@sylphx/management 0.1.0 → 0.2.0

package/dist/sandboxes.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Ephemeral compute sandboxes (ADR-052 container_executions).
+ *
+ *   POST   /projects/:id/sandboxes   — create (waits for pod ready)
+ *   GET    /projects/:id/sandboxes   — list active sandboxes for a project
+ *   GET    /sandboxes/:id            — get details
+ *   DELETE /sandboxes/:id            — terminate
+ */
+import type { Client } from './client.js';
+import type { Sandbox, SandboxCreateResult, SandboxSummary } from './types.js';
+export declare const create: (client: Client, projectId: string, body: Record<string, unknown>) => Promise<SandboxCreateResult>;
+export declare const list: (client: Client, projectId: string) => Promise<SandboxSummary[]>;
+export declare const get: (client: Client, sandboxId: string) => Promise<Sandbox>;
+export declare const terminate: (client: Client, sandboxId: string) => Promise<void>;
+//# sourceMappingURL=sandboxes.d.ts.map

package/dist/sandboxes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxes.d.ts","sourceRoot":"","sources":["../src/sandboxes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAE9E,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC3B,OAAO,CAAC,mBAAmB,CAC4D,CAAA;AAE1F,eAAO,MAAM,IAAI,GAAU,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,cAAc,EAAE,CAOtF,CAAA;AAED,eAAO,MAAM,GAAG,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,CACD,CAAA;AAEtE,eAAO,MAAM,SAAS,GAAU,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,IAAI,CAE/E,CAAA"}

package/dist/sandboxes.js

@@ -0,0 +1,18 @@
+/**
+ * Ephemeral compute sandboxes (ADR-052 container_executions).
+ *
+ *   POST   /projects/:id/sandboxes   — create (waits for pod ready)
+ *   GET    /projects/:id/sandboxes   — list active sandboxes for a project
+ *   GET    /sandboxes/:id            — get details
+ *   DELETE /sandboxes/:id            — terminate
+ */
+import { request } from './http.js';
+export const create = (client, projectId, body) => request(client, 'POST', `/projects/${encodeURIComponent(projectId)}/sandboxes`, { body });
+export const list = async (client, projectId) => {
+    const res = await request(client, 'GET', `/projects/${encodeURIComponent(projectId)}/sandboxes`);
+    return Array.isArray(res) ? res : (res.sandboxes ?? []);
+};
+export const get = (client, sandboxId) => request(client, 'GET', `/sandboxes/${encodeURIComponent(sandboxId)}`);
+export const terminate = async (client, sandboxId) => {
+    await request(client, 'DELETE', `/sandboxes/${encodeURIComponent(sandboxId)}`);
+};

package/dist/search.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Indexed search — analytics, corpus stats, and document listing.
+ *
+ *   GET  /search/projects/:projectId/analytics  — top queries, CTR, latency
+ *   GET  /search/projects/:projectId/stats      — corpus size + namespace breakdown
+ *   GET  /search/projects/:projectId/documents  — paginated document list
+ *
+ * Console-facing only — the SDK-level search *write* endpoints (index /
+ * query / click) remain internal. Consumers index documents through the
+ * runtime SDK; this namespace is for operator-grade introspection.
+ */
+import type { Client } from './client.js';
+export interface TopQuery {
+    readonly query: string;
+    readonly count: number;
+}
+export interface SearchAnalytics {
+    readonly totalQueries: number;
+    readonly avgLatencyMs: number;
+    readonly clickThroughRate: number;
+    readonly topQueries: readonly TopQuery[];
+}
+export interface AnalyticsOptions {
+    readonly namespace?: string;
+    readonly dateFrom?: string;
+    readonly dateTo?: string;
+}
+export declare const analytics: (client: Client, projectId: string, options?: AnalyticsOptions) => Promise<SearchAnalytics>;
+export interface NamespaceStats {
+    readonly namespace: string;
+    readonly count: number;
+}
+export interface SearchStats {
+    readonly totalDocuments: number;
+    readonly documentsWithEmbedding: number;
+    readonly byNamespace: readonly NamespaceStats[];
+}
+export declare const stats: (client: Client, projectId: string, namespace?: string) => Promise<SearchStats>;
+export interface SearchDocument {
+    readonly id: string;
+    readonly namespace: string;
+    readonly externalId: string | null;
+    readonly title: string | null;
+    readonly contentPreview: string;
+    readonly url: string | null;
+    readonly category: string | null;
+    readonly type: string | null;
+    readonly tags: readonly string[] | null;
+    readonly hasEmbedding: boolean;
+    readonly impressions: number;
+    readonly clicks: number;
+    readonly createdAt: string;
+    readonly updatedAt: string;
+}
+export interface ListDocumentsResult {
+    readonly documents: readonly SearchDocument[];
+    readonly total: number;
+    readonly hasMore: boolean;
+}
+export interface ListDocumentsOptions {
+    readonly namespace?: string;
+    readonly limit?: number;
+    readonly offset?: number;
+}
+export declare const listDocuments: (client: Client, projectId: string, options?: ListDocumentsOptions) => Promise<ListDocumentsResult>;
+//# sourceMappingURL=search.d.ts.map

package/dist/search.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../src/search.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,MAAM,WAAW,QAAQ;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,eAAe;IAC/B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,SAAS,QAAQ,EAAE,CAAA;CACxC;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,SAAS,GACrB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,UAAU,gBAAgB,KACxB,OAAO,CAAC,eAAe,CAOvB,CAAA;AAEH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,SAAS,cAAc,EAAE,CAAA;CAC/C;AAED,eAAO,MAAM,KAAK,GACjB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,YAAY,MAAM,KAChB,OAAO,CAAC,WAAW,CAGnB,CAAA;AAEH,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,mBAAmB;IACnC,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,CAAA;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,eAAO,MAAM,aAAa,GACzB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,UAAU,oBAAoB,KAC5B,OAAO,CAAC,mBAAmB,CAO3B,CAAA"}

package/dist/search.js

@@ -0,0 +1,29 @@
+/**
+ * Indexed search — analytics, corpus stats, and document listing.
+ *
+ *   GET  /search/projects/:projectId/analytics  — top queries, CTR, latency
+ *   GET  /search/projects/:projectId/stats      — corpus size + namespace breakdown
+ *   GET  /search/projects/:projectId/documents  — paginated document list
+ *
+ * Console-facing only — the SDK-level search *write* endpoints (index /
+ * query / click) remain internal. Consumers index documents through the
+ * runtime SDK; this namespace is for operator-grade introspection.
+ */
+import { request } from './http.js';
+export const analytics = (client, projectId, options) => request(client, 'GET', `/search/projects/${encodeURIComponent(projectId)}/analytics`, {
+    query: {
+        namespace: options?.namespace,
+        dateFrom: options?.dateFrom,
+        dateTo: options?.dateTo,
+    },
+});
+export const stats = (client, projectId, namespace) => request(client, 'GET', `/search/projects/${encodeURIComponent(projectId)}/stats`, {
+    query: { namespace },
+});
+export const listDocuments = (client, projectId, options) => request(client, 'GET', `/search/projects/${encodeURIComponent(projectId)}/documents`, {
+    query: {
+        namespace: options?.namespace,
+        limit: options?.limit !== undefined ? String(options.limit) : undefined,
+        offset: options?.offset !== undefined ? String(options.offset) : undefined,
+    },
+});

package/dist/secrets.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Encrypted secrets vault — AES-256-GCM at rest, env-scoped, versioned.
+ *
+ *   GET    /secrets                   — list (project + optional env)
+ *   GET    /secrets/detail?id=&reveal — get one (reveal opt-in only)
+ *   POST   /secrets                   — create
+ *   PATCH  /secrets                   — update (new value → new version)
+ *   DELETE /secrets                   — delete
+ *   POST   /secrets/rollback          — restore a past version
+ *   GET    /secrets/stats             — per-env counts
+ *
+ * Secrets are distinct from `envVars`: envVars are plain K/V for runtime
+ * injection; secrets are a first-class vault with version history, audit
+ * trail, and on-demand decryption. Prefer secrets when the value must
+ * never leak into build logs or reach the filesystem.
+ *
+ * The `reveal` flag on `get()` MUST be passed explicitly — without it
+ * the API returns a masked string. Callers opting in accept full
+ * responsibility for shielding the plaintext.
+ *
+ * Wire shape sourced from `@sylphx/contract` (ADR-084).
+ */
+import type { CreateSecretInput, CreateSecretResult, RollbackSecretResult, SecretDetail, SecretListItem, UpdateSecretInput, UpdateSecretResult } from '@sylphx/contract';
+import type { Client } from './client.js';
+export type { CreateSecretInput as CreateInput, CreateSecretResult as CreateResult, EnvironmentRef, RollbackSecretResult as RollbackResult, SecretDetail, SecretListItem, SecretVersion, UpdateSecretInput as UpdateInput, UpdateSecretResult as UpdateResult, } from '@sylphx/contract';
+export interface ListOptions {
+    readonly environmentId?: string;
+    readonly includeInactive?: boolean;
+}
+export declare const list: (client: Client, projectId: string, options?: ListOptions) => Promise<{
+    secrets: readonly SecretListItem[];
+}>;
+export declare const get: (client: Client, id: string, options?: {
+    reveal?: boolean;
+}) => Promise<SecretDetail>;
+export declare const create: (client: Client, input: CreateSecretInput) => Promise<CreateSecretResult>;
+export declare const update: (client: Client, input: UpdateSecretInput) => Promise<UpdateSecretResult>;
+declare const _delete: (client: Client, id: string) => Promise<{
+    success: boolean;
+}>;
+export { _delete as delete };
+export declare const rollback: (client: Client, id: string, version: string) => Promise<RollbackSecretResult>;
+export interface EnvironmentStats {
+    readonly environmentId: string | null;
+    readonly count: number;
+}
+export declare const stats: (client: Client, projectId: string) => Promise<{
+    stats: readonly EnvironmentStats[];
+}>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EACX,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,kBAAkB,CAAA;AAEzB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKzC,YAAY,EACX,iBAAiB,IAAI,WAAW,EAChC,kBAAkB,IAAI,YAAY,EAClC,cAAc,EACd,oBAAoB,IAAI,cAAc,EACtC,YAAY,EACZ,cAAc,EACd,aAAa,EACb,iBAAiB,IAAI,WAAW,EAChC,kBAAkB,IAAI,YAAY,GAClC,MAAM,kBAAkB,CAAA;AAEzB,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAA;CAClC;AAED,eAAO,MAAM,IAAI,GAChB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,UAAU,WAAW,KACnB,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,cAAc,EAAE,CAAA;CAAE,CAShD,CAAA;AAED,eAAO,MAAM,GAAG,GACf,QAAQ,MAAM,EACd,IAAI,MAAM,EACV,UAAU;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,KAC5B,OAAO,CAAC,YAAY,CAKtB,CAAA;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,OAAO,iBAAiB,KAAG,OAAO,CAAC,kBAAkB,CAG3F,CAAA;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,OAAO,iBAAiB,KAAG,OAAO,CAAC,kBAAkB,CAG3F,CAAA;AAED,QAAA,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAGzE,CAAA;AACD,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,CAAA;AAE5B,eAAO,MAAM,QAAQ,GACpB,QAAQ,MAAM,EACd,IAAI,MAAM,EACV,SAAS,MAAM,KACb,OAAO,CAAC,oBAAoB,CAG9B,CAAA;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,eAAO,MAAM,KAAK,GACjB,QAAQ,MAAM,EACd,WAAW,MAAM,KACf,OAAO,CAAC;IAAE,KAAK,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAAE,CAGhD,CAAA"}

package/dist/secrets.js

@@ -0,0 +1,61 @@
+/**
+ * Encrypted secrets vault — AES-256-GCM at rest, env-scoped, versioned.
+ *
+ *   GET    /secrets                   — list (project + optional env)
+ *   GET    /secrets/detail?id=&reveal — get one (reveal opt-in only)
+ *   POST   /secrets                   — create
+ *   PATCH  /secrets                   — update (new value → new version)
+ *   DELETE /secrets                   — delete
+ *   POST   /secrets/rollback          — restore a past version
+ *   GET    /secrets/stats             — per-env counts
+ *
+ * Secrets are distinct from `envVars`: envVars are plain K/V for runtime
+ * injection; secrets are a first-class vault with version history, audit
+ * trail, and on-demand decryption. Prefer secrets when the value must
+ * never leak into build logs or reach the filesystem.
+ *
+ * The `reveal` flag on `get()` MUST be passed explicitly — without it
+ * the API returns a masked string. Callers opting in accept full
+ * responsibility for shielding the plaintext.
+ *
+ * Wire shape sourced from `@sylphx/contract` (ADR-084).
+ */
+import { secretsEndpoints } from '@sylphx/contract';
+import { request } from './http.js';
+export const list = (client, projectId, options) => {
+    const { method, path } = secretsEndpoints.list;
+    return request(client, method, path, {
+        query: {
+            projectId,
+            environmentId: options?.environmentId,
+            includeInactive: options?.includeInactive ? 'true' : undefined,
+        },
+    });
+};
+export const get = (client, id, options) => {
+    const { method, path } = secretsEndpoints.get;
+    return request(client, method, path, {
+        query: { id, reveal: options?.reveal ? 'true' : undefined },
+    });
+};
+export const create = (client, input) => {
+    const { method, path } = secretsEndpoints.create;
+    return request(client, method, path, { body: input });
+};
+export const update = (client, input) => {
+    const { method, path } = secretsEndpoints.update;
+    return request(client, method, path, { body: input });
+};
+const _delete = (client, id) => {
+    const { method, path } = secretsEndpoints.delete;
+    return request(client, method, path, { body: { id } });
+};
+export { _delete as delete };
+export const rollback = (client, id, version) => {
+    const { method, path } = secretsEndpoints.rollback;
+    return request(client, method, path, { body: { id, version } });
+};
+export const stats = (client, projectId) => {
+    const { method, path } = secretsEndpoints.stats;
+    return request(client, method, path, { query: { projectId } });
+};

package/dist/security.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Security Console — user-facing security settings (Management plane).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/security/*`. Paths come
+ * from `@sylphx/contract` (`securityEndpoints`, mount `/security/*`).
+ *
+ * This is the SDK surface the CLI / Console UI use to drive the
+ * authenticated user's own security settings — distinct from
+ * `@sylphx/sdk.auth` (BaaS plane, end-user sign-in/sign-up) and from
+ * `authSettings.ts` (Management plane, project-level OAuth/SAML config).
+ *
+ * Initial scope (ADR-089 closure for P0-1 — email change). Other
+ * sub-namespaces (2FA, OAuth, password, passkeys, sessions, score,
+ * alerts) follow the same pattern as endpoints stabilise.
+ */
+import type { Client } from './client.js';
+export interface EmailChangeRequestInput {
+    readonly newEmail: string;
+}
+export interface EmailChangeRequestResult {
+    readonly success: boolean;
+    readonly message: string;
+    readonly expiresAt: string;
+}
+/**
+ * Request a change of the authenticated user's email address.
+ *
+ * The Platform issues a 32-byte verification token, persists a pending
+ * `email_change_requests` row, and emails the verification link to the
+ * **new** address. The current address is left untouched until the user
+ * confirms via {@link confirmEmailChange}. Audit-emitted as
+ * `email_change.create` with the new address masked.
+ *
+ * Errors:
+ *   - 409 — `newEmail` is already in use by another account
+ *   - 404 — current user not found (should not happen for a valid session)
+ */
+export declare const requestEmailChange: (client: Client, body: EmailChangeRequestInput) => Promise<EmailChangeRequestResult>;
+export interface EmailChangeConfirmInput {
+    readonly token: string;
+}
+export interface EmailChangeConfirmResult {
+    readonly success: boolean;
+    readonly newEmail: string;
+}
+/**
+ * Confirm a pending email change using the token delivered via email.
+ *
+ * On success the `users.email` column is updated, the pending request is
+ * deleted, a security alert is recorded, and a notification is sent to
+ * the **previous** address. Audit-emitted as `user.update` with
+ * `metadata.action = 'email_changed'`.
+ *
+ * Errors:
+ *   - 422 — invalid or expired token (the row is cleaned up on expiry)
+ */
+export declare const confirmEmailChange: (client: Client, body: EmailChangeConfirmInput) => Promise<EmailChangeConfirmResult>;
+//# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKzC,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,kBAAkB,GAC9B,QAAQ,MAAM,EACd,MAAM,uBAAuB,KAC3B,OAAO,CAAC,wBAAwB,CAGlC,CAAA;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,wBAAwB;IACxC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAC9B,QAAQ,MAAM,EACd,MAAM,uBAAuB,KAC3B,OAAO,CAAC,wBAAwB,CAGlC,CAAA"}

package/dist/security.js

@@ -0,0 +1,49 @@
+/**
+ * Security Console — user-facing security settings (Management plane).
+ *
+ * Mirrors `apps/api/src/server/platform/routes/security/*`. Paths come
+ * from `@sylphx/contract` (`securityEndpoints`, mount `/security/*`).
+ *
+ * This is the SDK surface the CLI / Console UI use to drive the
+ * authenticated user's own security settings — distinct from
+ * `@sylphx/sdk.auth` (BaaS plane, end-user sign-in/sign-up) and from
+ * `authSettings.ts` (Management plane, project-level OAuth/SAML config).
+ *
+ * Initial scope (ADR-089 closure for P0-1 — email change). Other
+ * sub-namespaces (2FA, OAuth, password, passkeys, sessions, score,
+ * alerts) follow the same pattern as endpoints stabilise.
+ */
+import { securityEndpoints } from '@sylphx/contract';
+import { request } from './http.js';
+/**
+ * Request a change of the authenticated user's email address.
+ *
+ * The Platform issues a 32-byte verification token, persists a pending
+ * `email_change_requests` row, and emails the verification link to the
+ * **new** address. The current address is left untouched until the user
+ * confirms via {@link confirmEmailChange}. Audit-emitted as
+ * `email_change.create` with the new address masked.
+ *
+ * Errors:
+ *   - 409 — `newEmail` is already in use by another account
+ *   - 404 — current user not found (should not happen for a valid session)
+ */
+export const requestEmailChange = (client, body) => {
+    const { method, path } = securityEndpoints.email.requestChange;
+    return request(client, method, path, { body });
+};
+/**
+ * Confirm a pending email change using the token delivered via email.
+ *
+ * On success the `users.email` column is updated, the pending request is
+ * deleted, a security alert is recorded, and a notification is sent to
+ * the **previous** address. Audit-emitted as `user.update` with
+ * `metadata.action = 'email_changed'`.
+ *
+ * Errors:
+ *   - 422 — invalid or expired token (the row is cleaned up on expiry)
+ */
+export const confirmEmailChange = (client, body) => {
+    const { method, path } = securityEndpoints.email.confirmChange;
+    return request(client, method, path, { body });
+};

package/dist/serviceTokenRequests.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Service-token requests — user-submitted requests for org-scoped service
+ * tokens that require admin approval before a token is minted. Paired
+ * with `serviceTokens.ts` (which owns the final credential).
+ *
+ *   POST   /orgs/:orgId/service-token-requests              — submit
+ *   GET    /orgs/:orgId/service-token-requests              — list
+ *   GET    /orgs/:orgId/service-token-requests/:id          — get
+ *   POST   /orgs/:orgId/service-token-requests/:id/approve  — admin approve
+ *   POST   /orgs/:orgId/service-token-requests/:id/deny     — admin deny
+ *   POST   /orgs/:orgId/service-token-requests/:id/cancel   — requester cancel
+ *   POST   /orgs/:orgId/service-token-requests/:id/mint     — mint after approve
+ */
+import type { Client } from './client.js';
+export type ServiceTokenRequestStatus = 'pending' | 'approved' | 'denied' | 'cancelled' | 'minted' | 'expired';
+export interface ServiceTokenRequestView {
+    readonly id: string;
+    readonly orgId: string;
+    readonly requestedBy: string;
+    readonly name: string;
+    readonly scopes: readonly string[];
+    readonly projectId: string | null;
+    readonly environmentId: string | null;
+    readonly reason: string | null;
+    readonly status: ServiceTokenRequestStatus;
+    readonly createdAt: string;
+    readonly decidedAt: string | null;
+    readonly decidedBy: string | null;
+    readonly mintedAt: string | null;
+    readonly tokenId: string | null;
+}
+export interface SubmitInput {
+    readonly name: string;
+    readonly scopes: readonly string[];
+    readonly projectId?: string | null;
+    readonly environmentId?: string | null;
+    readonly reason?: string;
+    readonly expiresInDays?: number | null;
+}
+export declare const submit: (client: Client, orgId: string, body: SubmitInput) => Promise<{
+    request: ServiceTokenRequestView;
+}>;
+export declare const list: (client: Client, orgId: string, query?: {
+    readonly status?: ServiceTokenRequestStatus;
+}) => Promise<{
+    requests: readonly ServiceTokenRequestView[];
+}>;
+export declare const get: (client: Client, orgId: string, id: string) => Promise<{
+    request: ServiceTokenRequestView;
+}>;
+export declare const approve: (client: Client, orgId: string, id: string, body?: {
+    readonly note?: string;
+}) => Promise<{
+    request: ServiceTokenRequestView;
+}>;
+export declare const deny: (client: Client, orgId: string, id: string, body?: {
+    readonly reason?: string;
+}) => Promise<{
+    request: ServiceTokenRequestView;
+}>;
+export declare const cancel: (client: Client, orgId: string, id: string) => Promise<{
+    request: ServiceTokenRequestView;
+}>;
+export interface MintResult {
+    /** Raw bearer token — shown ONCE; the server stores a hash. */
+    readonly token: string;
+    readonly tokenId: string;
+    readonly request: ServiceTokenRequestView;
+}
+export declare const mint: (client: Client, orgId: string, id: string) => Promise<MintResult>;
+//# sourceMappingURL=serviceTokenRequests.d.ts.map

package/dist/serviceTokenRequests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenRequests.d.ts","sourceRoot":"","sources":["../src/serviceTokenRequests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,MAAM,MAAM,yBAAyB,GAClC,SAAS,GACT,UAAU,GACV,QAAQ,GACR,WAAW,GACX,QAAQ,GACR,SAAS,CAAA;AAEZ,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAA;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACtC;AAED,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,MAAM,WAAW,KACf,OAAO,CAAC;IAAE,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAG9C,CAAA;AAED,eAAO,MAAM,IAAI,GAChB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,QAAQ;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,yBAAyB,CAAA;CAAE,KACrD,OAAO,CAAC;IAAE,QAAQ,EAAE,SAAS,uBAAuB,EAAE,CAAA;CAAE,CAG1D,CAAA;AAED,eAAO,MAAM,GAAG,GACf,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,IAAI,MAAM,KACR,OAAO,CAAC;IAAE,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAG9C,CAAA;AAED,eAAO,MAAM,OAAO,GACnB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,IAAI,MAAM,EACV,OAAM;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,KACnC,OAAO,CAAC;IAAE,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAG9C,CAAA;AAED,eAAO,MAAM,IAAI,GAChB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,IAAI,MAAM,EACV,OAAM;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAO,KACrC,OAAO,CAAC;IAAE,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAG9C,CAAA;AAED,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,IAAI,MAAM,KACR,OAAO,CAAC;IAAE,OAAO,EAAE,uBAAuB,CAAA;CAAE,CAG9C,CAAA;AAED,MAAM,WAAW,UAAU;IAC1B,+DAA+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,uBAAuB,CAAA;CACzC;AAED,eAAO,MAAM,IAAI,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,UAAU,CAGlF,CAAA"}

package/dist/serviceTokenRequests.js

@@ -0,0 +1,43 @@
+/**
+ * Service-token requests — user-submitted requests for org-scoped service
+ * tokens that require admin approval before a token is minted. Paired
+ * with `serviceTokens.ts` (which owns the final credential).
+ *
+ *   POST   /orgs/:orgId/service-token-requests              — submit
+ *   GET    /orgs/:orgId/service-token-requests              — list
+ *   GET    /orgs/:orgId/service-token-requests/:id          — get
+ *   POST   /orgs/:orgId/service-token-requests/:id/approve  — admin approve
+ *   POST   /orgs/:orgId/service-token-requests/:id/deny     — admin deny
+ *   POST   /orgs/:orgId/service-token-requests/:id/cancel   — requester cancel
+ *   POST   /orgs/:orgId/service-token-requests/:id/mint     — mint after approve
+ */
+import { serviceTokenRequestsEndpoints } from '@sylphx/contract';
+import { interpolatePath, request } from './http.js';
+export const submit = (client, orgId, body) => {
+    const { method, path } = serviceTokenRequestsEndpoints.submit;
+    return request(client, method, interpolatePath(path, { orgId }), { body });
+};
+export const list = (client, orgId, query) => {
+    const { method, path } = serviceTokenRequestsEndpoints.list;
+    return request(client, method, interpolatePath(path, { orgId }), query ? { query } : {});
+};
+export const get = (client, orgId, id) => {
+    const { method, path } = serviceTokenRequestsEndpoints.get;
+    return request(client, method, interpolatePath(path, { orgId, id }));
+};
+export const approve = (client, orgId, id, body = {}) => {
+    const { method, path } = serviceTokenRequestsEndpoints.approve;
+    return request(client, method, interpolatePath(path, { orgId, id }), { body });
+};
+export const deny = (client, orgId, id, body = {}) => {
+    const { method, path } = serviceTokenRequestsEndpoints.deny;
+    return request(client, method, interpolatePath(path, { orgId, id }), { body });
+};
+export const cancel = (client, orgId, id) => {
+    const { method, path } = serviceTokenRequestsEndpoints.cancel;
+    return request(client, method, interpolatePath(path, { orgId, id }));
+};
+export const mint = (client, orgId, id) => {
+    const { method, path } = serviceTokenRequestsEndpoints.mint;
+    return request(client, method, interpolatePath(path, { orgId, id }));
+};

package/dist/serviceTokens.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Service tokens (ADR-059 §3) — org-scoped bearer tokens for CI / agent
+ * workloads. Each token has a name, a scope set, optional project/env
+ * binding, and optional IP allowlist.
+ *
+ *   GET    /orgs/:orgId/service-tokens?includeRevoked=
+ *   POST   /orgs/:orgId/service-tokens                   — returns raw token once
+ *   GET    /orgs/:orgId/service-tokens/:id               — metadata only
+ *   DELETE /orgs/:orgId/service-tokens/:id               — revoke
+ *   POST   /orgs/:orgId/service-tokens/:id/rotate        — issue new + revoke old
+ *
+ * The raw token value is returned ONLY at create() and rotate() time —
+ * the API stores a SHA-256 hash at rest (ADR-055 Rule A).
+ */
+import type { Client } from './client.js';
+export interface ServiceTokenView {
+    readonly id: string;
+    readonly orgId: string;
+    readonly name: string;
+    readonly tokenPrefix: string | null;
+    readonly projectId: string | null;
+    readonly environmentId: string | null;
+    readonly scopes: readonly string[] | null;
+    readonly ipAllowlist: readonly string[] | null;
+    readonly createdBy: string | null;
+    readonly createdAt: string;
+    readonly expiresAt: string | null;
+    readonly lastUsedAt: string | null;
+    readonly revokedAt: string | null;
+    readonly revokedBy: string | null;
+    readonly useCount: number;
+}
+export interface ListOptions {
+    readonly includeRevoked?: boolean;
+}
+export declare const list: (client: Client, orgId: string, options?: ListOptions) => Promise<{
+    tokens: readonly ServiceTokenView[];
+}>;
+export interface CreateInput {
+    readonly name: string;
+    readonly scopes: readonly string[];
+    readonly projectId?: string | null;
+    readonly environmentId?: string | null;
+    readonly expiresInDays?: number | null;
+    readonly ipAllowlist?: readonly string[] | null;
+}
+export interface CreateResult {
+    /** Raw bearer token — shown ONCE; the server only keeps a hash. */
+    readonly token: string;
+    readonly view: ServiceTokenView;
+}
+export declare const create: (client: Client, orgId: string, input: CreateInput) => Promise<CreateResult>;
+export declare const get: (client: Client, orgId: string, tokenId: string) => Promise<{
+    view: ServiceTokenView;
+}>;
+export declare const revoke: (client: Client, orgId: string, tokenId: string) => Promise<{
+    view: ServiceTokenView;
+}>;
+export interface RotateResult {
+    readonly token: string;
+    readonly oldView: ServiceTokenView;
+    readonly newView: ServiceTokenView;
+}
+export declare const rotate: (client: Client, orgId: string, tokenId: string) => Promise<RotateResult>;
+//# sourceMappingURL=serviceTokens.d.ts.map

package/dist/serviceTokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokens.d.ts","sourceRoot":"","sources":["../src/serviceTokens.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IACzC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CACjC;AAED,eAAO,MAAM,IAAI,GAChB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,UAAU,WAAW,KACnB,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,gBAAgB,EAAE,CAAA;CAAE,CAG/C,CAAA;AAEH,MAAM,WAAW,WAAW;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAA;CAC/C;AAED,MAAM,WAAW,YAAY;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAA;CAC/B;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,EAAE,OAAO,WAAW,KAAG,OAAO,CAAC,YAAY,CACD,CAAA;AAE9F,eAAO,MAAM,GAAG,GACf,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,SAAS,MAAM,KACb,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAKnC,CAAA;AAEF,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,OAAO,MAAM,EACb,SAAS,MAAM,KACb,OAAO,CAAC;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAKnC,CAAA;AAEF,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAA;CAClC;AAED,eAAO,MAAM,MAAM,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,EAAE,SAAS,MAAM,KAAG,OAAO,CAAC,YAAY,CAK1F,CAAA"}

package/dist/serviceTokens.js

@@ -0,0 +1,22 @@
+/**
+ * Service tokens (ADR-059 §3) — org-scoped bearer tokens for CI / agent
+ * workloads. Each token has a name, a scope set, optional project/env
+ * binding, and optional IP allowlist.
+ *
+ *   GET    /orgs/:orgId/service-tokens?includeRevoked=
+ *   POST   /orgs/:orgId/service-tokens                   — returns raw token once
+ *   GET    /orgs/:orgId/service-tokens/:id               — metadata only
+ *   DELETE /orgs/:orgId/service-tokens/:id               — revoke
+ *   POST   /orgs/:orgId/service-tokens/:id/rotate        — issue new + revoke old
+ *
+ * The raw token value is returned ONLY at create() and rotate() time —
+ * the API stores a SHA-256 hash at rest (ADR-055 Rule A).
+ */
+import { request } from './http.js';
+export const list = (client, orgId, options) => request(client, 'GET', `/orgs/${encodeURIComponent(orgId)}/service-tokens`, {
+    query: { includeRevoked: options?.includeRevoked ? 'true' : undefined },
+});
+export const create = (client, orgId, input) => request(client, 'POST', `/orgs/${encodeURIComponent(orgId)}/service-tokens`, { body: input });
+export const get = (client, orgId, tokenId) => request(client, 'GET', `/orgs/${encodeURIComponent(orgId)}/service-tokens/${encodeURIComponent(tokenId)}`);
+export const revoke = (client, orgId, tokenId) => request(client, 'DELETE', `/orgs/${encodeURIComponent(orgId)}/service-tokens/${encodeURIComponent(tokenId)}`);
+export const rotate = (client, orgId, tokenId) => request(client, 'POST', `/orgs/${encodeURIComponent(orgId)}/service-tokens/${encodeURIComponent(tokenId)}/rotate`);

package/dist/services.d.ts

@@ -0,0 +1,10 @@
+/** Per-project services — list / get / deploy / delete. */
+import type { Client } from './client.js';
+import type { DeployResult, Service } from './types.js';
+export declare const list: (client: Client, projectId: string) => Promise<Service[]>;
+export declare const get: (client: Client, projectId: string, name: string) => Promise<Service>;
+/** Deploy a specific service — resolves envType → environmentId first. */
+export declare const deploy: (client: Client, projectId: string, name: string, envType: string) => Promise<DeployResult>;
+declare const _delete: (client: Client, projectId: string, name: string) => Promise<void>;
+export { _delete as delete };
+//# sourceMappingURL=services.d.ts.map

package/dist/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAE3D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAGzC,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEvD,eAAO,MAAM,IAAI,GAAU,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,OAAO,EAAE,CAO/E,CAAA;AAED,eAAO,MAAM,GAAG,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,OAAO,CAKnF,CAAA;AAEF,0EAA0E;AAC1E,eAAO,MAAM,MAAM,GAClB,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,MAAM,MAAM,EACZ,SAAS,MAAM,KACb,OAAO,CAAC,YAAY,CAQtB,CAAA;AAED,QAAA,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,EAAE,MAAM,MAAM,KAAG,OAAO,CAAC,IAAI,CAK7E,CAAA;AACF,OAAO,EAAE,OAAO,IAAI,MAAM,EAAE,CAAA"}

package/dist/services.js

@@ -0,0 +1,15 @@
+/** Per-project services — list / get / deploy / delete. */
+import { resolveId as resolveEnvId } from './environments.js';
+import { request } from './http.js';
+export const list = async (client, projectId) => {
+    const res = await request(client, 'GET', `/projects/${encodeURIComponent(projectId)}/services`);
+    return Array.isArray(res) ? res : (res.data ?? []);
+};
+export const get = (client, projectId, name) => request(client, 'GET', `/projects/${encodeURIComponent(projectId)}/services/${encodeURIComponent(name)}`);
+/** Deploy a specific service — resolves envType → environmentId first. */
+export const deploy = async (client, projectId, name, envType) => {
+    const environmentId = await resolveEnvId(client, projectId, envType);
+    return request(client, 'POST', `/projects/${encodeURIComponent(projectId)}/services/${encodeURIComponent(name)}/deploy`, { body: environmentId ? { environmentId } : {} });
+};
+const _delete = (client, projectId, name) => request(client, 'DELETE', `/projects/${encodeURIComponent(projectId)}/services/${encodeURIComponent(name)}`);
+export { _delete as delete };