@sylphx/contract 0.2.0

package/dist/schemas/admin-env-services.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Admin Env-Services — operator recovery schemas (OPS-4).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/env-services.ts`.
+ * Replaces the manual `UPDATE environment_services …` from
+ * `docs/how-to/customer-image-gc-outreach.md` (line 169) with a
+ * structured admin endpoint that flows through the deployments pointer
+ * chain (`env_services.desired_deployment_id → deployments.artifact_id →
+ * artifacts.image_digest` per ADR-070 Phase D).
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:envservices:repoint`).
+ */
+import { Schema } from 'effect';
+/**
+ * Body of `POST /admin/env-services/repoint`.
+ *
+ *   - `envId`   — target environment (`env_*` TypeID).
+ *   - `service` — service name within the project. The route resolves
+ *                  the env_service row via `(envId, serviceId)` where
+ *                  `serviceId` comes from `(projects, project_services)`.
+ *   - `digest`  — `sha256:<64hex>` to repoint to. The artifact MUST
+ *                  already exist for this service (the endpoint refuses
+ *                  with 404 otherwise — repoint never minted artifacts).
+ *   - `reason`  — required. Audit narrative. Min 3 chars.
+ *
+ * Side effect: writes one `deployments` row with `source='manual_promote'`
+ * (or reuses the most recent existing row for the same `(env_service,
+ * artifact)` pair to keep the pointer chain idempotent) and sets
+ * `environment_services.desired_deployment_id` to it. The reconciler
+ * picks up the change on the next tick.
+ */
+export declare const AdminEnvServiceRepointInput: Schema.Struct<{
+    envId: Schema.filter<typeof Schema.String>;
+    service: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    digest: Schema.filter<typeof Schema.String>;
+    reason: Schema.filter<Schema.filter<typeof Schema.String>>;
+}>;
+export type AdminEnvServiceRepointInput = typeof AdminEnvServiceRepointInput.Type;
+/**
+ * Response envelope.
+ *
+ *   - `envServiceId`   — TypeID (`esvc_*`) of the env_service that was
+ *                         re-pointed.
+ *   - `previousDigest` — image digest the env_service was previously
+ *                         pointing to. `null` when there was no prior
+ *                         desired deployment (initial-state edge case).
+ *   - `newDigest`      — echo of the request flag.
+ *   - `deploymentId`   — TypeID (`dpl_*`) of the deployments row that
+ *                         carries the new pointer (newly inserted OR
+ *                         reused).
+ *   - `reused`         — `true` iff the endpoint reused an existing
+ *                         deployments row instead of inserting a new one.
+ */
+export declare const AdminEnvServiceRepointResult: Schema.Struct<{
+    envServiceId: typeof Schema.String;
+    previousDigest: Schema.NullOr<typeof Schema.String>;
+    newDigest: typeof Schema.String;
+    deploymentId: typeof Schema.String;
+    reused: typeof Schema.Boolean;
+}>;
+export type AdminEnvServiceRepointResult = typeof AdminEnvServiceRepointResult.Type;
+//# sourceMappingURL=admin-env-services.d.ts.map

package/dist/schemas/admin-env-services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-env-services.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-env-services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAmC/B;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,2BAA2B;;;;;EAKtC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,4BAA4B;;;;;;EAMvC,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-env-services.js

@@ -0,0 +1,81 @@
+/**
+ * Admin Env-Services — operator recovery schemas (OPS-4).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/env-services.ts`.
+ * Replaces the manual `UPDATE environment_services …` from
+ * `docs/how-to/customer-image-gc-outreach.md` (line 169) with a
+ * structured admin endpoint that flows through the deployments pointer
+ * chain (`env_services.desired_deployment_id → deployments.artifact_id →
+ * artifacts.image_digest` per ADR-070 Phase D).
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:envservices:repoint`).
+ */
+import { Schema } from 'effect';
+const Reason = Schema.String.pipe(Schema.minLength(3), Schema.maxLength(500));
+const ImageDigest = Schema.String.pipe(Schema.pattern(/^sha256:[a-f0-9]{64}$/, {
+    message: () => 'digest must match ^sha256:[a-f0-9]{64}$',
+}));
+/**
+ * TypeID for the target environment (`env_*`).
+ *
+ * The route file decodes this to a UUID; we keep the validator strict so
+ * the audit row carries a TypeID and accidental raw-UUID inputs surface
+ * as 400.
+ */
+const EnvId = Schema.String.pipe(Schema.pattern(/^env_[0-9a-z]{20,30}$/i, {
+    message: () => 'envId must be a TypeID with prefix `env_`',
+}));
+/**
+ * Service name within the project (`project_services.name`). Matches
+ * the existing service-name shape used everywhere else in the platform.
+ */
+const ServiceName = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(63), Schema.pattern(/^[a-z0-9][a-z0-9-]*[a-z0-9]$|^[a-z0-9]$/, {
+    message: () => 'service name must be lowercase alphanumeric / hyphen, length 1..63',
+}));
+/**
+ * Body of `POST /admin/env-services/repoint`.
+ *
+ *   - `envId`   — target environment (`env_*` TypeID).
+ *   - `service` — service name within the project. The route resolves
+ *                  the env_service row via `(envId, serviceId)` where
+ *                  `serviceId` comes from `(projects, project_services)`.
+ *   - `digest`  — `sha256:<64hex>` to repoint to. The artifact MUST
+ *                  already exist for this service (the endpoint refuses
+ *                  with 404 otherwise — repoint never minted artifacts).
+ *   - `reason`  — required. Audit narrative. Min 3 chars.
+ *
+ * Side effect: writes one `deployments` row with `source='manual_promote'`
+ * (or reuses the most recent existing row for the same `(env_service,
+ * artifact)` pair to keep the pointer chain idempotent) and sets
+ * `environment_services.desired_deployment_id` to it. The reconciler
+ * picks up the change on the next tick.
+ */
+export const AdminEnvServiceRepointInput = Schema.Struct({
+    envId: EnvId,
+    service: ServiceName,
+    digest: ImageDigest,
+    reason: Reason,
+});
+/**
+ * Response envelope.
+ *
+ *   - `envServiceId`   — TypeID (`esvc_*`) of the env_service that was
+ *                         re-pointed.
+ *   - `previousDigest` — image digest the env_service was previously
+ *                         pointing to. `null` when there was no prior
+ *                         desired deployment (initial-state edge case).
+ *   - `newDigest`      — echo of the request flag.
+ *   - `deploymentId`   — TypeID (`dpl_*`) of the deployments row that
+ *                         carries the new pointer (newly inserted OR
+ *                         reused).
+ *   - `reused`         — `true` iff the endpoint reused an existing
+ *                         deployments row instead of inserting a new one.
+ */
+export const AdminEnvServiceRepointResult = Schema.Struct({
+    envServiceId: Schema.String,
+    previousDigest: Schema.NullOr(Schema.String),
+    newDigest: Schema.String,
+    deploymentId: Schema.String,
+    reused: Schema.Boolean,
+});

package/dist/schemas/admin-impersonation.d.ts

@@ -0,0 +1,150 @@
+/**
+ * Admin Impersonation — schemas for admin user impersonation.
+ * Mirrors `/admin/impersonation/*`.
+ *
+ * Plane: `admin`.
+ */
+import { Schema } from 'effect';
+export declare const AdminStartImpersonationInput: Schema.Struct<{
+    targetUserId: typeof Schema.String;
+}>;
+export type AdminStartImpersonationInput = typeof AdminStartImpersonationInput.Type;
+export declare const AdminEndImpersonationInput: Schema.Struct<{
+    sessionId: Schema.optional<typeof Schema.String>;
+}>;
+export type AdminEndImpersonationInput = typeof AdminEndImpersonationInput.Type;
+export declare const AdminStartImpersonationResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    token: typeof Schema.String;
+    sessionId: typeof Schema.String;
+    expiresAt: typeof Schema.String;
+}>;
+export type AdminStartImpersonationResult = typeof AdminStartImpersonationResult.Type;
+export declare const AdminEndImpersonationResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    sessionsEnded: typeof Schema.Number;
+}>;
+export type AdminEndImpersonationResult = typeof AdminEndImpersonationResult.Type;
+/** Null when current session is not an impersonation. */
+export declare const AdminImpersonationInfoResult: Schema.NullOr<Schema.Struct<{
+    isImpersonation: typeof Schema.Boolean;
+    adminUserId: typeof Schema.String;
+    adminEmail: typeof Schema.String;
+    adminName: Schema.NullOr<typeof Schema.String>;
+    impersonatedAt: typeof Schema.String;
+}>>;
+export type AdminImpersonationInfoResult = typeof AdminImpersonationInfoResult.Type;
+export declare const AdminActiveImpersonation: Schema.Struct<{
+    sessionId: typeof Schema.String;
+    adminUserId: typeof Schema.String;
+    adminEmail: typeof Schema.String;
+    adminName: Schema.NullOr<typeof Schema.String>;
+    targetUserId: typeof Schema.String;
+    targetEmail: typeof Schema.String;
+    targetName: Schema.NullOr<typeof Schema.String>;
+    impersonatedAt: typeof Schema.String;
+    lastActiveAt: typeof Schema.String;
+}>;
+export type AdminActiveImpersonation = typeof AdminActiveImpersonation.Type;
+export declare const AdminListActiveImpersonationsResult: Schema.Array$<Schema.Struct<{
+    sessionId: typeof Schema.String;
+    adminUserId: typeof Schema.String;
+    adminEmail: typeof Schema.String;
+    adminName: Schema.NullOr<typeof Schema.String>;
+    targetUserId: typeof Schema.String;
+    targetEmail: typeof Schema.String;
+    targetName: Schema.NullOr<typeof Schema.String>;
+    impersonatedAt: typeof Schema.String;
+    lastActiveAt: typeof Schema.String;
+}>>;
+export type AdminListActiveImpersonationsResult = typeof AdminListActiveImpersonationsResult.Type;
+export declare const ImpersonationStartChallengeInput: Schema.Struct<{
+    targetUserId: typeof Schema.String;
+    reason: typeof Schema.String;
+}>;
+export type ImpersonationStartChallengeInput = typeof ImpersonationStartChallengeInput.Type;
+export declare const ImpersonationStartChallengeResult: Schema.Struct<{
+    requestId: typeof Schema.String;
+    challengeKey: typeof Schema.String;
+    webauthnOptions: Schema.Struct<{
+        challenge: typeof Schema.String;
+        rpId: Schema.optional<typeof Schema.String>;
+        allowCredentials: Schema.Array$<Schema.Struct<{
+            id: typeof Schema.String;
+            type: Schema.Literal<["public-key"]>;
+            transports: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        userVerification: Schema.Literal<["required"]>;
+        timeout: typeof Schema.Number;
+    }>;
+}>;
+export type ImpersonationStartChallengeResult = typeof ImpersonationStartChallengeResult.Type;
+export declare const ImpersonationStartInput: Schema.Struct<{
+    requestId: typeof Schema.String;
+    challengeKey: typeof Schema.String;
+    assertion: typeof Schema.Unknown;
+    emergencyBypass: Schema.optional<typeof Schema.Boolean>;
+}>;
+export type ImpersonationStartInput = typeof ImpersonationStartInput.Type;
+export declare const ImpersonationStartResult: Schema.Union<[Schema.Struct<{
+    branch: Schema.Literal<["emergency"]>;
+    requestId: typeof Schema.String;
+    token: typeof Schema.String;
+    sessionId: typeof Schema.String;
+    expiresAt: typeof Schema.String;
+}>, Schema.Struct<{
+    branch: Schema.Literal<["awaiting-consent"]>;
+    requestId: typeof Schema.String;
+    consentDeadline: typeof Schema.String;
+}>]>;
+export type ImpersonationStartResult = typeof ImpersonationStartResult.Type;
+export declare const ImpersonationConsentInput: Schema.Struct<{
+    decision: Schema.Literal<["approve", "deny"]>;
+}>;
+export type ImpersonationConsentInput = typeof ImpersonationConsentInput.Type;
+export declare const ImpersonationConsentResult: Schema.Union<[Schema.Struct<{
+    branch: Schema.Literal<["approved"]>;
+    requestId: typeof Schema.String;
+    token: typeof Schema.String;
+    sessionId: typeof Schema.String;
+    expiresAt: typeof Schema.String;
+}>, Schema.Struct<{
+    branch: Schema.Literal<["denied"]>;
+    requestId: typeof Schema.String;
+}>]>;
+export type ImpersonationConsentResult = typeof ImpersonationConsentResult.Type;
+export declare const ImpersonationRequestListItem: Schema.Struct<{
+    id: typeof Schema.String;
+    operatorId: typeof Schema.String;
+    targetUserId: typeof Schema.String;
+    reason: typeof Schema.String;
+    status: Schema.Literal<["awaiting-stepup", "awaiting-consent", "active", "denied", "expired", "ended", "revoked"]>;
+    emergencyBypass: typeof Schema.Boolean;
+    sessionId: Schema.NullOr<typeof Schema.String>;
+    consentDeadline: Schema.NullOr<typeof Schema.String>;
+    startedAt: Schema.NullOr<typeof Schema.String>;
+    endedAt: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+}>;
+export type ImpersonationRequestListItem = typeof ImpersonationRequestListItem.Type;
+export declare const ImpersonationRequestList: Schema.Array$<Schema.Struct<{
+    id: typeof Schema.String;
+    operatorId: typeof Schema.String;
+    targetUserId: typeof Schema.String;
+    reason: typeof Schema.String;
+    status: Schema.Literal<["awaiting-stepup", "awaiting-consent", "active", "denied", "expired", "ended", "revoked"]>;
+    emergencyBypass: typeof Schema.Boolean;
+    sessionId: Schema.NullOr<typeof Schema.String>;
+    consentDeadline: Schema.NullOr<typeof Schema.String>;
+    startedAt: Schema.NullOr<typeof Schema.String>;
+    endedAt: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+}>>;
+export type ImpersonationRequestList = typeof ImpersonationRequestList.Type;
+export declare const ImpersonationEndSessionResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    requestId: typeof Schema.String;
+    sessionId: Schema.NullOr<typeof Schema.String>;
+}>;
+export type ImpersonationEndSessionResult = typeof ImpersonationEndSessionResult.Type;
+//# sourceMappingURL=admin-impersonation.d.ts.map

package/dist/schemas/admin-impersonation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-impersonation.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-impersonation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,4BAA4B;;EAEvC,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAA;AAEnF,eAAO,MAAM,0BAA0B;;EAErC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,6BAA6B;;;;;EAKxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA;AAErF,eAAO,MAAM,2BAA2B;;;EAGtC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,yDAAyD;AACzD,eAAO,MAAM,4BAA4B;;;;;;GAQxC,CAAA;AACD,MAAM,MAAM,4BAA4B,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAA;AAEnF,eAAO,MAAM,wBAAwB;;;;;;;;;;EAUnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,mCAAmC;;;;;;;;;;GAAyC,CAAA;AACzF,MAAM,MAAM,mCAAmC,GAAG,OAAO,mCAAmC,CAAC,IAAI,CAAA;AAMjG,eAAO,MAAM,gCAAgC;;;EAG3C,CAAA;AACF,MAAM,MAAM,gCAAgC,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAA;AAE3F,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;EAgB5C,CAAA;AACF,MAAM,MAAM,iCAAiC,GAAG,OAAO,iCAAiC,CAAC,IAAI,CAAA;AAE7F,eAAO,MAAM,uBAAuB;;;;;EAKlC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,wBAAwB;;;;;;;;;;IAapC,CAAA;AACD,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,yBAAyB;;EAEpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAE7E,eAAO,MAAM,0BAA0B;;;;;;;;;IAYtC,CAAA;AACD,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,4BAA4B;;;;;;;;;;;;EAoBvC,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAA;AAEnF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;GAA6C,CAAA;AAClF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,6BAA6B;;;;EAIxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-impersonation.js

@@ -0,0 +1,114 @@
+/**
+ * Admin Impersonation — schemas for admin user impersonation.
+ * Mirrors `/admin/impersonation/*`.
+ *
+ * Plane: `admin`.
+ */
+import { Schema } from 'effect';
+export const AdminStartImpersonationInput = Schema.Struct({
+    targetUserId: Schema.String,
+});
+export const AdminEndImpersonationInput = Schema.Struct({
+    sessionId: Schema.optional(Schema.String),
+});
+export const AdminStartImpersonationResult = Schema.Struct({
+    success: Schema.Boolean,
+    token: Schema.String,
+    sessionId: Schema.String,
+    expiresAt: Schema.String,
+});
+export const AdminEndImpersonationResult = Schema.Struct({
+    success: Schema.Boolean,
+    sessionsEnded: Schema.Number,
+});
+/** Null when current session is not an impersonation. */
+export const AdminImpersonationInfoResult = Schema.NullOr(Schema.Struct({
+    isImpersonation: Schema.Boolean,
+    adminUserId: Schema.String,
+    adminEmail: Schema.String,
+    adminName: Schema.NullOr(Schema.String),
+    impersonatedAt: Schema.String,
+}));
+export const AdminActiveImpersonation = Schema.Struct({
+    sessionId: Schema.String,
+    adminUserId: Schema.String,
+    adminEmail: Schema.String,
+    adminName: Schema.NullOr(Schema.String),
+    targetUserId: Schema.String,
+    targetEmail: Schema.String,
+    targetName: Schema.NullOr(Schema.String),
+    impersonatedAt: Schema.String,
+    lastActiveAt: Schema.String,
+});
+export const AdminListActiveImpersonationsResult = Schema.Array(AdminActiveImpersonation);
+// ============================================================================
+// Phase 5.9 — WebAuthn step-up + consent workflow
+// ============================================================================
+export const ImpersonationStartChallengeInput = Schema.Struct({
+    targetUserId: Schema.String,
+    reason: Schema.String,
+});
+export const ImpersonationStartChallengeResult = Schema.Struct({
+    requestId: Schema.String,
+    challengeKey: Schema.String,
+    webauthnOptions: Schema.Struct({
+        challenge: Schema.String,
+        rpId: Schema.optional(Schema.String),
+        allowCredentials: Schema.Array(Schema.Struct({
+            id: Schema.String,
+            type: Schema.Literal('public-key'),
+            transports: Schema.optional(Schema.Array(Schema.String)),
+        })),
+        userVerification: Schema.Literal('required'),
+        timeout: Schema.Number,
+    }),
+});
+export const ImpersonationStartInput = Schema.Struct({
+    requestId: Schema.String,
+    challengeKey: Schema.String,
+    assertion: Schema.Unknown,
+    emergencyBypass: Schema.optional(Schema.Boolean),
+});
+export const ImpersonationStartResult = Schema.Union(Schema.Struct({
+    branch: Schema.Literal('emergency'),
+    requestId: Schema.String,
+    token: Schema.String,
+    sessionId: Schema.String,
+    expiresAt: Schema.String,
+}), Schema.Struct({
+    branch: Schema.Literal('awaiting-consent'),
+    requestId: Schema.String,
+    consentDeadline: Schema.String,
+}));
+export const ImpersonationConsentInput = Schema.Struct({
+    decision: Schema.Literal('approve', 'deny'),
+});
+export const ImpersonationConsentResult = Schema.Union(Schema.Struct({
+    branch: Schema.Literal('approved'),
+    requestId: Schema.String,
+    token: Schema.String,
+    sessionId: Schema.String,
+    expiresAt: Schema.String,
+}), Schema.Struct({
+    branch: Schema.Literal('denied'),
+    requestId: Schema.String,
+}));
+export const ImpersonationRequestListItem = Schema.Struct({
+    id: Schema.String,
+    operatorId: Schema.String,
+    targetUserId: Schema.String,
+    reason: Schema.String,
+    status: Schema.Literal('awaiting-stepup', 'awaiting-consent', 'active', 'denied', 'expired', 'ended', 'revoked'),
+    emergencyBypass: Schema.Boolean,
+    sessionId: Schema.NullOr(Schema.String),
+    consentDeadline: Schema.NullOr(Schema.String),
+    startedAt: Schema.NullOr(Schema.String),
+    endedAt: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+});
+export const ImpersonationRequestList = Schema.Array(ImpersonationRequestListItem);
+export const ImpersonationEndSessionResult = Schema.Struct({
+    success: Schema.Boolean,
+    requestId: Schema.String,
+    sessionId: Schema.NullOr(Schema.String),
+});

package/dist/schemas/admin-invitations.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Admin Invitations — schemas for platform team invitation management.
+ * Mirrors `/admin/invitations/*`.
+ *
+ * Plane: `admin`. `/accept` is a public endpoint (no auth) but lives under
+ * the admin mount for routing consistency.
+ */
+import { Schema } from 'effect';
+export declare const AdminInvitationRole: Schema.Literal<["user", "admin", "super_admin"]>;
+export type AdminInvitationRole = typeof AdminInvitationRole.Type;
+export declare const AdminInvitationStatus: Schema.Literal<["pending", "accepted", "revoked", "expired"]>;
+export type AdminInvitationStatus = typeof AdminInvitationStatus.Type;
+export declare const AdminInvitedBy: Schema.Struct<{
+    id: typeof Schema.String;
+    name: Schema.NullOr<typeof Schema.String>;
+    email: typeof Schema.String;
+}>;
+export type AdminInvitedBy = typeof AdminInvitedBy.Type;
+export declare const AdminInvitation: Schema.Struct<{
+    id: typeof Schema.String;
+    email: typeof Schema.String;
+    code: typeof Schema.String;
+    role: Schema.Literal<["user", "admin", "super_admin"]>;
+    status: Schema.Literal<["pending", "accepted", "revoked", "expired"]>;
+    expiresAt: typeof Schema.String;
+    acceptedAt: Schema.NullOr<typeof Schema.String>;
+    note: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+    invitedBy: Schema.NullOr<Schema.Struct<{
+        id: typeof Schema.String;
+        name: Schema.NullOr<typeof Schema.String>;
+        email: typeof Schema.String;
+    }>>;
+}>;
+export type AdminInvitation = typeof AdminInvitation.Type;
+export declare const AdminAcceptedUser: Schema.Struct<{
+    id: typeof Schema.String;
+    email: typeof Schema.String;
+    name: Schema.NullOr<typeof Schema.String>;
+    role: Schema.Literal<["user", "admin", "super_admin"]>;
+}>;
+export type AdminAcceptedUser = typeof AdminAcceptedUser.Type;
+export declare const AdminInvitationIdParams: Schema.Struct<{
+    id: typeof Schema.String;
+}>;
+export type AdminInvitationIdParams = typeof AdminInvitationIdParams.Type;
+export declare const AdminListInvitationsQuery: Schema.Struct<{
+    limit: Schema.optional<typeof Schema.String>;
+    offset: Schema.optional<typeof Schema.String>;
+    statsOnly: Schema.optional<typeof Schema.String>;
+}>;
+export type AdminListInvitationsQuery = typeof AdminListInvitationsQuery.Type;
+export declare const AdminCreateInvitationInput: Schema.Struct<{
+    email: typeof Schema.String;
+    role: Schema.optional<Schema.Literal<["user", "admin", "super_admin"]>>;
+    note: Schema.optional<typeof Schema.String>;
+}>;
+export type AdminCreateInvitationInput = typeof AdminCreateInvitationInput.Type;
+export declare const AdminAcceptInvitationInput: Schema.Struct<{
+    code: typeof Schema.String;
+    name: typeof Schema.String;
+    password: typeof Schema.String;
+}>;
+export type AdminAcceptInvitationInput = typeof AdminAcceptInvitationInput.Type;
+export declare const AdminCreateInvitationResult: Schema.Struct<{
+    id: typeof Schema.String;
+    email: typeof Schema.String;
+    role: Schema.Literal<["user", "admin", "super_admin"]>;
+    inviteUrl: typeof Schema.String;
+    expiresAt: typeof Schema.String;
+}>;
+export type AdminCreateInvitationResult = typeof AdminCreateInvitationResult.Type;
+/** Union: list shape OR stats-only shape. */
+export declare const AdminListInvitationsResult: Schema.Union<[Schema.Struct<{
+    invitations: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        email: typeof Schema.String;
+        code: typeof Schema.String;
+        role: Schema.Literal<["user", "admin", "super_admin"]>;
+        status: Schema.Literal<["pending", "accepted", "revoked", "expired"]>;
+        expiresAt: typeof Schema.String;
+        acceptedAt: Schema.NullOr<typeof Schema.String>;
+        note: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        invitedBy: Schema.NullOr<Schema.Struct<{
+            id: typeof Schema.String;
+            name: Schema.NullOr<typeof Schema.String>;
+            email: typeof Schema.String;
+        }>>;
+    }>>;
+    total: typeof Schema.Number;
+}>, Schema.Struct<{
+    totalMembers: typeof Schema.Number;
+    pendingInvites: typeof Schema.Number;
+    acceptedInvites: typeof Schema.Number;
+}>]>;
+export type AdminListInvitationsResult = typeof AdminListInvitationsResult.Type;
+export declare const AdminRevokeInvitationResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+}>;
+export type AdminRevokeInvitationResult = typeof AdminRevokeInvitationResult.Type;
+export declare const AdminResendInvitationResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    inviteUrl: typeof Schema.String;
+    expiresAt: typeof Schema.String;
+}>;
+export type AdminResendInvitationResult = typeof AdminResendInvitationResult.Type;
+export declare const AdminAcceptInvitationResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    message: typeof Schema.String;
+    user: Schema.Struct<{
+        id: typeof Schema.String;
+        email: typeof Schema.String;
+        name: Schema.NullOr<typeof Schema.String>;
+        role: Schema.Literal<["user", "admin", "super_admin"]>;
+    }>;
+}>;
+export type AdminAcceptInvitationResult = typeof AdminAcceptInvitationResult.Type;
+//# sourceMappingURL=admin-invitations.d.ts.map

package/dist/schemas/admin-invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-invitations.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-invitations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,mBAAmB,kDAAiD,CAAA;AACjF,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE,eAAO,MAAM,qBAAqB,+DAA8D,CAAA;AAChG,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,cAAc;;;;EAIzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;EAW1B,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD,eAAO,MAAM,iBAAiB;;;;;EAK5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAI7D,eAAO,MAAM,uBAAuB;;EAAuC,CAAA;AAC3E,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAIzE,eAAO,MAAM,yBAAyB;;;;EAIpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAI7E,eAAO,MAAM,0BAA0B;;;;EAIrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,0BAA0B;;;;EAIrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAI/E,eAAO,MAAM,2BAA2B;;;;;;EAMtC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,6CAA6C;AAC7C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;IAUtC,CAAA;AACD,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,2BAA2B;;EAA6C,CAAA;AACrF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,eAAO,MAAM,2BAA2B;;;;EAItC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,eAAO,MAAM,2BAA2B;;;;;;;;;EAItC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-invitations.js

@@ -0,0 +1,80 @@
+/**
+ * Admin Invitations — schemas for platform team invitation management.
+ * Mirrors `/admin/invitations/*`.
+ *
+ * Plane: `admin`. `/accept` is a public endpoint (no auth) but lives under
+ * the admin mount for routing consistency.
+ */
+import { Schema } from 'effect';
+export const AdminInvitationRole = Schema.Literal('user', 'admin', 'super_admin');
+export const AdminInvitationStatus = Schema.Literal('pending', 'accepted', 'revoked', 'expired');
+export const AdminInvitedBy = Schema.Struct({
+    id: Schema.String,
+    name: Schema.NullOr(Schema.String),
+    email: Schema.String,
+});
+export const AdminInvitation = Schema.Struct({
+    id: Schema.String,
+    email: Schema.String,
+    code: Schema.String,
+    role: AdminInvitationRole,
+    status: AdminInvitationStatus,
+    expiresAt: Schema.String,
+    acceptedAt: Schema.NullOr(Schema.String),
+    note: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+    invitedBy: Schema.NullOr(AdminInvitedBy),
+});
+export const AdminAcceptedUser = Schema.Struct({
+    id: Schema.String,
+    email: Schema.String,
+    name: Schema.NullOr(Schema.String),
+    role: AdminInvitationRole,
+});
+// ── Params ─────────────────────────────────────────────────────────────────
+export const AdminInvitationIdParams = Schema.Struct({ id: Schema.String });
+// ── Query ──────────────────────────────────────────────────────────────────
+export const AdminListInvitationsQuery = Schema.Struct({
+    limit: Schema.optional(Schema.String),
+    offset: Schema.optional(Schema.String),
+    statsOnly: Schema.optional(Schema.String),
+});
+// ── Inputs ─────────────────────────────────────────────────────────────────
+export const AdminCreateInvitationInput = Schema.Struct({
+    email: Schema.String,
+    role: Schema.optional(AdminInvitationRole),
+    note: Schema.optional(Schema.String),
+});
+export const AdminAcceptInvitationInput = Schema.Struct({
+    code: Schema.String,
+    name: Schema.String,
+    password: Schema.String,
+});
+// ── Responses ──────────────────────────────────────────────────────────────
+export const AdminCreateInvitationResult = Schema.Struct({
+    id: Schema.String,
+    email: Schema.String,
+    role: AdminInvitationRole,
+    inviteUrl: Schema.String,
+    expiresAt: Schema.String,
+});
+/** Union: list shape OR stats-only shape. */
+export const AdminListInvitationsResult = Schema.Union(Schema.Struct({
+    invitations: Schema.Array(AdminInvitation),
+    total: Schema.Number,
+}), Schema.Struct({
+    totalMembers: Schema.Number,
+    pendingInvites: Schema.Number,
+    acceptedInvites: Schema.Number,
+}));
+export const AdminRevokeInvitationResult = Schema.Struct({ success: Schema.Boolean });
+export const AdminResendInvitationResult = Schema.Struct({
+    success: Schema.Boolean,
+    inviteUrl: Schema.String,
+    expiresAt: Schema.String,
+});
+export const AdminAcceptInvitationResult = Schema.Struct({
+    success: Schema.Boolean,
+    message: Schema.String,
+    user: AdminAcceptedUser,
+});