@sylphx/contract 0.2.0

package/dist/schemas/audit-chain.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Audit Chain — verification-status read schemas (SoC Round 3A G-3).
+ *
+ * The verifier cron writes one row per detected break into
+ * `audit_chain_failures`. This schema describes the read surface served
+ * at `GET /admin/audit-chain/status` for operators / SoC-2 auditors who
+ * need a compliance-grade view of the verifier's history.
+ *
+ * Plane: `admin` (super-admin / service-token only).
+ */
+import { Schema } from 'effect';
+/** One historical failure row, as returned to operator consoles. */
+export declare const AuditChainFailureRecord: Schema.Struct<{
+    id: typeof Schema.String;
+    detectedAt: typeof Schema.String;
+    runId: typeof Schema.String;
+    kind: Schema.Literal<["chain_break", "row_hash_mismatch", "checkpoint_missing", "checkpoint_signature_invalid"]>;
+    partialBreakAuditId: Schema.NullOr<typeof Schema.String>;
+    partialBreakIndex: Schema.NullOr<typeof Schema.Number>;
+    /** Hex-encoded SHA-256 digest the verifier RECOMPUTED. */
+    expectedHash: Schema.NullOr<typeof Schema.String>;
+    /** Hex-encoded SHA-256 digest the DB STORED. */
+    actualHash: Schema.NullOr<typeof Schema.String>;
+    missingEventCount: Schema.NullOr<typeof Schema.Number>;
+    details: Schema.NullOr<typeof Schema.String>;
+    status: Schema.Literal<["open", "acknowledged", "resolved"]>;
+    acknowledgedAt: Schema.NullOr<typeof Schema.String>;
+    acknowledgedBy: Schema.NullOr<typeof Schema.String>;
+    resolvedAt: Schema.NullOr<typeof Schema.String>;
+    resolution: Schema.NullOr<typeof Schema.String>;
+}>;
+export type AuditChainFailureRecord = typeof AuditChainFailureRecord.Type;
+/**
+ * Top-level chain-status response.
+ *
+ *   - `latestCheckpoint` — the most recent signed chain tip, NULL when
+ *     no checkpoint has been written yet (genesis / signer outage).
+ *   - `latestVerification` — the verifier's most recent `audit_chain_failures`
+ *     row, OR a synthetic `ok` record when the table is empty (steady state).
+ *   - `openFailures` — count of rows still in `status='open'`. SoC-2
+ *     auditors will scrutinise any non-zero value.
+ *   - `failures` — most recent N failure rows, newest first.
+ */
+export declare const AuditChainStatusResponse: Schema.Struct<{
+    latestCheckpoint: Schema.NullOr<Schema.Struct<{
+        id: typeof Schema.String;
+        chainTipId: typeof Schema.String;
+        chainTipHash: typeof Schema.String;
+        signingKeyId: typeof Schema.String;
+        rowCount: typeof Schema.Number;
+        signedAt: typeof Schema.String;
+    }>>;
+    latestVerification: Schema.NullOr<Schema.Struct<{
+        detectedAt: typeof Schema.String;
+        runId: typeof Schema.String;
+        kind: Schema.Literal<["chain_break", "row_hash_mismatch", "checkpoint_missing", "checkpoint_signature_invalid"]>;
+        status: Schema.Literal<["open", "acknowledged", "resolved"]>;
+    }>>;
+    openFailureCount: typeof Schema.Number;
+    failures: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        detectedAt: typeof Schema.String;
+        runId: typeof Schema.String;
+        kind: Schema.Literal<["chain_break", "row_hash_mismatch", "checkpoint_missing", "checkpoint_signature_invalid"]>;
+        partialBreakAuditId: Schema.NullOr<typeof Schema.String>;
+        partialBreakIndex: Schema.NullOr<typeof Schema.Number>;
+        /** Hex-encoded SHA-256 digest the verifier RECOMPUTED. */
+        expectedHash: Schema.NullOr<typeof Schema.String>;
+        /** Hex-encoded SHA-256 digest the DB STORED. */
+        actualHash: Schema.NullOr<typeof Schema.String>;
+        missingEventCount: Schema.NullOr<typeof Schema.Number>;
+        details: Schema.NullOr<typeof Schema.String>;
+        status: Schema.Literal<["open", "acknowledged", "resolved"]>;
+        acknowledgedAt: Schema.NullOr<typeof Schema.String>;
+        acknowledgedBy: Schema.NullOr<typeof Schema.String>;
+        resolvedAt: Schema.NullOr<typeof Schema.String>;
+        resolution: Schema.NullOr<typeof Schema.String>;
+    }>>;
+}>;
+export type AuditChainStatusResponse = typeof AuditChainStatusResponse.Type;
+//# sourceMappingURL=audit-chain.d.ts.map

package/dist/schemas/audit-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-chain.d.ts","sourceRoot":"","sources":["../../src/schemas/audit-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAU/B,oEAAoE;AACpE,eAAO,MAAM,uBAAuB;;;;;;;IAOnC,0DAA0D;;IAE1D,gDAAgD;;;;;;;;;EAS/C,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;QAzBpC,0DAA0D;;QAE1D,gDAAgD;;;;;;;;;;EA4C/C,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA"}

package/dist/schemas/audit-chain.js

@@ -0,0 +1,62 @@
+/**
+ * Audit Chain — verification-status read schemas (SoC Round 3A G-3).
+ *
+ * The verifier cron writes one row per detected break into
+ * `audit_chain_failures`. This schema describes the read surface served
+ * at `GET /admin/audit-chain/status` for operators / SoC-2 auditors who
+ * need a compliance-grade view of the verifier's history.
+ *
+ * Plane: `admin` (super-admin / service-token only).
+ */
+import { Schema } from 'effect';
+const FailureStatus = Schema.Literal('open', 'acknowledged', 'resolved');
+const FailureKind = Schema.Literal('chain_break', 'row_hash_mismatch', 'checkpoint_missing', 'checkpoint_signature_invalid');
+/** One historical failure row, as returned to operator consoles. */
+export const AuditChainFailureRecord = Schema.Struct({
+    id: Schema.String,
+    detectedAt: Schema.String,
+    runId: Schema.String,
+    kind: FailureKind,
+    partialBreakAuditId: Schema.NullOr(Schema.String),
+    partialBreakIndex: Schema.NullOr(Schema.Number),
+    /** Hex-encoded SHA-256 digest the verifier RECOMPUTED. */
+    expectedHash: Schema.NullOr(Schema.String),
+    /** Hex-encoded SHA-256 digest the DB STORED. */
+    actualHash: Schema.NullOr(Schema.String),
+    missingEventCount: Schema.NullOr(Schema.Number),
+    details: Schema.NullOr(Schema.String),
+    status: FailureStatus,
+    acknowledgedAt: Schema.NullOr(Schema.String),
+    acknowledgedBy: Schema.NullOr(Schema.String),
+    resolvedAt: Schema.NullOr(Schema.String),
+    resolution: Schema.NullOr(Schema.String),
+});
+/**
+ * Top-level chain-status response.
+ *
+ *   - `latestCheckpoint` — the most recent signed chain tip, NULL when
+ *     no checkpoint has been written yet (genesis / signer outage).
+ *   - `latestVerification` — the verifier's most recent `audit_chain_failures`
+ *     row, OR a synthetic `ok` record when the table is empty (steady state).
+ *   - `openFailures` — count of rows still in `status='open'`. SoC-2
+ *     auditors will scrutinise any non-zero value.
+ *   - `failures` — most recent N failure rows, newest first.
+ */
+export const AuditChainStatusResponse = Schema.Struct({
+    latestCheckpoint: Schema.NullOr(Schema.Struct({
+        id: Schema.String,
+        chainTipId: Schema.String,
+        chainTipHash: Schema.String,
+        signingKeyId: Schema.String,
+        rowCount: Schema.Number,
+        signedAt: Schema.String,
+    })),
+    latestVerification: Schema.NullOr(Schema.Struct({
+        detectedAt: Schema.String,
+        runId: Schema.String,
+        kind: FailureKind,
+        status: FailureStatus,
+    })),
+    openFailureCount: Schema.Number,
+    failures: Schema.Array(AuditChainFailureRecord),
+});

package/dist/schemas/auth-admin.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Auth Admin — Console-plane endpoints for app administrators to manage
+ * authentication settings on their projects.
+ *
+ * Distinct from `@sylphx/contract` `auth.*` which is the BaaS-plane
+ * sign-in/sign-up surface. Production mounts at `/auth/projects/:id/auth/*`
+ * (ADR-084 Wave 2b). Mirrors `apps/api/src/server/platform/routes/auth.ts`.
+ */
+import { Schema } from 'effect';
+export declare const OAuthProvidersResult: Schema.Struct<{
+    platformProviders: Schema.Array$<typeof Schema.String>;
+    appEnabledProviders: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+    effectiveProviders: Schema.Array$<typeof Schema.String>;
+}>;
+export type OAuthProvidersResult = typeof OAuthProvidersResult.Type;
+export declare const UpdateOAuthProvidersInput: Schema.Struct<{
+    /** null = enable every platform provider. */
+    enabledProviders: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+}>;
+export type UpdateOAuthProvidersInput = typeof UpdateOAuthProvidersInput.Type;
+export declare const UpdateOAuthProvidersResult: Schema.Struct<{
+    enabledProviders: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+    effectiveProviders: Schema.Array$<typeof Schema.String>;
+}>;
+export type UpdateOAuthProvidersResult = typeof UpdateOAuthProvidersResult.Type;
+export declare const AuthSettings: Schema.Struct<{
+    allowPasswordAuth: typeof Schema.Boolean;
+    allowMagicLink: typeof Schema.Boolean;
+    allowPasskey: typeof Schema.Boolean;
+    require2FA: typeof Schema.Boolean;
+    sessionLifetimeSeconds: typeof Schema.Number;
+    refreshTokenLifetimeSeconds: typeof Schema.Number;
+}>;
+export type AuthSettings = typeof AuthSettings.Type;
+export declare const UpdateAuthSettingsInput: Schema.Struct<{
+    allowPasswordAuth: Schema.optional<typeof Schema.Boolean>;
+    allowMagicLink: Schema.optional<typeof Schema.Boolean>;
+    allowPasskey: Schema.optional<typeof Schema.Boolean>;
+    require2FA: Schema.optional<typeof Schema.Boolean>;
+    sessionLifetimeSeconds: Schema.optional<typeof Schema.Number>;
+    refreshTokenLifetimeSeconds: Schema.optional<typeof Schema.Number>;
+}>;
+export type UpdateAuthSettingsInput = typeof UpdateAuthSettingsInput.Type;
+export declare const AuthStats: Schema.Struct<{
+    totalUsers: typeof Schema.Number;
+    activeUsers24h: typeof Schema.Number;
+    activeUsers7d: typeof Schema.Number;
+    activeUsers30d: typeof Schema.Number;
+    twoFactorEnabled: typeof Schema.Number;
+    passkeyEnabled: typeof Schema.Number;
+    loginsByMethod: Schema.Record$<typeof Schema.String, typeof Schema.Number>;
+    successRate: typeof Schema.Number;
+}>;
+export type AuthStats = typeof AuthStats.Type;
+//# sourceMappingURL=auth-admin.d.ts.map

package/dist/schemas/auth-admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-admin.d.ts","sourceRoot":"","sources":["../../src/schemas/auth-admin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,oBAAoB;;;;EAI/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,yBAAyB;IACrC,6CAA6C;;EAE5C,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAE7E,eAAO,MAAM,0BAA0B;;;EAGrC,CAAA;AACF,MAAM,MAAM,0BAA0B,GAAG,OAAO,0BAA0B,CAAC,IAAI,CAAA;AAE/E,eAAO,MAAM,YAAY;;;;;;;EAOvB,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAA;AAEnD,eAAO,MAAM,uBAAuB;;;;;;;EAOlC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,SAAS;;;;;;;;;EASpB,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA"}

package/dist/schemas/auth-admin.js

@@ -0,0 +1,48 @@
+/**
+ * Auth Admin — Console-plane endpoints for app administrators to manage
+ * authentication settings on their projects.
+ *
+ * Distinct from `@sylphx/contract` `auth.*` which is the BaaS-plane
+ * sign-in/sign-up surface. Production mounts at `/auth/projects/:id/auth/*`
+ * (ADR-084 Wave 2b). Mirrors `apps/api/src/server/platform/routes/auth.ts`.
+ */
+import { Schema } from 'effect';
+export const OAuthProvidersResult = Schema.Struct({
+    platformProviders: Schema.Array(Schema.String),
+    appEnabledProviders: Schema.NullOr(Schema.Array(Schema.String)),
+    effectiveProviders: Schema.Array(Schema.String),
+});
+export const UpdateOAuthProvidersInput = Schema.Struct({
+    /** null = enable every platform provider. */
+    enabledProviders: Schema.NullOr(Schema.Array(Schema.String)),
+});
+export const UpdateOAuthProvidersResult = Schema.Struct({
+    enabledProviders: Schema.NullOr(Schema.Array(Schema.String)),
+    effectiveProviders: Schema.Array(Schema.String),
+});
+export const AuthSettings = Schema.Struct({
+    allowPasswordAuth: Schema.Boolean,
+    allowMagicLink: Schema.Boolean,
+    allowPasskey: Schema.Boolean,
+    require2FA: Schema.Boolean,
+    sessionLifetimeSeconds: Schema.Number,
+    refreshTokenLifetimeSeconds: Schema.Number,
+});
+export const UpdateAuthSettingsInput = Schema.Struct({
+    allowPasswordAuth: Schema.optional(Schema.Boolean),
+    allowMagicLink: Schema.optional(Schema.Boolean),
+    allowPasskey: Schema.optional(Schema.Boolean),
+    require2FA: Schema.optional(Schema.Boolean),
+    sessionLifetimeSeconds: Schema.optional(Schema.Number),
+    refreshTokenLifetimeSeconds: Schema.optional(Schema.Number),
+});
+export const AuthStats = Schema.Struct({
+    totalUsers: Schema.Number,
+    activeUsers24h: Schema.Number,
+    activeUsers7d: Schema.Number,
+    activeUsers30d: Schema.Number,
+    twoFactorEnabled: Schema.Number,
+    passkeyEnabled: Schema.Number,
+    loginsByMethod: Schema.Record({ key: Schema.String, value: Schema.Number }),
+    successRate: Schema.Number,
+});