@intutic/shared-types 2.2.0 → 2.4.0

package/dist/anomaly.d.ts

@@ -5,7 +5,6 @@
  * corrective prompt card system, trust scoring, and ARE probe battery.
  *
  * HLD §3.5 (Anomaly Detection), HLD §7.7 (Drift Detector)
- * LLD #5 — Anomaly Detection + ARE
  *
  * @module
  */
@@ -30,7 +29,7 @@ export interface AnomalyEvent {
  * Full classification result from the anomaly detector.
  * Includes severity mapping and whether an incident was created.
  *
- * LLD #5 §2.2 — classifyAnomaly() return type
+ * classifyAnomaly() return type
  */
 export interface AnomalyClassification {
     /** Whether an anomaly was detected. */
@@ -59,7 +58,6 @@ export type { AnomalySeverity };
  * Static mapping from anomaly type to default severity.
  *
  * HLD §3.5 — 12-category table, Alert Route column
- * LLD #5 Appendix B
  */
 /**
  * Severity per anomaly category.
@@ -107,7 +105,7 @@ export type ProbeType = 'PATTERN' | 'SCHEMA' | 'LLM';
 /**
  * Result from an individual ARE probe execution.
  *
- * LLD #5 §2.2 — runProbes() return type
+ * runProbes() return type
  */
 export interface ProbeResult {
     /** Probe tier. */
@@ -130,7 +128,7 @@ export interface ProbeResult {
 /**
  * Trust score for a user/agent within a workspace.
  *
- * LLD #5 §4.4 — Trust Score Algorithm
+ * Trust Score Algorithm
  * Decay: score * 0.85 per anomaly
  * Boost: score * 1.02 per clean session
  * Clamped to [0, 100]. Initial: 80.
@@ -156,7 +154,7 @@ export interface TrustScoreResult {
 /**
  * Result of a trust score update operation.
  *
- * LLD #5 §2.2 — updateTrustScore() return type
+ * updateTrustScore() return type
  */
 export interface TrustScoreUpdate {
     /** Previous score before update. */
@@ -170,8 +168,6 @@ export interface TrustScoreUpdate {
 }
 /**
  * Events that can modify a trust score.
- *
- * LLD #5 §4.4
  */
 export interface TrustEvent {
     type: 'ANOMALY_DETECTED' | 'CLEAN_SESSION';
@@ -212,7 +208,7 @@ export interface CapabilityMissEvent {
 /**
  * Input for recording a capability miss.
  *
- * LLD #5 §2.2 — recordCapabilityMiss() parameter
+ * recordCapabilityMiss() parameter
  */
 export interface CapabilityMissInput {
     workspaceId: string;
@@ -232,7 +228,7 @@ export type DriftDirection = 'POSITIVE_DRIFT' | 'NEGATIVE_DRIFT' | 'NEUTRAL_DRIF
 /**
  * Drift detection event payload.
  *
- * LLD #5 §2.3 — anomaly.drift.detected event
+ * anomaly.drift.detected event
  */
 export interface DriftEvent {
     workspaceId: string;

package/dist/anomaly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI7C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,EAAE,WAAW,CAAA;IAEjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,EAAE,OAAO,CAAA;IAEjB,0EAA0E;IAC1E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;IAE/B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,gDAAgD;IAChD,QAAQ,EAAE,eAAe,CAAA;IAEzB,uDAAuD;IACvD,cAAc,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAE3C,4DAA4D;IAC5D,YAAY,EAAE,WAAW,EAAE,CAAA;IAE3B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAID;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,CAAA;AAE/B;;;;;GAKG;AACH;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAElB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,SAAS,EAAE,SAAS,CAAA;IAEpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IAEjB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAA;IAElB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAEhB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IAEjB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAA;IAEf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAA;IAEd,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAA;IAEpB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAA;IAEpB,4BAA4B;IAC5B,aAAa,EAAE,MAAM,CAAA;IAErB,iCAAiC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IAErB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAA;IAEb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAAA;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAKrD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAA;IAEvB,iCAAiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3B,+CAA+C;IAC/C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B,0CAA0C;IAC1C,iBAAiB,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC7D;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAA;AAElF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB"}
+{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI7C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,EAAE,WAAW,CAAA;IAEjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,EAAE,OAAO,CAAA;IAEjB,0EAA0E;IAC1E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;IAE/B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,gDAAgD;IAChD,QAAQ,EAAE,eAAe,CAAA;IAEzB,uDAAuD;IACvD,cAAc,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAE3C,4DAA4D;IAC5D,YAAY,EAAE,WAAW,EAAE,CAAA;IAE3B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAID;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,CAAA;AAE/B;;;;GAIG;AACH;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAElB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,SAAS,EAAE,SAAS,CAAA;IAEpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IAEjB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAA;IAElB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAEhB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IAEjB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAA;IAEf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAA;IAEd,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAA;IAEpB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAA;IAEpB,4BAA4B;IAC5B,aAAa,EAAE,MAAM,CAAA;IAErB,iCAAiC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IAErB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAA;IAEb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAAA;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAKrD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAA;IAEvB,iCAAiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3B,+CAA+C;IAC/C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B,0CAA0C;IAC1C,iBAAiB,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC7D;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAA;AAElF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB"}

package/dist/anomaly.js

@@ -6,7 +6,6 @@
  * corrective prompt card system, trust scoring, and ARE probe battery.
  *
  * HLD §3.5 (Anomaly Detection), HLD §7.7 (Drift Detector)
- * LLD #5 — Anomaly Detection + ARE
  *
  * @module
  */
@@ -16,7 +15,6 @@ exports.ANOMALY_SEVERITY_MAP = void 0;
  * Static mapping from anomaly type to default severity.
  *
  * HLD §3.5 — 12-category table, Alert Route column
- * LLD #5 Appendix B
  */
 /**
  * Severity per anomaly category.

package/dist/anomaly.js.map

@@ -1 +1 @@
-{"version":3,"file":"anomaly.js","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAoEH;;;;;GAKG;AACH;;;;;GAKG;AACH,8DAAgE;AAAvD,wHAAA,oBAAoB,OAAA"}
+{"version":3,"file":"anomaly.js","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAoEH;;;;GAIG;AACH;;;;;GAKG;AACH,8DAAgE;AAAvD,wHAAA,oBAAoB,OAAA"}

package/dist/api-contracts.d.ts

@@ -31,7 +31,7 @@ export declare const CreateSessionSchema: z.ZodObject<{
     /** Execution mode — defaults to STANDARD on the server. */
     executionMode: z.ZodOptional<z.ZodEnum<["STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS", ...("STANDARD" | "PLAN_ONLY" | "SHADOW" | "AUTONOMOUS")[]]>>;
     /**
-     * The local proxy process this session's traces are filed under (TD-231).
+     * The local proxy process this session's traces are filed under.
      * When set, the server records the git/task context on the row it derives
      * for that process's traces — a PROXY row named by the server, never a new
      * `ses_` id — and ignores `executionMode` / `userId`. Mutually exclusive with

package/dist/api-contracts.js

@@ -41,7 +41,7 @@ exports.CreateSessionSchema = zod_1.z.object({
     /** Execution mode — defaults to STANDARD on the server. */
     executionMode: zod_1.z.enum(constValues(enums_js_1.ExecutionMode)).optional(),
     /**
-     * The local proxy process this session's traces are filed under (TD-231).
+     * The local proxy process this session's traces are filed under.
      * When set, the server records the git/task context on the row it derives
      * for that process's traces — a PROXY row named by the server, never a new
      * `ses_` id — and ignores `executionMode` / `userId`. Mutually exclusive with

package/dist/attenuation.d.ts

@@ -1,5 +1,5 @@
 /**
- * Attenuation & GDPR types — LLD #19 (Enterprise Identity & Compliance)
+ * Attenuation & GDPR types (Enterprise Identity & Compliance)
  *
  * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
  * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.

package/dist/attenuation.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Attenuation & GDPR types — LLD #19 (Enterprise Identity & Compliance)
+ * Attenuation & GDPR types (Enterprise Identity & Compliance)
  *
  * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
  * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.

package/dist/auth.d.ts

@@ -1,13 +1,13 @@
 /**
  * Auth + RBAC Types — Shared across control plane services.
  *
- * LLD #7 — Auth, RBAC, Dashboard API
  * HLD §5.1 — Zero-Trust Perimeter
  *
  * @module
  */
 import { z } from 'zod';
 import type { WorkspaceRole } from './enums.js';
+import { type HardBudgetWire, type KeyRateLimit, type SpendBudget } from './spendBudgets.js';
 /**
  * Auth context injected by middleware on every authenticated request.
  * Available via `c.get('auth')` in Hono handlers.
@@ -21,11 +21,11 @@ export interface AuthContext {
     email: string;
     /** RBAC role within the workspace. */
     role: WorkspaceRole;
-    /** Cross-workspace user ID (LLD #11). Optional for pre-migration members. */
+    /** Cross-workspace user ID. Optional for pre-migration members. */
     userId?: string;
     /**
-     * The org the workspace belongs to (denormalized `workspaces.orgId`,
-     * LLD #71). Optional: cached auth entries written before this field
+     * The org the workspace belongs to (denormalized `workspaces.orgId`).
+     * Optional: cached auth entries written before this field
      * existed lack it, and readers must treat absence as "unknown", never as
      * "no org" — the proxy's cell org-pinning revalidates via the control
      * plane in that case rather than guessing.
@@ -46,6 +46,21 @@ export interface AuthContext {
      * absence there means "required", never "exempt".
      */
     byokRequired?: boolean;
+    /**
+     * The `vk_` key's id (`api_keys.key_id`). The proxy names the key's spend
+     * counters and rate-limit counters with it; absent on a session JWT.
+     */
+    keyId?: string;
+    /**
+     * Every hard spend budget that covers this key's calls — the workspace's,
+     * the key's own and its owner's member budgets — which the proxy checks
+     * before a request leaves. Soft budgets are not listed: they only alert.
+     * Absent on an entry written before the field existed, where the proxy
+     * keeps the workspace daily cap it read before.
+     */
+    hardBudgets?: HardBudgetWire[];
+    /** The key's requests-per-minute and tokens-per-minute limits, when it has either. */
+    rateLimit?: KeyRateLimit;
 }
 /** JWT access token payload (compact claims). */
 export interface JwtPayload {
@@ -245,7 +260,7 @@ export declare const OrgSignupInputSchema: z.ZodObject<{
     orgName: z.ZodString;
     /**
      * The company's own domain (e.g. "acme.com") — informational, stored in
-     * `orgs.settings.domain` (LLD #71). Deliberately NOT the cell hostname:
+     * `orgs.settings.domain`. Deliberately NOT the cell hostname:
      * the org's slug is the subdomain under gateway.intutic.ai, so no domain
      * verification is needed here.
      */
@@ -346,7 +361,7 @@ export declare const CreateApiKeyInputSchema: z.ZodObject<{
     /**
      * Automation key: exempt from the `ssoKeyMaxIdleDays` recency gate, because its
      * owner may never log in interactively. Still bound to the member's active flag
-     * and still revocable, so offboarding applies (TD-218).
+     * and still revocable, so offboarding applies.
      */
     isServiceAccount: z.ZodDefault<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
@@ -376,7 +391,93 @@ export interface CreateApiKeyResult {
     allowedModels: string[] | null;
     expiresAt: string | null;
     createdAt: string;
+    /** The key's own spend budgets; empty when it has none. */
+    budgets: SpendBudget[];
+    /** The key's per-minute limits; both `null` when it has none. */
+    rateLimit: KeyRateLimit;
 }
+/**
+ * `PATCH /api/v1/keys/:id` — replace a key's spend budgets and/or rate limit.
+ * The only way to set them: any member creates their own keys, and only an
+ * OWNER or ADMIN may say what a key can spend, so a key is created unlimited
+ * and limited afterwards.
+ * A field left out is unchanged; `budgets: []` removes every budget, and a
+ * `rateLimit` field set to `null` removes that limit.
+ */
+export declare const UpdateApiKeyInputSchema: z.ZodEffects<z.ZodObject<{
+    budgets: z.ZodOptional<z.ZodEffects<z.ZodArray<z.ZodObject<{
+        period: z.ZodEnum<["day", "month"]>;
+        limitUsd: z.ZodNumber;
+        enforcement: z.ZodDefault<z.ZodEnum<["hard", "soft"]>>;
+    }, "strict", z.ZodTypeAny, {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement: "hard" | "soft";
+    }, {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement?: "hard" | "soft" | undefined;
+    }>, "many">, {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement: "hard" | "soft";
+    }[], {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement?: "hard" | "soft" | undefined;
+    }[]>>;
+    rateLimit: z.ZodOptional<z.ZodObject<{
+        rpm: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        tpm: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    }, "strict", z.ZodTypeAny, {
+        rpm?: number | null | undefined;
+        tpm?: number | null | undefined;
+    }, {
+        rpm?: number | null | undefined;
+        tpm?: number | null | undefined;
+    }>>;
+}, "strict", z.ZodTypeAny, {
+    budgets?: {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement: "hard" | "soft";
+    }[] | undefined;
+    rateLimit?: {
+        rpm?: number | null | undefined;
+        tpm?: number | null | undefined;
+    } | undefined;
+}, {
+    budgets?: {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement?: "hard" | "soft" | undefined;
+    }[] | undefined;
+    rateLimit?: {
+        rpm?: number | null | undefined;
+        tpm?: number | null | undefined;
+    } | undefined;
+}>, {
+    budgets?: {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement: "hard" | "soft";
+    }[] | undefined;
+    rateLimit?: {
+        rpm?: number | null | undefined;
+        tpm?: number | null | undefined;
+    } | undefined;
+}, {
+    budgets?: {
+        period: "day" | "month";
+        limitUsd: number;
+        enforcement?: "hard" | "soft" | undefined;
+    }[] | undefined;
+    rateLimit?: {
+        rpm?: number | null | undefined;
+        tpm?: number | null | undefined;
+    } | undefined;
+}>;
+export type UpdateApiKeyInput = z.infer<typeof UpdateApiKeyInputSchema>;
 /** Safe projection of an API key (no key_hash, no plaintext). */
 export interface ApiKeyInfo {
     keyId: string;
@@ -389,10 +490,16 @@ export interface ApiKeyInfo {
     lastUsedAt: string | null;
     revokedAt: string | null;
     createdAt: string;
+    /** An automation key, exempt from the SSO-recency window (see `CreateApiKeyInputSchema`). */
+    isServiceAccount: boolean;
+    /** The key's own spend budgets; empty when it has none. */
+    budgets: SpendBudget[];
+    /** The key's per-minute limits; both `null` when it has none. */
+    rateLimit: KeyRateLimit;
 }
 /**
  * Workspace dashboard summary — aggregated metrics for EM Dashboard.
- * Phase 1 provides JSON API; the EM Dashboard UI is Phase 2 (TD-032).
+ * Phase 1 provides JSON API; the EM Dashboard UI is Phase 2.
  * HLD §8b.1
  */
 export interface DashboardSummary {
@@ -400,7 +507,7 @@ export interface DashboardSummary {
     activeSessions: number;
     /**
      * Sessions opened with `executionMode: 'SANDBOX'` in the last 30 days —
-     * `intutic exec --sandbox` runs (LLD #63 §6). A 30-day window rather than
+     * `intutic exec --sandbox` runs. A 30-day window rather than
      * "active" because a sandbox run is typically short-lived.
      */
     sandboxSessions30d: number;
@@ -484,7 +591,7 @@ export interface DashboardSummary {
         savedUsd: number;
         savingsPercent: number;
         /**
-         * Provider prompt-cache reads (TD-347) over the same window — a
+         * Provider prompt-cache reads over the same window — a
          * SEPARATE population from `savedUsd`. A request can show heavy
          * cache-read activity while `savedUsd` is flat or negative (the router
          * moved off a model that was warm), so this must never be folded into

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAI/C;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAID,mDAAmD;AACnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAEF,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,sCAAsC;AACtC,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAIF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,oCAAoC;AACpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAIvE,kCAAkC;AAClC,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAA;AAIF,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE5D,yBAAyB;AACzB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAID;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;IAK/B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;EAQH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAElE,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAA;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAA;AAEF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAA;AAEF,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAM3E,uCAAuC;AACvC,eAAO,MAAM,uBAAuB;;;;IAIlC;;;;OAIG;;IAEH;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B,2DAA2D;IAC3D,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,0BAA0B;IAC1B,SAAS,EAAE;QACT,6EAA6E;QAC7E,WAAW,EAAE,MAAM,CAAA;QACnB;;;;;;;WAOG;QACH,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,4CAA4C;IAC5C,eAAe,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAGF,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;KACjD,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;IACF;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAA;AAI1B;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,sFAAsF;IACtF,SAAS,CAAC,EAAE,YAAY,CAAA;CACzB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAID,mDAAmD;AACnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAEF,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,sCAAsC;AACtC,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAIF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,oCAAoC;AACpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAIvE,kCAAkC;AAClC,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAA;AAIF,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE5D,yBAAyB;AACzB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAID;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;IAK/B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;EAQH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAElE,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAA;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAA;AAEF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAA;AAEF,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAM3E,uCAAuC;AACvC,eAAO,MAAM,uBAAuB;;;;IAIlC;;;;OAIG;;IAEH;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAA;CACxB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMkF,CAAA;AAEtH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,gBAAgB,EAAE,OAAO,CAAA;IACzB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAA;CACxB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B,2DAA2D;IAC3D,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,0BAA0B;IAC1B,SAAS,EAAE;QACT,6EAA6E;QAC7E,WAAW,EAAE,MAAM,CAAA;QACnB;;;;;;;WAOG;QACH,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,4CAA4C;IAC5C,eAAe,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAGF,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;KACjD,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;IACF;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B"}

package/dist/auth.js

@@ -2,14 +2,14 @@
 /**
  * Auth + RBAC Types — Shared across control plane services.
  *
- * LLD #7 — Auth, RBAC, Dashboard API
  * HLD §5.1 — Zero-Trust Perimeter
  *
  * @module
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CreateApiKeyInputSchema = exports.MagicLinkLoginInputSchema = exports.MagicLinkRequestInputSchema = exports.ResendVerificationInputSchema = exports.VerifyEmailInputSchema = exports.OrgSignupInputSchema = exports.SignupInputSchema = exports.UpdateRoleInputSchema = exports.InviteMemberInputSchema = exports.ChangePasswordInputSchema = exports.RefreshInputSchema = exports.RegisterInputSchema = exports.LoginInputSchema = void 0;
+exports.UpdateApiKeyInputSchema = exports.CreateApiKeyInputSchema = exports.MagicLinkLoginInputSchema = exports.MagicLinkRequestInputSchema = exports.ResendVerificationInputSchema = exports.VerifyEmailInputSchema = exports.OrgSignupInputSchema = exports.SignupInputSchema = exports.UpdateRoleInputSchema = exports.InviteMemberInputSchema = exports.ChangePasswordInputSchema = exports.RefreshInputSchema = exports.RegisterInputSchema = exports.LoginInputSchema = void 0;
 const zod_1 = require("zod");
+const spendBudgets_js_1 = require("./spendBudgets.js");
 // ─── Login ───────────────────────────────────────────────────────────
 /** Login request schema (Zod validated). */
 exports.LoginInputSchema = zod_1.z.object({
@@ -51,7 +51,7 @@ exports.InviteMemberInputSchema = zod_1.z.object({
 exports.UpdateRoleInputSchema = zod_1.z.object({
     role: zod_1.z.enum(['OWNER', 'ADMIN', 'EM', 'DEVELOPER', 'VIEWER']),
 });
-// ─── PLG Self-Serve Signup (LLD #9) ───────────────────────────────────
+// ─── PLG Self-Serve Signup ───────────────────────────────────
 /** PLG signup input schema. */
 exports.SignupInputSchema = zod_1.z.object({
     email: zod_1.z.string().email(),
@@ -75,7 +75,7 @@ exports.OrgSignupInputSchema = zod_1.z.object({
     orgName: zod_1.z.string().min(1).max(128),
     /**
      * The company's own domain (e.g. "acme.com") — informational, stored in
-     * `orgs.settings.domain` (LLD #71). Deliberately NOT the cell hostname:
+     * `orgs.settings.domain`. Deliberately NOT the cell hostname:
      * the org's slug is the subdomain under gateway.intutic.ai, so no domain
      * verification is needed here.
      */
@@ -118,8 +118,23 @@ exports.CreateApiKeyInputSchema = zod_1.z.object({
     /**
      * Automation key: exempt from the `ssoKeyMaxIdleDays` recency gate, because its
      * owner may never log in interactively. Still bound to the member's active flag
-     * and still revocable, so offboarding applies (TD-218).
+     * and still revocable, so offboarding applies.
      */
     isServiceAccount: zod_1.z.boolean().default(false),
 });
+/**
+ * `PATCH /api/v1/keys/:id` — replace a key's spend budgets and/or rate limit.
+ * The only way to set them: any member creates their own keys, and only an
+ * OWNER or ADMIN may say what a key can spend, so a key is created unlimited
+ * and limited afterwards.
+ * A field left out is unchanged; `budgets: []` removes every budget, and a
+ * `rateLimit` field set to `null` removes that limit.
+ */
+exports.UpdateApiKeyInputSchema = zod_1.z
+    .object({
+    budgets: spendBudgets_js_1.SpendBudgetListSchema.optional(),
+    rateLimit: spendBudgets_js_1.KeyRateLimitSchema.optional(),
+})
+    .strict()
+    .refine((v) => v.budgets !== undefined || v.rateLimit !== undefined, 'nothing to change: send budgets or rateLimit');
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAEH,6BAAuB;AA6DvB,wEAAwE;AAExE,4CAA4C;AAC/B,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAA;AAaF,wEAAwE;AAExE,mDAAmD;AACtC,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAcF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AASF,wEAAwE;AAExE,sCAAsC;AACzB,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAyBF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACzC,CAAC,CAAA;AAKF,wEAAwE;AAExE,kCAAkC;AACrB,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;CAC9D,CAAC,CAAA;AAEF,yEAAyE;AAEzE,+BAA+B;AAClB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAyBF,yEAAyE;AAEzE;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC;;;;;OAKG;IACH,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,oEAAoE,EAAE,qCAAqC,CAAC;SAClH,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AA+BF,iCAAiC;AACpB,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,8CAA8C;AACjC,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,iDAAiD;AACpC,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAKF,+CAA+C;AAClC,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAOF,wEAAwE;AAExE,uCAAuC;AAC1B,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAA"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,6BAAuB;AAEvB,uDAM0B;AA2E1B,wEAAwE;AAExE,4CAA4C;AAC/B,QAAA,gBAAgB,GAAG,OAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACrC,CAAC,CAAA;AAaF,wEAAwE;AAExE,mDAAmD;AACtC,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACzC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;IAC9D,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAcF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,kBAAkB,GAAG,OAAC,CAAC,MAAM,CAAC;IACzC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAA;AASF,wEAAwE;AAExE,sCAAsC;AACzB,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,eAAe,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAA;AAyBF,wEAAwE;AAExE,oCAAoC;AACvB,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACpD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACzC,CAAC,CAAA;AAKF,wEAAwE;AAExE,kCAAkC;AACrB,QAAA,qBAAqB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;CAC9D,CAAC,CAAA;AAEF,gEAAgE;AAEhE,+BAA+B;AAClB,QAAA,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AAyBF,yEAAyE;AAEzE;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;IACzB,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnC;;;;;OAKG;IACH,SAAS,EAAE,OAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,GAAG,CAAC;SACR,KAAK,CAAC,oEAAoE,EAAE,qCAAqC,CAAC;SAClH,QAAQ,EAAE;IACb,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3C,oBAAoB,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC,CAAA;AA+BF,iCAAiC;AACpB,QAAA,sBAAsB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;CAC7B,CAAC,CAAA;AAEF,8CAA8C;AACjC,QAAA,6BAA6B,GAAG,OAAC,CAAC,MAAM,CAAC;IACpD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;CAC1B,CAAC,CAAA;AAEF,iDAAiD;AACpC,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;CACnC,CAAC,CAAA;AAKF,+CAA+C;AAClC,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACzB,CAAC,CAAA;AAOF,wEAAwE;AAExE,uCAAuC;AAC1B,QAAA,uBAAuB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC9C,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1C,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1D;;;;OAIG;IACH,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5E;;;;OAIG;IACH,gBAAgB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CAC7C,CAAC,CAAA;AAuBF;;;;;;;GAOG;AACU,QAAA,uBAAuB,GAAG,OAAC;KACrC,MAAM,CAAC;IACN,OAAO,EAAE,uCAAqB,CAAC,QAAQ,EAAE;IACzC,SAAS,EAAE,oCAAkB,CAAC,QAAQ,EAAE;CACzC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,KAAK,SAAS,EAAE,8CAA8C,CAAC,CAAA"}

package/dist/billing.d.ts

@@ -1,5 +1,5 @@
 /**
- * Monetization & Financial Ledger types — LLD #20
+ * Monetization & Financial Ledger types
  *
  * Stripe Metered Billing,
  * and usage-based overage enforcement.

package/dist/billing.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Monetization & Financial Ledger types — LLD #20
+ * Monetization & Financial Ledger types
  *
  * Stripe Metered Billing,
  * and usage-based overage enforcement.

package/dist/cloudProbe.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Verification probes for cloud provider credentials: AWS Bedrock and Google
+ * Vertex AI, whose cheapest authenticated call has to be signed per request.
+ *
+ * Still no network here: this builds the request (SigV4-signed, or carrying a
+ * freshly signed service-account assertion) with WebCrypto, which Node and
+ * browsers both provide, and the executors in the CLI and the control plane
+ * send it exactly as they send every other provider's probe.
+ *
+ * - **Bedrock, access key pair**: STS `GetCallerIdentity`, which any valid
+ *   key may call — it proves the key, not its Bedrock permissions, which the
+ *   first model call checks.
+ *   <https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html>
+ * - **Bedrock, API key**: `ListFoundationModels` with the key as a bearer
+ *   token (Bedrock API keys work with Bedrock control-plane actions).
+ *   <https://docs.aws.amazon.com/bedrock/latest/userguide/api-keys-use.html>
+ * - **Vertex AI**: the service account's OAuth token exchange — the key is
+ *   valid when Google mints a token for it; project access is checked on the
+ *   first model call. An `authorized_user` file is checked by its refresh
+ *   grant.
+ *
+ * @module
+ */
+import type { ProviderProbeRequest } from './providerVerification.js';
+export interface SigV4Input {
+    method: string;
+    host: string;
+    path: string;
+    query?: Array<[string, string]>;
+    /** Headers to sign besides `host` and `x-amz-date`. */
+    headers?: Record<string, string>;
+    body: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken?: string;
+    region: string;
+    service: string;
+    now: Date;
+}
+/**
+ * AWS Signature Version 4: the headers to add (`x-amz-date`,
+ * `x-amz-security-token` for temporary credentials, `authorization`).
+ * Held to AWS's published test-suite vectors in this package's tests.
+ */
+export declare function sigv4Headers(i: SigV4Input): Promise<Record<string, string>>;
+/** An RS256 JWT bearer assertion for Google's token endpoint. */
+export declare function serviceAccountAssertion(clientEmail: string, privateKeyPem: string, privateKeyId: string | undefined, now: Date): Promise<string>;
+export declare const GOOGLE_TOKEN_URI = "https://oauth2.googleapis.com/token";
+/**
+ * The verification request for a Bedrock or Vertex AI credential, or `null`
+ * when `fields` are not a complete credential for one.
+ */
+export declare function buildCloudVerificationProbe(provider: string, fields: Record<string, string>, now?: Date): Promise<ProviderProbeRequest | null>;
+//# sourceMappingURL=cloudProbe.d.ts.map

package/dist/cloudProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudProbe.d.ts","sourceRoot":"","sources":["../src/cloudProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAgB,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAiCnF,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IAC/B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,GAAG,EAAE,IAAI,CAAA;CACV;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmCjF;AASD,iEAAiE;AACjE,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EACnB,aAAa,EAAE,MAAM,EACrB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,MAAM,CAAC,CAoBjB;AAED,eAAO,MAAM,gBAAgB,wCAAwC,CAAA;AA+BrE;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CA2FtC"}