@intutic/shared-types 1.0.1

package/dist/auth.d.ts

@@ -0,0 +1,340 @@
+/**
+ * Auth + RBAC Types — Shared across control plane services.
+ *
+ * LLD #7 — Auth, RBAC, Dashboard API
+ * HLD §5.1 — Zero-Trust Perimeter
+ *
+ * @module
+ */
+import { z } from 'zod';
+import type { WorkspaceRole } from './enums.js';
+/**
+ * Auth context injected by middleware on every authenticated request.
+ * Available via `c.get('auth')` in Hono handlers.
+ */
+export interface AuthContext {
+    /** The workspace member ID (PK of workspace_members). */
+    memberId: string;
+    /** The workspace this member belongs to. */
+    workspaceId: string;
+    /** Display-facing email of the authenticated member. */
+    email: string;
+    /** RBAC role within the workspace. */
+    role: WorkspaceRole;
+    /** Cross-workspace user ID (LLD #11). Optional for pre-migration members. */
+    userId?: string;
+}
+/** JWT access token payload (compact claims). */
+export interface JwtPayload {
+    /** Subject — member_id */
+    sub: string;
+    /** Workspace ID */
+    wid: string;
+    /** RBAC role */
+    role: WorkspaceRole;
+    /** Issued at (epoch seconds) */
+    iat: number;
+    /** Expiry (epoch seconds) */
+    exp: number;
+}
+/** Login request schema (Zod validated). */
+export declare const LoginInputSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+}, {
+    email: string;
+    password: string;
+}>;
+/** Login request input. */
+export type LoginInput = z.infer<typeof LoginInputSchema>;
+/** Login response payload. */
+export interface LoginResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    member: WorkspaceMemberInfo;
+}
+/** Registration request schema (Zod validated). */
+export declare const RegisterInputSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    displayName: z.ZodString;
+    workspaceName: z.ZodString;
+    workspaceSlug: z.ZodString;
+    signupSource: z.ZodOptional<z.ZodString>;
+    marketingAttribution: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+    displayName: string;
+    workspaceName: string;
+    workspaceSlug: string;
+    signupSource?: string | undefined;
+    marketingAttribution?: Record<string, any> | undefined;
+}, {
+    email: string;
+    password: string;
+    displayName: string;
+    workspaceName: string;
+    workspaceSlug: string;
+    signupSource?: string | undefined;
+    marketingAttribution?: Record<string, any> | undefined;
+}>;
+/** Registration request input. */
+export type RegisterInput = z.infer<typeof RegisterInputSchema>;
+/** Registration response payload. */
+export interface RegisterResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+    member: WorkspaceMemberInfo;
+    workspaceId: string;
+}
+/** Token refresh request schema. */
+export declare const RefreshInputSchema: z.ZodObject<{
+    refreshToken: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    refreshToken: string;
+}, {
+    refreshToken: string;
+}>;
+/** Token refresh response. */
+export interface RefreshResult {
+    accessToken: string;
+    refreshToken: string;
+    expiresIn: number;
+}
+/** Change password request schema. */
+export declare const ChangePasswordInputSchema: z.ZodObject<{
+    currentPassword: z.ZodString;
+    newPassword: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    currentPassword: string;
+    newPassword: string;
+}, {
+    currentPassword: string;
+    newPassword: string;
+}>;
+/** Safe projection of a workspace member (no password hash). */
+export interface WorkspaceMemberInfo {
+    memberId: string;
+    workspaceId: string;
+    email: string;
+    displayName: string;
+    role: WorkspaceRole;
+    isActive: boolean;
+    lastLoginAt: string | null;
+    createdAt: string;
+}
+/** Invite member request schema. */
+export declare const InviteMemberInputSchema: z.ZodObject<{
+    email: z.ZodString;
+    displayName: z.ZodString;
+    role: z.ZodEnum<["ADMIN", "EM", "DEVELOPER", "VIEWER"]>;
+    tempPassword: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    displayName: string;
+    role: "ADMIN" | "EM" | "DEVELOPER" | "VIEWER";
+    tempPassword: string;
+}, {
+    email: string;
+    displayName: string;
+    role: "ADMIN" | "EM" | "DEVELOPER" | "VIEWER";
+    tempPassword: string;
+}>;
+/** Invite member input. */
+export type InviteMemberInput = z.infer<typeof InviteMemberInputSchema>;
+/** Update role request schema. */
+export declare const UpdateRoleInputSchema: z.ZodObject<{
+    role: z.ZodEnum<["OWNER", "ADMIN", "EM", "DEVELOPER", "VIEWER"]>;
+}, "strip", z.ZodTypeAny, {
+    role: "OWNER" | "ADMIN" | "EM" | "DEVELOPER" | "VIEWER";
+}, {
+    role: "OWNER" | "ADMIN" | "EM" | "DEVELOPER" | "VIEWER";
+}>;
+/** PLG signup input schema. */
+export declare const SignupInputSchema: z.ZodObject<{
+    email: z.ZodString;
+    password: z.ZodString;
+    name: z.ZodString;
+    workspaceName: z.ZodOptional<z.ZodString>;
+    signupSource: z.ZodOptional<z.ZodString>;
+    marketingAttribution: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+    password: string;
+    name: string;
+    workspaceName?: string | undefined;
+    signupSource?: string | undefined;
+    marketingAttribution?: Record<string, any> | undefined;
+}, {
+    email: string;
+    password: string;
+    name: string;
+    workspaceName?: string | undefined;
+    signupSource?: string | undefined;
+    marketingAttribution?: Record<string, any> | undefined;
+}>;
+/** PLG signup params type. */
+export type SignupParams = z.infer<typeof SignupInputSchema>;
+/** PLG signup result. */
+export interface SignupResult {
+    user: {
+        id: string;
+        email: string;
+        name: string;
+        emailVerified: boolean;
+    };
+    workspace: {
+        id: string;
+        name: string;
+        planTier: string;
+        trialExpiresAt: string;
+    };
+    accessToken: string;
+    refreshToken: string;
+    cliInstall: string;
+    isNewUser: boolean;
+}
+/** Verify email input schema. */
+export declare const VerifyEmailInputSchema: z.ZodObject<{
+    token: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    token: string;
+}, {
+    token: string;
+}>;
+/** Resend verification email input schema. */
+export declare const ResendVerificationInputSchema: z.ZodObject<{
+    email: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+}, {
+    email: string;
+}>;
+/** Magic link request schema (Zod validated). */
+export declare const MagicLinkRequestInputSchema: z.ZodObject<{
+    email: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    email: string;
+}, {
+    email: string;
+}>;
+/** Magic link request input. */
+export type MagicLinkRequestInput = z.infer<typeof MagicLinkRequestInputSchema>;
+/** Magic link login schema (Zod validated). */
+export declare const MagicLinkLoginInputSchema: z.ZodObject<{
+    token: z.ZodString;
+}, "strip", z.ZodTypeAny, {
+    token: string;
+}, {
+    token: string;
+}>;
+/** Magic link login input. */
+export type MagicLinkLoginInput = z.infer<typeof MagicLinkLoginInputSchema>;
+/** API key creation request schema. */
+export declare const CreateApiKeyInputSchema: z.ZodObject<{
+    label: z.ZodString;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    expiresInDays: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    label: string;
+    scopes: string[];
+    expiresInDays?: number | undefined;
+}, {
+    label: string;
+    scopes?: string[] | undefined;
+    expiresInDays?: number | undefined;
+}>;
+/** API key creation input. */
+export type CreateApiKeyInput = z.infer<typeof CreateApiKeyInputSchema>;
+/** API key creation result (plaintext key returned ONCE). */
+export interface CreateApiKeyResult {
+    keyId: string;
+    /** Plaintext vk_* token — returned ONCE, never stored. */
+    key: string;
+    keyPrefix: string;
+    label: string;
+    scopes: string[];
+    expiresAt: string | null;
+    createdAt: string;
+}
+/** Safe projection of an API key (no key_hash, no plaintext). */
+export interface ApiKeyInfo {
+    keyId: string;
+    keyPrefix: string;
+    label: string;
+    scopes: string[];
+    expiresAt: string | null;
+    lastUsedAt: string | null;
+    revokedAt: string | null;
+    createdAt: string;
+}
+/**
+ * Workspace dashboard summary — aggregated metrics for EM Dashboard.
+ * Phase 1 provides JSON API; the EM Dashboard UI is Phase 2 (TD-032).
+ * HLD §8b.1
+ */
+export interface DashboardSummary {
+    /** Total active sessions in the workspace. */
+    activeSessions: number;
+    /** Budget utilization (current month spend vs. budget). */
+    budgetUtilization: {
+        spentUsd: number;
+        budgetUsd: number;
+        percentUsed: number;
+    };
+    /** Anomaly count in the last 24 hours by category. */
+    anomalyCount24h: number;
+    /** SOP health summary. */
+    sopHealth: {
+        totalActive: number;
+        totalStale: number;
+        totalInvalidated: number;
+    };
+    /** Recent governance incidents (last 5). */
+    recentIncidents: Array<{
+        incidentId: string;
+        sessionId: string;
+        category: string;
+        severity: string;
+        createdAt: string;
+    }>;
+    agentSuccessRate?: Array<{
+        date: string;
+        rate: number;
+    }>;
+    tokenEfficiency?: Array<{
+        model: string;
+        inputTokens: number;
+        outputTokens: number;
+        wastedTokens: number;
+    }>;
+    recurringFailures?: Array<{
+        pattern: string;
+        count: number;
+        severity: 'critical' | 'high' | 'medium' | 'low';
+        sopId?: string;
+    }>;
+    sopAdherence?: Array<{
+        date: string;
+        adherenceRate: number;
+        threshold: number;
+    }>;
+    wastedTokenBreakdown?: Array<{
+        category: string;
+        tokens: number;
+        percentOfTotal: number;
+    }>;
+    costSavings?: {
+        rawCostUsd: number;
+        actualCostUsd: number;
+        savedUsd: number;
+        savingsPercent: number;
+    };
+}
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAI/C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAID,mDAAmD;AACnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAEF,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,sCAAsC;AACtC,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAIF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,oCAAoC;AACpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAIvE,kCAAkC;AAClC,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAA;AAIF,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE5D,yBAAyB;AACzB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAA;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAA;AAEF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAA;AAEF,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAM3E,uCAAuC;AACvC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;EAIlC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB,2DAA2D;IAC3D,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,0BAA0B;IAC1B,SAAS,EAAE;QACT,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,4CAA4C;IAC5C,eAAe,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAGF,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;QAChD,KAAK,CAAC,EAAE,MAAM,CAAA;KACf,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;IACF,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;CACF"}

package/dist/auth.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * Auth + RBAC Types — Shared across control plane services.
+ *
+ * LLD #7 — Auth, RBAC, Dashboard API
+ * HLD §5.1 — Zero-Trust Perimeter
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CreateApiKeyInputSchema = exports.MagicLinkLoginInputSchema = exports.MagicLinkRequestInputSchema = exports.ResendVerificationInputSchema = exports.VerifyEmailInputSchema = exports.SignupInputSchema = exports.UpdateRoleInputSchema = exports.InviteMemberInputSchema = exports.ChangePasswordInputSchema = exports.RefreshInputSchema = exports.RegisterInputSchema = exports.LoginInputSchema = void 0;
+const zod_1 = require("zod");
+// ─── Login ───────────────────────────────────────────────────────────
+/** Login request schema (Zod validated). */
+exports.LoginInputSchema = zod_1.z.object({
+    email: zod_1.z.string().email().max(256),
+    password: zod_1.z.string().min(8).max(128),
+});
+// ─── Register ────────────────────────────────────────────────────────
+/** Registration request schema (Zod validated). */
+exports.RegisterInputSchema = zod_1.z.object({
+    email: zod_1.z.string().email().max(256),
+    password: zod_1.z.string().min(8).max(128),
+    displayName: zod_1.z.string().min(1).max(128),
+    workspaceName: zod_1.z.string().min(1).max(128),
+    workspaceSlug: zod_1.z.string().min(1).max(64).regex(/^[a-z0-9-]+$/),
+    signupSource: zod_1.z.string().max(32).optional(),
+    marketingAttribution: zod_1.z.record(zod_1.z.any()).optional(),
+});
+// ─── Refresh ─────────────────────────────────────────────────────────
+/** Token refresh request schema. */
+exports.RefreshInputSchema = zod_1.z.object({
+    refreshToken: zod_1.z.string().min(1),
+});
+// ─── Change Password ─────────────────────────────────────────────────
+/** Change password request schema. */
+exports.ChangePasswordInputSchema = zod_1.z.object({
+    currentPassword: zod_1.z.string().min(8).max(128),
+    newPassword: zod_1.z.string().min(8).max(128),
+});
+// ─── Member Invite ───────────────────────────────────────────────────
+/** Invite member request schema. */
+exports.InviteMemberInputSchema = zod_1.z.object({
+    email: zod_1.z.string().email().max(256),
+    displayName: zod_1.z.string().min(1).max(128),
+    role: zod_1.z.enum(['ADMIN', 'EM', 'DEVELOPER', 'VIEWER']),
+    tempPassword: zod_1.z.string().min(8).max(128),
+});
+// ─── Role Update ─────────────────────────────────────────────────────
+/** Update role request schema. */
+exports.UpdateRoleInputSchema = zod_1.z.object({
+    role: zod_1.z.enum(['OWNER', 'ADMIN', 'EM', 'DEVELOPER', 'VIEWER']),
+});
+// ─── PLG Self-Serve Signup (LLD #9) ───────────────────────────────────
+/** PLG signup input schema. */
+exports.SignupInputSchema = zod_1.z.object({
+    email: zod_1.z.string().email(),
+    password: zod_1.z.string().min(8).max(128),
+    name: zod_1.z.string().min(1).max(128),
+    workspaceName: zod_1.z.string().min(1).max(64).optional(),
+    signupSource: zod_1.z.string().max(32).optional(),
+    marketingAttribution: zod_1.z.record(zod_1.z.any()).optional(),
+});
+/** Verify email input schema. */
+exports.VerifyEmailInputSchema = zod_1.z.object({
+    token: zod_1.z.string().length(64),
+});
+/** Resend verification email input schema. */
+exports.ResendVerificationInputSchema = zod_1.z.object({
+    email: zod_1.z.string().email(),
+});
+/** Magic link request schema (Zod validated). */
+exports.MagicLinkRequestInputSchema = zod_1.z.object({
+    email: zod_1.z.string().email().max(256),
+});
+/** Magic link login schema (Zod validated). */
+exports.MagicLinkLoginInputSchema = zod_1.z.object({
+    token: zod_1.z.string().min(1),
+});
+// ─── API Key ─────────────────────────────────────────────────────────
+/** API key creation request schema. */
+exports.CreateApiKeyInputSchema = zod_1.z.object({
+    label: zod_1.z.string().min(1).max(128),
+    scopes: zod_1.z.array(zod_1.z.string()).default(['*']),
+    expiresInDays: zod_1.z.number().int().min(1).max(365).optional(),
+});
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAAuB;AAsCvB,wEAAwE;AAExE,4CAA4C;AAC/B,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAA;AAaF,wEAAwE;AAExE,mDAAmD;AACtC,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAcF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AASF,wEAAwE;AAExE,sCAAsC;AACzB,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAgBF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACzC,CAAC,CAAA;AAKF,wEAAwE;AAExE,kCAAkC;AACrB,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;CAC9D,CAAC,CAAA;AAEF,yEAAyE;AAEzE,+BAA+B;AAClB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAyBF,iCAAiC;AACpB,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,8CAA8C;AACjC,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,iDAAiD;AACpC,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAKF,+CAA+C;AAClC,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAOF,wEAAwE;AAExE,uCAAuC;AAC1B,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAA"}

package/dist/benchmark.d.ts

@@ -0,0 +1,76 @@
+/**
+ * PromptGrade Advanced Benchmark Types
+ *
+ * WS-4E Advanced
+ */
+export interface BenchmarkSuite {
+    suiteId: string;
+    workspaceId?: string | null;
+    name: string;
+    description: string;
+    isBuiltin: boolean;
+    taskCount: number;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface BenchmarkTask {
+    taskId: string;
+    suiteId: string;
+    title: string;
+    scenarioPrompt: string;
+    expectedOutcome: 'ALLOW' | 'BLOCK' | 'REDACT';
+    expectedSopIds: string[];
+    severity: string;
+    createdAt: string;
+}
+export interface BenchmarkRun {
+    runId: string;
+    workspaceId: string;
+    suiteId: string;
+    triggeredBy?: string | null;
+    harnessType?: string | null;
+    sopSnapshot?: Record<string, any> | null;
+    status: 'pending' | 'running' | 'completed' | 'failed';
+    tasksTotal: number;
+    tasksPassed: number;
+    tasksFailed: number;
+    violationsCaught: number;
+    violationsMissed: number;
+    totalTokens: number;
+    totalCostUsd: string;
+    compositeScore?: string | null;
+    startedAt?: string | null;
+    completedAt?: string | null;
+    createdAt: string;
+}
+export interface BenchmarkTaskResult {
+    resultId: string;
+    runId: string;
+    taskId: string;
+    actualOutcome?: 'ALLOW' | 'BLOCK' | 'REDACT' | null;
+    passed?: boolean | null;
+    godelScore?: string | null;
+    tokensUsed?: number | null;
+    costUsd?: string | null;
+    latencyMs?: number | null;
+    sopsTriggered?: string[] | null;
+    errorDetail?: string | null;
+    completedAt?: string | null;
+}
+export interface BenchmarkComparison {
+    runA: BenchmarkRun;
+    runB: BenchmarkRun;
+    scoreDelta: number;
+    taskComparisons: Array<{
+        taskId: string;
+        title: string;
+        expectedOutcome: string;
+        outcomeA: string;
+        outcomeB: string;
+        passedA: boolean;
+        passedB: boolean;
+        costDelta: number;
+        tokenDelta: number;
+    }>;
+}
+//# sourceMappingURL=benchmark.d.ts.map

package/dist/benchmark.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark.d.ts","sourceRoot":"","sources":["../src/benchmark.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,cAAc,EAAE,MAAM,CAAA;IACtB,eAAe,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;IAC7C,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,IAAI,CAAA;IACxC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;IACtD,UAAU,EAAE,MAAM,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,gBAAgB,EAAE,MAAM,CAAA;IACxB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAA;IACnD,MAAM,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,aAAa,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,YAAY,CAAA;IAClB,IAAI,EAAE,YAAY,CAAA;IAClB,UAAU,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,KAAK,CAAC;QACrB,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,eAAe,EAAE,MAAM,CAAA;QACvB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,OAAO,EAAE,OAAO,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAC,CAAA;CACH"}

package/dist/benchmark.js

@@ -0,0 +1,8 @@
+"use strict";
+/**
+ * PromptGrade Advanced Benchmark Types
+ *
+ * WS-4E Advanced
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=benchmark.js.map

package/dist/benchmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark.js","sourceRoot":"","sources":["../src/benchmark.ts"],"names":[],"mappings":";AAAA;;;;GAIG"}