@sylphx/contract 0.2.0

package/dist/endpoints/service-tokens.d.ts

@@ -0,0 +1,392 @@
+/**
+ * Service Tokens + Service Token Requests endpoints — ADR-059 §3 / §6.
+ * Mirrors `apps/api/src/server/platform/routes/service-tokens.ts` and
+ * `…/service-token-requests.ts`.
+ *
+ * Production mount: `/orgs/*` (both sub-routers share the prefix).
+ */
+export declare const serviceTokensEndpoints: {
+    readonly create: import("../endpoint.js").Endpoint<"POST", "/orgs/:orgId/service-tokens", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        name: typeof import("effect/Schema").String;
+        scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+        projectId: import("effect/Schema").optional<import("effect/Schema").NullOr<typeof import("effect/Schema").String>>;
+        environmentId: import("effect/Schema").optional<import("effect/Schema").NullOr<typeof import("effect/Schema").String>>;
+        resourceScope: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+            orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+        }>>>;
+        ipAllowlist: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>>;
+        expiresInDays: import("effect/Schema").optional<import("effect/Schema").NullOr<typeof import("effect/Schema").Number>>;
+    }>, import("effect/Schema").Struct<{
+        token: typeof import("effect/Schema").String;
+        view: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            name: typeof import("effect/Schema").String;
+            tokenPrefix: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            scopes: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            createdBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            expiresAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUsedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            useCount: typeof import("effect/Schema").Number;
+        }>;
+    }>>;
+    readonly list: import("../endpoint.js").Endpoint<"GET", "/orgs/:orgId/service-tokens", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        includeRevoked: import("effect/Schema").optional<import("effect/Schema").Literal<["true", "false"]>>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        tokens: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            name: typeof import("effect/Schema").String;
+            tokenPrefix: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            scopes: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            createdBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            expiresAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUsedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            useCount: typeof import("effect/Schema").Number;
+        }>>;
+    }>>;
+    readonly get: import("../endpoint.js").Endpoint<"GET", "/orgs/:orgId/service-tokens/:tokenId", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        tokenId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        view: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            name: typeof import("effect/Schema").String;
+            tokenPrefix: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            scopes: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            createdBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            expiresAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUsedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            useCount: typeof import("effect/Schema").Number;
+        }>;
+    }>>;
+    readonly revoke: import("../endpoint.js").Endpoint<"DELETE", "/orgs/:orgId/service-tokens/:tokenId", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        tokenId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        view: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            name: typeof import("effect/Schema").String;
+            tokenPrefix: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            scopes: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            createdBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            expiresAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUsedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            useCount: typeof import("effect/Schema").Number;
+        }>;
+    }>>;
+    readonly rotate: import("../endpoint.js").Endpoint<"POST", "/orgs/:orgId/service-tokens/:tokenId/rotate", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        tokenId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        token: typeof import("effect/Schema").String;
+        oldView: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            name: typeof import("effect/Schema").String;
+            tokenPrefix: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            scopes: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            createdBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            expiresAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUsedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            useCount: typeof import("effect/Schema").Number;
+        }>;
+        newView: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            name: typeof import("effect/Schema").String;
+            tokenPrefix: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            scopes: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            createdBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            expiresAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUsedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            revokedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            useCount: typeof import("effect/Schema").Number;
+        }>;
+    }>>;
+};
+export declare const serviceTokenRequestsEndpoints: {
+    readonly submit: import("../endpoint.js").Endpoint<"POST", "/orgs/:orgId/service-token-requests", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        name: typeof import("effect/Schema").String;
+        scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+        projectId: import("effect/Schema").optional<import("effect/Schema").NullOr<typeof import("effect/Schema").String>>;
+        environmentId: import("effect/Schema").optional<import("effect/Schema").NullOr<typeof import("effect/Schema").String>>;
+        resourceScope: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+            orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+        }>>>;
+        ipAllowlist: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>>;
+        expiresInDays: import("effect/Schema").optional<import("effect/Schema").NullOr<typeof import("effect/Schema").Number>>;
+    }>, import("effect/Schema").Struct<{
+        request: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            requestedBy: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+            tokenName: typeof import("effect/Schema").String;
+            scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            expiresInDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            approvedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            approvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            deniedReason: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            mintedTokenId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            updatedAt: typeof import("effect/Schema").String;
+        }>;
+    }>>;
+    readonly list: import("../endpoint.js").Endpoint<"GET", "/orgs/:orgId/service-token-requests", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        requests: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            requestedBy: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+            tokenName: typeof import("effect/Schema").String;
+            scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            expiresInDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            approvedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            approvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            deniedReason: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            mintedTokenId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            updatedAt: typeof import("effect/Schema").String;
+        }>>;
+    }>>;
+    readonly get: import("../endpoint.js").Endpoint<"GET", "/orgs/:orgId/service-token-requests/:id", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        id: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        request: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            requestedBy: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+            tokenName: typeof import("effect/Schema").String;
+            scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            expiresInDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            approvedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            approvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            deniedReason: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            mintedTokenId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            updatedAt: typeof import("effect/Schema").String;
+        }>;
+    }>>;
+    readonly approve: import("../endpoint.js").Endpoint<"POST", "/orgs/:orgId/service-token-requests/:id/approve", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        id: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        request: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            requestedBy: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+            tokenName: typeof import("effect/Schema").String;
+            scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            expiresInDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            approvedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            approvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            deniedReason: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            mintedTokenId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            updatedAt: typeof import("effect/Schema").String;
+        }>;
+    }>>;
+    readonly deny: import("../endpoint.js").Endpoint<"POST", "/orgs/:orgId/service-token-requests/:id/deny", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        id: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        reason: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        request: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            requestedBy: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+            tokenName: typeof import("effect/Schema").String;
+            scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            expiresInDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            approvedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            approvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            deniedReason: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            mintedTokenId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            updatedAt: typeof import("effect/Schema").String;
+        }>;
+    }>>;
+    readonly cancel: import("../endpoint.js").Endpoint<"POST", "/orgs/:orgId/service-token-requests/:id/cancel", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        id: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        request: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            requestedBy: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+            tokenName: typeof import("effect/Schema").String;
+            scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            expiresInDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            approvedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            approvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            deniedReason: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            mintedTokenId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            updatedAt: typeof import("effect/Schema").String;
+        }>;
+    }>>;
+    readonly mint: import("../endpoint.js").Endpoint<"POST", "/orgs/:orgId/service-token-requests/:id/mint", import("effect/Schema").Struct<{
+        orgId: typeof import("effect/Schema").String;
+        id: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        token: typeof import("effect/Schema").String;
+        request: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            orgId: typeof import("effect/Schema").String;
+            requestedBy: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+            tokenName: typeof import("effect/Schema").String;
+            scopes: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+            projectId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            environmentId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            resourceScope: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                orgId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+                envIds: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            ipAllowlist: import("effect/Schema").NullOr<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            expiresInDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            approvedBy: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            approvedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            deniedReason: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            mintedTokenId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            updatedAt: typeof import("effect/Schema").String;
+        }>;
+    }>>;
+};
+//# sourceMappingURL=service-tokens.d.ts.map

package/dist/endpoints/service-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-tokens.d.ts","sourceRoot":"","sources":["../../src/endpoints/service-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqBH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgDzB,CAAA;AAEV,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkEhC,CAAA"}

package/dist/endpoints/service-tokens.js

@@ -0,0 +1,125 @@
+/**
+ * Service Tokens + Service Token Requests endpoints — ADR-059 §3 / §6.
+ * Mirrors `apps/api/src/server/platform/routes/service-tokens.ts` and
+ * `…/service-token-requests.ts`.
+ *
+ * Production mount: `/orgs/*` (both sub-routers share the prefix).
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { CreateServiceTokenInput, CreateServiceTokenResult, DenyServiceTokenRequestInput, GetServiceTokenResult, ListServiceTokenRequestsResult, ListServiceTokensQuery, ListServiceTokensResult, MintServiceTokenRequestResult, OrgIdParams, OrgRequestIdParams, OrgTokenIdParams, RevokeServiceTokenResult, RotateServiceTokenResult, ServiceTokenRequestResult, SubmitServiceTokenRequestInput, } from '../schemas/service-tokens.js';
+export const serviceTokensEndpoints = {
+    create: defineEndpoint({
+        method: 'POST',
+        path: '/orgs/:orgId/service-tokens',
+        params: OrgIdParams,
+        body: CreateServiceTokenInput,
+        response: CreateServiceTokenResult,
+        plane: 'management',
+        summary: 'Create a service token (plaintext returned once)',
+        tags: ['service-tokens'],
+    }),
+    list: defineEndpoint({
+        method: 'GET',
+        path: '/orgs/:orgId/service-tokens',
+        params: OrgIdParams,
+        query: ListServiceTokensQuery,
+        response: ListServiceTokensResult,
+        plane: 'management',
+        summary: 'List service tokens',
+        tags: ['service-tokens'],
+    }),
+    get: defineEndpoint({
+        method: 'GET',
+        path: '/orgs/:orgId/service-tokens/:tokenId',
+        params: OrgTokenIdParams,
+        response: GetServiceTokenResult,
+        plane: 'management',
+        summary: 'Get a service token by ID',
+        tags: ['service-tokens'],
+    }),
+    revoke: defineEndpoint({
+        method: 'DELETE',
+        path: '/orgs/:orgId/service-tokens/:tokenId',
+        params: OrgTokenIdParams,
+        response: RevokeServiceTokenResult,
+        plane: 'management',
+        summary: 'Revoke a service token',
+        tags: ['service-tokens'],
+    }),
+    rotate: defineEndpoint({
+        method: 'POST',
+        path: '/orgs/:orgId/service-tokens/:tokenId/rotate',
+        params: OrgTokenIdParams,
+        response: RotateServiceTokenResult,
+        plane: 'management',
+        summary: 'Rotate a service token (revoke old, issue new)',
+        tags: ['service-tokens'],
+    }),
+};
+export const serviceTokenRequestsEndpoints = {
+    submit: defineEndpoint({
+        method: 'POST',
+        path: '/orgs/:orgId/service-token-requests',
+        params: OrgIdParams,
+        body: SubmitServiceTokenRequestInput,
+        response: ServiceTokenRequestResult,
+        plane: 'management',
+        summary: 'Submit a two-person-rule service-token request',
+        tags: ['service-tokens'],
+    }),
+    list: defineEndpoint({
+        method: 'GET',
+        path: '/orgs/:orgId/service-token-requests',
+        params: OrgIdParams,
+        response: ListServiceTokenRequestsResult,
+        plane: 'management',
+        summary: 'List service-token requests',
+        tags: ['service-tokens'],
+    }),
+    get: defineEndpoint({
+        method: 'GET',
+        path: '/orgs/:orgId/service-token-requests/:id',
+        params: OrgRequestIdParams,
+        response: ServiceTokenRequestResult,
+        plane: 'management',
+        summary: 'Get a service-token request by ID',
+        tags: ['service-tokens'],
+    }),
+    approve: defineEndpoint({
+        method: 'POST',
+        path: '/orgs/:orgId/service-token-requests/:id/approve',
+        params: OrgRequestIdParams,
+        response: ServiceTokenRequestResult,
+        plane: 'management',
+        summary: 'Approve a pending service-token request',
+        tags: ['service-tokens'],
+    }),
+    deny: defineEndpoint({
+        method: 'POST',
+        path: '/orgs/:orgId/service-token-requests/:id/deny',
+        params: OrgRequestIdParams,
+        body: DenyServiceTokenRequestInput,
+        response: ServiceTokenRequestResult,
+        plane: 'management',
+        summary: 'Deny a pending service-token request',
+        tags: ['service-tokens'],
+    }),
+    cancel: defineEndpoint({
+        method: 'POST',
+        path: '/orgs/:orgId/service-token-requests/:id/cancel',
+        params: OrgRequestIdParams,
+        response: ServiceTokenRequestResult,
+        plane: 'management',
+        summary: 'Cancel a pending service-token request (requester only)',
+        tags: ['service-tokens'],
+    }),
+    mint: defineEndpoint({
+        method: 'POST',
+        path: '/orgs/:orgId/service-token-requests/:id/mint',
+        params: OrgRequestIdParams,
+        response: MintServiceTokenRequestResult,
+        plane: 'management',
+        summary: 'Mint the approved service token',
+        tags: ['service-tokens'],
+    }),
+};