@sylphx/contract 0.5.1 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # @sylphx/contract
 
+## 0.7.0
+
+### Minor Changes
+
+- [#746](https://github.com/SylphxAI/platform/pull/746) [`382a78e`](https://github.com/SylphxAI/platform/commit/382a78e2fb52d248890ae4fcb9551b8dde17a641) Thanks [@shtse8](https://github.com/shtse8)! - Align Management SDK email logs, suppressions, and settings with the contract-derived email admin surface.
+
+  The email management module now returns the contract list shape for logs, exposes log detail and suppression management helpers, and uses the contract settings input/response types. Consumers using the older hand-written email settings or log-list TypeScript shapes should migrate to the exported `EmailSettings`, `UpdateEmailSettingsInput`, `ListEmailLogsResult`, and `ListSuppressionsResult` types.
+
+## 0.6.0
+
+### Minor Changes
+
+- [#679](https://github.com/SylphxAI/platform/pull/679) [`df3c86e`](https://github.com/SylphxAI/platform/commit/df3c86e210f165070ed1e2f715eeed11ece6f07b) Thanks [@shtse8](https://github.com/shtse8)! - Align organization creation with the runtime SDK contract by supporting server-generated slugs plus optional organization email and metadata.
+
 ## 0.5.1
 
 ### Patch Changes
@@ -34,7 +48,7 @@
 
 ### Changes
 
-- **Initial beta release.** Effect Schema SSOT for the entire Sylphx API surface. Per [ADR-084](https://github.com/SylphxAI/platform/blob/main/docs/adr/ADR-084-effect-schema-contract.md), every endpoint, request body, response envelope, and error type is defined once in this package and consumed everywhere — `apps/api` Hono routes, the published SDKs (`@sylphx/management`, `@sylphx/sdk`), and the derived `openapi.json` spec. Hand-written parallel types are a bug (ADR-084 Rule 2).
+- **Initial beta release.** Effect Schema SSOT for the entire Sylphx API surface. Per **ADR-084** (Effect Schema Contract — Sylphx-internal architecture record), every endpoint, request body, response envelope, and error type is defined once in this package and consumed everywhere — `apps/api` Hono routes, the published SDKs (`@sylphx/management`, `@sylphx/sdk`), and the derived `openapi.json` spec. Hand-written parallel types are a bug (ADR-084 Rule 2).
 - **70 endpoint groups, 82 schema files, ~745 endpoint definitions** covering three planes:
   - **Management** (`api.sylphx.com/v1`, Bearer `slx_*` / `sk_*`): `projects`, `deployments`, `environments`, `databases`, `envVars`, `domains`, `organizations`, `secrets`, `users`, `ciSettings`, `github`, `billingSettings`, `serviceTokens`, `serviceTokenRequests`, `runners`, `backups`, `webhooks`, `tasks`, `storage`, `storageAdmin`, `realtime`, `realtimeAdmin`, `saml`, `oidc`, `security`, `monitoring`, `monitoringAdmin`, `analytics`, `analyticsAdmin`, `flags`, `flagsAdmin`, `experiments`, `newsletter`, `referralsAdmin`, `engagementAdmin`, `aiAdmin`, `search`, `sessionReplay`, `email`, `emailAdmin`, `notifications`, `notificationsAdmin`, `consentAdmin`, `privacy`, `plans`, `billingConsole`.
   - **BaaS** (`<tenant-slug>.api.sylphx.com/v1`, ADR-083.1): `auth`, `refresh`, `challenge`, `kv`, `kvAdmin`, `email` (transactional send), `notifications` (push / in-app), `flags.evaluate`, `realtime` (pub/sub), `storage`, `search`.

package/README.md

@@ -5,7 +5,7 @@
 
 > The Effect Schema SSOT for every Sylphx API endpoint.
 
-Part of [ADR-084 — Effect Schema Contract](https://github.com/SylphxAI/platform/blob/main/docs/adr/ADR-084-effect-schema-contract.md).
+Part of **ADR-084 — Effect Schema Contract** (Sylphx-internal architecture record).
 
 ## Installation
 

package/dist/compute.d.ts

@@ -0,0 +1,33 @@
+import type { MachineSize } from './schemas/project-manifest.js';
+export declare const MACHINE_SIZES: readonly ["nano", "micro", "small", "standard", "large", "xlarge"];
+export declare const DEFAULT_MACHINE_SIZE: MachineSize;
+export interface MachineConfig {
+    cpu?: string;
+    memory?: string;
+    gpu?: string;
+}
+export interface MachineResourceRequirements {
+    requests?: {
+        cpu?: string;
+        memory?: string;
+    };
+    limits?: {
+        cpu?: string;
+        memory?: string;
+    };
+}
+export interface MachineTierResources {
+    cpuCores: number;
+    ramGb: number;
+}
+export declare const MACHINE_CONFIGS: Record<MachineSize, MachineConfig>;
+export declare const MACHINE_RESOURCE_REQUIREMENTS: Record<MachineSize, MachineResourceRequirements>;
+export declare const MACHINE_MAX_INSTANCES: Record<MachineSize, number>;
+export declare function isMachineSize(value: unknown): value is MachineSize;
+export declare function parseMachineSize(value: unknown): MachineSize | null;
+export declare function toPublicMachineSize(value: unknown): MachineSize | null;
+export declare function resolveMachineConfig(machine: MachineSize): MachineConfig;
+export declare function resolveMachineResources(machine: MachineSize): MachineResourceRequirements;
+export declare function resolveMachineMaxInstances(machine: MachineSize): number;
+export declare function resolveMachineTierResources(machine: MachineSize): MachineTierResources;
+//# sourceMappingURL=compute.d.ts.map

package/dist/compute.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compute.d.ts","sourceRoot":"","sources":["../src/compute.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAEhE,eAAO,MAAM,aAAa,oEAOiB,CAAA;AAE3C,eAAO,MAAM,oBAAoB,EAAE,WAAwB,CAAA;AAE3D,MAAM,WAAW,aAAa;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,2BAA2B;IAC3C,QAAQ,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAC5C,MAAM,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAC1C;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;CACb;AAED,eAAO,MAAM,eAAe,EAAE,MAAM,CAAC,WAAW,EAAE,aAAa,CAO9D,CAAA;AAED,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,WAAW,EAAE,2BAA2B,CAyB1F,CAAA;AAED,eAAO,MAAM,qBAAqB,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAO7D,CAAA;AAkBD,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAElE;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAEnE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,WAAW,GAAG,IAAI,CAItE;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,GAAG,aAAa,CAExE;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,WAAW,GAAG,2BAA2B,CAMzF;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,WAAW,GAAG,MAAM,CAEvE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,WAAW,GAAG,oBAAoB,CAMtF"}

package/dist/compute.js

@@ -0,0 +1,119 @@
+export const MACHINE_SIZES = [
+    'nano',
+    'micro',
+    'small',
+    'standard',
+    'large',
+    'xlarge',
+];
+export const DEFAULT_MACHINE_SIZE = 'standard';
+export const MACHINE_CONFIGS = {
+    nano: { cpu: '100m', memory: '256Mi' },
+    micro: { cpu: '250m', memory: '512Mi' },
+    small: { cpu: '500m', memory: '1Gi' },
+    standard: { cpu: '1000m', memory: '2Gi' },
+    large: { cpu: '2000m', memory: '4Gi' },
+    xlarge: { cpu: '4000m', memory: '8Gi' },
+};
+export const MACHINE_RESOURCE_REQUIREMENTS = {
+    nano: {
+        requests: MACHINE_CONFIGS.nano,
+        limits: { cpu: '500m', memory: '512Mi' },
+    },
+    micro: {
+        requests: MACHINE_CONFIGS.micro,
+        limits: { cpu: '1000m', memory: '1Gi' },
+    },
+    small: {
+        requests: MACHINE_CONFIGS.small,
+        limits: { cpu: '2000m', memory: '2Gi' },
+    },
+    standard: {
+        requests: MACHINE_CONFIGS.standard,
+        limits: { cpu: '4000m', memory: '4Gi' },
+    },
+    large: {
+        requests: MACHINE_CONFIGS.large,
+        limits: { cpu: '8000m', memory: '8Gi' },
+    },
+    xlarge: {
+        requests: MACHINE_CONFIGS.xlarge,
+        limits: { cpu: '16000m', memory: '16Gi' },
+    },
+};
+export const MACHINE_MAX_INSTANCES = {
+    nano: 1,
+    micro: 3,
+    small: 5,
+    standard: 10,
+    large: 10,
+    xlarge: 20,
+};
+const LEGACY_PUBLIC_MACHINE_SIZE_ALIASES = {
+    xs: 'nano',
+    sm: 'micro',
+    md: 'standard',
+    lg: 'large',
+    xl: 'xlarge',
+    '2xl': 'xlarge',
+    '4xl': 'xlarge',
+    'starter-1x': 'standard',
+    'standard-1x': 'large',
+    'standard-2x': 'large',
+    'performance-m': 'xlarge',
+    'performance-l': 'xlarge',
+    'performance-xl': 'xlarge',
+};
+export function isMachineSize(value) {
+    return typeof value === 'string' && MACHINE_SIZES.includes(value);
+}
+export function parseMachineSize(value) {
+    return isMachineSize(value) ? value : null;
+}
+export function toPublicMachineSize(value) {
+    if (isMachineSize(value))
+        return value;
+    if (typeof value !== 'string')
+        return null;
+    return LEGACY_PUBLIC_MACHINE_SIZE_ALIASES[value] ?? null;
+}
+export function resolveMachineConfig(machine) {
+    return { ...MACHINE_CONFIGS[machine] };
+}
+export function resolveMachineResources(machine) {
+    const resources = MACHINE_RESOURCE_REQUIREMENTS[machine];
+    const resolved = {};
+    if (resources.requests)
+        resolved.requests = { ...resources.requests };
+    if (resources.limits)
+        resolved.limits = { ...resources.limits };
+    return resolved;
+}
+export function resolveMachineMaxInstances(machine) {
+    return MACHINE_MAX_INSTANCES[machine];
+}
+export function resolveMachineTierResources(machine) {
+    const resources = MACHINE_RESOURCE_REQUIREMENTS[machine];
+    return {
+        cpuCores: parseCpuCores(resources.limits?.cpu ?? resources.requests?.cpu),
+        ramGb: parseMemoryGb(resources.limits?.memory ?? resources.requests?.memory),
+    };
+}
+function parseCpuCores(quantity) {
+    if (!quantity)
+        return 0;
+    if (quantity.endsWith('m'))
+        return Number.parseFloat(quantity) / 1000;
+    return Number.parseFloat(quantity);
+}
+function parseMemoryGb(quantity) {
+    if (!quantity)
+        return 0;
+    if (quantity.endsWith('Gi'))
+        return Number.parseFloat(quantity);
+    if (quantity.endsWith('Mi'))
+        return Number.parseFloat(quantity) / 1024;
+    if (quantity.endsWith('Ki'))
+        return Number.parseFloat(quantity) / (1024 * 1024);
+    return Number.parseFloat(quantity) / 1024 ** 3;
+}

package/dist/endpoint.d.ts

@@ -72,8 +72,10 @@ interface EndpointBase<Method extends HttpMethod = HttpMethod, Path extends stri
      *
      * `admin` is a distinct plane covering Console operator-dashboard routes
      * that customers never consume (super-admin platform administration).
+     * `operator` is lower-level platform-owned mutation/debug surface and is
+     * intentionally excluded from public OpenAPI snapshots.
      */
-    readonly plane?: 'management' | 'baas' | 'admin';
+    readonly plane?: 'management' | 'baas' | 'admin' | 'operator';
     /**
      * OpenAPI security requirements. Omit for the default bearerAuth contract;
      * use an empty array for deliberately public endpoints such as sign-in and

package/dist/endpoint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../src/endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEpC,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpE,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;AAEzD,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAA;AAEjD,MAAM,MAAM,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;AAE3E,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,qBAAqB,CAAA;AAEzE,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAClC;AAED,eAAO,MAAM,wBAAwB;;;CAGO,CAAA;AAE5C;;;;;;;;GAQG;AACH,UAAU,YAAY,CACrB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAC7D,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS;IAEzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAA;IAChD;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,KAAK,cAAc,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,IAAI,OAAO,CACzE,OAAO,EACP,mBAAmB,GAAG,SAAS,CAC/B,CAAA;AAED,KAAK,gBAAgB,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,IAAI,OAAO,CAC3E,OAAO,EACP,qBAAqB,CACrB,CAAA;AAED,MAAM,MAAM,YAAY,CACvB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE7D,QAAQ,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAChF,OAAO,SAAS,mBAAmB,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,IAC9E,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG;IAC9D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,CACzB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAC7D,OAAO,SAAS,qBAAqB,GAAG,qBAAqB,IAC1D,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,GAAG;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,QAAQ,CACnB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE7D,QAAQ,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAChF,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAEvE,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,GAClF,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,UAAU,EACzB,IAAI,SAAS,MAAM,EACnB,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,EACrD,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,EACpD,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,EACnD,QAAQ,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EACxE,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,SAAS,EAEvD,UAAU,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,KACtE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAa,CAAA;AAE7E,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAClC,GAAG,uBAAuB,CAI1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAA;CAChD"}
+{"version":3,"file":"endpoint.d.ts","sourceRoot":"","sources":["../src/endpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEpC,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,GAAG,QAAQ,CAAA;AAEpE,mEAAmE;AACnE,MAAM,MAAM,qBAAqB,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAAA;AAEzD,0FAA0F;AAC1F,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,MAAM,CAAA;AAEjD,MAAM,MAAM,yBAAyB,GAAG,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAA;AAE3E,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAA;IAC3C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,qBAAqB;IACrC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,qBAAqB,CAAA;AAEzE,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;CAClC;AAED,eAAO,MAAM,wBAAwB;;;CAGO,CAAA;AAE5C;;;;;;;;GAQG;AACH,UAAU,YAAY,CACrB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAC7D,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS;IAEzE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,CAAA;IACpB;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAA;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,GAAG,UAAU,CAAA;IAC7D;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,qFAAqF;IACrF,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED,KAAK,cAAc,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,IAAI,OAAO,CACzE,OAAO,EACP,mBAAmB,GAAG,SAAS,CAC/B,CAAA;AAED,KAAK,gBAAgB,CAAC,OAAO,SAAS,eAAe,GAAG,SAAS,IAAI,OAAO,CAC3E,OAAO,EACP,qBAAqB,CACrB,CAAA;AAED,MAAM,MAAM,YAAY,CACvB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE7D,QAAQ,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAChF,OAAO,SAAS,mBAAmB,GAAG,SAAS,GAAG,mBAAmB,GAAG,SAAS,IAC9E,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG;IAC9D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,cAAc,CACzB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAC7D,OAAO,SAAS,qBAAqB,GAAG,qBAAqB,IAC1D,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,GAAG;IAC/E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,QAAQ,CACnB,MAAM,SAAS,UAAU,GAAG,UAAU,EACtC,IAAI,SAAS,MAAM,GAAG,MAAM,EAE5B,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE/D,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE9D,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,SAAS,GAAG,GAAG,EAE7D,QAAQ,SAAS,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,EAChF,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,IAEvE,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,OAAO,CAAC,CAAC,GAClF,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAC1B,MAAM,SAAS,UAAU,EACzB,IAAI,SAAS,MAAM,EACnB,MAAM,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,EACrD,KAAK,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,EACpD,IAAI,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,SAAS,EACnD,QAAQ,SAAS,MAAM,CAAC,MAAM,CAAC,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,EACxE,OAAO,SAAS,eAAe,GAAG,SAAS,GAAG,SAAS,EAEvD,UAAU,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,KACtE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAa,CAAA;AAE7E,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE;IAChD,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAA;CAClC,GAAG,uBAAuB,CAI1B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,GAAG,aAAa,CAAA;CAChD"}

package/dist/endpoints/admin-audit.d.ts

@@ -5,7 +5,7 @@
  * Production mount: `/admin/audit/*`. The audit tree aggregates data from
  * many per-project databases. Where the shape is stable we use typed
  * schemas; where the payload is a pass-through from an evolving external
- * surface (Loki, Tempo, Mimir, CNPG) we use envelope-typed schemas; the
+ * surface (logs, traces, metrics, databases) we use envelope-typed schemas; the
  * residual `AdminAuditUnknownResult` cases are documented inline.
  */
 export declare const adminAuditEndpoints: {
@@ -442,7 +442,7 @@ export declare const adminAuditEndpoints: {
         latencyP95: import("effect/Schema").Array$<typeof import("effect/Schema").Unknown>;
         cpuUsage: import("effect/Schema").Array$<typeof import("effect/Schema").Unknown>;
         memoryUsage: import("effect/Schema").Array$<typeof import("effect/Schema").Unknown>;
-        podCount: import("effect/Schema").Array$<typeof import("effect/Schema").Unknown>;
+        instanceCount: import("effect/Schema").Array$<typeof import("effect/Schema").Unknown>;
     }>, undefined>;
     readonly obsMetricsRange: import("../endpoint.js").Endpoint<"GET", "/operator/audit/projects/:id/obs/metrics/range", import("effect/Schema").Struct<{
         id: typeof import("effect/Schema").String;

package/dist/endpoints/admin-audit.js

@@ -5,7 +5,7 @@
  * Production mount: `/admin/audit/*`. The audit tree aggregates data from
  * many per-project databases. Where the shape is stable we use typed
  * schemas; where the payload is a pass-through from an evolving external
- * surface (Loki, Tempo, Mimir, CNPG) we use envelope-typed schemas; the
+ * surface (logs, traces, metrics, databases) we use envelope-typed schemas; the
  * residual `AdminAuditUnknownResult` cases are documented inline.
  */
 import { defineEndpoint } from '../endpoint.js';
@@ -416,7 +416,7 @@ export const adminAuditEndpoints = {
         method: 'GET',
         path: '/operator/audit/projects/:id/database/metrics',
         params: AdminAuditProjectParams,
-        // CNPG real-time metrics passthrough — upstream operator owns the shape.
+        // Database real-time metrics passthrough — upstream operator owns the shape.
         response: AdminAuditUnknownResult,
         plane: 'management',
         summary: 'Database metrics',

package/dist/endpoints/admin-bootstrap.js

@@ -16,10 +16,10 @@ export const adminBootstrapEndpoints = {
         response: ResetBootstrapWindowResult,
         plane: 'management',
         summary: 'Re-open the Appwrite-pattern bootstrap window',
-        description: 'Forcibly sets the `bootstrap:window:open` Redis key (TTL 600s) so ' +
-            'another call to `POST /v1/auth/bootstrap-signup` will succeed. ' +
+        description: 'Forcibly re-opens the managed bootstrap window (TTL 600s) so another ' +
+            'call to `POST /v1/auth/bootstrap-signup` will succeed. ' +
             'Requires a super-admin platform session. The window normally opens ' +
-            'exactly once per fresh cluster and closes itself on first successful ' +
+            'exactly once per fresh installation and closes itself on first successful ' +
             'bootstrap signup; this endpoint is the documented recovery path when ' +
             'the window expires before an operator can use it, or when a second ' +
             'recovery admin needs to be created via the same flow.',

package/dist/endpoints/admin-branch-databases.d.ts

@@ -2,7 +2,7 @@
  * Admin Branch Databases endpoints — operator recovery surface.
  *
  * Replaces raw production `branch_databases` UPDATE/INSERT repair steps with
- * scoped service-token endpoints. The controller still owns all CNPG/Rook
+ * scoped service-token endpoints. The controller still owns all backend
  * side effects; these endpoints only mutate the branch DB desired-state row.
  */
 export declare const adminBranchDatabasesEndpoints: {

package/dist/endpoints/admin-branch-databases.js

@@ -2,7 +2,7 @@
  * Admin Branch Databases endpoints — operator recovery surface.
  *
  * Replaces raw production `branch_databases` UPDATE/INSERT repair steps with
- * scoped service-token endpoints. The controller still owns all CNPG/Rook
+ * scoped service-token endpoints. The controller still owns all backend
  * side effects; these endpoints only mutate the branch DB desired-state row.
  */
 import { defineEndpoint } from '../endpoint.js';
@@ -32,7 +32,7 @@ export const adminBranchDatabasesEndpoints = {
         plane: 'management',
         summary: 'Schedule preview branch database teardown from the operator plane',
         description: 'Transitions the active branch database for a preview environment to ' +
-            '`destroying`; the controller performs CNPG/Rook cleanup and stamps ' +
+            '`destroying`; the controller performs backend cleanup and stamps ' +
             '`destroyed`. Re-running while already destroying is idempotent. Requires ' +
             'service token scope `platform:branchdb:destroy` and emits an `audit_logs` ' +
             'row with `operation=branch_database_destroy`.',

package/dist/endpoints/admin-config.d.ts

@@ -172,6 +172,9 @@ export declare const adminConfigEndpoints: {
         filename: typeof import("effect/Schema").String;
         count: typeof import("effect/Schema").Number;
     }>, undefined>;
+    readonly getOAuthProviders: import("../endpoint.js").Endpoint<"GET", "/operator/config/oauth-providers", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
+        enabledProviders: import("effect/Schema").Array$<typeof import("effect/Schema").String>;
+    }>, undefined>;
     readonly notificationsOverview: import("../endpoint.js").Endpoint<"GET", "/operator/config/notifications/overview", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, typeof import("effect/Schema").Unknown, undefined>;
     readonly referralsOverview: import("../endpoint.js").Endpoint<"GET", "/operator/config/referrals/overview", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, typeof import("effect/Schema").Unknown, undefined>;
     readonly flagsOverview: import("../endpoint.js").Endpoint<"GET", "/operator/config/flags/overview", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, typeof import("effect/Schema").Unknown, undefined>;

package/dist/endpoints/admin-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-config.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAkBH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmGvB,CAAA"}
+{"version":3,"file":"admin-config.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2GvB,CAAA"}

package/dist/endpoints/admin-config.js

@@ -5,7 +5,7 @@
  * Production mount: `/admin/config/*`.
  */
 import { defineEndpoint } from '../endpoint.js';
-import { AdminConfigProjectParams, AdminExportUsersResult, AdminGetConsentConfigResult, AdminGetPushCredentialsResult, AdminGetReferralConfigResult, AdminOverviewResult, AdminUpdateConsentConfigInput, AdminUpdateConsentConfigResult, AdminUpdatePushCredentialsInput, AdminUpdatePushCredentialsResult, AdminUpdateReferralConfigInput, AdminUpdateReferralConfigResult, } from '../schemas/admin-config.js';
+import { AdminConfigProjectParams, AdminExportUsersResult, AdminGetConsentConfigResult, AdminGetPushCredentialsResult, AdminGetReferralConfigResult, AdminOAuthProvidersResult, AdminOverviewResult, AdminUpdateConsentConfigInput, AdminUpdateConsentConfigResult, AdminUpdatePushCredentialsInput, AdminUpdatePushCredentialsResult, AdminUpdateReferralConfigInput, AdminUpdateReferralConfigResult, } from '../schemas/admin-config.js';
 export const adminConfigEndpoints = {
     getReferralConfig: defineEndpoint({
         method: 'GET',
@@ -73,6 +73,14 @@ export const adminConfigEndpoints = {
         summary: 'Export app users as CSV',
         tags: ['admin-config'],
     }),
+    getOAuthProviders: defineEndpoint({
+        method: 'GET',
+        path: '/operator/config/oauth-providers',
+        response: AdminOAuthProvidersResult,
+        plane: 'management',
+        summary: 'List platform OAuth providers configured by environment',
+        tags: ['admin-config'],
+    }),
     notificationsOverview: defineEndpoint({
         method: 'GET',
         path: '/operator/config/notifications/overview',

package/dist/endpoints/admin-envs-spec.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Admin Envs-Spec endpoint — operator-only desired-spec patch surface.
+ *
+ * Scope: `platform:envs:spec`. Plane: operator.
+ */
+export declare const adminEnvsSpecEndpoints: {
+    readonly patch: import("../endpoint.js").Endpoint<"PATCH", "/operator/envs/:envId/spec", import("effect/Schema").Struct<{
+        envId: import("effect/Schema").filter<typeof import("effect/Schema").String>;
+    }>, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").filter<import("effect/Schema").Struct<{
+        runtimeClassName: import("effect/Schema").optional<import("effect/Schema").NullOr<typeof import("effect/Schema").String>>;
+        defaultSandboxImage: import("effect/Schema").optional<import("effect/Schema").NullOr<import("effect/Schema").filter<typeof import("effect/Schema").String>>>;
+        defaultSecurityContext: import("effect/Schema").optional<import("effect/Schema").Struct<{
+            runAsNonRoot: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+            allowPrivilegeEscalation: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+            privileged: import("effect/Schema").optional<typeof import("effect/Schema").Boolean>;
+        }>>;
+        defaultHealthAgentMode: import("effect/Schema").optional<import("effect/Schema").Literal<["auto", "passthrough", "disabled"]>>;
+        reason: import("effect/Schema").filter<import("effect/Schema").filter<typeof import("effect/Schema").String>>;
+    }>>, import("effect/Schema").Struct<{
+        envId: import("effect/Schema").filter<typeof import("effect/Schema").String>;
+        runtimeClassName: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        defaultSandboxImage: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        defaultSecurityContext: import("effect/Schema").NullOr<import("effect/Schema").Record$<typeof import("effect/Schema").String, typeof import("effect/Schema").Unknown>>;
+        defaultHealthAgentMode: import("effect/Schema").NullOr<import("effect/Schema").Literal<["auto", "passthrough", "disabled"]>>;
+    }>, undefined>;
+};
+//# sourceMappingURL=admin-envs-spec.d.ts.map

package/dist/endpoints/admin-envs-spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-envs-spec.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-envs-spec.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AASH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;CAkBzB,CAAA"}

package/dist/endpoints/admin-envs-spec.js

@@ -0,0 +1,25 @@
+/**
+ * Admin Envs-Spec endpoint — operator-only desired-spec patch surface.
+ *
+ * Scope: `platform:envs:spec`. Plane: operator.
+ */
+import { defineEndpoint } from '../endpoint.js';
+import { AdminEnvsSpecParams, AdminEnvsSpecPatchInput, AdminEnvsSpecPatchResult, } from '../schemas/admin-envs-spec.js';
+export const adminEnvsSpecEndpoints = {
+    patch: defineEndpoint({
+        method: 'PATCH',
+        path: '/operator/envs/:envId/spec',
+        params: AdminEnvsSpecParams,
+        body: AdminEnvsSpecPatchInput,
+        response: AdminEnvsSpecPatchResult,
+        plane: 'operator',
+        summary: 'Patch operator-only environment desired-spec fields',
+        description: 'Mutates the operator-owned subset of environment desired_spec: ' +
+            'runtimeClassName, defaultSandboxImage, defaultSecurityContext, and ' +
+            'defaultHealthAgentMode. Requires service token scope `platform:envs:spec`, ' +
+            'validates the merged result against the canonical EnvSpec schema, rejects ' +
+            'privileged security context unless runtimeClassName contains `kata`, queues ' +
+            'reconciliation for materialized environments, and emits an audit log.',
+        tags: ['admin-envs-spec'],
+    }),
+};

package/dist/endpoints/admin-projects.d.ts

@@ -149,7 +149,7 @@ export declare const adminProjectsEndpoints: {
         role: typeof import("effect/Schema").String;
         resourceId: typeof import("effect/Schema").String;
         status: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
-        clusterName: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+        backendName: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
     }>>, undefined>;
 };
 //# sourceMappingURL=admin-projects.d.ts.map

package/dist/endpoints/admin-rate-limits.d.ts

@@ -15,7 +15,7 @@
  *   2. DB row for credential type → multiplier.
  *   3. Inline `CREDENTIAL_MULTIPLIERS_INLINE` defaults if the DB lookup
  *      fails (config-path fail-open). The enforcement layer itself still
- *      fails CLOSED on Redis outages.
+ *      fails CLOSED on managed cache outages.
  *
  * @see `apps/api/src/server/platform/routes/admin/rate-limits.ts`
  * @see `packages/core/src/lib/security/rate-limit-credential-multipliers.ts`

package/dist/endpoints/admin-rate-limits.js

@@ -15,7 +15,7 @@
  *   2. DB row for credential type → multiplier.
  *   3. Inline `CREDENTIAL_MULTIPLIERS_INLINE` defaults if the DB lookup
  *      fails (config-path fail-open). The enforcement layer itself still
- *      fails CLOSED on Redis outages.
+ *      fails CLOSED on managed cache outages.
  *
  * @see `apps/api/src/server/platform/routes/admin/rate-limits.ts`
  * @see `packages/core/src/lib/security/rate-limit-credential-multipliers.ts`
@@ -32,8 +32,8 @@ export const adminRateLimitsEndpoints = {
         description: 'Returns one row per credential type (`public`, `secret`, `service`, ' +
             '`session`, `spiffe`, `unknown`) with its multiplier, exempt flag, ' +
             'operator-supplied notes, and last-update timestamp. Reads ' +
-            'authoritatively from the DB; the in-memory cache is refreshed every ' +
-            '5 minutes via Redis. Requires service token with scope ' +
+            'authoritatively from the DB; the enforcement cache is refreshed every ' +
+            '5 minutes. Requires service token with scope ' +
             '`platform:ratelimits:write`.',
         tags: ['admin-rate-limits'],
     }),

package/dist/endpoints/admin-secrets.d.ts

@@ -6,7 +6,7 @@
  *
  * Auth: service-token + scope `platform:secrets:rotate` (NOT super-admin
  * session — see schema header for rationale). The endpoint is the audit
- * trail; actual K8s secret value updates remain a two-person Ops runbook
+ * trail; actual secret value updates remain a two-person Ops runbook
  * step (`docs/runbooks/secret-rotation.md`).
  */
 export declare const adminSecretsEndpoints: {
@@ -17,7 +17,7 @@ export declare const adminSecretsEndpoints: {
             ageDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
             cadenceDays: typeof import("effect/Schema").Number;
             overdue: typeof import("effect/Schema").Boolean;
-            clusterSecretRef: typeof import("effect/Schema").String;
+            rotationTarget: typeof import("effect/Schema").String;
         }>>;
     }>, undefined>;
     readonly rotate: import("../endpoint.js").Endpoint<"POST", "/operator/secrets/rotate", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
@@ -32,7 +32,7 @@ export declare const adminSecretsEndpoints: {
             ageDays: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
             cadenceDays: typeof import("effect/Schema").Number;
             overdue: typeof import("effect/Schema").Boolean;
-            clusterSecretRef: typeof import("effect/Schema").String;
+            rotationTarget: typeof import("effect/Schema").String;
         }>;
         auditLogId: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
         message: typeof import("effect/Schema").String;

package/dist/endpoints/admin-secrets.js

@@ -6,7 +6,7 @@
  *
  * Auth: service-token + scope `platform:secrets:rotate` (NOT super-admin
  * session — see schema header for rationale). The endpoint is the audit
- * trail; actual K8s secret value updates remain a two-person Ops runbook
+ * trail; actual secret value updates remain a two-person Ops runbook
  * step (`docs/runbooks/secret-rotation.md`).
  */
 import { defineEndpoint } from '../endpoint.js';

package/dist/endpoints/admin-services.d.ts

@@ -17,11 +17,11 @@ export declare const adminServicesEndpoints: {
     readonly imageStatus: import("../endpoint.js").Endpoint<"GET", "/operator/services/image-status", import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Schema.AnyNoContext | undefined, import("effect/Schema").Struct<{
         services: import("effect/Schema").Array$<import("effect/Schema").Struct<{
             name: typeof import("effect/Schema").String;
-            dbRef: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
-            k8sRef: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            controlRef: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            runtimeRef: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
             driftMinutes: import("effect/Schema").NullOr<typeof import("effect/Schema").Number>;
             inSync: typeof import("effect/Schema").Boolean;
-            dbUpdatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
+            controlUpdatedAt: import("effect/Schema").NullOr<typeof import("effect/Schema").String>;
         }>>;
         checkedAt: typeof import("effect/Schema").String;
     }>, undefined>;

package/dist/endpoints/admin-services.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-services.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;CAkBzB,CAAA"}
+{"version":3,"file":"admin-services.d.ts","sourceRoot":"","sources":["../../src/endpoints/admin-services.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;CAiBzB,CAAA"}

package/dist/endpoints/admin-services.js

@@ -21,14 +21,13 @@ export const adminServicesEndpoints = {
         path: '/operator/services/image-status',
         response: AdminServiceImageStatusResult,
         plane: 'management',
-        summary: 'Per-Platform-service image SSOT vs live K8s drift report',
+        summary: 'Per-Platform-service image SSOT vs live runtime drift report',
         description: 'Returns one row per Platform service (controller, api, runtime, ' +
-            'web, exec-server, storage-gateway, storage-worker) reporting both ' +
-            '`project_services.latest_image_ref` (DB SSOT) and the live ' +
-            '`Deployment.spec.template.spec.containers[0].image` (K8s). The ' +
+            'web, exec-server, storage-gateway, storage-worker) reporting both the ' +
+            'control-plane artifact reference and the live runtime artifact reference. The ' +
             'drift-watchdog cronjob polls this every 10 minutes; rows where ' +
             '`inSync=false` past a 30-minute grace window page on-call. ' +
-            'Read-only: never mutates DB or K8s state. Requires service token ' +
+            'Read-only: never mutates control-plane or runtime state. Requires service token ' +
             'with scope `platform:services:read`.',
         tags: ['admin-services'],
     }),