@smartcrab/contracts-management 0.1.0

package/dist/environments.d.ts

@@ -0,0 +1,194 @@
+import { z } from "zod";
+/**
+ * `environments` (design.md §11.4, §7.3). `auth_routing_version` is excluded
+ * as internal multi-cell routing state (design.md §10.6 `AuthLocatorDO`),
+ * the same category of field the assignment's "internal routing" exclusion
+ * targets alongside the explicitly named secret columns. `config_version` is
+ * kept: it is a plain monotonic counter for the environment's own config
+ * generation (design.md §11.4 `config_version INTEGER`), not a routing
+ * detail, and is useful for dashboard cache-busting.
+ */
+export declare const ENVIRONMENT_TYPES: readonly ["test", "production"];
+export declare const environmentTypeSchema: z.ZodEnum<{
+    test: "test";
+    production: "production";
+}>;
+export type EnvironmentType = (typeof ENVIRONMENT_TYPES)[number];
+export declare const ENVIRONMENT_STATUSES: readonly ["active", "suspended", "deleted"];
+export declare const environmentStatusSchema: z.ZodEnum<{
+    active: "active";
+    deleted: "deleted";
+    suspended: "suspended";
+}>;
+export type EnvironmentStatus = (typeof ENVIRONMENT_STATUSES)[number];
+export declare const environmentSchema: z.ZodObject<{
+    id: z.ZodString;
+    project_id: z.ZodString;
+    type: z.ZodEnum<{
+        test: "test";
+        production: "production";
+    }>;
+    name: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        deleted: "deleted";
+        suspended: "suspended";
+    }>;
+    issuer: z.ZodURL;
+    interaction_domain: z.ZodString;
+    rp_id: z.ZodString;
+    config_version: z.ZodNumber;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type Environment = z.infer<typeof environmentSchema>;
+export declare const environmentListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    project_id: z.ZodString;
+    type: z.ZodOptional<z.ZodEnum<{
+        test: "test";
+        production: "production";
+    }>>;
+}, z.core.$strip>;
+export type EnvironmentListQuery = z.infer<typeof environmentListQuerySchema>;
+export declare const environmentListResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        project_id: z.ZodString;
+        type: z.ZodEnum<{
+            test: "test";
+            production: "production";
+        }>;
+        name: z.ZodString;
+        status: z.ZodEnum<{
+            active: "active";
+            deleted: "deleted";
+            suspended: "suspended";
+        }>;
+        issuer: z.ZodURL;
+        interaction_domain: z.ZodString;
+        rp_id: z.ZodString;
+        config_version: z.ZodNumber;
+        created_at: z.ZodISODateTime;
+        updated_at: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    next_cursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type EnvironmentListResponse = z.infer<typeof environmentListResponseSchema>;
+/**
+ * `issuer` / `interaction_domain` / `rp_id` are NOT client-settable at
+ * creation: they are server-derived from the new environment's id and the
+ * platform's root domain (design.md §8), then fixed for the environment's
+ * lifetime (design.md §7.3's isolation guarantees depend on this).
+ */
+export declare const environmentCreateRequestSchema: z.ZodObject<{
+    project_id: z.ZodString;
+    type: z.ZodEnum<{
+        test: "test";
+        production: "production";
+    }>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type EnvironmentCreateRequest = z.infer<typeof environmentCreateRequestSchema>;
+export declare const environmentCreateResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    project_id: z.ZodString;
+    type: z.ZodEnum<{
+        test: "test";
+        production: "production";
+    }>;
+    name: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        deleted: "deleted";
+        suspended: "suspended";
+    }>;
+    issuer: z.ZodURL;
+    interaction_domain: z.ZodString;
+    rp_id: z.ZodString;
+    config_version: z.ZodNumber;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type EnvironmentCreateResponse = z.infer<typeof environmentCreateResponseSchema>;
+export declare const environmentGetResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    project_id: z.ZodString;
+    type: z.ZodEnum<{
+        test: "test";
+        production: "production";
+    }>;
+    name: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        deleted: "deleted";
+        suspended: "suspended";
+    }>;
+    issuer: z.ZodURL;
+    interaction_domain: z.ZodString;
+    rp_id: z.ZodString;
+    config_version: z.ZodNumber;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type EnvironmentGetResponse = z.infer<typeof environmentGetResponseSchema>;
+/** `status` here only toggles `active`/`suspended`; `deleted` is reached via `DELETE`, not `PATCH`. */
+export declare const environmentUpdateRequestSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    status: z.ZodOptional<z.ZodEnum<{
+        active: "active";
+        suspended: "suspended";
+    }>>;
+}, z.core.$strict>;
+export type EnvironmentUpdateRequest = z.infer<typeof environmentUpdateRequestSchema>;
+export declare const environmentUpdateResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    project_id: z.ZodString;
+    type: z.ZodEnum<{
+        test: "test";
+        production: "production";
+    }>;
+    name: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        deleted: "deleted";
+        suspended: "suspended";
+    }>;
+    issuer: z.ZodURL;
+    interaction_domain: z.ZodString;
+    rp_id: z.ZodString;
+    config_version: z.ZodNumber;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+}, z.core.$strict>;
+export type EnvironmentUpdateResponse = z.infer<typeof environmentUpdateResponseSchema>;
+export declare const environmentDeleteResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    status: z.ZodLiteral<"deleted">;
+}, z.core.$strict>;
+export type EnvironmentDeleteResponse = z.infer<typeof environmentDeleteResponseSchema>;
+/**
+ * RP ID migration progress (design.md §8.3). The migration is in effect while
+ * the Environment has an active `rp_enabled` custom domain: `active_rp_id` is
+ * that hostname and `legacy_rp_id` the Environment's original `rp_id`;
+ * otherwise `active_rp_id` = `rp_id` and `legacy_rp_id` = null.
+ * `legacy_disabled_at` is the stored value, returned even when not in effect.
+ * User counts cover every Auth partition and only non-revoked passkeys.
+ */
+export declare const rpMigrationResponseSchema: z.ZodObject<{
+    environment_id: z.ZodString;
+    active_rp_id: z.ZodString;
+    legacy_rp_id: z.ZodNullable<z.ZodString>;
+    legacy_disabled_at: z.ZodNullable<z.ZodISODateTime>;
+    total_users: z.ZodNumber;
+    migrated_users: z.ZodNumber;
+    legacy_only_users: z.ZodNumber;
+    migrated_share: z.ZodNumber;
+}, z.core.$strict>;
+export type RpMigrationResponse = z.infer<typeof rpMigrationResponseSchema>;
+/** Irreversible: `confirm_rp_id` must equal the Environment's legacy `rp_id`. */
+export declare const rpMigrationDisableLegacyRequestSchema: z.ZodObject<{
+    confirm_rp_id: z.ZodString;
+}, z.core.$strict>;
+export type RpMigrationDisableLegacyRequest = z.infer<typeof rpMigrationDisableLegacyRequestSchema>;

package/dist/environments.js

@@ -0,0 +1,101 @@
+import { z } from "zod";
+import { cursorPageSchema, paginationQuerySchema } from "./common.js";
+import { environmentIdSchema, httpsUrlSchema, projectIdSchema } from "./primitives.js";
+/**
+ * `environments` (design.md §11.4, §7.3). `auth_routing_version` is excluded
+ * as internal multi-cell routing state (design.md §10.6 `AuthLocatorDO`),
+ * the same category of field the assignment's "internal routing" exclusion
+ * targets alongside the explicitly named secret columns. `config_version` is
+ * kept: it is a plain monotonic counter for the environment's own config
+ * generation (design.md §11.4 `config_version INTEGER`), not a routing
+ * detail, and is useful for dashboard cache-busting.
+ */
+export const ENVIRONMENT_TYPES = ["test", "production"];
+export const environmentTypeSchema = z.enum(ENVIRONMENT_TYPES);
+export const ENVIRONMENT_STATUSES = ["active", "suspended", "deleted"];
+export const environmentStatusSchema = z.enum(ENVIRONMENT_STATUSES);
+export const environmentSchema = z.strictObject({
+    id: environmentIdSchema,
+    project_id: projectIdSchema,
+    type: environmentTypeSchema,
+    name: z.string().min(1).max(200),
+    status: environmentStatusSchema,
+    /** design.md §8.1: the OIDC issuer URL, distinct from the interaction domain. */
+    issuer: httpsUrlSchema,
+    /** design.md §8.1: the Hosted Login / interaction-facing hostname. */
+    interaction_domain: z.string().min(1),
+    /** design.md §8.3, §17: WebAuthn Relying Party ID for this environment's passkeys. */
+    rp_id: z.string().min(1),
+    config_version: z.number().int().nonnegative(),
+    created_at: z.iso.datetime(),
+    updated_at: z.iso.datetime(),
+});
+// ---------------------------------------------------------------------------
+// GET /environments
+// ---------------------------------------------------------------------------
+export const environmentListQuerySchema = paginationQuerySchema.extend({
+    project_id: projectIdSchema,
+    type: environmentTypeSchema.optional(),
+});
+export const environmentListResponseSchema = cursorPageSchema(environmentSchema);
+// ---------------------------------------------------------------------------
+// POST /environments
+// ---------------------------------------------------------------------------
+/**
+ * `issuer` / `interaction_domain` / `rp_id` are NOT client-settable at
+ * creation: they are server-derived from the new environment's id and the
+ * platform's root domain (design.md §8), then fixed for the environment's
+ * lifetime (design.md §7.3's isolation guarantees depend on this).
+ */
+export const environmentCreateRequestSchema = z.strictObject({
+    project_id: projectIdSchema,
+    type: environmentTypeSchema,
+    name: z.string().min(1).max(200),
+});
+export const environmentCreateResponseSchema = environmentSchema;
+// ---------------------------------------------------------------------------
+// GET /environments/:environmentId
+// ---------------------------------------------------------------------------
+export const environmentGetResponseSchema = environmentSchema;
+// ---------------------------------------------------------------------------
+// PATCH /environments/:environmentId
+// ---------------------------------------------------------------------------
+/** `status` here only toggles `active`/`suspended`; `deleted` is reached via `DELETE`, not `PATCH`. */
+export const environmentUpdateRequestSchema = z.strictObject({
+    name: z.string().min(1).max(200).optional(),
+    status: z.enum(["active", "suspended"]).optional(),
+});
+export const environmentUpdateResponseSchema = environmentSchema;
+// ---------------------------------------------------------------------------
+// DELETE /environments/:environmentId
+// ---------------------------------------------------------------------------
+export const environmentDeleteResponseSchema = z.strictObject({
+    id: environmentIdSchema,
+    status: z.literal("deleted"),
+});
+// ---------------------------------------------------------------------------
+// GET  /environments/:environmentId/rp-migration
+// POST /environments/:environmentId/rp-migration/disable-legacy
+// ---------------------------------------------------------------------------
+/**
+ * RP ID migration progress (design.md §8.3). The migration is in effect while
+ * the Environment has an active `rp_enabled` custom domain: `active_rp_id` is
+ * that hostname and `legacy_rp_id` the Environment's original `rp_id`;
+ * otherwise `active_rp_id` = `rp_id` and `legacy_rp_id` = null.
+ * `legacy_disabled_at` is the stored value, returned even when not in effect.
+ * User counts cover every Auth partition and only non-revoked passkeys.
+ */
+export const rpMigrationResponseSchema = z.strictObject({
+    environment_id: environmentIdSchema,
+    active_rp_id: z.string(),
+    legacy_rp_id: z.string().nullable(),
+    legacy_disabled_at: z.iso.datetime().nullable(),
+    total_users: z.number().int().min(0),
+    migrated_users: z.number().int().min(0),
+    legacy_only_users: z.number().int().min(0),
+    migrated_share: z.number().min(0).max(1),
+});
+/** Irreversible: `confirm_rp_id` must equal the Environment's legacy `rp_id`. */
+export const rpMigrationDisableLegacyRequestSchema = z.strictObject({
+    confirm_rp_id: z.string().min(1),
+});

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * @smartcrab/contracts-management — zod request/response contracts for
+ * the Management API (design.md §26), consumed by control-worker routes,
+ * `@smartcrab/management-client`, the dashboard SPA, and the CLI.
+ *
+ * Mirrors `@smartcrab/contracts-public`'s conventions: a local
+ * dependency-free style (no `@smartcrab/result`), `idPattern`-based id
+ * schemas, `z.strictObject` on every response shape, and per-field doc
+ * comments citing design.md sections.
+ */
+export * from "./common.js";
+export * from "./primitives.js";
+export * from "./rbac.js";
+export * from "./api-keys.js";
+export * from "./workspaces.js";
+export * from "./projects.js";
+export * from "./environments.js";
+export * from "./clients.js";
+export * from "./connections.js";
+export * from "./domains.js";
+export * from "./users.js";
+export * from "./user-subresources.js";
+export * from "./user-jobs.js";
+export * from "./webhooks.js";
+export * from "./audit-events.js";
+export * from "./usage.js";
+export * from "./billing.js";

package/dist/index.js

@@ -0,0 +1,27 @@
+/**
+ * @smartcrab/contracts-management — zod request/response contracts for
+ * the Management API (design.md §26), consumed by control-worker routes,
+ * `@smartcrab/management-client`, the dashboard SPA, and the CLI.
+ *
+ * Mirrors `@smartcrab/contracts-public`'s conventions: a local
+ * dependency-free style (no `@smartcrab/result`), `idPattern`-based id
+ * schemas, `z.strictObject` on every response shape, and per-field doc
+ * comments citing design.md sections.
+ */
+export * from "./common.js";
+export * from "./primitives.js";
+export * from "./rbac.js";
+export * from "./api-keys.js";
+export * from "./workspaces.js";
+export * from "./projects.js";
+export * from "./environments.js";
+export * from "./clients.js";
+export * from "./connections.js";
+export * from "./domains.js";
+export * from "./users.js";
+export * from "./user-subresources.js";
+export * from "./user-jobs.js";
+export * from "./webhooks.js";
+export * from "./audit-events.js";
+export * from "./usage.js";
+export * from "./billing.js";

package/dist/primitives.d.ts

@@ -0,0 +1,49 @@
+import { z } from "zod";
+/**
+ * Shared primitives for the Management API (design.md §26).
+ *
+ * ID schemas for kinds already modeled by `@smartcrab/contracts-public`
+ * (client/user/session/passkey/identity/webhook) are re-exported from there
+ * rather than redefined, per the assignment notes: this package's
+ * `package.json` only declares `zod` and `@smartcrab/contracts-public` as
+ * dependencies, so `@smartcrab/identifiers` and `@smartcrab/tenant-context`
+ * are not resolvable here directly (pnpm's strict `node_modules` only links a
+ * package's own declared dependencies, not its transitive ones). For the
+ * remaining ID kinds this Management API surface needs
+ * (workspace/project/environment/connection/domain/job/management-api-key/
+ * audit-event) that `contracts-public` does not export, the exact
+ * `<prefix>_<32 base32url chars>` rule and prefix table are mirrored locally
+ * from `@smartcrab/identifiers`'s `ID_PREFIXES` (design.md §7.5) so the
+ * pattern never drifts from the canonical source.
+ */
+export { clientIdSchema, httpsUrlSchema, identityIdSchema, isoDateTimeSchema, passkeyIdSchema, sessionIdSchema, userIdSchema, webhookIdSchema, } from "@smartcrab/contracts-public";
+export type { ClientId, IdentityId, PasskeyId, SessionId, UserId, WebhookId, } from "@smartcrab/contracts-public";
+export declare const workspaceIdSchema: z.ZodString;
+export type WorkspaceId = z.infer<typeof workspaceIdSchema>;
+export declare const projectIdSchema: z.ZodString;
+export type ProjectId = z.infer<typeof projectIdSchema>;
+export declare const environmentIdSchema: z.ZodString;
+export type EnvironmentId = z.infer<typeof environmentIdSchema>;
+export declare const connectionIdSchema: z.ZodString;
+export type ConnectionId = z.infer<typeof connectionIdSchema>;
+export declare const domainIdSchema: z.ZodString;
+export type DomainId = z.infer<typeof domainIdSchema>;
+export declare const jobIdSchema: z.ZodString;
+export type JobId = z.infer<typeof jobIdSchema>;
+export declare const apiKeyIdSchema: z.ZodString;
+export type ApiKeyId = z.infer<typeof apiKeyIdSchema>;
+export declare const auditEventIdSchema: z.ZodString;
+export type AuditEventId = z.infer<typeof auditEventIdSchema>;
+/**
+ * Generic domain event ID (`evt_...`, design.md §7.5) — the exact same ID
+ * kind as `auditEventIdSchema` above, exported under a resource-neutral name
+ * for consumers (e.g. `webhooks.ts`'s delivery history `event_id`) that
+ * reference a domain event without being about the audit log itself.
+ */
+export declare const eventIdSchema: z.ZodString;
+export type EventId = z.infer<typeof eventIdSchema>;
+/** `webhook_delivery_history.id` (design.md §29.4, §10.10): `dlv_...`. */
+export declare const deliveryIdSchema: z.ZodString;
+export type DeliveryId = z.infer<typeof deliveryIdSchema>;
+/** `workspaces.slug` / `projects.slug` (design.md §11.1, §11.3): URL-safe, lowercase, hyphenated. */
+export declare const slugSchema: z.ZodString;

package/dist/primitives.js

@@ -0,0 +1,56 @@
+import { z } from "zod";
+/**
+ * Shared primitives for the Management API (design.md §26).
+ *
+ * ID schemas for kinds already modeled by `@smartcrab/contracts-public`
+ * (client/user/session/passkey/identity/webhook) are re-exported from there
+ * rather than redefined, per the assignment notes: this package's
+ * `package.json` only declares `zod` and `@smartcrab/contracts-public` as
+ * dependencies, so `@smartcrab/identifiers` and `@smartcrab/tenant-context`
+ * are not resolvable here directly (pnpm's strict `node_modules` only links a
+ * package's own declared dependencies, not its transitive ones). For the
+ * remaining ID kinds this Management API surface needs
+ * (workspace/project/environment/connection/domain/job/management-api-key/
+ * audit-event) that `contracts-public` does not export, the exact
+ * `<prefix>_<32 base32url chars>` rule and prefix table are mirrored locally
+ * from `@smartcrab/identifiers`'s `ID_PREFIXES` (design.md §7.5) so the
+ * pattern never drifts from the canonical source.
+ */
+export { clientIdSchema, httpsUrlSchema, identityIdSchema, isoDateTimeSchema, passkeyIdSchema, sessionIdSchema, userIdSchema, webhookIdSchema, } from "@smartcrab/contracts-public";
+/** Mirrors `@smartcrab/identifiers`'s `ID_PREFIXES` (design.md §7.5) for kinds not re-exported above. */
+const LOCAL_ID_PREFIXES = {
+    workspace: "wsp",
+    project: "prj",
+    environment: "env",
+    connection: "con",
+    domain: "dom",
+    job: "job",
+    apiKey: "mky",
+    event: "evt",
+    delivery: "dlv",
+};
+/** Zod-ready regex, identical shape to `@smartcrab/identifiers`'s `idPattern`. */
+const localIdPattern = (kind) => new RegExp(`^${LOCAL_ID_PREFIXES[kind]}_[a-z2-7]{32}$`);
+export const workspaceIdSchema = z.string().regex(localIdPattern("workspace"));
+export const projectIdSchema = z.string().regex(localIdPattern("project"));
+export const environmentIdSchema = z.string().regex(localIdPattern("environment"));
+export const connectionIdSchema = z.string().regex(localIdPattern("connection"));
+export const domainIdSchema = z.string().regex(localIdPattern("domain"));
+export const jobIdSchema = z.string().regex(localIdPattern("job"));
+export const apiKeyIdSchema = z.string().regex(localIdPattern("apiKey"));
+export const auditEventIdSchema = z.string().regex(localIdPattern("event"));
+/**
+ * Generic domain event ID (`evt_...`, design.md §7.5) — the exact same ID
+ * kind as `auditEventIdSchema` above, exported under a resource-neutral name
+ * for consumers (e.g. `webhooks.ts`'s delivery history `event_id`) that
+ * reference a domain event without being about the audit log itself.
+ */
+export const eventIdSchema = z.string().regex(localIdPattern("event"));
+/** `webhook_delivery_history.id` (design.md §29.4, §10.10): `dlv_...`. */
+export const deliveryIdSchema = z.string().regex(localIdPattern("delivery"));
+/** `workspaces.slug` / `projects.slug` (design.md §11.1, §11.3): URL-safe, lowercase, hyphenated. */
+export const slugSchema = z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/);

package/dist/projects.d.ts

@@ -0,0 +1,78 @@
+import { z } from "zod";
+/** `projects` (design.md §11.3, §7.2). No secret/internal-routing columns. */
+export declare const projectSchema: z.ZodObject<{
+    id: z.ZodString;
+    workspace_id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+    deleted_at: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type Project = z.infer<typeof projectSchema>;
+/** `/projects` is a flat top-level route (design.md §26.2); `workspace_id` scopes the listing. */
+export declare const projectListQuerySchema: z.ZodObject<{
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    workspace_id: z.ZodString;
+}, z.core.$strip>;
+export type ProjectListQuery = z.infer<typeof projectListQuerySchema>;
+export declare const projectListResponseSchema: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        workspace_id: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodString;
+        created_at: z.ZodISODateTime;
+        updated_at: z.ZodISODateTime;
+        deleted_at: z.ZodNullable<z.ZodISODateTime>;
+    }, z.core.$strict>>;
+    next_cursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ProjectListResponse = z.infer<typeof projectListResponseSchema>;
+export declare const projectCreateRequestSchema: z.ZodObject<{
+    workspace_id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ProjectCreateRequest = z.infer<typeof projectCreateRequestSchema>;
+export declare const projectCreateResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    workspace_id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+    deleted_at: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type ProjectCreateResponse = z.infer<typeof projectCreateResponseSchema>;
+export declare const projectGetResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    workspace_id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+    deleted_at: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type ProjectGetResponse = z.infer<typeof projectGetResponseSchema>;
+export declare const projectUpdateRequestSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    slug: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type ProjectUpdateRequest = z.infer<typeof projectUpdateRequestSchema>;
+export declare const projectUpdateResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    workspace_id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    created_at: z.ZodISODateTime;
+    updated_at: z.ZodISODateTime;
+    deleted_at: z.ZodNullable<z.ZodISODateTime>;
+}, z.core.$strict>;
+export type ProjectUpdateResponse = z.infer<typeof projectUpdateResponseSchema>;
+export declare const projectDeleteResponseSchema: z.ZodObject<{
+    id: z.ZodString;
+    deleted: z.ZodLiteral<true>;
+}, z.core.$strict>;
+export type ProjectDeleteResponse = z.infer<typeof projectDeleteResponseSchema>;

package/dist/projects.js

@@ -0,0 +1,49 @@
+import { z } from "zod";
+import { cursorPageSchema, paginationQuerySchema } from "./common.js";
+import { projectIdSchema, slugSchema, workspaceIdSchema } from "./primitives.js";
+/** `projects` (design.md §11.3, §7.2). No secret/internal-routing columns. */
+export const projectSchema = z.strictObject({
+    id: projectIdSchema,
+    workspace_id: workspaceIdSchema,
+    name: z.string().min(1).max(200),
+    slug: slugSchema,
+    created_at: z.iso.datetime(),
+    updated_at: z.iso.datetime(),
+    deleted_at: z.iso.datetime().nullable(),
+});
+// ---------------------------------------------------------------------------
+// GET /projects
+// ---------------------------------------------------------------------------
+/** `/projects` is a flat top-level route (design.md §26.2); `workspace_id` scopes the listing. */
+export const projectListQuerySchema = paginationQuerySchema.extend({
+    workspace_id: workspaceIdSchema,
+});
+export const projectListResponseSchema = cursorPageSchema(projectSchema);
+// ---------------------------------------------------------------------------
+// POST /projects
+// ---------------------------------------------------------------------------
+export const projectCreateRequestSchema = z.strictObject({
+    workspace_id: workspaceIdSchema,
+    name: z.string().min(1).max(200),
+    slug: slugSchema.optional(),
+});
+export const projectCreateResponseSchema = projectSchema;
+// ---------------------------------------------------------------------------
+// GET /projects/:projectId
+// ---------------------------------------------------------------------------
+export const projectGetResponseSchema = projectSchema;
+// ---------------------------------------------------------------------------
+// PATCH /projects/:projectId
+// ---------------------------------------------------------------------------
+export const projectUpdateRequestSchema = z.strictObject({
+    name: z.string().min(1).max(200).optional(),
+    slug: slugSchema.optional(),
+});
+export const projectUpdateResponseSchema = projectSchema;
+// ---------------------------------------------------------------------------
+// DELETE /projects/:projectId (design.md §11.3 `deleted_at` — logical delete)
+// ---------------------------------------------------------------------------
+export const projectDeleteResponseSchema = z.strictObject({
+    id: projectIdSchema,
+    deleted: z.literal(true),
+});