@sylphx/contract 0.2.0

package/dist/endpoints/admin-impersonation.d.ts

@@ -0,0 +1,105 @@
+/**
+ * Admin Impersonation endpoints — Console operator dashboard user impersonation.
+ * Mirrors `apps/api/src/server/platform/routes/admin/impersonation.ts`.
+ *
+ * Production mount: `/admin/impersonation/*`.
+ */
+export declare const adminImpersonationEndpoints: {
+    readonly start: import("../endpoint.js").Endpoint<"POST", "/admin/impersonation/start", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        targetUserId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        token: typeof import("effect/Schema").String;
+        sessionId: typeof import("effect/Schema").String;
+        expiresAt: typeof import("effect/Schema").String;
+    }>>;
+    readonly end: import("../endpoint.js").Endpoint<"POST", "/admin/impersonation/end", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        sessionId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        sessionsEnded: typeof import("effect/Schema").Number;
+    }>>;
+    readonly info: import("../endpoint.js").Endpoint<"GET", "/admin/impersonation/info", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+        isImpersonation: typeof import("effect/Schema").Boolean;
+        adminUserId: typeof import("effect/Schema").String;
+        adminEmail: typeof import("effect/Schema").String;
+        adminName: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        impersonatedAt: typeof import("effect/Schema").String;
+    }>>>;
+    readonly active: import("../endpoint.js").Endpoint<"GET", "/admin/impersonation/active", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Array$<import("effect/Schema").Struct<{
+        sessionId: typeof import("effect/Schema").String;
+        adminUserId: typeof import("effect/Schema").String;
+        adminEmail: typeof import("effect/Schema").String;
+        adminName: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        targetUserId: typeof import("effect/Schema").String;
+        targetEmail: typeof import("effect/Schema").String;
+        targetName: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        impersonatedAt: typeof import("effect/Schema").String;
+        lastActiveAt: typeof import("effect/Schema").String;
+    }>>>;
+    readonly startChallenge: import("../endpoint.js").Endpoint<"POST", "/admin/impersonation/start-challenge", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        targetUserId: typeof import("effect/Schema").String;
+        reason: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        requestId: typeof import("effect/Schema").String;
+        challengeKey: typeof import("effect/Schema").String;
+        webauthnOptions: import("effect/Schema").Struct<{
+            challenge: typeof import("effect/Schema").String;
+            rpId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            allowCredentials: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+                id: typeof import("effect/Schema").String;
+                type: import("effect/Schema").Literal<["public-key"]>;
+                transports: import("effect/Schema").optional<import("effect/Schema").Array$<typeof import("effect/Schema").String>>;
+            }>>;
+            userVerification: import("effect/Schema").Literal<["required"]>;
+            timeout: typeof import("effect/Schema").Number;
+        }>;
+    }>>;
+    readonly startStepup: import("../endpoint.js").Endpoint<"POST", "/admin/impersonation/start-stepup", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        requestId: typeof import("effect/Schema").String;
+        challengeKey: typeof import("effect/Schema").String;
+        assertion: typeof import("effect/Schema").Unknown;
+        emergencyBypass: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+    }>, import("effect/Schema").Union<[import("effect/Schema").Struct<{
+        branch: import("effect/Schema").Literal<["emergency"]>;
+        requestId: typeof import("effect/Schema").String;
+        token: typeof import("effect/Schema").String;
+        sessionId: typeof import("effect/Schema").String;
+        expiresAt: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        branch: import("effect/Schema").Literal<["awaiting-consent"]>;
+        requestId: typeof import("effect/Schema").String;
+        consentDeadline: typeof import("effect/Schema").String;
+    }>]>>;
+    readonly respondConsent: import("../endpoint.js").Endpoint<"POST", "/admin/impersonation/consent/:id", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        decision: import("effect/Schema").Literal<["approve", "deny"]>;
+    }>, import("effect/Schema").Union<[import("effect/Schema").Struct<{
+        branch: import("effect/Schema").Literal<["approved"]>;
+        requestId: typeof import("effect/Schema").String;
+        token: typeof import("effect/Schema").String;
+        sessionId: typeof import("effect/Schema").String;
+        expiresAt: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        branch: import("effect/Schema").Literal<["denied"]>;
+        requestId: typeof import("effect/Schema").String;
+    }>]>>;
+    readonly listRequests: import("../endpoint.js").Endpoint<"GET", "/admin/impersonation/requests", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Array$<import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+        operatorId: typeof import("effect/Schema").String;
+        targetUserId: typeof import("effect/Schema").String;
+        reason: typeof import("effect/Schema").String;
+        status: import("effect/Schema").Literal<["awaiting-stepup", "awaiting-consent", "active", "denied", "expired", "ended", "revoked"]>;
+        emergencyBypass: typeof import("effect/Schema").Boolean;
+        sessionId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        consentDeadline: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        startedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        endedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        createdAt: typeof import("effect/Schema").String;
+    }>>>;
+    readonly endSession: import("../endpoint.js").Endpoint<"POST", "/admin/impersonation/end/:id", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        requestId: typeof import("effect/Schema").String;
+        sessionId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+    }>>;
+};
+//# sourceMappingURL=admin-impersonation.d.ts.map

package/dist/endpoints/admin-impersonation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-impersonation.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-impersonation.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoBH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+E9B,CAAA"}

package/dist/endpoints/admin-impersonation.js

@@ -0,0 +1,88 @@
+/**
+ * Admin Impersonation endpoints — Console operator dashboard user impersonation.
+ * Mirrors `apps/api/src/server/platform/routes/admin/impersonation.ts`.
+ *
+ * Production mount: `/admin/impersonation/*`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminEndImpersonationInput, AdminEndImpersonationResult, AdminImpersonationInfoResult, AdminListActiveImpersonationsResult, AdminStartImpersonationInput, AdminStartImpersonationResult, ImpersonationConsentInput, ImpersonationConsentResult, ImpersonationEndSessionResult, ImpersonationRequestList, ImpersonationStartChallengeInput, ImpersonationStartChallengeResult, ImpersonationStartInput, ImpersonationStartResult, } from '../schemas/admin-impersonation.js';
+export const adminImpersonationEndpoints = {
+    start: defineEndpoint({
+        method: 'POST',
+        path: '/admin/impersonation/start',
+        body: AdminStartImpersonationInput,
+        response: AdminStartImpersonationResult,
+        plane: 'admin',
+        summary: 'Begin impersonating a user',
+        tags: ['admin-impersonation'],
+    }),
+    end: defineEndpoint({
+        method: 'POST',
+        path: '/admin/impersonation/end',
+        body: AdminEndImpersonationInput,
+        response: AdminEndImpersonationResult,
+        plane: 'admin',
+        summary: 'End current or specified impersonation session',
+        tags: ['admin-impersonation'],
+    }),
+    info: defineEndpoint({
+        method: 'GET',
+        path: '/admin/impersonation/info',
+        response: AdminImpersonationInfoResult,
+        plane: 'admin',
+        summary: 'Get impersonation info for current session',
+        tags: ['admin-impersonation'],
+    }),
+    active: defineEndpoint({
+        method: 'GET',
+        path: '/admin/impersonation/active',
+        response: AdminListActiveImpersonationsResult,
+        plane: 'admin',
+        summary: 'List all active impersonation sessions (super_admin)',
+        tags: ['admin-impersonation'],
+    }),
+    // ── Phase 5.9: WebAuthn step-up + consent workflow ─────────────────
+    startChallenge: defineEndpoint({
+        method: 'POST',
+        path: '/admin/impersonation/start-challenge',
+        body: ImpersonationStartChallengeInput,
+        response: ImpersonationStartChallengeResult,
+        plane: 'admin',
+        summary: 'Request a WebAuthn step-up challenge (Phase 5.9)',
+        tags: ['admin-impersonation'],
+    }),
+    startStepup: defineEndpoint({
+        method: 'POST',
+        path: '/admin/impersonation/start-stepup',
+        body: ImpersonationStartInput,
+        response: ImpersonationStartResult,
+        plane: 'admin',
+        summary: 'Complete WebAuthn step-up; branch to emergency or consent (Phase 5.9)',
+        tags: ['admin-impersonation'],
+    }),
+    respondConsent: defineEndpoint({
+        method: 'POST',
+        path: '/admin/impersonation/consent/:id',
+        body: ImpersonationConsentInput,
+        response: ImpersonationConsentResult,
+        plane: 'admin',
+        summary: 'Target user consent decision (Phase 5.9)',
+        tags: ['admin-impersonation'],
+    }),
+    listRequests: defineEndpoint({
+        method: 'GET',
+        path: '/admin/impersonation/requests',
+        response: ImpersonationRequestList,
+        plane: 'admin',
+        summary: 'List impersonation requests (Phase 5.9)',
+        tags: ['admin-impersonation'],
+    }),
+    endSession: defineEndpoint({
+        method: 'POST',
+        path: '/admin/impersonation/end/:id',
+        response: ImpersonationEndSessionResult,
+        plane: 'admin',
+        summary: 'End impersonation session by request id (Phase 5.9)',
+        tags: ['admin-impersonation'],
+    }),
+};

package/dist/endpoints/admin-invitations.d.ts

@@ -0,0 +1,73 @@
+/**
+ * Admin Invitations endpoints — Console operator dashboard team invitation ops.
+ * Mirrors `apps/api/src/server/platform/routes/admin/invitations.ts`.
+ *
+ * Production mount: `/admin/invitations/*`. `/accept` is public (no auth).
+ */
+export declare const adminInvitationsEndpoints: {
+    readonly create: import("../endpoint.js").Endpoint<"POST", "/admin/invitations/", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        email: typeof import("effect/Schema").String;
+        role: import("effect/Schema").optional<import("effect/Schema").Literal<["user", "admin", "super_admin"]>>;
+        note: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+        email: typeof import("effect/Schema").String;
+        role: import("effect/Schema").Literal<["user", "admin", "super_admin"]>;
+        inviteUrl: typeof import("effect/Schema").String;
+        expiresAt: typeof import("effect/Schema").String;
+    }>>;
+    readonly list: import("../endpoint.js").Endpoint<"GET", "/admin/invitations/", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        limit: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        offset: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        statsOnly: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Union<[import("effect/Schema").Struct<{
+        invitations: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            email: typeof import("effect/Schema").String;
+            code: typeof import("effect/Schema").String;
+            role: import("effect/Schema").Literal<["user", "admin", "super_admin"]>;
+            status: import("effect/Schema").Literal<["pending", "accepted", "revoked", "expired"]>;
+            expiresAt: typeof import("effect/Schema").String;
+            acceptedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            note: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+            invitedBy: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+                id: typeof import("effect/Schema").String;
+                name: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+                email: typeof import("effect/Schema").String;
+            }>>;
+        }>>;
+        total: typeof import("effect/Schema").Number;
+    }>, import("effect/Schema").Struct<{
+        totalMembers: typeof import("effect/Schema").Number;
+        pendingInvites: typeof import("effect/Schema").Number;
+        acceptedInvites: typeof import("effect/Schema").Number;
+    }>]>>;
+    readonly revoke: import("../endpoint.js").Endpoint<"DELETE", "/admin/invitations/:id", import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+    }>>;
+    readonly resend: import("../endpoint.js").Endpoint<"POST", "/admin/invitations/:id/resend", import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        inviteUrl: typeof import("effect/Schema").String;
+        expiresAt: typeof import("effect/Schema").String;
+    }>>;
+    readonly accept: import("../endpoint.js").Endpoint<"POST", "/admin/invitations/accept", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        code: typeof import("effect/Schema").String;
+        name: typeof import("effect/Schema").String;
+        password: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        message: typeof import("effect/Schema").String;
+        user: import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            email: typeof import("effect/Schema").String;
+            name: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            role: import("effect/Schema").Literal<["user", "admin", "super_admin"]>;
+        }>;
+    }>>;
+};
+//# sourceMappingURL=admin-invitations.d.ts.map

package/dist/endpoints/admin-invitations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-invitations.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-invitations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8C5B,CAAA"}

package/dist/endpoints/admin-invitations.js

@@ -0,0 +1,55 @@
+/**
+ * Admin Invitations endpoints — Console operator dashboard team invitation ops.
+ * Mirrors `apps/api/src/server/platform/routes/admin/invitations.ts`.
+ *
+ * Production mount: `/admin/invitations/*`. `/accept` is public (no auth).
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminAcceptInvitationInput, AdminAcceptInvitationResult, AdminCreateInvitationInput, AdminCreateInvitationResult, AdminInvitationIdParams, AdminListInvitationsQuery, AdminListInvitationsResult, AdminResendInvitationResult, AdminRevokeInvitationResult, } from '../schemas/admin-invitations.js';
+export const adminInvitationsEndpoints = {
+    create: defineEndpoint({
+        method: 'POST',
+        path: '/admin/invitations/',
+        body: AdminCreateInvitationInput,
+        response: AdminCreateInvitationResult,
+        plane: 'admin',
+        summary: 'Create a team invitation and send email',
+        tags: ['admin-invitations'],
+    }),
+    list: defineEndpoint({
+        method: 'GET',
+        path: '/admin/invitations/',
+        query: AdminListInvitationsQuery,
+        response: AdminListInvitationsResult,
+        plane: 'admin',
+        summary: 'List team invitations (or stats-only mode)',
+        tags: ['admin-invitations'],
+    }),
+    revoke: defineEndpoint({
+        method: 'DELETE',
+        path: '/admin/invitations/:id',
+        params: AdminInvitationIdParams,
+        response: AdminRevokeInvitationResult,
+        plane: 'admin',
+        summary: 'Revoke a pending invitation',
+        tags: ['admin-invitations'],
+    }),
+    resend: defineEndpoint({
+        method: 'POST',
+        path: '/admin/invitations/:id/resend',
+        params: AdminInvitationIdParams,
+        response: AdminResendInvitationResult,
+        plane: 'admin',
+        summary: 'Resend an invitation with a fresh code + extended expiry',
+        tags: ['admin-invitations'],
+    }),
+    accept: defineEndpoint({
+        method: 'POST',
+        path: '/admin/invitations/accept',
+        body: AdminAcceptInvitationInput,
+        response: AdminAcceptInvitationResult,
+        plane: 'admin',
+        summary: 'Public invite acceptance endpoint — creates the user account',
+        tags: ['admin-invitations'],
+    }),
+};

package/dist/endpoints/admin-jwt-keys.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Admin JWT Keys endpoints — Console operator dashboard JWT key lifecycle operations.
+ * Mirrors `apps/api/src/server/platform/routes/admin/jwt-keys.ts`.
+ *
+ * Production mount: `/admin/jwt-keys/*`.
+ */
+export declare const adminJwtKeysEndpoints: {
+    readonly list: import("../endpoint.js").Endpoint<"GET", "/admin/jwt-keys/keys", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        keys: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            keyId: typeof import("effect/Schema").String;
+            status: import("effect/Schema").Literal<["pending", "active", "grace", "retired"]>;
+            algorithm: typeof import("effect/Schema").String;
+            rotationReason: import("effect/Schema").Literal<["initial", "scheduled", "manual", "compromise"]>;
+            createdAt: typeof import("effect/Schema").String;
+            activatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            gracedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            retiredAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        }>>;
+    }>>;
+    readonly get: import("../endpoint.js").Endpoint<"GET", "/admin/jwt-keys/keys/:keyId", import("effect/Schema").Struct<{
+        keyId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+        keyId: typeof import("effect/Schema").String;
+        status: import("effect/Schema").Literal<["pending", "active", "grace", "retired"]>;
+        algorithm: typeof import("effect/Schema").String;
+        rotationReason: import("effect/Schema").Literal<["initial", "scheduled", "manual", "compromise"]>;
+        publicKey: typeof import("effect/Schema").String;
+        createdAt: typeof import("effect/Schema").String;
+        activatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        gracedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        retiredAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        createdBy: import("effect/Schema").NullOr<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            email: typeof import("effect/Schema").String;
+            name: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        }>>;
+    }>>;
+    readonly rotate: import("../endpoint.js").Endpoint<"POST", "/admin/jwt-keys/rotate", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        reason: import("effect/Schema").Literal<["scheduled", "manual", "compromise"]>;
+        notes: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        newKeyId: typeof import("effect/Schema").String;
+    }>>;
+    readonly forceRetire: import("../endpoint.js").Endpoint<"POST", "/admin/jwt-keys/keys/:keyId/retire", import("effect/Schema").Struct<{
+        keyId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        notes: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        keyId: typeof import("effect/Schema").String;
+        wasActive: typeof import("effect/Schema").Boolean;
+    }>>;
+    readonly rotations: import("../endpoint.js").Endpoint<"GET", "/admin/jwt-keys/rotations", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        limit: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        rotations: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            oldKeyId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            newKeyId: typeof import("effect/Schema").String;
+            reason: import("effect/Schema").Literal<["initial", "scheduled", "manual", "compromise"]>;
+            notes: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            createdAt: typeof import("effect/Schema").String;
+        }>>;
+    }>>;
+    readonly status: import("../endpoint.js").Endpoint<"GET", "/admin/jwt-keys/status", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        rotationNeeded: typeof import("effect/Schema").Boolean;
+        activeKeyId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        activeKeySince: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        rotationIntervalDays: typeof import("effect/Schema").Number;
+    }>>;
+};
+//# sourceMappingURL=admin-jwt-keys.d.ts.map

package/dist/endpoints/admin-jwt-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-jwt-keys.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-jwt-keys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgBH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsDxB,CAAA"}

package/dist/endpoints/admin-jwt-keys.js

@@ -0,0 +1,63 @@
+/**
+ * Admin JWT Keys endpoints — Console operator dashboard JWT key lifecycle operations.
+ * Mirrors `apps/api/src/server/platform/routes/admin/jwt-keys.ts`.
+ *
+ * Production mount: `/admin/jwt-keys/*`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminForceRetireJwtKeyInput, AdminForceRetireJwtKeyResult, AdminGetJwtKeyResult, AdminKeyIdParams, AdminListJwtKeysResult, AdminRotateJwtKeysInput, AdminRotateJwtKeysResult, AdminRotationHistoryQuery, AdminRotationHistoryResult, AdminRotationStatusResult, } from '../schemas/admin-jwt-keys.js';
+export const adminJwtKeysEndpoints = {
+    list: defineEndpoint({
+        method: 'GET',
+        path: '/admin/jwt-keys/keys',
+        response: AdminListJwtKeysResult,
+        plane: 'admin',
+        summary: 'List all JWT keys with lifecycle status',
+        tags: ['admin-jwt-keys'],
+    }),
+    get: defineEndpoint({
+        method: 'GET',
+        path: '/admin/jwt-keys/keys/:keyId',
+        params: AdminKeyIdParams,
+        response: AdminGetJwtKeyResult,
+        plane: 'admin',
+        summary: 'Get a JWT key by its database ID (public key only)',
+        tags: ['admin-jwt-keys'],
+    }),
+    rotate: defineEndpoint({
+        method: 'POST',
+        path: '/admin/jwt-keys/rotate',
+        body: AdminRotateJwtKeysInput,
+        response: AdminRotateJwtKeysResult,
+        plane: 'admin',
+        summary: 'Rotate JWT keys (super_admin only)',
+        tags: ['admin-jwt-keys'],
+    }),
+    forceRetire: defineEndpoint({
+        method: 'POST',
+        path: '/admin/jwt-keys/keys/:keyId/retire',
+        params: AdminKeyIdParams,
+        body: AdminForceRetireJwtKeyInput,
+        response: AdminForceRetireJwtKeyResult,
+        plane: 'admin',
+        summary: 'Emergency JWT key retirement (super_admin only)',
+        tags: ['admin-jwt-keys'],
+    }),
+    rotations: defineEndpoint({
+        method: 'GET',
+        path: '/admin/jwt-keys/rotations',
+        query: AdminRotationHistoryQuery,
+        response: AdminRotationHistoryResult,
+        plane: 'admin',
+        summary: 'Get JWT rotation audit trail',
+        tags: ['admin-jwt-keys'],
+    }),
+    status: defineEndpoint({
+        method: 'GET',
+        path: '/admin/jwt-keys/status',
+        response: AdminRotationStatusResult,
+        plane: 'admin',
+        summary: 'Check whether JWT rotation is needed',
+        tags: ['admin-jwt-keys'],
+    }),
+};

package/dist/endpoints/admin-logs.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Admin Logs endpoints — Console operator dashboard structured log reports.
+ * Mirrors `apps/api/src/server/platform/routes/admin/logs.ts`.
+ *
+ * Production mount: `/admin/logs/*`.
+ */
+export declare const adminLogsEndpoints: {
+    readonly stats: import("../endpoint.js").Endpoint<"GET", "/admin/logs/projects/:projectId/stats", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        startDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        endDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        total: typeof import("effect/Schema").Number;
+        debug: typeof import("effect/Schema").Number;
+        info: typeof import("effect/Schema").Number;
+        warn: typeof import("effect/Schema").Number;
+        error: typeof import("effect/Schema").Number;
+        fatal: typeof import("effect/Schema").Number;
+        period: import("effect/Schema").Struct<{
+            start: typeof import("effect/Schema").String;
+            end: typeof import("effect/Schema").String;
+        }>;
+    }>>;
+    readonly list: import("../endpoint.js").Endpoint<"GET", "/admin/logs/projects/:projectId/logs", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        levels: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        traceId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        userId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        source: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        search: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        startDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        endDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        limit: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        offset: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        logs: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            level: import("effect/Schema").Literal<["debug", "info", "warn", "error", "fatal"]>;
+            message: typeof import("effect/Schema").String;
+            source: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            traceId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            userId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            context: import("effect/Schema").NullOr<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+            createdAt: typeof import("effect/Schema").String;
+        }>>;
+        total: typeof import("effect/Schema").Number;
+        hasMore: typeof import("effect/Schema").Boolean;
+    }>>;
+    readonly get: import("../endpoint.js").Endpoint<"GET", "/admin/logs/projects/:projectId/logs/:logId", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+        logId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+        projectId: typeof import("effect/Schema").String;
+        level: import("effect/Schema").Literal<["debug", "info", "warn", "error", "fatal"]>;
+        message: typeof import("effect/Schema").String;
+        source: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        traceId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        userId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        context: import("effect/Schema").NullOr<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+        createdAt: typeof import("effect/Schema").String;
+    }>>;
+    readonly forTrace: import("../endpoint.js").Endpoint<"GET", "/admin/logs/projects/:projectId/traces/:traceId/logs", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+        traceId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Array$<import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+        level: import("effect/Schema").Literal<["debug", "info", "warn", "error", "fatal"]>;
+        message: typeof import("effect/Schema").String;
+        source: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        context: import("effect/Schema").NullOr<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+        createdAt: typeof import("effect/Schema").String;
+    }>>>;
+    readonly volume: import("../endpoint.js").Endpoint<"GET", "/admin/logs/projects/:projectId/volume", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        startDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        endDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Array$<import("effect/Schema").Struct<{
+        hour: typeof import("effect/Schema").String;
+        count: typeof import("effect/Schema").Number;
+        errors: typeof import("effect/Schema").Number;
+    }>>>;
+    readonly topErrors: import("../endpoint.js").Endpoint<"GET", "/admin/logs/projects/:projectId/top-errors", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        startDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        endDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        limit: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Array$<import("effect/Schema").Struct<{
+        message: typeof import("effect/Schema").String;
+        count: typeof import("effect/Schema").Number;
+        lastSeen: typeof import("effect/Schema").String;
+    }>>>;
+    readonly topSources: import("../endpoint.js").Endpoint<"GET", "/admin/logs/projects/:projectId/top-sources", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        startDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        endDate: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        limit: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Array$<import("effect/Schema").Struct<{
+        source: typeof import("effect/Schema").String;
+        count: typeof import("effect/Schema").Number;
+        errors: typeof import("effect/Schema").Number;
+    }>>>;
+};
+//# sourceMappingURL=admin-logs.d.ts.map

package/dist/endpoints/admin-logs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-logs.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-logs.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAoBH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqErB,CAAA"}