@intutic/shared-types 2.2.0 → 2.3.0

package/dist/anomaly.d.ts

@@ -5,7 +5,6 @@
  * corrective prompt card system, trust scoring, and ARE probe battery.
  *
  * HLD §3.5 (Anomaly Detection), HLD §7.7 (Drift Detector)
- * LLD #5 — Anomaly Detection + ARE
  *
  * @module
  */
@@ -30,7 +29,7 @@ export interface AnomalyEvent {
  * Full classification result from the anomaly detector.
  * Includes severity mapping and whether an incident was created.
  *
- * LLD #5 §2.2 — classifyAnomaly() return type
+ * classifyAnomaly() return type
  */
 export interface AnomalyClassification {
     /** Whether an anomaly was detected. */
@@ -59,7 +58,6 @@ export type { AnomalySeverity };
  * Static mapping from anomaly type to default severity.
  *
  * HLD §3.5 — 12-category table, Alert Route column
- * LLD #5 Appendix B
  */
 /**
  * Severity per anomaly category.
@@ -107,7 +105,7 @@ export type ProbeType = 'PATTERN' | 'SCHEMA' | 'LLM';
 /**
  * Result from an individual ARE probe execution.
  *
- * LLD #5 §2.2 — runProbes() return type
+ * runProbes() return type
  */
 export interface ProbeResult {
     /** Probe tier. */
@@ -130,7 +128,7 @@ export interface ProbeResult {
 /**
  * Trust score for a user/agent within a workspace.
  *
- * LLD #5 §4.4 — Trust Score Algorithm
+ * Trust Score Algorithm
  * Decay: score * 0.85 per anomaly
  * Boost: score * 1.02 per clean session
  * Clamped to [0, 100]. Initial: 80.
@@ -156,7 +154,7 @@ export interface TrustScoreResult {
 /**
  * Result of a trust score update operation.
  *
- * LLD #5 §2.2 — updateTrustScore() return type
+ * updateTrustScore() return type
  */
 export interface TrustScoreUpdate {
     /** Previous score before update. */
@@ -170,8 +168,6 @@ export interface TrustScoreUpdate {
 }
 /**
  * Events that can modify a trust score.
- *
- * LLD #5 §4.4
  */
 export interface TrustEvent {
     type: 'ANOMALY_DETECTED' | 'CLEAN_SESSION';
@@ -212,7 +208,7 @@ export interface CapabilityMissEvent {
 /**
  * Input for recording a capability miss.
  *
- * LLD #5 §2.2 — recordCapabilityMiss() parameter
+ * recordCapabilityMiss() parameter
  */
 export interface CapabilityMissInput {
     workspaceId: string;
@@ -232,7 +228,7 @@ export type DriftDirection = 'POSITIVE_DRIFT' | 'NEGATIVE_DRIFT' | 'NEUTRAL_DRIF
 /**
  * Drift detection event payload.
  *
- * LLD #5 §2.3 — anomaly.drift.detected event
+ * anomaly.drift.detected event
  */
 export interface DriftEvent {
     workspaceId: string;

package/dist/anomaly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI7C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,EAAE,WAAW,CAAA;IAEjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,EAAE,OAAO,CAAA;IAEjB,0EAA0E;IAC1E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;IAE/B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,gDAAgD;IAChD,QAAQ,EAAE,eAAe,CAAA;IAEzB,uDAAuD;IACvD,cAAc,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAE3C,4DAA4D;IAC5D,YAAY,EAAE,WAAW,EAAE,CAAA;IAE3B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAID;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,CAAA;AAE/B;;;;;GAKG;AACH;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAElB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,SAAS,EAAE,SAAS,CAAA;IAEpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IAEjB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAA;IAElB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAEhB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IAEjB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAA;IAEf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAA;IAEd,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAA;IAEpB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAA;IAEpB,4BAA4B;IAC5B,aAAa,EAAE,MAAM,CAAA;IAErB,iCAAiC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IAErB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAA;IAEb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAAA;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAKrD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAA;IAEvB,iCAAiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3B,+CAA+C;IAC/C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B,0CAA0C;IAC1C,iBAAiB,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC7D;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAA;AAElF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB"}
+{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI7C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,EAAE,WAAW,CAAA;IAEjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,EAAE,OAAO,CAAA;IAEjB,0EAA0E;IAC1E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;IAE/B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,gDAAgD;IAChD,QAAQ,EAAE,eAAe,CAAA;IAEzB,uDAAuD;IACvD,cAAc,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAE3C,4DAA4D;IAC5D,YAAY,EAAE,WAAW,EAAE,CAAA;IAE3B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAID;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,CAAA;AAE/B;;;;GAIG;AACH;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAElB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,SAAS,EAAE,SAAS,CAAA;IAEpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IAEjB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAA;IAElB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAEhB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IAEjB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAA;IAEf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAA;IAEd,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAA;IAEpB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAA;IAEpB,4BAA4B;IAC5B,aAAa,EAAE,MAAM,CAAA;IAErB,iCAAiC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IAErB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAA;IAEb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAAA;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAKrD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAA;IAEvB,iCAAiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3B,+CAA+C;IAC/C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B,0CAA0C;IAC1C,iBAAiB,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC7D;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAA;AAElF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB"}

package/dist/anomaly.js

@@ -6,7 +6,6 @@
  * corrective prompt card system, trust scoring, and ARE probe battery.
  *
  * HLD §3.5 (Anomaly Detection), HLD §7.7 (Drift Detector)
- * LLD #5 — Anomaly Detection + ARE
  *
  * @module
  */
@@ -16,7 +15,6 @@ exports.ANOMALY_SEVERITY_MAP = void 0;
  * Static mapping from anomaly type to default severity.
  *
  * HLD §3.5 — 12-category table, Alert Route column
- * LLD #5 Appendix B
  */
 /**
  * Severity per anomaly category.

package/dist/anomaly.js.map

@@ -1 +1 @@
-{"version":3,"file":"anomaly.js","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAoEH;;;;;GAKG;AACH;;;;;GAKG;AACH,8DAAgE;AAAvD,wHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"anomaly.js","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAoEH;;;;GAIG;AACH;;;;;GAKG;AACH,8DAAgE;AAAvD,wHAAA,oBAAoB,OAAA"}

package/dist/api-contracts.d.ts

@@ -31,7 +31,7 @@ export declare const CreateSessionSchema: z.ZodObject<{
     /** Execution mode — defaults to STANDARD on the server. */
     executionMode: z.ZodOptional<z.ZodEnum<["STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS", ...("STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS")[]]>>;
     /**
-     * The local proxy process this session's traces are filed under (TD-231).
+     * The local proxy process this session's traces are filed under.
      * When set, the server records the git/task context on the row it derives
      * for that process's traces — a PROXY row named by the server, never a new
      * `ses_` id — and ignores `executionMode` / `userId`. Mutually exclusive with

package/dist/api-contracts.js

@@ -41,7 +41,7 @@ exports.CreateSessionSchema = zod_1.z.object({
     /** Execution mode — defaults to STANDARD on the server. */
     executionMode: zod_1.z.enum(constValues(enums_js_1.ExecutionMode)).optional(),
     /**
-     * The local proxy process this session's traces are filed under (TD-231).
+     * The local proxy process this session's traces are filed under.
      * When set, the server records the git/task context on the row it derives
      * for that process's traces — a PROXY row named by the server, never a new
      * `ses_` id — and ignores `executionMode` / `userId`. Mutually exclusive with

package/dist/attenuation.d.ts

@@ -1,5 +1,5 @@
 /**
- * Attenuation & GDPR types — LLD #19 (Enterprise Identity & Compliance)
+ * Attenuation & GDPR types (Enterprise Identity & Compliance)
  *
  * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
  * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.

package/dist/attenuation.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Attenuation & GDPR types — LLD #19 (Enterprise Identity & Compliance)
+ * Attenuation & GDPR types (Enterprise Identity & Compliance)
  *
  * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
  * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.

package/dist/auth.d.ts

@@ -1,7 +1,6 @@
 /**
  * Auth + RBAC Types — Shared across control plane services.
  *
- * LLD #7 — Auth, RBAC, Dashboard API
  * HLD §5.1 — Zero-Trust Perimeter
  *
  * @module
@@ -21,11 +20,11 @@ export interface AuthContext {
     email: string;
     /** RBAC role within the workspace. */
     role: WorkspaceRole;
-    /** Cross-workspace user ID (LLD #11). Optional for pre-migration members. */
+    /** Cross-workspace user ID. Optional for pre-migration members. */
     userId?: string;
     /**
-     * The org the workspace belongs to (denormalized `workspaces.orgId`,
-     * LLD #71). Optional: cached auth entries written before this field
+     * The org the workspace belongs to (denormalized `workspaces.orgId`).
+     * Optional: cached auth entries written before this field
      * existed lack it, and readers must treat absence as "unknown", never as
      * "no org" — the proxy's cell org-pinning revalidates via the control
      * plane in that case rather than guessing.
@@ -245,7 +244,7 @@ export declare const OrgSignupInputSchema: z.ZodObject<{
     orgName: z.ZodString;
     /**
      * The company's own domain (e.g. "acme.com") — informational, stored in
-     * `orgs.settings.domain` (LLD #71). Deliberately NOT the cell hostname:
+     * `orgs.settings.domain`. Deliberately NOT the cell hostname:
      * the org's slug is the subdomain under gateway.intutic.ai, so no domain
      * verification is needed here.
      */
@@ -346,7 +345,7 @@ export declare const CreateApiKeyInputSchema: z.ZodObject<{
     /**
      * Automation key: exempt from the `ssoKeyMaxIdleDays` recency gate, because its
      * owner may never log in interactively. Still bound to the member's active flag
-     * and still revocable, so offboarding applies (TD-218).
+     * and still revocable, so offboarding applies.
      */
     isServiceAccount: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
@@ -389,10 +388,12 @@ export interface ApiKeyInfo {
     lastUsedAt: string | null;
     revokedAt: string | null;
     createdAt: string;
+    /** An automation key, exempt from the SSO-recency window (see `CreateApiKeyInputSchema`). */
+    isServiceAccount: boolean;
 }
 /**
  * Workspace dashboard summary — aggregated metrics for EM Dashboard.
- * Phase 1 provides JSON API; the EM Dashboard UI is Phase 2 (TD-032).
+ * Phase 1 provides JSON API; the EM Dashboard UI is Phase 2.
  * HLD §8b.1
  */
 export interface DashboardSummary {
@@ -400,7 +401,7 @@ export interface DashboardSummary {
     activeSessions: number;
     /**
      * Sessions opened with `executionMode: 'SANDBOX'` in the last 30 days —
-     * `intutic exec --sandbox` runs (LLD #63 §6). A 30-day window rather than
+     * `intutic exec --sandbox` runs. A 30-day window rather than
      * "active" because a sandbox run is typically short-lived.
      */
     sandboxSessions30d: number;
@@ -484,7 +485,7 @@ export interface DashboardSummary {
         savedUsd: number;
         savingsPercent: number;
         /**
-         * Provider prompt-cache reads (TD-347) over the same window — a
+         * Provider prompt-cache reads over the same window — a
          * SEPARATE population from `savedUsd`. A request can show heavy
          * cache-read activity while `savedUsd` is flat or negative (the router
          * moved off a model that was warm), so this must never be folded into

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAI/C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAID,mDAAmD;AACnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAEF,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,sCAAsC;AACtC,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAIF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,oCAAoC;AACpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAIvE,kCAAkC;AAClC,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAA;AAIF,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE5D,yBAAyB;AACzB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAID;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;IAK/B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;EAQH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAElE,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAA;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAA;AAEF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAA;AAEF,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAM3E,uCAAuC;AACvC,eAAO,MAAM,uBAAuB;;;;IAIlC;;;;OAIG;;IAEH;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B,2DAA2D;IAC3D,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,0BAA0B;IAC1B,SAAS,EAAE;QACT,6EAA6E;QAC7E,WAAW,EAAE,MAAM,CAAA;QACnB;;;;;;;WAOG;QACH,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,4CAA4C;IAC5C,eAAe,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAGF,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;KACjD,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;IACF;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAI/C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAID,mDAAmD;AACnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAEF,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,sCAAsC;AACtC,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAIF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,oCAAoC;AACpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAIvE,kCAAkC;AAClC,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAA;AAIF,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE5D,yBAAyB;AACzB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAID;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;IAK/B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;EAQH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAElE,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAA;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAA;AAEF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAA;AAEF,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAM3E,uCAAuC;AACvC,eAAO,MAAM,uBAAuB;;;;IAIlC;;;;OAIG;;IAEH;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B,2DAA2D;IAC3D,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,0BAA0B;IAC1B,SAAS,EAAE;QACT,6EAA6E;QAC7E,WAAW,EAAE,MAAM,CAAA;QACnB;;;;;;;WAOG;QACH,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,4CAA4C;IAC5C,eAAe,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAGF,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;KACjD,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;IACF;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B"}

package/dist/auth.js

@@ -2,7 +2,6 @@
 /**
  * Auth + RBAC Types — Shared across control plane services.
  *
- * LLD #7 — Auth, RBAC, Dashboard API
  * HLD §5.1 — Zero-Trust Perimeter
  *
  * @module
@@ -51,7 +50,7 @@ exports.InviteMemberInputSchema = zod_1.z.object({
 exports.UpdateRoleInputSchema = zod_1.z.object({
     role: zod_1.z.enum(['OWNER', 'ADMIN', 'EM', 'DEVELOPER', 'VIEWER']),
 });
-// ─── PLG Self-Serve Signup (LLD #9) ───────────────────────────────────
+// ─── PLG Self-Serve Signup ───────────────────────────────────
 /** PLG signup input schema. */
 exports.SignupInputSchema = zod_1.z.object({
     email: zod_1.z.string().email(),
@@ -75,7 +74,7 @@ exports.OrgSignupInputSchema = zod_1.z.object({
     orgName: zod_1.z.string().min(1).max(128),
     /**
      * The company's own domain (e.g. "acme.com") — informational, stored in
-     * `orgs.settings.domain` (LLD #71). Deliberately NOT the cell hostname:
+     * `orgs.settings.domain`. Deliberately NOT the cell hostname:
      * the org's slug is the subdomain under gateway.intutic.ai, so no domain
      * verification is needed here.
      */
@@ -118,7 +117,7 @@ exports.CreateApiKeyInputSchema = zod_1.z.object({
     /**
      * Automation key: exempt from the `ssoKeyMaxIdleDays` recency gate, because its
      * owner may never log in interactively. Still bound to the member's active flag
-     * and still revocable, so offboarding applies (TD-218).
+     * and still revocable, so offboarding applies.
      */
     isServiceAccount: zod_1.z.boolean().default(false),
 });

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAAuB;AA6DvB,wEAAwE;AAExE,4CAA4C;AAC/B,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAA;AAaF,wEAAwE;AAExE,mDAAmD;AACtC,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAcF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AASF,wEAAwE;AAExE,sCAAsC;AACzB,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAyBF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACzC,CAAC,CAAA;AAKF,wEAAwE;AAExE,kCAAkC;AACrB,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;CAC9D,CAAC,CAAA;AAEF,yEAAyE;AAEzE,+BAA+B;AAClB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAyBF,yEAAyE;AAEzE;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC;;;;;OAKG;IACH,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,oEAAoE,EAAE,qCAAqC,CAAC;SAClH,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AA+BF,iCAAiC;AACpB,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,8CAA8C;AACjC,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,iDAAiD;AACpC,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAKF,+CAA+C;AAClC,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAOF,wEAAwE;AAExE,uCAAuC;AAC1B,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAA"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,6BAAuB;AA6DvB,wEAAwE;AAExE,4CAA4C;AAC/B,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAA;AAaF,wEAAwE;AAExE,mDAAmD;AACtC,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAcF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AASF,wEAAwE;AAExE,sCAAsC;AACzB,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAyBF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACzC,CAAC,CAAA;AAKF,wEAAwE;AAExE,kCAAkC;AACrB,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;CAC9D,CAAC,CAAA;AAEF,gEAAgE;AAEhE,+BAA+B;AAClB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAyBF,yEAAyE;AAEzE;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC;;;;;OAKG;IACH,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,oEAAoE,EAAE,qCAAqC,CAAC;SAClH,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AA+BF,iCAAiC;AACpB,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,8CAA8C;AACjC,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,iDAAiD;AACpC,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAKF,+CAA+C;AAClC,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAOF,wEAAwE;AAExE,uCAAuC;AAC1B,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAA"}

package/dist/billing.d.ts

@@ -1,5 +1,5 @@
 /**
- * Monetization & Financial Ledger types — LLD #20
+ * Monetization & Financial Ledger types
  *
  * Stripe Metered Billing,
  * and usage-based overage enforcement.

package/dist/billing.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Monetization & Financial Ledger types — LLD #20
+ * Monetization & Financial Ledger types
  *
  * Stripe Metered Billing,
  * and usage-based overage enforcement.

package/dist/destructiveSql.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Destructive SQL as a text rule: the statements every blocking text scanner
+ * refuses in tool arguments.
+ *
+ * The control plane's DLP (`POST /api/v1/hook-gate`, which both gate SDKs'
+ * server tier, the AgentCore interceptor and the QM security screen run) and
+ * the MCP governance proxy's DLP read both from here. The harness hook gates
+ * carry the same phrases as the `destructive.sql_drop` rule
+ * (`protectedPaths.ts`). Each statement is matched as words by the phrase
+ * matcher (phrases.ts), bounded at both ends: any separator the shell or the
+ * database reads as a word break may split the keywords (a comment, an escaped
+ * newline, a line continuation, `--` options), but `DROP TABLES` and
+ * `truncate --size 0 table.log` are not the statement. No regex runs on the
+ * text, so crafted input cannot make the scan backtrack.
+ * `fixtures/destructive-sql-vectors.json` holds every implementation to the
+ * same answers.
+ *
+ * A text rule, not a SQL parser: a quoted mention (`SELECT 'drop table'`) is
+ * refused too, because quoting is how a shell command carries the real
+ * statement (`psql -c 'DROP TABLE x'`). The proxy's `sql_guard`, which parses
+ * the SQL a client will run, is the one that tells them apart.
+ */
+import { type PhraseText } from './phrases.js';
+/** The statements a text scanner refuses, and the phrase that finds each. */
+export declare const DESTRUCTIVE_SQL_STATEMENTS: readonly [{
+    readonly statement: "DROP TABLE";
+    readonly phrase: "drop table";
+    readonly description: "SQL DROP TABLE statement";
+}, {
+    readonly statement: "DROP DATABASE";
+    readonly phrase: "drop database";
+    readonly description: "SQL DROP DATABASE statement";
+}, {
+    readonly statement: "DROP SCHEMA";
+    readonly phrase: "drop schema";
+    readonly description: "SQL DROP SCHEMA statement";
+}, {
+    readonly statement: "TRUNCATE TABLE";
+    readonly phrase: "truncate table";
+    readonly description: "SQL TRUNCATE TABLE statement";
+}];
+export type DestructiveSqlStatement = (typeof DESTRUCTIVE_SQL_STATEMENTS)[number]['statement'];
+/**
+ * The destructive statements `text` contains, in {@link DESTRUCTIVE_SQL_STATEMENTS}
+ * order. Pass a {@link PhraseText} already cut from the text to reuse it.
+ */
+export declare function findDestructiveSql(text: string | PhraseText): Array<(typeof DESTRUCTIVE_SQL_STATEMENTS)[number]>;
+//# sourceMappingURL=destructiveSql.d.ts.map

package/dist/destructiveSql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructiveSql.d.ts","sourceRoot":"","sources":["../src/destructiveSql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,EAAyB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAA;AAErE,6EAA6E;AAC7E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;EAK7B,CAAA;AAEV,MAAM,MAAM,uBAAuB,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAA;AAE9F;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,OAAO,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAGhH"}

package/dist/destructiveSql.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DESTRUCTIVE_SQL_STATEMENTS = void 0;
+exports.findDestructiveSql = findDestructiveSql;
+/**
+ * Destructive SQL as a text rule: the statements every blocking text scanner
+ * refuses in tool arguments.
+ *
+ * The control plane's DLP (`POST /api/v1/hook-gate`, which both gate SDKs'
+ * server tier, the AgentCore interceptor and the QM security screen run) and
+ * the MCP governance proxy's DLP read both from here. The harness hook gates
+ * carry the same phrases as the `destructive.sql_drop` rule
+ * (`protectedPaths.ts`). Each statement is matched as words by the phrase
+ * matcher (phrases.ts), bounded at both ends: any separator the shell or the
+ * database reads as a word break may split the keywords (a comment, an escaped
+ * newline, a line continuation, `--` options), but `DROP TABLES` and
+ * `truncate --size 0 table.log` are not the statement. No regex runs on the
+ * text, so crafted input cannot make the scan backtrack.
+ * `fixtures/destructive-sql-vectors.json` holds every implementation to the
+ * same answers.
+ *
+ * A text rule, not a SQL parser: a quoted mention (`SELECT 'drop table'`) is
+ * refused too, because quoting is how a shell command carries the real
+ * statement (`psql -c 'DROP TABLE x'`). The proxy's `sql_guard`, which parses
+ * the SQL a client will run, is the one that tells them apart.
+ */
+const phrases_js_1 = require("./phrases.js");
+/** The statements a text scanner refuses, and the phrase that finds each. */
+exports.DESTRUCTIVE_SQL_STATEMENTS = [
+    { statement: 'DROP TABLE', phrase: 'drop table', description: 'SQL DROP TABLE statement' },
+    { statement: 'DROP DATABASE', phrase: 'drop database', description: 'SQL DROP DATABASE statement' },
+    { statement: 'DROP SCHEMA', phrase: 'drop schema', description: 'SQL DROP SCHEMA statement' },
+    { statement: 'TRUNCATE TABLE', phrase: 'truncate table', description: 'SQL TRUNCATE TABLE statement' },
+];
+/**
+ * The destructive statements `text` contains, in {@link DESTRUCTIVE_SQL_STATEMENTS}
+ * order. Pass a {@link PhraseText} already cut from the text to reuse it.
+ */
+function findDestructiveSql(text) {
+    const words = typeof text === 'string' ? (0, phrases_js_1.phraseText)(text) : text;
+    return exports.DESTRUCTIVE_SQL_STATEMENTS.filter((s) => (0, phrases_js_1.hasPhrase)(words, s.phrase, true));
+}
+//# sourceMappingURL=destructiveSql.js.map

package/dist/destructiveSql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructiveSql.js","sourceRoot":"","sources":["../src/destructiveSql.ts"],"names":[],"mappings":";;;AAsCA,gDAGC;AAzCD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,6CAAqE;AAErE,6EAA6E;AAChE,QAAA,0BAA0B,GAAG;IACxC,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,0BAA0B,EAAE;IAC1F,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,EAAE,6BAA6B,EAAE;IACnG,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE;IAC7F,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,8BAA8B,EAAE;CAC9F,CAAA;AAIV;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,IAAyB;IAC1D,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAA,uBAAU,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChE,OAAO,kCAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,sBAAS,EAAC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AACnF,CAAC"}

package/dist/devInventory.d.ts

@@ -0,0 +1,120 @@
+/**
+ * devInventory.ts — the AI inventory a connected developer machine reports.
+ *
+ * `intutic connect` collects it (the sync daemon's `inventory.ts`): the AI
+ * coding harnesses the machine has, whether Intutic's gate runs for each, the
+ * MCP servers their configs declare, and the skill bundles on disk. It travels
+ * as the `inventory` facet of `POST /api/v1/agents/report`, and the control
+ * plane keeps the latest copy per device with first-seen and last-seen times
+ * per item.
+ *
+ * What it may carry is deliberately narrow: names, paths relative to the home
+ * directory, content hashes and timestamps. Never file contents, environment
+ * values, command lines or URL query strings. {@link homeRelativePath} and
+ * {@link sanitizeMcpEndpoint} are where that rule is applied on the machine;
+ * the control plane applies {@link sanitizeMcpEndpoint} again on ingest, so a
+ * daemon that skipped it still cannot store a credential.
+ *
+ * @module
+ */
+import type { GateKind } from './gateKind.js';
+/** Bumped when a field's meaning changes; the control plane refuses versions it does not know. */
+export declare const DEVICE_INVENTORY_SCHEMA_VERSION = 1;
+/** How a harness's tool calls are gated (`gateKind.ts`). */
+export type InventoryGateKind = GateKind;
+/** One harness found on the machine, by detection or because `intutic connect` is configured for it. */
+export interface InventoryHarness {
+    /**
+     * A `HarnessType` value, or for the harness with two gates the gate id of
+     * the product found (`antigravity`, `gemini-cli`; see `gateIdentity.ts`).
+     */
+    type: string;
+    /** Only where the install records it cheaply, such as a VS Code extension directory name. */
+    version?: string;
+    /** True when it is one of this machine's `intutic connect` harnesses, the ones connect installs a gate for. */
+    configured: boolean;
+    /**
+     * True when `intutic disconnect --harness` removed Intutic from it on this
+     * machine: ungoverned by the user's choice, so its first appearance as
+     * ungoverned is not announced.
+     */
+    disconnected?: boolean;
+    gateKind: InventoryGateKind;
+    /** For a `hook` gate, whether its gate file is on disk; null when the gate is not a file the daemon writes. */
+    gateInstalled: boolean | null;
+    /** Where the gate file was found, relative to the home directory. */
+    gateFile?: string;
+    /** Newest event this machine's gate for the harness wrote, as the daemon drained it. */
+    lastHookEventAt: string | null;
+    /** Newest `guards_disabled` event: the gate ran with `INTUTIC_GUARD_DISABLE=1`. */
+    guardsDisabledAt: string | null;
+}
+/** One MCP server a harness config on the machine declares. */
+export interface InventoryMcpServer {
+    server: string;
+    harness: string;
+    transport: 'stdio' | 'http' | 'sse' | 'unknown';
+    /** True when the MCP governance proxy fronts it. */
+    wrapped: boolean;
+    /** A remote server's URL after {@link sanitizeMcpEndpoint}; absent for a local (stdio) server. */
+    endpoint?: string;
+    /** Why the harness runs it without the proxy, when the daemon can say. */
+    ungovernedReason?: string;
+}
+/** One skill bundle (a directory holding `SKILL.md`). */
+export interface InventorySkill {
+    name: string;
+    /** The directory it was found in, relative to the workspace (`.agents/skills`) or the home directory (`~/.claude/skills`). */
+    source: string;
+    /** sha256 of `SKILL.md`; absent when it could not be read. */
+    sha256?: string;
+    scanned: boolean;
+    clean: boolean;
+    findingsCount: number;
+    /** Files bundled next to `SKILL.md`. */
+    scriptCount: number;
+}
+/** The local proxy's last scheduled guard-liveness probe run. */
+export interface InventoryGuardProbes {
+    total: number;
+    failed: number;
+    /** Unix seconds. */
+    ranAt: number;
+}
+/** The whole snapshot one machine sends. */
+export interface DeviceInventory {
+    schemaVersion: typeof DEVICE_INVENTORY_SCHEMA_VERSION;
+    collectedAt: string;
+    /** The `intutic connect` workspace root, relative to the home directory. */
+    workspace: string;
+    harnesses: InventoryHarness[];
+    mcpServers: InventoryMcpServer[];
+    skills: InventorySkill[];
+    /** Present only when the local proxy answered. */
+    guardProbes?: InventoryGuardProbes;
+}
+/** The machine a report comes from: the same fingerprint `intutic enforce` reports to `/api/v1/devices`. */
+export interface InventoryDeviceIdentity {
+    fingerprint: string;
+    hostname: string;
+    platform: string;
+    cliVersion?: string;
+}
+/** What a path outside the home directory is reported as. */
+export declare const REDACTED_PATH = "[redacted]";
+/**
+ * `~/...` for a path inside `home`, `~` for `home` itself, and
+ * {@link REDACTED_PATH} for anything else: a path outside the home directory
+ * names nothing the inventory needs, and may name another user's files.
+ */
+export declare function homeRelativePath(absolutePath: string, home: string): string;
+/** Replaces a URL path segment that looks like a token. */
+export declare const REDACTED_SEGMENT = "[redacted]";
+/**
+ * A remote MCP server's URL with what could be a credential removed: the
+ * user name and password, the query string, the fragment, and any path
+ * segment that looks like a token. `undefined` for anything that is not an
+ * http(s) or ws(s) URL, including one still holding `${VAR}` in its host.
+ */
+export declare function sanitizeMcpEndpoint(raw: string): string | undefined;
+//# sourceMappingURL=devInventory.d.ts.map

package/dist/devInventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"devInventory.d.ts","sourceRoot":"","sources":["../src/devInventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAE7C,kGAAkG;AAClG,eAAO,MAAM,+BAA+B,IAAI,CAAA;AAEhD,4DAA4D;AAC5D,MAAM,MAAM,iBAAiB,GAAG,QAAQ,CAAA;AAExC,wGAAwG;AACxG,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAA;IACZ,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,+GAA+G;IAC/G,UAAU,EAAE,OAAO,CAAA;IACnB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,+GAA+G;IAC/G,aAAa,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7B,qEAAqE;IACrE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,wFAAwF;IACxF,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,mFAAmF;IACnF,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;CAChC;AAED,+DAA+D;AAC/D,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,CAAA;IAC/C,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAA;IAChB,kGAAkG;IAClG,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,8HAA8H;IAC9H,MAAM,EAAE,MAAM,CAAA;IACd,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,OAAO,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,wCAAwC;IACxC,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,iEAAiE;AACjE,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,OAAO,+BAA+B,CAAA;IACrD,WAAW,EAAE,MAAM,CAAA;IACnB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,gBAAgB,EAAE,CAAA;IAC7B,UAAU,EAAE,kBAAkB,EAAE,CAAA;IAChC,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,kDAAkD;IAClD,WAAW,CAAC,EAAE,oBAAoB,CAAA;CACnC;AAED,4GAA4G;AAC5G,MAAM,WAAW,uBAAuB;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,6DAA6D;AAC7D,eAAO,MAAM,aAAa,eAAe,CAAA;AAEzC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAO3E;AAED,2DAA2D;AAC3D,eAAO,MAAM,gBAAgB,eAAe,CAAA;AAW5C;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAenE"}

package/dist/devInventory.js

@@ -0,0 +1,80 @@
+"use strict";
+/**
+ * devInventory.ts — the AI inventory a connected developer machine reports.
+ *
+ * `intutic connect` collects it (the sync daemon's `inventory.ts`): the AI
+ * coding harnesses the machine has, whether Intutic's gate runs for each, the
+ * MCP servers their configs declare, and the skill bundles on disk. It travels
+ * as the `inventory` facet of `POST /api/v1/agents/report`, and the control
+ * plane keeps the latest copy per device with first-seen and last-seen times
+ * per item.
+ *
+ * What it may carry is deliberately narrow: names, paths relative to the home
+ * directory, content hashes and timestamps. Never file contents, environment
+ * values, command lines or URL query strings. {@link homeRelativePath} and
+ * {@link sanitizeMcpEndpoint} are where that rule is applied on the machine;
+ * the control plane applies {@link sanitizeMcpEndpoint} again on ingest, so a
+ * daemon that skipped it still cannot store a credential.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDACTED_SEGMENT = exports.REDACTED_PATH = exports.DEVICE_INVENTORY_SCHEMA_VERSION = void 0;
+exports.homeRelativePath = homeRelativePath;
+exports.sanitizeMcpEndpoint = sanitizeMcpEndpoint;
+/** Bumped when a field's meaning changes; the control plane refuses versions it does not know. */
+exports.DEVICE_INVENTORY_SCHEMA_VERSION = 1;
+/** What a path outside the home directory is reported as. */
+exports.REDACTED_PATH = '[redacted]';
+/**
+ * `~/...` for a path inside `home`, `~` for `home` itself, and
+ * {@link REDACTED_PATH} for anything else: a path outside the home directory
+ * names nothing the inventory needs, and may name another user's files.
+ */
+function homeRelativePath(absolutePath, home) {
+    const sep = home.includes('\\') && !home.includes('/') ? '\\' : '/';
+    const base = home.endsWith(sep) ? home.slice(0, -1) : home;
+    if (base === '')
+        return exports.REDACTED_PATH;
+    if (absolutePath === base)
+        return '~';
+    if (absolutePath.startsWith(base + sep))
+        return `~/${absolutePath.slice(base.length + 1).split(sep).join('/')}`;
+    return exports.REDACTED_PATH;
+}
+/** Replaces a URL path segment that looks like a token. */
+exports.REDACTED_SEGMENT = '[redacted]';
+/**
+ * A path segment of 16 or more URL-safe characters mixing letters and digits.
+ * Some MCP services put the API key in the path (`/mcp/<key>/sse`); a
+ * readable route segment (`sse`, `v1`, `mcp-server`) does not look like this.
+ */
+function looksLikeToken(segment) {
+    return segment.length >= 16 && /^[A-Za-z0-9._~%-]+$/.test(segment) && /[A-Za-z]/.test(segment) && /[0-9]/.test(segment);
+}
+/**
+ * A remote MCP server's URL with what could be a credential removed: the
+ * user name and password, the query string, the fragment, and any path
+ * segment that looks like a token. `undefined` for anything that is not an
+ * http(s) or ws(s) URL, including one still holding `${VAR}` in its host.
+ */
+function sanitizeMcpEndpoint(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (!['http:', 'https:', 'ws:', 'wss:'].includes(url.protocol))
+        return undefined;
+    // A host still templated (`${MCP_HOST}`) names no server yet.
+    if (/[${}]/.test(url.hostname))
+        return undefined;
+    const path = url.pathname
+        .split('/')
+        .map((segment) => (looksLikeToken(segment) ? exports.REDACTED_SEGMENT : segment))
+        .join('/');
+    return `${url.protocol}//${url.host}${path === '/' ? '' : path}`;
+}
+//# sourceMappingURL=devInventory.js.map