@sylphx/contract 0.2.0

package/dist/schemas/admin-resources.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Admin Resources — operator recovery schemas (OPS-3).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/resources.ts`.
+ * Replaces the manual `DELETE FROM managed_resources WHERE id=...` from
+ * `docs/how-to/teardown-failure.md` (lines 113, 131) with a structured
+ * admin endpoint.
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:resources:forcedelete`).
+ *
+ * Sibling slice OPS-2 (reseal) extends this file with its own schemas
+ * when it lands; keeping both under `admin-resources` so the audit
+ * `resourceType='managed_resource'` aligns with the surface name.
+ */
+import { Schema } from 'effect';
+/**
+ * Path param for `DELETE /admin/resources/:id`. Matches the TypeID grammar
+ * (`res_xxx`) — invalid input returns 400 at the validator boundary.
+ */
+export declare const AdminResourceIdParams: Schema.Struct<{
+    id: Schema.filter<typeof Schema.String>;
+}>;
+export type AdminResourceIdParams = typeof AdminResourceIdParams.Type;
+/**
+ * Query parameters for `DELETE /admin/resources/:id`.
+ *
+ * Semantics:
+ *
+ *   - `reason`       — required. Goes verbatim into the audit row.
+ *   - `cascade`      — when `true`, also tears down dependent rows (PITR
+ *                       restore points, project_platform_resources binding,
+ *                       project_resource_bindings rows). Default `false`.
+ *   - `reallyForce`  — escape hatch for rows whose `reconcile_status` is
+ *                       NOT `terminating`. Default `false`. The endpoint
+ *                       refuses the row otherwise (the reconciler should
+ *                       drive normal teardown — only rows already in
+ *                       `terminating` are valid candidates here).
+ */
+export declare const AdminResourceForceDeleteQuery: Schema.Struct<{
+    reason: Schema.filter<Schema.filter<typeof Schema.String>>;
+    cascade: Schema.optional<Schema.transform<Schema.Union<[Schema.Literal<["true"]>, Schema.Literal<["false"]>]>, typeof Schema.Boolean>>;
+    reallyForce: Schema.optional<Schema.transform<Schema.Union<[Schema.Literal<["true"]>, Schema.Literal<["false"]>]>, typeof Schema.Boolean>>;
+}>;
+export type AdminResourceForceDeleteQuery = typeof AdminResourceForceDeleteQuery.Type;
+/**
+ * Response envelope.
+ *
+ *   - `id`              — TypeID (`res_xxx`) of the row that was deleted.
+ *   - `previousStatus`  — `reconcile_status` value the row carried just
+ *                          before the DELETE landed. Operators use this to
+ *                          confirm the row was in `terminating` (or that
+ *                          `--really-force` was the override path).
+ *   - `cascade`         — echo of the request flag.
+ *   - `reallyForce`     — echo of the request flag.
+ *   - `dependentsDeleted` — count of dependent rows additionally removed
+ *                            when cascade was true (PITR restore points,
+ *                            platform binding, project resource bindings).
+ *                            Always 0 when cascade=false.
+ */
+export declare const AdminResourceForceDeleteResult: Schema.Struct<{
+    id: typeof Schema.String;
+    previousStatus: typeof Schema.String;
+    cascade: typeof Schema.Boolean;
+    reallyForce: typeof Schema.Boolean;
+    dependentsDeleted: typeof Schema.Number;
+}>;
+export type AdminResourceForceDeleteResult = typeof AdminResourceForceDeleteResult.Type;
+/**
+ * Body of `POST /admin/resources/reseal`.
+ *
+ *   - `keyId`  — the active KEK ID the operator believes the platform
+ *                is serving with. The endpoint refuses with 409 if the
+ *                live ring's `activeKeyId` does not match — protecting
+ *                against split-brain rotations where two operators race.
+ *   - `filter` — reserved (see `ResealFilter`). Today the endpoint walks
+ *                the canonical `buildRotationFields()` registry for ALL
+ *                rows whose envelope is not under the active key; the
+ *                filter is accepted but logged as ignored. When per-
+ *                row scoping ships, the registry adapter will honour it.
+ *
+ * Idempotent: re-running with the same `keyId` rewrites zero rows once
+ * the registry has converged.
+ */
+export declare const AdminResourceResealInput: Schema.Struct<{
+    keyId: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    filter: Schema.optional<Schema.Struct<{
+        projectId: Schema.optional<typeof Schema.String>;
+        envId: Schema.optional<typeof Schema.String>;
+    }>>;
+}>;
+export type AdminResourceResealInput = typeof AdminResourceResealInput.Type;
+/**
+ * Per-field result. Mirrors `RotationFieldResult` from
+ * `packages/core/src/lib/crypto/rotation.ts` so the wire format stays a
+ * faithful projection of the in-process struct.
+ */
+export declare const AdminResourceResealFieldResult: Schema.Struct<{
+    fieldName: typeof Schema.String;
+    rowsSeen: typeof Schema.Number;
+    rowsRotated: typeof Schema.Number;
+    rowsFailed: typeof Schema.Number;
+    failures: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        reason: typeof Schema.String;
+    }>>;
+}>;
+export type AdminResourceResealFieldResult = typeof AdminResourceResealFieldResult.Type;
+/**
+ * Response envelope. `activeKeyId` is the server's authoritative answer
+ * (echo of the input on success).
+ */
+export declare const AdminResourceResealResult: Schema.Struct<{
+    activeKeyId: typeof Schema.String;
+    totalRotated: typeof Schema.Number;
+    totalFailed: typeof Schema.Number;
+    fields: Schema.Array$<Schema.Struct<{
+        fieldName: typeof Schema.String;
+        rowsSeen: typeof Schema.Number;
+        rowsRotated: typeof Schema.Number;
+        rowsFailed: typeof Schema.Number;
+        failures: Schema.Array$<Schema.Struct<{
+            id: typeof Schema.String;
+            reason: typeof Schema.String;
+        }>>;
+    }>>;
+}>;
+export type AdminResourceResealResult = typeof AdminResourceResealResult.Type;
+//# sourceMappingURL=admin-resources.d.ts.map

package/dist/schemas/admin-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-resources.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAI/B;;;GAGG;AACH,eAAO,MAAM,qBAAqB;;EAMhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAgBrE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,6BAA6B;;;;EAIxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA;AAErF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,8BAA8B;;;;;;EAMzC,CAAA;AACF,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAA;AA6BvF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,wBAAwB;;;;;;EAGnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E;;;;GAIG;AACH,eAAO,MAAM,8BAA8B;;;;;;;;;EAWzC,CAAA;AACF,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAA;AAEvF;;;GAGG;AACH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;EAKpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-resources.js

@@ -0,0 +1,143 @@
+/**
+ * Admin Resources — operator recovery schemas (OPS-3).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/resources.ts`.
+ * Replaces the manual `DELETE FROM managed_resources WHERE id=...` from
+ * `docs/how-to/teardown-failure.md` (lines 113, 131) with a structured
+ * admin endpoint.
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:resources:forcedelete`).
+ *
+ * Sibling slice OPS-2 (reseal) extends this file with its own schemas
+ * when it lands; keeping both under `admin-resources` so the audit
+ * `resourceType='managed_resource'` aligns with the surface name.
+ */
+import { Schema } from 'effect';
+// ─── Force-delete (OPS-3) ───────────────────────────────────────────────
+/**
+ * Path param for `DELETE /admin/resources/:id`. Matches the TypeID grammar
+ * (`res_xxx`) — invalid input returns 400 at the validator boundary.
+ */
+export const AdminResourceIdParams = Schema.Struct({
+    id: Schema.String.pipe(Schema.pattern(/^res_[0-9a-z]{20,30}$/i, {
+        message: () => 'id must be a TypeID with prefix `res_`',
+    })),
+});
+/**
+ * Reason string for the audit trail. Length-bounded so audit_logs.metadata
+ * stays predictable.
+ */
+const Reason = Schema.String.pipe(Schema.minLength(3), Schema.maxLength(500));
+const BoolString = Schema.Union(Schema.Literal('true'), Schema.Literal('false')).pipe(Schema.transform(Schema.Boolean, {
+    strict: true,
+    decode: (s) => s === 'true',
+    encode: (b) => (b ? 'true' : 'false'),
+}));
+/**
+ * Query parameters for `DELETE /admin/resources/:id`.
+ *
+ * Semantics:
+ *
+ *   - `reason`       — required. Goes verbatim into the audit row.
+ *   - `cascade`      — when `true`, also tears down dependent rows (PITR
+ *                       restore points, project_platform_resources binding,
+ *                       project_resource_bindings rows). Default `false`.
+ *   - `reallyForce`  — escape hatch for rows whose `reconcile_status` is
+ *                       NOT `terminating`. Default `false`. The endpoint
+ *                       refuses the row otherwise (the reconciler should
+ *                       drive normal teardown — only rows already in
+ *                       `terminating` are valid candidates here).
+ */
+export const AdminResourceForceDeleteQuery = Schema.Struct({
+    reason: Reason,
+    cascade: Schema.optional(BoolString),
+    reallyForce: Schema.optional(BoolString),
+});
+/**
+ * Response envelope.
+ *
+ *   - `id`              — TypeID (`res_xxx`) of the row that was deleted.
+ *   - `previousStatus`  — `reconcile_status` value the row carried just
+ *                          before the DELETE landed. Operators use this to
+ *                          confirm the row was in `terminating` (or that
+ *                          `--really-force` was the override path).
+ *   - `cascade`         — echo of the request flag.
+ *   - `reallyForce`     — echo of the request flag.
+ *   - `dependentsDeleted` — count of dependent rows additionally removed
+ *                            when cascade was true (PITR restore points,
+ *                            platform binding, project resource bindings).
+ *                            Always 0 when cascade=false.
+ */
+export const AdminResourceForceDeleteResult = Schema.Struct({
+    id: Schema.String,
+    previousStatus: Schema.String,
+    cascade: Schema.Boolean,
+    reallyForce: Schema.Boolean,
+    dependentsDeleted: Schema.Number,
+});
+// ─── Reseal (OPS-2) ─────────────────────────────────────────────────────
+/**
+ * Active KEK identifier grammar. Sylphx KEK ids are short opaque strings
+ * (e.g. `kek-2026-04`); we constrain to printable ASCII so the audit
+ * row stays grep-friendly and the value can't smuggle control chars
+ * into log pipelines.
+ */
+const KeyId = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(64), Schema.pattern(/^[A-Za-z0-9._:-]+$/, {
+    message: () => 'keyId must match ^[A-Za-z0-9._:-]+$',
+}));
+/**
+ * Optional filter — currently unused by the rotation primitive (the
+ * canonical registry walks all rows under retired keys). Reserved for
+ * future per-project / per-env scoped rotations; accepted today so the
+ * shape stabilises before we expand the registry.
+ */
+const ResealFilter = Schema.Struct({
+    projectId: Schema.optional(Schema.String),
+    envId: Schema.optional(Schema.String),
+});
+/**
+ * Body of `POST /admin/resources/reseal`.
+ *
+ *   - `keyId`  — the active KEK ID the operator believes the platform
+ *                is serving with. The endpoint refuses with 409 if the
+ *                live ring's `activeKeyId` does not match — protecting
+ *                against split-brain rotations where two operators race.
+ *   - `filter` — reserved (see `ResealFilter`). Today the endpoint walks
+ *                the canonical `buildRotationFields()` registry for ALL
+ *                rows whose envelope is not under the active key; the
+ *                filter is accepted but logged as ignored. When per-
+ *                row scoping ships, the registry adapter will honour it.
+ *
+ * Idempotent: re-running with the same `keyId` rewrites zero rows once
+ * the registry has converged.
+ */
+export const AdminResourceResealInput = Schema.Struct({
+    keyId: KeyId,
+    filter: Schema.optional(ResealFilter),
+});
+/**
+ * Per-field result. Mirrors `RotationFieldResult` from
+ * `packages/core/src/lib/crypto/rotation.ts` so the wire format stays a
+ * faithful projection of the in-process struct.
+ */
+export const AdminResourceResealFieldResult = Schema.Struct({
+    fieldName: Schema.String,
+    rowsSeen: Schema.Number,
+    rowsRotated: Schema.Number,
+    rowsFailed: Schema.Number,
+    failures: Schema.Array(Schema.Struct({
+        id: Schema.String,
+        reason: Schema.String,
+    })),
+});
+/**
+ * Response envelope. `activeKeyId` is the server's authoritative answer
+ * (echo of the input on success).
+ */
+export const AdminResourceResealResult = Schema.Struct({
+    activeKeyId: Schema.String,
+    totalRotated: Schema.Number,
+    totalFailed: Schema.Number,
+    fields: Schema.Array(AdminResourceResealFieldResult),
+});

package/dist/schemas/admin-secrets.d.ts

@@ -0,0 +1,113 @@
+/**
+ * Admin Secrets — operator-driven secret rotation primitives.
+ *
+ * G-5: closes the production-ready audit gap on secret rotation. The
+ * Platform holds a small set of HMAC / encryption secrets in K8s Secret
+ * env-var slots (BREAK_GLASS_SECRET, PLATFORM_ENCRYPTION_KEY, …). Pre-G-5
+ * rotation was a manual two-person rule documented in
+ * `docs/runbooks/break-glass.md` §4 — not auditable, not metered, no
+ * automated reminder when a secret aged past 90 days.
+ *
+ * This endpoint surface gives operators a uniform CLI path to:
+ *   - List rotatable secrets + their last-rotation age (`--dry-run`)
+ *   - Initiate a rotation event for compliance (audit row + metric tick)
+ *
+ * The actual K8s secret value rotation is delegated to the runbook's
+ * existing two-person procedure; this endpoint is the AUDIT trail and
+ * the OBSERVABILITY anchor for `sylphx_secret_age_days`. We deliberately
+ * do NOT mint the new value server-side — minting would require holding
+ * the cluster KMS key in process memory, which is the very threat the
+ * rotation is hedging against. Operators paste the new value into the
+ * cluster Secret store; the endpoint records that it happened.
+ *
+ * Scope (`platform:secrets:rotate`) is service-token only; super-admin
+ * sessions are explicitly NOT accepted — a rotation MUST be a programmatic
+ * step in an Ops runbook, never an interactive Console click.
+ */
+import { Schema } from 'effect';
+/**
+ * The set of platform secrets that follow the Sylphx rotation cadence.
+ * Adding a new secret = adding a literal here AND a row in
+ * `secret_rotation_events` retention; CI guards both.
+ */
+export declare const AdminSecretType: Schema.Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+export type AdminSecretType = typeof AdminSecretType.Type;
+export declare const AdminRotateSecretInput: Schema.Struct<{
+    /** Which secret to rotate. */
+    type: Schema.Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+    /**
+     * If true, returns the rotation eligibility report WITHOUT writing an
+     * audit row or emitting the metric tick. Always-safe; used by the CLI's
+     * `--dry-run` mode and by the periodic `sylphx_secret_age_days` alert
+     * cron to read state.
+     */
+    dryRun: Schema.optional<typeof Schema.Boolean>;
+    /**
+     * Operator note explaining WHY this rotation is happening. Required on
+     * non-dry-run calls (min 3 chars). Recorded on the audit row + on the
+     * `secret_rotation_events` ledger.
+     */
+    reason: Schema.optional<typeof Schema.String>;
+}>;
+export type AdminRotateSecretInput = typeof AdminRotateSecretInput.Type;
+/**
+ * Per-secret rotation status — one row per known secret type.
+ *
+ * `lastRotatedAt` is null for a secret that has never been rotated since
+ * ledger ingest (greenfield clusters, freshly seeded `secret_rotation_events`).
+ * `ageDays` is `now() - lastRotatedAt` in days, or null when never-rotated;
+ * the alert rule fires when `ageDays > 90`.
+ */
+export declare const AdminSecretStatus: Schema.Struct<{
+    type: Schema.Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+    lastRotatedAt: Schema.NullOr<typeof Schema.String>;
+    ageDays: Schema.NullOr<typeof Schema.Number>;
+    /** Operator-facing rotation cadence in days (90 today). */
+    cadenceDays: typeof Schema.Number;
+    /** True iff `ageDays > cadenceDays` (or never-rotated). */
+    overdue: typeof Schema.Boolean;
+    /** Name of the K8s Secret + key the operator must update. */
+    clusterSecretRef: typeof Schema.String;
+}>;
+export type AdminSecretStatus = typeof AdminSecretStatus.Type;
+export declare const AdminRotateSecretResult: Schema.Struct<{
+    /** True iff a real rotation event was recorded; false on dry-run. */
+    rotated: typeof Schema.Boolean;
+    /** Per-type rotation status snapshot (always populated). */
+    status: Schema.Struct<{
+        type: Schema.Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+        lastRotatedAt: Schema.NullOr<typeof Schema.String>;
+        ageDays: Schema.NullOr<typeof Schema.Number>;
+        /** Operator-facing rotation cadence in days (90 today). */
+        cadenceDays: typeof Schema.Number;
+        /** True iff `ageDays > cadenceDays` (or never-rotated). */
+        overdue: typeof Schema.Boolean;
+        /** Name of the K8s Secret + key the operator must update. */
+        clusterSecretRef: typeof Schema.String;
+    }>;
+    /** ID of the audit_logs row written on a non-dry-run call. */
+    auditLogId: Schema.NullOr<typeof Schema.String>;
+    /** Operator-facing next-step instruction. */
+    message: typeof Schema.String;
+}>;
+export type AdminRotateSecretResult = typeof AdminRotateSecretResult.Type;
+/**
+ * `GET /admin/secrets` — list every secret type + its rotation status.
+ * Used by the `sylphx_secret_age_days` alert and by the Console operator
+ * dashboard's secret-rotation widget.
+ */
+export declare const AdminListSecretsResult: Schema.Struct<{
+    secrets: Schema.Array$<Schema.Struct<{
+        type: Schema.Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+        lastRotatedAt: Schema.NullOr<typeof Schema.String>;
+        ageDays: Schema.NullOr<typeof Schema.Number>;
+        /** Operator-facing rotation cadence in days (90 today). */
+        cadenceDays: typeof Schema.Number;
+        /** True iff `ageDays > cadenceDays` (or never-rotated). */
+        overdue: typeof Schema.Boolean;
+        /** Name of the K8s Secret + key the operator must update. */
+        clusterSecretRef: typeof Schema.String;
+    }>>;
+}>;
+export type AdminListSecretsResult = typeof AdminListSecretsResult.Type;
+//# sourceMappingURL=admin-secrets.d.ts.map

package/dist/schemas/admin-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-secrets.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;GAIG;AACH,eAAO,MAAM,eAAe,kEAQ3B,CAAA;AACD,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD,eAAO,MAAM,sBAAsB;IAClC,8BAA8B;;IAE9B;;;;;OAKG;;IAEH;;;;OAIG;;EAEF,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;IAI7B,2DAA2D;;IAE3D,2DAA2D;;IAE3D,6DAA6D;;EAE5D,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,uBAAuB;IACnC,qEAAqE;;IAErE,4DAA4D;;;;;QAZ5D,2DAA2D;;QAE3D,2DAA2D;;QAE3D,6DAA6D;;;IAU7D,8DAA8D;;IAE9D,6CAA6C;;EAE5C,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;QA1BlC,2DAA2D;;QAE3D,2DAA2D;;QAE3D,6DAA6D;;;EAwB5D,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-secrets.js

@@ -0,0 +1,94 @@
+/**
+ * Admin Secrets — operator-driven secret rotation primitives.
+ *
+ * G-5: closes the production-ready audit gap on secret rotation. The
+ * Platform holds a small set of HMAC / encryption secrets in K8s Secret
+ * env-var slots (BREAK_GLASS_SECRET, PLATFORM_ENCRYPTION_KEY, …). Pre-G-5
+ * rotation was a manual two-person rule documented in
+ * `docs/runbooks/break-glass.md` §4 — not auditable, not metered, no
+ * automated reminder when a secret aged past 90 days.
+ *
+ * This endpoint surface gives operators a uniform CLI path to:
+ *   - List rotatable secrets + their last-rotation age (`--dry-run`)
+ *   - Initiate a rotation event for compliance (audit row + metric tick)
+ *
+ * The actual K8s secret value rotation is delegated to the runbook's
+ * existing two-person procedure; this endpoint is the AUDIT trail and
+ * the OBSERVABILITY anchor for `sylphx_secret_age_days`. We deliberately
+ * do NOT mint the new value server-side — minting would require holding
+ * the cluster KMS key in process memory, which is the very threat the
+ * rotation is hedging against. Operators paste the new value into the
+ * cluster Secret store; the endpoint records that it happened.
+ *
+ * Scope (`platform:secrets:rotate`) is service-token only; super-admin
+ * sessions are explicitly NOT accepted — a rotation MUST be a programmatic
+ * step in an Ops runbook, never an interactive Console click.
+ */
+import { Schema } from 'effect';
+/**
+ * The set of platform secrets that follow the Sylphx rotation cadence.
+ * Adding a new secret = adding a literal here AND a row in
+ * `secret_rotation_events` retention; CI guards both.
+ */
+export const AdminSecretType = Schema.Literal(
+/** HMAC key for the `/admin/break-glass` endpoint (90-day cadence). */
+'break-glass', 
+/** AES-256-GCM key for at-rest encryption of secrets / webhooks. */
+'encryption-key', 
+/** RSA private key family for JWT signing — superseded by the
+ *  `adminJwtKeys.rotate` namespace; included here for parity dashboards. */
+'jwt-signing');
+export const AdminRotateSecretInput = Schema.Struct({
+    /** Which secret to rotate. */
+    type: AdminSecretType,
+    /**
+     * If true, returns the rotation eligibility report WITHOUT writing an
+     * audit row or emitting the metric tick. Always-safe; used by the CLI's
+     * `--dry-run` mode and by the periodic `sylphx_secret_age_days` alert
+     * cron to read state.
+     */
+    dryRun: Schema.optional(Schema.Boolean),
+    /**
+     * Operator note explaining WHY this rotation is happening. Required on
+     * non-dry-run calls (min 3 chars). Recorded on the audit row + on the
+     * `secret_rotation_events` ledger.
+     */
+    reason: Schema.optional(Schema.String),
+});
+/**
+ * Per-secret rotation status — one row per known secret type.
+ *
+ * `lastRotatedAt` is null for a secret that has never been rotated since
+ * ledger ingest (greenfield clusters, freshly seeded `secret_rotation_events`).
+ * `ageDays` is `now() - lastRotatedAt` in days, or null when never-rotated;
+ * the alert rule fires when `ageDays > 90`.
+ */
+export const AdminSecretStatus = Schema.Struct({
+    type: AdminSecretType,
+    lastRotatedAt: Schema.NullOr(Schema.String),
+    ageDays: Schema.NullOr(Schema.Number),
+    /** Operator-facing rotation cadence in days (90 today). */
+    cadenceDays: Schema.Number,
+    /** True iff `ageDays > cadenceDays` (or never-rotated). */
+    overdue: Schema.Boolean,
+    /** Name of the K8s Secret + key the operator must update. */
+    clusterSecretRef: Schema.String,
+});
+export const AdminRotateSecretResult = Schema.Struct({
+    /** True iff a real rotation event was recorded; false on dry-run. */
+    rotated: Schema.Boolean,
+    /** Per-type rotation status snapshot (always populated). */
+    status: AdminSecretStatus,
+    /** ID of the audit_logs row written on a non-dry-run call. */
+    auditLogId: Schema.NullOr(Schema.String),
+    /** Operator-facing next-step instruction. */
+    message: Schema.String,
+});
+/**
+ * `GET /admin/secrets` — list every secret type + its rotation status.
+ * Used by the `sylphx_secret_age_days` alert and by the Console operator
+ * dashboard's secret-rotation widget.
+ */
+export const AdminListSecretsResult = Schema.Struct({
+    secrets: Schema.Array(AdminSecretStatus),
+});

package/dist/schemas/admin-services.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Admin Services — operator-only image-status drift schemas (drift-watchdog).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/services.ts`.
+ *
+ * The drift watchdog (`infra/addons/dogfood-smoke/manifests/image-drift-cronjob.yaml`)
+ * polls this endpoint every 10 minutes. For each Platform service it
+ * compares:
+ *
+ *   - DB SSOT — `project_services.latest_image_ref` (the digest the
+ *               build pipeline says is current).
+ *   - K8s live — `deployment.spec.template.spec.containers[0].image`
+ *                (the digest actually rolling on cluster).
+ *
+ * When the two diverge for >30 minutes the probe pages on-call. Inside the
+ * 30-minute grace window drift is tolerated (legit during a rolling deploy
+ * or a fresh build that hasn't propagated yet).
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:services:read`).
+ */
+import { Schema } from 'effect';
+/**
+ * One row of the image-status report.
+ *
+ *   - `name`         — service name within the platform project
+ *                       (e.g. `api`, `controller`, `runtime`).
+ *   - `dbRef`        — `latest_image_ref` from `project_services`.
+ *                       `null` if the service has never been built.
+ *   - `k8sRef`       — image string from the live `Deployment`.
+ *                       `null` if the deployment is missing in K8s.
+ *   - `driftMinutes` — minutes since the divergence first appeared.
+ *                       `0` when DB and K8s agree (or both null).
+ *                       `null` when one side is missing.
+ *   - `inSync`       — `true` iff `dbRef === k8sRef` AND both non-null.
+ *                       Probes alert when this is `false` past the grace
+ *                       window.
+ *   - `dbUpdatedAt`  — ISO timestamp the DB row was last touched
+ *                       (`project_services.updated_at`). Drives the
+ *                       `driftMinutes` calculation when DB is the lagger.
+ */
+export declare const AdminServiceImageStatusRow: Schema.Struct<{
+    name: typeof Schema.String;
+    dbRef: Schema.NullOr<typeof Schema.String>;
+    k8sRef: Schema.NullOr<typeof Schema.String>;
+    driftMinutes: Schema.NullOr<typeof Schema.Number>;
+    inSync: typeof Schema.Boolean;
+    dbUpdatedAt: Schema.NullOr<typeof Schema.String>;
+}>;
+export type AdminServiceImageStatusRow = typeof AdminServiceImageStatusRow.Type;
+/**
+ * Response of `GET /admin/services/image-status`.
+ *
+ * Always returns one row per Platform service (controller, api, runtime,
+ * web, exec-server, storage-gateway, storage-worker). Missing rows on
+ * either side surface as `dbRef=null` or `k8sRef=null` so the probe can
+ * still page on configuration drift, not just digest drift.
+ */
+export declare const AdminServiceImageStatusResult: Schema.Struct<{
+    services: Schema.Array$<Schema.Struct<{
+        name: typeof Schema.String;
+        dbRef: Schema.NullOr<typeof Schema.String>;
+        k8sRef: Schema.NullOr<typeof Schema.String>;
+        driftMinutes: Schema.NullOr<typeof Schema.Number>;
+        inSync: typeof Schema.Boolean;
+        dbUpdatedAt: Schema.NullOr<typeof Schema.String>;
+    }>>;
+    checkedAt: typeof Schema.String;
+}>;
+export type AdminServiceImageStatusResult = typeof AdminServiceImageStatusResult.Type;
+//# sourceMappingURL=admin-services.d.ts.map

package/dist/schemas/admin-services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-services.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,0BAA0B;;;;;;;EAOrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B;;;;;;;;;;EAGxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-services.js

@@ -0,0 +1,61 @@
+/**
+ * Admin Services — operator-only image-status drift schemas (drift-watchdog).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/services.ts`.
+ *
+ * The drift watchdog (`infra/addons/dogfood-smoke/manifests/image-drift-cronjob.yaml`)
+ * polls this endpoint every 10 minutes. For each Platform service it
+ * compares:
+ *
+ *   - DB SSOT — `project_services.latest_image_ref` (the digest the
+ *               build pipeline says is current).
+ *   - K8s live — `deployment.spec.template.spec.containers[0].image`
+ *                (the digest actually rolling on cluster).
+ *
+ * When the two diverge for >30 minutes the probe pages on-call. Inside the
+ * 30-minute grace window drift is tolerated (legit during a rolling deploy
+ * or a fresh build that hasn't propagated yet).
+ *
+ * Plane: `admin` (super-admin / scoped service-token only — scope
+ * `platform:services:read`).
+ */
+import { Schema } from 'effect';
+/**
+ * One row of the image-status report.
+ *
+ *   - `name`         — service name within the platform project
+ *                       (e.g. `api`, `controller`, `runtime`).
+ *   - `dbRef`        — `latest_image_ref` from `project_services`.
+ *                       `null` if the service has never been built.
+ *   - `k8sRef`       — image string from the live `Deployment`.
+ *                       `null` if the deployment is missing in K8s.
+ *   - `driftMinutes` — minutes since the divergence first appeared.
+ *                       `0` when DB and K8s agree (or both null).
+ *                       `null` when one side is missing.
+ *   - `inSync`       — `true` iff `dbRef === k8sRef` AND both non-null.
+ *                       Probes alert when this is `false` past the grace
+ *                       window.
+ *   - `dbUpdatedAt`  — ISO timestamp the DB row was last touched
+ *                       (`project_services.updated_at`). Drives the
+ *                       `driftMinutes` calculation when DB is the lagger.
+ */
+export const AdminServiceImageStatusRow = Schema.Struct({
+    name: Schema.String,
+    dbRef: Schema.NullOr(Schema.String),
+    k8sRef: Schema.NullOr(Schema.String),
+    driftMinutes: Schema.NullOr(Schema.Number),
+    inSync: Schema.Boolean,
+    dbUpdatedAt: Schema.NullOr(Schema.String),
+});
+/**
+ * Response of `GET /admin/services/image-status`.
+ *
+ * Always returns one row per Platform service (controller, api, runtime,
+ * web, exec-server, storage-gateway, storage-worker). Missing rows on
+ * either side surface as `dbRef=null` or `k8sRef=null` so the probe can
+ * still page on configuration drift, not just digest drift.
+ */
+export const AdminServiceImageStatusResult = Schema.Struct({
+    services: Schema.Array(AdminServiceImageStatusRow),
+    checkedAt: Schema.String,
+});