@sylphx/contract 0.2.0

package/dist/endpoints/analytics.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Analytics endpoints — BaaS plane. Paths mirror `@sylphx/sdk/analytics.ts`.
+ */
+export declare const analyticsEndpoints: {
+    readonly track: import("../endpoint.js").Endpoint<"POST", "/analytics/track", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        event: typeof import("effect/Schema").String;
+        properties: import("effect/Schema").optional<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+        userId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        anonymousId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        timestamp: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+    }>>;
+    readonly identify: import("../endpoint.js").Endpoint<"POST", "/analytics/identify", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        userId: typeof import("effect/Schema").String;
+        traits: import("effect/Schema").optional<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+        anonymousId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        timestamp: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+    }>>;
+    readonly page: import("../endpoint.js").Endpoint<"POST", "/analytics/page", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        name: typeof import("effect/Schema").String;
+        properties: import("effect/Schema").optional<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+        userId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        anonymousId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        timestamp: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+    }>>;
+    readonly batch: import("../endpoint.js").Endpoint<"POST", "/analytics/batch", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        events: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            event: typeof import("effect/Schema").String;
+            properties: import("effect/Schema").optional<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+            timestamp: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            destinations: import("effect/Schema").optional<import("effect/Schema").Array$<import("effect/Schema").Literal<["google_ads", "meta", "tiktok"]>>>;
+            skipDestinations: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+            conversion: import("effect/Schema").optional<import("effect/Schema").Struct<{
+                clickId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                value: import("effect/Schema").optional<typeof import("effect/Schema").Number>;
+                currency: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                orderId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                userEmail: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                userPhone: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                userFirstName: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                userLastName: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            }>>;
+            userId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            anonymousId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        }>>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        count: typeof import("effect/Schema").Number;
+        deduplicated: typeof import("effect/Schema").Number;
+        total: typeof import("effect/Schema").Number;
+    }>>;
+};
+//# sourceMappingURL=analytics.d.ts.map

package/dist/endpoints/analytics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics.d.ts","sourceRoot":"","sources":["../../src/endpoints/analytics.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCrB,CAAA"}

package/dist/endpoints/analytics.js

@@ -0,0 +1,43 @@
+/**
+ * Analytics endpoints — BaaS plane. Paths mirror `@sylphx/sdk/analytics.ts`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { BatchTrackInput, BatchTrackResult, IdentifyInput, PageInput, TrackInput, TrackResult, } from '../schemas/analytics.js';
+export const analyticsEndpoints = {
+    track: defineEndpoint({
+        method: 'POST',
+        path: '/analytics/track',
+        body: TrackInput,
+        response: TrackResult,
+        plane: 'baas',
+        summary: 'Record a single analytics event',
+        tags: ['analytics'],
+    }),
+    identify: defineEndpoint({
+        method: 'POST',
+        path: '/analytics/identify',
+        body: IdentifyInput,
+        response: TrackResult,
+        plane: 'baas',
+        summary: 'Associate traits with a user',
+        tags: ['analytics'],
+    }),
+    page: defineEndpoint({
+        method: 'POST',
+        path: '/analytics/page',
+        body: PageInput,
+        response: TrackResult,
+        plane: 'baas',
+        summary: 'Record a page view',
+        tags: ['analytics'],
+    }),
+    batch: defineEndpoint({
+        method: 'POST',
+        path: '/analytics/batch',
+        body: BatchTrackInput,
+        response: BatchTrackResult,
+        plane: 'baas',
+        summary: 'Flush a batch of events in a single call',
+        tags: ['analytics'],
+    }),
+};

package/dist/endpoints/audit-chain.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Audit Chain endpoints — SoC Round 3A G-3 verification status surface.
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/audit-chain.ts`. Read-
+ * only operator dashboard for the continuous-verification cron's history.
+ *
+ * Auth: service token (`svc_*`) with scope `platform:audit:read`. The
+ * Console UI consumes this via the same scoped token; super-admin sessions
+ * also pass via the unscoped path.
+ *
+ * Plane: `admin`.
+ */
+export declare const auditChainEndpoints: {
+    readonly status: import("../endpoint.js").Endpoint<"GET", "/audit/chain-status", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        latestCheckpoint: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            chainTipId: typeof import("effect/Schema").String;
+            chainTipHash: typeof import("effect/Schema").String;
+            signingKeyId: typeof import("effect/Schema").String;
+            rowCount: typeof import("effect/Schema").Number;
+            signedAt: typeof import("effect/Schema").String;
+        }>>;
+        latestVerification: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+            detectedAt: typeof import("effect/Schema").String;
+            runId: typeof import("effect/Schema").String;
+            kind: import("effect/Schema").Literal<["chain_break", "row_hash_mismatch", "checkpoint_missing", "checkpoint_signature_invalid"]>;
+            status: import("effect/Schema").Literal<["open", "acknowledged", "resolved"]>;
+        }>>;
+        openFailureCount: typeof import("effect/Schema").Number;
+        failures: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            detectedAt: typeof import("effect/Schema").String;
+            runId: typeof import("effect/Schema").String;
+            kind: import("effect/Schema").Literal<["chain_break", "row_hash_mismatch", "checkpoint_missing", "checkpoint_signature_invalid"]>;
+            partialBreakAuditId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            partialBreakIndex: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            expectedHash: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            actualHash: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            missingEventCount: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            details: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            status: import("effect/Schema").Literal<["open", "acknowledged", "resolved"]>;
+            acknowledgedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            acknowledgedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resolvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resolution: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        }>>;
+    }>>;
+};
+//# sourceMappingURL=audit-chain.d.ts.map

package/dist/endpoints/audit-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain.d.ts","sourceRoot":"","sources":["../../src/endpoints/audit-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAetB,CAAA"}

package/dist/endpoints/audit-chain.js

@@ -0,0 +1,29 @@
+/**
+ * Audit Chain endpoints — SoC Round 3A G-3 verification status surface.
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/audit-chain.ts`. Read-
+ * only operator dashboard for the continuous-verification cron's history.
+ *
+ * Auth: service token (`svc_*`) with scope `platform:audit:read`. The
+ * Console UI consumes this via the same scoped token; super-admin sessions
+ * also pass via the unscoped path.
+ *
+ * Plane: `admin`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AuditChainStatusResponse } from '../schemas/audit-chain.js';
+export const auditChainEndpoints = {
+    status: defineEndpoint({
+        method: 'GET',
+        path: '/audit/chain-status',
+        response: AuditChainStatusResponse,
+        plane: 'admin',
+        summary: 'Latest audit hash-chain verification result + recent failure history',
+        description: 'Returns the latest signed checkpoint, the latest verifier result, ' +
+            'an open-failure count, and the most recent verification failures ' +
+            '(newest first). SoC-2 auditors consume this to confirm continuous ' +
+            'tamper-evidence enforcement is active. Requires service token with ' +
+            'scope `platform:audit:read`.',
+        tags: ['audit-chain'],
+    }),
+};

package/dist/endpoints/audit.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Audit endpoints — BaaS-plane audit-log reader (ADR-089 Phase 5.3b,
+ * Σ1 SoC rename).
+ *
+ * Previously mounted under `/auth/platform-audit/*` (co-located with
+ * Phase 2b/c/d's Platform-audience AUTH endpoints). Σ1 moves these to
+ * their correct top-level namespace `/audit/*` — audit is a
+ * cross-cutting BaaS primitive (compliance / observability), not an
+ * auth verb.
+ *
+ * Scope enforcement (server-side — `apps/runtime/.../routes/audit.ts`):
+ *   - super_admin / admin → all scopes, all rows.
+ *   - project admin       → `project-ops` + `app-events` for projects
+ *                             they admin.
+ *   - regular user        → `project-ops` for projects they're a member
+ *                             of, OR their own `app-events`.
+ *   - scope escalation    → 403 `audit_scope_forbidden`.
+ */
+export declare const auditEndpoints: {
+    readonly query: import("../endpoint.js").Endpoint<"GET", "/audit/query", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        scope: import("effect/Schema").optional<import("effect/Schema").Literal<["platform-ops", "project-ops", "app-events"]>>;
+        actor: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        resourceType: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        resourceId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        action: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        from: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        to: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        cursor: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        limit: import("effect/Schema").optional<typeof import("effect/Schema").Number>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        events: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            ts: typeof import("effect/Schema").String;
+            scope: import("effect/Schema").Literal<["platform-ops", "project-ops", "app-events"]>;
+            actor: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            user: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            orgId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceType: typeof import("effect/Schema").String;
+            resourceId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            action: typeof import("effect/Schema").String;
+            metadata: import("effect/Schema").NullOr<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+            prevHashHex: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            rowHashHex: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        }>>;
+        nextCursor: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        chainVerified: typeof import("effect/Schema").Boolean;
+    }>>;
+};
+//# sourceMappingURL=audit.d.ts.map

package/dist/endpoints/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/endpoints/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CASjB,CAAA"}

package/dist/endpoints/audit.js

@@ -0,0 +1,30 @@
+/**
+ * Audit endpoints — BaaS-plane audit-log reader (ADR-089 Phase 5.3b,
+ * Σ1 SoC rename).
+ *
+ * Previously mounted under `/auth/platform-audit/*` (co-located with
+ * Phase 2b/c/d's Platform-audience AUTH endpoints). Σ1 moves these to
+ * their correct top-level namespace `/audit/*` — audit is a
+ * cross-cutting BaaS primitive (compliance / observability), not an
+ * auth verb.
+ *
+ * Scope enforcement (server-side — `apps/runtime/.../routes/audit.ts`):
+ *   - super_admin / admin → all scopes, all rows.
+ *   - project admin       → `project-ops` + `app-events` for projects
+ *                             they admin.
+ *   - regular user        → `project-ops` for projects they're a member
+ *                             of, OR their own `app-events`.
+ *   - scope escalation    → 403 `audit_scope_forbidden`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { PlatformAuditQueryRequest, PlatformAuditQueryResponse } from '../schemas/auth.js';
+export const auditEndpoints = {
+    query: defineEndpoint({
+        method: 'GET',
+        path: '/audit/query',
+        query: PlatformAuditQueryRequest,
+        response: PlatformAuditQueryResponse,
+        summary: 'Query tamper-evident audit log with role-scoped filtering',
+        tags: ['audit'],
+    }),
+};

package/dist/endpoints/auth-admin.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Auth Admin endpoints — Console-plane OAuth + auth settings + stats.
+ * Distinct from BaaS-plane `authEndpoints` (sign-in/sign-up/sign-out/me).
+ * Mirrors `apps/api/src/server/platform/routes/auth.ts`. Mounted at
+ * `/auth/projects/:id/auth/*` (the `/auth` prefix is the router mount; the
+ * router's own paths are `projects/:id/auth/...`).
+ */
+import { Schema } from 'effect';
+export declare const authAdminEndpoints: {
+    readonly getOAuthProviders: import("../endpoint.js").Endpoint<"GET", "/auth/projects/:id/auth/oauth-providers", Schema.Struct<{
+        id: typeof Schema.String;
+    }>, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        platformProviders: Schema.Array$<typeof Schema.String>;
+        appEnabledProviders: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        effectiveProviders: Schema.Array$<typeof Schema.String>;
+    }>>;
+    readonly updateOAuthProviders: import("../endpoint.js").Endpoint<"PATCH", "/auth/projects/:id/auth/oauth-providers", Schema.Struct<{
+        id: typeof Schema.String;
+    }>, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        enabledProviders: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+    }>, Schema.Struct<{
+        enabledProviders: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        effectiveProviders: Schema.Array$<typeof Schema.String>;
+    }>>;
+    readonly getAuthSettings: import("../endpoint.js").Endpoint<"GET", "/auth/projects/:id/auth/settings", Schema.Struct<{
+        id: typeof Schema.String;
+    }>, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        allowPasswordAuth: typeof Schema.Boolean;
+        allowMagicLink: typeof Schema.Boolean;
+        allowPasskey: typeof Schema.Boolean;
+        require2FA: typeof Schema.Boolean;
+        sessionLifetimeSeconds: typeof Schema.Number;
+        refreshTokenLifetimeSeconds: typeof Schema.Number;
+    }>>;
+    readonly updateAuthSettings: import("../endpoint.js").Endpoint<"PATCH", "/auth/projects/:id/auth/settings", Schema.Struct<{
+        id: typeof Schema.String;
+    }>, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        allowPasswordAuth: Schema.optional<typeof Schema.Boolean>;
+        allowMagicLink: Schema.optional<typeof Schema.Boolean>;
+        allowPasskey: Schema.optional<typeof Schema.Boolean>;
+        require2FA: Schema.optional<typeof Schema.Boolean>;
+        sessionLifetimeSeconds: Schema.optional<typeof Schema.Number>;
+        refreshTokenLifetimeSeconds: Schema.optional<typeof Schema.Number>;
+    }>, Schema.Struct<{
+        allowPasswordAuth: typeof Schema.Boolean;
+        allowMagicLink: typeof Schema.Boolean;
+        allowPasskey: typeof Schema.Boolean;
+        require2FA: typeof Schema.Boolean;
+        sessionLifetimeSeconds: typeof Schema.Number;
+        refreshTokenLifetimeSeconds: typeof Schema.Number;
+    }>>;
+    readonly getAuthStats: import("../endpoint.js").Endpoint<"GET", "/auth/projects/:id/auth/stats", Schema.Struct<{
+        id: typeof Schema.String;
+    }>, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        totalUsers: typeof Schema.Number;
+        activeUsers24h: typeof Schema.Number;
+        activeUsers7d: typeof Schema.Number;
+        activeUsers30d: typeof Schema.Number;
+        twoFactorEnabled: typeof Schema.Number;
+        passkeyEnabled: typeof Schema.Number;
+        loginsByMethod: Schema.Record$<typeof Schema.String, typeof Schema.Number>;
+        successRate: typeof Schema.Number;
+    }>>;
+};
+//# sourceMappingURL=auth-admin.d.ts.map

package/dist/endpoints/auth-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../../src/endpoints/auth-admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAa/B,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CrB,CAAA"}

package/dist/endpoints/auth-admin.js

@@ -0,0 +1,55 @@
+/**
+ * Auth Admin endpoints — Console-plane OAuth + auth settings + stats.
+ * Distinct from BaaS-plane `authEndpoints` (sign-in/sign-up/sign-out/me).
+ * Mirrors `apps/api/src/server/platform/routes/auth.ts`. Mounted at
+ * `/auth/projects/:id/auth/*` (the `/auth` prefix is the router mount; the
+ * router's own paths are `projects/:id/auth/...`).
+ */
+import { Schema } from 'effect';
+import { defineEndpoint } from '../endpoint.js';
+import { AuthSettings, AuthStats, OAuthProvidersResult, UpdateAuthSettingsInput, UpdateOAuthProvidersInput, UpdateOAuthProvidersResult, } from '../schemas/auth-admin.js';
+const ProjectIdPath = Schema.Struct({ id: Schema.String });
+export const authAdminEndpoints = {
+    getOAuthProviders: defineEndpoint({
+        method: 'GET',
+        path: '/auth/projects/:id/auth/oauth-providers',
+        params: ProjectIdPath,
+        response: OAuthProvidersResult,
+        summary: 'Get OAuth providers configuration for a project',
+        tags: ['auth-admin'],
+    }),
+    updateOAuthProviders: defineEndpoint({
+        method: 'PATCH',
+        path: '/auth/projects/:id/auth/oauth-providers',
+        params: ProjectIdPath,
+        body: UpdateOAuthProvidersInput,
+        response: UpdateOAuthProvidersResult,
+        summary: 'Update enabled OAuth providers for a project',
+        tags: ['auth-admin'],
+    }),
+    getAuthSettings: defineEndpoint({
+        method: 'GET',
+        path: '/auth/projects/:id/auth/settings',
+        params: ProjectIdPath,
+        response: AuthSettings,
+        summary: 'Get authentication settings for a project',
+        tags: ['auth-admin'],
+    }),
+    updateAuthSettings: defineEndpoint({
+        method: 'PATCH',
+        path: '/auth/projects/:id/auth/settings',
+        params: ProjectIdPath,
+        body: UpdateAuthSettingsInput,
+        response: AuthSettings,
+        summary: 'Update authentication settings for a project',
+        tags: ['auth-admin'],
+    }),
+    getAuthStats: defineEndpoint({
+        method: 'GET',
+        path: '/auth/projects/:id/auth/stats',
+        params: ProjectIdPath,
+        response: AuthStats,
+        summary: 'Get authentication statistics (users, 2FA adoption, passkeys)',
+        tags: ['auth-admin'],
+    }),
+};

package/dist/endpoints/auth.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Auth endpoints — BaaS plane sign-in / sign-up / sign-out / session. Maps
+ * onto `packages/sdk/src/auth.ts` (under `/api/sdk/auth/*` upstream).
+ *
+ * Plus the RFC 8628 device-flow surface used by headless clients (CLI, TV
+ * apps, IoT). ADR-089 Phase 2a shipped the device endpoints on apps/runtime
+ * as the first dogfood bypass migration; Phase 5.1 extends the surface to
+ * full RFC 6749 + 7662 + 8414 (PKCE, token, revoke, introspect, metadata).
+ */
+import { Schema } from 'effect';
+export declare const authEndpoints: {
+    readonly signIn: import("../endpoint.js").Endpoint<"POST", "/auth/login", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        email: typeof Schema.String;
+        password: typeof Schema.String;
+    }>, Schema.Struct<{
+        requiresTwoFactor: Schema.optional<typeof Schema.Boolean>;
+        userId: Schema.optional<Schema.brand<Schema.filter<typeof Schema.String>, "UserId">>;
+        accessToken: Schema.optional<typeof Schema.String>;
+        refreshToken: Schema.optional<typeof Schema.String>;
+        tokenType: Schema.optional<typeof Schema.String>;
+        expiresIn: Schema.optional<typeof Schema.Number>;
+    }>>;
+    readonly signUp: import("../endpoint.js").Endpoint<"POST", "/auth/register", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        email: typeof Schema.String;
+        password: typeof Schema.String;
+        name: Schema.optional<typeof Schema.String>;
+    }>, Schema.Struct<{
+        userId: Schema.brand<Schema.filter<typeof Schema.String>, "UserId">;
+        email: typeof Schema.String;
+        emailVerified: typeof Schema.Boolean;
+    }>>;
+    readonly signOut: import("../endpoint.js").Endpoint<"POST", "/auth/logout", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        success: typeof Schema.Boolean;
+    }>>;
+    readonly getSession: import("../endpoint.js").Endpoint<"GET", "/auth/me", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        user: Schema.NullOr<Schema.Struct<{
+            id: Schema.brand<Schema.filter<typeof Schema.String>, "UserId">;
+            email: typeof Schema.String;
+            name: Schema.NullOr<typeof Schema.String>;
+            image: Schema.NullOr<typeof Schema.String>;
+            emailVerified: typeof Schema.Boolean;
+        }>>;
+    }>>;
+    readonly deviceInit: import("../endpoint.js").Endpoint<"POST", "/auth/device", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        client_id: typeof Schema.String;
+        scope: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    }>, Schema.Struct<{
+        device_code: typeof Schema.String;
+        user_code: typeof Schema.String;
+        verification_uri: typeof Schema.String;
+        verification_uri_complete: typeof Schema.String;
+        expires_in: typeof Schema.Number;
+        interval: typeof Schema.Number;
+    }>>;
+    readonly devicePoll: import("../endpoint.js").Endpoint<"GET", "/auth/device/poll", Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        device_code: typeof Schema.String;
+    }>, Schema.Schema.AnyNoContext | undefined, Schema.Union<[Schema.Struct<{
+        status: Schema.Literal<["pending"]>;
+    }>, Schema.Struct<{
+        status: Schema.Literal<["approved"]>;
+        access_token: typeof Schema.String;
+        refresh_token: typeof Schema.String;
+        token_type: Schema.Literal<["Bearer"]>;
+        expires_in: typeof Schema.Number;
+        refresh_expires_at: typeof Schema.String;
+    }>, Schema.Struct<{
+        status: Schema.Literal<["denied"]>;
+    }>, Schema.Struct<{
+        status: Schema.Literal<["expired"]>;
+    }>]>>;
+    readonly deviceApprove: import("../endpoint.js").Endpoint<"POST", "/auth/device/approve", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        user_code: typeof Schema.String;
+    }>, Schema.Struct<{
+        success: Schema.Literal<[true]>;
+    }>>;
+    readonly deviceDeny: import("../endpoint.js").Endpoint<"POST", "/auth/device/deny", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        user_code: typeof Schema.String;
+    }>, Schema.Struct<{
+        success: Schema.Literal<[true]>;
+    }>>;
+    readonly oauthRevoke: import("../endpoint.js").Endpoint<"POST", "/oauth/revoke", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        token: typeof Schema.String;
+        token_type_hint: Schema.optional<Schema.Literal<["access_token", "refresh_token"]>>;
+        client_id: typeof Schema.String;
+        client_secret: Schema.optional<typeof Schema.String>;
+    }>, Schema.Struct<{}>>;
+    readonly oauthIntrospect: import("../endpoint.js").Endpoint<"POST", "/oauth/introspect", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        token: typeof Schema.String;
+        token_type_hint: Schema.optional<Schema.Literal<["access_token", "refresh_token"]>>;
+        client_id: typeof Schema.String;
+        client_secret: Schema.optional<typeof Schema.String>;
+    }>, Schema.Struct<{
+        active: typeof Schema.Boolean;
+        scope: Schema.optional<typeof Schema.String>;
+        client_id: Schema.optional<typeof Schema.String>;
+        username: Schema.optional<typeof Schema.String>;
+        token_type: Schema.optional<Schema.Literal<["Bearer"]>>;
+        exp: Schema.optional<typeof Schema.Number>;
+        iat: Schema.optional<typeof Schema.Number>;
+        nbf: Schema.optional<typeof Schema.Number>;
+        sub: Schema.optional<typeof Schema.String>;
+        aud: Schema.optional<Schema.Union<[typeof Schema.String, Schema.Array$<typeof Schema.String>]>>;
+        iss: Schema.optional<typeof Schema.String>;
+        jti: Schema.optional<typeof Schema.String>;
+    }>>;
+    readonly platformSessionsList: import("../endpoint.js").Endpoint<"GET", "/auth/platform-sessions", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        sessions: Schema.Array$<Schema.Struct<{
+            id: typeof Schema.String;
+            name: Schema.NullOr<typeof Schema.String>;
+            ipAddress: Schema.NullOr<typeof Schema.String>;
+            userAgent: Schema.NullOr<typeof Schema.String>;
+            createdAt: typeof Schema.String;
+            lastActiveAt: Schema.NullOr<typeof Schema.String>;
+            isCurrent: typeof Schema.Boolean;
+        }>>;
+    }>>;
+    readonly platformSessionsRevoke: import("../endpoint.js").Endpoint<"POST", "/auth/platform-sessions/revoke", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        sessionId: typeof Schema.String;
+    }>, Schema.Struct<{
+        success: Schema.Literal<[true]>;
+    }>>;
+    readonly platformSessionsRevokeOther: import("../endpoint.js").Endpoint<"POST", "/auth/platform-sessions/revoke-other", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        revokedCount: typeof Schema.Number;
+    }>>;
+    readonly platformSessionsRevokeAll: import("../endpoint.js").Endpoint<"POST", "/auth/platform-sessions/revoke-all", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        success: Schema.Literal<[true]>;
+        count: typeof Schema.Number;
+    }>>;
+    readonly platformSessionsRename: import("../endpoint.js").Endpoint<"POST", "/auth/platform-sessions/rename", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        sessionId: typeof Schema.String;
+        name: typeof Schema.String;
+    }>, Schema.Struct<{
+        success: Schema.Literal<[true]>;
+    }>>;
+    readonly platformPasswordStatus: import("../endpoint.js").Endpoint<"GET", "/auth/platform-password/status", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        hasPassword: typeof Schema.Boolean;
+    }>>;
+    readonly platformPasswordSet: import("../endpoint.js").Endpoint<"POST", "/auth/platform-password/set", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        password: typeof Schema.String;
+    }>, Schema.Struct<{
+        success: Schema.Literal<[true]>;
+    }>>;
+    readonly platformPasswordChange: import("../endpoint.js").Endpoint<"POST", "/auth/platform-password/change", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        currentPassword: typeof Schema.String;
+        newPassword: typeof Schema.String;
+    }>, Schema.Struct<{
+        success: Schema.Literal<[true]>;
+    }>>;
+    readonly platformUserExport: import("../endpoint.js").Endpoint<"GET", "/auth/platform-user/export", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Record$<typeof Schema.String, typeof Schema.Unknown>>;
+    readonly platformUserDelete: import("../endpoint.js").Endpoint<"DELETE", "/auth/platform-user/account", Schema.Schema.AnyNoContext | undefined, Schema.Schema.AnyNoContext | undefined, Schema.Struct<{
+        reason: Schema.optional<typeof Schema.String>;
+    }>, Schema.Struct<{
+        success: typeof Schema.Boolean;
+        deletedData: Schema.Array$<typeof Schema.String>;
+    }>>;
+};
+//# sourceMappingURL=auth.d.ts.map

package/dist/endpoints/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/endpoints/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAoC/B,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyMhB,CAAA"}