@intutic/shared-types 2.4.0 → 2.5.1

package/README.md

@@ -8,12 +8,12 @@
 
 ## Scope
 
-27 source modules exporting ~200+ types covering:
+One source module per domain under `src/`. Among them:
 
 | Module | Key Types |
 |--------|-----------|
-| `enums` | `EnforcementAction`, `HarnessType`, `RiskLevel`, `SopLifecycleStage` |
-| `finops` | `TraceEntry`, `Attribution4D`, `BudgetEnvelope`, `CostBreakdown` |
+| `enums` | `EnforcementAction`, `HarnessType`, `RiskLevel`, `SopLifecycleState` |
+| `finops` | `TraceEntry`, `CostBreakdown`, `TraceFilters` |
 | `sop` | SOP lifecycle types, rule schemas, hook definitions |
 | `auth` | Session, token, credential types |
 | `identity` | SSO/OIDC provider config, cross-workspace user identity |
@@ -23,23 +23,23 @@
 | `notifications` | Notification channels, alert templates, delivery status |
 | `billing` | Subscription tiers, usage metering, invoice types |
 | `observability` | Trace spans, metric definitions, log schemas |
+| `responses/` | The control plane's response schemas (`<Thing>Response`, zod with the inferred type): what each route that declares one answers with, as published in the OpenAPI document |
 
 ## Usage
 
 ```typescript
-import { EnforcementAction, HarnessType } from '@intutic/shared-types';
-import { traceEntrySchema } from '@intutic/shared-types/finops';
+import { EnforcementAction, HarnessType, CreateTraceSchema } from '@intutic/shared-types';
 
 // Zod validation
-const parsed = traceEntrySchema.parse(rawData);
+const parsed = CreateTraceSchema.parse(rawData);
 ```
 
 ## Design Principles
 
 - **Single source of truth**: All cross-package types live here. No type duplication.
-- **Zod-first**: Schemas define the shape; TypeScript types are inferred via `z.infer<>`.
-- **Barrel exports**: Each module re-exports from `index.ts` for clean import paths.
-- **No runtime dependencies**: This package has zero runtime dependencies beyond Zod.
+- **Zod at the boundaries**: API payloads have Zod schemas, with their TypeScript types inferred via `z.infer<>`; other shapes are plain interfaces.
+- **Barrel exports**: `index.ts` is the single entry point; import from the package root (there are no subpath exports).
+- **Minimal runtime dependencies**: Zod and `@intutic/anomaly-taxonomy`, nothing else.
 
 ## Installation
 

package/dist/anomaly.d.ts

@@ -219,23 +219,4 @@ export interface CapabilityMissInput {
     similarityScore?: number;
     recommendedAction?: 'AUTHOR_NEW_SOP' | 'EXTEND_EXISTING_SOP';
 }
-/**
- * Drift direction classification.
- *
- * HLD §7.7 — Behavioral Drift Detector
- */
-export type DriftDirection = 'POSITIVE_DRIFT' | 'NEGATIVE_DRIFT' | 'NEUTRAL_DRIFT';
-/**
- * Drift detection event payload.
- *
- * anomaly.drift.detected event
- */
-export interface DriftEvent {
-    workspaceId: string;
-    sopId: string;
-    driftScore: number;
-    driftDirection: DriftDirection;
-    baselineScore: number;
-    currentScore: number;
-}
 //# sourceMappingURL=anomaly.d.ts.map

package/dist/anomaly.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI7C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,EAAE,WAAW,CAAA;IAEjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,EAAE,OAAO,CAAA;IAEjB,0EAA0E;IAC1E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;IAE/B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,gDAAgD;IAChD,QAAQ,EAAE,eAAe,CAAA;IAEzB,uDAAuD;IACvD,cAAc,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAE3C,4DAA4D;IAC5D,YAAY,EAAE,WAAW,EAAE,CAAA;IAE3B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAID;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,CAAA;AAE/B;;;;GAIG;AACH;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAElB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,SAAS,EAAE,SAAS,CAAA;IAEpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IAEjB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAA;IAElB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAEhB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IAEjB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAA;IAEf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAA;IAEd,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAA;IAEpB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAA;IAEpB,4BAA4B;IAC5B,aAAa,EAAE,MAAM,CAAA;IAErB,iCAAiC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IAErB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAA;IAEb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAAA;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAKrD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAA;IAEvB,iCAAiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3B,+CAA+C;IAC/C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B,0CAA0C;IAC1C,iBAAiB,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC7D;AAID;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAA;AAElF;;;;GAIG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,EAAE,MAAM,CAAA;IAClB,cAAc,EAAE,cAAc,CAAA;IAC9B,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,EAAE,MAAM,CAAA;CACrB"}
+{"version":3,"file":"anomaly.d.ts","sourceRoot":"","sources":["../src/anomaly.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAI7C;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,IAAI,EAAE,WAAW,CAAA;IAEjB,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACnC;AAID;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,uCAAuC;IACvC,QAAQ,EAAE,OAAO,CAAA;IAEjB,0EAA0E;IAC1E,WAAW,EAAE,WAAW,GAAG,IAAI,CAAA;IAE/B,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAElB,gDAAgD;IAChD,QAAQ,EAAE,eAAe,CAAA;IAEzB,uDAAuD;IACvD,cAAc,EAAE,oBAAoB,GAAG,IAAI,CAAA;IAE3C,4DAA4D;IAC5D,YAAY,EAAE,WAAW,EAAE,CAAA;IAE3B,kEAAkE;IAClE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAID;;;;GAIG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAChE,YAAY,EAAE,eAAe,EAAE,CAAA;AAE/B;;;;GAIG;AACH;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAA;AAIhE;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAElB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAA;IAElB,uDAAuD;IACvD,cAAc,EAAE,MAAM,EAAE,CAAA;IAExB,iEAAiE;IACjE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAID;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpD;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,kBAAkB;IAClB,SAAS,EAAE,SAAS,CAAA;IAEpB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAA;IAEjB,2CAA2C;IAC3C,SAAS,EAAE,OAAO,CAAA;IAElB,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAElB,kEAAkE;IAClE,OAAO,EAAE,OAAO,CAAA;IAEhB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAA;IAEnB,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IAEjB,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAID;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sCAAsC;IACtC,OAAO,EAAE,MAAM,CAAA;IAEf,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAA;IAEd,mCAAmC;IACnC,YAAY,EAAE,MAAM,CAAA;IAEpB,2BAA2B;IAC3B,YAAY,EAAE,MAAM,CAAA;IAEpB,4BAA4B;IAC5B,aAAa,EAAE,MAAM,CAAA;IAErB,iCAAiC;IACjC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAE5B,+BAA+B;IAC/B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAA;IAErB,8BAA8B;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAEhB,qBAAqB;IACrB,KAAK,EAAE,MAAM,CAAA;IAEb,6BAA6B;IAC7B,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,kBAAkB,GAAG,eAAe,CAAA;IAC1C,WAAW,CAAC,EAAE,WAAW,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAEhD;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,cAAc,CAAA;AAKrD;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAA;IAEd,oBAAoB;IACpB,WAAW,EAAE,MAAM,CAAA;IAEnB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IAExB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAA;IAEvB,iCAAiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IAEtB,oDAAoD;IACpD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAE3B,+CAA+C;IAC/C,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAE9B,0CAA0C;IAC1C,iBAAiB,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC5D;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,EAAE,MAAM,CAAA;IACvB,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,iBAAiB,CAAC,EAAE,gBAAgB,GAAG,qBAAqB,CAAA;CAC7D"}

package/dist/apiKeyScopes.d.ts

@@ -0,0 +1,100 @@
+/**
+ * API key scopes — what a `vk_` key may do, on top of its owner's role.
+ *
+ * One small, fixed vocabulary, in the shape GitHub fine-grained tokens, Stripe
+ * restricted keys, OpenAI project keys and Cloudflare API tokens share: a
+ * resource area with a `read` or `write` level, `write` covering `read`, and
+ * everything not granted refused. Three kinds of scope:
+ *
+ * - `*` — everything the owner's role allows. The default, and what every key
+ *   minted before scopes were enforced holds.
+ * - `gateway:use` — agent traffic: what the proxy, the hook gates, the SDKs,
+ *   the MCP proxy and the sync daemon send with a key (LLM calls through the
+ *   proxy, gate checks, hook events, trace sync-back, holds). The scope for a
+ *   key that only runs agents.
+ * - `<area>:read` / `<area>:write` — the REST API by area.
+ *
+ * A request made with a key needs BOTH: the owner's role must allow the route
+ * and the key's scopes must cover it. A dashboard session has no scopes; only
+ * its role applies. The control plane maps every route to the scopes that
+ * cover it (`services/control-plane/src/lib/routeScopes.ts`) and refuses an
+ * uncovered request with 403 `INSUFFICIENT_SCOPE`.
+ *
+ * Mirrored by the Terraform provider's `validKeyScopes` (checked by
+ * `__tests__/apiKeyScopes.test.ts`) and published in `apps/docs/reference/api.md`
+ * (generated from this file).
+ *
+ * @module
+ */
+/** Every REST area a scope can name, with what it covers. Order is the display order. */
+export declare const API_SCOPE_AREAS: {
+    readonly traces: "traces, agent sessions, plans, loop runs, trajectories, agents and the tamper-evident trace chain";
+    readonly usage: "usage, cost and routing analytics, cost prediction and provider incidents";
+    readonly findings: "findings, incidents, anomalies, holds and decisions, judge reviews, governance cards, trust scores and break-glass";
+    readonly sops: "SOPs and their lifecycle, skills, the dream cycle, MetaClaw and optimisation suggestions";
+    readonly policies: "policies, guardrails and policy documents, WASM rules, rule candidates and the evaluator sandbox";
+    readonly compliance: "compliance coverage, probes and evidence exports, and the audit timeline";
+    readonly inventory: "developer machines, harnesses, MCP servers, self-hosted gateways and governance coverage";
+    readonly settings: "workspace settings, provider credentials, region, orgs and teams, domains, SSO providers and the license";
+    readonly members: "members, invitations, roles, profiles and SCIM tokens";
+    readonly keys: "API keys, attenuated child keys and on-behalf-of tokens";
+    readonly billing: "billing, invoices, budgets and trials";
+    readonly siem: "SIEM destinations and their dead-letter queue, and notification rules";
+    readonly integrations: "connectors and the GitHub, Slack and task-tracker integrations";
+};
+/** A REST area a scope can name. */
+export type ApiKeyScopeArea = keyof typeof API_SCOPE_AREAS;
+/** The scope that covers agent traffic. */
+export declare const GATEWAY_USE_SCOPE: "gateway:use";
+/** The scope that covers everything the owner's role allows. */
+export declare const ALL_SCOPES: "*";
+/** One scope a key can hold. */
+export type ApiKeyScope = typeof ALL_SCOPES | typeof GATEWAY_USE_SCOPE | `${ApiKeyScopeArea}:${'read' | 'write'}`;
+/** A scope with what it grants, as the dashboard, the CLI and the docs show it. */
+export interface ApiKeyScopeEntry {
+    scope: ApiKeyScope;
+    description: string;
+}
+/** The registry: every valid scope, in display order. */
+export declare const API_SCOPES: readonly ApiKeyScopeEntry[];
+/** Every valid scope string. */
+export declare const API_SCOPE_NAMES: readonly ApiKeyScope[];
+/** The least-privilege preset for a key that only runs agents, CI jobs or a proxy. */
+export declare const AUTOMATION_KEY_SCOPES: readonly ApiKeyScope[];
+/** Whether `scope` is in the registry. */
+export declare function isApiKeyScope(scope: string): scope is ApiKeyScope;
+/** The scopes in `scopes` that are not in the registry. */
+export declare function unknownApiKeyScopes(scopes: readonly string[]): string[];
+/**
+ * Whether a key holding `granted` may act with `required`: `*` grants every
+ * scope, and `<area>:write` grants `<area>:read`.
+ */
+export declare function scopeGrants(granted: readonly string[], required: string): boolean;
+/** Whether a key holding `granted` may act with at least one of `anyOf`. */
+export declare function scopesGrantAny(granted: readonly string[], anyOf: readonly string[]): boolean;
+/**
+ * What a key's stored scopes mean today.
+ *
+ * - All known: those scopes.
+ * - None known (a key written with free-form scope strings before scopes were
+ *   enforced, such as `["read"]`): `*`, flagged `legacy`, for one release —
+ *   until 2.6.0, when such a key is refused. The control plane logs a
+ *   deprecation warning on each use and the dashboard marks the key.
+ * - Some known: the known ones; the unknown ones grant nothing.
+ * - Missing (a NULL column): `*`, the column's default.
+ */
+export declare function effectiveApiKeyScopes(stored: unknown): {
+    scopes: ApiKeyScope[];
+    legacy: boolean;
+    ignored: string[];
+};
+/**
+ * The smallest list granting the same as `scopes`: `*` alone when present,
+ * and an area's `read` dropped when its `write` is there. Registry order.
+ */
+export declare function compactScopes(scopes: readonly string[]): ApiKeyScope[];
+/** What both `a` and `b` grant, compacted — a child key's reach under its parent. */
+export declare function intersectScopes(a: readonly string[], b: readonly string[]): ApiKeyScope[];
+/** The message naming the valid scopes, for a request that sent an unknown one. */
+export declare function unknownScopesMessage(unknown: readonly string[]): string;
+//# sourceMappingURL=apiKeyScopes.d.ts.map

package/dist/apiKeyScopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyScopes.d.ts","sourceRoot":"","sources":["../src/apiKeyScopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,yFAAyF;AACzF,eAAO,MAAM,eAAe;;;;;;;;;;;;;;CAclB,CAAA;AAEV,oCAAoC;AACpC,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,eAAe,CAAA;AAE1D,2CAA2C;AAC3C,eAAO,MAAM,iBAAiB,EAAG,aAAsB,CAAA;AAEvD,gEAAgE;AAChE,eAAO,MAAM,UAAU,EAAG,GAAY,CAAA;AAEtC,gCAAgC;AAChC,MAAM,MAAM,WAAW,GAAG,OAAO,UAAU,GAAG,OAAO,iBAAiB,GAAG,GAAG,eAAe,IAAI,MAAM,GAAG,OAAO,EAAE,CAAA;AAEjH,mFAAmF;AACnF,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,WAAW,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,yDAAyD;AACzD,eAAO,MAAM,UAAU,EAAE,SAAS,gBAAgB,EAWjD,CAAA;AAED,gCAAgC;AAChC,eAAO,MAAM,eAAe,EAAE,SAAS,WAAW,EAAmC,CAAA;AAIrF,sFAAsF;AACtF,eAAO,MAAM,qBAAqB,EAAE,SAAS,WAAW,EAAwB,CAAA;AAEhF,0CAA0C;AAC1C,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,WAAW,CAEjE;AAED,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAEvE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAKjF;AAED,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAE5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAOpH;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAKtE;AAED,qFAAqF;AACrF,wBAAgB,eAAe,CAAC,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,EAAE,CAGzF;AAED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAEvE"}

package/dist/apiKeyScopes.js

@@ -0,0 +1,142 @@
+"use strict";
+/**
+ * API key scopes — what a `vk_` key may do, on top of its owner's role.
+ *
+ * One small, fixed vocabulary, in the shape GitHub fine-grained tokens, Stripe
+ * restricted keys, OpenAI project keys and Cloudflare API tokens share: a
+ * resource area with a `read` or `write` level, `write` covering `read`, and
+ * everything not granted refused. Three kinds of scope:
+ *
+ * - `*` — everything the owner's role allows. The default, and what every key
+ *   minted before scopes were enforced holds.
+ * - `gateway:use` — agent traffic: what the proxy, the hook gates, the SDKs,
+ *   the MCP proxy and the sync daemon send with a key (LLM calls through the
+ *   proxy, gate checks, hook events, trace sync-back, holds). The scope for a
+ *   key that only runs agents.
+ * - `<area>:read` / `<area>:write` — the REST API by area.
+ *
+ * A request made with a key needs BOTH: the owner's role must allow the route
+ * and the key's scopes must cover it. A dashboard session has no scopes; only
+ * its role applies. The control plane maps every route to the scopes that
+ * cover it (`services/control-plane/src/lib/routeScopes.ts`) and refuses an
+ * uncovered request with 403 `INSUFFICIENT_SCOPE`.
+ *
+ * Mirrored by the Terraform provider's `validKeyScopes` (checked by
+ * `__tests__/apiKeyScopes.test.ts`) and published in `apps/docs/reference/api.md`
+ * (generated from this file).
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTOMATION_KEY_SCOPES = exports.API_SCOPE_NAMES = exports.API_SCOPES = exports.ALL_SCOPES = exports.GATEWAY_USE_SCOPE = exports.API_SCOPE_AREAS = void 0;
+exports.isApiKeyScope = isApiKeyScope;
+exports.unknownApiKeyScopes = unknownApiKeyScopes;
+exports.scopeGrants = scopeGrants;
+exports.scopesGrantAny = scopesGrantAny;
+exports.effectiveApiKeyScopes = effectiveApiKeyScopes;
+exports.compactScopes = compactScopes;
+exports.intersectScopes = intersectScopes;
+exports.unknownScopesMessage = unknownScopesMessage;
+/** Every REST area a scope can name, with what it covers. Order is the display order. */
+exports.API_SCOPE_AREAS = {
+    traces: 'traces, agent sessions, plans, loop runs, trajectories, agents and the tamper-evident trace chain',
+    usage: 'usage, cost and routing analytics, cost prediction and provider incidents',
+    findings: 'findings, incidents, anomalies, holds and decisions, judge reviews, governance cards, trust scores and break-glass',
+    sops: 'SOPs and their lifecycle, skills, the dream cycle, MetaClaw and optimisation suggestions',
+    policies: 'policies, guardrails and policy documents, WASM rules, rule candidates and the evaluator sandbox',
+    compliance: 'compliance coverage, probes and evidence exports, and the audit timeline',
+    inventory: 'developer machines, harnesses, MCP servers, self-hosted gateways and governance coverage',
+    settings: 'workspace settings, provider credentials, region, orgs and teams, domains, SSO providers and the license',
+    members: 'members, invitations, roles, profiles and SCIM tokens',
+    keys: 'API keys, attenuated child keys and on-behalf-of tokens',
+    billing: 'billing, invoices, budgets and trials',
+    siem: 'SIEM destinations and their dead-letter queue, and notification rules',
+    integrations: 'connectors and the GitHub, Slack and task-tracker integrations',
+};
+/** The scope that covers agent traffic. */
+exports.GATEWAY_USE_SCOPE = 'gateway:use';
+/** The scope that covers everything the owner's role allows. */
+exports.ALL_SCOPES = '*';
+/** The registry: every valid scope, in display order. */
+exports.API_SCOPES = [
+    { scope: exports.ALL_SCOPES, description: "Everything the key owner's role allows (the default)" },
+    {
+        scope: exports.GATEWAY_USE_SCOPE,
+        description: 'Agent traffic: LLM calls through the proxy, hook-gate checks, hook events, trace sync-back, sessions, holds, SOP rules, the policy snapshot and the workspace settings agents read',
+    },
+    ...Object.entries(exports.API_SCOPE_AREAS).flatMap(([area, covers]) => [
+        { scope: `${area}:read`, description: `Read ${covers}` },
+        { scope: `${area}:write`, description: `Read and change ${covers}` },
+    ]),
+];
+/** Every valid scope string. */
+exports.API_SCOPE_NAMES = exports.API_SCOPES.map((s) => s.scope);
+const SCOPE_SET = new Set(exports.API_SCOPE_NAMES);
+/** The least-privilege preset for a key that only runs agents, CI jobs or a proxy. */
+exports.AUTOMATION_KEY_SCOPES = [exports.GATEWAY_USE_SCOPE];
+/** Whether `scope` is in the registry. */
+function isApiKeyScope(scope) {
+    return SCOPE_SET.has(scope);
+}
+/** The scopes in `scopes` that are not in the registry. */
+function unknownApiKeyScopes(scopes) {
+    return scopes.filter((s) => !SCOPE_SET.has(s));
+}
+/**
+ * Whether a key holding `granted` may act with `required`: `*` grants every
+ * scope, and `<area>:write` grants `<area>:read`.
+ */
+function scopeGrants(granted, required) {
+    if (granted.includes(exports.ALL_SCOPES))
+        return true;
+    if (granted.includes(required))
+        return true;
+    if (required.endsWith(':read'))
+        return granted.includes(`${required.slice(0, -':read'.length)}:write`);
+    return false;
+}
+/** Whether a key holding `granted` may act with at least one of `anyOf`. */
+function scopesGrantAny(granted, anyOf) {
+    return anyOf.some((r) => scopeGrants(granted, r));
+}
+/**
+ * What a key's stored scopes mean today.
+ *
+ * - All known: those scopes.
+ * - None known (a key written with free-form scope strings before scopes were
+ *   enforced, such as `["read"]`): `*`, flagged `legacy`, for one release —
+ *   until 2.6.0, when such a key is refused. The control plane logs a
+ *   deprecation warning on each use and the dashboard marks the key.
+ * - Some known: the known ones; the unknown ones grant nothing.
+ * - Missing (a NULL column): `*`, the column's default.
+ */
+function effectiveApiKeyScopes(stored) {
+    if (!Array.isArray(stored))
+        return { scopes: [exports.ALL_SCOPES], legacy: false, ignored: [] };
+    const strings = stored.filter((s) => typeof s === 'string');
+    const known = strings.filter(isApiKeyScope);
+    const ignored = strings.filter((s) => !SCOPE_SET.has(s));
+    if (known.length === 0)
+        return { scopes: [exports.ALL_SCOPES], legacy: true, ignored };
+    return { scopes: compactScopes(known), legacy: false, ignored };
+}
+/**
+ * The smallest list granting the same as `scopes`: `*` alone when present,
+ * and an area's `read` dropped when its `write` is there. Registry order.
+ */
+function compactScopes(scopes) {
+    if (scopes.includes(exports.ALL_SCOPES))
+        return [exports.ALL_SCOPES];
+    return exports.API_SCOPE_NAMES.filter((s) => s !== exports.ALL_SCOPES && scopes.includes(s) && !(s.endsWith(':read') && scopes.includes(`${s.slice(0, -':read'.length)}:write`)));
+}
+/** What both `a` and `b` grant, compacted — a child key's reach under its parent. */
+function intersectScopes(a, b) {
+    if (a.includes(exports.ALL_SCOPES) && b.includes(exports.ALL_SCOPES))
+        return [exports.ALL_SCOPES];
+    return compactScopes(exports.API_SCOPE_NAMES.filter((s) => s !== exports.ALL_SCOPES && scopeGrants(a, s) && scopeGrants(b, s)));
+}
+/** The message naming the valid scopes, for a request that sent an unknown one. */
+function unknownScopesMessage(unknown) {
+    return `Unknown scope${unknown.length === 1 ? '' : 's'} ${unknown.map((s) => `"${s}"`).join(', ')}. Valid scopes: ${exports.API_SCOPE_NAMES.join(', ')}`;
+}
+//# sourceMappingURL=apiKeyScopes.js.map

package/dist/apiKeyScopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiKeyScopes.js","sourceRoot":"","sources":["../src/apiKeyScopes.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;AA4DH,sCAEC;AAGD,kDAEC;AAMD,kCAKC;AAGD,wCAEC;AAaD,sDAOC;AAMD,sCAKC;AAGD,0CAGC;AAGD,oDAEC;AA3HD,yFAAyF;AAC5E,QAAA,eAAe,GAAG;IAC7B,MAAM,EAAE,mGAAmG;IAC3G,KAAK,EAAE,2EAA2E;IAClF,QAAQ,EAAE,oHAAoH;IAC9H,IAAI,EAAE,0FAA0F;IAChG,QAAQ,EAAE,kGAAkG;IAC5G,UAAU,EAAE,0EAA0E;IACtF,SAAS,EAAE,0FAA0F;IACrG,QAAQ,EAAE,0GAA0G;IACpH,OAAO,EAAE,uDAAuD;IAChE,IAAI,EAAE,yDAAyD;IAC/D,OAAO,EAAE,uCAAuC;IAChD,IAAI,EAAE,uEAAuE;IAC7E,YAAY,EAAE,gEAAgE;CACtE,CAAA;AAKV,2CAA2C;AAC9B,QAAA,iBAAiB,GAAG,aAAsB,CAAA;AAEvD,gEAAgE;AACnD,QAAA,UAAU,GAAG,GAAY,CAAA;AAWtC,yDAAyD;AAC5C,QAAA,UAAU,GAAgC;IACrD,EAAE,KAAK,EAAE,kBAAU,EAAE,WAAW,EAAE,sDAAsD,EAAE;IAC1F;QACE,KAAK,EAAE,yBAAiB;QACxB,WAAW,EACT,oLAAoL;KACvL;IACD,GAAI,MAAM,CAAC,OAAO,CAAC,uBAAe,CAAsC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACnG,EAAE,KAAK,EAAE,GAAG,IAAI,OAAsB,EAAE,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE;QACvE,EAAE,KAAK,EAAE,GAAG,IAAI,QAAuB,EAAE,WAAW,EAAE,mBAAmB,MAAM,EAAE,EAAE;KACpF,CAAC;CACH,CAAA;AAED,gCAAgC;AACnB,QAAA,eAAe,GAA2B,kBAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAErF,MAAM,SAAS,GAAwB,IAAI,GAAG,CAAC,uBAAe,CAAC,CAAA;AAE/D,sFAAsF;AACzE,QAAA,qBAAqB,GAA2B,CAAC,yBAAiB,CAAC,CAAA;AAEhF,0CAA0C;AAC1C,SAAgB,aAAa,CAAC,KAAa;IACzC,OAAO,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;AAC7B,CAAC;AAED,2DAA2D;AAC3D,SAAgB,mBAAmB,CAAC,MAAyB;IAC3D,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;AAChD,CAAC;AAED;;;GAGG;AACH,SAAgB,WAAW,CAAC,OAA0B,EAAE,QAAgB;IACtE,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3C,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACtG,OAAO,KAAK,CAAA;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAgB,cAAc,CAAC,OAA0B,EAAE,KAAwB;IACjF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CAAC,MAAe;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,kBAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACvF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAA;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAA;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IACxD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,kBAAU,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;IAC9E,OAAO,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACjE,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAU,CAAC;QAAE,OAAO,CAAC,kBAAU,CAAC,CAAA;IACpD,OAAO,uBAAe,CAAC,MAAM,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,kBAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CACnI,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,SAAgB,eAAe,CAAC,CAAoB,EAAE,CAAoB;IACxE,IAAI,CAAC,CAAC,QAAQ,CAAC,kBAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,kBAAU,CAAC;QAAE,OAAO,CAAC,kBAAU,CAAC,CAAA;IACzE,OAAO,aAAa,CAAC,uBAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,kBAAU,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AACjH,CAAC;AAED,mFAAmF;AACnF,SAAgB,oBAAoB,CAAC,OAA0B;IAC7D,OAAO,gBAAgB,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,uBAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAA;AAClJ,CAAC"}

package/dist/attenuation.d.ts

@@ -1,8 +1,9 @@
 /**
- * Attenuation & GDPR types (Enterprise Identity & Compliance)
+ * Attenuation types (Enterprise Identity & Compliance)
  *
- * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
- * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.
+ * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens and SSO
+ * Group Privilege Scoping. Per-user GDPR erasure has no types here: it is an
+ * operator script over the control plane's data erasure service.
  *
  * HLD §5.1, §5.6 — Zero-Trust Identity Broker
  *
@@ -71,7 +72,7 @@ export interface AttenuationChainLink {
     childKeyId: string;
     /** Workspace scope */
     workspaceId: string;
-    /** Capabilities granted to the child key */
+    /** Scopes granted to the child key */
     grantedCaps: string[];
     /** Chain expiry (ISO-8601) */
     expiresAt: string;
@@ -81,7 +82,11 @@ export interface AttenuationChainLink {
 /** Request schema for token attenuation. */
 export declare const AttenuateTokenInputSchema: z.ZodObject<{
     parentKeyId: z.ZodString;
-    requestedCaps: z.ZodArray<z.ZodString, "many">;
+    /**
+     * The child key's scopes (`API_SCOPES`), each one granted by the parent
+     * key: a child can only narrow.
+     */
+    requestedCaps: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
     ttlSeconds: z.ZodOptional<z.ZodNumber>;
 }, "strip", z.ZodTypeAny, {
     parentKeyId: string;

package/dist/attenuation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attenuation.d.ts","sourceRoot":"","sources":["../src/attenuation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,6CAA6C;AAC7C,eAAO,MAAM,wBAAwB;;;;;;;;;EAGnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAIzE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAA;IAChB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,4CAA4C;AAC5C,eAAO,MAAM,yBAAyB;;;;;;;;;;;;EAIpC,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAK3E;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,4EAA4E;IAC5E,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB"}
+{"version":3,"file":"attenuation.d.ts","sourceRoot":"","sources":["../src/attenuation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,kCAAkC;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,qCAAqC;IACrC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAA;IAChB,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,6CAA6C;AAC7C,eAAO,MAAM,wBAAwB;;;;;;;;;EAGnC,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAA;AAIzE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAA;IAChB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,kCAAkC;IAClC,kBAAkB,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,6BAA6B;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,4BAA4B;IAC5B,UAAU,EAAE,MAAM,CAAA;IAClB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,WAAW,EAAE,MAAM,EAAE,CAAA;IACrB,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,oCAAoC;IACpC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,4CAA4C;AAC5C,eAAO,MAAM,yBAAyB;;IAEpC;;;OAGG;;;;;;;;;;;EASH,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAK3E;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAA;AAErE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,0FAA0F;IAC1F,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,+DAA+D;IAC/D,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB,4EAA4E;IAC5E,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB"}

package/dist/attenuation.js

@@ -1,9 +1,10 @@
 "use strict";
 /**
- * Attenuation & GDPR types (Enterprise Identity & Compliance)
+ * Attenuation types (Enterprise Identity & Compliance)
  *
- * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens,
- * PointerMemory GDPR erasure, and SSO Group Privilege Scoping.
+ * DCT Token Attenuation (Patent Family A), OBO Ephemeral Tokens and SSO
+ * Group Privilege Scoping. Per-user GDPR erasure has no types here: it is an
+ * operator script over the control plane's data erasure service.
  *
  * HLD §5.1, §5.6 — Zero-Trust Identity Broker
  *
@@ -12,6 +13,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AttenuateTokenInputSchema = exports.IssueOboTokenInputSchema = void 0;
 const zod_1 = require("zod");
+const apiKeyScopes_js_1 = require("./apiKeyScopes.js");
 /** Request schema for OBO token issuance. */
 exports.IssueOboTokenInputSchema = zod_1.z.object({
     sessionId: zod_1.z.string().min(1).optional(),
@@ -20,7 +22,18 @@ exports.IssueOboTokenInputSchema = zod_1.z.object({
 /** Request schema for token attenuation. */
 exports.AttenuateTokenInputSchema = zod_1.z.object({
     parentKeyId: zod_1.z.string().min(1),
-    requestedCaps: zod_1.z.array(zod_1.z.string().min(1)).min(1, 'At least one capability must be requested'),
+    /**
+     * The child key's scopes (`API_SCOPES`), each one granted by the parent
+     * key: a child can only narrow.
+     */
+    requestedCaps: zod_1.z
+        .array(zod_1.z.string().min(1))
+        .min(1, 'At least one scope must be requested')
+        .superRefine((caps, ctx) => {
+        const unknown = (0, apiKeyScopes_js_1.unknownApiKeyScopes)(caps);
+        if (unknown.length > 0)
+            ctx.addIssue({ code: zod_1.z.ZodIssueCode.custom, message: (0, apiKeyScopes_js_1.unknownScopesMessage)(unknown) });
+    }),
     ttlSeconds: zod_1.z.number().int().min(60).max(86400).optional(),
 });
 //# sourceMappingURL=attenuation.js.map

package/dist/attenuation.js.map

@@ -1 +1 @@
-{"version":3,"file":"attenuation.js","sourceRoot":"","sources":["../src/attenuation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,6BAAuB;AA2BvB,6CAA6C;AAChC,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;CACtF,CAAC,CAAA;AA0CF,4CAA4C;AAC/B,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,aAAa,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,2CAA2C,CAAC;IAC7F,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAA"}
+{"version":3,"file":"attenuation.js","sourceRoot":"","sources":["../src/attenuation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAEH,6BAAuB;AACvB,uDAA6E;AA2B7E,6CAA6C;AAChC,QAAA,wBAAwB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC/C,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACvC,WAAW,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;CACtF,CAAC,CAAA;AA0CF,4CAA4C;AAC/B,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B;;;OAGG;IACH,aAAa,EAAE,OAAC;SACb,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SACxB,GAAG,CAAC,CAAC,EAAE,sCAAsC,CAAC;SAC9C,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACzB,MAAM,OAAO,GAAG,IAAA,qCAAmB,EAAC,IAAI,CAAC,CAAA;QACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAA,sCAAoB,EAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC/G,CAAC,CAAC;IACJ,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;CAC3D,CAAC,CAAA"}

package/dist/auth.d.ts

@@ -61,6 +61,15 @@ export interface AuthContext {
     hardBudgets?: HardBudgetWire[];
     /** The key's requests-per-minute and tokens-per-minute limits, when it has either. */
     rateLimit?: KeyRateLimit;
+    /**
+     * What the `vk_` key may do on top of its owner's role (`apiKeyScopes.ts`),
+     * already resolved: `*` for a key whose stored scopes predate the registry,
+     * and narrowed by every key above an attenuated child. Absent on a session
+     * JWT, which has no scopes. The proxy reads it from the cached entry and
+     * refuses LLM traffic from a key without `gateway:use`; an entry without the
+     * field was written before scopes were enforced.
+     */
+    scopes?: string[];
 }
 /** JWT access token payload (compact claims). */
 export interface JwtPayload {
@@ -347,10 +356,19 @@ export declare const MagicLinkLoginInputSchema: z.ZodObject<{
 }>;
 /** Magic link login input. */
 export type MagicLinkLoginInput = z.infer<typeof MagicLinkLoginInputSchema>;
+/**
+ * A key's scope list: at least one, at most every scope, each one in the
+ * registry. An unknown scope is refused with a message naming the valid ones.
+ */
+export declare const ApiKeyScopeListSchema: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
 /** API key creation request schema. */
 export declare const CreateApiKeyInputSchema: z.ZodObject<{
     label: z.ZodString;
-    scopes: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
+    /**
+     * What the key may do on top of its owner's role; `["*"]` (everything) when
+     * omitted. Every entry must be in the registry (`API_SCOPES`).
+     */
+    scopes: z.ZodDefault<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>>;
     expiresInDays: z.ZodOptional<z.ZodNumber>;
     /**
      * Optional per-key model allowlist. Omitted or empty inherits the workspace's
@@ -397,10 +415,10 @@ export interface CreateApiKeyResult {
     rateLimit: KeyRateLimit;
 }
 /**
- * `PATCH /api/v1/keys/:id` — replace a key's spend budgets and/or rate limit.
- * The only way to set them: any member creates their own keys, and only an
+ * `PATCH /api/v1/keys/:id` — replace a key's spend budgets, rate limit and/or scopes.
+ * The only way to change them: any member creates their own keys, and only an
  * OWNER or ADMIN may say what a key can spend, so a key is created unlimited
- * and limited afterwards.
+ * and limited afterwards. Scopes are set at creation and may be replaced here.
  * A field left out is unchanged; `budgets: []` removes every budget, and a
  * `rateLimit` field set to `null` removes that limit.
  */
@@ -436,7 +454,10 @@ export declare const UpdateApiKeyInputSchema: z.ZodEffects<z.ZodObject<{
         rpm?: number | null | undefined;
         tpm?: number | null | undefined;
     }>>;
+    /** Replaces the key's scopes; applies from the key's next request. */
+    scopes: z.ZodOptional<z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>>;
 }, "strict", z.ZodTypeAny, {
+    scopes?: string[] | undefined;
     budgets?: {
         period: "day" | "month";
         limitUsd: number;
@@ -447,6 +468,7 @@ export declare const UpdateApiKeyInputSchema: z.ZodEffects<z.ZodObject<{
         tpm?: number | null | undefined;
     } | undefined;
 }, {
+    scopes?: string[] | undefined;
     budgets?: {
         period: "day" | "month";
         limitUsd: number;
@@ -457,6 +479,7 @@ export declare const UpdateApiKeyInputSchema: z.ZodEffects<z.ZodObject<{
         tpm?: number | null | undefined;
     } | undefined;
 }>, {
+    scopes?: string[] | undefined;
     budgets?: {
         period: "day" | "month";
         limitUsd: number;
@@ -467,6 +490,7 @@ export declare const UpdateApiKeyInputSchema: z.ZodEffects<z.ZodObject<{
         tpm?: number | null | undefined;
     } | undefined;
 }, {
+    scopes?: string[] | undefined;
     budgets?: {
         period: "day" | "month";
         limitUsd: number;
@@ -483,7 +507,14 @@ export interface ApiKeyInfo {
     keyId: string;
     keyPrefix: string;
     label: string;
+    /** The scopes as stored on the key. */
     scopes: string[];
+    /**
+     * The stored scopes are all outside the registry (free-form strings written
+     * before scopes were enforced), so the key works as `*` until 2.6.0, when it
+     * is refused. Re-create it, or set its scopes, before then.
+     */
+    legacyScopes: boolean;
     /** Per-key model allowlist; `null` when the key inherits the workspace list. */
     allowedModels: string[] | null;
     expiresAt: string | null;

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAA;AAI1B;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,sFAAsF;IACtF,SAAS,CAAC,EAAE,YAAY,CAAA;CACzB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAID,mDAAmD;AACnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAEF,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,sCAAsC;AACtC,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAIF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,oCAAoC;AACpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAIvE,kCAAkC;AAClC,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAA;AAIF,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE5D,yBAAyB;AACzB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAID;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;IAK/B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;EAQH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAElE,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAA;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAA;AAEF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAA;AAEF,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAM3E,uCAAuC;AACvC,eAAO,MAAM,uBAAuB;;;;IAIlC;;;;OAIG;;IAEH;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAA;CACxB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAMkF,CAAA;AAEtH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,gBAAgB,EAAE,OAAO,CAAA;IACzB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAA;CACxB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B,2DAA2D;IAC3D,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,0BAA0B;IAC1B,SAAS,EAAE;QACT,6EAA6E;QAC7E,WAAW,EAAE,MAAM,CAAA;QACnB;;;;;;;WAOG;QACH,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,4CAA4C;IAC5C,eAAe,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAGF,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;KACjD,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;IACF;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAA;AAK1B;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAA;IAChB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,wDAAwD;IACxD,KAAK,EAAE,MAAM,CAAA;IACb,sCAAsC;IACtC,IAAI,EAAE,aAAa,CAAA;IACnB,mEAAmE;IACnE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,cAAc,EAAE,CAAA;IAC9B,sFAAsF;IACtF,SAAS,CAAC,EAAE,YAAY,CAAA;IACxB;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAID,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,mBAAmB;IACnB,GAAG,EAAE,MAAM,CAAA;IACX,gBAAgB;IAChB,IAAI,EAAE,aAAa,CAAA;IACnB,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAA;IACX,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAA;CACZ;AAID,4CAA4C;AAC5C,eAAO,MAAM,gBAAgB;;;;;;;;;EAG3B,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,8BAA8B;AAC9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAID,mDAAmD;AACnD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;EAQ9B,CAAA;AAEF,kCAAkC;AAClC,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAA;AAE/D,qCAAqC;AACrC,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,mBAAmB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;CACpB;AAID,oCAAoC;AACpC,eAAO,MAAM,kBAAkB;;;;;;EAE7B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;CAClB;AAID,sCAAsC;AACtC,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAIF,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,oCAAoC;AACpC,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKlC,CAAA;AAEF,2BAA2B;AAC3B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAIvE,kCAAkC;AAClC,eAAO,MAAM,qBAAqB;;;;;;EAEhC,CAAA;AAIF,+BAA+B;AAC/B,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;EAO5B,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE5D,yBAAyB;AACzB,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAID;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;;;;IAK/B;;;;;OAKG;;;;;;;;;;;;;;;;;;;;EAQH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAElE,6EAA6E;AAC7E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE;QACJ,EAAE,EAAE,MAAM,CAAA;QACV,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,OAAO,CAAA;KACvB,CAAA;IACD,GAAG,EAAE;QACH,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,SAAS,EAAE;QACT,EAAE,EAAE,MAAM,CAAA;QACV,IAAI,EAAE,MAAM,CAAA;QACZ,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;KACvB,CAAA;IACD,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,OAAO,CAAA;CACnB;AAED,iCAAiC;AACjC,eAAO,MAAM,sBAAsB;;;;;;EAEjC,CAAA;AAEF,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;EAExC,CAAA;AAEF,iDAAiD;AACjD,eAAO,MAAM,2BAA2B;;;;;;EAEtC,CAAA;AAEF,gCAAgC;AAChC,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAE/E,+CAA+C;AAC/C,eAAO,MAAM,yBAAyB;;;;;;EAEpC,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAM3E;;;GAGG;AACH,eAAO,MAAM,qBAAqB,mEAO9B,CAAA;AAEJ,uCAAuC;AACvC,eAAO,MAAM,uBAAuB;;IAElC;;;OAGG;;;IAGH;;;;OAIG;;IAEH;;;;OAIG;;;;;;;;;;;;;;EAEH,CAAA;AAEF,8BAA8B;AAC9B,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,6DAA6D;AAC7D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAA;IACb,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAA;CACxB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAIhC,sEAAsE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOvE,CAAA;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAA;AAEvE,iEAAiE;AACjE,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,MAAM,CAAA;IACb,uCAAuC;IACvC,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAA;IACrB,gFAAgF;IAChF,aAAa,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;IACjB,6FAA6F;IAC7F,gBAAgB,EAAE,OAAO,CAAA;IACzB,2DAA2D;IAC3D,OAAO,EAAE,WAAW,EAAE,CAAA;IACtB,iEAAiE;IACjE,SAAS,EAAE,YAAY,CAAA;CACxB;AAID;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8CAA8C;IAC9C,cAAc,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAA;IAC1B,2DAA2D;IAC3D,iBAAiB,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;QACjB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IACD,sDAAsD;IACtD,eAAe,EAAE,MAAM,CAAA;IACvB,0BAA0B;IAC1B,SAAS,EAAE;QACT,6EAA6E;QAC7E,WAAW,EAAE,MAAM,CAAA;QACnB;;;;;;;WAOG;QACH,aAAa,EAAE,MAAM,CAAA;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,gBAAgB,EAAE,MAAM,CAAA;KACzB,CAAA;IACD,4CAA4C;IAC5C,eAAe,EAAE,KAAK,CAAC;QACrB,UAAU,EAAE,MAAM,CAAA;QAClB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,QAAQ,EAAE,MAAM,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IAGF,gBAAgB,CAAC,EAAE,KAAK,CAAC;QACvB,IAAI,EAAE,MAAM,CAAA;QACZ,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,MAAM,CAAA;QACpB,YAAY,EAAE,MAAM,CAAA;KACrB,CAAC,CAAA;IACF,iBAAiB,CAAC,EAAE,KAAK,CAAC;QACxB,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;KACjD,CAAC,CAAA;IACF,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,IAAI,EAAE,MAAM,CAAA;QACZ,aAAa,EAAE,MAAM,CAAA;QACrB,SAAS,EAAE,MAAM,CAAA;KAClB,CAAC,CAAA;IACF,oBAAoB,CAAC,EAAE,KAAK,CAAC;QAC3B,QAAQ,EAAE,MAAM,CAAA;QAChB,MAAM,EAAE,MAAM,CAAA;QACd,cAAc,EAAE,MAAM,CAAA;KACvB,CAAC,CAAA;IACF;;;;;;OAMG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,WAAW,CAAC,EAAE;QACZ,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB;;;;;;;;WAQG;QACH,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,MAAM,CAAA;QACtB;;;;;;WAMG;QACH,oBAAoB,EAAE,MAAM,CAAA;KAC7B,CAAA;IACD;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B"}