@sylphx/contract 0.2.0

package/dist/schemas/admin-traces.js

@@ -0,0 +1,128 @@
+/**
+ * Admin Traces — internal operator console schemas for request tracing.
+ * Mirrors `/admin/traces/*` in `apps/api/src/server/platform/routes/admin/traces.ts`.
+ *
+ * Plane: `admin`.
+ */
+import { Schema } from 'effect';
+export const AdminHttpMethod = Schema.Literal('GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS');
+export const AdminStatusFilter = Schema.Literal('all', '2xx', '3xx', '4xx', '5xx', 'error');
+export const AdminSpanStatus = Schema.Literal('ok', 'error', 'unset');
+export const AdminTracePeriod = Schema.Struct({
+    start: Schema.String,
+    end: Schema.String,
+});
+export const AdminTraceSummary = Schema.Struct({
+    id: Schema.String,
+    traceId: Schema.String,
+    method: AdminHttpMethod,
+    path: Schema.String,
+    statusCode: Schema.Number,
+    durationMs: Schema.Number,
+    userId: Schema.NullOr(Schema.String),
+    startedAt: Schema.String,
+    endedAt: Schema.String,
+    hasError: Schema.Boolean,
+});
+export const AdminTraceDetail = Schema.Struct({
+    id: Schema.String,
+    traceId: Schema.String,
+    projectId: Schema.String,
+    method: AdminHttpMethod,
+    path: Schema.String,
+    statusCode: Schema.Number,
+    durationMs: Schema.Number,
+    userId: Schema.NullOr(Schema.String),
+    metadata: Schema.NullOr(Schema.Record({ key: Schema.String, value: Schema.Unknown })),
+    startedAt: Schema.String,
+    endedAt: Schema.String,
+    createdAt: Schema.String,
+});
+export const AdminSpan = Schema.Struct({
+    id: Schema.String,
+    spanId: Schema.String,
+    parentSpanId: Schema.NullOr(Schema.String),
+    name: Schema.String,
+    service: Schema.String,
+    durationMs: Schema.Number,
+    status: AdminSpanStatus,
+    attributes: Schema.NullOr(Schema.Record({ key: Schema.String, value: Schema.Unknown })),
+    startedAt: Schema.String,
+    endedAt: Schema.String,
+    depth: Schema.Number,
+});
+export const AdminServiceBreakdown = Schema.Struct({
+    service: Schema.String,
+    totalDurationMs: Schema.Number,
+    spanCount: Schema.Number,
+});
+export const AdminSlowEndpoint = Schema.Struct({
+    path: Schema.String,
+    method: AdminHttpMethod,
+    avgDurationMs: Schema.Number,
+    p95Ms: Schema.Number,
+    requestCount: Schema.Number,
+});
+export const AdminErrorEndpoint = Schema.Struct({
+    path: Schema.String,
+    method: AdminHttpMethod,
+    errorCount: Schema.Number,
+    errorRate: Schema.Number,
+    requestCount: Schema.Number,
+});
+// ── Params ─────────────────────────────────────────────────────────────────
+export const AdminTracesProjectParams = Schema.Struct({ projectId: Schema.String });
+export const AdminTracesTraceParams = Schema.Struct({
+    projectId: Schema.String,
+    traceId: Schema.String,
+});
+// ── Query ──────────────────────────────────────────────────────────────────
+export const AdminGetTraceStatsQuery = Schema.Struct({
+    startDate: Schema.optional(Schema.String),
+    endDate: Schema.optional(Schema.String),
+});
+export const AdminListTracesQuery = Schema.Struct({
+    statusFilter: Schema.optional(AdminStatusFilter),
+    methods: Schema.optional(Schema.String),
+    pathPattern: Schema.optional(Schema.String),
+    minDurationMs: Schema.optional(Schema.String),
+    maxDurationMs: Schema.optional(Schema.String),
+    userId: Schema.optional(Schema.String),
+    startDate: Schema.optional(Schema.String),
+    endDate: Schema.optional(Schema.String),
+    limit: Schema.optional(Schema.String),
+    offset: Schema.optional(Schema.String),
+});
+export const AdminGetEndpointsQuery = Schema.Struct({
+    startDate: Schema.optional(Schema.String),
+    endDate: Schema.optional(Schema.String),
+    limit: Schema.optional(Schema.String),
+});
+// ── Responses ──────────────────────────────────────────────────────────────
+export const AdminTraceStatsResult = Schema.Struct({
+    totalRequests: Schema.Number,
+    errorCount: Schema.Number,
+    errorRate: Schema.Number,
+    avgDurationMs: Schema.Number,
+    p50Ms: Schema.Number,
+    p95Ms: Schema.Number,
+    p99Ms: Schema.Number,
+    requestsPerMinute: Schema.Number,
+    status2xx: Schema.Number,
+    status3xx: Schema.Number,
+    status4xx: Schema.Number,
+    status5xx: Schema.Number,
+    period: AdminTracePeriod,
+});
+export const AdminListTracesResult = Schema.Struct({
+    traces: Schema.Array(AdminTraceSummary),
+    total: Schema.Number,
+    hasMore: Schema.Boolean,
+});
+export const AdminGetTraceResult = Schema.Struct({
+    trace: AdminTraceDetail,
+    spans: Schema.Array(AdminSpan),
+    serviceBreakdown: Schema.Array(AdminServiceBreakdown),
+});
+export const AdminSlowEndpointsResult = Schema.Array(AdminSlowEndpoint);
+export const AdminErrorEndpointsResult = Schema.Array(AdminErrorEndpoint);

package/dist/schemas/admin-users.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Admin Users — internal operator console schemas for platform user management.
+ * Mirrors the wire shapes served at `/admin/users/*` in
+ * `apps/api/src/server/platform/routes/admin/users.ts`.
+ *
+ * Plane: `admin`. Only super-admin / admin platform roles reach these routes.
+ */
+import { Schema } from 'effect';
+export declare const AdminUserRole: Schema.Literal<["user", "admin", "super_admin"]>;
+export type AdminUserRole = typeof AdminUserRole.Type;
+export declare const AdminPlatformUser: Schema.Struct<{
+    id: typeof Schema.String;
+    email: typeof Schema.String;
+    name: Schema.NullOr<typeof Schema.String>;
+    image: Schema.NullOr<typeof Schema.String>;
+    role: Schema.Literal<["user", "admin", "super_admin"]>;
+    emailVerified: typeof Schema.Boolean;
+    createdAt: typeof Schema.String;
+}>;
+export type AdminPlatformUser = typeof AdminPlatformUser.Type;
+export declare const AdminUserSession: Schema.Struct<{
+    id: typeof Schema.String;
+    ipAddress: Schema.NullOr<typeof Schema.String>;
+    userAgent: Schema.NullOr<typeof Schema.String>;
+    deviceName: Schema.NullOr<typeof Schema.String>;
+    browser: Schema.NullOr<typeof Schema.String>;
+    os: Schema.NullOr<typeof Schema.String>;
+    deviceType: Schema.NullOr<typeof Schema.String>;
+    country: Schema.NullOr<typeof Schema.String>;
+    city: Schema.NullOr<typeof Schema.String>;
+    lastActiveAt: typeof Schema.String;
+    createdAt: typeof Schema.String;
+    expiresAt: typeof Schema.String;
+}>;
+export type AdminUserSession = typeof AdminUserSession.Type;
+export declare const AdminProjectMembership: Schema.Struct<{
+    projectId: typeof Schema.String;
+    projectName: typeof Schema.String;
+    role: typeof Schema.String;
+}>;
+export type AdminProjectMembership = typeof AdminProjectMembership.Type;
+export declare const AdminUserSubscription: Schema.Struct<{
+    projectId: typeof Schema.String;
+    projectName: typeof Schema.String;
+    planName: typeof Schema.String;
+    status: typeof Schema.String;
+}>;
+export type AdminUserSubscription = typeof AdminUserSubscription.Type;
+export declare const AdminUserIdParams: Schema.Struct<{
+    userId: typeof Schema.String;
+}>;
+export type AdminUserIdParams = typeof AdminUserIdParams.Type;
+export declare const AdminRevokeSessionParams: Schema.Struct<{
+    userId: typeof Schema.String;
+    sessionId: typeof Schema.String;
+}>;
+export type AdminRevokeSessionParams = typeof AdminRevokeSessionParams.Type;
+/**
+ * Search users query — all string-shaped on the wire. The route handler
+ * coerces `limit` / `offset` via helpers; `statsOnly === 'true'` switches
+ * to the aggregate response variant that the Console security dashboard uses.
+ */
+export declare const AdminSearchUsersQuery: Schema.Struct<{
+    query: Schema.optional<typeof Schema.String>;
+    limit: Schema.optional<typeof Schema.String>;
+    offset: Schema.optional<typeof Schema.String>;
+    statsOnly: Schema.optional<typeof Schema.String>;
+}>;
+export type AdminSearchUsersQuery = typeof AdminSearchUsersQuery.Type;
+export declare const AdminUpdateUserRoleInput: Schema.Struct<{
+    role: Schema.Literal<["user", "admin", "super_admin"]>;
+}>;
+export type AdminUpdateUserRoleInput = typeof AdminUpdateUserRoleInput.Type;
+/** Union wire shape: list view OR aggregate security stats. */
+export declare const AdminSearchUsersResult: Schema.Union<[Schema.Struct<{
+    users: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        email: typeof Schema.String;
+        name: Schema.NullOr<typeof Schema.String>;
+        image: Schema.NullOr<typeof Schema.String>;
+        role: Schema.Literal<["user", "admin", "super_admin"]>;
+        emailVerified: typeof Schema.Boolean;
+        createdAt: typeof Schema.String;
+    }>>;
+    total: typeof Schema.Number;
+    limit: typeof Schema.Number;
+    offset: typeof Schema.Number;
+}>, Schema.Struct<{
+    totalUsers: typeof Schema.Number;
+    twoFactorEnabled: typeof Schema.Number;
+    emailVerified: typeof Schema.Number;
+    unreadAlerts: typeof Schema.Number;
+}>]>;
+export type AdminSearchUsersResult = typeof AdminSearchUsersResult.Type;
+export declare const AdminGetUserResult: Schema.Struct<{
+    id: typeof Schema.String;
+    email: typeof Schema.String;
+    name: Schema.NullOr<typeof Schema.String>;
+    image: Schema.NullOr<typeof Schema.String>;
+    role: Schema.Literal<["user", "admin", "super_admin"]>;
+    emailVerified: typeof Schema.Boolean;
+    twoFactorEnabled: typeof Schema.Boolean;
+    createdAt: typeof Schema.String;
+    projects: Schema.Array$<Schema.Struct<{
+        projectId: typeof Schema.String;
+        projectName: typeof Schema.String;
+        role: typeof Schema.String;
+    }>>;
+    subscriptions: Schema.Array$<Schema.Struct<{
+        projectId: typeof Schema.String;
+        projectName: typeof Schema.String;
+        planName: typeof Schema.String;
+        status: typeof Schema.String;
+    }>>;
+}>;
+export type AdminGetUserResult = typeof AdminGetUserResult.Type;
+export declare const AdminUpdateUserRoleResult: Schema.Struct<{
+    id: typeof Schema.String;
+    role: Schema.Literal<["user", "admin", "super_admin"]>;
+}>;
+export type AdminUpdateUserRoleResult = typeof AdminUpdateUserRoleResult.Type;
+export declare const AdminDeleteUserResult: Schema.Struct<{
+    id: typeof Schema.String;
+    email: typeof Schema.String;
+}>;
+export type AdminDeleteUserResult = typeof AdminDeleteUserResult.Type;
+export declare const AdminGetUserSessionsResult: Schema.Struct<{
+    sessions: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        ipAddress: Schema.NullOr<typeof Schema.String>;
+        userAgent: Schema.NullOr<typeof Schema.String>;
+        deviceName: Schema.NullOr<typeof Schema.String>;
+        browser: Schema.NullOr<typeof Schema.String>;
+        os: Schema.NullOr<typeof Schema.String>;
+        deviceType: Schema.NullOr<typeof Schema.String>;
+        country: Schema.NullOr<typeof Schema.String>;
+        city: Schema.NullOr<typeof Schema.String>;
+        lastActiveAt: typeof Schema.String;
+        createdAt: typeof Schema.String;
+        expiresAt: typeof Schema.String;
+    }>>;
+}>;
+export type AdminGetUserSessionsResult = typeof AdminGetUserSessionsResult.Type;
+export declare const AdminRevokeUserSessionsResult: Schema.Struct<{
+    userId: typeof Schema.String;
+    revokedCount: typeof Schema.Number;
+}>;
+export type AdminRevokeUserSessionsResult = typeof AdminRevokeUserSessionsResult.Type;
+export declare const AdminRevokeSessionResult: Schema.Struct<{
+    sessionId: typeof Schema.String;
+}>;
+export type AdminRevokeSessionResult = typeof AdminRevokeSessionResult.Type;
+export declare const AdminVerifyUserEmailResult: Schema.Struct<{
+    id: typeof Schema.String;
+    email: typeof Schema.String;
+}>;
+export type AdminVerifyUserEmailResult = typeof AdminVerifyUserEmailResult.Type;
+//# sourceMappingURL=admin-users.d.ts.map

package/dist/schemas/admin-users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-users.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,aAAa,kDAAiD,CAAA;AAC3E,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD,eAAO,MAAM,iBAAiB;;;;;;;;EAQ5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;EAa3B,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,eAAO,MAAM,sBAAsB;;;;EAIjC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,qBAAqB;;;;;EAKhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAIrE,eAAO,MAAM,iBAAiB;;EAA2C,CAAA;AACzE,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAC7D,eAAO,MAAM,wBAAwB;;;EAGnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAI3E;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;EAKhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAIrE,eAAO,MAAM,wBAAwB;;EAEnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAI3E,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;IAalC,CAAA;AACD,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;EAW7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,yBAAyB;;;EAGpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAE7E,eAAO,MAAM,qBAAqB;;;EAGhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;EAErC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,6BAA6B;;;EAGxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA;AAErF,eAAO,MAAM,wBAAwB;;EAA8C,CAAA;AACnF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,0BAA0B;;;EAGrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-users.js

@@ -0,0 +1,110 @@
+/**
+ * Admin Users — internal operator console schemas for platform user management.
+ * Mirrors the wire shapes served at `/admin/users/*` in
+ * `apps/api/src/server/platform/routes/admin/users.ts`.
+ *
+ * Plane: `admin`. Only super-admin / admin platform roles reach these routes.
+ */
+import { Schema } from 'effect';
+export const AdminUserRole = Schema.Literal('user', 'admin', 'super_admin');
+export const AdminPlatformUser = Schema.Struct({
+    id: Schema.String,
+    email: Schema.String,
+    name: Schema.NullOr(Schema.String),
+    image: Schema.NullOr(Schema.String),
+    role: AdminUserRole,
+    emailVerified: Schema.Boolean,
+    createdAt: Schema.String,
+});
+export const AdminUserSession = Schema.Struct({
+    id: Schema.String,
+    ipAddress: Schema.NullOr(Schema.String),
+    userAgent: Schema.NullOr(Schema.String),
+    deviceName: Schema.NullOr(Schema.String),
+    browser: Schema.NullOr(Schema.String),
+    os: Schema.NullOr(Schema.String),
+    deviceType: Schema.NullOr(Schema.String),
+    country: Schema.NullOr(Schema.String),
+    city: Schema.NullOr(Schema.String),
+    lastActiveAt: Schema.String,
+    createdAt: Schema.String,
+    expiresAt: Schema.String,
+});
+export const AdminProjectMembership = Schema.Struct({
+    projectId: Schema.String,
+    projectName: Schema.String,
+    role: Schema.String,
+});
+export const AdminUserSubscription = Schema.Struct({
+    projectId: Schema.String,
+    projectName: Schema.String,
+    planName: Schema.String,
+    status: Schema.String,
+});
+// ── Params ─────────────────────────────────────────────────────────────────
+export const AdminUserIdParams = Schema.Struct({ userId: Schema.String });
+export const AdminRevokeSessionParams = Schema.Struct({
+    userId: Schema.String,
+    sessionId: Schema.String,
+});
+// ── Query ──────────────────────────────────────────────────────────────────
+/**
+ * Search users query — all string-shaped on the wire. The route handler
+ * coerces `limit` / `offset` via helpers; `statsOnly === 'true'` switches
+ * to the aggregate response variant that the Console security dashboard uses.
+ */
+export const AdminSearchUsersQuery = Schema.Struct({
+    query: Schema.optional(Schema.String),
+    limit: Schema.optional(Schema.String),
+    offset: Schema.optional(Schema.String),
+    statsOnly: Schema.optional(Schema.String),
+});
+// ── Inputs ─────────────────────────────────────────────────────────────────
+export const AdminUpdateUserRoleInput = Schema.Struct({
+    role: AdminUserRole,
+});
+// ── Responses ──────────────────────────────────────────────────────────────
+/** Union wire shape: list view OR aggregate security stats. */
+export const AdminSearchUsersResult = Schema.Union(Schema.Struct({
+    users: Schema.Array(AdminPlatformUser),
+    total: Schema.Number,
+    limit: Schema.Number,
+    offset: Schema.Number,
+}), Schema.Struct({
+    totalUsers: Schema.Number,
+    twoFactorEnabled: Schema.Number,
+    emailVerified: Schema.Number,
+    unreadAlerts: Schema.Number,
+}));
+export const AdminGetUserResult = Schema.Struct({
+    id: Schema.String,
+    email: Schema.String,
+    name: Schema.NullOr(Schema.String),
+    image: Schema.NullOr(Schema.String),
+    role: AdminUserRole,
+    emailVerified: Schema.Boolean,
+    twoFactorEnabled: Schema.Boolean,
+    createdAt: Schema.String,
+    projects: Schema.Array(AdminProjectMembership),
+    subscriptions: Schema.Array(AdminUserSubscription),
+});
+export const AdminUpdateUserRoleResult = Schema.Struct({
+    id: Schema.String,
+    role: AdminUserRole,
+});
+export const AdminDeleteUserResult = Schema.Struct({
+    id: Schema.String,
+    email: Schema.String,
+});
+export const AdminGetUserSessionsResult = Schema.Struct({
+    sessions: Schema.Array(AdminUserSession),
+});
+export const AdminRevokeUserSessionsResult = Schema.Struct({
+    userId: Schema.String,
+    revokedCount: Schema.Number,
+});
+export const AdminRevokeSessionResult = Schema.Struct({ sessionId: Schema.String });
+export const AdminVerifyUserEmailResult = Schema.Struct({
+    id: Schema.String,
+    email: Schema.String,
+});

package/dist/schemas/admin-webhook-signature-versions.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Webhook Signature Versions — admin schemas (SoC Round 3A G-2).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/webhook-signature-versions.ts`.
+ * Operator-controlled registry of active signature versions. Stripe-style
+ * dual-signature emission during HMAC algorithm rotation.
+ *
+ * Plane: `admin` (service-token only — `platform:webhooks:rotate`).
+ */
+import { Schema } from 'effect';
+/**
+ * Algorithm identifier. Mirrors `WEBHOOK_SIGNATURE_ALGORITHMS` in
+ * `packages/core/src/lib/db/schema/webhook-signature-versions.ts`.
+ *
+ * v1 is pinned to `HMAC-SHA256` at the DB layer; the `WebhookSignature
+ * VersionError` taxonomy on the server side returns 400 for any attempt
+ * to register `version=1` with a different algorithm.
+ */
+export declare const WebhookSignatureAlgorithm: Schema.Literal<["HMAC-SHA256", "HMAC-SHA512"]>;
+export type WebhookSignatureAlgorithm = typeof WebhookSignatureAlgorithm.Type;
+/** One registry row in API representation. */
+export declare const WebhookSignatureVersionRecord: Schema.Struct<{
+    version: typeof Schema.Number;
+    algorithm: Schema.Literal<["HMAC-SHA256", "HMAC-SHA512"]>;
+    hmacKeyKmsId: Schema.NullOr<typeof Schema.String>;
+    active: typeof Schema.Boolean;
+    createdAt: typeof Schema.String;
+    retiredAt: Schema.NullOr<typeof Schema.String>;
+    updatedAt: typeof Schema.String;
+    updatedBy: Schema.NullOr<typeof Schema.String>;
+}>;
+export type WebhookSignatureVersionRecord = typeof WebhookSignatureVersionRecord.Type;
+export declare const ListWebhookSignatureVersionsResponse: Schema.Struct<{
+    versions: Schema.Array$<Schema.Struct<{
+        version: typeof Schema.Number;
+        algorithm: Schema.Literal<["HMAC-SHA256", "HMAC-SHA512"]>;
+        hmacKeyKmsId: Schema.NullOr<typeof Schema.String>;
+        active: typeof Schema.Boolean;
+        createdAt: typeof Schema.String;
+        retiredAt: Schema.NullOr<typeof Schema.String>;
+        updatedAt: typeof Schema.String;
+        updatedBy: Schema.NullOr<typeof Schema.String>;
+    }>>;
+}>;
+export type ListWebhookSignatureVersionsResponse = typeof ListWebhookSignatureVersionsResponse.Type;
+/**
+ * Body for `POST /admin/webhooks/signature-versions`. Operators install
+ * a new version with `active=false` initially, then flip `active=true`
+ * via the PATCH endpoint once they're ready to start emitting it.
+ *
+ * Constraints:
+ *   - `version > 0` and not already in the registry.
+ *   - If `version === 1` then `algorithm` MUST be `HMAC-SHA256` (DB
+ *     CHECK; handler also enforces).
+ */
+export declare const CreateWebhookSignatureVersionInput: Schema.Struct<{
+    version: Schema.filter<Schema.filter<typeof Schema.Number>>;
+    algorithm: Schema.Literal<["HMAC-SHA256", "HMAC-SHA512"]>;
+    hmacKeyKmsId: Schema.optional<typeof Schema.String>;
+    active: Schema.optional<typeof Schema.Boolean>;
+}>;
+export type CreateWebhookSignatureVersionInput = typeof CreateWebhookSignatureVersionInput.Type;
+export declare const CreateWebhookSignatureVersionResponse: Schema.Struct<{
+    version: typeof Schema.Number;
+    algorithm: Schema.Literal<["HMAC-SHA256", "HMAC-SHA512"]>;
+    hmacKeyKmsId: Schema.NullOr<typeof Schema.String>;
+    active: typeof Schema.Boolean;
+    createdAt: typeof Schema.String;
+    retiredAt: Schema.NullOr<typeof Schema.String>;
+    updatedAt: typeof Schema.String;
+    updatedBy: Schema.NullOr<typeof Schema.String>;
+}>;
+/**
+ * Body for `PATCH /admin/webhooks/signature-versions/:version`.
+ *
+ * Allowed transitions:
+ *   - `active: true` — start emitting this version. May be combined
+ *     with v1 active for dual-signing during rotation.
+ *   - `active: false` — stop emitting (v1 may not be deactivated while
+ *     it is the only active row; the handler enforces).
+ *   - `retire: true` — mark `retired_at = now()` AND set `active=false`.
+ *     Retired versions cannot be re-activated; create a new version row.
+ */
+export declare const UpdateWebhookSignatureVersionInput: Schema.Struct<{
+    active: Schema.optional<typeof Schema.Boolean>;
+    retire: Schema.optional<typeof Schema.Boolean>;
+}>;
+export type UpdateWebhookSignatureVersionInput = typeof UpdateWebhookSignatureVersionInput.Type;
+export declare const UpdateWebhookSignatureVersionResponse: Schema.Struct<{
+    version: typeof Schema.Number;
+    algorithm: Schema.Literal<["HMAC-SHA256", "HMAC-SHA512"]>;
+    hmacKeyKmsId: Schema.NullOr<typeof Schema.String>;
+    active: typeof Schema.Boolean;
+    createdAt: typeof Schema.String;
+    retiredAt: Schema.NullOr<typeof Schema.String>;
+    updatedAt: typeof Schema.String;
+    updatedBy: Schema.NullOr<typeof Schema.String>;
+}>;
+export declare const WebhookSignatureVersionParams: Schema.Struct<{
+    version: Schema.filter<Schema.filter<typeof Schema.NumberFromString>>;
+}>;
+export type WebhookSignatureVersionParams = typeof WebhookSignatureVersionParams.Type;
+//# sourceMappingURL=admin-webhook-signature-versions.d.ts.map

package/dist/schemas/admin-webhook-signature-versions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-webhook-signature-versions.d.ts","sourceRoot":"","sources":["../../src/schemas/admin-webhook-signature-versions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,gDAA+C,CAAA;AACrF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAE7E,8CAA8C;AAC9C,eAAO,MAAM,6BAA6B;;;;;;;;;EASxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA;AAIrF,eAAO,MAAM,oCAAoC;;;;;;;;;;;EAE/C,CAAA;AACF,MAAM,MAAM,oCAAoC,GAAG,OAAO,oCAAoC,CAAC,IAAI,CAAA;AAInG;;;;;;;;;GASG;AACH,eAAO,MAAM,kCAAkC;;;;;EAQ7C,CAAA;AACF,MAAM,MAAM,kCAAkC,GAAG,OAAO,kCAAkC,CAAC,IAAI,CAAA;AAE/F,eAAO,MAAM,qCAAqC;;;;;;;;;EAAgC,CAAA;AAIlF;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kCAAkC;;;EAG7C,CAAA;AACF,MAAM,MAAM,kCAAkC,GAAG,OAAO,kCAAkC,CAAC,IAAI,CAAA;AAE/F,eAAO,MAAM,qCAAqC;;;;;;;;;EAAgC,CAAA;AAIlF,eAAO,MAAM,6BAA6B;;EAKxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA"}

package/dist/schemas/admin-webhook-signature-versions.js

@@ -0,0 +1,73 @@
+/**
+ * Webhook Signature Versions — admin schemas (SoC Round 3A G-2).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/webhook-signature-versions.ts`.
+ * Operator-controlled registry of active signature versions. Stripe-style
+ * dual-signature emission during HMAC algorithm rotation.
+ *
+ * Plane: `admin` (service-token only — `platform:webhooks:rotate`).
+ */
+import { Schema } from 'effect';
+/**
+ * Algorithm identifier. Mirrors `WEBHOOK_SIGNATURE_ALGORITHMS` in
+ * `packages/core/src/lib/db/schema/webhook-signature-versions.ts`.
+ *
+ * v1 is pinned to `HMAC-SHA256` at the DB layer; the `WebhookSignature
+ * VersionError` taxonomy on the server side returns 400 for any attempt
+ * to register `version=1` with a different algorithm.
+ */
+export const WebhookSignatureAlgorithm = Schema.Literal('HMAC-SHA256', 'HMAC-SHA512');
+/** One registry row in API representation. */
+export const WebhookSignatureVersionRecord = Schema.Struct({
+    version: Schema.Number,
+    algorithm: WebhookSignatureAlgorithm,
+    hmacKeyKmsId: Schema.NullOr(Schema.String),
+    active: Schema.Boolean,
+    createdAt: Schema.String,
+    retiredAt: Schema.NullOr(Schema.String),
+    updatedAt: Schema.String,
+    updatedBy: Schema.NullOr(Schema.String),
+});
+// ─── List ──────────────────────────────────────────────────────────────
+export const ListWebhookSignatureVersionsResponse = Schema.Struct({
+    versions: Schema.Array(WebhookSignatureVersionRecord),
+});
+// ─── Create ────────────────────────────────────────────────────────────
+/**
+ * Body for `POST /admin/webhooks/signature-versions`. Operators install
+ * a new version with `active=false` initially, then flip `active=true`
+ * via the PATCH endpoint once they're ready to start emitting it.
+ *
+ * Constraints:
+ *   - `version > 0` and not already in the registry.
+ *   - If `version === 1` then `algorithm` MUST be `HMAC-SHA256` (DB
+ *     CHECK; handler also enforces).
+ */
+export const CreateWebhookSignatureVersionInput = Schema.Struct({
+    version: Schema.Number.pipe(Schema.int(), Schema.greaterThan(0, { message: () => 'version must be > 0' })),
+    algorithm: WebhookSignatureAlgorithm,
+    hmacKeyKmsId: Schema.optional(Schema.String),
+    active: Schema.optional(Schema.Boolean),
+});
+export const CreateWebhookSignatureVersionResponse = WebhookSignatureVersionRecord;
+// ─── Update (toggle active / retire) ──────────────────────────────────
+/**
+ * Body for `PATCH /admin/webhooks/signature-versions/:version`.
+ *
+ * Allowed transitions:
+ *   - `active: true` — start emitting this version. May be combined
+ *     with v1 active for dual-signing during rotation.
+ *   - `active: false` — stop emitting (v1 may not be deactivated while
+ *     it is the only active row; the handler enforces).
+ *   - `retire: true` — mark `retired_at = now()` AND set `active=false`.
+ *     Retired versions cannot be re-activated; create a new version row.
+ */
+export const UpdateWebhookSignatureVersionInput = Schema.Struct({
+    active: Schema.optional(Schema.Boolean),
+    retire: Schema.optional(Schema.Boolean),
+});
+export const UpdateWebhookSignatureVersionResponse = WebhookSignatureVersionRecord;
+// ─── URL params ────────────────────────────────────────────────────────
+export const WebhookSignatureVersionParams = Schema.Struct({
+    version: Schema.NumberFromString.pipe(Schema.int(), Schema.greaterThan(0, { message: () => 'version must be > 0' })),
+});

package/dist/schemas/ai-admin.d.ts

@@ -0,0 +1,39 @@
+/**
+ * AI Admin — schemas for Console-plane AI usage analytics + model config.
+ * Mirrors `routes/ai.ts`.
+ *
+ * Plane: `management`. Response shapes for analytics aggregations use
+ * `Schema.Unknown` — they're computed breakdowns that evolve over time.
+ */
+import { Schema } from 'effect';
+export declare const AiAdminProjectIdParams: Schema.Struct<{
+    projectId: typeof Schema.String;
+}>;
+export type AiAdminProjectIdParams = typeof AiAdminProjectIdParams.Type;
+export declare const AiOverviewQuery: Schema.Struct<{
+    period: Schema.optional<Schema.Literal<["day", "week", "month"]>>;
+}>;
+export type AiOverviewQuery = typeof AiOverviewQuery.Type;
+export declare const AiCostTrendsQuery: Schema.Struct<{
+    period: Schema.optional<Schema.Literal<["day", "week", "month"]>>;
+    interval: Schema.optional<Schema.Literal<["hour", "day"]>>;
+    projectId: Schema.optional<typeof Schema.String>;
+}>;
+export type AiCostTrendsQuery = typeof AiCostTrendsQuery.Type;
+export declare const AiProjectUsageQuery: Schema.Struct<{
+    period: Schema.optional<Schema.Literal<["day", "week", "month"]>>;
+}>;
+export type AiProjectUsageQuery = typeof AiProjectUsageQuery.Type;
+export declare const AiOverviewResult: typeof Schema.Unknown;
+export type AiOverviewResult = typeof AiOverviewResult.Type;
+export declare const AiProjectUsageResult: typeof Schema.Unknown;
+export type AiProjectUsageResult = typeof AiProjectUsageResult.Type;
+export declare const AiCostTrendsResult: typeof Schema.Unknown;
+export type AiCostTrendsResult = typeof AiCostTrendsResult.Type;
+export declare const AiProjectConfigResult: typeof Schema.Unknown;
+export type AiProjectConfigResult = typeof AiProjectConfigResult.Type;
+export declare const AiUpdateProjectConfigInput: Schema.Record$<typeof Schema.String, typeof Schema.Unknown>;
+export type AiUpdateProjectConfigInput = typeof AiUpdateProjectConfigInput.Type;
+export declare const AiUpdateProjectConfigResult: typeof Schema.Unknown;
+export type AiUpdateProjectConfigResult = typeof AiUpdateProjectConfigResult.Type;
+//# sourceMappingURL=ai-admin.d.ts.map

package/dist/schemas/ai-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-admin.d.ts","sourceRoot":"","sources":["../../src/schemas/ai-admin.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,sBAAsB;;EAA8C,CAAA;AACjF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAEvE,eAAO,MAAM,eAAe;;EAE1B,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD,eAAO,MAAM,iBAAiB;;;;EAI5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,mBAAmB;;EAE9B,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE,eAAO,MAAM,gBAAgB,uBAAiB,CAAA;AAC9C,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAC3D,eAAO,MAAM,oBAAoB,uBAAiB,CAAA;AAClD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AACnE,eAAO,MAAM,kBAAkB,uBAAiB,CAAA;AAChD,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAC/D,eAAO,MAAM,qBAAqB,uBAAiB,CAAA;AACnD,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,0BAA0B,6DAGrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAC/E,eAAO,MAAM,2BAA2B,uBAAiB,CAAA;AACzD,MAAM,MAAM,2BAA2B,GAAG,OAAO,2BAA2B,CAAC,IAAI,CAAA"}

package/dist/schemas/ai-admin.js

@@ -0,0 +1,29 @@
+/**
+ * AI Admin — schemas for Console-plane AI usage analytics + model config.
+ * Mirrors `routes/ai.ts`.
+ *
+ * Plane: `management`. Response shapes for analytics aggregations use
+ * `Schema.Unknown` — they're computed breakdowns that evolve over time.
+ */
+import { Schema } from 'effect';
+export const AiAdminProjectIdParams = Schema.Struct({ projectId: Schema.String });
+export const AiOverviewQuery = Schema.Struct({
+    period: Schema.optional(Schema.Literal('day', 'week', 'month')),
+});
+export const AiCostTrendsQuery = Schema.Struct({
+    period: Schema.optional(Schema.Literal('day', 'week', 'month')),
+    interval: Schema.optional(Schema.Literal('hour', 'day')),
+    projectId: Schema.optional(Schema.String),
+});
+export const AiProjectUsageQuery = Schema.Struct({
+    period: Schema.optional(Schema.Literal('day', 'week', 'month')),
+});
+export const AiOverviewResult = Schema.Unknown;
+export const AiProjectUsageResult = Schema.Unknown;
+export const AiCostTrendsResult = Schema.Unknown;
+export const AiProjectConfigResult = Schema.Unknown;
+export const AiUpdateProjectConfigInput = Schema.Record({
+    key: Schema.String,
+    value: Schema.Unknown,
+});
+export const AiUpdateProjectConfigResult = Schema.Unknown;