@sylphx/contract 0.2.0

package/dist/schemas/service-tokens.d.ts

@@ -0,0 +1,342 @@
+/**
+ * Service Tokens — schemas for org-owned machine identities (ADR-059 §3).
+ *
+ * Two sibling contract namespaces share this file:
+ *   • `serviceTokens`          — CRUD over the live tokens
+ *   • `serviceTokenRequests`   — two-person approval workflow
+ *
+ * Plane: `management`. Both mount under `/orgs/:orgId/…`.
+ */
+import { Schema } from 'effect';
+export declare const ResourceScope: Schema.NullOr<Schema.Struct<{
+    orgId: Schema.optional<typeof Schema.String>;
+    projectId: Schema.optional<typeof Schema.String>;
+    envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+}>>;
+export type ResourceScope = typeof ResourceScope.Type;
+export declare const ServiceTokenView: Schema.Struct<{
+    id: typeof Schema.String;
+    orgId: typeof Schema.String;
+    name: typeof Schema.String;
+    tokenPrefix: Schema.NullOr<typeof Schema.String>;
+    projectId: Schema.NullOr<typeof Schema.String>;
+    environmentId: Schema.NullOr<typeof Schema.String>;
+    resourceScope: Schema.NullOr<Schema.Struct<{
+        orgId: Schema.optional<typeof Schema.String>;
+        projectId: Schema.optional<typeof Schema.String>;
+        envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    }>>;
+    scopes: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+    ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+    createdBy: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+    expiresAt: Schema.NullOr<typeof Schema.String>;
+    lastUsedAt: Schema.NullOr<typeof Schema.String>;
+    revokedAt: Schema.NullOr<typeof Schema.String>;
+    revokedBy: Schema.NullOr<typeof Schema.String>;
+    useCount: typeof Schema.Number;
+}>;
+export type ServiceTokenView = typeof ServiceTokenView.Type;
+export declare const ServiceTokenRequestView: Schema.Struct<{
+    id: typeof Schema.String;
+    orgId: typeof Schema.String;
+    requestedBy: typeof Schema.String;
+    status: Schema.Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+    tokenName: typeof Schema.String;
+    scopes: Schema.Array$<typeof Schema.String>;
+    projectId: Schema.NullOr<typeof Schema.String>;
+    environmentId: Schema.NullOr<typeof Schema.String>;
+    resourceScope: Schema.NullOr<Schema.Struct<{
+        orgId: Schema.optional<typeof Schema.String>;
+        projectId: Schema.optional<typeof Schema.String>;
+        envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    }>>;
+    ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+    expiresInDays: Schema.NullOr<typeof Schema.Number>;
+    approvedBy: Schema.NullOr<typeof Schema.String>;
+    approvedAt: Schema.NullOr<typeof Schema.String>;
+    deniedReason: Schema.NullOr<typeof Schema.String>;
+    mintedTokenId: Schema.NullOr<typeof Schema.String>;
+    createdAt: typeof Schema.String;
+    updatedAt: typeof Schema.String;
+}>;
+export type ServiceTokenRequestView = typeof ServiceTokenRequestView.Type;
+export declare const OrgIdParams: Schema.Struct<{
+    orgId: typeof Schema.String;
+}>;
+export type OrgIdParams = typeof OrgIdParams.Type;
+export declare const OrgTokenIdParams: Schema.Struct<{
+    orgId: typeof Schema.String;
+    tokenId: typeof Schema.String;
+}>;
+export type OrgTokenIdParams = typeof OrgTokenIdParams.Type;
+export declare const OrgRequestIdParams: Schema.Struct<{
+    orgId: typeof Schema.String;
+    id: typeof Schema.String;
+}>;
+export type OrgRequestIdParams = typeof OrgRequestIdParams.Type;
+export declare const ListServiceTokensQuery: Schema.Struct<{
+    includeRevoked: Schema.optional<Schema.Literal<["true", "false"]>>;
+}>;
+export type ListServiceTokensQuery = typeof ListServiceTokensQuery.Type;
+export declare const CreateServiceTokenInput: Schema.Struct<{
+    name: typeof Schema.String;
+    scopes: Schema.Array$<typeof Schema.String>;
+    projectId: Schema.optional<Schema.NullOr<typeof Schema.String>>;
+    environmentId: Schema.optional<Schema.NullOr<typeof Schema.String>>;
+    resourceScope: Schema.optional<Schema.NullOr<Schema.Struct<{
+        orgId: Schema.optional<typeof Schema.String>;
+        projectId: Schema.optional<typeof Schema.String>;
+        envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    }>>>;
+    ipAllowlist: Schema.optional<Schema.NullOr<Schema.Array$<typeof Schema.String>>>;
+    expiresInDays: Schema.optional<Schema.NullOr<typeof Schema.Number>>;
+}>;
+export type CreateServiceTokenInput = typeof CreateServiceTokenInput.Type;
+export declare const SubmitServiceTokenRequestInput: Schema.Struct<{
+    name: typeof Schema.String;
+    scopes: Schema.Array$<typeof Schema.String>;
+    projectId: Schema.optional<Schema.NullOr<typeof Schema.String>>;
+    environmentId: Schema.optional<Schema.NullOr<typeof Schema.String>>;
+    resourceScope: Schema.optional<Schema.NullOr<Schema.Struct<{
+        orgId: Schema.optional<typeof Schema.String>;
+        projectId: Schema.optional<typeof Schema.String>;
+        envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+    }>>>;
+    ipAllowlist: Schema.optional<Schema.NullOr<Schema.Array$<typeof Schema.String>>>;
+    expiresInDays: Schema.optional<Schema.NullOr<typeof Schema.Number>>;
+}>;
+export type SubmitServiceTokenRequestInput = typeof SubmitServiceTokenRequestInput.Type;
+export declare const DenyServiceTokenRequestInput: Schema.Struct<{
+    reason: typeof Schema.String;
+}>;
+export type DenyServiceTokenRequestInput = typeof DenyServiceTokenRequestInput.Type;
+export declare const CreateServiceTokenResult: Schema.Struct<{
+    token: typeof Schema.String;
+    view: Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        name: typeof Schema.String;
+        tokenPrefix: Schema.NullOr<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        scopes: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        createdBy: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        expiresAt: Schema.NullOr<typeof Schema.String>;
+        lastUsedAt: Schema.NullOr<typeof Schema.String>;
+        revokedAt: Schema.NullOr<typeof Schema.String>;
+        revokedBy: Schema.NullOr<typeof Schema.String>;
+        useCount: typeof Schema.Number;
+    }>;
+}>;
+export type CreateServiceTokenResult = typeof CreateServiceTokenResult.Type;
+export declare const ListServiceTokensResult: Schema.Struct<{
+    tokens: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        name: typeof Schema.String;
+        tokenPrefix: Schema.NullOr<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        scopes: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        createdBy: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        expiresAt: Schema.NullOr<typeof Schema.String>;
+        lastUsedAt: Schema.NullOr<typeof Schema.String>;
+        revokedAt: Schema.NullOr<typeof Schema.String>;
+        revokedBy: Schema.NullOr<typeof Schema.String>;
+        useCount: typeof Schema.Number;
+    }>>;
+}>;
+export type ListServiceTokensResult = typeof ListServiceTokensResult.Type;
+export declare const GetServiceTokenResult: Schema.Struct<{
+    view: Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        name: typeof Schema.String;
+        tokenPrefix: Schema.NullOr<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        scopes: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        createdBy: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        expiresAt: Schema.NullOr<typeof Schema.String>;
+        lastUsedAt: Schema.NullOr<typeof Schema.String>;
+        revokedAt: Schema.NullOr<typeof Schema.String>;
+        revokedBy: Schema.NullOr<typeof Schema.String>;
+        useCount: typeof Schema.Number;
+    }>;
+}>;
+export type GetServiceTokenResult = typeof GetServiceTokenResult.Type;
+export declare const RevokeServiceTokenResult: Schema.Struct<{
+    view: Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        name: typeof Schema.String;
+        tokenPrefix: Schema.NullOr<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        scopes: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        createdBy: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        expiresAt: Schema.NullOr<typeof Schema.String>;
+        lastUsedAt: Schema.NullOr<typeof Schema.String>;
+        revokedAt: Schema.NullOr<typeof Schema.String>;
+        revokedBy: Schema.NullOr<typeof Schema.String>;
+        useCount: typeof Schema.Number;
+    }>;
+}>;
+export type RevokeServiceTokenResult = typeof RevokeServiceTokenResult.Type;
+export declare const RotateServiceTokenResult: Schema.Struct<{
+    token: typeof Schema.String;
+    oldView: Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        name: typeof Schema.String;
+        tokenPrefix: Schema.NullOr<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        scopes: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        createdBy: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        expiresAt: Schema.NullOr<typeof Schema.String>;
+        lastUsedAt: Schema.NullOr<typeof Schema.String>;
+        revokedAt: Schema.NullOr<typeof Schema.String>;
+        revokedBy: Schema.NullOr<typeof Schema.String>;
+        useCount: typeof Schema.Number;
+    }>;
+    newView: Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        name: typeof Schema.String;
+        tokenPrefix: Schema.NullOr<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        scopes: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        createdBy: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        expiresAt: Schema.NullOr<typeof Schema.String>;
+        lastUsedAt: Schema.NullOr<typeof Schema.String>;
+        revokedAt: Schema.NullOr<typeof Schema.String>;
+        revokedBy: Schema.NullOr<typeof Schema.String>;
+        useCount: typeof Schema.Number;
+    }>;
+}>;
+export type RotateServiceTokenResult = typeof RotateServiceTokenResult.Type;
+export declare const ListServiceTokenRequestsResult: Schema.Struct<{
+    requests: Schema.Array$<Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        requestedBy: typeof Schema.String;
+        status: Schema.Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+        tokenName: typeof Schema.String;
+        scopes: Schema.Array$<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        expiresInDays: Schema.NullOr<typeof Schema.Number>;
+        approvedBy: Schema.NullOr<typeof Schema.String>;
+        approvedAt: Schema.NullOr<typeof Schema.String>;
+        deniedReason: Schema.NullOr<typeof Schema.String>;
+        mintedTokenId: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        updatedAt: typeof Schema.String;
+    }>>;
+}>;
+export type ListServiceTokenRequestsResult = typeof ListServiceTokenRequestsResult.Type;
+export declare const ServiceTokenRequestResult: Schema.Struct<{
+    request: Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        requestedBy: typeof Schema.String;
+        status: Schema.Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+        tokenName: typeof Schema.String;
+        scopes: Schema.Array$<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        expiresInDays: Schema.NullOr<typeof Schema.Number>;
+        approvedBy: Schema.NullOr<typeof Schema.String>;
+        approvedAt: Schema.NullOr<typeof Schema.String>;
+        deniedReason: Schema.NullOr<typeof Schema.String>;
+        mintedTokenId: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        updatedAt: typeof Schema.String;
+    }>;
+}>;
+export type ServiceTokenRequestResult = typeof ServiceTokenRequestResult.Type;
+export declare const MintServiceTokenRequestResult: Schema.Struct<{
+    token: typeof Schema.String;
+    request: Schema.Struct<{
+        id: typeof Schema.String;
+        orgId: typeof Schema.String;
+        requestedBy: typeof Schema.String;
+        status: Schema.Literal<["pending", "approved", "denied", "minted", "cancelled"]>;
+        tokenName: typeof Schema.String;
+        scopes: Schema.Array$<typeof Schema.String>;
+        projectId: Schema.NullOr<typeof Schema.String>;
+        environmentId: Schema.NullOr<typeof Schema.String>;
+        resourceScope: Schema.NullOr<Schema.Struct<{
+            orgId: Schema.optional<typeof Schema.String>;
+            projectId: Schema.optional<typeof Schema.String>;
+            envIds: Schema.optional<Schema.Array$<typeof Schema.String>>;
+        }>>;
+        ipAllowlist: Schema.NullOr<Schema.Array$<typeof Schema.String>>;
+        expiresInDays: Schema.NullOr<typeof Schema.Number>;
+        approvedBy: Schema.NullOr<typeof Schema.String>;
+        approvedAt: Schema.NullOr<typeof Schema.String>;
+        deniedReason: Schema.NullOr<typeof Schema.String>;
+        mintedTokenId: Schema.NullOr<typeof Schema.String>;
+        createdAt: typeof Schema.String;
+        updatedAt: typeof Schema.String;
+    }>;
+}>;
+export type MintServiceTokenRequestResult = typeof MintServiceTokenRequestResult.Type;
+//# sourceMappingURL=service-tokens.d.ts.map

package/dist/schemas/service-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-tokens.d.ts","sourceRoot":"","sources":["../../src/schemas/service-tokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,eAAO,MAAM,aAAa;;;;GAMzB,CAAA;AACD,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;EAiB3B,CAAA;AACF,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAE3D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;EAkBlC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAIzE,eAAO,MAAM,WAAW;;EAA0C,CAAA;AAClE,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,IAAI,CAAA;AACjD,eAAO,MAAM,gBAAgB;;;EAAkE,CAAA;AAC/F,MAAM,MAAM,gBAAgB,GAAG,OAAO,gBAAgB,CAAC,IAAI,CAAA;AAC3D,eAAO,MAAM,kBAAkB;;;EAA6D,CAAA;AAC5F,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAI/D,eAAO,MAAM,sBAAsB;;EAEjC,CAAA;AACF,MAAM,MAAM,sBAAsB,GAAG,OAAO,sBAAsB,CAAC,IAAI,CAAA;AAIvE,eAAO,MAAM,uBAAuB;;;;;;;;;;;;EAQlC,CAAA;AACF,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AAEzE,eAAO,MAAM,8BAA8B;;;;;;;;;;;;EAQzC,CAAA;AACF,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAA;AAEvF,eAAO,MAAM,4BAA4B;;EAA2C,CAAA;AACpF,MAAM,MAAM,4BAA4B,GAAG,OAAO,4BAA4B,CAAC,IAAI,CAAA;AAInF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;EAGnC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;EAA4D,CAAA;AAChG,MAAM,MAAM,uBAAuB,GAAG,OAAO,uBAAuB,CAAC,IAAI,CAAA;AACzE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;EAA4C,CAAA;AAC9E,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,IAAI,CAAA;AACrE,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;EAA4C,CAAA;AACjF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAC3E,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAInC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,OAAO,wBAAwB,CAAC,IAAI,CAAA;AAE3E,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;EAEzC,CAAA;AACF,MAAM,MAAM,8BAA8B,GAAG,OAAO,8BAA8B,CAAC,IAAI,CAAA;AACvF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;EAAsD,CAAA;AAC5F,MAAM,MAAM,yBAAyB,GAAG,OAAO,yBAAyB,CAAC,IAAI,CAAA;AAC7E,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;EAGxC,CAAA;AACF,MAAM,MAAM,6BAA6B,GAAG,OAAO,6BAA6B,CAAC,IAAI,CAAA"}

package/dist/schemas/service-tokens.js

@@ -0,0 +1,101 @@
+/**
+ * Service Tokens — schemas for org-owned machine identities (ADR-059 §3).
+ *
+ * Two sibling contract namespaces share this file:
+ *   • `serviceTokens`          — CRUD over the live tokens
+ *   • `serviceTokenRequests`   — two-person approval workflow
+ *
+ * Plane: `management`. Both mount under `/orgs/:orgId/…`.
+ */
+import { Schema } from 'effect';
+export const ResourceScope = Schema.NullOr(Schema.Struct({
+    orgId: Schema.optional(Schema.String),
+    projectId: Schema.optional(Schema.String),
+    envIds: Schema.optional(Schema.Array(Schema.String)),
+}));
+export const ServiceTokenView = Schema.Struct({
+    id: Schema.String,
+    orgId: Schema.String,
+    name: Schema.String,
+    tokenPrefix: Schema.NullOr(Schema.String),
+    projectId: Schema.NullOr(Schema.String),
+    environmentId: Schema.NullOr(Schema.String),
+    resourceScope: ResourceScope,
+    scopes: Schema.NullOr(Schema.Array(Schema.String)),
+    ipAllowlist: Schema.NullOr(Schema.Array(Schema.String)),
+    createdBy: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+    expiresAt: Schema.NullOr(Schema.String),
+    lastUsedAt: Schema.NullOr(Schema.String),
+    revokedAt: Schema.NullOr(Schema.String),
+    revokedBy: Schema.NullOr(Schema.String),
+    useCount: Schema.Number,
+});
+export const ServiceTokenRequestView = Schema.Struct({
+    id: Schema.String,
+    orgId: Schema.String,
+    requestedBy: Schema.String,
+    status: Schema.Literal('pending', 'approved', 'denied', 'minted', 'cancelled'),
+    tokenName: Schema.String,
+    scopes: Schema.Array(Schema.String),
+    projectId: Schema.NullOr(Schema.String),
+    environmentId: Schema.NullOr(Schema.String),
+    resourceScope: ResourceScope,
+    ipAllowlist: Schema.NullOr(Schema.Array(Schema.String)),
+    expiresInDays: Schema.NullOr(Schema.Number),
+    approvedBy: Schema.NullOr(Schema.String),
+    approvedAt: Schema.NullOr(Schema.String),
+    deniedReason: Schema.NullOr(Schema.String),
+    mintedTokenId: Schema.NullOr(Schema.String),
+    createdAt: Schema.String,
+    updatedAt: Schema.String,
+});
+// ── Params ─────────────────────────────────────────────────────────────────
+export const OrgIdParams = Schema.Struct({ orgId: Schema.String });
+export const OrgTokenIdParams = Schema.Struct({ orgId: Schema.String, tokenId: Schema.String });
+export const OrgRequestIdParams = Schema.Struct({ orgId: Schema.String, id: Schema.String });
+// ── Query ──────────────────────────────────────────────────────────────────
+export const ListServiceTokensQuery = Schema.Struct({
+    includeRevoked: Schema.optional(Schema.Literal('true', 'false')),
+});
+// ── Bodies ─────────────────────────────────────────────────────────────────
+export const CreateServiceTokenInput = Schema.Struct({
+    name: Schema.String,
+    scopes: Schema.Array(Schema.String),
+    projectId: Schema.optional(Schema.NullOr(Schema.String)),
+    environmentId: Schema.optional(Schema.NullOr(Schema.String)),
+    resourceScope: Schema.optional(ResourceScope),
+    ipAllowlist: Schema.optional(Schema.NullOr(Schema.Array(Schema.String))),
+    expiresInDays: Schema.optional(Schema.NullOr(Schema.Number)),
+});
+export const SubmitServiceTokenRequestInput = Schema.Struct({
+    name: Schema.String,
+    scopes: Schema.Array(Schema.String),
+    projectId: Schema.optional(Schema.NullOr(Schema.String)),
+    environmentId: Schema.optional(Schema.NullOr(Schema.String)),
+    resourceScope: Schema.optional(ResourceScope),
+    ipAllowlist: Schema.optional(Schema.NullOr(Schema.Array(Schema.String))),
+    expiresInDays: Schema.optional(Schema.NullOr(Schema.Number)),
+});
+export const DenyServiceTokenRequestInput = Schema.Struct({ reason: Schema.String });
+// ── Results ────────────────────────────────────────────────────────────────
+export const CreateServiceTokenResult = Schema.Struct({
+    token: Schema.String,
+    view: ServiceTokenView,
+});
+export const ListServiceTokensResult = Schema.Struct({ tokens: Schema.Array(ServiceTokenView) });
+export const GetServiceTokenResult = Schema.Struct({ view: ServiceTokenView });
+export const RevokeServiceTokenResult = Schema.Struct({ view: ServiceTokenView });
+export const RotateServiceTokenResult = Schema.Struct({
+    token: Schema.String,
+    oldView: ServiceTokenView,
+    newView: ServiceTokenView,
+});
+export const ListServiceTokenRequestsResult = Schema.Struct({
+    requests: Schema.Array(ServiceTokenRequestView),
+});
+export const ServiceTokenRequestResult = Schema.Struct({ request: ServiceTokenRequestView });
+export const MintServiceTokenRequestResult = Schema.Struct({
+    token: Schema.String,
+    request: ServiceTokenRequestView,
+});