@ninedeploy/schemas 0.2.7 → 0.3.0

package/dist/auth.d.ts

@@ -40,15 +40,16 @@ export declare const passwordChange: z.ZodObject<{
 }, z.core.$strip>;
 export type PasswordChange = z.infer<typeof passwordChange>;
 /** Admin-initiated password reset for another user. */
-/** Admin-created user — same shape as register plus the starting role. */
+/**
+ * Admin-created user — same shape as register, no global role.
+ * A new user has no workspace memberships until an existing owner/admin
+ * invites them; the first user on a fresh install is auto-promoted to owner
+ * of a personal workspace by the auth module.
+ */
 export declare const userCreate: z.ZodObject<{
     email: z.ZodEmail;
     password: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
-    role: z.ZodDefault<z.ZodEnum<{
-        admin: "admin";
-        member: "member";
-    }>>;
 }, z.core.$strip>;
 export type UserCreate = z.infer<typeof userCreate>;
 export declare const passwordReset: z.ZodObject<{
@@ -77,15 +78,20 @@ export declare const refresh: z.ZodObject<{
     refreshToken: z.ZodString;
 }, z.core.$strip>;
 export type Refresh = z.infer<typeof refresh>;
-/** Public user representation (never includes passwordHash). */
+/**
+ * Public user representation (never includes passwordHash).
+ * The legacy global `role` field was removed; authorization is per-workspace
+ * now. The effective "is operator" check is computed by joining
+ * `workspace_members` and asking whether the user holds owner/admin in any
+ * workspace.
+ */
 export declare const publicUser: z.ZodObject<{
     id: z.ZodNumber;
     email: z.ZodEmail;
     name: z.ZodNullable<z.ZodString>;
-    role: z.ZodEnum<{
-        admin: "admin";
-        member: "member";
-    }>;
+    isOperator: z.ZodBoolean;
+    workspaceCount: z.ZodNumber;
+    createdAt: z.ZodString;
 }, z.core.$strip>;
 export type PublicUser = z.infer<typeof publicUser>;
 export declare const session: z.ZodObject<{
@@ -93,10 +99,9 @@ export declare const session: z.ZodObject<{
         id: z.ZodNumber;
         email: z.ZodEmail;
         name: z.ZodNullable<z.ZodString>;
-        role: z.ZodEnum<{
-            admin: "admin";
-            member: "member";
-        }>;
+        isOperator: z.ZodBoolean;
+        workspaceCount: z.ZodNumber;
+        createdAt: z.ZodString;
     }, z.core.$strip>;
     tokens: z.ZodObject<{
         accessToken: z.ZodString;

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,QAAQ;;;;iBAInB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,kFAAkF;AAClF,eAAO,MAAM,KAAK;;;;iBAAW,CAAC;AAC9B,MAAM,MAAM,KAAK,GAAG,QAAQ,CAAC;AAE7B,eAAO,MAAM,KAAK;;;;iBAKhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C,kEAAkE;AAClE,eAAO,MAAM,aAAa;;iBAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,kFAAkF;AAClF,eAAO,MAAM,cAAc;;iBAA4C,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,mEAAmE;AACnE,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,uDAAuD;AACvD,0EAA0E;AAC1E,eAAO,MAAM,UAAU;;;;;;;;iBAKrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,aAAa;;iBAExB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,yEAAyE;AACzE,eAAO,MAAM,cAAc;;iBAEzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sDAAsD;AACtD,eAAO,MAAM,SAAS;;;;iBAIpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,OAAO;;iBAElB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C,gEAAgE;AAChE,eAAO,MAAM,UAAU;;;;;;;;iBAKrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;iBAGlB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,cAAc;;iBAEzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;iBAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAG9D,gGAAgG;AAChG,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAGlE,eAAO,MAAM,aAAa;;;;;;;iBAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,QAAQ;;;;iBAInB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,kFAAkF;AAClF,eAAO,MAAM,KAAK;;;;iBAAW,CAAC;AAC9B,MAAM,MAAM,KAAK,GAAG,QAAQ,CAAC;AAE7B,eAAO,MAAM,KAAK;;;;iBAKhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C,kEAAkE;AAClE,eAAO,MAAM,aAAa;;iBAAkD,CAAC;AAC7E,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,kFAAkF;AAClF,eAAO,MAAM,cAAc;;iBAA4C,CAAC;AACxE,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,gBAAgB;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,mEAAmE;AACnE,eAAO,MAAM,cAAc;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,uDAAuD;AACvD;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;;iBAIrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,aAAa;;iBAExB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,yEAAyE;AACzE,eAAO,MAAM,cAAc;;iBAEzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,0EAA0E;AAC1E,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE5E,sDAAsD;AACtD,eAAO,MAAM,SAAS;;;;iBAIpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAElD,eAAO,MAAM,OAAO;;iBAElB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;iBASrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,OAAO;;;;;;;;;;;;;;iBAGlB,CAAC;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,CAAC;AAG9C,eAAO,MAAM,cAAc;;iBAEzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,QAAQ;;;;;iBAKnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC;AAEhD,iFAAiF;AACjF,eAAO,MAAM,eAAe;;;;;iBAK1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAG9D,gGAAgG;AAChG,eAAO,MAAM,qBAAqB;;;iBAGhC,CAAC;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAE1E,iGAAiG;AACjG,eAAO,MAAM,kBAAkB;;iBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAEpE,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAGlE,eAAO,MAAM,aAAa;;;;;;;iBAOxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC"}

package/dist/auth.js

@@ -26,12 +26,16 @@ export const passwordChange = z.object({
     newPassword: z.string().min(8).max(128),
 });
 /** Admin-initiated password reset for another user. */
-/** Admin-created user — same shape as register plus the starting role. */
+/**
+ * Admin-created user — same shape as register, no global role.
+ * A new user has no workspace memberships until an existing owner/admin
+ * invites them; the first user on a fresh install is auto-promoted to owner
+ * of a personal workspace by the auth module.
+ */
 export const userCreate = z.object({
     email: z.email().max(255),
     password: z.string().min(8).max(128),
     name: z.string().min(1).max(100).optional(),
-    role: z.enum(['admin', 'member']).default('member'),
 });
 export const passwordReset = z.object({
     newPassword: z.string().min(8).max(128),
@@ -54,12 +58,22 @@ export const tokenPair = z.object({
 export const refresh = z.object({
     refreshToken: z.string().min(1),
 });
-/** Public user representation (never includes passwordHash). */
+/**
+ * Public user representation (never includes passwordHash).
+ * The legacy global `role` field was removed; authorization is per-workspace
+ * now. The effective "is operator" check is computed by joining
+ * `workspace_members` and asking whether the user holds owner/admin in any
+ * workspace.
+ */
 export const publicUser = z.object({
     id: z.number().int(),
     email: z.email(),
     name: z.string().nullable(),
-    role: z.enum(['admin', 'member']),
+    /** True iff the user holds owner/admin in at least one workspace. */
+    isOperator: z.boolean(),
+    /** Number of workspaces the user belongs to. Computed by the server. */
+    workspaceCount: z.number().int().nonnegative(),
+    createdAt: z.string().datetime(),
 });
 export const session = z.object({
     user: publicUser,

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC;AAG9B,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAG7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAGH,uDAAuD;AACvD,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;CACjB,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAGH,sDAAsD;AACtD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH,gEAAgE;AAChE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;CAClC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,8EAA8E;AAC9E,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAGH,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,kFAAkF;AAClF,MAAM,CAAC,MAAM,KAAK,GAAG,QAAQ,CAAC;AAG9B,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,iDAAiD;IACjD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AAGH,kEAAkE;AAClE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAG7E,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAGxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAClC,CAAC,CAAC;AAGH,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAGH,uDAAuD;AACvD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAGH,yEAAyE;AACzE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;CACjB,CAAC,CAAC;AAGH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACxC,CAAC,CAAC;AAGH,sDAAsD;AACtD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAChC,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,qEAAqE;IACrE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;IACvB,wEAAwE;IACxE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,SAAS;CAClB,CAAC,CAAC;AAGH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,iFAAiF;AACjF,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,8EAA8E;AAC9E,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAGH,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC5C,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CAAC;AAGH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAC"}

package/dist/common.d.ts

@@ -37,6 +37,24 @@ export declare const gitRepoUrl: z.ZodURL;
  * itself rejects in `check-ref-format`.
  */
 export declare const gitBranch: z.ZodString;
+export declare const repoRelativePath: z.ZodString;
+/** Same rules as {@link repoRelativePath}; named for the build-context field. */
+export declare const repoBaseDir: z.ZodString;
+/**
+ * Absolute path inside a container (e.g. `/data`, `/var/lib/uploads`).
+ * Rejected: empty, relative, paths containing NUL, parent-relative segments,
+ * or a leading double slash (Docker treats `//` as the named-volume named
+ * bind-mount form which is not what we want here).
+ */
+export declare const containerPath: z.ZodString;
+/**
+ * Docker named-volume name. Lowercase letters, digits, underscores, hyphens
+ * and dots; must start with alnum; max 64 chars (the volume driver limit
+ * on most filesystems). The managed prefixes `nd-svc-` / `nd-db-` are
+ * accepted; clients sending a non-managed name attach a pre-existing volume
+ * they have created out-of-band.
+ */
+export declare const dockerVolumeName: z.ZodString;
 /** Cursor-style pagination params. */
 export declare const pagination: z.ZodObject<{
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;

package/dist/common.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,eAAO,MAAM,IAAI,aAIqE,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAMpB,CAAC;AAEJ,eAAO,MAAM,EAAE,aAA8B,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,aAMlB,CAAC;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAInB,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,SAAS,aAKyE,CAAC;AAEhG,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,mDAAmD;AACnD,eAAO,MAAM,aAAa;;;;;;iBAMxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,yBAAyB;AACzB,wBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;;;;kBAMnD"}
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,eAAO,MAAM,IAAI,aAIqE,CAAC;AAEvF;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,aAMpB,CAAC;AAEJ,eAAO,MAAM,EAAE,aAA8B,CAAC;AAE9C;;;;;;;;GAQG;AACH,eAAO,MAAM,QAAQ,aAMlB,CAAC;AAEJ;;;;;;;;GAQG;AACH,eAAO,MAAM,UAAU,UAInB,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,SAAS,aAKyE,CAAC;AAqBhG,eAAO,MAAM,gBAAgB,aAIuD,CAAC;AAErF,iFAAiF;AACjF,eAAO,MAAM,WAAW,aAAmB,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,aAAa,aAIuD,CAAC;AAElF;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,aAIoC,CAAC;AAElE,sCAAsC;AACtC,eAAO,MAAM,UAAU;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,mDAAmD;AACnD,eAAO,MAAM,aAAa;;;;;;iBAMxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D,yBAAyB;AACzB,wBAAgB,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;;;;kBAMnD"}

package/dist/common.js

@@ -56,6 +56,53 @@ export const gitBranch = z
     .max(200)
     .regex(/^[A-Za-z0-9._][A-Za-z0-9._/-]*$/, 'invalid branch name')
     .refine((v) => !v.includes('..') && !v.endsWith('.lock'), { message: 'invalid branch name' });
+/**
+ * A path interpreted relative to the checked-out repository.
+ *
+ * A LEADING SLASH IS ALLOWED and means "from the repo root" — that is the
+ * existing convention for `baseDir` (`/`, `/app`), so rejecting it here would
+ * break real configurations. What is rejected is anything that could climb out
+ * of the checkout once resolved: `..` segments, NUL, and Windows drive
+ * letters.
+ *
+ * This is a usability guard, not the security boundary. The sinks
+ * (`docker build -f` / its build context, `docker compose -f`) resolve these
+ * values against the work dir, so they re-anchor the path themselves — see
+ * `lib/repoPath.ts`.
+ */
+const insideRepo = (value) => !/^[A-Za-z]:/.test(value) &&
+    !value.includes('\0') &&
+    !value.split(/[\\/]/).includes('..');
+export const repoRelativePath = z
+    .string()
+    .trim()
+    .max(400)
+    .refine(insideRepo, { message: 'must be a path inside the repository (no "..")' });
+/** Same rules as {@link repoRelativePath}; named for the build-context field. */
+export const repoBaseDir = repoRelativePath;
+/**
+ * Absolute path inside a container (e.g. `/data`, `/var/lib/uploads`).
+ * Rejected: empty, relative, paths containing NUL, parent-relative segments,
+ * or a leading double slash (Docker treats `//` as the named-volume named
+ * bind-mount form which is not what we want here).
+ */
+export const containerPath = z
+    .string()
+    .min(1)
+    .max(1024)
+    .regex(/^\/[^/].*|^\/$/, 'must be an absolute path starting with a single "/"');
+/**
+ * Docker named-volume name. Lowercase letters, digits, underscores, hyphens
+ * and dots; must start with alnum; max 64 chars (the volume driver limit
+ * on most filesystems). The managed prefixes `nd-svc-` / `nd-db-` are
+ * accepted; clients sending a non-managed name attach a pre-existing volume
+ * they have created out-of-band.
+ */
+export const dockerVolumeName = z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9][a-z0-9_.-]*$/i, 'invalid docker volume name');
 /** Cursor-style pagination params. */
 export const pagination = z.object({
     limit: z.coerce.number().int().min(1).max(100).default(25),

package/dist/common.js.map

@@ -1 +1 @@
-{"version":3,"file":"common.js","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,mCAAmC,EAAE,uCAAuC,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CACJ,0BAA0B,EAC1B,oGAAoG,CACrG,CAAC;AAEJ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,yCAAyC,EACzC,+DAA+D,CAChE,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IACtD,OAAO,EAAE,uCAAuC;CACjD,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,iCAAiC,EAAE,qBAAqB,CAAC;KAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAEhG,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAGH,yBAAyB;AACzB,MAAM,UAAU,IAAI,CAAyB,IAAO;IAClD,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,yDAAyD;AACzD,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,mCAAmC,EAAE,uCAAuC,CAAC,CAAC;AAEvF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CACJ,0BAA0B,EAC1B,oGAAoG,CACrG,CAAC;AAEJ,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAE9C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC;KACtB,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACJ,yCAAyC,EACzC,+DAA+D,CAChE,CAAC;AAEJ;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC;KACxB,GAAG,EAAE;KACL,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;IACtD,OAAO,EAAE,uCAAuC;CACjD,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC;KACvB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,iCAAiC,EAAE,qBAAqB,CAAC;KAC/D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAEhG;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAW,EAAE,CAC5C,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;IACzB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;IACrB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAEvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,gDAAgD,EAAE,CAAC,CAAC;AAErF,iFAAiF;AACjF,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,KAAK,CAAC,gBAAgB,EAAE,qDAAqD,CAAC,CAAC;AAElF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,yBAAyB,EAAE,4BAA4B,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1D,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtD,CAAC,CAAC;AAGH,mDAAmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAChC,CAAC;CACH,CAAC,CAAC;AAGH,yBAAyB;AACzB,MAAM,UAAU,IAAI,CAAyB,IAAO;IAClD,OAAO,CAAC,CAAC,MAAM,CAAC;QACd,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;KACjD,CAAC,CAAC;AACL,CAAC"}

package/dist/index.d.ts

@@ -1,8 +1,14 @@
 export * from './common.js';
 export * from './auth.js';
 export * from './management.js';
+export * from './ninedeployManifest.js';
+export type { AlertWhen } from './ninedeployManifest.js';
+export type { RestartPolicy } from './ninedeployManifest.js';
 export * from './project.js';
 export * from './service.js';
+export * from './insights.js';
 export * from './kernel.js';
 export * from './workspaces.js';
+export * from './labels.js';
+export * from './secretScan.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,YAAY,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACzD,YAAY,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -1,8 +1,12 @@
 export * from './common.js';
 export * from './auth.js';
 export * from './management.js';
+export * from './ninedeployManifest.js';
 export * from './project.js';
 export * from './service.js';
+export * from './insights.js';
 export * from './kernel.js';
 export * from './workspaces.js';
+export * from './labels.js';
+export * from './secretScan.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AAGxC,cAAc,cAAc,CAAC;AAC7B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC;AAChC,cAAc,aAAa,CAAC;AAC5B,cAAc,iBAAiB,CAAC"}

package/dist/insights.d.ts

@@ -0,0 +1,110 @@
+import { z } from 'zod';
+export declare const frameworkCategory: z.ZodEnum<{
+    backend: "backend";
+    container: "container";
+    spa: "spa";
+    ssr: "ssr";
+    static: "static";
+    unknown: "unknown";
+}>;
+export type FrameworkCategory = z.infer<typeof frameworkCategory>;
+export declare const packageManagerId: z.ZodEnum<{
+    bun: "bun";
+    npm: "npm";
+    pnpm: "pnpm";
+    yarn: "yarn";
+}>;
+export type PackageManagerId = z.infer<typeof packageManagerId>;
+/** One recommended environment variable (pre-filled, user-editable). */
+export declare const envSuggestion: z.ZodObject<{
+    key: z.ZodString;
+    value: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type EnvSuggestion = z.infer<typeof envSuggestion>;
+/** A detected framework plus its deploy preset (commands already adapted to
+ * the detected package manager). Null commands mean "no safe suggestion". */
+export declare const frameworkPreset: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    emoji: z.ZodString;
+    category: z.ZodEnum<{
+        backend: "backend";
+        container: "container";
+        spa: "spa";
+        ssr: "ssr";
+        static: "static";
+        unknown: "unknown";
+    }>;
+    port: z.ZodNumber;
+    installCmd: z.ZodNullable<z.ZodString>;
+    buildCmd: z.ZodNullable<z.ZodString>;
+    startCmd: z.ZodNullable<z.ZodString>;
+    env: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        value: z.ZodString;
+        description: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    notes: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type FrameworkPreset = z.infer<typeof frameworkPreset>;
+export declare const repoInsights: z.ZodObject<{
+    framework: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        emoji: z.ZodString;
+        category: z.ZodEnum<{
+            backend: "backend";
+            container: "container";
+            spa: "spa";
+            ssr: "ssr";
+            static: "static";
+            unknown: "unknown";
+        }>;
+        port: z.ZodNumber;
+        installCmd: z.ZodNullable<z.ZodString>;
+        buildCmd: z.ZodNullable<z.ZodString>;
+        startCmd: z.ZodNullable<z.ZodString>;
+        env: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            value: z.ZodString;
+            description: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        notes: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    language: z.ZodString;
+    packageManager: z.ZodNullable<z.ZodEnum<{
+        bun: "bun";
+        npm: "npm";
+        pnpm: "pnpm";
+        yarn: "yarn";
+    }>>;
+    nodeVersion: z.ZodNullable<z.ZodString>;
+    frameworkVersion: z.ZodNullable<z.ZodString>;
+    scripts: z.ZodRecord<z.ZodString, z.ZodString>;
+    dependencyCount: z.ZodNumber;
+    devDependencyCount: z.ZodNumber;
+    hasDockerfile: z.ZodBoolean;
+    hasComposeFile: z.ZodBoolean;
+    monorepo: z.ZodBoolean;
+    detectedFiles: z.ZodArray<z.ZodString>;
+    workspacePackages: z.ZodArray<z.ZodObject<{
+        dir: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        framework: z.ZodNullable<z.ZodString>;
+        frameworkVersion: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    baseDir: z.ZodString;
+    commitSha: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    analyzedAt: z.ZodString;
+}, z.core.$strip>;
+export type RepoInsights = z.infer<typeof repoInsights>;
+/** Pre-deploy inspection request (DeployWizard, before a service exists). */
+export declare const analyzeRepoInput: z.ZodObject<{
+    repoUrl: z.ZodURL;
+    branch: z.ZodDefault<z.ZodString>;
+    sourceId: z.ZodOptional<z.ZodNumber>;
+    baseDir: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AnalyzeRepoInput = z.input<typeof analyzeRepoInput>;
+//# sourceMappingURL=insights.d.ts.map

package/dist/insights.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"insights.d.ts","sourceRoot":"","sources":["../src/insights.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB,eAAO,MAAM,iBAAiB;;;;;;;EAAsE,CAAC;AACrG,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAElE,eAAO,MAAM,gBAAgB;;;;;EAAyC,CAAC;AACvE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,wEAAwE;AACxE,eAAO,MAAM,aAAa;;;;iBAIxB,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,CAAC;AAE1D;6EAC6E;AAC7E,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;iBAW1B,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE9D,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA6BvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,6EAA6E;AAC7E,eAAO,MAAM,gBAAgB;;;;;iBAK3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/insights.js

@@ -0,0 +1,64 @@
+import { z } from 'zod';
+import { gitBranch, gitRepoUrl, repoBaseDir } from './common.js';
+// ── Repository / framework insights ─────────────────────────────────────────
+// The analysis engine (server lib/frameworks.ts) inspects a checked-out repo
+// and reduces it to this shape; the wizard and the service-detail Framework
+// tab render it to explain "what is in this repo and how should it deploy".
+export const frameworkCategory = z.enum(['ssr', 'spa', 'static', 'backend', 'container', 'unknown']);
+export const packageManagerId = z.enum(['npm', 'pnpm', 'yarn', 'bun']);
+/** One recommended environment variable (pre-filled, user-editable). */
+export const envSuggestion = z.object({
+    key: z.string(),
+    value: z.string(),
+    description: z.string().optional(),
+});
+/** A detected framework plus its deploy preset (commands already adapted to
+ * the detected package manager). Null commands mean "no safe suggestion". */
+export const frameworkPreset = z.object({
+    id: z.string(),
+    name: z.string(),
+    emoji: z.string(),
+    category: frameworkCategory,
+    port: z.number().int().min(1).max(65535),
+    installCmd: z.string().nullable(),
+    buildCmd: z.string().nullable(),
+    startCmd: z.string().nullable(),
+    env: z.array(envSuggestion),
+    notes: z.array(z.string()),
+});
+export const repoInsights = z.object({
+    framework: frameworkPreset,
+    language: z.string(),
+    packageManager: packageManagerId.nullable(),
+    nodeVersion: z.string().nullable(),
+    frameworkVersion: z.string().nullable(),
+    scripts: z.record(z.string(), z.string()),
+    dependencyCount: z.number().int(),
+    devDependencyCount: z.number().int(),
+    hasDockerfile: z.boolean(),
+    hasComposeFile: z.boolean(),
+    monorepo: z.boolean(),
+    /** Marker files the detection was derived from (e.g. package.json, go.mod). */
+    detectedFiles: z.array(z.string()),
+    /** Workspace member packages of a monorepo root (empty for single-app repos
+     * and for analyses scoped to a base directory). Powers the wizard's
+     * "deploy each sub-app as its own service" picker. */
+    workspacePackages: z.array(z.object({
+        /** Repo-relative directory, e.g. "apps/web". */
+        dir: z.string(),
+        name: z.string().nullable(),
+        framework: z.string().nullable(),
+        frameworkVersion: z.string().nullable(),
+    })),
+    baseDir: z.string(),
+    commitSha: z.string().nullable().optional(),
+    analyzedAt: z.string().datetime(),
+});
+/** Pre-deploy inspection request (DeployWizard, before a service exists). */
+export const analyzeRepoInput = z.object({
+    repoUrl: gitRepoUrl,
+    branch: gitBranch.default('main'),
+    sourceId: z.number().int().positive().optional(),
+    baseDir: repoBaseDir.optional(),
+});
+//# sourceMappingURL=insights.js.map

package/dist/insights.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"insights.js","sourceRoot":"","sources":["../src/insights.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEjE,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC;AAGrG,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAGvE,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH;6EAC6E;AAC7E,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,iBAAiB;IAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IACxC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC3B,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,SAAS,EAAE,eAAe;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,cAAc,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACjC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACpC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE;IAC1B,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,+EAA+E;IAC/E,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC;;0DAEsD;IACtD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CACxB,CAAC,CAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;QACf,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KACxC,CAAC,CACH;IACD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC;AAGH,6EAA6E;AAC7E,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,EAAE,UAAU;IACnB,MAAM,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAChD,OAAO,EAAE,WAAW,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC"}

package/dist/labels.d.ts

@@ -0,0 +1,108 @@
+import { z } from 'zod';
+/**
+ * Workspace-scoped free-form labels used to tag services without tying them
+ * to the project hierarchy (e.g. "production", "staging", "team-x"). Labels
+ * can be created on the fly; the color is a tailwind-style palette token
+ * consumed by the UI.
+ */
+export declare const labelColor: z.ZodEnum<{
+    amber: "amber";
+    emerald: "emerald";
+    indigo: "indigo";
+    lime: "lime";
+    rose: "rose";
+    sky: "sky";
+    slate: "slate";
+    violet: "violet";
+}>;
+export type LabelColor = z.infer<typeof labelColor>;
+export declare const createLabel: z.ZodObject<{
+    workspaceId: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    name: z.ZodString;
+    color: z.ZodDefault<z.ZodEnum<{
+        amber: "amber";
+        emerald: "emerald";
+        indigo: "indigo";
+        lime: "lime";
+        rose: "rose";
+        sky: "sky";
+        slate: "slate";
+        violet: "violet";
+    }>>;
+}, z.core.$strip>;
+export type CreateLabel = z.infer<typeof createLabel>;
+export type CreateLabelInput = CreateLabel;
+export declare const labelPatch: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    color: z.ZodOptional<z.ZodEnum<{
+        amber: "amber";
+        emerald: "emerald";
+        indigo: "indigo";
+        lime: "lime";
+        rose: "rose";
+        sky: "sky";
+        slate: "slate";
+        violet: "violet";
+    }>>;
+}, z.core.$strip>;
+export type LabelPatch = z.infer<typeof labelPatch>;
+export type LabelPatchInput = LabelPatch;
+export declare const label: z.ZodObject<{
+    id: z.ZodNumber;
+    workspaceId: z.ZodNullable<z.ZodNumber>;
+    name: z.ZodString;
+    color: z.ZodString;
+    serviceCount: z.ZodNumber;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type Label = z.infer<typeof label>;
+/**
+ * PUT /v1/services/:id/tags body — replaces the service's project / workspace
+ * / label memberships wholesale. The caller must be a member of every
+ * workspace in `workspaceIds` (or an operator), and every project/label id
+ * must be valid. Empty arrays clear the corresponding dimension.
+ */
+export declare const setServiceTags: z.ZodObject<{
+    projectIds: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+    workspaceIds: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+    labelIds: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+}, z.core.$strip>;
+export type SetServiceTags = z.infer<typeof setServiceTags>;
+export type SetServiceTagsInput = SetServiceTags;
+export declare const serviceTags: z.ZodObject<{
+    serviceId: z.ZodNumber;
+    projects: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        name: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strip>>;
+    workspaces: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        name: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strip>>;
+    labels: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        name: z.ZodString;
+        color: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ServiceTags = z.infer<typeof serviceTags>;
+/**
+ * /v1/services list filter — every present array is OR'd within its dimension
+ * and AND'd across dimensions. An empty array means "no filter on this
+ * dimension" (so omitting all three is equivalent to the unfiltered list).
+ *
+ *   ?tagWorkspaceIds=1,2   → service is in ws 1 OR ws 2
+ *   ?tagProjectIds=10      → service has project 10
+ *   ?tagLabelIds=3,4       → service has label 3 OR 4
+ *   combined: AND across dimensions
+ */
+export declare const serviceListFilter: z.ZodObject<{
+    tagWorkspaceIds: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+    tagProjectIds: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+    tagLabelIds: z.ZodDefault<z.ZodArray<z.ZodNumber>>;
+}, z.core.$strip>;
+export type ServiceListFilter = z.infer<typeof serviceListFilter>;
+//# sourceMappingURL=labels.d.ts.map

package/dist/labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"labels.d.ts","sourceRoot":"","sources":["../src/labels.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;;;;;;;EASrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,WAAW;;;;;;;;;;;;;iBAItB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAE3C,eAAO,MAAM,UAAU;;;;;;;;;;;;iBAKsD,CAAC;AAC9E,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACpD,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC;AAEzC,eAAO,MAAM,KAAK;;;;;;;;iBAQhB,CAAC;AACH,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC;AAE1C;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;iBAIzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAEjD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;iBAKtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;GASG;AACH,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AACH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}