@sylphx/contract 0.2.0

package/dist/schemas/admin-quotas.d.ts

@@ -0,0 +1,161 @@
+/**
+ * Admin Quotas — internal operator console schemas for quota management.
+ * Mirrors `/admin/quotas/*` in `apps/api/src/server/platform/routes/admin/quotas.ts`.
+ *
+ * Plane: `admin`.
+ *
+ * Note — `service` is typed as `Schema.String` here because the billable
+ * service enum is the Drizzle enum SSOT in `core`; keeping it string-shaped
+ * avoids a cross-package enum sync every time a new service is added.
+ */
+import { Schema } from 'effect';
+export declare const AdminBillableService: typeof Schema.String;
+export type AdminBillableService = typeof AdminBillableService.Type;
+export declare const AdminQuotaEnforcement: Schema.Literal<["hard", "soft", "none"]>;
+export type AdminQuotaEnforcement = typeof AdminQuotaEnforcement.Type;
+export declare const AdminQuotaStatus: Schema.Literal<["ok", "warning", "critical", "exceeded"]>;
+export type AdminQuotaStatus = typeof AdminQuotaStatus.Type;
+export declare const AdminOverallQuotaStatus: Schema.Literal<["ok", "warning", "critical", "exceeded", "blocked"]>;
+export type AdminOverallQuotaStatus = typeof AdminOverallQuotaStatus.Type;
+export declare const AdminQuotaPeriod: Schema.Literal<["hourly", "daily", "monthly", "unlimited"]>;
+export type AdminQuotaPeriod = typeof AdminQuotaPeriod.Type;
+export declare const AdminQuotaAlertLevel: Schema.Literal<["warning", "critical", "exceeded"]>;
+export type AdminQuotaAlertLevel = typeof AdminQuotaAlertLevel.Type;
+export declare const AdminQuotaItem: Schema.Struct<{
+    service: typeof Schema.String;
+    metric: typeof Schema.String;
+    currentUsage: typeof Schema.Number;
+    limit: typeof Schema.Number;
+    percentUsed: typeof Schema.Number;
+    enforcement: Schema.Literal<["hard", "soft", "none"]>;
+    period: Schema.Literal<["hourly", "daily", "monthly", "unlimited"]>;
+    status: Schema.Literal<["ok", "warning", "critical", "exceeded"]>;
+    isActive: typeof Schema.Boolean;
+}>;
+export type AdminQuotaItem = typeof AdminQuotaItem.Type;
+export declare const AdminQuotaAlert: Schema.Struct<{
+    id: typeof Schema.String;
+    service: typeof Schema.String;
+    metric: typeof Schema.String;
+    level: Schema.Literal<["warning", "critical", "exceeded"]>;
+    usagePercent: typeof Schema.Number;
+    currentValue: typeof Schema.Number;
+    limitValue: typeof Schema.Number;
+    message: typeof Schema.String;
+    sentAt: typeof Schema.String;
+    acknowledgedAt: Schema.NullOr<typeof Schema.String>;
+}>;
+export type AdminQuotaAlert = typeof AdminQuotaAlert.Type;
+export declare const AdminQuotaHistoryItem: Schema.Struct<{
+    date: typeof Schema.String;
+    value: typeof Schema.Number;
+}>;
+export type AdminQuotaHistoryItem = typeof AdminQuotaHistoryItem.Type;
+export declare const AdminUpdatedQuota: Schema.Struct<{
+    service: typeof Schema.String;
+    metric: typeof Schema.String;
+    limitValue: typeof Schema.Number;
+    enforcement: Schema.Literal<["hard", "soft", "none"]>;
+    warningThresholdPercent: typeof Schema.Number;
+    criticalThresholdPercent: typeof Schema.Number;
+    isActive: typeof Schema.Boolean;
+}>;
+export type AdminUpdatedQuota = typeof AdminUpdatedQuota.Type;
+export declare const AdminQuotasProjectParams: Schema.Struct<{
+    projectId: typeof Schema.String;
+}>;
+export type AdminQuotasProjectParams = typeof AdminQuotasProjectParams.Type;
+export declare const AdminAlertIdParams: Schema.Struct<{
+    alertId: typeof Schema.String;
+}>;
+export type AdminAlertIdParams = typeof AdminAlertIdParams.Type;
+export declare const AdminGetQuotaAlertsQuery: Schema.Struct<{
+    acknowledged: Schema.optional<typeof Schema.String>;
+    limit: Schema.optional<typeof Schema.String>;
+}>;
+export type AdminGetQuotaAlertsQuery = typeof AdminGetQuotaAlertsQuery.Type;
+export declare const AdminGetQuotaHistoryQuery: Schema.Struct<{
+    service: typeof Schema.String;
+    metric: typeof Schema.String;
+    days: Schema.optional<typeof Schema.String>;
+}>;
+export type AdminGetQuotaHistoryQuery = typeof AdminGetQuotaHistoryQuery.Type;
+export declare const AdminUpdateQuotaInput: Schema.Struct<{
+    service: typeof Schema.String;
+    metric: typeof Schema.String;
+    limitValue: Schema.optional<typeof Schema.Number>;
+    enforcement: Schema.optional<Schema.Literal<["hard", "soft", "none"]>>;
+    warningThresholdPercent: Schema.optional<typeof Schema.Number>;
+    criticalThresholdPercent: Schema.optional<typeof Schema.Number>;
+    isActive: Schema.optional<typeof Schema.Boolean>;
+}>;
+export type AdminUpdateQuotaInput = typeof AdminUpdateQuotaInput.Type;
+export declare const AdminGetProjectQuotasResult: Schema.Struct<{
+    projectId: typeof Schema.String;
+    projectName: typeof Schema.String;
+    quotas: Schema.Array$<Schema.Struct<{
+        service: typeof Schema.String;
+        metric: typeof Schema.String;
+        currentUsage: typeof Schema.Number;
+        limit: typeof Schema.Number;
+        percentUsed: typeof Schema.Number;
+        enforcement: Schema.Literal<["hard", "soft", "none"]>;
+        period: Schema.Literal<["hourly", "daily", "monthly", "unlimited"]>;
+        status: Schema.Literal<["ok", "warning", "critical", "exceeded"]>;
+        isActive: typeof Schema.Boolean;
+    }>>;
+    mauCount: typeof Schema.Number;
+    mauLimit: typeof Schema.Number;
+    overallStatus: Schema.Literal<["ok", "warning", "critical", "exceeded", "blocked"]>;
+    unacknowledgedAlertsCount: typeof Schema.Number;
+}>;
+export type AdminGetProjectQuotasResult = typeof AdminGetProjectQuotasResult.Type;
+export declare const AdminGetQuotaStatsResult: Schema.Struct<{
+    atLimit: typeof Schema.Number;
+    warning: typeof Schema.Number;
+    critical: typeof Schema.Number;
+    ok: typeof Schema.Number;
+    total: typeof Schema.Number;
+}>;
+export type AdminGetQuotaStatsResult = typeof AdminGetQuotaStatsResult.Type;
+export declare const AdminGetQuotaAlertsResult: Schema.Struct<{
+    alerts: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        service: typeof Schema.String;
+        metric: typeof Schema.String;
+        level: Schema.Literal<["warning", "critical", "exceeded"]>;
+        usagePercent: typeof Schema.Number;
+        currentValue: typeof Schema.Number;
+        limitValue: typeof Schema.Number;
+        message: typeof Schema.String;
+        sentAt: typeof Schema.String;
+        acknowledgedAt: Schema.NullOr<typeof Schema.String>;
+    }>>;
+}>;
+export type AdminGetQuotaAlertsResult = typeof AdminGetQuotaAlertsResult.Type;
+export declare const AdminGetQuotaHistoryResult: Schema.Struct<{
+    history: Schema.Array$<Schema.Struct<{
+        date: typeof Schema.String;
+        value: typeof Schema.Number;
+    }>>;
+}>;
+export type AdminGetQuotaHistoryResult = typeof AdminGetQuotaHistoryResult.Type;
+export declare const AdminUpdateQuotaResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    quota: Schema.Struct<{
+        service: typeof Schema.String;
+        metric: typeof Schema.String;
+        limitValue: typeof Schema.Number;
+        enforcement: Schema.Literal<["hard", "soft", "none"]>;
+        warningThresholdPercent: typeof Schema.Number;
+        criticalThresholdPercent: typeof Schema.Number;
+        isActive: typeof Schema.Boolean;
+    }>;
+}>;
+export type AdminUpdateQuotaResult = typeof AdminUpdateQuotaResult.Type;
+export declare const AdminAcknowledgeAlertResult: Schema.Struct<{
+    success: typeof Schema.Boolean;
+    acknowledgedAt: Schema.NullOr<typeof Schema.String>;
+}>;
+export type AdminAcknowledgeAlertResult = typeof AdminAcknowledgeAlertResult.Type;
+//# sourceMappingURL=admin-quotas.d.ts.map

package/dist/schemas/admin-quotas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-quotas.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-quotas.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,oBAAoB,sBAAgB,CAAA;AACjD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,qBAAqB,0CAAyC,CAAA;AAC3E,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,gBAAgB,2DAA0D,CAAA;AACvF,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,eAAO,MAAM,uBAAuB,sEAMnC,CAAA;AACD,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,gBAAgB,6DAA4D,CAAA;AACzF,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,eAAO,MAAM,oBAAoB,qDAAoD,CAAA;AACrF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,cAAc;;;;;;;;;;EAUzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,eAAe;;;;;;;;;;;EAW1B,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD,eAAO,MAAM,qBAAqB;;;EAGhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,iBAAiB;;;;;;;;EAQ5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAI7D,eAAO,MAAM,wBAAwB;;EAA8C,CAAA;AACnF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAC3E,eAAO,MAAM,kBAAkB;;EAA4C,CAAA;AAC3E,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAI/D,eAAO,MAAM,wBAAwB;;;EAGnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,yBAAyB;;;;EAIpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAI7E,eAAO,MAAM,qBAAqB;;;;;;;;EAQhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAIrE,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;EAQtC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA;AAEjF,eAAO,MAAM,wBAAwB;;;;;;EAMnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;EAEpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAE7E,eAAO,MAAM,0BAA0B;;;;;EAErC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,sBAAsB;;;;;;;;;;;EAGjC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,2BAA2B;;;EAGtC,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-quotas.js

@@ -0,0 +1,107 @@
+/**
+ * Admin Quotas — internal operator console schemas for quota management.
+ * Mirrors `/admin/quotas/*` in `apps/api/src/server/platform/routes/admin/quotas.ts`.
+ *
+ * Plane: `admin`.
+ *
+ * Note — `service` is typed as `Schema.String` here because the billable
+ * service enum is the Drizzle enum SSOT in `core`; keeping it string-shaped
+ * avoids a cross-package enum sync every time a new service is added.
+ */
+import { Schema } from 'effect';
+export const AdminBillableService = Schema.String;
+export const AdminQuotaEnforcement = Schema.Literal('hard', 'soft', 'none');
+export const AdminQuotaStatus = Schema.Literal('ok', 'warning', 'critical', 'exceeded');
+export const AdminOverallQuotaStatus = Schema.Literal('ok', 'warning', 'critical', 'exceeded', 'blocked');
+export const AdminQuotaPeriod = Schema.Literal('hourly', 'daily', 'monthly', 'unlimited');
+export const AdminQuotaAlertLevel = Schema.Literal('warning', 'critical', 'exceeded');
+export const AdminQuotaItem = Schema.Struct({
+    service: AdminBillableService,
+    metric: Schema.String,
+    currentUsage: Schema.Number,
+    limit: Schema.Number,
+    percentUsed: Schema.Number,
+    enforcement: AdminQuotaEnforcement,
+    period: AdminQuotaPeriod,
+    status: AdminQuotaStatus,
+    isActive: Schema.Boolean,
+});
+export const AdminQuotaAlert = Schema.Struct({
+    id: Schema.String,
+    service: AdminBillableService,
+    metric: Schema.String,
+    level: AdminQuotaAlertLevel,
+    usagePercent: Schema.Number,
+    currentValue: Schema.Number,
+    limitValue: Schema.Number,
+    message: Schema.String,
+    sentAt: Schema.String,
+    acknowledgedAt: Schema.NullOr(Schema.String),
+});
+export const AdminQuotaHistoryItem = Schema.Struct({
+    date: Schema.String,
+    value: Schema.Number,
+});
+export const AdminUpdatedQuota = Schema.Struct({
+    service: AdminBillableService,
+    metric: Schema.String,
+    limitValue: Schema.Number,
+    enforcement: AdminQuotaEnforcement,
+    warningThresholdPercent: Schema.Number,
+    criticalThresholdPercent: Schema.Number,
+    isActive: Schema.Boolean,
+});
+// ── Params ─────────────────────────────────────────────────────────────────
+export const AdminQuotasProjectParams = Schema.Struct({ projectId: Schema.String });
+export const AdminAlertIdParams = Schema.Struct({ alertId: Schema.String });
+// ── Query ──────────────────────────────────────────────────────────────────
+export const AdminGetQuotaAlertsQuery = Schema.Struct({
+    acknowledged: Schema.optional(Schema.String),
+    limit: Schema.optional(Schema.String),
+});
+export const AdminGetQuotaHistoryQuery = Schema.Struct({
+    service: AdminBillableService,
+    metric: Schema.String,
+    days: Schema.optional(Schema.String),
+});
+// ── Inputs ─────────────────────────────────────────────────────────────────
+export const AdminUpdateQuotaInput = Schema.Struct({
+    service: AdminBillableService,
+    metric: Schema.String,
+    limitValue: Schema.optional(Schema.Number),
+    enforcement: Schema.optional(AdminQuotaEnforcement),
+    warningThresholdPercent: Schema.optional(Schema.Number),
+    criticalThresholdPercent: Schema.optional(Schema.Number),
+    isActive: Schema.optional(Schema.Boolean),
+});
+// ── Responses ──────────────────────────────────────────────────────────────
+export const AdminGetProjectQuotasResult = Schema.Struct({
+    projectId: Schema.String,
+    projectName: Schema.String,
+    quotas: Schema.Array(AdminQuotaItem),
+    mauCount: Schema.Number,
+    mauLimit: Schema.Number,
+    overallStatus: AdminOverallQuotaStatus,
+    unacknowledgedAlertsCount: Schema.Number,
+});
+export const AdminGetQuotaStatsResult = Schema.Struct({
+    atLimit: Schema.Number,
+    warning: Schema.Number,
+    critical: Schema.Number,
+    ok: Schema.Number,
+    total: Schema.Number,
+});
+export const AdminGetQuotaAlertsResult = Schema.Struct({
+    alerts: Schema.Array(AdminQuotaAlert),
+});
+export const AdminGetQuotaHistoryResult = Schema.Struct({
+    history: Schema.Array(AdminQuotaHistoryItem),
+});
+export const AdminUpdateQuotaResult = Schema.Struct({
+    success: Schema.Boolean,
+    quota: AdminUpdatedQuota,
+});
+export const AdminAcknowledgeAlertResult = Schema.Struct({
+    success: Schema.Boolean,
+    acknowledgedAt: Schema.NullOr(Schema.String),
+});

package/dist/schemas/admin-rate-limits.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Admin Rate-Limits — operator-driven tuning of per-credential-type
+ * multipliers (Production-Ready audit M-3).
+ *
+ * Pre-M-3 the multipliers were hard-coded constants in
+ * `packages/core/src/lib/security/rate-limit.ts:86-92`. Tuning required
+ * a code deploy + restart — exactly the workflow we don't want to run
+ * during a credential-enumeration attack on a `pk_*` key.
+ *
+ * Endpoints:
+ *
+ *   - GET  /admin/rate-limits/credential-multipliers — snapshot every
+ *     credential type's current multiplier + exempt status.
+ *   - POST /admin/rate-limits/credential-multipliers — upsert the row
+ *     for one credential type. The enforcement layer picks up the
+ *     change within 5 minutes (Redis cache TTL) or immediately via
+ *     `invalidateAndReload()`.
+ *
+ * Auth: service token + scope `platform:ratelimits:write`. Super-admin
+ * sessions are NOT accepted server-side — a multiplier change is a
+ * security-policy decision and MUST be a programmatic step in an Ops
+ * runbook, never an interactive Console click.
+ */
+import { Schema } from 'effect';
+/**
+ * Credential-type enumeration — mirrors `RateLimitCredentialType` in
+ * the schema layer. New types require a coordinated migration + union
+ * extension + this literal.
+ */
+export declare const AdminRateLimitCredentialType: Schema.Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+export type AdminRateLimitCredentialType = typeof AdminRateLimitCredentialType.Type;
+/**
+ * Snapshot row — one per credential type. `effectiveMultiplier` is
+ * the value the limiter is currently applying (after Redis cache
+ * settles); `exempt=true` means the limiter short-circuits to
+ * always-allow (used for the SPIFFE mesh path).
+ */
+export declare const AdminRateLimitMultiplierStatus: Schema.Struct<{
+    credentialType: Schema.Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+    multiplier: typeof Schema.Number;
+    exempt: typeof Schema.Boolean;
+    notes: Schema.NullOr<typeof Schema.String>;
+    lastUpdatedAt: Schema.NullOr<typeof Schema.String>;
+}>;
+export type AdminRateLimitMultiplierStatus = typeof AdminRateLimitMultiplierStatus.Type;
+/**
+ * `GET /admin/rate-limits/credential-multipliers` response.
+ */
+export declare const AdminListRateLimitMultipliersResult: Schema.Struct<{
+    multipliers: Schema.Array$<Schema.Struct<{
+        credentialType: Schema.Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+        multiplier: typeof Schema.Number;
+        exempt: typeof Schema.Boolean;
+        notes: Schema.NullOr<typeof Schema.String>;
+        lastUpdatedAt: Schema.NullOr<typeof Schema.String>;
+    }>>;
+}>;
+export type AdminListRateLimitMultipliersResult = typeof AdminListRateLimitMultipliersResult.Type;
+/**
+ * `POST /admin/rate-limits/credential-multipliers` body. One write
+ * per (credentialType) row — the table's PK enforces uniqueness.
+ *
+ * `multiplier` is required; pass any value in (0, 10]. To toggle
+ * exempt status, set `exempt=true` (multiplier becomes a no-op).
+ * `reason` is required and audited.
+ */
+export declare const AdminSetRateLimitMultiplierInput: Schema.Struct<{
+    credentialType: Schema.Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+    multiplier: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    exempt: Schema.optional<typeof Schema.Boolean>;
+    reason: Schema.filter<typeof Schema.String>;
+}>;
+export type AdminSetRateLimitMultiplierInput = typeof AdminSetRateLimitMultiplierInput.Type;
+/**
+ * Result envelope — returns the freshly-written row + the audit log
+ * ID for traceability.
+ */
+export declare const AdminSetRateLimitMultiplierResult: Schema.Struct<{
+    updated: Schema.Struct<{
+        credentialType: Schema.Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+        multiplier: typeof Schema.Number;
+        exempt: typeof Schema.Boolean;
+        notes: Schema.NullOr<typeof Schema.String>;
+        lastUpdatedAt: Schema.NullOr<typeof Schema.String>;
+    }>;
+    auditLogId: Schema.NullOr<typeof Schema.String>;
+    message: typeof Schema.String;
+}>;
+export type AdminSetRateLimitMultiplierResult = typeof AdminSetRateLimitMultiplierResult.Type;
+//# sourceMappingURL=admin-rate-limits.d.ts.map

package/dist/schemas/admin-rate-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-rate-limits.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-rate-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;GAIG;AACH,eAAO,MAAM,4BAA4B,iFAOxC,CAAA;AACD,MAAM,MAAM,4BAA4B,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAA;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B;;;;;;EAMzC,CAAA;AACF,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAA;AAEvF;;GAEG;AACH,eAAO,MAAM,mCAAmC;;;;;;;;EAE9C,CAAA;AACF,MAAM,MAAM,mCAAmC,GAAG,OAAO,mCAAmC,CAAC,IAAI,CAAA;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,gCAAgC;;;;;EAK3C,CAAA;AACF,MAAM,MAAM,gCAAgC,GAAG,OAAO,gCAAgC,CAAC,IAAI,CAAA;AAE3F;;;GAGG;AACH,eAAO,MAAM,iCAAiC;;;;;;;;;;EAI5C,CAAA;AACF,MAAM,MAAM,iCAAiC,GAAG,OAAO,iCAAiC,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-rate-limits.js

@@ -0,0 +1,72 @@
+/**
+ * Admin Rate-Limits — operator-driven tuning of per-credential-type
+ * multipliers (Production-Ready audit M-3).
+ *
+ * Pre-M-3 the multipliers were hard-coded constants in
+ * `packages/core/src/lib/security/rate-limit.ts:86-92`. Tuning required
+ * a code deploy + restart — exactly the workflow we don't want to run
+ * during a credential-enumeration attack on a `pk_*` key.
+ *
+ * Endpoints:
+ *
+ *   - GET  /admin/rate-limits/credential-multipliers — snapshot every
+ *     credential type's current multiplier + exempt status.
+ *   - POST /admin/rate-limits/credential-multipliers — upsert the row
+ *     for one credential type. The enforcement layer picks up the
+ *     change within 5 minutes (Redis cache TTL) or immediately via
+ *     `invalidateAndReload()`.
+ *
+ * Auth: service token + scope `platform:ratelimits:write`. Super-admin
+ * sessions are NOT accepted server-side — a multiplier change is a
+ * security-policy decision and MUST be a programmatic step in an Ops
+ * runbook, never an interactive Console click.
+ */
+import { Schema } from 'effect';
+/**
+ * Credential-type enumeration — mirrors `RateLimitCredentialType` in
+ * the schema layer. New types require a coordinated migration + union
+ * extension + this literal.
+ */
+export const AdminRateLimitCredentialType = Schema.Literal('public', 'secret', 'service', 'session', 'spiffe', 'unknown');
+/**
+ * Snapshot row — one per credential type. `effectiveMultiplier` is
+ * the value the limiter is currently applying (after Redis cache
+ * settles); `exempt=true` means the limiter short-circuits to
+ * always-allow (used for the SPIFFE mesh path).
+ */
+export const AdminRateLimitMultiplierStatus = Schema.Struct({
+    credentialType: AdminRateLimitCredentialType,
+    multiplier: Schema.Number,
+    exempt: Schema.Boolean,
+    notes: Schema.NullOr(Schema.String),
+    lastUpdatedAt: Schema.NullOr(Schema.String),
+});
+/**
+ * `GET /admin/rate-limits/credential-multipliers` response.
+ */
+export const AdminListRateLimitMultipliersResult = Schema.Struct({
+    multipliers: Schema.Array(AdminRateLimitMultiplierStatus),
+});
+/**
+ * `POST /admin/rate-limits/credential-multipliers` body. One write
+ * per (credentialType) row — the table's PK enforces uniqueness.
+ *
+ * `multiplier` is required; pass any value in (0, 10]. To toggle
+ * exempt status, set `exempt=true` (multiplier becomes a no-op).
+ * `reason` is required and audited.
+ */
+export const AdminSetRateLimitMultiplierInput = Schema.Struct({
+    credentialType: AdminRateLimitCredentialType,
+    multiplier: Schema.Number.pipe(Schema.greaterThan(0), Schema.lessThanOrEqualTo(10)),
+    exempt: Schema.optional(Schema.Boolean),
+    reason: Schema.String.pipe(Schema.minLength(3)),
+});
+/**
+ * Result envelope — returns the freshly-written row + the audit log
+ * ID for traceability.
+ */
+export const AdminSetRateLimitMultiplierResult = Schema.Struct({
+    updated: AdminRateLimitMultiplierStatus,
+    auditLogId: Schema.NullOr(Schema.String),
+    message: Schema.String,
+});

package/dist/schemas/admin-reconcile.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Admin Reconcile — operator recovery schemas (OPS-6).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/reconcile.ts`.
+ * Replaces the manual `UPDATE project_environments SET generation = … ,
+ * reconcile_status = 'pending' …` from
+ * `docs/how-to/reconciler-cleanup-semantic.md` (lines 34, 42, 68, 74,
+ * 125) with a structured admin endpoint.
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:reconcile:reset`).
+ */
+import { Schema } from 'effect';
+/**
+ * Targetable rows. The wire vocabulary maps to:
+ *
+ *   - `service`     → `environment_services.id` (TypeID `esvc_*`).
+ *                      State machine: `pending | progressing | synced |
+ *                      degraded | failed | stopped` plus the
+ *                      lifecycle terminal `terminating`.
+ *   - `environment` → `project_environments.id` (TypeID `env_*`).
+ *                      State machine: `pending | synced | failed` plus
+ *                      the lifecycle terminal `terminating`.
+ *
+ * Per ADR-055 §3, IDs are TypeIDs on the wire — the route decodes to UUID
+ * server-side via `parseIdOrError()`.
+ */
+declare const ReconcileKind: Schema.Union<[Schema.Literal<["service"]>, Schema.Literal<["environment"]>]>;
+export type AdminReconcileKind = typeof ReconcileKind.Type;
+/**
+ * Target reconcile_status. Operators only ever need two:
+ *
+ *   - `pending` — re-arm the reconciler (the typical "undo a stuck
+ *                 failed/progressing/degraded row" path).
+ *   - `synced`  — mark the row as converged when the underlying K8s
+ *                 state has actually been verified out-of-band (the
+ *                 escape hatch for split-brain repairs).
+ *
+ * `terminating` / `terminated` are NOT acceptable here — those are
+ * lifecycle transitions driven by `handleTerminating` and the
+ * force-delete path (OPS-3), not by an operator's reset button.
+ */
+declare const ReconcileStatus: Schema.Union<[Schema.Literal<["pending"]>, Schema.Literal<["synced"]>]>;
+export type AdminReconcileStatus = typeof ReconcileStatus.Type;
+/**
+ * Body of `POST /admin/reconcile/reset`.
+ *
+ * Semantics:
+ *
+ *   - `kind`   — `service` or `environment`. Selects the target table.
+ *   - `id`     — TypeID (`esvc_*` for `service`, `env_*` for
+ *                 `environment`).
+ *   - `to`     — target `reconcile_status`. The endpoint validates the
+ *                 source state allows the transition (see route file for
+ *                 the full transition table).
+ *   - `reason` — required (min 3 chars). Audit row narrative.
+ *
+ * Side effect on `to=pending`: also bumps `generation += 1` so the
+ * reconciler picks up the row on the next tick (matching the runbook's
+ * canonical UPDATE).
+ */
+export declare const AdminReconcileResetInput: Schema.Struct<{
+    kind: Schema.Union<[Schema.Literal<["service"]>, Schema.Literal<["environment"]>]>;
+    id: Schema.filter<typeof Schema.String>;
+    to: Schema.Union<[Schema.Literal<["pending"]>, Schema.Literal<["synced"]>]>;
+    reason: Schema.filter<Schema.filter<typeof Schema.String>>;
+}>;
+export type AdminReconcileResetInput = typeof AdminReconcileResetInput.Type;
+/**
+ * Response envelope.
+ *
+ *   - `kind`            — echo of the request.
+ *   - `id`              — echo of the request (TypeID).
+ *   - `previousStatus`  — `reconcile_status` value the row carried just
+ *                          before the UPDATE landed.
+ *   - `newStatus`       — final value (matches `to`).
+ *   - `generationBumped` — `true` iff the endpoint additionally
+ *                          incremented `generation` (only on `to=pending`).
+ */
+export declare const AdminReconcileResetResult: Schema.Struct<{
+    kind: Schema.Union<[Schema.Literal<["service"]>, Schema.Literal<["environment"]>]>;
+    id: typeof Schema.String;
+    previousStatus: typeof Schema.String;
+    newStatus: Schema.Union<[Schema.Literal<["pending"]>, Schema.Literal<["synced"]>]>;
+    generationBumped: typeof Schema.Boolean;
+}>;
+export type AdminReconcileResetResult = typeof AdminReconcileResetResult.Type;
+export {};
+//# sourceMappingURL=admin-reconcile.d.ts.map

package/dist/schemas/admin-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-reconcile.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;;;;;;;;;GAaG;AACH,QAAA,MAAM,aAAa,8EAAyE,CAAA;AAC5F,MAAM,MAAM,kBAAkB,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAE1D;;;;;;;;;;;;GAYG;AACH,QAAA,MAAM,eAAe,yEAAoE,CAAA;AACzF,MAAM,MAAM,oBAAoB,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAI9D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,wBAAwB;;;;;EASnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB;;;;;;EAMpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-reconcile.js

@@ -0,0 +1,86 @@
+/**
+ * Admin Reconcile — operator recovery schemas (OPS-6).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/reconcile.ts`.
+ * Replaces the manual `UPDATE project_environments SET generation = … ,
+ * reconcile_status = 'pending' …` from
+ * `docs/how-to/reconciler-cleanup-semantic.md` (lines 34, 42, 68, 74,
+ * 125) with a structured admin endpoint.
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:reconcile:reset`).
+ */
+import { Schema } from 'effect';
+/**
+ * Targetable rows. The wire vocabulary maps to:
+ *
+ *   - `service`     → `environment_services.id` (TypeID `esvc_*`).
+ *                      State machine: `pending | progressing | synced |
+ *                      degraded | failed | stopped` plus the
+ *                      lifecycle terminal `terminating`.
+ *   - `environment` → `project_environments.id` (TypeID `env_*`).
+ *                      State machine: `pending | synced | failed` plus
+ *                      the lifecycle terminal `terminating`.
+ *
+ * Per ADR-055 §3, IDs are TypeIDs on the wire — the route decodes to UUID
+ * server-side via `parseIdOrError()`.
+ */
+const ReconcileKind = Schema.Union(Schema.Literal('service'), Schema.Literal('environment'));
+/**
+ * Target reconcile_status. Operators only ever need two:
+ *
+ *   - `pending` — re-arm the reconciler (the typical "undo a stuck
+ *                 failed/progressing/degraded row" path).
+ *   - `synced`  — mark the row as converged when the underlying K8s
+ *                 state has actually been verified out-of-band (the
+ *                 escape hatch for split-brain repairs).
+ *
+ * `terminating` / `terminated` are NOT acceptable here — those are
+ * lifecycle transitions driven by `handleTerminating` and the
+ * force-delete path (OPS-3), not by an operator's reset button.
+ */
+const ReconcileStatus = Schema.Union(Schema.Literal('pending'), Schema.Literal('synced'));
+const Reason = Schema.String.pipe(Schema.minLength(3), Schema.maxLength(500));
+/**
+ * Body of `POST /admin/reconcile/reset`.
+ *
+ * Semantics:
+ *
+ *   - `kind`   — `service` or `environment`. Selects the target table.
+ *   - `id`     — TypeID (`esvc_*` for `service`, `env_*` for
+ *                 `environment`).
+ *   - `to`     — target `reconcile_status`. The endpoint validates the
+ *                 source state allows the transition (see route file for
+ *                 the full transition table).
+ *   - `reason` — required (min 3 chars). Audit row narrative.
+ *
+ * Side effect on `to=pending`: also bumps `generation += 1` so the
+ * reconciler picks up the row on the next tick (matching the runbook's
+ * canonical UPDATE).
+ */
+export const AdminReconcileResetInput = Schema.Struct({
+    kind: ReconcileKind,
+    id: Schema.String.pipe(Schema.pattern(/^(esvc|env)_[0-9a-z]{20,30}$/i, {
+        message: () => 'id must be a TypeID with prefix `esvc_` or `env_`',
+    })),
+    to: ReconcileStatus,
+    reason: Reason,
+});
+/**
+ * Response envelope.
+ *
+ *   - `kind`            — echo of the request.
+ *   - `id`              — echo of the request (TypeID).
+ *   - `previousStatus`  — `reconcile_status` value the row carried just
+ *                          before the UPDATE landed.
+ *   - `newStatus`       — final value (matches `to`).
+ *   - `generationBumped` — `true` iff the endpoint additionally
+ *                          incremented `generation` (only on `to=pending`).
+ */
+export const AdminReconcileResetResult = Schema.Struct({
+    kind: ReconcileKind,
+    id: Schema.String,
+    previousStatus: Schema.String,
+    newStatus: ReconcileStatus,
+    generationBumped: Schema.Boolean,
+});