@sylphx/contract 0.2.0

package/dist/endpoints/admin-projects.js

@@ -0,0 +1,74 @@
+/**
+ * Admin Projects endpoints — Console operator dashboard project management.
+ * Mirrors `apps/api/src/server/platform/routes/admin/projects.ts`.
+ *
+ * Production mount: `/admin/projects/*`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminCreateProjectInput, AdminCreateProjectResult, AdminDeleteProjectResult, AdminEnvironmentIdParams, AdminGetProjectResult, AdminListProjectsQuery, AdminListProjectsResult, AdminPlatformResourcesResult, AdminProjectIdParams, AdminRegenerateSecretKeyResult, AdminUpdateProjectInput, AdminUpdateProjectResult, } from '../schemas/admin-projects.js';
+export const adminProjectsEndpoints = {
+    list: defineEndpoint({
+        method: 'GET',
+        path: '/admin/projects/',
+        query: AdminListProjectsQuery,
+        response: AdminListProjectsResult,
+        plane: 'admin',
+        summary: "List apps for the user's organization",
+        tags: ['admin-projects'],
+    }),
+    get: defineEndpoint({
+        method: 'GET',
+        path: '/admin/projects/:id',
+        params: AdminProjectIdParams,
+        response: AdminGetProjectResult,
+        plane: 'admin',
+        summary: 'Get app by ID or slug (org-scoped)',
+        tags: ['admin-projects'],
+    }),
+    create: defineEndpoint({
+        method: 'POST',
+        path: '/admin/projects/',
+        body: AdminCreateProjectInput,
+        response: AdminCreateProjectResult,
+        plane: 'admin',
+        summary: 'Create app with default dev + production environments',
+        tags: ['admin-projects'],
+    }),
+    update: defineEndpoint({
+        method: 'PATCH',
+        path: '/admin/projects/:id',
+        params: AdminProjectIdParams,
+        body: AdminUpdateProjectInput,
+        response: AdminUpdateProjectResult,
+        plane: 'admin',
+        summary: 'Update app settings',
+        tags: ['admin-projects'],
+    }),
+    delete: defineEndpoint({
+        method: 'DELETE',
+        path: '/admin/projects/:id',
+        params: AdminProjectIdParams,
+        response: AdminDeleteProjectResult,
+        plane: 'admin',
+        summary: 'Soft delete app (super_admin only)',
+        tags: ['admin-projects'],
+    }),
+    regenerateSecretKey: defineEndpoint({
+        method: 'POST',
+        path: '/admin/projects/environments/:environmentId/regenerate-key',
+        params: AdminEnvironmentIdParams,
+        response: AdminRegenerateSecretKeyResult,
+        plane: 'admin',
+        summary: 'Regenerate environment secret key (super_admin only)',
+        tags: ['admin-projects'],
+    }),
+    platformResources: defineEndpoint({
+        method: 'GET',
+        path: '/admin/projects/:id/platform-resources',
+        params: AdminProjectIdParams,
+        response: AdminPlatformResourcesResult,
+        plane: 'admin',
+        summary: "List project's hidden BaaS resource bindings (ADR-047)",
+        tags: ['admin-projects'],
+    }),
+};

package/dist/endpoints/admin-quotas.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Admin Quotas endpoints — Console operator dashboard per-project quota ops.
+ * Mirrors `apps/api/src/server/platform/routes/admin/quotas.ts`.
+ *
+ * Production mount: `/admin/quotas/*`.
+ */
+export declare const adminQuotasEndpoints: {
+    readonly getProjectQuotas: import("../endpoint.js").Endpoint<"GET", "/admin/quotas/projects/:projectId/quotas", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+        projectName: typeof import("effect/Schema").String;
+        quotas: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            service: typeof import("effect/Schema").String;
+            metric: typeof import("effect/Schema").String;
+            currentUsage: typeof import("effect/Schema").Number;
+            limit: typeof import("effect/Schema").Number;
+            percentUsed: typeof import("effect/Schema").Number;
+            enforcement: import("effect/Schema").Literal<["hard", "soft", "none"]>;
+            period: import("effect/Schema").Literal<["hourly", "daily", "monthly", "unlimited"]>;
+            status: import("effect/Schema").Literal<["ok", "warning", "critical", "exceeded"]>;
+            isActive: typeof import("effect/Schema").Boolean;
+        }>>;
+        mauCount: typeof import("effect/Schema").Number;
+        mauLimit: typeof import("effect/Schema").Number;
+        overallStatus: import("effect/Schema").Literal<["ok", "warning", "critical", "exceeded", "blocked"]>;
+        unacknowledgedAlertsCount: typeof import("effect/Schema").Number;
+    }>>;
+    readonly getQuotaStats: import("../endpoint.js").Endpoint<"GET", "/admin/quotas/projects/:projectId/quotas/stats", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        atLimit: typeof import("effect/Schema").Number;
+        warning: typeof import("effect/Schema").Number;
+        critical: typeof import("effect/Schema").Number;
+        ok: typeof import("effect/Schema").Number;
+        total: typeof import("effect/Schema").Number;
+    }>>;
+    readonly getQuotaAlerts: import("../endpoint.js").Endpoint<"GET", "/admin/quotas/projects/:projectId/quotas/alerts", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        acknowledged: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        limit: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        alerts: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            id: typeof import("effect/Schema").String;
+            service: typeof import("effect/Schema").String;
+            metric: typeof import("effect/Schema").String;
+            level: import("effect/Schema").Literal<["warning", "critical", "exceeded"]>;
+            usagePercent: typeof import("effect/Schema").Number;
+            currentValue: typeof import("effect/Schema").Number;
+            limitValue: typeof import("effect/Schema").Number;
+            message: typeof import("effect/Schema").String;
+            sentAt: typeof import("effect/Schema").String;
+            acknowledgedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        }>>;
+    }>>;
+    readonly getQuotaHistory: import("../endpoint.js").Endpoint<"GET", "/admin/quotas/projects/:projectId/quotas/history", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Struct<{
+        service: typeof import("effect/Schema").String;
+        metric: typeof import("effect/Schema").String;
+        days: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        history: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            date: typeof import("effect/Schema").String;
+            value: typeof import("effect/Schema").Number;
+        }>>;
+    }>>;
+    readonly updateQuota: import("../endpoint.js").Endpoint<"PATCH", "/admin/quotas/projects/:projectId/quotas", import("effect/Schema").Struct<{
+        projectId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        service: typeof import("effect/Schema").String;
+        metric: typeof import("effect/Schema").String;
+        limitValue: import("effect/Schema").optional<typeof import("effect/Schema").Number>;
+        enforcement: import("effect/Schema").optional<import("effect/Schema").Literal<["hard", "soft", "none"]>>;
+        warningThresholdPercent: import("effect/Schema").optional<typeof import("effect/Schema").Number>;
+        criticalThresholdPercent: import("effect/Schema").optional<typeof import("effect/Schema").Number>;
+        isActive: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+    }>, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        quota: import("effect/Schema").Struct<{
+            service: typeof import("effect/Schema").String;
+            metric: typeof import("effect/Schema").String;
+            limitValue: typeof import("effect/Schema").Number;
+            enforcement: import("effect/Schema").Literal<["hard", "soft", "none"]>;
+            warningThresholdPercent: typeof import("effect/Schema").Number;
+            criticalThresholdPercent: typeof import("effect/Schema").Number;
+            isActive: typeof import("effect/Schema").Boolean;
+        }>;
+    }>>;
+    readonly acknowledgeAlert: import("../endpoint.js").Endpoint<"POST", "/admin/quotas/alerts/:alertId/acknowledge", import("effect/Schema").Struct<{
+        alertId: typeof import("effect/Schema").String;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        success: typeof import("effect/Schema").Boolean;
+        acknowledgedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+    }>>;
+};
+//# sourceMappingURL=admin-quotas.d.ts.map

package/dist/endpoints/admin-quotas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-quotas.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-quotas.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0DvB,CAAA"}

package/dist/endpoints/admin-quotas.js

@@ -0,0 +1,67 @@
+/**
+ * Admin Quotas endpoints — Console operator dashboard per-project quota ops.
+ * Mirrors `apps/api/src/server/platform/routes/admin/quotas.ts`.
+ *
+ * Production mount: `/admin/quotas/*`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminAcknowledgeAlertResult, AdminAlertIdParams, AdminGetProjectQuotasResult, AdminGetQuotaAlertsQuery, AdminGetQuotaAlertsResult, AdminGetQuotaHistoryQuery, AdminGetQuotaHistoryResult, AdminGetQuotaStatsResult, AdminQuotasProjectParams, AdminUpdateQuotaInput, AdminUpdateQuotaResult, } from '../schemas/admin-quotas.js';
+export const adminQuotasEndpoints = {
+    getProjectQuotas: defineEndpoint({
+        method: 'GET',
+        path: '/admin/quotas/projects/:projectId/quotas',
+        params: AdminQuotasProjectParams,
+        response: AdminGetProjectQuotasResult,
+        plane: 'admin',
+        summary: 'Get all quotas for a project with current usage',
+        tags: ['admin-quotas'],
+    }),
+    getQuotaStats: defineEndpoint({
+        method: 'GET',
+        path: '/admin/quotas/projects/:projectId/quotas/stats',
+        params: AdminQuotasProjectParams,
+        response: AdminGetQuotaStatsResult,
+        plane: 'admin',
+        summary: 'Quota status count breakdown',
+        tags: ['admin-quotas'],
+    }),
+    getQuotaAlerts: defineEndpoint({
+        method: 'GET',
+        path: '/admin/quotas/projects/:projectId/quotas/alerts',
+        params: AdminQuotasProjectParams,
+        query: AdminGetQuotaAlertsQuery,
+        response: AdminGetQuotaAlertsResult,
+        plane: 'admin',
+        summary: 'List quota alerts with optional ack filter',
+        tags: ['admin-quotas'],
+    }),
+    getQuotaHistory: defineEndpoint({
+        method: 'GET',
+        path: '/admin/quotas/projects/:projectId/quotas/history',
+        params: AdminQuotasProjectParams,
+        query: AdminGetQuotaHistoryQuery,
+        response: AdminGetQuotaHistoryResult,
+        plane: 'admin',
+        summary: 'Daily usage history for one service/metric pair',
+        tags: ['admin-quotas'],
+    }),
+    updateQuota: defineEndpoint({
+        method: 'PATCH',
+        path: '/admin/quotas/projects/:projectId/quotas',
+        params: AdminQuotasProjectParams,
+        body: AdminUpdateQuotaInput,
+        response: AdminUpdateQuotaResult,
+        plane: 'admin',
+        summary: 'Update quota settings for one service/metric',
+        tags: ['admin-quotas'],
+    }),
+    acknowledgeAlert: defineEndpoint({
+        method: 'POST',
+        path: '/admin/quotas/alerts/:alertId/acknowledge',
+        params: AdminAlertIdParams,
+        response: AdminAcknowledgeAlertResult,
+        plane: 'admin',
+        summary: 'Acknowledge a quota alert',
+        tags: ['admin-quotas'],
+    }),
+};

package/dist/endpoints/admin-rate-limits.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Admin Rate-Limits endpoints — operator-driven tuning of per-credential-type
+ * multipliers (Production-Ready audit M-3).
+ *
+ * Production mount: `/admin/rate-limits/*`.
+ *
+ * Auth: service token + scope `platform:ratelimits:write`. Super-admin
+ * sessions are explicitly NOT accepted by the server — a multiplier change
+ * is a security-policy decision and MUST be a programmatic step in an Ops
+ * runbook, never an interactive Console click.
+ *
+ * Resolution order (server-side):
+ *
+ *   1. SPIFFE mesh path → exempt (always allow).
+ *   2. DB row for credential type → multiplier.
+ *   3. Inline `CREDENTIAL_MULTIPLIERS_INLINE` defaults if the DB lookup
+ *      fails (config-path fail-open). The enforcement layer itself still
+ *      fails CLOSED on Redis outages.
+ *
+ * @see `apps/api/src/server/platform/routes/admin/rate-limits.ts`
+ * @see `packages/core/src/lib/security/rate-limit-credential-multipliers.ts`
+ */
+export declare const adminRateLimitsEndpoints: {
+    readonly listStrategies: import("../endpoint.js").Endpoint<"GET", "/admin/rate-limits/strategies", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        multipliers: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            credentialType: import("effect/Schema").Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+            multiplier: typeof import("effect/Schema").Number;
+            exempt: typeof import("effect/Schema").Boolean;
+            notes: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUpdatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        }>>;
+    }>>;
+    readonly setStrategy: import("../endpoint.js").Endpoint<"POST", "/admin/rate-limits/strategies", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        credentialType: import("effect/Schema").Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+        multiplier: import("effect/Schema").filter<import("effect/Schema").filter<typeof import("effect/Schema").Number>>;
+        exempt: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+        reason: import("effect/Schema").filter<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        updated: import("effect/Schema").Struct<{
+            credentialType: import("effect/Schema").Literal<["public", "secret", "service", "session", "spiffe", "unknown"]>;
+            multiplier: typeof import("effect/Schema").Number;
+            exempt: typeof import("effect/Schema").Boolean;
+            notes: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            lastUpdatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        }>;
+        auditLogId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        message: typeof import("effect/Schema").String;
+    }>>;
+};
+//# sourceMappingURL=admin-rate-limits.d.ts.map

package/dist/endpoints/admin-rate-limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-rate-limits.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-rate-limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;CA+B3B,CAAA"}

package/dist/endpoints/admin-rate-limits.js

@@ -0,0 +1,53 @@
+/**
+ * Admin Rate-Limits endpoints — operator-driven tuning of per-credential-type
+ * multipliers (Production-Ready audit M-3).
+ *
+ * Production mount: `/admin/rate-limits/*`.
+ *
+ * Auth: service token + scope `platform:ratelimits:write`. Super-admin
+ * sessions are explicitly NOT accepted by the server — a multiplier change
+ * is a security-policy decision and MUST be a programmatic step in an Ops
+ * runbook, never an interactive Console click.
+ *
+ * Resolution order (server-side):
+ *
+ *   1. SPIFFE mesh path → exempt (always allow).
+ *   2. DB row for credential type → multiplier.
+ *   3. Inline `CREDENTIAL_MULTIPLIERS_INLINE` defaults if the DB lookup
+ *      fails (config-path fail-open). The enforcement layer itself still
+ *      fails CLOSED on Redis outages.
+ *
+ * @see `apps/api/src/server/platform/routes/admin/rate-limits.ts`
+ * @see `packages/core/src/lib/security/rate-limit-credential-multipliers.ts`
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminListRateLimitMultipliersResult, AdminSetRateLimitMultiplierInput, AdminSetRateLimitMultiplierResult, } from '../schemas/admin-rate-limits.js';
+export const adminRateLimitsEndpoints = {
+    listStrategies: defineEndpoint({
+        method: 'GET',
+        path: '/admin/rate-limits/strategies',
+        response: AdminListRateLimitMultipliersResult,
+        plane: 'admin',
+        summary: 'List the per-credential-type rate-limit multipliers currently applied to every preset',
+        description: 'Returns one row per credential type (`public`, `secret`, `service`, ' +
+            '`session`, `spiffe`, `unknown`) with its multiplier, exempt flag, ' +
+            'operator-supplied notes, and last-update timestamp. Reads ' +
+            'authoritatively from the DB; the in-memory cache is refreshed every ' +
+            '5 minutes via Redis. Requires service token with scope ' +
+            '`platform:ratelimits:write`.',
+        tags: ['admin-rate-limits'],
+    }),
+    setStrategy: defineEndpoint({
+        method: 'POST',
+        path: '/admin/rate-limits/strategies',
+        body: AdminSetRateLimitMultiplierInput,
+        response: AdminSetRateLimitMultiplierResult,
+        plane: 'admin',
+        summary: 'Upsert the multiplier (or exempt flag) for a single credential type',
+        description: 'Writes the row for `credentialType` and fires `invalidateAndReload()` ' +
+            'on the enforcement layer so the new value is live within seconds — no ' +
+            '5-min wait. `reason` is required (≥3 chars) and recorded on the audit ' +
+            'log. Requires service token with scope `platform:ratelimits:write`.',
+        tags: ['admin-rate-limits'],
+    }),
+};

package/dist/endpoints/admin-reconcile.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Admin Reconcile endpoints — operator-only recovery surface (OPS-6).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/reconcile.ts`.
+ *
+ * `POST /admin/reconcile/reset` replaces raw
+ * `UPDATE project_environments SET generation = generation + 1, …` and
+ * `UPDATE environment_services SET reconcile_status = 'pending', …` from
+ * `docs/how-to/reconciler-cleanup-semantic.md`. Scope:
+ * `platform:reconcile:reset`.
+ *
+ * Plane: `admin`.
+ */
+export declare const adminReconcileEndpoints: {
+    readonly reset: import("../endpoint.js").Endpoint<"POST", "/admin/reconcile/reset", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        kind: import("effect/Schema").Union<[import("effect/Schema").Literal<["service"]>, import("effect/Schema").Literal<["environment"]>]>;
+        id: import("effect/Schema").filter<typeof import("effect/Schema").String>;
+        to: import("effect/Schema").Union<[import("effect/Schema").Literal<["pending"]>, import("effect/Schema").Literal<["synced"]>]>;
+        reason: import("effect/Schema").filter<import("effect/Schema").filter<typeof import("effect/Schema").String>>;
+    }>, import("effect/Schema").Struct<{
+        kind: import("effect/Schema").Union<[import("effect/Schema").Literal<["service"]>, import("effect/Schema").Literal<["environment"]>]>;
+        id: typeof import("effect/Schema").String;
+        previousStatus: typeof import("effect/Schema").String;
+        newStatus: import("effect/Schema").Union<[import("effect/Schema").Literal<["pending"]>, import("effect/Schema").Literal<["synced"]>]>;
+        generationBumped: typeof import("effect/Schema").Boolean;
+    }>>;
+};
+//# sourceMappingURL=admin-reconcile.d.ts.map

package/dist/endpoints/admin-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-reconcile.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;CAkB1B,CAAA"}

package/dist/endpoints/admin-reconcile.js

@@ -0,0 +1,33 @@
+/**
+ * Admin Reconcile endpoints — operator-only recovery surface (OPS-6).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/reconcile.ts`.
+ *
+ * `POST /admin/reconcile/reset` replaces raw
+ * `UPDATE project_environments SET generation = generation + 1, …` and
+ * `UPDATE environment_services SET reconcile_status = 'pending', …` from
+ * `docs/how-to/reconciler-cleanup-semantic.md`. Scope:
+ * `platform:reconcile:reset`.
+ *
+ * Plane: `admin`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminReconcileResetInput, AdminReconcileResetResult } from '../schemas/admin-reconcile.js';
+export const adminReconcileEndpoints = {
+    reset: defineEndpoint({
+        method: 'POST',
+        path: '/admin/reconcile/reset',
+        body: AdminReconcileResetInput,
+        response: AdminReconcileResetResult,
+        plane: 'admin',
+        summary: 'Reset reconcile_status on a service or environment row',
+        description: 'Validates that the source state permits the target transition and ' +
+            'rejects `terminating`/`terminated` rows (use force-delete instead). ' +
+            'When `to=pending`, also bumps `generation` so the reconciler picks ' +
+            'up the row on the next tick. Every successful call writes one ' +
+            '`audit_logs` row tagged `resourceType=service|environment`, ' +
+            '`action=admin_action`, `operation=reconcile_reset`, `source=api`. ' +
+            'Requires service token with scope `platform:reconcile:reset`.',
+        tags: ['admin-reconcile'],
+    }),
+};

package/dist/endpoints/admin-resources.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Admin Resources endpoints — operator-only recovery surface (OPS-3).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/resources.ts`.
+ *
+ * `DELETE /admin/resources/:id` replaces raw
+ * `DELETE FROM managed_resources WHERE id=...` from
+ * `docs/how-to/teardown-failure.md`. Scope: `platform:resources:forcedelete`.
+ *
+ * Sibling slice OPS-2 (reseal) extends this file with its own endpoint
+ * when it lands.
+ *
+ * Plane: `admin`.
+ */
+export declare const adminResourcesEndpoints: {
+    readonly forceDelete: import("../endpoint.js").Endpoint<"DELETE", "/admin/resources/:id", import("effect/Schema").Struct<{
+        id: import("effect/Schema").filter<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        reason: import("effect/Schema").filter<import("effect/Schema").filter<typeof import("effect/Schema").String>>;
+        cascade: import("effect/Schema").optional<import("effect/Schema").transform<import("effect/Schema").Union<[import("effect/Schema").Literal<["true"]>, import("effect/Schema").Literal<["false"]>]>, typeof import("effect/Schema").Boolean>>;
+        reallyForce: import("effect/Schema").optional<import("effect/Schema").transform<import("effect/Schema").Union<[import("effect/Schema").Literal<["true"]>, import("effect/Schema").Literal<["false"]>]>, typeof import("effect/Schema").Boolean>>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        id: typeof import("effect/Schema").String;
+        previousStatus: typeof import("effect/Schema").String;
+        cascade: typeof import("effect/Schema").Boolean;
+        reallyForce: typeof import("effect/Schema").Boolean;
+        dependentsDeleted: typeof import("effect/Schema").Number;
+    }>>;
+    readonly reseal: import("../endpoint.js").Endpoint<"POST", "/admin/resources/reseal", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        keyId: import("effect/Schema").filter<import("effect/Schema").filter<import("effect/Schema").filter<typeof import("effect/Schema").String>>>;
+        filter: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            projectId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+            envId: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+        }>>;
+    }>, import("effect/Schema").Struct<{
+        activeKeyId: typeof import("effect/Schema").String;
+        totalRotated: typeof import("effect/Schema").Number;
+        totalFailed: typeof import("effect/Schema").Number;
+        fields: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            fieldName: typeof import("effect/Schema").String;
+            rowsSeen: typeof import("effect/Schema").Number;
+            rowsRotated: typeof import("effect/Schema").Number;
+            rowsFailed: typeof import("effect/Schema").Number;
+            failures: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+                id: typeof import("effect/Schema").String;
+                reason: typeof import("effect/Schema").String;
+            }>>;
+        }>>;
+    }>>;
+};
+//# sourceMappingURL=admin-resources.d.ts.map

package/dist/endpoints/admin-resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-resources.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsC1B,CAAA"}

package/dist/endpoints/admin-resources.js

@@ -0,0 +1,53 @@
+/**
+ * Admin Resources endpoints — operator-only recovery surface (OPS-3).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/resources.ts`.
+ *
+ * `DELETE /admin/resources/:id` replaces raw
+ * `DELETE FROM managed_resources WHERE id=...` from
+ * `docs/how-to/teardown-failure.md`. Scope: `platform:resources:forcedelete`.
+ *
+ * Sibling slice OPS-2 (reseal) extends this file with its own endpoint
+ * when it lands.
+ *
+ * Plane: `admin`.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminResourceForceDeleteQuery, AdminResourceForceDeleteResult, AdminResourceIdParams, AdminResourceResealInput, AdminResourceResealResult, } from '../schemas/admin-resources.js';
+export const adminResourcesEndpoints = {
+    forceDelete: defineEndpoint({
+        method: 'DELETE',
+        path: '/admin/resources/:id',
+        params: AdminResourceIdParams,
+        query: AdminResourceForceDeleteQuery,
+        response: AdminResourceForceDeleteResult,
+        plane: 'admin',
+        summary: 'Force-delete a stuck `managed_resources` row',
+        description: 'Hard-deletes the row and (when `cascade=true`) its dependent rows. ' +
+            'Refuses the call when `reconcile_status` is not `terminating` unless ' +
+            '`reallyForce=true` is passed. Every call writes one ' +
+            '`audit_logs` row tagged `resourceType=managed_resource`, ' +
+            '`action=force_delete`, `source=api`. Requires service token with ' +
+            'scope `platform:resources:forcedelete`.',
+        tags: ['admin-resources'],
+    }),
+    reseal: defineEndpoint({
+        method: 'POST',
+        path: '/admin/resources/reseal',
+        body: AdminResourceResealInput,
+        response: AdminResourceResealResult,
+        plane: 'admin',
+        summary: 'Re-encrypt every encrypted column under the active KEK',
+        description: 'Walks the canonical rotation registry (environment_secrets, ' +
+            'environment_secret_versions, projects.webhook_secret_encrypted, ' +
+            'project_environments.webhook_secret_encrypted, ' +
+            'jwt_keys.encrypted_private_key) and re-encrypts every row whose ' +
+            'envelope is not under the active KEK. Idempotent — re-running ' +
+            'after convergence rewrites zero rows. Refuses with 409 when the ' +
+            'request `keyId` does not match the live ring. Emits one ' +
+            '`audit_logs` row tagged `resourceType=managed_resource`, ' +
+            '`action=admin_action`, `operation=reseal`, `source=api`. ' +
+            'Requires service token with scope `platform:resources:reseal`.',
+        tags: ['admin-resources'],
+    }),
+};

package/dist/endpoints/admin-secrets.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Admin Secrets endpoints — operator-driven rotation of platform HMAC /
+ * encryption secrets (G-5).
+ *
+ * Production mount: `/admin/secrets/*`.
+ *
+ * Auth: service-token + scope `platform:secrets:rotate` (NOT super-admin
+ * session — see schema header for rationale). The endpoint is the audit
+ * trail; actual K8s secret value updates remain a two-person Ops runbook
+ * step (`docs/runbooks/secret-rotation.md`).
+ */
+export declare const adminSecretsEndpoints: {
+    readonly list: import("../endpoint.js").Endpoint<"GET", "/admin/secrets", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        secrets: import("effect/Schema").Array$<import("effect/Schema").Struct<{
+            type: import("effect/Schema").Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+            lastRotatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            ageDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            cadenceDays: typeof import("effect/Schema").Number;
+            overdue: typeof import("effect/Schema").Boolean;
+            clusterSecretRef: typeof import("effect/Schema").String;
+        }>>;
+    }>>;
+    readonly rotate: import("../endpoint.js").Endpoint<"POST", "/admin/secrets/rotate", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        type: import("effect/Schema").Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+        dryRun: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+        reason: import("effect/Schema").optional<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Struct<{
+        rotated: typeof import("effect/Schema").Boolean;
+        status: import("effect/Schema").Struct<{
+            type: import("effect/Schema").Literal<["break-glass", "encryption-key", "jwt-signing"]>;
+            lastRotatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            ageDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
+            cadenceDays: typeof import("effect/Schema").Number;
+            overdue: typeof import("effect/Schema").Boolean;
+            clusterSecretRef: typeof import("effect/Schema").String;
+        }>;
+        auditLogId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        message: typeof import("effect/Schema").String;
+    }>>;
+};
+//# sourceMappingURL=admin-secrets.d.ts.map

package/dist/endpoints/admin-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-secrets.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AASH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqBxB,CAAA"}

package/dist/endpoints/admin-secrets.js

@@ -0,0 +1,33 @@
+/**
+ * Admin Secrets endpoints — operator-driven rotation of platform HMAC /
+ * encryption secrets (G-5).
+ *
+ * Production mount: `/admin/secrets/*`.
+ *
+ * Auth: service-token + scope `platform:secrets:rotate` (NOT super-admin
+ * session — see schema header for rationale). The endpoint is the audit
+ * trail; actual K8s secret value updates remain a two-person Ops runbook
+ * step (`docs/runbooks/secret-rotation.md`).
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminListSecretsResult, AdminRotateSecretInput, AdminRotateSecretResult, } from '../schemas/admin-secrets.js';
+export const adminSecretsEndpoints = {
+    list: defineEndpoint({
+        method: 'GET',
+        path: '/admin/secrets',
+        response: AdminListSecretsResult,
+        plane: 'admin',
+        summary: 'List rotatable platform secrets with last-rotation age + overdue flag (drives `sylphx_secret_age_days`)',
+        tags: ['admin-secrets'],
+    }),
+    rotate: defineEndpoint({
+        method: 'POST',
+        path: '/admin/secrets/rotate',
+        body: AdminRotateSecretInput,
+        response: AdminRotateSecretResult,
+        plane: 'admin',
+        summary: 'Record a secret-rotation event for compliance + emit the audit row. ' +
+            'Pass dryRun=true to inspect status without writing.',
+        tags: ['admin-secrets'],
+    }),
+};