@smartcrab/contracts-management 0.1.0

package/dist/audit-events.js

@@ -0,0 +1,45 @@
+import { z } from "zod";
+import { cursorPageSchema, paginationQuerySchema, requestIdSchema } from "./common.js";
+import { auditEventIdSchema, environmentIdSchema, workspaceIdSchema } from "./primitives.js";
+/**
+ * `audit_events` (design.md §12.11), read-only (`GET /audit-events` is the
+ * only route; design.md §12.11: "監査ログは追記専用とし、通常APIから更新・
+ * 削除できない"). `auth_partition_id` is excluded per the assignment's
+ * forbidden-field list (internal Auth D1 co-location routing).
+ * `ip_prefix_hash` is excluded for the same reason `@smartcrab/contracts-public`
+ * excludes hash-only columns from any response: an irreversible hash is not
+ * a usable value for an API consumer.
+ */
+export const AUDIT_ACTOR_TYPES = ["end_user", "workspace_member", "api_key", "system"];
+export const auditActorTypeSchema = z.enum(AUDIT_ACTOR_TYPES);
+export const AUDIT_RESULTS = ["success", "failure"];
+export const auditResultSchema = z.enum(AUDIT_RESULTS);
+const auditMetadataSchema = z.record(z.string(), z.unknown());
+export const auditEventSchema = z.strictObject({
+    id: auditEventIdSchema,
+    environment_id: environmentIdSchema,
+    workspace_id: workspaceIdSchema,
+    actor_type: auditActorTypeSchema,
+    actor_id: z.string().min(1).nullable(),
+    action: z.string().min(1),
+    subject_type: z.string().min(1),
+    subject_id: z.string().min(1).nullable(),
+    result: auditResultSchema,
+    request_id: requestIdSchema,
+    metadata: auditMetadataSchema,
+    created_at: z.iso.datetime(),
+});
+// ---------------------------------------------------------------------------
+// GET /audit-events
+// ---------------------------------------------------------------------------
+export const auditEventListQuerySchema = paginationQuerySchema.extend({
+    environment_id: environmentIdSchema,
+    actor_type: auditActorTypeSchema.optional(),
+    action: z.string().min(1).optional(),
+    subject_type: z.string().min(1).optional(),
+    subject_id: z.string().min(1).optional(),
+    result: auditResultSchema.optional(),
+    created_after: z.iso.datetime().optional(),
+    created_before: z.iso.datetime().optional(),
+});
+export const auditEventListResponseSchema = cursorPageSchema(auditEventSchema);

package/dist/billing.d.ts

@@ -0,0 +1,30 @@
+import { z } from "zod";
+/**
+ * `POST /billing/checkout-session`, `POST /billing/portal-session`
+ * (design.md §26.2, §28.5: "30,000 MAUを超えて継続利用するにはStripe
+ * Customer、Subscription、Payment Methodを有効化する"). design.md does not
+ * give an exact JSON shape for these two routes; the request/response
+ * fields below are the minimum Stripe Checkout/Billing Portal session
+ * creation requires (a return destination in, a redirect URL out) and
+ * intentionally surface no Stripe object IDs — this package never exposes
+ * `billing_accounts`' Stripe identifiers (design.md §11.14) through these
+ * routes, only the redirect URL the dashboard needs.
+ */
+export declare const billingCheckoutSessionCreateRequestSchema: z.ZodObject<{
+    success_url: z.ZodURL;
+    cancel_url: z.ZodURL;
+}, z.core.$strict>;
+export type BillingCheckoutSessionCreateRequest = z.infer<typeof billingCheckoutSessionCreateRequestSchema>;
+export declare const billingCheckoutSessionCreateResponseSchema: z.ZodObject<{
+    checkout_url: z.ZodURL;
+    expires_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type BillingCheckoutSessionCreateResponse = z.infer<typeof billingCheckoutSessionCreateResponseSchema>;
+export declare const billingPortalSessionCreateRequestSchema: z.ZodObject<{
+    return_url: z.ZodURL;
+}, z.core.$strict>;
+export type BillingPortalSessionCreateRequest = z.infer<typeof billingPortalSessionCreateRequestSchema>;
+export declare const billingPortalSessionCreateResponseSchema: z.ZodObject<{
+    portal_url: z.ZodURL;
+}, z.core.$strict>;
+export type BillingPortalSessionCreateResponse = z.infer<typeof billingPortalSessionCreateResponseSchema>;

package/dist/billing.js

@@ -0,0 +1,30 @@
+import { httpsUrlSchema } from "@smartcrab/contracts-public";
+import { z } from "zod";
+/**
+ * `POST /billing/checkout-session`, `POST /billing/portal-session`
+ * (design.md §26.2, §28.5: "30,000 MAUを超えて継続利用するにはStripe
+ * Customer、Subscription、Payment Methodを有効化する"). design.md does not
+ * give an exact JSON shape for these two routes; the request/response
+ * fields below are the minimum Stripe Checkout/Billing Portal session
+ * creation requires (a return destination in, a redirect URL out) and
+ * intentionally surface no Stripe object IDs — this package never exposes
+ * `billing_accounts`' Stripe identifiers (design.md §11.14) through these
+ * routes, only the redirect URL the dashboard needs.
+ */
+export const billingCheckoutSessionCreateRequestSchema = z.strictObject({
+    /** Where Stripe Checkout redirects on success. */
+    success_url: httpsUrlSchema,
+    /** Where Stripe Checkout redirects if the workspace member cancels. */
+    cancel_url: httpsUrlSchema,
+});
+export const billingCheckoutSessionCreateResponseSchema = z.strictObject({
+    checkout_url: httpsUrlSchema,
+    expires_at: z.iso.datetime(),
+});
+export const billingPortalSessionCreateRequestSchema = z.strictObject({
+    /** Where the Stripe Billing Portal redirects when the member is done. */
+    return_url: httpsUrlSchema,
+});
+export const billingPortalSessionCreateResponseSchema = z.strictObject({
+    portal_url: httpsUrlSchema,
+});

package/dist/clients.d.ts

@@ -0,0 +1,328 @@
+import { z } from "zod";
+/**
+ * `clients` (design.md §11.5), `client_redirect_uris` (§11.6),
+ * `client_origins` (§11.7), `mobile_apps` (§11.8) and the conceptual Client
+ * model of design.md §7.4 (which groups these tables' columns into one
+ * resource: `redirect_uris`, `post_logout_redirect_uris`, `allowed_origins`,
+ * `allowed_scopes`, `allowed_resources`).
+ *
+ * `secret_hash` (§11.5) is excluded per the assignment's secret-field rule;
+ * `public_key_prefix` is kept — it exists specifically so a non-secret
+ * fragment of client identity can be displayed (the same pattern as
+ * `management_api_keys.prefix` alongside its hidden `key_mac`, §11.12).
+ */
+export declare const CLIENT_TYPES: readonly ["web_bff", "web_spa", "react_native"];
+export declare const clientTypeSchema: z.ZodEnum<{
+    web_bff: "web_bff";
+    web_spa: "web_spa";
+    react_native: "react_native";
+}>;
+export type ClientType = (typeof CLIENT_TYPES)[number];
+export declare const TOKEN_ENDPOINT_AUTH_METHODS: readonly ["none", "client_secret_basic", "client_secret_post"];
+export declare const tokenEndpointAuthMethodSchema: z.ZodEnum<{
+    client_secret_basic: "client_secret_basic";
+    client_secret_post: "client_secret_post";
+    none: "none";
+}>;
+export type TokenEndpointAuthMethod = (typeof TOKEN_ENDPOINT_AUTH_METHODS)[number];
+export declare const CLIENT_STATUSES: readonly ["active", "disabled"];
+export declare const clientStatusSchema: z.ZodEnum<{
+    active: "active";
+    disabled: "disabled";
+}>;
+export type ClientStatus = (typeof CLIENT_STATUSES)[number];
+/**
+ * design.md §11.8 `android_sha256_fingerprints_json`: colon-separated hex, 32
+ * bytes. Any case is accepted on the wire; the control-plane repository stores
+ * and serves the canonical uppercase form. Kept transform-free so the schema
+ * stays representable for OpenAPI generation (`z.toJSONSchema` with `io: "output"`).
+ */
+export declare const androidSha256FingerprintSchema: z.ZodString;
+/** design.md §11.8 `android_package_name`: reversed-DNS package name with at least two dot-separated segments. */
+export declare const androidPackageNameSchema: z.ZodString;
+/** design.md §11.8, §21.3, §27.3 "React Native設定": present only for `client_type: "react_native"`. */
+export declare const mobileAppSchema: z.ZodObject<{
+    app_scheme: z.ZodString;
+    ios_bundle_id: z.ZodNullable<z.ZodString>;
+    ios_team_id: z.ZodNullable<z.ZodString>;
+    android_package_name: z.ZodNullable<z.ZodString>;
+    android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+    universal_link_host: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type MobileApp = z.infer<typeof mobileAppSchema>;
+export declare const clientSchema: z.ZodObject<{
+    id: z.ZodString;
+    environment_id: z.ZodString;
+    client_type: z.ZodEnum<{
+        web_bff: "web_bff";
+        web_spa: "web_spa";
+        react_native: "react_native";
+    }>;
+    name: z.ZodString;
+    public_key_prefix: z.ZodNullable<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    post_logout_redirect_uris: z.ZodArray<z.ZodString>;
+    allowed_origins: z.ZodArray<z.ZodString>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    allowed_resources: z.ZodArray<z.ZodURL>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    require_pkce: z.ZodBoolean;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    mobile_app: z.ZodNullable<z.ZodObject<{
+        app_scheme: z.ZodString;
+        ios_bundle_id: z.ZodNullable<z.ZodString>;
+        ios_team_id: z.ZodNullable<z.ZodString>;
+        android_package_name: z.ZodNullable<z.ZodString>;
+        android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+        universal_link_host: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type Client = z.infer<typeof clientSchema>;
+export declare const clientListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    environment_id: z.ZodString;
+    client_type: z.ZodOptional<z.ZodEnum<{
+        web_bff: "web_bff";
+        web_spa: "web_spa";
+        react_native: "react_native";
+    }>>;
+}, z.core.$strip>;
+export type ClientListQuery = z.infer<typeof clientListQuerySchema>;
+export declare const clientListResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        environment_id: z.ZodString;
+        client_type: z.ZodEnum<{
+            web_bff: "web_bff";
+            web_spa: "web_spa";
+            react_native: "react_native";
+        }>;
+        name: z.ZodString;
+        public_key_prefix: z.ZodNullable<z.ZodString>;
+        redirect_uris: z.ZodArray<z.ZodString>;
+        post_logout_redirect_uris: z.ZodArray<z.ZodString>;
+        allowed_origins: z.ZodArray<z.ZodString>;
+        allowed_scopes: z.ZodArray<z.ZodString>;
+        allowed_resources: z.ZodArray<z.ZodURL>;
+        token_endpoint_auth_method: z.ZodEnum<{
+            client_secret_basic: "client_secret_basic";
+            client_secret_post: "client_secret_post";
+            none: "none";
+        }>;
+        require_pkce: z.ZodBoolean;
+        status: z.ZodEnum<{
+            active: "active";
+            disabled: "disabled";
+        }>;
+        mobile_app: z.ZodNullable<z.ZodObject<{
+            app_scheme: z.ZodString;
+            ios_bundle_id: z.ZodNullable<z.ZodString>;
+            ios_team_id: z.ZodNullable<z.ZodString>;
+            android_package_name: z.ZodNullable<z.ZodString>;
+            android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+            universal_link_host: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        created_at: z.ZodISODateTime;
+        updated_at: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    next_cursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ClientListResponse = z.infer<typeof clientListResponseSchema>;
+export declare const clientCreateRequestSchema: z.ZodObject<{
+    environment_id: z.ZodString;
+    client_type: z.ZodEnum<{
+        web_bff: "web_bff";
+        web_spa: "web_spa";
+        react_native: "react_native";
+    }>;
+    name: z.ZodString;
+    redirect_uris: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    post_logout_redirect_uris: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowed_origins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowed_scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowed_resources: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    require_pkce: z.ZodDefault<z.ZodBoolean>;
+    mobile_app: z.ZodOptional<z.ZodObject<{
+        app_scheme: z.ZodString;
+        ios_bundle_id: z.ZodNullable<z.ZodString>;
+        ios_team_id: z.ZodNullable<z.ZodString>;
+        android_package_name: z.ZodNullable<z.ZodString>;
+        android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+        universal_link_host: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ClientCreateRequest = z.infer<typeof clientCreateRequestSchema>;
+/**
+ * design.md §11.12's "Secretは作成時に1回だけ表示する" applies by the same
+ * logic to any generated confidential-client secret: `client_secret` is
+ * present only when `token_endpoint_auth_method !== "none"`, and only on this
+ * one response — never on `GET`/`PATCH`/list.
+ */
+export declare const clientCreateResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    environment_id: z.ZodString;
+    client_type: z.ZodEnum<{
+        web_bff: "web_bff";
+        web_spa: "web_spa";
+        react_native: "react_native";
+    }>;
+    name: z.ZodString;
+    public_key_prefix: z.ZodNullable<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    post_logout_redirect_uris: z.ZodArray<z.ZodString>;
+    allowed_origins: z.ZodArray<z.ZodString>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    allowed_resources: z.ZodArray<z.ZodURL>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    require_pkce: z.ZodBoolean;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    mobile_app: z.ZodNullable<z.ZodObject<{
+        app_scheme: z.ZodString;
+        ios_bundle_id: z.ZodNullable<z.ZodString>;
+        ios_team_id: z.ZodNullable<z.ZodString>;
+        android_package_name: z.ZodNullable<z.ZodString>;
+        android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+        universal_link_host: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+    client_secret: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ClientCreateResponse = z.infer<typeof clientCreateResponseSchema>;
+export declare const clientGetResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    environment_id: z.ZodString;
+    client_type: z.ZodEnum<{
+        web_bff: "web_bff";
+        web_spa: "web_spa";
+        react_native: "react_native";
+    }>;
+    name: z.ZodString;
+    public_key_prefix: z.ZodNullable<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    post_logout_redirect_uris: z.ZodArray<z.ZodString>;
+    allowed_origins: z.ZodArray<z.ZodString>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    allowed_resources: z.ZodArray<z.ZodURL>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    require_pkce: z.ZodBoolean;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    mobile_app: z.ZodNullable<z.ZodObject<{
+        app_scheme: z.ZodString;
+        ios_bundle_id: z.ZodNullable<z.ZodString>;
+        ios_team_id: z.ZodNullable<z.ZodString>;
+        android_package_name: z.ZodNullable<z.ZodString>;
+        android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+        universal_link_host: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type ClientGetResponse = z.infer<typeof clientGetResponseSchema>;
+export declare const clientUpdateRequestSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    post_logout_redirect_uris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowed_origins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowed_scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowed_resources: z.ZodOptional<z.ZodArray<z.ZodURL>>;
+    token_endpoint_auth_method: z.ZodOptional<z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>>;
+    require_pkce: z.ZodOptional<z.ZodBoolean>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>>;
+    mobile_app: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        app_scheme: z.ZodString;
+        ios_bundle_id: z.ZodNullable<z.ZodString>;
+        ios_team_id: z.ZodNullable<z.ZodString>;
+        android_package_name: z.ZodNullable<z.ZodString>;
+        android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+        universal_link_host: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+export type ClientUpdateRequest = z.infer<typeof clientUpdateRequestSchema>;
+export declare const clientUpdateResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    environment_id: z.ZodString;
+    client_type: z.ZodEnum<{
+        web_bff: "web_bff";
+        web_spa: "web_spa";
+        react_native: "react_native";
+    }>;
+    name: z.ZodString;
+    public_key_prefix: z.ZodNullable<z.ZodString>;
+    redirect_uris: z.ZodArray<z.ZodString>;
+    post_logout_redirect_uris: z.ZodArray<z.ZodString>;
+    allowed_origins: z.ZodArray<z.ZodString>;
+    allowed_scopes: z.ZodArray<z.ZodString>;
+    allowed_resources: z.ZodArray<z.ZodURL>;
+    token_endpoint_auth_method: z.ZodEnum<{
+        client_secret_basic: "client_secret_basic";
+        client_secret_post: "client_secret_post";
+        none: "none";
+    }>;
+    require_pkce: z.ZodBoolean;
+    status: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+    }>;
+    mobile_app: z.ZodNullable<z.ZodObject<{
+        app_scheme: z.ZodString;
+        ios_bundle_id: z.ZodNullable<z.ZodString>;
+        ios_team_id: z.ZodNullable<z.ZodString>;
+        android_package_name: z.ZodNullable<z.ZodString>;
+        android_sha256_fingerprints: z.ZodArray<z.ZodString>;
+        universal_link_host: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type ClientUpdateResponse = z.infer<typeof clientUpdateResponseSchema>;
+export declare const clientDeleteResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    deleted: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type ClientDeleteResponse = z.infer<typeof clientDeleteResponseSchema>;
+export declare const clientRotateSecretRequestSchema: z.ZodObject<{}, z.core.$strict>;
+export type ClientRotateSecretRequest = z.infer<typeof clientRotateSecretRequestSchema>;
+/** One-time plaintext secret (design.md §11.12's display-once rule, applied to client secrets). */
+export declare const clientRotateSecretResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    client_secret: z.ZodString;
+    rotated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type ClientRotateSecretResponse = z.infer<typeof clientRotateSecretResponseSchema>;

package/dist/clients.js

@@ -0,0 +1,141 @@
+import { z } from "zod";
+import { cursorPageSchema, paginationQuerySchema } from "./common.js";
+import { clientIdSchema, environmentIdSchema, httpsUrlSchema } from "./primitives.js";
+/**
+ * `clients` (design.md §11.5), `client_redirect_uris` (§11.6),
+ * `client_origins` (§11.7), `mobile_apps` (§11.8) and the conceptual Client
+ * model of design.md §7.4 (which groups these tables' columns into one
+ * resource: `redirect_uris`, `post_logout_redirect_uris`, `allowed_origins`,
+ * `allowed_scopes`, `allowed_resources`).
+ *
+ * `secret_hash` (§11.5) is excluded per the assignment's secret-field rule;
+ * `public_key_prefix` is kept — it exists specifically so a non-secret
+ * fragment of client identity can be displayed (the same pattern as
+ * `management_api_keys.prefix` alongside its hidden `key_mac`, §11.12).
+ */
+export const CLIENT_TYPES = ["web_bff", "web_spa", "react_native"];
+export const clientTypeSchema = z.enum(CLIENT_TYPES);
+export const TOKEN_ENDPOINT_AUTH_METHODS = [
+    "none",
+    "client_secret_basic",
+    "client_secret_post",
+];
+export const tokenEndpointAuthMethodSchema = z.enum(TOKEN_ENDPOINT_AUTH_METHODS);
+export const CLIENT_STATUSES = ["active", "disabled"];
+export const clientStatusSchema = z.enum(CLIENT_STATUSES);
+/** design.md §11.6: exact-match only, no wildcards; §15.9 governs shape rules by client type. */
+const clientRedirectUriSchema = z.string().min(1).max(2048);
+/** design.md §11.7: "Originにはscheme、host、portのみを許可し、path/query/fragmentを拒否する。" */
+const originSchema = z.string().regex(/^https?:\/\/[^/?#]+$/);
+/** A single non-whitespace OAuth scope token, e.g. `openid` or a custom API scope. */
+const allowedScopeSchema = z.string().min(1).max(100).regex(/^\S+$/);
+/**
+ * design.md §11.8 `android_sha256_fingerprints_json`: colon-separated hex, 32
+ * bytes. Any case is accepted on the wire; the control-plane repository stores
+ * and serves the canonical uppercase form. Kept transform-free so the schema
+ * stays representable for OpenAPI generation (`z.toJSONSchema` with `io: "output"`).
+ */
+export const androidSha256FingerprintSchema = z
+    .string()
+    .regex(/^([0-9A-Fa-f]{2}:){31}[0-9A-Fa-f]{2}$/);
+/** design.md §11.8 `android_package_name`: reversed-DNS package name with at least two dot-separated segments. */
+export const androidPackageNameSchema = z
+    .string()
+    .regex(/^[A-Za-z][A-Za-z0-9_]*(\.[A-Za-z][A-Za-z0-9_]*)+$/);
+/** design.md §11.8, §21.3, §27.3 "React Native設定": present only for `client_type: "react_native"`. */
+export const mobileAppSchema = z.strictObject({
+    app_scheme: z.string().min(1),
+    ios_bundle_id: z.string().min(1).nullable(),
+    ios_team_id: z.string().min(1).nullable(),
+    android_package_name: androidPackageNameSchema.nullable(),
+    android_sha256_fingerprints: z.array(androidSha256FingerprintSchema),
+    universal_link_host: z.string().min(1).nullable(),
+});
+export const clientSchema = z.strictObject({
+    id: clientIdSchema,
+    environment_id: environmentIdSchema,
+    client_type: clientTypeSchema,
+    name: z.string().min(1).max(200),
+    public_key_prefix: z.string().min(1).nullable(),
+    redirect_uris: z.array(clientRedirectUriSchema).max(50),
+    post_logout_redirect_uris: z.array(clientRedirectUriSchema).max(50),
+    allowed_origins: z.array(originSchema).max(50),
+    allowed_scopes: z.array(allowedScopeSchema).max(50),
+    allowed_resources: z.array(httpsUrlSchema).max(20),
+    token_endpoint_auth_method: tokenEndpointAuthMethodSchema,
+    require_pkce: z.boolean(),
+    status: clientStatusSchema,
+    mobile_app: mobileAppSchema.nullable(),
+    created_at: z.iso.datetime(),
+    updated_at: z.iso.datetime(),
+});
+// ---------------------------------------------------------------------------
+// GET /clients
+// ---------------------------------------------------------------------------
+export const clientListQuerySchema = paginationQuerySchema.extend({
+    environment_id: environmentIdSchema,
+    client_type: clientTypeSchema.optional(),
+});
+export const clientListResponseSchema = cursorPageSchema(clientSchema);
+// ---------------------------------------------------------------------------
+// POST /clients
+// ---------------------------------------------------------------------------
+export const clientCreateRequestSchema = z.strictObject({
+    environment_id: environmentIdSchema,
+    client_type: clientTypeSchema,
+    name: z.string().min(1).max(200),
+    redirect_uris: z.array(clientRedirectUriSchema).max(50).default([]),
+    post_logout_redirect_uris: z.array(clientRedirectUriSchema).max(50).default([]),
+    allowed_origins: z.array(originSchema).max(50).default([]),
+    allowed_scopes: z.array(allowedScopeSchema).max(50).default([]),
+    allowed_resources: z.array(httpsUrlSchema).max(20).default([]),
+    token_endpoint_auth_method: tokenEndpointAuthMethodSchema,
+    require_pkce: z.boolean().default(true),
+    mobile_app: mobileAppSchema.optional(),
+});
+/**
+ * design.md §11.12's "Secretは作成時に1回だけ表示する" applies by the same
+ * logic to any generated confidential-client secret: `client_secret` is
+ * present only when `token_endpoint_auth_method !== "none"`, and only on this
+ * one response — never on `GET`/`PATCH`/list.
+ */
+export const clientCreateResponseSchema = clientSchema.extend({
+    client_secret: z.string().min(1).optional(),
+});
+// ---------------------------------------------------------------------------
+// GET /clients/:clientId
+// ---------------------------------------------------------------------------
+export const clientGetResponseSchema = clientSchema;
+// ---------------------------------------------------------------------------
+// PATCH /clients/:clientId
+// ---------------------------------------------------------------------------
+export const clientUpdateRequestSchema = z.strictObject({
+    name: z.string().min(1).max(200).optional(),
+    redirect_uris: z.array(clientRedirectUriSchema).max(50).optional(),
+    post_logout_redirect_uris: z.array(clientRedirectUriSchema).max(50).optional(),
+    allowed_origins: z.array(originSchema).max(50).optional(),
+    allowed_scopes: z.array(allowedScopeSchema).max(50).optional(),
+    allowed_resources: z.array(httpsUrlSchema).max(20).optional(),
+    token_endpoint_auth_method: tokenEndpointAuthMethodSchema.optional(),
+    require_pkce: z.boolean().optional(),
+    status: clientStatusSchema.optional(),
+    mobile_app: mobileAppSchema.nullable().optional(),
+});
+export const clientUpdateResponseSchema = clientSchema;
+// ---------------------------------------------------------------------------
+// DELETE /clients/:clientId
+// ---------------------------------------------------------------------------
+export const clientDeleteResponseSchema = z.strictObject({
+    id: clientIdSchema,
+    deleted: z.literal(true),
+});
+// ---------------------------------------------------------------------------
+// POST /clients/:clientId/rotate-secret
+// ---------------------------------------------------------------------------
+export const clientRotateSecretRequestSchema = z.strictObject({});
+/** One-time plaintext secret (design.md §11.12's display-once rule, applied to client secrets). */
+export const clientRotateSecretResponseSchema = z.strictObject({
+    id: clientIdSchema,
+    client_secret: z.string().min(1),
+    rotated_at: z.iso.datetime(),
+});

package/dist/common.d.ts

@@ -0,0 +1,95 @@
+import { z } from "zod";
+/**
+ * Common Management API envelope conventions (design.md §26.3):
+ *
+ * - cursor pagination, max page size 100
+ * - write APIs support `Idempotency-Key`
+ * - updates support ETag / `If-Match`
+ * - a Request ID is attached to every response
+ * - errors are returned as RFC 9457 Problem Details
+ *
+ * `request_id`: design.md §26.3's Problem Details example embeds
+ * `request_id` inside the error body. For success responses this package
+ * does not duplicate `request_id` into every resource/list schema — doing so
+ * would force every list item and every nested object to carry a redundant
+ * copy. Instead, success responses attach it the same way
+ * `@smartcrab/result`'s `problemDetailsResponse` already does for errors:
+ * an `X-Request-Id` response header (`requestIdHeaderSchema` below). Routes
+ * that need the id in the JSON body too may extend a resource schema with
+ * `problemDetailsSchema`'s `request_id` field; the header is the one
+ * guarantee this package encodes as "attached to all responses".
+ */
+export declare const DEFAULT_PAGE_SIZE = 25;
+export declare const MAX_PAGE_SIZE = 100;
+/**
+ * Query parameters shared by every `GET` list route. `limit` is coerced from
+ * its wire representation (a query string) to a number so callers can parse
+ * `URLSearchParams` values directly.
+ */
+export declare const paginationQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type PaginationQuery = z.infer<typeof paginationQuerySchema>;
+/**
+ * Generic cursor-paginated list envelope: `{ items, next_cursor }`.
+ * `next_cursor` is `null` once the caller has reached the last page.
+ */
+export declare const cursorPageSchema: <ItemSchema extends z.ZodType>(itemSchema: ItemSchema) => z.ZodObject<{
+    items: z.ZodArray<ItemSchema>;
+    next_cursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type CursorPage<Item> = {
+    readonly items: readonly Item[];
+    readonly next_cursor: string | null;
+};
+export declare const idempotencyKeySchema: z.ZodString;
+/** Header carried by every `POST`/`PATCH`/`DELETE` write request. */
+export declare const idempotencyKeyHeaderSchema: z.ZodObject<{
+    "idempotency-key": z.ZodString;
+}, z.core.$strict>;
+export type IdempotencyKeyHeader = z.infer<typeof idempotencyKeyHeaderSchema>;
+/** An opaque entity tag, optionally weak (`W/"..."`) or quoted per RFC 9110 §8.8.3. */
+export declare const etagSchema: z.ZodString;
+export type ETag = z.infer<typeof etagSchema>;
+/** Header carried by every conditional `PATCH`/`DELETE` request. */
+export declare const ifMatchHeaderSchema: z.ZodObject<{
+    "if-match": z.ZodString;
+}, z.core.$strict>;
+export type IfMatchHeader = z.infer<typeof ifMatchHeaderSchema>;
+/** `req_...` (design.md §7.5 / `@smartcrab/identifiers` `ID_PREFIXES.request`). */
+export declare const requestIdSchema: z.ZodString;
+export type RequestId = z.infer<typeof requestIdSchema>;
+export declare const requestIdHeaderSchema: z.ZodObject<{
+    "x-request-id": z.ZodString;
+}, z.core.$strict>;
+export type RequestIdHeader = z.infer<typeof requestIdHeaderSchema>;
+/**
+ * Matches `@smartcrab/result`'s `ProblemDetails` interface shape exactly
+ * (this package does not import `@smartcrab/result`, per assignment
+ * rules, so the shape is redefined here as a zod schema for request/response
+ * contract validation rather than reused as a TS type).
+ *
+ * ```json
+ * {
+ *   "type": "https://docs.example-auth.com/errors/invalid-redirect-uri",
+ *   "title": "Invalid redirect URI",
+ *   "status": 400,
+ *   "detail": "The redirect URI is not registered for this client.",
+ *   "code": "invalid_redirect_uri",
+ *   "request_id": "req_xxx"
+ * }
+ * ```
+ *
+ * Deliberately NOT `z.strictObject`: RFC 9457 explicitly allows arbitrary
+ * extension members alongside the standard ones.
+ */
+export declare const problemDetailsSchema: z.ZodObject<{
+    type: z.ZodString;
+    title: z.ZodString;
+    status: z.ZodNumber;
+    detail: z.ZodOptional<z.ZodString>;
+    code: z.ZodOptional<z.ZodString>;
+    request_id: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type ProblemDetails = z.infer<typeof problemDetailsSchema>;