAU,EAAE,OAAO,CAAC;IAQpB,yEAAyE;IACzE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,yFAAyF;IACzF,SAAS,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,yBAAyB,EAAE,OAAO,CAAC;IACnC,sGAAsG;IACtG,UAAU,EAAE,OAAO,CAAC;IACpB,6CAA6C;IAC7C,cAAc,EAAE,OAAO,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,aAAa,EAAE,eAAe,EAAE,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,4BAA4B,GAAG;IACzC,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,0BAA0B,GAAG;IACvC,YAAY,EAAE,eAAe,CAAC;CAC/B,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/consumer.js

@@ -0,0 +1,37 @@
+// ---------------------------------------------------------------------------
+// Subscription types — cross-product "My Subscriptions" surface.
+//
+// A signed-in Clerk user can manage subscriptions owned by the active Farther
+// Shore organization. One Subscription row per (subscriber, product,
+// environment) tuple. The web-ui Subscriptions tab fetches them through
+// GET /consumer/subscriptions and renders full lifecycle state + inline
+// cancel / keep / resubscribe actions — backed by matching POST endpoints
+// under /consumer/*.
+//
+// v0.14.0 renames (no back-compat; pre-prod):
+//   - `ConsumerSubscriptionDto` → `SubscriptionDto`
+//   - `planId` → `compiledPlanId` (points at the immutable CompiledPlan row)
+//   - `SubscriptionLifecycleState` is now a `KnownSubscriptionLifecycleState
+//     | (string & {})` union (typed autocomplete + open set for custom
+//     builder-defined states)
+//   - `ScheduledDowngrade` replaced by `ScheduledTransition` (mirrors the 3
+//     `scheduledTransition*` columns on Subscription + a `kind` discriminator)
+//
+// v0.14.2 — legacy `ConsumerSubscriptionDto` / `ConsumerSubscriptionsResponse`
+// / `ConsumerSubscriptionActionResponse` / `ScheduledDowngrade` have been
+// fully removed. Callers must migrate to the canonical shapes above.
+// ---------------------------------------------------------------------------
+/**
+ * Explicit fallback for unknown lifecycle values. UIs SHOULD call this
+ * from their switch's `default` arm so the decision to collapse an
+ * unknown lifecycle onto "ACTIVE" is made visibly, not implicitly.
+ *
+ * The argument is kept for forward compatibility (future refinements
+ * may want to pivot on the unknown value); today it is ignored.
+ */
+export function fallbackLifecycleState(_value) {
+    // Platform-documented treatment of unknowns; surfaced as a helper so
+    // callers make the fallback decision explicit rather than assuming it.
+    return "ACTIVE";
+}
+//# sourceMappingURL=consumer.js.map

package/node_modules/@farther-shore/shared-types/dist/consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer.js","sourceRoot":"","sources":["../src/consumer.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iEAAiE;AACjE,EAAE;AACF,8EAA8E;AAC9E,qEAAqE;AACrE,wEAAwE;AACxE,wEAAwE;AACxE,0EAA0E;AAC1E,qBAAqB;AACrB,EAAE;AACF,8CAA8C;AAC9C,oDAAoD;AACpD,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,8BAA8B;AAC9B,4EAA4E;AAC5E,+EAA+E;AAC/E,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,qEAAqE;AACrE,8EAA8E;AAoD9E;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc;IAEd,qEAAqE;IACrE,uEAAuE;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/node_modules/@farther-shore/shared-types/dist/dlq.d.ts

@@ -0,0 +1,47 @@
+import { z } from "zod";
+/**
+ * Compact zod issue summary suitable for log lines + DLQ envelopes.
+ * Mirrors the ZodIssue base shape but trims to the fields operators
+ * actually need to triage a schema regression.
+ */
+export declare const dlqZodIssueSchema: z.ZodObject<{
+    path: z.ZodString;
+    code: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>;
+export type DlqZodIssue = z.infer<typeof dlqZodIssueSchema>;
+/**
+ * Envelope that fs-usage-consumer's sendToSchemaFailureDlq emits when
+ * a queue message fails gatewayUsageEventSchema validation.
+ *
+ * Trust gate: consumers (fs-dlq-consumer) MUST verify
+ * `consumerVersion.startsWith("fs-usage-consumer/")` before unwrapping
+ * `rawPayload`. Without that gate, any writer to the DLQ queue could
+ * forge the shape and have rawPayload replayed against the main queue.
+ */
+export declare const schemaFailureDlqEntrySchema: z.ZodObject<{
+    reason: z.ZodLiteral<"schema_validation_failed">;
+    receivedAt: z.ZodString;
+    rawPayload: z.ZodUnknown;
+    issues: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        code: z.ZodString;
+        message: z.ZodString;
+    }, z.core.$strip>>;
+    consumerVersion: z.ZodOptional<z.ZodString>;
+    originalMessageId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SchemaFailureDlqEntry = z.infer<typeof schemaFailureDlqEntrySchema>;
+/**
+ * Trust-gate predicate used by fs-dlq-consumer. Returns true ONLY when:
+ *   1. The body parses cleanly against schemaFailureDlqEntrySchema, AND
+ *   2. consumerVersion is present and starts with the trusted prefix.
+ *
+ * The prefix is the contract — whoever owns publishing to the DLQ
+ * controls it. fs-usage-consumer stamps it via env.CONSUMER_VERSION
+ * and the prefix is hardcoded both here and in the consumer's
+ * dlq-helper.ts. A drifted consumer is the one regression risk.
+ */
+export declare const TRUSTED_DLQ_CONSUMER_VERSION_PREFIX = "fs-usage-consumer/";
+export declare function isTrustedSchemaFailureDlqEntry(body: unknown): body is SchemaFailureDlqEntry;
+//# sourceMappingURL=dlq.d.ts.map

package/node_modules/@farther-shore/shared-types/dist/dlq.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dlq.d.ts","sourceRoot":"","sources":["../src/dlq.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAE5D;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;;;;;;;;;;iBAyBtC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACH,eAAO,MAAM,mCAAmC,uBAAuB,CAAC;AAExE,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,IAAI,qBAAqB,CAM3F"}