@sylphx/contract 0.2.0

package/dist/schemas/saml.js

@@ -0,0 +1,159 @@
+/**
+ * SAML — Enterprise SSO configuration. Console-plane admin endpoints manage
+ * the IdP catalogue, SP metadata, authentication logs, and config validation.
+ *
+ * Mirrors the wire shapes served at `/saml/*` in
+ * `apps/api/src/server/platform/routes/saml.ts`.
+ */
+import { Schema } from 'effect';
+export const SAMLProviderType = Schema.Literal('okta', 'azure_ad', 'google_workspace', 'onelogin', 'ping_identity', 'jumpcloud', 'custom');
+export const SAMLNameIdFormat = Schema.Literal('email', 'persistent', 'transient', 'unspecified');
+export const SAMLSignatureAlgorithm = Schema.Literal('rsa-sha256', 'rsa-sha384', 'rsa-sha512');
+export const SAMLProviderStatus = Schema.Literal('pending', 'active', 'disabled', 'error');
+/** SAML IdP attribute → internal user field mapping. */
+export const SAMLAttributeMapping = Schema.Struct({
+    email: Schema.optional(Schema.String),
+    firstName: Schema.optional(Schema.String),
+    lastName: Schema.optional(Schema.String),
+    displayName: Schema.optional(Schema.String),
+    groups: Schema.optional(Schema.String),
+});
+export const SAMLProvider = Schema.Struct({
+    id: Schema.String,
+    name: Schema.String,
+    type: SAMLProviderType,
+    status: SAMLProviderStatus,
+    entityId: Schema.String,
+    ssoUrl: Schema.String,
+    sloUrl: Schema.NullOr(Schema.String),
+    nameIdFormat: SAMLNameIdFormat,
+    signatureAlgorithm: SAMLSignatureAlgorithm,
+    allowedDomains: Schema.NullOr(Schema.Array(Schema.String)),
+    enforceSSO: Schema.Boolean,
+    attributeMapping: Schema.NullOr(SAMLAttributeMapping),
+    spEntityId: Schema.NullOr(Schema.String),
+    spAcsUrl: Schema.NullOr(Schema.String),
+    certificateExpiresAt: Schema.NullOr(Schema.String),
+    lastLoginAt: Schema.NullOr(Schema.String),
+    loginCount: Schema.Number,
+    lastError: Schema.NullOr(Schema.String),
+    lastErrorAt: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+    updatedAt: Schema.NullOr(Schema.String),
+});
+export const SAMLAuthLog = Schema.Struct({
+    id: Schema.String,
+    success: Schema.Boolean,
+    errorCode: Schema.NullOr(Schema.String),
+    errorMessage: Schema.NullOr(Schema.String),
+    nameId: Schema.NullOr(Schema.String),
+    ipAddress: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+});
+export const SAMLIdPTemplate = Schema.Struct({
+    type: SAMLProviderType,
+    name: Schema.String,
+    instructions: Schema.String,
+    requiredFields: Schema.Array(Schema.String),
+});
+export const SAMLNameIdFormatOption = Schema.Struct({
+    key: Schema.String,
+    value: Schema.String,
+    description: Schema.String,
+});
+export const SAMLSignatureAlgorithmOption = Schema.Struct({
+    key: Schema.String,
+    value: Schema.String,
+    recommended: Schema.Boolean,
+});
+// ── Requests ───────────────────────────────────────────────────────────────
+/**
+ * `organizationId` is carried as a query param on read endpoints so the
+ * Console can look up providers before selecting an org in the UI context.
+ */
+export const GetSAMLProviderQuery = Schema.Struct({
+    organizationId: Schema.String,
+});
+export const GetSAMLMetadataQuery = Schema.Struct({
+    organizationId: Schema.String,
+});
+export const GetSAMLLogsQuery = Schema.Struct({
+    providerId: Schema.String,
+    limit: Schema.optional(Schema.String),
+});
+export const CreateSAMLProviderInput = Schema.Struct({
+    organizationId: Schema.String,
+    name: Schema.String,
+    type: Schema.optional(SAMLProviderType),
+    entityId: Schema.String,
+    ssoUrl: Schema.String,
+    sloUrl: Schema.optional(Schema.String),
+    certificate: Schema.String,
+    nameIdFormat: Schema.optional(SAMLNameIdFormat),
+    signatureAlgorithm: Schema.optional(SAMLSignatureAlgorithm),
+    allowedDomains: Schema.optional(Schema.Array(Schema.String)),
+    enforceSSO: Schema.optional(Schema.Boolean),
+    attributeMapping: Schema.optional(SAMLAttributeMapping),
+});
+export const UpdateSAMLProviderInput = Schema.Struct({
+    providerId: Schema.String,
+    name: Schema.optional(Schema.String),
+    entityId: Schema.optional(Schema.String),
+    ssoUrl: Schema.optional(Schema.String),
+    sloUrl: Schema.optional(Schema.NullOr(Schema.String)),
+    certificate: Schema.optional(Schema.String),
+    nameIdFormat: Schema.optional(SAMLNameIdFormat),
+    signatureAlgorithm: Schema.optional(SAMLSignatureAlgorithm),
+    allowedDomains: Schema.optional(Schema.Array(Schema.String)),
+    enforceSSO: Schema.optional(Schema.Boolean),
+    attributeMapping: Schema.optional(SAMLAttributeMapping),
+});
+export const SetSAMLProviderStatusInput = Schema.Struct({
+    providerId: Schema.String,
+    enabled: Schema.Boolean,
+});
+export const DeleteSAMLProviderInput = Schema.Struct({
+    providerId: Schema.String,
+});
+export const TestSAMLConfigInput = Schema.Struct({
+    entityId: Schema.String,
+    ssoUrl: Schema.String,
+    certificate: Schema.String,
+});
+// ── Responses ──────────────────────────────────────────────────────────────
+export const GetSAMLProviderResult = Schema.NullOr(SAMLProvider);
+export const CreateSAMLProviderResult = Schema.Struct({
+    id: Schema.String,
+    spEntityId: Schema.NullOr(Schema.String),
+    spAcsUrl: Schema.NullOr(Schema.String),
+});
+export const UpdateSAMLProviderResult = Schema.Struct({
+    success: Schema.Boolean,
+});
+export const SetSAMLProviderStatusResult = Schema.Struct({
+    success: Schema.Boolean,
+});
+export const DeleteSAMLProviderResult = Schema.Struct({
+    success: Schema.Boolean,
+});
+export const GetSAMLMetadataResult = Schema.Struct({
+    metadata: Schema.String,
+    spEntityId: Schema.NullOr(Schema.String),
+    spAcsUrl: Schema.NullOr(Schema.String),
+});
+export const GetSAMLLogsResult = Schema.Struct({
+    logs: Schema.Array(SAMLAuthLog),
+});
+export const TestSAMLConfigResult = Schema.Struct({
+    valid: Schema.Boolean,
+    issues: Schema.Array(Schema.String),
+});
+export const ListSAMLIdPTemplatesResult = Schema.Struct({
+    templates: Schema.Array(SAMLIdPTemplate),
+});
+export const ListSAMLNameIdFormatsResult = Schema.Struct({
+    formats: Schema.Array(SAMLNameIdFormatOption),
+});
+export const ListSAMLSignatureAlgorithmsResult = Schema.Struct({
+    algorithms: Schema.Array(SAMLSignatureAlgorithmOption),
+});

package/dist/schemas/search.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Search — schemas for Console admin search analytics.
+ * Mirrors `routes/search.ts`.
+ *
+ * Plane: `management` (distinct from any BaaS search — this file is Console
+ * operator dashboard over the shared search index).
+ */
+import { Schema } from 'effect';
+export declare const SearchProjectIdParams: Schema.Struct<{
+    projectId: typeof Schema.String;
+}>;
+export type SearchProjectIdParams = typeof SearchProjectIdParams.Type;
+export declare const SearchAnalyticsQuery: Schema.Struct<{
+    namespace: Schema.optional<typeof Schema.String>;
+    dateFrom: Schema.optional<typeof Schema.String>;
+    dateTo: Schema.optional<typeof Schema.String>;
+}>;
+export type SearchAnalyticsQuery = typeof SearchAnalyticsQuery.Type;
+export declare const SearchListDocumentsQuery: Schema.Struct<{
+    namespace: Schema.optional<typeof Schema.String>;
+    limit: Schema.optional<typeof Schema.String>;
+    offset: Schema.optional<typeof Schema.String>;
+}>;
+export type SearchListDocumentsQuery = typeof SearchListDocumentsQuery.Type;
+export declare const SearchStatsQuery: Schema.Struct<{
+    namespace: Schema.optional<typeof Schema.String>;
+}>;
+export type SearchStatsQuery = typeof SearchStatsQuery.Type;
+export declare const SearchTopQuery: Schema.Struct<{
+    query: typeof Schema.String;
+    count: typeof Schema.Number;
+}>;
+export type SearchTopQuery = typeof SearchTopQuery.Type;
+export declare const SearchAnalyticsResult: Schema.Struct<{
+    totalQueries: typeof Schema.Number;
+    avgLatencyMs: typeof Schema.Number;
+    clickThroughRate: typeof Schema.Number;
+    topQueries: Schema.Array$<Schema.Struct<{
+        query: typeof Schema.String;
+        count: typeof Schema.Number;
+    }>>;
+}>;
+export type SearchAnalyticsResult = typeof SearchAnalyticsResult.Type;
+export declare const SearchNamespaceStats: Schema.Struct<{
+    namespace: typeof Schema.String;
+    count: typeof Schema.Number;
+}>;
+export type SearchNamespaceStats = typeof SearchNamespaceStats.Type;
+export declare const SearchStatsResult: Schema.Struct<{
+    totalDocuments: typeof Schema.Number;
+    documentsWithEmbedding: typeof Schema.Number;
+    byNamespace: Schema.Array$<Schema.Struct<{
+        namespace: typeof Schema.String;
+        count: typeof Schema.Number;
+    }>>;
+}>;
+export type SearchStatsResult = typeof SearchStatsResult.Type;
+export declare const SearchDocumentItem: Schema.Struct<{
+    id: typeof Schema.String;
+    namespace: typeof Schema.String;
+    externalId: Schema.NullOr<typeof Schema.String>;
+    title: Schema.NullOr<typeof Schema.String>;
+    contentPreview: typeof Schema.String;
+    url: Schema.NullOr<typeof Schema.String>;
+    category: Schema.NullOr<typeof Schema.String>;
+    type: Schema.NullOr<typeof Schema.String>;
+    tags: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+    hasEmbedding: typeof Schema.Boolean;
+    impressions: typeof Schema.Number;
+    clicks: typeof Schema.Number;
+    createdAt: typeof Schema.String;
+    updatedAt: typeof Schema.String;
+}>;
+export type SearchDocumentItem = typeof SearchDocumentItem.Type;
+export declare const SearchListDocumentsResult: Schema.Struct<{
+    documents: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        namespace: typeof Schema.String;
+        externalId: Schema.NullOr<typeof Schema.String>;
+        title: Schema.NullOr<typeof Schema.String>;
+        contentPreview: typeof Schema.String;
+        url: Schema.NullOr<typeof Schema.String>;
+        category: Schema.NullOr<typeof Schema.String>;
+        type: Schema.NullOr<typeof Schema.String>;
+        tags: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        hasEmbedding: typeof Schema.Boolean;
+        impressions: typeof Schema.Number;
+        clicks: typeof Schema.Number;
+        createdAt: typeof Schema.String;
+        updatedAt: typeof Schema.String;
+    }>>;
+    total: typeof Schema.Number;
+    hasMore: typeof Schema.Boolean;
+}>;
+export type SearchListDocumentsResult = typeof SearchListDocumentsResult.Type;
+//# sourceMappingURL=search.d.ts.map

package/dist/schemas/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../src/schemas/search.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,qBAAqB;;EAA8C,CAAA;AAChF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,oBAAoB;;;;EAI/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,wBAAwB;;;;EAInC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,gBAAgB;;EAA+D,CAAA;AAC5F,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,eAAO,MAAM,cAAc;;;EAAgE,CAAA;AAC3F,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,qBAAqB;;;;;;;;EAKhC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AAErE,eAAO,MAAM,oBAAoB;;;EAG/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAEnE,eAAO,MAAM,iBAAiB;;;;;;;EAI5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;EAe7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;EAIpC,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA"}

package/dist/schemas/search.js

@@ -0,0 +1,57 @@
+/**
+ * Search — schemas for Console admin search analytics.
+ * Mirrors `routes/search.ts`.
+ *
+ * Plane: `management` (distinct from any BaaS search — this file is Console
+ * operator dashboard over the shared search index).
+ */
+import { Schema } from 'effect';
+export const SearchProjectIdParams = Schema.Struct({ projectId: Schema.String });
+export const SearchAnalyticsQuery = Schema.Struct({
+    namespace: Schema.optional(Schema.String),
+    dateFrom: Schema.optional(Schema.String),
+    dateTo: Schema.optional(Schema.String),
+});
+export const SearchListDocumentsQuery = Schema.Struct({
+    namespace: Schema.optional(Schema.String),
+    limit: Schema.optional(Schema.String),
+    offset: Schema.optional(Schema.String),
+});
+export const SearchStatsQuery = Schema.Struct({ namespace: Schema.optional(Schema.String) });
+export const SearchTopQuery = Schema.Struct({ query: Schema.String, count: Schema.Number });
+export const SearchAnalyticsResult = Schema.Struct({
+    totalQueries: Schema.Number,
+    avgLatencyMs: Schema.Number,
+    clickThroughRate: Schema.Number,
+    topQueries: Schema.Array(SearchTopQuery),
+});
+export const SearchNamespaceStats = Schema.Struct({
+    namespace: Schema.String,
+    count: Schema.Number,
+});
+export const SearchStatsResult = Schema.Struct({
+    totalDocuments: Schema.Number,
+    documentsWithEmbedding: Schema.Number,
+    byNamespace: Schema.Array(SearchNamespaceStats),
+});
+export const SearchDocumentItem = Schema.Struct({
+    id: Schema.String,
+    namespace: Schema.String,
+    externalId: Schema.NullOr(Schema.String),
+    title: Schema.NullOr(Schema.String),
+    contentPreview: Schema.String,
+    url: Schema.NullOr(Schema.String),
+    category: Schema.NullOr(Schema.String),
+    type: Schema.NullOr(Schema.String),
+    tags: Schema.NullOr(Schema.Array(Schema.String)),
+    hasEmbedding: Schema.Boolean,
+    impressions: Schema.Number,
+    clicks: Schema.Number,
+    createdAt: Schema.String,
+    updatedAt: Schema.String,
+});
+export const SearchListDocumentsResult = Schema.Struct({
+    documents: Schema.Array(SearchDocumentItem),
+    total: Schema.Number,
+    hasMore: Schema.Boolean,
+});

package/dist/schemas/secret.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Secret — AES-256-GCM encrypted credential with version history. Distinct
+ * from EnvVar (unencrypted runtime config) — secrets are a first-class
+ * audited vault with opt-in reveal.
+ */
+import { Schema } from 'effect';
+/** `[A-Z0-9_]+` per apps/api schema — uppercase config-key convention. */
+export declare const SecretKey: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+export type SecretKey = typeof SecretKey.Type;
+/** Secret values may contain anything up to 64 KiB. */
+export declare const SecretValue: Schema.filter<Schema.filter<typeof Schema.String>>;
+export type SecretValue = typeof SecretValue.Type;
+export declare const EnvironmentRef: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "EnvironmentId">;
+    name: typeof Schema.String;
+}>;
+export type EnvironmentRef = typeof EnvironmentRef.Type;
+export declare const SecretVersion: Schema.Struct<{
+    version: typeof Schema.String;
+    changeNote: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+}>;
+export type SecretVersion = typeof SecretVersion.Type;
+export declare const SecretListItem: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "SecretId">;
+    key: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    description: Schema.NullOr<typeof Schema.String>;
+    environment: Schema.NullOr<Schema.Struct<{
+        id: Schema.brand<Schema.filter<typeof Schema.String>, "EnvironmentId">;
+        name: typeof Schema.String;
+    }>>;
+    isActive: typeof Schema.Boolean;
+    version: typeof Schema.String;
+    createdAt: typeof Schema.String;
+    updatedAt: typeof Schema.String;
+}>;
+export type SecretListItem = typeof SecretListItem.Type;
+export declare const SecretDetail: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "SecretId">;
+    key: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    /** Plaintext — only populated when `reveal=true` was requested. */
+    value: Schema.NullOr<typeof Schema.String>;
+    maskedValue: typeof Schema.String;
+    description: Schema.NullOr<typeof Schema.String>;
+    environment: Schema.NullOr<Schema.Struct<{
+        id: Schema.brand<Schema.filter<typeof Schema.String>, "EnvironmentId">;
+        name: typeof Schema.String;
+    }>>;
+    isActive: typeof Schema.Boolean;
+    version: typeof Schema.String;
+    versions: Schema.Array$<Schema.Struct<{
+        version: typeof Schema.String;
+        changeNote: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+    }>>;
+    createdAt: typeof Schema.String;
+    updatedAt: typeof Schema.String;
+}>;
+export type SecretDetail = typeof SecretDetail.Type;
+export declare const CreateSecretInput: Schema.Struct<{
+    projectId: typeof Schema.String;
+    key: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    value: Schema.filter<Schema.filter<typeof Schema.String>>;
+    description: Schema.optional<typeof Schema.String>;
+    environmentId: Schema.optional<Schema.brand<Schema.filter<typeof Schema.String>, "EnvironmentId">>;
+}>;
+export type CreateSecretInput = typeof CreateSecretInput.Type;
+export declare const CreateSecretResult: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "SecretId">;
+    key: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    version: typeof Schema.String;
+}>;
+export type CreateSecretResult = typeof CreateSecretResult.Type;
+export declare const UpdateSecretInput: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "SecretId">;
+    value: Schema.optional<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    description: Schema.optional<Schema.NullOr<typeof Schema.String>>;
+    isActive: Schema.optional<typeof Schema.Boolean>;
+    changeNote: Schema.optional<typeof Schema.String>;
+}>;
+export type UpdateSecretInput = typeof UpdateSecretInput.Type;
+export declare const UpdateSecretResult: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "SecretId">;
+    key: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    version: typeof Schema.String;
+}>;
+export type UpdateSecretResult = typeof UpdateSecretResult.Type;
+export declare const RollbackSecretInput: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "SecretId">;
+    version: typeof Schema.String;
+}>;
+export type RollbackSecretInput = typeof RollbackSecretInput.Type;
+export declare const RollbackSecretResult: Schema.Struct<{
+    id: Schema.brand<Schema.filter<typeof Schema.String>, "SecretId">;
+    key: Schema.filter<Schema.filter<Schema.filter<typeof Schema.String>>>;
+    version: typeof Schema.String;
+    rolledBackFrom: typeof Schema.String;
+    rolledBackTo: typeof Schema.String;
+}>;
+export type RollbackSecretResult = typeof RollbackSecretResult.Type;
+//# sourceMappingURL=secret.d.ts.map

package/dist/schemas/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/schemas/secret.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAG/B,0EAA0E;AAC1E,eAAO,MAAM,SAAS,mEAIrB,CAAA;AACD,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAE7C,uDAAuD;AACvD,eAAO,MAAM,WAAW,oDAAoE,CAAA;AAC5F,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;AAEjD,eAAO,MAAM,cAAc;;;EAGzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,aAAa;;;;EAIxB,CAAA;AACF,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD,eAAO,MAAM,cAAc;;;;;;;;;;;;EASzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,eAAO,MAAM,YAAY;;;IAGxB,mEAAmE;;;;;;;;;;;;;;;;;EAUlE,CAAA;AACF,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,IAAI,CAAA;AAEnD,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,iBAAiB;;;;;;EAM5B,CAAA;AACF,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,IAAI,CAAA;AAE7D,eAAO,MAAM,kBAAkB;;;;EAI7B,CAAA;AACF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,eAAO,MAAM,mBAAmB;;;EAG9B,CAAA;AACF,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE,eAAO,MAAM,oBAAoB;;;;;;EAM/B,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA"}

package/dist/schemas/secret.js

@@ -0,0 +1,79 @@
+/**
+ * Secret — AES-256-GCM encrypted credential with version history. Distinct
+ * from EnvVar (unencrypted runtime config) — secrets are a first-class
+ * audited vault with opt-in reveal.
+ */
+import { Schema } from 'effect';
+import { EnvironmentId, SecretId } from './ids.js';
+/** `[A-Z0-9_]+` per apps/api schema — uppercase config-key convention. */
+export const SecretKey = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(255), Schema.pattern(/^[A-Z0-9_]+$/));
+/** Secret values may contain anything up to 64 KiB. */
+export const SecretValue = Schema.String.pipe(Schema.minLength(1), Schema.maxLength(65_536));
+export const EnvironmentRef = Schema.Struct({
+    id: EnvironmentId,
+    name: Schema.String,
+});
+export const SecretVersion = Schema.Struct({
+    version: Schema.String,
+    changeNote: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+});
+export const SecretListItem = Schema.Struct({
+    id: SecretId,
+    key: SecretKey,
+    description: Schema.NullOr(Schema.String),
+    environment: Schema.NullOr(EnvironmentRef),
+    isActive: Schema.Boolean,
+    version: Schema.String,
+    createdAt: Schema.String,
+    updatedAt: Schema.String,
+});
+export const SecretDetail = Schema.Struct({
+    id: SecretId,
+    key: SecretKey,
+    /** Plaintext — only populated when `reveal=true` was requested. */
+    value: Schema.NullOr(Schema.String),
+    maskedValue: Schema.String,
+    description: Schema.NullOr(Schema.String),
+    environment: Schema.NullOr(EnvironmentRef),
+    isActive: Schema.Boolean,
+    version: Schema.String,
+    versions: Schema.Array(SecretVersion),
+    createdAt: Schema.String,
+    updatedAt: Schema.String,
+});
+export const CreateSecretInput = Schema.Struct({
+    projectId: Schema.String,
+    key: SecretKey,
+    value: SecretValue,
+    description: Schema.optional(Schema.String),
+    environmentId: Schema.optional(EnvironmentId),
+});
+export const CreateSecretResult = Schema.Struct({
+    id: SecretId,
+    key: SecretKey,
+    version: Schema.String,
+});
+export const UpdateSecretInput = Schema.Struct({
+    id: SecretId,
+    value: Schema.optional(SecretValue),
+    description: Schema.optional(Schema.NullOr(Schema.String)),
+    isActive: Schema.optional(Schema.Boolean),
+    changeNote: Schema.optional(Schema.String),
+});
+export const UpdateSecretResult = Schema.Struct({
+    id: SecretId,
+    key: SecretKey,
+    version: Schema.String,
+});
+export const RollbackSecretInput = Schema.Struct({
+    id: SecretId,
+    version: Schema.String,
+});
+export const RollbackSecretResult = Schema.Struct({
+    id: SecretId,
+    key: SecretKey,
+    version: Schema.String,
+    rolledBackFrom: Schema.String,
+    rolledBackTo: Schema.String,
+});