@intutic/shared-types 0.1.0

package/.dist/errors.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Shared error codes and error class for the Intutic platform.
+ *
+ * All services throw `IntuticError` instances so that HTTP handlers can
+ * reliably extract `code`, `statusCode`, and `details` for structured
+ * error responses.
+ *
+ * @module
+ */
+/** Resource not found. */
+export declare const E_NOT_FOUND: "E_NOT_FOUND";
+/** Missing or invalid authentication credentials. */
+export declare const E_UNAUTHORIZED: "E_UNAUTHORIZED";
+/** Authenticated but insufficient permissions. */
+export declare const E_FORBIDDEN: "E_FORBIDDEN";
+/** Budget limit exceeded — HLD §3.6 FinOps guardrail. */
+export declare const E_BUDGET_EXCEEDED: "E_BUDGET_EXCEEDED";
+/** Request rate limit exceeded. */
+export declare const E_RATE_LIMITED: "E_RATE_LIMITED";
+/** Attempted UPDATE/DELETE on an append-only table (e.g., execution_traces). */
+export declare const E_APPEND_ONLY_VIOLATION: "E_APPEND_ONLY_VIOLATION";
+/** High-risk plan approval requires a human-written rationale (EU AI Act Art. 14). */
+export declare const E_APPROVAL_RATIONALE_REQUIRED: "E_APPROVAL_RATIONALE_REQUIRED";
+/** Request payload failed Zod schema validation. */
+export declare const E_VALIDATION_FAILED: "E_VALIDATION_FAILED";
+/** Stripe/billing checkout disabled or unavailable. */
+export declare const E_CHECKOUT_DISABLED: "CHECKOUT_DISABLED";
+/** Workspace already on the requested tier. */
+export declare const E_ALREADY_ON_TIER: "ALREADY_ON_TIER";
+/** Stripe API error. */
+export declare const E_STRIPE_ERROR: "STRIPE_ERROR";
+/** Webhook signature validation failed. */
+export declare const E_SIGNATURE_INVALID: "SIGNATURE_INVALID";
+/** Email already registered. */
+export declare const E_EMAIL_ALREADY_EXISTS: "EMAIL_ALREADY_EXISTS";
+/** OAuth flow failure. */
+export declare const E_OAUTH_FAILED: "OAUTH_FAILED";
+/** Token is invalid or malformed. */
+export declare const E_TOKEN_INVALID: "TOKEN_INVALID";
+/** Token has expired. */
+export declare const E_TOKEN_EXPIRED: "TOKEN_EXPIRED";
+/** Resource is already in the target state. */
+export declare const E_ALREADY_VERIFIED: "ALREADY_VERIFIED";
+/** Workspace free trial has expired. */
+export declare const E_TRIAL_EXPIRED: "TRIAL_EXPIRED";
+/** Generic validation failure (legacy alias). */
+export declare const E_VALIDATION: "E_VALIDATION";
+/** SSO is not configured or disabled for this workspace. */
+export declare const E_SSO_DISABLED: "SSO_DISABLED";
+/** SSO user has no workspace membership. */
+export declare const E_SSO_NO_MEMBERSHIP: "SSO_NO_MEMBERSHIP";
+/** OIDC state parameter is invalid or expired. */
+export declare const E_OIDC_INVALID_STATE: "OIDC_INVALID_STATE";
+/** OIDC token exchange with the IdP failed. */
+export declare const E_OIDC_TOKEN_EXCHANGE_FAILED: "OIDC_TOKEN_EXCHANGE_FAILED";
+/** Required claims missing from OIDC id_token. */
+export declare const E_OIDC_CLAIMS_MISSING: "OIDC_CLAIMS_MISSING";
+/** SSO provider exists but is disabled. */
+export declare const E_PROVIDER_DISABLED: "PROVIDER_DISABLED";
+/** Cannot delete provider — active members are using it. */
+export declare const E_PROVIDER_IN_USE: "PROVIDER_IN_USE";
+/** SCIM bearer token authentication failed. */
+export declare const E_SCIM_AUTH_FAILED: "SCIM_AUTH_FAILED";
+/** SCIM resource already exists (duplicate externalId). */
+export declare const E_SCIM_DUPLICATE: "SCIM_DUPLICATE";
+/** Offboarding cascade is already running for this user. */
+export declare const E_OFFBOARDING_IN_PROGRESS: "OFFBOARDING_IN_PROGRESS";
+/** Feature is not available on the current plan tier. */
+export declare const E_FEATURE_NOT_AVAILABLE: "FEATURE_NOT_AVAILABLE";
+/**
+ * Union of all Intutic error code constants.
+ *
+ * Use this type to constrain error handling branches:
+ * ```ts
+ * function handle(code: IntuticErrorCode) { ... }
+ * ```
+ */
+export type IntuticErrorCode = typeof E_NOT_FOUND | typeof E_UNAUTHORIZED | typeof E_FORBIDDEN | typeof E_BUDGET_EXCEEDED | typeof E_RATE_LIMITED | typeof E_APPEND_ONLY_VIOLATION | typeof E_APPROVAL_RATIONALE_REQUIRED | typeof E_VALIDATION_FAILED | typeof E_CHECKOUT_DISABLED | typeof E_ALREADY_ON_TIER | typeof E_STRIPE_ERROR | typeof E_SIGNATURE_INVALID | typeof E_EMAIL_ALREADY_EXISTS | typeof E_OAUTH_FAILED | typeof E_TOKEN_INVALID | typeof E_TOKEN_EXPIRED | typeof E_ALREADY_VERIFIED | typeof E_TRIAL_EXPIRED | typeof E_VALIDATION | typeof E_SSO_DISABLED | typeof E_SSO_NO_MEMBERSHIP | typeof E_OIDC_INVALID_STATE | typeof E_OIDC_TOKEN_EXCHANGE_FAILED | typeof E_OIDC_CLAIMS_MISSING | typeof E_PROVIDER_DISABLED | typeof E_PROVIDER_IN_USE | typeof E_SCIM_AUTH_FAILED | typeof E_SCIM_DUPLICATE | typeof E_OFFBOARDING_IN_PROGRESS | typeof E_FEATURE_NOT_AVAILABLE;
+/**
+ * Structured error class used across all Intutic services.
+ *
+ * Every error carries a machine-readable `code`, an HTTP `statusCode`,
+ * and optional `details` for diagnostics.
+ *
+ * @example
+ * ```typescript
+ * import { IntuticError, E_BUDGET_EXCEEDED } from '@intutic/shared-types'
+ *
+ * throw new IntuticError(
+ *   E_BUDGET_EXCEEDED,
+ *   402,
+ *   'Monthly budget of $500.00 exceeded',
+ *   { currentSpend: 512.34, limit: 500.00 }
+ * )
+ * ```
+ */
+export declare class IntuticError extends Error {
+    /** Machine-readable error code (e.g., `E_BUDGET_EXCEEDED`). */
+    readonly code: IntuticErrorCode;
+    /** HTTP status code to return (e.g., 402, 403, 404). */
+    readonly statusCode: number;
+    /** Optional structured details for diagnostics. */
+    readonly details?: Record<string, unknown>;
+    constructor(code: IntuticErrorCode, statusCode: number, message: string, details?: Record<string, unknown>);
+}
+//# sourceMappingURL=errors.d.ts.map

package/.dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,0BAA0B;AAC1B,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,qDAAqD;AACrD,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AAEvD,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAG,aAAsB,CAAA;AAEjD,yDAAyD;AACzD,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACnC,eAAO,MAAM,cAAc,EAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AAChF,eAAO,MAAM,uBAAuB,EAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACtF,eAAO,MAAM,6BAA6B,EAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACpD,eAAO,MAAM,mBAAmB,EAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AACvD,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACxB,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,gCAAgC;AAChC,eAAO,MAAM,sBAAsB,EAAG,sBAA+B,CAAA;AAErE,0BAA0B;AAC1B,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,qCAAqC;AACrC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACzB,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAE7D,wCAAwC;AACxC,eAAO,MAAM,eAAe,EAAG,eAAwB,CAAA;AAEvD,iDAAiD;AACjD,eAAO,MAAM,YAAY,EAAG,cAAuB,CAAA;AAInD,4DAA4D;AAC5D,eAAO,MAAM,cAAc,EAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AAClD,eAAO,MAAM,oBAAoB,EAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAC/C,eAAO,MAAM,4BAA4B,EAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AAClD,eAAO,MAAM,qBAAqB,EAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC3C,eAAO,MAAM,mBAAmB,EAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC5D,eAAO,MAAM,iBAAiB,EAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,kBAAkB,EAAG,kBAA2B,CAAA;AAE7D,2DAA2D;AAC3D,eAAO,MAAM,gBAAgB,EAAG,gBAAyB,CAAA;AAEzD,4DAA4D;AAC5D,eAAO,MAAM,yBAAyB,EAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AACzD,eAAO,MAAM,uBAAuB,EAAG,uBAAgC,CAAA;AAEvE;;;;;;;GAOG;AACH,MAAM,MAAM,gBAAgB,GACxB,OAAO,WAAW,GAClB,OAAO,cAAc,GACrB,OAAO,WAAW,GAClB,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,uBAAuB,GAC9B,OAAO,6BAA6B,GACpC,OAAO,mBAAmB,GAC1B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,sBAAsB,GAC7B,OAAO,cAAc,GACrB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,kBAAkB,GACzB,OAAO,eAAe,GACtB,OAAO,YAAY,GAEnB,OAAO,cAAc,GACrB,OAAO,mBAAmB,GAC1B,OAAO,oBAAoB,GAC3B,OAAO,4BAA4B,GACnC,OAAO,qBAAqB,GAC5B,OAAO,mBAAmB,GAC1B,OAAO,iBAAiB,GACxB,OAAO,kBAAkB,GACzB,OAAO,gBAAgB,GACvB,OAAO,yBAAyB,GAChC,OAAO,uBAAuB,CAAA;AAIlC;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;IAE/B,wDAAwD;IACxD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAE3B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQpC"}

package/.dist/errors.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * Shared error codes and error class for the Intutic platform.
+ *
+ * All services throw `IntuticError` instances so that HTTP handlers can
+ * reliably extract `code`, `statusCode`, and `details` for structured
+ * error responses.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IntuticError = exports.E_FEATURE_NOT_AVAILABLE = exports.E_OFFBOARDING_IN_PROGRESS = exports.E_SCIM_DUPLICATE = exports.E_SCIM_AUTH_FAILED = exports.E_PROVIDER_IN_USE = exports.E_PROVIDER_DISABLED = exports.E_OIDC_CLAIMS_MISSING = exports.E_OIDC_TOKEN_EXCHANGE_FAILED = exports.E_OIDC_INVALID_STATE = exports.E_SSO_NO_MEMBERSHIP = exports.E_SSO_DISABLED = exports.E_VALIDATION = exports.E_TRIAL_EXPIRED = exports.E_ALREADY_VERIFIED = exports.E_TOKEN_EXPIRED = exports.E_TOKEN_INVALID = exports.E_OAUTH_FAILED = exports.E_EMAIL_ALREADY_EXISTS = exports.E_SIGNATURE_INVALID = exports.E_STRIPE_ERROR = exports.E_ALREADY_ON_TIER = exports.E_CHECKOUT_DISABLED = exports.E_VALIDATION_FAILED = exports.E_APPROVAL_RATIONALE_REQUIRED = exports.E_APPEND_ONLY_VIOLATION = exports.E_RATE_LIMITED = exports.E_BUDGET_EXCEEDED = exports.E_FORBIDDEN = exports.E_UNAUTHORIZED = exports.E_NOT_FOUND = void 0;
+// ─── Error Code Constants ────────────────────────────────────────────
+/** Resource not found. */
+exports.E_NOT_FOUND = 'E_NOT_FOUND';
+/** Missing or invalid authentication credentials. */
+exports.E_UNAUTHORIZED = 'E_UNAUTHORIZED';
+/** Authenticated but insufficient permissions. */
+exports.E_FORBIDDEN = 'E_FORBIDDEN';
+/** Budget limit exceeded — HLD §3.6 FinOps guardrail. */
+exports.E_BUDGET_EXCEEDED = 'E_BUDGET_EXCEEDED';
+/** Request rate limit exceeded. */
+exports.E_RATE_LIMITED = 'E_RATE_LIMITED';
+/** Attempted UPDATE/DELETE on an append-only table (e.g., execution_traces). */
+exports.E_APPEND_ONLY_VIOLATION = 'E_APPEND_ONLY_VIOLATION';
+/** High-risk plan approval requires a human-written rationale (EU AI Act Art. 14). */
+exports.E_APPROVAL_RATIONALE_REQUIRED = 'E_APPROVAL_RATIONALE_REQUIRED';
+/** Request payload failed Zod schema validation. */
+exports.E_VALIDATION_FAILED = 'E_VALIDATION_FAILED';
+/** Stripe/billing checkout disabled or unavailable. */
+exports.E_CHECKOUT_DISABLED = 'CHECKOUT_DISABLED';
+/** Workspace already on the requested tier. */
+exports.E_ALREADY_ON_TIER = 'ALREADY_ON_TIER';
+/** Stripe API error. */
+exports.E_STRIPE_ERROR = 'STRIPE_ERROR';
+/** Webhook signature validation failed. */
+exports.E_SIGNATURE_INVALID = 'SIGNATURE_INVALID';
+/** Email already registered. */
+exports.E_EMAIL_ALREADY_EXISTS = 'EMAIL_ALREADY_EXISTS';
+/** OAuth flow failure. */
+exports.E_OAUTH_FAILED = 'OAUTH_FAILED';
+/** Token is invalid or malformed. */
+exports.E_TOKEN_INVALID = 'TOKEN_INVALID';
+/** Token has expired. */
+exports.E_TOKEN_EXPIRED = 'TOKEN_EXPIRED';
+/** Resource is already in the target state. */
+exports.E_ALREADY_VERIFIED = 'ALREADY_VERIFIED';
+/** Workspace free trial has expired. */
+exports.E_TRIAL_EXPIRED = 'TRIAL_EXPIRED';
+/** Generic validation failure (legacy alias). */
+exports.E_VALIDATION = 'E_VALIDATION';
+// ─── Identity Federation Error Codes (LLD #11) ─────────────────────
+/** SSO is not configured or disabled for this workspace. */
+exports.E_SSO_DISABLED = 'SSO_DISABLED';
+/** SSO user has no workspace membership. */
+exports.E_SSO_NO_MEMBERSHIP = 'SSO_NO_MEMBERSHIP';
+/** OIDC state parameter is invalid or expired. */
+exports.E_OIDC_INVALID_STATE = 'OIDC_INVALID_STATE';
+/** OIDC token exchange with the IdP failed. */
+exports.E_OIDC_TOKEN_EXCHANGE_FAILED = 'OIDC_TOKEN_EXCHANGE_FAILED';
+/** Required claims missing from OIDC id_token. */
+exports.E_OIDC_CLAIMS_MISSING = 'OIDC_CLAIMS_MISSING';
+/** SSO provider exists but is disabled. */
+exports.E_PROVIDER_DISABLED = 'PROVIDER_DISABLED';
+/** Cannot delete provider — active members are using it. */
+exports.E_PROVIDER_IN_USE = 'PROVIDER_IN_USE';
+/** SCIM bearer token authentication failed. */
+exports.E_SCIM_AUTH_FAILED = 'SCIM_AUTH_FAILED';
+/** SCIM resource already exists (duplicate externalId). */
+exports.E_SCIM_DUPLICATE = 'SCIM_DUPLICATE';
+/** Offboarding cascade is already running for this user. */
+exports.E_OFFBOARDING_IN_PROGRESS = 'OFFBOARDING_IN_PROGRESS';
+/** Feature is not available on the current plan tier. */
+exports.E_FEATURE_NOT_AVAILABLE = 'FEATURE_NOT_AVAILABLE';
+// ─── Error Class ─────────────────────────────────────────────────────
+/**
+ * Structured error class used across all Intutic services.
+ *
+ * Every error carries a machine-readable `code`, an HTTP `statusCode`,
+ * and optional `details` for diagnostics.
+ *
+ * @example
+ * ```typescript
+ * import { IntuticError, E_BUDGET_EXCEEDED } from '@intutic/shared-types'
+ *
+ * throw new IntuticError(
+ *   E_BUDGET_EXCEEDED,
+ *   402,
+ *   'Monthly budget of $500.00 exceeded',
+ *   { currentSpend: 512.34, limit: 500.00 }
+ * )
+ * ```
+ */
+class IntuticError extends Error {
+    /** Machine-readable error code (e.g., `E_BUDGET_EXCEEDED`). */
+    code;
+    /** HTTP status code to return (e.g., 402, 403, 404). */
+    statusCode;
+    /** Optional structured details for diagnostics. */
+    details;
+    constructor(code, statusCode, message, details) {
+        super(message);
+        this.name = 'IntuticError';
+        this.code = code;
+        this.statusCode = statusCode;
+        this.details = details;
+    }
+}
+exports.IntuticError = IntuticError;
+//# sourceMappingURL=errors.js.map

package/.dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAEH,wEAAwE;AAExE,0BAA0B;AACb,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,qDAAqD;AACxC,QAAA,cAAc,GAAG,gBAAyB,CAAA;AAEvD,kDAAkD;AACrC,QAAA,WAAW,GAAG,aAAsB,CAAA;AAEjD,yDAAyD;AAC5C,QAAA,iBAAiB,GAAG,mBAA4B,CAAA;AAE7D,mCAAmC;AACtB,QAAA,cAAc,GAAG,gBAAyB,CAAA;AAEvD,gFAAgF;AACnE,QAAA,uBAAuB,GAAG,yBAAkC,CAAA;AAEzE,sFAAsF;AACzE,QAAA,6BAA6B,GAAG,+BAAwC,CAAA;AAErF,oDAAoD;AACvC,QAAA,mBAAmB,GAAG,qBAA8B,CAAA;AAEjE,uDAAuD;AAC1C,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,+CAA+C;AAClC,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,wBAAwB;AACX,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,gCAAgC;AACnB,QAAA,sBAAsB,GAAG,sBAA+B,CAAA;AAErE,0BAA0B;AACb,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,qCAAqC;AACxB,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,yBAAyB;AACZ,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,+CAA+C;AAClC,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D,wCAAwC;AAC3B,QAAA,eAAe,GAAG,eAAwB,CAAA;AAEvD,iDAAiD;AACpC,QAAA,YAAY,GAAG,cAAuB,CAAA;AAEnD,sEAAsE;AAEtE,4DAA4D;AAC/C,QAAA,cAAc,GAAG,cAAuB,CAAA;AAErD,4CAA4C;AAC/B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,kDAAkD;AACrC,QAAA,oBAAoB,GAAG,oBAA6B,CAAA;AAEjE,+CAA+C;AAClC,QAAA,4BAA4B,GAAG,4BAAqC,CAAA;AAEjF,kDAAkD;AACrC,QAAA,qBAAqB,GAAG,qBAA8B,CAAA;AAEnE,2CAA2C;AAC9B,QAAA,mBAAmB,GAAG,mBAA4B,CAAA;AAE/D,4DAA4D;AAC/C,QAAA,iBAAiB,GAAG,iBAA0B,CAAA;AAE3D,+CAA+C;AAClC,QAAA,kBAAkB,GAAG,kBAA2B,CAAA;AAE7D,2DAA2D;AAC9C,QAAA,gBAAgB,GAAG,gBAAyB,CAAA;AAEzD,4DAA4D;AAC/C,QAAA,yBAAyB,GAAG,yBAAkC,CAAA;AAE3E,yDAAyD;AAC5C,QAAA,uBAAuB,GAAG,uBAAgC,CAAA;AA2CvE,wEAAwE;AAExE;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAa,YAAa,SAAQ,KAAK;IACrC,+DAA+D;IACtD,IAAI,CAAkB;IAE/B,wDAAwD;IAC/C,UAAU,CAAQ;IAE3B,mDAAmD;IAC1C,OAAO,CAA0B;IAE1C,YACE,IAAsB,EACtB,UAAkB,EAClB,OAAe,EACf,OAAiC;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;QAC1B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;QAC5B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,CAAC;CACF;AAtBD,oCAsBC"}

package/.dist/finops.d.ts

@@ -0,0 +1,117 @@
+/**
+ * FinOps ledger types for cost tracking and attribution.
+ *
+ * These types correspond to the `execution_traces` table and the
+ * `finops_attribution_4d` materialized view defined in
+ * LLD 01-data-architecture §3.1.
+ *
+ * HLD §3.6 (FinOps Ledger), §3.19 (4D Attribution)
+ *
+ * @module
+ */
+import type { AnomalyType, EnforcementAction, RoutingTier, TokenUtility } from './enums.js';
+/**
+ * A single row in the `execution_traces` table — the append-only FinOps ledger.
+ *
+ * This is the canonical financial audit trail for every LLM call flowing
+ * through the platform. INSERT only; UPDATE and DELETE are forbidden by
+ * a database trigger.
+ *
+ * LLD §3.1 — execution_traces table definition
+ */
+export interface TraceEntry {
+    /** Unique trace identifier — `newId('tr')`. */
+    traceId: string;
+    /** Session that produced this trace — FK to `agent_sessions`. */
+    sessionId: string;
+    /** Idempotency key — UNIQUE constraint. */
+    requestId: string;
+    /** Timestamp of the trace event. */
+    timestamp: string;
+    /** Effective date of the SOP governing this call. */
+    sopEffectiveDate: string;
+    /** Model requested by the agent/user. */
+    requestedModel: string;
+    /** Model actually routed to after complexity scoring. */
+    actualModelRouted: string;
+    /** Routing tier for this call. */
+    routingTier: RoutingTier;
+    /** Complexity score used for routing (0.0–1.0). */
+    complexityScore: number;
+    /** Raw input tokens before compression. */
+    rawInputTokens: number;
+    /** Input tokens after compression. */
+    compressedInputTokens: number;
+    /** Output tokens generated. */
+    outputTokens: number;
+    /** Cost at the raw model rate (USD). */
+    rawCostUsd: number;
+    /** Actual cost after routing optimization (USD). */
+    actualCostUsd: number;
+    /** Savings from routing optimization (USD) — generated column. */
+    savingsUsd: number;
+    /** Whether the token spend was useful or wasted. */
+    tokenUtility: TokenUtility;
+    /** Utility confidence score (0.0–1.0). */
+    tokenUtilityScore: number;
+    /** Compliance score from policy evaluation (0.0–1.0). */
+    complianceScore: number;
+    /** Enforcement action applied to this call. */
+    enforcementAction: EnforcementAction;
+    /** Detected anomaly type, if any. */
+    anomalyDetected: AnomalyType | null;
+    /** Anomaly detection confidence score (0.0–1.0). */
+    anomalyConfidenceScore: number | null;
+    /** Additional anomaly taxonomy metadata. */
+    taxonomyMetadata: Record<string, unknown> | null;
+    /** Raw request/response payload for audit. SENSITIVE. */
+    rawPayloadJson: Record<string, unknown> | null;
+    /** Application identifier for attribution. */
+    appId: string | null;
+    /** Agent chain identifier for attribution. */
+    agentChainId: string | null;
+    /** Full agent delegation chain (JSON). */
+    agentChain: Record<string, unknown> | null;
+    /** Whether this call was served from cache. */
+    cacheHit: boolean;
+    /** Savings from cache hit (USD). */
+    cacheSavingsUsd: number;
+    /** Structured root cause attribution for anomalies. */
+    rootCauseAttribution: Record<string, unknown> | null;
+    /** Corrective prompt card generated for this anomaly. */
+    correctivePromptCard: Record<string, unknown> | null;
+}
+/**
+ * Summarized cost breakdown for a session, workspace, or time window.
+ *
+ * HLD §3.6 — FinOps cost accounting
+ */
+export interface CostBreakdown {
+    /** Cost at raw model rates (USD). */
+    rawCost: number;
+    /** Actual cost after optimization (USD). */
+    actualCost: number;
+    /** Total savings from model routing (USD). */
+    savings: number;
+    /** Total savings from cache hits (USD). */
+    cacheSavings: number;
+}
+/**
+ * Four-dimensional attribution key for FinOps rollup.
+ *
+ * Maps to the `finops_attribution_4d` materialized view's grouping dimensions:
+ * Person × Harness × App × Agent Chain.
+ *
+ * HLD §3.19, LLD §3.1 — finops_attribution_4d materialized view
+ */
+export interface Attribution4D {
+    /** User/person identifier. */
+    personId: string;
+    /** Harness/IDE type that produced the cost. */
+    harnessType: string;
+    /** Optional application identifier. */
+    appId?: string;
+    /** Optional agent chain identifier. */
+    agentChainId?: string;
+}
+//# sourceMappingURL=finops.d.ts.map

package/.dist/finops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finops.d.ts","sourceRoot":"","sources":["../src/finops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACb,MAAM,YAAY,CAAA;AAInB;;;;;;;;GAQG;AACH,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IAEf,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAA;IAEjB,2CAA2C;IAC3C,SAAS,EAAE,MAAM,CAAA;IAEjB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;IAEjB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,CAAA;IAGxB,yCAAyC;IACzC,cAAc,EAAE,MAAM,CAAA;IAEtB,yDAAyD;IACzD,iBAAiB,EAAE,MAAM,CAAA;IAEzB,kCAAkC;IAClC,WAAW,EAAE,WAAW,CAAA;IAExB,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAA;IAGvB,2CAA2C;IAC3C,cAAc,EAAE,MAAM,CAAA;IAEtB,sCAAsC;IACtC,qBAAqB,EAAE,MAAM,CAAA;IAE7B,+BAA+B;IAC/B,YAAY,EAAE,MAAM,CAAA;IAGpB,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAA;IAElB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAA;IAErB,kEAAkE;IAClE,UAAU,EAAE,MAAM,CAAA;IAGlB,oDAAoD;IACpD,YAAY,EAAE,YAAY,CAAA;IAE1B,0CAA0C;IAC1C,iBAAiB,EAAE,MAAM,CAAA;IAGzB,yDAAyD;IACzD,eAAe,EAAE,MAAM,CAAA;IAEvB,+CAA+C;IAC/C,iBAAiB,EAAE,iBAAiB,CAAA;IAGpC,qCAAqC;IACrC,eAAe,EAAE,WAAW,GAAG,IAAI,CAAA;IAEnC,oDAAoD;IACpD,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IAErC,4CAA4C;IAC5C,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAGhD,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAG9C,8CAA8C;IAC9C,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAEpB,8CAA8C;IAC9C,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3B,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAG1C,+CAA+C;IAC/C,QAAQ,EAAE,OAAO,CAAA;IAEjB,oCAAoC;IACpC,eAAe,EAAE,MAAM,CAAA;IAGvB,uDAAuD;IACvD,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAEpD,yDAAyD;IACzD,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CACrD;AAID;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAA;IAEf,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAA;IAEf,2CAA2C;IAC3C,YAAY,EAAE,MAAM,CAAA;CACrB;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAA;IAEnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB"}

package/.dist/finops.js

@@ -0,0 +1,14 @@
+"use strict";
+/**
+ * FinOps ledger types for cost tracking and attribution.
+ *
+ * These types correspond to the `execution_traces` table and the
+ * `finops_attribution_4d` materialized view defined in
+ * LLD 01-data-architecture §3.1.
+ *
+ * HLD §3.6 (FinOps Ledger), §3.19 (4D Attribution)
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=finops.js.map

package/.dist/finops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finops.js","sourceRoot":"","sources":["../src/finops.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG"}

package/.dist/identity.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Identity Federation types — LLD #11
+ *
+ * Cross-workspace user identity, SSO/OIDC provider configuration,
+ * SCIM 2.0 provisioning resources, and offboarding cascade types.
+ *
+ * @module
+ */
+import { z } from 'zod';
+export interface User {
+    userId: string;
+    email: string;
+    displayName: string | null;
+    avatarUrl: string | null;
+    authProvider: 'email' | 'okta' | 'entra_id';
+    externalId: string | null;
+    isActive: boolean;
+    lastLoginAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface UserInfo {
+    userId: string;
+    email: string;
+    displayName: string | null;
+    avatarUrl: string | null;
+    authProvider: string;
+    isActive: boolean;
+    lastLoginAt: string | null;
+    createdAt: string;
+}
+export interface SsoProvider {
+    providerId: string;
+    workspaceId: string;
+    name: string;
+    type: 'okta' | 'entra_id';
+    issuer: string;
+    clientId: string;
+    scopes: string[];
+    autoProvision: boolean;
+    defaultRole: string;
+    isEnabled: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const CreateSsoProviderSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodEnum<["okta", "entra_id"]>;
+    issuer: z.ZodString;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    autoProvision: z.ZodDefault<z.ZodBoolean>;
+    defaultRole: z.ZodDefault<z.ZodEnum<["ADMIN", "EM", "DEVELOPER", "VIEWER"]>>;
+}, "strip", z.ZodTypeAny, {
+    type: "okta" | "entra_id";
+    scopes: string[];
+    name: string;
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    autoProvision: boolean;
+    defaultRole: "ADMIN" | "EM" | "DEVELOPER" | "VIEWER";
+}, {
+    type: "okta" | "entra_id";
+    name: string;
+    issuer: string;
+    clientId: string;
+    clientSecret: string;
+    scopes?: string[] | undefined;
+    autoProvision?: boolean | undefined;
+    defaultRole?: "ADMIN" | "EM" | "DEVELOPER" | "VIEWER" | undefined;
+}>;
+export type CreateSsoProviderInput = z.infer<typeof CreateSsoProviderSchema>;
+export interface OidcClaims {
+    sub: string;
+    email: string;
+    email_verified?: boolean;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    picture?: string;
+    groups?: string[];
+    iss: string;
+    aud: string | string[];
+    exp: number;
+    iat: number;
+    nonce?: string;
+}
+export interface ScimUserResource {
+    schemas: string[];
+    id?: string;
+    externalId?: string;
+    userName: string;
+    name?: {
+        givenName?: string;
+        familyName?: string;
+        formatted?: string;
+    };
+    emails?: Array<{
+        value: string;
+        primary?: boolean;
+        type?: string;
+    }>;
+    active?: boolean;
+    groups?: Array<{
+        value: string;
+        display?: string;
+    }>;
+    meta?: {
+        resourceType?: string;
+        created?: string;
+        lastModified?: string;
+        location?: string;
+    };
+}
+export interface ScimListResponse {
+    schemas: ['urn:ietf:params:scim:api:messages:2.0:ListResponse'];
+    totalResults: number;
+    startIndex: number;
+    itemsPerPage: number;
+    Resources: ScimUserResource[];
+}
+export interface ScimPatchOp {
+    schemas: ['urn:ietf:params:scim:api:messages:2.0:PatchOp'];
+    Operations: Array<{
+        op: 'add' | 'replace' | 'remove';
+        path?: string;
+        value?: unknown;
+    }>;
+}
+export interface OffboardingStepResult {
+    step: 1 | 2 | 3 | 4 | 5 | 6 | 7;
+    name: string;
+    status: 'completed' | 'failed' | 'skipped';
+    detail: Record<string, unknown>;
+    durationMs: number;
+}
+export interface OffboardingResult {
+    userId: string;
+    memberId: string;
+    workspaceId: string;
+    steps: OffboardingStepResult[];
+    totalDurationMs: number;
+    completedAt: string;
+}
+export declare const UpdateUserProfileSchema: z.ZodObject<{
+    displayName: z.ZodOptional<z.ZodString>;
+    avatarUrl: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    displayName?: string | undefined;
+    avatarUrl?: string | undefined;
+}, {
+    displayName?: string | undefined;
+    avatarUrl?: string | undefined;
+}>;
+export type UpdateUserProfileInput = z.infer<typeof UpdateUserProfileSchema>;
+export interface ScimTokenInfo {
+    tokenId: string;
+    workspaceId: string;
+    label: string | null;
+    expiresAt: string | null;
+    createdAt: string;
+}
+export declare const CreateScimTokenSchema: z.ZodObject<{
+    label: z.ZodOptional<z.ZodString>;
+    expiresInDays: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    label?: string | undefined;
+    expiresInDays?: number | undefined;
+}, {
+    label?: string | undefined;
+    expiresInDays?: number | undefined;
+}>;
+export type CreateScimTokenInput = z.infer<typeof CreateScimTokenSchema>;
+//# sourceMappingURL=identity.d.ts.map

package/.dist/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB,MAAM,WAAW,IAAI;IACnB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,OAAO,GAAG,MAAM,GAAG,UAAU,CAAA;IAC3C,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,aAAa,EAAE,OAAO,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;EASlC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAI5E,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACtB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE;QACL,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnE,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACnD,IAAI,CAAC,EAAE;QACL,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB,QAAQ,CAAC,EAAE,MAAM,CAAA;KAClB,CAAA;CACF;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,CAAC,oDAAoD,CAAC,CAAA;IAC/D,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,gBAAgB,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,+CAA+C,CAAC,CAAA;IAC1D,UAAU,EAAE,KAAK,CAAC;QAChB,EAAE,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAA;QAChC,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,KAAK,CAAC,EAAE,OAAO,CAAA;KAChB,CAAC,CAAA;CACH;AAID,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAA;IAC1C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,qBAAqB,EAAE,CAAA;IAC9B,eAAe,EAAE,MAAM,CAAA;IACvB,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,eAAO,MAAM,uBAAuB;;;;;;;;;EAGlC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAI5E,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;EAGhC,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA"}

package/.dist/identity.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * Identity Federation types — LLD #11
+ *
+ * Cross-workspace user identity, SSO/OIDC provider configuration,
+ * SCIM 2.0 provisioning resources, and offboarding cascade types.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateScimTokenSchema = exports.UpdateUserProfileSchema = exports.CreateSsoProviderSchema = void 0;
+const zod_1 = require("zod");
+exports.CreateSsoProviderSchema = zod_1.z.object({
+    name: zod_1.z.string().min(1).max(255),
+    type: zod_1.z.enum(['okta', 'entra_id']),
+    issuer: zod_1.z.string().url(),
+    clientId: zod_1.z.string().min(1),
+    clientSecret: zod_1.z.string().min(1),
+    scopes: zod_1.z.array(zod_1.z.string()).default(['openid', 'profile', 'email']),
+    autoProvision: zod_1.z.boolean().default(false),
+    defaultRole: zod_1.z.enum(['ADMIN', 'EM', 'DEVELOPER', 'VIEWER']).default('DEVELOPER'),
+});
+// ── User management ──
+exports.UpdateUserProfileSchema = zod_1.z.object({
+    displayName: zod_1.z.string().min(1).max(255).optional(),
+    avatarUrl: zod_1.z.string().url().optional(),
+});
+exports.CreateScimTokenSchema = zod_1.z.object({
+    label: zod_1.z.string().min(1).max(255).optional(),
+    expiresInDays: zod_1.z.number().int().min(1).max(365).optional(),
+});
+//# sourceMappingURL=identity.js.map

package/.dist/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAAuB;AA8CV,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACxB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACnE,aAAa,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACzC,WAAW,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;CACjF,CAAC,CAAA;AAgFF,wBAAwB;AAEX,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAA;AAaW,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAA"}

package/.dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @intutic/shared-types — Shared TypeScript types, interfaces, and enums
+ *
+ * This package is the single source of truth for all types used by 2+ packages
+ * in the Intutic monorepo. Never duplicate type definitions across services.
+ *
+ * @packageDocumentation
+ */
+export { RiskLevel, EnforcementAction, TokenUtility, BudgetTier, ComplexityTier, ChangeClassification, AnomalyType, HarnessType, ExecutionMode, IncidentStatus, PlanLifecycleState, SopLifecycleState, RoutingTier, WorkspaceRole, } from './enums.js';
+export type { PermissionSet, PolicyVerdict, DctToken, RiskCategory, InterventionMode, PluginVerdict, EvaluationCascadeResult, } from './policy.js';
+export type { TraceEntry, CostBreakdown, Attribution4D, } from './finops.js';
+export { ANOMALY_SEVERITY_MAP, } from './anomaly.js';
+export type { AnomalyEvent, AnomalyClassification, AnomalySeverity, CorrectivePromptCard, ProbeType, ProbeResult, TrustScoreResult, TrustScoreUpdate, TrustEvent, GovernanceIncidentStatus, CapabilityMissEvent, CapabilityMissInput, DriftDirection, DriftEvent, } from './anomaly.js';
+export type { Session, SessionCheckpoint, } from './session.js';
+export type { Sop, SopProofTree, SopLifecycleTransition, SopHealthMetrics, DreamCycleQueueItem, DreamCycleEnqueueInput, GodelProbeResult, SopContentUpdate, SopLifecycleTransitionResult, CascadeImpactResult, CascadeInvalidationResult, AntiGamingResult, SopEdgeType, SopGraphEdge, DeviationType, PlanDeviation, PlanAdherenceScore, StoredPlan, DecisionRecommendation, DecisionMiningAnalysis, GodelGateResult, GodelScore, ProofTreeDiff, } from './sop.js';
+export { VALID_SOP_TRANSITIONS, ENFORCEMENT_BY_STATE, } from './sop.js';
+export { IntuticError, E_NOT_FOUND, E_UNAUTHORIZED, E_FORBIDDEN, E_BUDGET_EXCEEDED, E_RATE_LIMITED, E_APPEND_ONLY_VIOLATION, E_APPROVAL_RATIONALE_REQUIRED, E_VALIDATION_FAILED, E_SSO_DISABLED, E_SSO_NO_MEMBERSHIP, E_OIDC_INVALID_STATE, E_OIDC_TOKEN_EXCHANGE_FAILED, E_OIDC_CLAIMS_MISSING, E_PROVIDER_DISABLED, E_PROVIDER_IN_USE, E_SCIM_AUTH_FAILED, E_SCIM_DUPLICATE, E_OFFBOARDING_IN_PROGRESS, E_FEATURE_NOT_AVAILABLE, } from './errors.js';
+export type { IntuticErrorCode } from './errors.js';
+export { CreateSessionSchema, CreateTraceSchema, PolicyVerdictSchema, } from './api-contracts.js';
+export type { CreateSessionInput, CreateTraceInput, PolicyVerdictInput, } from './api-contracts.js';
+export { LoginInputSchema, RegisterInputSchema, RefreshInputSchema, ChangePasswordInputSchema, InviteMemberInputSchema, UpdateRoleInputSchema, CreateApiKeyInputSchema, } from './auth.js';
+export type { AuthContext, JwtPayload, LoginInput, LoginResult, RegisterInput, RegisterResult, RefreshResult, WorkspaceMemberInfo, InviteMemberInput, CreateApiKeyInput, CreateApiKeyResult, ApiKeyInfo, DashboardSummary, } from './auth.js';
+export { SopHashReportSchema, DaemonStatusSchema, } from './sync.js';
+export type { SyncSopEntry, SyncConfigPayload, SopFileHash, SopHashReport, DetectedHarness, DaemonStatus, IntuticCredentials, IntuticConfig, IntegrityStore, } from './sync.js';
+export { CreateSsoProviderSchema, UpdateUserProfileSchema, CreateScimTokenSchema, } from './identity.js';
+export type { User, UserInfo, SsoProvider, CreateSsoProviderInput, OidcClaims, ScimUserResource, ScimListResponse, ScimPatchOp, OffboardingStepResult, OffboardingResult, UpdateUserProfileInput, ScimTokenInfo, CreateScimTokenInput, } from './identity.js';
+//# sourceMappingURL=index.d.ts.map

package/.dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,SAAS,EACT,iBAAiB,EACjB,YAAY,EACZ,UAAU,EACV,cAAc,EACd,oBAAoB,EACpB,WAAW,EACX,WAAW,EACX,aAAa,EACb,cAAc,EACd,kBAAkB,EAClB,iBAAiB,EACjB,WAAW,EACX,aAAa,GACd,MAAM,YAAY,CAAA;AAEnB,YAAY,EACV,aAAa,EACb,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,gBAAgB,EAChB,aAAa,EACb,uBAAuB,GACxB,MAAM,aAAa,CAAA;AAEpB,YAAY,EACV,UAAU,EACV,aAAa,EACb,aAAa,GACd,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,oBAAoB,GACrB,MAAM,cAAc,CAAA;AAErB,YAAY,EACV,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,oBAAoB,EACpB,SAAS,EACT,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,UAAU,GACX,MAAM,cAAc,CAAA;AAErB,YAAY,EACV,OAAO,EACP,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAErB,YAAY,EACV,GAAG,EACH,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,4BAA4B,EAC5B,mBAAmB,EACnB,yBAAyB,EACzB,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,aAAa,EACb,aAAa,EACb,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,aAAa,GACd,MAAM,UAAU,CAAA;AAEjB,OAAO,EACL,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,UAAU,CAAA;AAEjB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,cAAc,EACd,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,uBAAuB,EACvB,6BAA6B,EAC7B,mBAAmB,EAEnB,cAAc,EACd,mBAAmB,EACnB,oBAAoB,EACpB,4BAA4B,EAC5B,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAA;AACpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAE3B,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,WAAW,CAAA;AAElB,YAAY,EACV,WAAW,EACX,UAAU,EACV,UAAU,EACV,WAAW,EACX,aAAa,EACb,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAElB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,WAAW,CAAA;AAElB,YAAY,EACV,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,aAAa,EACb,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,cAAc,GACf,MAAM,WAAW,CAAA;AAGlB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,eAAe,CAAA;AAEtB,YAAY,EACV,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,sBAAsB,EACtB,UAAU,EACV,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,oBAAoB,GACrB,MAAM,eAAe,CAAA"}