@sylphx/management 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,88 @@
+# @sylphx/management
+
+## 0.2.0
+
+### Minor Changes
+
+- [`c4471cf`](https://github.com/SylphxAI/platform/commit/c4471cf729a2a60865d0df5bbf04b87f55d57858) Thanks [@shtse8](https://github.com/shtse8)! - Pure-FP `createClient` + free-function rewrite (ADR-077). Adds 39 capability namespaces — billing, certs, email, monitoring, notifications, backups, kv, flags, webhooks, secrets, realtime, serviceTokens, runners, experiments, analytics, oidc, and ten user-facing namespaces. Tenant provisioning migrated to service-token auth (the legacy `/admin/bootstrap` route is retired); platform admin bootstrap now follows the Appwrite pattern with the `X-Sylphx-Project-Id` header. New audit-source filter and webhook signature-algorithm versioning. Wave 1 domains consume `@sylphx/contract` directly; schemas widened to production reality (Wave 2b). Sends `Content-Type` only when a body is present; always sets `Accept`.
+
+### Patch Changes
+
+- Updated dependencies [[`c4471cf`](https://github.com/SylphxAI/platform/commit/c4471cf729a2a60865d0df5bbf04b87f55d57858)]:
+  - @sylphx/contract@0.2.0
+
+## 0.2.0-beta.0 — 2026-04-24
+
+ADR-089 Phase 2 / 3 / 4a / 4b — **100% PaaS endpoint coverage**. The
+`check-paas-sdk-coverage.ts` guard flipped from advisory to strict; the
+Management SDK now covers every public `apps/api/src/server/platform/routes/`
+namespace (35/35 non-excluded, 6 internal-only exclusions with written
+rationale).
+
+### New namespaces (14)
+
+- `admin` — operator org / user / credit / audit administration
+- `auth` (alias of `authSettings`) — OAuth providers + project auth policy + stats
+- `authSettings` — same surface, ergonomic name
+- `billingSettings` — business info, spending caps, invoice prefs
+- `branchDatabases` — per-branch Neon/CNPG database bindings (ADR-070)
+- `ciSettings` — org + repo CI configuration (runners, secrets, policy)
+- `edgeDeployments` — Vercel-edge / Workers-style function releases
+- `github` — GitHub App installation + repo discovery
+- `kv` — KV admin (operator dashboard; distinct from BaaS `kv` in `@sylphx/sdk`)
+- `management` — self-hosted runtime database backups / PITR restore (ADR-070)
+- `plans` — subscription plan catalog + plan changes
+- `refresh` — refresh-token rotation + sign-out (ADR-059 §1.1)
+- `serviceTokenRequests` — ADR-059 §3 approval workflow for service tokens
+- `user` — authenticated-user self-service (profile, sessions, MFA, connected identities)
+
+### New methods on existing namespaces
+
+- `backups.restorePointInTime`, `backups.restoreInPlace`
+- `certs.autoProvision`, `certs.getAutoProvisionStatus`
+- `deployments.cancel` (in-flight build cancellation)
+- `environments.clone` (deep-copy env vars + secrets + bindings)
+
+### Coverage guard
+
+- `scripts/check-paas-sdk-coverage.ts`: strict mode enabled (non-zero
+  exit on any non-excluded gap). Namespace matching normalises kebab ↔
+  camelCase so `service-tokens` (route) matches `serviceTokens.ts` (SDK).
+  Six internal-only namespaces are excluded with one-line rationales:
+  `misc`, `internal`, `cron`, `image-opt`, `break-glass`, `challenge`.
+
+### Migration notes
+
+- No breaking changes. Existing imports continue to work.
+- Bumped to `0.2.0-beta.0` to signal a meaningful surface expansion;
+  the package remains in the 0.x beta line (shape not frozen).
+
+## Unreleased (wrongly labelled 1.0.0; reverted 2026-04-23 — still in beta)
+
+### Changes
+
+- **Beta API surface.** Per [ADR-077](https://github.com/SylphxAI/platform/blob/main/docs/adr/ADR-077-trio-completeness.md), the Promise-based pure-functional interface is the target public contract. No classes, no `this`, no hidden state — `createClient` returns a frozen value, and every capability is a free function that takes `client` as its first argument. Shape is NOT yet frozen; still iterating in 0.x.
+- **46 capability namespaces** (in-flight; count may change before stable) covering the full Management plane: `projects`, `deployments`, `environments`, `envVars`, `domains`, `databases`, `services`, `volumes`, `storage`, `secrets`, `tasks`, `resourceBindings`, `organizations`, `users`, `sandboxes`, `functions`, `logs`, `email` (admin), `notifications` (admin/inbox), `monitoring`, `analytics`, `flags`, `experiments`, `remoteConfig`, `ai`, `webhooks`, `runners`, `backups`, `billing`, `certs`, `consent`, `engagement`, `newsletter`, `oidc`, `privacy`, `realtime`, `referrals`, `saml`, `search`, `serviceTokens`, `sessionReplay`.
+- **Contract-first types** ([ADR-084](https://github.com/SylphxAI/platform/blob/main/docs/adr/ADR-084-effect-schema-contract.md)). Wire types and endpoint metadata (method + path) are imported from [`@sylphx/contract`](https://www.npmjs.com/package/@sylphx/contract) — the Effect Schema SSOT. Hand-written type shims were removed; the contract package is the only place wire shape is defined.
+- **Bearer-token auth.** `createClient({ token })` accepts both user session tokens (`slx_...`) and service tokens (`sk_...`). The same SDK works for CLI / CI / backend integrations on the Management plane (`api.sylphx.com/v1`).
+- **Tree-shakable subpath exports.** Every namespace is also reachable as `@sylphx/management/projects`, `@sylphx/management/deployments`, etc. `sideEffects: false` for bundler-friendly dead-code elimination.
+- **ESM-only.** `"type": "module"`, Node ≥ 20, uses the built-in `fetch`. No classes, no polyfills, no peer framework required.
+
+### Plane discipline (ADR-083)
+
+This SDK is **Management-plane-only**. Runtime BaaS verbs (`kv.get`, `email.send`, `notifications.send`, `flags.evaluate`, `auth.*`, realtime, storage uploads, search, analytics.track) live in [`@sylphx/sdk`](https://www.npmjs.com/package/@sylphx/sdk) with its Firebase-pattern peer-dep entry points (`@sylphx/sdk`, `/react`, `/server`, `/nextjs`, `/web-analytics`). Mixing planes (wrong hostname + wrong auth scheme) returns `401 plane_mismatch`.
+
+---
+
+## 0.1.0
+
+### Minor Changes
+
+- Initial public release of `@sylphx/management` as a standalone SDK.
+  - Resource-namespaced Management API client.
+  - `@sylphx/cli` now dogfoods this package.
+
+## Pre-release history
+
+Earlier changeset entries referenced pre-release work on internal versions;
+the unreleased entry above captures the current 0.x beta direction.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Sylphx
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,37 @@
 # @sylphx/management
 
-Programmatic access to the [Sylphx Platform](https://sylphx.com) Management API.
+[![npm version](https://img.shields.io/npm/v/@sylphx/management.svg)](https://www.npmjs.com/package/@sylphx/management)
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](./LICENSE)
+
+Pure-FP Promise client for the [Sylphx Platform](https://sylphx.com)
+Management API — **46 capability namespaces, contract-first types, zero
+classes**.
+
+The SDK is a thin, stateless transport over `api.sylphx.com/v1`. No classes,
+no mutable state, no business logic — consumers create an immutable `Client`
+and pass it to free functions grouped by capability namespace. Every
+request / response type is imported from
+[`@sylphx/contract`](https://www.npmjs.com/package/@sylphx/contract) — the
+Effect Schema single source of truth (ADR-084).
+
+> **Scope: Management plane only** (ADR-083). This SDK covers platform-owner
+> operations (project / deployment / environment / secret / domain / audit
+> / billing / SAML / OIDC / webhooks / privacy / analytics admin, …) on
+> `api.sylphx.com/v1` with Bearer tokens (`slx_...` user / `sk_...`
+> service). For app-runtime data-plane operations (auth, KV, transactional
+> email, push, realtime, `flags.evaluate`, search, analytics.track, AI,
+> storage uploads, end-user session replay) use
+> [`@sylphx/sdk`](https://www.npmjs.com/package/@sylphx/sdk) — one package,
+> Firebase-pattern with `./`, `./react`, `./server`, `./nextjs`,
+> `./web-analytics` peer-dep-gated entry points. Mixing planes (wrong
+> hostname + wrong auth scheme) returns `401 plane_mismatch`.
+
+## Requirements
+
+- Node.js `>= 20` (uses built-in `fetch`) — or Bun `>= 1.3`
+- A Sylphx API token:
+  - **User session token** (`slx_...`) — sign in at `sylphx.com` and run `sylphx auth token`
+  - **Service token** (`sk_...`) — for CI / server-side automation, created under project → Tokens
 
 ## Installation
 
@@ -8,131 +39,156 @@ Programmatic access to the [Sylphx Platform](https://sylphx.com) Management API.
 bun add @sylphx/management
 # or
 npm install @sylphx/management
+# or
+pnpm add @sylphx/management
 ```
 
 ## Quick Start
 
 ```typescript
-import { SylphxManagement } from '@sylphx/management'
+import { createClient, projects, deployments, envVars } from '@sylphx/management'
 
-const mgmt = new SylphxManagement({
+const client = createClient({
   token: process.env.SYLPHX_TOKEN!,
-  // baseUrl: 'https://api.sylphx.com' (default)
+  // baseUrl defaults to 'https://api.sylphx.com'
 })
 
-// List projects
-const projects = await mgmt.projects.list()
+// List projects (ids are TypeIDs — `proj_xxx`)
+const list = await projects.list(client)
 
 // Trigger a deployment
-await mgmt.deployments.trigger('my-project-id', 'production')
+await deployments.trigger(client, 'proj_abc', 'production')
 
-// List env vars
-const vars = await mgmt.envVars.list('my-project-id', 'production')
+// List env vars for a project + environment
+const vars = await envVars.list(client, 'proj_abc', 'production')
 ```
 
-## API
-
-All methods are namespaced under the `SylphxManagement` instance:
-
-### `mgmt.user`
-- `whoami()` — Get current user and orgs
-
-### `mgmt.projects`
-- `list()` — List all projects
-- `create(data)` — Create a new project
-- `delete(id)` — Delete a project
-
-### `mgmt.deployments`
-- `status(projectId)` — Get deployment status
-- `trigger(projectId, envType)` — Trigger a deploy
-- `history(projectId, envType)` — Get deployment history
-- `rollback(projectId, body)` — Rollback to a previous deploy
-
-### `mgmt.environments`
-- `list(projectId)` — List environments
-- `resolveId(projectId, envType)` — Resolve envType → envId
-- `promote(projectId, targetEnvId, sourceEnvId)` — Promote an environment
-
-### `mgmt.envVars`
-- `list(projectId, envType)` — List env vars
-- `set(projectId, key, value, envType, secret?)` — Set a single env var
-- `setMany(projectId, vars, envType)` — Batch-set env vars
-- `delete(projectId, key, envType)` — Delete an env var
-
-### `mgmt.domains`
-- `list(projectId, envType?)` — List apex domains
-- `create(projectId, apexDomain, envType?)` — Register a domain
-- `addHostname(projectId, domainId, hostname, opts?)` — Add a hostname
-- `removeHostname(projectId, domainId, hostnameId)` — Remove a hostname
-- `checkHostname(projectId, domainId, hostnameId)` — Check DNS for hostname
-- `enableEmail(projectId, domainId, opts?)` — Enable email sending
-- `checkEmail(projectId, domainId)` — Check email DNS propagation
-- `disableEmail(projectId, domainId)` — Disable email sending
-
-### `mgmt.databases`
-- `list()` — List all databases
-- `create(data)` — Provision a database
-- `get(id)` — Get database details
-- `delete(id)` — Delete a database
-- `branch(id, data)` — Branch a database
-
-### `mgmt.services`
-- `list(projectId)` — List services
-- `get(projectId, name)` — Get a service
-- `deploy(projectId, name, envType)` — Deploy a service
-- `delete(projectId, name)` — Delete a service
-
-### `mgmt.volumes`
-- `list(projectId)` — List volumes
-- `create(projectId, data)` — Create a volume
-- `delete(projectId, volId)` — Delete a volume
-
-### `mgmt.storage`
-- `list(projectId, envType?)` — List storage resources
-- `create(projectId, data)` — Provision storage
-- `delete(projectId, storageId)` — Delete storage
-
-### `mgmt.config`
-- `list(projectId, envType?)` — List config keys
-- `get(projectId, key, envType?)` — Get a config key
-- `set(projectId, key, value, envType?)` — Set a config key
-- `delete(projectId, key, envType?)` — Delete a config key
-
-### `mgmt.tasks`
-- `list(projectId, envType?)` — List task definitions
-- `create(projectId, data)` — Create/update a task
-- `get(projectId, taskId)` — Get a task
-- `update(projectId, taskId, data)` — Update a task
-- `delete(projectId, taskId)` — Delete a task
-
-### `mgmt.resources`
-- `listBindings(resourceId)` — List resource bindings
-- `bind(resourceId, data)` — Bind a resource to a project env
-- `unbind(resourceId, bindingId)` — Unbind a resource
-
-### `mgmt.org`
-- `current()` — Get current org
-- `listMembers(orgId)` — List org members
-- `inviteMember(orgId, email, role)` — Invite a member
-- `removeMember(orgId, userId)` — Remove a member
-
-### `mgmt.logs`
-- `stream(projectId, envType)` — Get `{ url, token }` for SSE log streaming
+### Tree-shakable subpath imports
+
+Bundlers that support subpath exports can import a single capability
+namespace for better tree-shaking:
+
+```typescript
+import { createClient } from '@sylphx/management'
+import * as projects from '@sylphx/management/projects'
+
+const client = createClient({ token: process.env.SYLPHX_TOKEN! })
+await projects.list(client)
+```
+
+## Capabilities
+
+46 namespaces. Every module exports free functions that take `client` as
+the first argument. Key namespaces:
+
+| Namespace            | Representative functions                                                                   |
+| -------------------- | ------------------------------------------------------------------------------------------ |
+| `users`              | `whoami`                                                                                   |
+| `projects`           | `list`, `create`, `delete`                                                                 |
+| `deployments`        | `status`, `trigger`, `history`, `rollback`                                                 |
+| `environments`       | `list`, `resolveId`, `create`, `update`, `delete`, `promote`                               |
+| `envVars`            | `list`, `set`, `setMany`, `delete`                                                         |
+| `domains`            | `list`, `create`, `addHostname`, `removeHostname`, `checkHostname`, `enableEmail`, `checkEmail`, `disableEmail` |
+| `databases`          | `list`, `create`, `get`, `delete`, `branch`                                                |
+| `services`           | `list`, `get`, `deploy`, `delete`                                                          |
+| `volumes`            | `list`, `create`, `delete`                                                                 |
+| `storage`            | `list`, `create`, `delete`                                                                 |
+| `secrets`            | `list`, `get`, `create`, `update`, `rollback`, `delete`                                    |
+| `remoteConfig`       | `list`, `get`, `set`, `delete`                                                             |
+| `tasks`              | `list`, `create`, `get`, `update`, `delete`                                                |
+| `resourceBindings`   | `list`, `create`, `delete`                                                                 |
+| `organizations`      | `current`, `listMembers`, `inviteMember`, `removeMember`                                   |
+| `sandboxes`          | `create`, `list`, `get`, `terminate`                                                       |
+| `functions`          | `list`, `get`, `deploy`, `delete`, `invoke`, `logs`                                        |
+| `logs`               | `stream` (returns `{ url, token }` for SSE)                                                |
+| `email`              | `listLogs`, `getSettings`, `updateSettings` (admin only — `send` lives in `@sylphx/sdk`)   |
+| `notifications`      | `listInbox` (admin only — `send` lives in `@sylphx/sdk`)                                   |
+| `billing`            | account / plan / invoice endpoints                                                         |
+| `saml`, `oidc`       | SSO configuration admin                                                                    |
+| `webhooks`           | outbound webhook endpoint CRUD                                                             |
+| `analytics`          | admin queries (runtime `analytics.track` lives in `@sylphx/sdk`)                           |
+| `flags`              | flag admin CRUD (runtime `flags.evaluate` lives in `@sylphx/sdk`)                          |
+| `experiments`        | A/B test admin CRUD                                                                        |
+| `ai`                 | model / completion admin                                                                   |
+| `backups`            | managed-data backup + restore                                                              |
+| `certs`              | TLS cert inspection                                                                        |
+| `consent`, `privacy` | GDPR / CCPA admin                                                                          |
+| `engagement`, `newsletter`, `referrals` | marketing admin                                                         |
+| `runners`            | self-hosted runner admin                                                                   |
+| `sessionReplay`      | session-replay admin (runtime capture lives in `@sylphx/sdk/web-analytics`)                |
+| `monitoring`         | metric / alert admin                                                                       |
+| `realtime`           | channel admin (runtime pub/sub lives in `@sylphx/sdk`)                                     |
+| `search`             | index admin (runtime queries live in `@sylphx/sdk`)                                        |
+| `serviceTokens`      | service-token issuance + revocation                                                        |
+
+Full, IDE-autocompleted surface is available on the re-exported
+namespaces from the root `@sylphx/management` entry point.
+
+> **Plane discipline (ADR-083).** Runtime BaaS verbs — `kv.*`, `email.send`,
+> `notifications.send`, MFA `challenge.*`, `flags.evaluate`,
+> `analytics.track` — are **not** part of `@sylphx/management`. Deployed
+> applications (both server-side and browser-side) use
+> [`@sylphx/sdk`](https://www.npmjs.com/package/@sylphx/sdk) with its
+> peer-dep-gated entry points (`@sylphx/sdk`, `@sylphx/sdk/react`,
+> `@sylphx/sdk/server`, `@sylphx/sdk/nextjs`,
+> `@sylphx/sdk/web-analytics`).
 
 ## Error Handling
 
+Every non-2xx response throws a single error type. Consumers discriminate on
+`status` or match on `body` shape.
+
 ```typescript
-import { ManagementApiError } from '@sylphx/management'
+import { ApiError } from '@sylphx/management'
+import * as projects from '@sylphx/management/projects'
 
 try {
-  await mgmt.projects.delete('non-existent')
+  await projects.delete(client, 'non-existent')
 } catch (err) {
-  if (err instanceof ManagementApiError) {
+  if (err instanceof ApiError) {
     console.error(`API Error ${err.status}: ${err.message}`)
   }
 }
 ```
 
+## Architecture
+
+- **Contract-first** (ADR-084). Every type in this SDK — `Project`,
+  `Deployment`, `EnvVar`, request / response envelopes — is imported from
+  [`@sylphx/contract`](https://www.npmjs.com/package/@sylphx/contract). Hand-written type
+  shims are a bug. Adding a new capability starts with a contract entry,
+  not this package.
+- **Promise-first, Effect-free public surface.** The server uses Effect-TS
+  internally (ADR-058), but no Effect types leak through the published
+  `.d.ts` — consumers see plain `Promise<T>`.
+- **Immutable value type `Client`.** Cheap to construct, safe to share
+  across parallel calls. No hidden globals, no singletons.
+- **ESM-only, tree-shakable.** `"type": "module"`, `sideEffects: false`,
+  per-namespace subpath exports.
+- See [ADR-077](https://github.com/SylphxAI/platform/blob/main/docs/adr/ADR-077-trio-completeness.md)
+  for the design rationale,
+  [ADR-083](https://github.com/SylphxAI/platform/blob/main/docs/adr/ADR-083-two-plane-sdk-architecture.md)
+  for the two-plane split,
+  [ADR-084](https://github.com/SylphxAI/platform/blob/main/docs/adr/ADR-084-effect-schema-contract.md)
+  for the contract SSOT.
+
+## Agent integration
+
+The `sylphx` CLI (built on top of this SDK) is the first-class agent surface
+for Claude Code / Cursor / ChatGPT Apps. Sylphx does not ship a standalone
+stdio MCP binary; if you want a bespoke MCP for your own workflows, compose
+one directly on top of `@sylphx/management` — every method is a pure
+`Promise<T>` and fully typed from `@sylphx/contract`.
+
+## Related packages
+
+- [`@sylphx/contract`](https://www.npmjs.com/package/@sylphx/contract) —
+  Effect Schema SSOT this SDK derives its types from (peer).
+- [`@sylphx/sdk`](https://www.npmjs.com/package/@sylphx/sdk) — runtime
+  BaaS SDK for deployed apps (different plane).
+- [`@sylphx/cli`](https://www.npmjs.com/package/@sylphx/cli) — interactive
+  CLI built on this SDK.
+
 ## License
 
-MIT
+MIT — see [LICENSE](./LICENSE).

package/dist/admin.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Platform-admin (superuser) surface — quotas, audit logs, invitations,
+ * JWT key rotation, plan governance. Consumed by the internal Console
+ * "Admin" sections; ordinary operators do not call these.
+ *
+ * Mirrors `apps/api/src/server/platform/routes/admin/**`. Paths are
+ * sourced from `@sylphx/contract` admin-* endpoint modules.
+ */
+import type { Client } from './client.js';
+export interface ProjectQuota {
+    readonly resource: string;
+    readonly limit: number;
+    readonly usage: number;
+    readonly windowSeconds: number;
+}
+export declare const getProjectQuotas: (client: Client, projectId: string) => Promise<{
+    quotas: readonly ProjectQuota[];
+}>;
+export declare const getQuotaStats: (client: Client, projectId: string) => Promise<Record<string, number>>;
+export declare const getQuotaAlerts: (client: Client, projectId: string) => Promise<{
+    alerts: readonly {
+        readonly id: string;
+        readonly resource: string;
+        readonly firedAt: string;
+    }[];
+}>;
+export declare const updateProjectQuotas: (client: Client, projectId: string, body: {
+    readonly quotas: readonly {
+        readonly resource: string;
+        readonly limit: number;
+    }[];
+}) => Promise<{
+    quotas: readonly ProjectQuota[];
+}>;
+export declare const acknowledgeQuotaAlert: (client: Client, alertId: string) => Promise<{
+    success: boolean;
+}>;
+export interface AuditLogEntry {
+    readonly id: string;
+    readonly actor: string;
+    readonly action: string;
+    readonly target: string;
+    readonly at: string;
+    readonly metadata: Record<string, unknown>;
+}
+export declare const getAuditLogs: (client: Client, query?: {
+    readonly from?: string;
+    readonly to?: string;
+    readonly actor?: string;
+}) => Promise<{
+    logs: readonly AuditLogEntry[];
+}>;
+export declare const getAuditActivity: (client: Client) => Promise<{
+    entries: readonly AuditLogEntry[];
+}>;
+export interface Invitation {
+    readonly id: string;
+    readonly email: string;
+    readonly role: string;
+    readonly orgId: string | null;
+    readonly invitedBy: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly acceptedAt: string | null;
+}
+export declare const listInvitations: (client: Client) => Promise<{
+    invitations: readonly Invitation[];
+}>;
+export declare const createInvitation: (client: Client, body: {
+    readonly email: string;
+    readonly role: string;
+    readonly orgId?: string;
+}) => Promise<{
+    invitation: Invitation;
+}>;
+export declare const revokeInvitation: (client: Client, id: string) => Promise<{
+    success: boolean;
+}>;
+export declare const resendInvitation: (client: Client, id: string) => Promise<{
+    invitation: Invitation;
+}>;
+export interface JwtKey {
+    readonly id: string;
+    readonly alg: string;
+    readonly status: 'active' | 'retired';
+    readonly createdAt: string;
+    readonly retiredAt: string | null;
+}
+export declare const listJwtKeys: (client: Client) => Promise<{
+    keys: readonly JwtKey[];
+}>;
+export declare const rotateJwtKeys: (client: Client) => Promise<{
+    newKey: JwtKey;
+}>;
+export declare const retireJwtKey: (client: Client, keyId: string) => Promise<{
+    key: JwtKey;
+}>;
+/**
+ * Trigger a project migration between regions. Phase 4b Matrix-2 gap.
+ * Underlying endpoint on the platform API is
+ * `POST /operator/projects/:id/migrate` — the SDK wraps it directly rather
+ * than going through `adminProjectsEndpoints` because migration is its
+ * own operational concern (drain → cut-over → warm-up).
+ */
+export declare const migrateProject: (client: Client, projectId: string, body: {
+    readonly targetRegion: string;
+    readonly strategy?: "drain-cutover" | "live-replication";
+    readonly dryRun?: boolean;
+}) => Promise<{
+    jobId: string;
+    startedAt: string;
+}>;
+/**
+ * Regenerate an environment's deploy / API key. Already exposed on
+ * `adminProjectsEndpoints.regenerateKey`; surfaced here under the `admin`
+ * namespace so Console wiring is one-stop.
+ */
+export declare const regenerateEnvironmentKey: (client: Client, environmentId: string) => Promise<{
+    key: string;
+    keyId: string;
+}>;
+export interface AdminUserView {
+    readonly id: string;
+    readonly email: string;
+    readonly role: string;
+    readonly createdAt: string;
+    readonly lastSeenAt: string | null;
+    readonly suspended: boolean;
+}
+export declare const listUsers: (client: Client) => Promise<{
+    users: readonly AdminUserView[];
+}>;
+export declare const getUser: (client: Client, userId: string) => Promise<{
+    user: AdminUserView;
+}>;
+export declare const updateUserRole: (client: Client, userId: string, body: {
+    readonly role: string;
+}) => Promise<{
+    user: AdminUserView;
+}>;
+/**
+ * L-15 (2026-05-02): manually verify a user's email. Super-admin only on the
+ * platform tenant. The Management API endpoint exists at
+ * `POST /admin/users/users/:userId/verify-email`; the SDK helper was the
+ * missing piece blocking operators from validating the new-user E2E flow
+ * without (a) a real email inbox or (b) a forbidden direct DB UPDATE.
+ */
+export declare const verifyUserEmail: (client: Client, userId: string) => Promise<{
+    readonly id: string;
+    readonly email: string;
+}>;
+/**
+ * L-15 (2026-05-02): soft-delete a platform user. Super-admin only;
+ * cannot delete oneself. Existing sessions are revoked first.
+ */
+export declare const deleteUser: (client: Client, userId: string) => Promise<{
+    readonly id: string;
+    readonly email: string;
+}>;
+/**
+ * L-15 (2026-05-02): revoke ALL sessions for a user (force re-login).
+ * Super-admin only.
+ */
+export declare const revokeUserSessions: (client: Client, userId: string) => Promise<{
+    readonly userId: string;
+    readonly revokedCount: number;
+}>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../src/admin.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAUH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAKzC,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC9B;AAED,eAAO,MAAM,gBAAgB,GAC5B,QAAQ,MAAM,EACd,WAAW,MAAM,KACf,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,CAG7C,CAAA;AAED,eAAO,MAAM,aAAa,GACzB,QAAQ,MAAM,EACd,WAAW,MAAM,KACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGhC,CAAA;AAED,eAAO,MAAM,cAAc,GAC1B,QAAQ,MAAM,EACd,WAAW,MAAM,KACf,OAAO,CAAC;IACV,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAC/F,CAGA,CAAA;AAED,eAAO,MAAM,mBAAmB,GAC/B,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,KACzF,OAAO,CAAC;IAAE,MAAM,EAAE,SAAS,YAAY,EAAE,CAAA;CAAE,CAG7C,CAAA;AAED,eAAO,MAAM,qBAAqB,GACjC,QAAQ,MAAM,EACd,SAAS,MAAM,KACb,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAG9B,CAAA;AAID,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC1C;AAED,eAAO,MAAM,YAAY,GACxB,QAAQ,MAAM,EACd,QAAQ;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC/E,OAAO,CAAC;IAAE,IAAI,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,CAG5C,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC5B,QAAQ,MAAM,KACZ,OAAO,CAAC;IAAE,OAAO,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,CAG/C,CAAA;AAID,MAAM,WAAW,UAAU;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAClC;AAED,eAAO,MAAM,eAAe,GAC3B,QAAQ,MAAM,KACZ,OAAO,CAAC;IAAE,WAAW,EAAE,SAAS,UAAU,EAAE,CAAA;CAAE,CAGhD,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC5B,QAAQ,MAAM,EACd,MAAM;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,KAC9E,OAAO,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAGpC,CAAA;AAED,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAGzF,CAAA;AAED,eAAO,MAAM,gBAAgB,GAC5B,QAAQ,MAAM,EACd,IAAI,MAAM,KACR,OAAO,CAAC;IAAE,UAAU,EAAE,UAAU,CAAA;CAAE,CAGpC,CAAA;AAID,MAAM,WAAW,MAAM;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC;AAED,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC;IAAE,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAG/E,CAAA;AAED,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAGxE,CAAA;AAED,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAGnF,CAAA;AAID;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAC1B,QAAQ,MAAM,EACd,WAAW,MAAM,EACjB,MAAM;IACL,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAAA;IACxD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CACzB,KACC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CACkD,CAAA;AAEjG;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACpC,QAAQ,MAAM,EACd,eAAe,MAAM,KACnB,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAGxC,CAAA;AAID,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;CAC3B;AAED,eAAO,MAAM,SAAS,GAAI,QAAQ,MAAM,KAAG,OAAO,CAAC;IAAE,KAAK,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,CAGrF,CAAA;AAED,eAAO,MAAM,OAAO,GAAI,QAAQ,MAAM,EAAE,QAAQ,MAAM,KAAG,OAAO,CAAC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAGvF,CAAA;AAED,eAAO,MAAM,cAAc,GAC1B,QAAQ,MAAM,EACd,QAAQ,MAAM,EACd,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KAC7B,OAAO,CAAC;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAGjC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAC3B,QAAQ,MAAM,EACd,QAAQ,MAAM,KACZ,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAGzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,GACtB,QAAQ,MAAM,EACd,QAAQ,MAAM,KACZ,OAAO,CAAC;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAGzD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC9B,QAAQ,MAAM,EACd,QAAQ,MAAM,KACZ,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAGpE,CAAA"}