@tearleads/client-sdk 0.1.93 → 0.1.95

package/internal/validators/response/rootAudit.d.ts

@@ -3,12 +3,13 @@ import { z } from "zod";
  * Every action the root audit trail records: one per `/root` operation, plus
  * the API CLI's root grant and revoke.
  */
-export declare const ROOT_AUDIT_ACTIONS: readonly ["root.access.grant", "root.access.revoke", "root.auditEvents.list", "root.identities.get", "root.identities.list", "root.identities.organizations.list", "root.organizations.dataUsage.get", "root.organizations.get", "root.organizations.identities.list", "root.organizations.list", "root.reports.dataUsage.list"];
-export declare const RootAuditActionSchema: z.ZodLiteral<"root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list">;
+export declare const ROOT_AUDIT_ACTIONS: readonly ["root.access.grant", "root.access.revoke", "root.auditEvents.list", "root.identities.get", "root.identities.list", "root.identities.organizations.list", "root.identities.suspension.delete", "root.identities.suspension.put", "root.organizations.dataUsage.get", "root.organizations.get", "root.organizations.identities.list", "root.organizations.list", "root.reports.dataUsage.list", "root.reports.opsHealth.get"];
+/** The server's own vocabulary: exactly the actions it records. */
+export declare const RootAuditActionSchema: z.ZodLiteral<"root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.identities.suspension.delete" | "root.identities.suspension.put" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list" | "root.reports.opsHealth.get">;
 export type RootAuditAction = z.infer<typeof RootAuditActionSchema>;
 /** One recorded operator action, from `GET /root/audit-events`. */
 export declare const RootAuditEventResponseSchema: z.ZodType<{
-    action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+    action: string;
     actorSigningKeyFingerprint: string | null;
     actorUserId: string | null;
     filter: string | null;
@@ -18,7 +19,7 @@ export declare const RootAuditEventResponseSchema: z.ZodType<{
     targetOrganizationId: string | null;
     targetUserId: string | null;
 }, {
-    action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+    action: string;
     actorSigningKeyFingerprint: string | null;
     actorUserId: string | null;
     filter: string | null;
@@ -28,7 +29,7 @@ export declare const RootAuditEventResponseSchema: z.ZodType<{
     targetOrganizationId: string | null;
     targetUserId: string | null;
 }, z.core.$ZodTypeInternals<{
-    action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+    action: string;
     actorSigningKeyFingerprint: string | null;
     actorUserId: string | null;
     filter: string | null;
@@ -38,7 +39,7 @@ export declare const RootAuditEventResponseSchema: z.ZodType<{
     targetOrganizationId: string | null;
     targetUserId: string | null;
 }, {
-    action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+    action: string;
     actorSigningKeyFingerprint: string | null;
     actorUserId: string | null;
     filter: string | null;
@@ -51,7 +52,7 @@ export declare const RootAuditEventResponseSchema: z.ZodType<{
 export type RootAuditEventResponse = z.infer<typeof RootAuditEventResponseSchema>;
 export declare const RootAuditEventsResponseSchema: z.ZodType<{
     events: {
-        action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+        action: string;
         actorSigningKeyFingerprint: string | null;
         actorUserId: string | null;
         filter: string | null;
@@ -64,7 +65,7 @@ export declare const RootAuditEventsResponseSchema: z.ZodType<{
     nextCursor: string | null;
 }, {
     events: {
-        action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+        action: string;
         actorSigningKeyFingerprint: string | null;
         actorUserId: string | null;
         filter: string | null;
@@ -77,7 +78,7 @@ export declare const RootAuditEventsResponseSchema: z.ZodType<{
     nextCursor: string | null;
 }, z.core.$ZodTypeInternals<{
     events: {
-        action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+        action: string;
         actorSigningKeyFingerprint: string | null;
         actorUserId: string | null;
         filter: string | null;
@@ -90,7 +91,7 @@ export declare const RootAuditEventsResponseSchema: z.ZodType<{
     nextCursor: string | null;
 }, {
     events: {
-        action: "root.access.grant" | "root.access.revoke" | "root.auditEvents.list" | "root.identities.get" | "root.identities.list" | "root.identities.organizations.list" | "root.organizations.dataUsage.get" | "root.organizations.get" | "root.organizations.identities.list" | "root.organizations.list" | "root.reports.dataUsage.list";
+        action: string;
         actorSigningKeyFingerprint: string | null;
         actorUserId: string | null;
         filter: string | null;

package/internal/validators/response/rootAudit.js

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { registerJsonSchemaFragment } from "../jsonSchema.js";
 import { arraySchema, loosePlainObject, nonEmptyStringSchema, sha256HexStringSchema, } from "../schema.js";
 /**
  * Every action the root audit trail records: one per `/root` operation, plus
@@ -11,16 +12,30 @@ export const ROOT_AUDIT_ACTIONS = [
     "root.identities.get",
     "root.identities.list",
     "root.identities.organizations.list",
+    "root.identities.suspension.delete",
+    "root.identities.suspension.put",
     "root.organizations.dataUsage.get",
     "root.organizations.get",
     "root.organizations.identities.list",
     "root.organizations.list",
     "root.reports.dataUsage.list",
+    "root.reports.opsHealth.get",
 ];
+/** The server's own vocabulary: exactly the actions it records. */
 export const RootAuditActionSchema = z.literal(ROOT_AUDIT_ACTIONS);
+/**
+ * An action as the audit listing reports it. Every new root operation adds an
+ * action, so clients accept any operation id rather than a closed list that a
+ * newer server would outgrow; the known ones are listed as extensible.
+ */
+const RootAuditEventActionSchema = registerJsonSchemaFragment(z.string().min(1), {
+    type: "string",
+    minLength: 1,
+    "x-extensible-enum": [...ROOT_AUDIT_ACTIONS],
+});
 /** One recorded operator action, from `GET /root/audit-events`. */
 export const RootAuditEventResponseSchema = loosePlainObject({
-    action: RootAuditActionSchema,
+    action: RootAuditEventActionSchema,
     /** The acting root identity's signing key; null when the API CLI acted. */
     actorSigningKeyFingerprint: sha256HexStringSchema.nullable(),
     actorUserId: nonEmptyStringSchema.nullable(),

package/internal/validators/response/rootAudit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rootAudit.js","sourceRoot":"","sources":["rootAudit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,qBAAqB;IACrB,sBAAsB;IACtB,oCAAoC;IACpC,kCAAkC;IAClC,wBAAwB;IACxB,oCAAoC;IACpC,yBAAyB;IACzB,6BAA6B;CACrB,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAInE,mEAAmE;AACnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IAC3D,MAAM,EAAE,qBAAqB;IAC7B,2EAA2E;IAC3E,0BAA0B,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC5D,WAAW,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC5C,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,oBAAoB;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACrD,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;IAC5D,MAAM,EAAE,WAAW,CAAC,4BAA4B,CAAC;IACjD,2EAA2E;IAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n  arraySchema,\n  loosePlainObject,\n  nonEmptyStringSchema,\n  sha256HexStringSchema,\n} from \"../schema\";\n\n/**\n * Every action the root audit trail records: one per `/root` operation, plus\n * the API CLI's root grant and revoke.\n */\nexport const ROOT_AUDIT_ACTIONS = [\n  \"root.access.grant\",\n  \"root.access.revoke\",\n  \"root.auditEvents.list\",\n  \"root.identities.get\",\n  \"root.identities.list\",\n  \"root.identities.organizations.list\",\n  \"root.organizations.dataUsage.get\",\n  \"root.organizations.get\",\n  \"root.organizations.identities.list\",\n  \"root.organizations.list\",\n  \"root.reports.dataUsage.list\",\n] as const;\n\nexport const RootAuditActionSchema = z.literal(ROOT_AUDIT_ACTIONS);\n\nexport type RootAuditAction = z.infer<typeof RootAuditActionSchema>;\n\n/** One recorded operator action, from `GET /root/audit-events`. */\nexport const RootAuditEventResponseSchema = loosePlainObject({\n  action: RootAuditActionSchema,\n  /** The acting root identity's signing key; null when the API CLI acted. */\n  actorSigningKeyFingerprint: sha256HexStringSchema.nullable(),\n  actorUserId: nonEmptyStringSchema.nullable(),\n  /** Listing filters as a sorted query string; null when none applied. */\n  filter: z.string().nullable(),\n  id: nonEmptyStringSchema,\n  occurredAt: z.string(),\n  sourceIpAddress: z.string().nullable(),\n  targetOrganizationId: nonEmptyStringSchema.nullable(),\n  targetUserId: nonEmptyStringSchema.nullable(),\n});\n\nexport type RootAuditEventResponse = z.infer<\n  typeof RootAuditEventResponseSchema\n>;\n\nexport const RootAuditEventsResponseSchema = loosePlainObject({\n  events: arraySchema(RootAuditEventResponseSchema),\n  /** Opaque cursor for the next page; null when the listing is exhausted. */\n  nextCursor: z.string().nullable(),\n});\n\nexport type RootAuditEventsResponse = z.infer<\n  typeof RootAuditEventsResponseSchema\n>;\n"]}
+{"version":3,"file":"rootAudit.js","sourceRoot":"","sources":["rootAudit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,WAAW,CAAC;AAEnB;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,qBAAqB;IACrB,sBAAsB;IACtB,oCAAoC;IACpC,mCAAmC;IACnC,gCAAgC;IAChC,kCAAkC;IAClC,wBAAwB;IACxB,oCAAoC;IACpC,yBAAyB;IACzB,6BAA6B;IAC7B,4BAA4B;CACpB,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAInE;;;;GAIG;AACH,MAAM,0BAA0B,GAAG,0BAA0B,CAC3D,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EACjB;IACE,IAAI,EAAE,QAAQ;IACd,SAAS,EAAE,CAAC;IACZ,mBAAmB,EAAE,CAAC,GAAG,kBAAkB,CAAC;CAC7C,CACF,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,4BAA4B,GAAG,gBAAgB,CAAC;IAC3D,MAAM,EAAE,0BAA0B;IAClC,2EAA2E;IAC3E,0BAA0B,EAAE,qBAAqB,CAAC,QAAQ,EAAE;IAC5D,WAAW,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IAC5C,wEAAwE;IACxE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,EAAE,EAAE,oBAAoB;IACxB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACtC,oBAAoB,EAAE,oBAAoB,CAAC,QAAQ,EAAE;IACrD,YAAY,EAAE,oBAAoB,CAAC,QAAQ,EAAE;CAC9C,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,6BAA6B,GAAG,gBAAgB,CAAC;IAC5D,MAAM,EAAE,WAAW,CAAC,4BAA4B,CAAC;IACjD,2EAA2E;IAC3E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAClC,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport { registerJsonSchemaFragment } from \"../jsonSchema\";\nimport {\n  arraySchema,\n  loosePlainObject,\n  nonEmptyStringSchema,\n  sha256HexStringSchema,\n} from \"../schema\";\n\n/**\n * Every action the root audit trail records: one per `/root` operation, plus\n * the API CLI's root grant and revoke.\n */\nexport const ROOT_AUDIT_ACTIONS = [\n  \"root.access.grant\",\n  \"root.access.revoke\",\n  \"root.auditEvents.list\",\n  \"root.identities.get\",\n  \"root.identities.list\",\n  \"root.identities.organizations.list\",\n  \"root.identities.suspension.delete\",\n  \"root.identities.suspension.put\",\n  \"root.organizations.dataUsage.get\",\n  \"root.organizations.get\",\n  \"root.organizations.identities.list\",\n  \"root.organizations.list\",\n  \"root.reports.dataUsage.list\",\n  \"root.reports.opsHealth.get\",\n] as const;\n\n/** The server's own vocabulary: exactly the actions it records. */\nexport const RootAuditActionSchema = z.literal(ROOT_AUDIT_ACTIONS);\n\nexport type RootAuditAction = z.infer<typeof RootAuditActionSchema>;\n\n/**\n * An action as the audit listing reports it. Every new root operation adds an\n * action, so clients accept any operation id rather than a closed list that a\n * newer server would outgrow; the known ones are listed as extensible.\n */\nconst RootAuditEventActionSchema = registerJsonSchemaFragment(\n  z.string().min(1),\n  {\n    type: \"string\",\n    minLength: 1,\n    \"x-extensible-enum\": [...ROOT_AUDIT_ACTIONS],\n  },\n);\n\n/** One recorded operator action, from `GET /root/audit-events`. */\nexport const RootAuditEventResponseSchema = loosePlainObject({\n  action: RootAuditEventActionSchema,\n  /** The acting root identity's signing key; null when the API CLI acted. */\n  actorSigningKeyFingerprint: sha256HexStringSchema.nullable(),\n  actorUserId: nonEmptyStringSchema.nullable(),\n  /** Listing filters as a sorted query string; null when none applied. */\n  filter: z.string().nullable(),\n  id: nonEmptyStringSchema,\n  occurredAt: z.string(),\n  sourceIpAddress: z.string().nullable(),\n  targetOrganizationId: nonEmptyStringSchema.nullable(),\n  targetUserId: nonEmptyStringSchema.nullable(),\n});\n\nexport type RootAuditEventResponse = z.infer<\n  typeof RootAuditEventResponseSchema\n>;\n\nexport const RootAuditEventsResponseSchema = loosePlainObject({\n  events: arraySchema(RootAuditEventResponseSchema),\n  /** Opaque cursor for the next page; null when the listing is exhausted. */\n  nextCursor: z.string().nullable(),\n});\n\nexport type RootAuditEventsResponse = z.infer<\n  typeof RootAuditEventsResponseSchema\n>;\n"]}

package/internal/validators/response/rootOpsHealth.d.ts

@@ -0,0 +1,224 @@
+import { z } from "zod";
+/** Rows each ops-health section returns at most; `truncated` marks more. */
+export declare const ROOT_OPS_HEALTH_SECTION_LIMIT = 50;
+/**
+ * Billing maintenance runs every minute, so work still due this long after it
+ * fell due means the job is not keeping up rather than about to reach it.
+ */
+export declare const ROOT_OPS_HEALTH_OVERDUE_MINUTES = 15;
+/** How far ahead the report looks for trials ending and purges coming due. */
+export declare const ROOT_OPS_HEALTH_UPCOMING_DAYS = 7;
+export declare const ROOT_SEAT_SYNC_CONDITIONS: readonly ["failing", "stalled", "leaseExpired"];
+/**
+ * Why a Stripe seat-sync row is listed: its last attempt failed, a pending
+ * change has waited well past its retry time, or a claim's lease expired
+ * without the claim completing or failing.
+ */
+export declare const RootSeatSyncConditionSchema: z.ZodLiteral<"failing" | "stalled" | "leaseExpired">;
+/** Cross-organization billing maintenance health, from `GET /root/reports/ops-health`. */
+export declare const RootOpsHealthReportResponseSchema: z.ZodType<{
+    generatedAt: string;
+    seatSync: {
+        rows: {
+            organizationId: string;
+            conditions: ("failing" | "stalled" | "leaseExpired")[];
+            attemptCount: number;
+            appliedRevision: number;
+            desiredRevision: number;
+            lastError: string | null;
+            lastSyncedAt: string | null;
+            leaseExpiresAt: string | null;
+            nextAttemptAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialExpiry: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+            attemptCount: number;
+            lastError: string | null;
+            nextAttemptAt: string | null;
+            requiresAttention: boolean;
+        }[];
+        truncated: boolean;
+    };
+    purges: {
+        rows: {
+            organizationId: string;
+            status: "disabled" | "deleting";
+            purgeAfter: string | null;
+            purgeStartedAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialsEnding: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+        }[];
+        truncated: boolean;
+    };
+    purgesDue: {
+        rows: {
+            organizationId: string;
+            disabledAt: string | null;
+            purgeAfter: string;
+        }[];
+        truncated: boolean;
+    };
+}, {
+    generatedAt: string;
+    seatSync: {
+        rows: {
+            organizationId: string;
+            conditions: ("failing" | "stalled" | "leaseExpired")[];
+            attemptCount: number;
+            appliedRevision: number;
+            desiredRevision: number;
+            lastError: string | null;
+            lastSyncedAt: string | null;
+            leaseExpiresAt: string | null;
+            nextAttemptAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialExpiry: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+            attemptCount: number;
+            lastError: string | null;
+            nextAttemptAt: string | null;
+            requiresAttention: boolean;
+        }[];
+        truncated: boolean;
+    };
+    purges: {
+        rows: {
+            organizationId: string;
+            status: "disabled" | "deleting";
+            purgeAfter: string | null;
+            purgeStartedAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialsEnding: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+        }[];
+        truncated: boolean;
+    };
+    purgesDue: {
+        rows: {
+            organizationId: string;
+            disabledAt: string | null;
+            purgeAfter: string;
+        }[];
+        truncated: boolean;
+    };
+}, z.core.$ZodTypeInternals<{
+    generatedAt: string;
+    seatSync: {
+        rows: {
+            organizationId: string;
+            conditions: ("failing" | "stalled" | "leaseExpired")[];
+            attemptCount: number;
+            appliedRevision: number;
+            desiredRevision: number;
+            lastError: string | null;
+            lastSyncedAt: string | null;
+            leaseExpiresAt: string | null;
+            nextAttemptAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialExpiry: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+            attemptCount: number;
+            lastError: string | null;
+            nextAttemptAt: string | null;
+            requiresAttention: boolean;
+        }[];
+        truncated: boolean;
+    };
+    purges: {
+        rows: {
+            organizationId: string;
+            status: "disabled" | "deleting";
+            purgeAfter: string | null;
+            purgeStartedAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialsEnding: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+        }[];
+        truncated: boolean;
+    };
+    purgesDue: {
+        rows: {
+            organizationId: string;
+            disabledAt: string | null;
+            purgeAfter: string;
+        }[];
+        truncated: boolean;
+    };
+}, {
+    generatedAt: string;
+    seatSync: {
+        rows: {
+            organizationId: string;
+            conditions: ("failing" | "stalled" | "leaseExpired")[];
+            attemptCount: number;
+            appliedRevision: number;
+            desiredRevision: number;
+            lastError: string | null;
+            lastSyncedAt: string | null;
+            leaseExpiresAt: string | null;
+            nextAttemptAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialExpiry: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+            attemptCount: number;
+            lastError: string | null;
+            nextAttemptAt: string | null;
+            requiresAttention: boolean;
+        }[];
+        truncated: boolean;
+    };
+    purges: {
+        rows: {
+            organizationId: string;
+            status: "disabled" | "deleting";
+            purgeAfter: string | null;
+            purgeStartedAt: string | null;
+        }[];
+        truncated: boolean;
+    };
+    trialsEnding: {
+        rows: {
+            organizationId: string;
+            trialEndsAt: string;
+        }[];
+        truncated: boolean;
+    };
+    purgesDue: {
+        rows: {
+            organizationId: string;
+            disabledAt: string | null;
+            purgeAfter: string;
+        }[];
+        truncated: boolean;
+    };
+}>>;
+export type RootOpsHealthReportResponse = z.infer<typeof RootOpsHealthReportResponseSchema>;

package/internal/validators/response/rootOpsHealth.js

@@ -0,0 +1,79 @@
+import { z } from "zod";
+import { arraySchema, loosePlainObject, nonEmptyStringSchema, nonNegativeIntegerSchema, } from "../schema.js";
+/** Rows each ops-health section returns at most; `truncated` marks more. */
+export const ROOT_OPS_HEALTH_SECTION_LIMIT = 50;
+/**
+ * Billing maintenance runs every minute, so work still due this long after it
+ * fell due means the job is not keeping up rather than about to reach it.
+ */
+export const ROOT_OPS_HEALTH_OVERDUE_MINUTES = 15;
+/** How far ahead the report looks for trials ending and purges coming due. */
+export const ROOT_OPS_HEALTH_UPCOMING_DAYS = 7;
+function sectionSchema(rowSchema) {
+    return loosePlainObject({
+        rows: arraySchema(rowSchema, ROOT_OPS_HEALTH_SECTION_LIMIT),
+        /** More rows matched than the section returns. */
+        truncated: z.boolean(),
+    });
+}
+export const ROOT_SEAT_SYNC_CONDITIONS = [
+    "failing",
+    "stalled",
+    "leaseExpired",
+];
+/**
+ * Why a Stripe seat-sync row is listed: its last attempt failed, a pending
+ * change has waited well past its retry time, or a claim's lease expired
+ * without the claim completing or failing.
+ */
+export const RootSeatSyncConditionSchema = z.literal(ROOT_SEAT_SYNC_CONDITIONS);
+const RootSeatSyncIssueSchema = loosePlainObject({
+    organizationId: nonEmptyStringSchema,
+    conditions: arraySchema(RootSeatSyncConditionSchema, ROOT_SEAT_SYNC_CONDITIONS.length),
+    attemptCount: nonNegativeIntegerSchema,
+    appliedRevision: nonNegativeIntegerSchema,
+    desiredRevision: nonNegativeIntegerSchema,
+    lastError: z.string().nullable(),
+    lastSyncedAt: z.string().nullable(),
+    leaseExpiresAt: z.string().nullable(),
+    nextAttemptAt: z.string().nullable(),
+});
+const RootTrialExpiryIssueSchema = loosePlainObject({
+    organizationId: nonEmptyStringSchema,
+    trialEndsAt: z.string(),
+    attemptCount: nonNegativeIntegerSchema,
+    lastError: z.string().nullable(),
+    nextAttemptAt: z.string().nullable(),
+    /** The sweep has failed often enough to report the organization. */
+    requiresAttention: z.boolean(),
+});
+const RootPurgeIssueSchema = loosePlainObject({
+    organizationId: nonEmptyStringSchema,
+    status: z.literal(["disabled", "deleting"]),
+    purgeAfter: z.string().nullable(),
+    purgeStartedAt: z.string().nullable(),
+});
+const RootTrialEndingSchema = loosePlainObject({
+    organizationId: nonEmptyStringSchema,
+    trialEndsAt: z.string(),
+});
+const RootPurgeDueSchema = loosePlainObject({
+    organizationId: nonEmptyStringSchema,
+    disabledAt: z.string().nullable(),
+    purgeAfter: z.string(),
+});
+/** Cross-organization billing maintenance health, from `GET /root/reports/ops-health`. */
+export const RootOpsHealthReportResponseSchema = loosePlainObject({
+    generatedAt: z.string(),
+    /** Stripe seat-sync rows the worker would claim, in retry order. */
+    seatSync: sectionSchema(RootSeatSyncIssueSchema),
+    /** Ended trials the expiry sweep failed on or has not reached in time. */
+    trialExpiry: sectionSchema(RootTrialExpiryIssueSchema),
+    /** Purges past due to start, or started with a lapsed lease. */
+    purges: sectionSchema(RootPurgeIssueSchema),
+    /** Trials ending within the upcoming window, soonest first. */
+    trialsEnding: sectionSchema(RootTrialEndingSchema),
+    /** Disabled organizations whose purge falls due within the window. */
+    purgesDue: sectionSchema(RootPurgeDueSchema),
+});
+//# sourceMappingURL=rootOpsHealth.js.map

package/internal/validators/response/rootOpsHealth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootOpsHealth.js","sourceRoot":"","sources":["rootOpsHealth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,WAAW,CAAC;AAEnB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAElD,8EAA8E;AAC9E,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC;AAE/C,SAAS,aAAa,CAA8B,SAAoB;IACtE,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,WAAW,CAAC,SAAS,EAAE,6BAA6B,CAAC;QAC3D,kDAAkD;QAClD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,SAAS;IACT,SAAS;IACT,cAAc;CACN,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC;AAEhF,MAAM,uBAAuB,GAAG,gBAAgB,CAAC;IAC/C,cAAc,EAAE,oBAAoB;IACpC,UAAU,EAAE,WAAW,CACrB,2BAA2B,EAC3B,yBAAyB,CAAC,MAAM,CACjC;IACD,YAAY,EAAE,wBAAwB;IACtC,eAAe,EAAE,wBAAwB;IACzC,eAAe,EAAE,wBAAwB;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACrC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,gBAAgB,CAAC;IAClD,cAAc,EAAE,oBAAoB;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,YAAY,EAAE,wBAAwB;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,oEAAoE;IACpE,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;IAC5C,cAAc,EAAE,oBAAoB;IACpC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;IAC7C,cAAc,EAAE,oBAAoB;IACpC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;IAC1C,cAAc,EAAE,oBAAoB;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,CAAC,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;IAChE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,oEAAoE;IACpE,QAAQ,EAAE,aAAa,CAAC,uBAAuB,CAAC;IAChD,0EAA0E;IAC1E,WAAW,EAAE,aAAa,CAAC,0BAA0B,CAAC;IACtD,gEAAgE;IAChE,MAAM,EAAE,aAAa,CAAC,oBAAoB,CAAC;IAC3C,+DAA+D;IAC/D,YAAY,EAAE,aAAa,CAAC,qBAAqB,CAAC;IAClD,sEAAsE;IACtE,SAAS,EAAE,aAAa,CAAC,kBAAkB,CAAC;CAC7C,CAAC,CAAC","sourcesContent":["import { z } from \"zod\";\nimport {\n  arraySchema,\n  loosePlainObject,\n  nonEmptyStringSchema,\n  nonNegativeIntegerSchema,\n} from \"../schema\";\n\n/** Rows each ops-health section returns at most; `truncated` marks more. */\nexport const ROOT_OPS_HEALTH_SECTION_LIMIT = 50;\n\n/**\n * Billing maintenance runs every minute, so work still due this long after it\n * fell due means the job is not keeping up rather than about to reach it.\n */\nexport const ROOT_OPS_HEALTH_OVERDUE_MINUTES = 15;\n\n/** How far ahead the report looks for trials ending and purges coming due. */\nexport const ROOT_OPS_HEALTH_UPCOMING_DAYS = 7;\n\nfunction sectionSchema<RowSchema extends z.ZodType>(rowSchema: RowSchema) {\n  return loosePlainObject({\n    rows: arraySchema(rowSchema, ROOT_OPS_HEALTH_SECTION_LIMIT),\n    /** More rows matched than the section returns. */\n    truncated: z.boolean(),\n  });\n}\n\nexport const ROOT_SEAT_SYNC_CONDITIONS = [\n  \"failing\",\n  \"stalled\",\n  \"leaseExpired\",\n] as const;\n\n/**\n * Why a Stripe seat-sync row is listed: its last attempt failed, a pending\n * change has waited well past its retry time, or a claim's lease expired\n * without the claim completing or failing.\n */\nexport const RootSeatSyncConditionSchema = z.literal(ROOT_SEAT_SYNC_CONDITIONS);\n\nconst RootSeatSyncIssueSchema = loosePlainObject({\n  organizationId: nonEmptyStringSchema,\n  conditions: arraySchema(\n    RootSeatSyncConditionSchema,\n    ROOT_SEAT_SYNC_CONDITIONS.length,\n  ),\n  attemptCount: nonNegativeIntegerSchema,\n  appliedRevision: nonNegativeIntegerSchema,\n  desiredRevision: nonNegativeIntegerSchema,\n  lastError: z.string().nullable(),\n  lastSyncedAt: z.string().nullable(),\n  leaseExpiresAt: z.string().nullable(),\n  nextAttemptAt: z.string().nullable(),\n});\n\nconst RootTrialExpiryIssueSchema = loosePlainObject({\n  organizationId: nonEmptyStringSchema,\n  trialEndsAt: z.string(),\n  attemptCount: nonNegativeIntegerSchema,\n  lastError: z.string().nullable(),\n  nextAttemptAt: z.string().nullable(),\n  /** The sweep has failed often enough to report the organization. */\n  requiresAttention: z.boolean(),\n});\n\nconst RootPurgeIssueSchema = loosePlainObject({\n  organizationId: nonEmptyStringSchema,\n  status: z.literal([\"disabled\", \"deleting\"]),\n  purgeAfter: z.string().nullable(),\n  purgeStartedAt: z.string().nullable(),\n});\n\nconst RootTrialEndingSchema = loosePlainObject({\n  organizationId: nonEmptyStringSchema,\n  trialEndsAt: z.string(),\n});\n\nconst RootPurgeDueSchema = loosePlainObject({\n  organizationId: nonEmptyStringSchema,\n  disabledAt: z.string().nullable(),\n  purgeAfter: z.string(),\n});\n\n/** Cross-organization billing maintenance health, from `GET /root/reports/ops-health`. */\nexport const RootOpsHealthReportResponseSchema = loosePlainObject({\n  generatedAt: z.string(),\n  /** Stripe seat-sync rows the worker would claim, in retry order. */\n  seatSync: sectionSchema(RootSeatSyncIssueSchema),\n  /** Ended trials the expiry sweep failed on or has not reached in time. */\n  trialExpiry: sectionSchema(RootTrialExpiryIssueSchema),\n  /** Purges past due to start, or started with a lapsed lease. */\n  purges: sectionSchema(RootPurgeIssueSchema),\n  /** Trials ending within the upcoming window, soonest first. */\n  trialsEnding: sectionSchema(RootTrialEndingSchema),\n  /** Disabled organizations whose purge falls due within the window. */\n  purgesDue: sectionSchema(RootPurgeDueSchema),\n});\n\nexport type RootOpsHealthReportResponse = z.infer<\n  typeof RootOpsHealthReportResponseSchema\n>;\n"]}

package/internal/validators/response/rootOrganizations.d.ts

@@ -353,6 +353,7 @@ export declare const RootOrganizationIdentityResponseSchema: z.ZodType<{
         lastActiveAt: string | null;
         registrationSourceIpAddress: string | null;
         signingKeyFingerprint: string;
+        suspendedAt: string | null;
         userId: string;
     };
     roster: {
@@ -370,6 +371,7 @@ export declare const RootOrganizationIdentityResponseSchema: z.ZodType<{
         lastActiveAt: string | null;
         registrationSourceIpAddress: string | null;
         signingKeyFingerprint: string;
+        suspendedAt: string | null;
         userId: string;
     };
     roster: {
@@ -387,6 +389,7 @@ export declare const RootOrganizationIdentityResponseSchema: z.ZodType<{
         lastActiveAt: string | null;
         registrationSourceIpAddress: string | null;
         signingKeyFingerprint: string;
+        suspendedAt: string | null;
         userId: string;
     };
     roster: {
@@ -404,6 +407,7 @@ export declare const RootOrganizationIdentityResponseSchema: z.ZodType<{
         lastActiveAt: string | null;
         registrationSourceIpAddress: string | null;
         signingKeyFingerprint: string;
+        suspendedAt: string | null;
         userId: string;
     };
     roster: {
@@ -424,6 +428,7 @@ export declare const RootOrganizationIdentitiesResponseSchema: z.ZodType<{
             lastActiveAt: string | null;
             registrationSourceIpAddress: string | null;
             signingKeyFingerprint: string;
+            suspendedAt: string | null;
             userId: string;
         };
         roster: {
@@ -444,6 +449,7 @@ export declare const RootOrganizationIdentitiesResponseSchema: z.ZodType<{
             lastActiveAt: string | null;
             registrationSourceIpAddress: string | null;
             signingKeyFingerprint: string;
+            suspendedAt: string | null;
             userId: string;
         };
         roster: {
@@ -464,6 +470,7 @@ export declare const RootOrganizationIdentitiesResponseSchema: z.ZodType<{
             lastActiveAt: string | null;
             registrationSourceIpAddress: string | null;
             signingKeyFingerprint: string;
+            suspendedAt: string | null;
             userId: string;
         };
         roster: {
@@ -484,6 +491,7 @@ export declare const RootOrganizationIdentitiesResponseSchema: z.ZodType<{
             lastActiveAt: string | null;
             registrationSourceIpAddress: string | null;
             signingKeyFingerprint: string;
+            suspendedAt: string | null;
             userId: string;
         };
         roster: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tearleads/client-sdk",
-  "version": "0.1.93",
+  "version": "0.1.95",
   "description": "React-free Tearleads client runtime: local SQLite persistence, keys, sync, encrypted blobs, and domain workflows.",
   "license": "UNLICENSED",
   "repository": {

package/workflows/root/audit.d.ts

@@ -1,11 +1,18 @@
 import type { RequestResult } from "../../internal/api-client/index.js";
 import type { RootAuditEventsQuery } from "../../internal/validators/operation/index.js";
-import type { RootAuditEventResponse, RootAuditEventsResponse } from "../../internal/validators/response/index.js";
+import type { RootAuditAction, RootAuditEventResponse, RootAuditEventsResponse } from "../../internal/validators/response/index.js";
 import { type RootRequestOutcome } from "./identities.js";
-/** One recorded operator action (wire shape); a null actor is the API CLI. */
-export type RootAuditEvent = RootAuditEventResponse;
+/**
+ * One recorded operator action (wire shape); a null actor is the API CLI. The
+ * action is an operation id, which may be one this SDK predates.
+ */
+export type RootAuditEvent = RootAuditEventResponse & {
+    readonly action: RootAuditAction | (string & {});
+};
 /** A page of audit events, newest first, plus the next page's cursor. */
-export type RootAuditEventsPage = RootAuditEventsResponse;
+export type RootAuditEventsPage = RootAuditEventsResponse & {
+    readonly events: RootAuditEvent[];
+};
 /** Paging and the optional identity or organization the events involve. */
 export type RootAuditEventsQueryInput = RootAuditEventsQuery;
 export interface RootAuditApi {

package/workflows/root/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["audit.ts"],"names":[],"mappings":"AAMA,OAAO,EAA2B,SAAS,EAAE,MAAM,cAAc,CAAC;AAiBlE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,QAAmC,EAAE;IAErC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { RootAuditEventsQuery } from \"@tearleads/validators/operation\";\nimport type {\n  RootAuditEventResponse,\n  RootAuditEventsResponse,\n} from \"@tearleads/validators/response\";\nimport { type RootRequestOutcome, toOutcome } from \"./identities\";\n\n/** One recorded operator action (wire shape); a null actor is the API CLI. */\nexport type RootAuditEvent = RootAuditEventResponse;\n\n/** A page of audit events, newest first, plus the next page's cursor. */\nexport type RootAuditEventsPage = RootAuditEventsResponse;\n\n/** Paging and the optional identity or organization the events involve. */\nexport type RootAuditEventsQueryInput = RootAuditEventsQuery;\n\nexport interface RootAuditApi {\n  listRootAuditEventsResult(\n    query?: RootAuditEventsQuery,\n  ): Promise<RequestResult<RootAuditEventsResponse>>;\n}\n\nexport async function listRootAuditEvents(\n  api: RootAuditApi,\n  query: RootAuditEventsQueryInput = {},\n): Promise<RootRequestOutcome<RootAuditEventsPage>> {\n  return toOutcome(await api.listRootAuditEventsResult(query));\n}\n"]}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["audit.ts"],"names":[],"mappings":"AAOA,OAAO,EAA2B,SAAS,EAAE,MAAM,cAAc,CAAC;AAwBlE,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,QAAmC,EAAE;IAErC,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,yBAAyB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { RootAuditEventsQuery } from \"@tearleads/validators/operation\";\nimport type {\n  RootAuditAction,\n  RootAuditEventResponse,\n  RootAuditEventsResponse,\n} from \"@tearleads/validators/response\";\nimport { type RootRequestOutcome, toOutcome } from \"./identities\";\n\n/**\n * One recorded operator action (wire shape); a null actor is the API CLI. The\n * action is an operation id, which may be one this SDK predates.\n */\nexport type RootAuditEvent = RootAuditEventResponse & {\n  readonly action: RootAuditAction | (string & {});\n};\n\n/** A page of audit events, newest first, plus the next page's cursor. */\nexport type RootAuditEventsPage = RootAuditEventsResponse & {\n  readonly events: RootAuditEvent[];\n};\n\n/** Paging and the optional identity or organization the events involve. */\nexport type RootAuditEventsQueryInput = RootAuditEventsQuery;\n\nexport interface RootAuditApi {\n  listRootAuditEventsResult(\n    query?: RootAuditEventsQuery,\n  ): Promise<RequestResult<RootAuditEventsResponse>>;\n}\n\nexport async function listRootAuditEvents(\n  api: RootAuditApi,\n  query: RootAuditEventsQueryInput = {},\n): Promise<RootRequestOutcome<RootAuditEventsPage>> {\n  return toOutcome(await api.listRootAuditEventsResult(query));\n}\n"]}

package/workflows/root/index.d.ts

@@ -1,4 +1,6 @@
 export { listRootAuditEvents, type RootAuditApi, type RootAuditEvent, type RootAuditEventsPage, type RootAuditEventsQueryInput, } from "./audit.js";
 export { listRootDataUsageReport, loadRootOrganizationDataUsage, type RootDataUsageApi, type RootDataUsageReportPage, } from "./dataUsage.js";
 export { listRootIdentities, listRootIdentityOrganizations, loadRootIdentity, type RootIdentitiesApi, type RootIdentitiesPage, type RootIdentitiesQueryInput, type RootIdentity, type RootIdentityDetail, type RootIdentityOrganization, type RootIdentitySession, type RootRequestOutcome, } from "./identities.js";
+export { loadRootOpsHealthReport, type RootOpsHealthApi, type RootOpsHealthReport, } from "./opsHealth.js";
 export { listRootOrganizationIdentities, listRootOrganizations, loadRootOrganization, type RootOrganization, type RootOrganizationDetail, type RootOrganizationIdentitiesPage, type RootOrganizationIdentity, type RootOrganizationPageQueryInput, type RootOrganizationsApi, type RootOrganizationsPage, type RootOrganizationsQueryInput, } from "./organizations.js";
+export { liftRootIdentitySuspension, type RootSuspensionApi, suspendRootIdentity, } from "./suspension.js";

package/workflows/root/index.js

@@ -1,5 +1,7 @@
 export { listRootAuditEvents, } from "./audit.js";
 export { listRootDataUsageReport, loadRootOrganizationDataUsage, } from "./dataUsage.js";
 export { listRootIdentities, listRootIdentityOrganizations, loadRootIdentity, } from "./identities.js";
+export { loadRootOpsHealthReport, } from "./opsHealth.js";
 export { listRootOrganizationIdentities, listRootOrganizations, loadRootOrganization, } from "./organizations.js";
+export { liftRootIdentitySuspension, suspendRootIdentity, } from "./suspension.js";
 //# sourceMappingURL=index.js.map

package/workflows/root/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAKpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAG9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,gBAAgB,GASjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,oBAAoB,GASrB,MAAM,iBAAiB,CAAC","sourcesContent":["export {\n  listRootAuditEvents,\n  type RootAuditApi,\n  type RootAuditEvent,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n} from \"./audit\";\nexport {\n  listRootDataUsageReport,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n} from \"./dataUsage\";\nexport {\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  loadRootIdentity,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentity,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootIdentitySession,\n  type RootRequestOutcome,\n} from \"./identities\";\nexport {\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootOrganization,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./organizations\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAKpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,uBAAuB,EACvB,6BAA6B,GAG9B,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,6BAA6B,EAC7B,gBAAgB,GASjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,uBAAuB,GAGxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,oBAAoB,GASrB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,0BAA0B,EAE1B,mBAAmB,GACpB,MAAM,cAAc,CAAC","sourcesContent":["export {\n  listRootAuditEvents,\n  type RootAuditApi,\n  type RootAuditEvent,\n  type RootAuditEventsPage,\n  type RootAuditEventsQueryInput,\n} from \"./audit\";\nexport {\n  listRootDataUsageReport,\n  loadRootOrganizationDataUsage,\n  type RootDataUsageApi,\n  type RootDataUsageReportPage,\n} from \"./dataUsage\";\nexport {\n  listRootIdentities,\n  listRootIdentityOrganizations,\n  loadRootIdentity,\n  type RootIdentitiesApi,\n  type RootIdentitiesPage,\n  type RootIdentitiesQueryInput,\n  type RootIdentity,\n  type RootIdentityDetail,\n  type RootIdentityOrganization,\n  type RootIdentitySession,\n  type RootRequestOutcome,\n} from \"./identities\";\nexport {\n  loadRootOpsHealthReport,\n  type RootOpsHealthApi,\n  type RootOpsHealthReport,\n} from \"./opsHealth\";\nexport {\n  listRootOrganizationIdentities,\n  listRootOrganizations,\n  loadRootOrganization,\n  type RootOrganization,\n  type RootOrganizationDetail,\n  type RootOrganizationIdentitiesPage,\n  type RootOrganizationIdentity,\n  type RootOrganizationPageQueryInput,\n  type RootOrganizationsApi,\n  type RootOrganizationsPage,\n  type RootOrganizationsQueryInput,\n} from \"./organizations\";\nexport {\n  liftRootIdentitySuspension,\n  type RootSuspensionApi,\n  suspendRootIdentity,\n} from \"./suspension\";\n"]}

package/workflows/root/opsHealth.d.ts

@@ -0,0 +1,9 @@
+import type { RequestResult } from "../../internal/api-client/index.js";
+import type { RootOpsHealthReportResponse } from "../../internal/validators/response/index.js";
+import { type RootRequestOutcome } from "./identities.js";
+/** Cross-organization billing maintenance health (wire shape). */
+export type RootOpsHealthReport = RootOpsHealthReportResponse;
+export interface RootOpsHealthApi {
+    getRootOpsHealthReportResult(): Promise<RequestResult<RootOpsHealthReportResponse>>;
+}
+export declare function loadRootOpsHealthReport(api: RootOpsHealthApi): Promise<RootRequestOutcome<RootOpsHealthReport>>;

package/workflows/root/opsHealth.js

@@ -0,0 +1,5 @@
+import { toOutcome } from "./identities.js";
+export async function loadRootOpsHealthReport(api) {
+    return toOutcome(await api.getRootOpsHealthReportResult());
+}
+//# sourceMappingURL=opsHealth.js.map

package/workflows/root/opsHealth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opsHealth.js","sourceRoot":"","sources":["opsHealth.ts"],"names":[],"mappings":"AAEA,OAAO,EAA2B,SAAS,EAAE,MAAM,cAAc,CAAC;AAWlE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,GAAqB;IAErB,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,4BAA4B,EAAE,CAAC,CAAC;AAC7D,CAAC","sourcesContent":["import type { RequestResult } from \"@tearleads/api-client\";\nimport type { RootOpsHealthReportResponse } from \"@tearleads/validators/response\";\nimport { type RootRequestOutcome, toOutcome } from \"./identities\";\n\n/** Cross-organization billing maintenance health (wire shape). */\nexport type RootOpsHealthReport = RootOpsHealthReportResponse;\n\nexport interface RootOpsHealthApi {\n  getRootOpsHealthReportResult(): Promise<\n    RequestResult<RootOpsHealthReportResponse>\n  >;\n}\n\nexport async function loadRootOpsHealthReport(\n  api: RootOpsHealthApi,\n): Promise<RootRequestOutcome<RootOpsHealthReport>> {\n  return toOutcome(await api.getRootOpsHealthReportResult());\n}\n"]}

package/workflows/root/suspension.d.ts

@@ -0,0 +1,13 @@
+import type { RequestResult } from "../../internal/api-client/index.js";
+import type { RootIdentitySuspensionResponse } from "../../internal/validators/response/index.js";
+import { type RootIdentity, type RootRequestOutcome } from "./identities.js";
+export interface RootSuspensionApi {
+    liftRootIdentitySuspensionResult(userId: string): Promise<RequestResult<RootIdentitySuspensionResponse>>;
+    suspendRootIdentityResult(userId: string): Promise<RequestResult<RootIdentitySuspensionResponse>>;
+}
+/**
+ * Signs the identity out of every device and refuses its sign-in until the
+ * suspension is lifted. Root identities are refused with status 409.
+ */
+export declare function suspendRootIdentity(api: RootSuspensionApi, userId: string): Promise<RootRequestOutcome<RootIdentity>>;
+export declare function liftRootIdentitySuspension(api: RootSuspensionApi, userId: string): Promise<RootRequestOutcome<RootIdentity>>;

package/workflows/root/suspension.js

@@ -0,0 +1,17 @@
+import { toOutcome, } from "./identities.js";
+function identityOutcome(result) {
+    return result.ok
+        ? { data: result.data.identity, ok: true }
+        : toOutcome(result);
+}
+/**
+ * Signs the identity out of every device and refuses its sign-in until the
+ * suspension is lifted. Root identities are refused with status 409.
+ */
+export async function suspendRootIdentity(api, userId) {
+    return identityOutcome(await api.suspendRootIdentityResult(userId));
+}
+export async function liftRootIdentitySuspension(api, userId) {
+    return identityOutcome(await api.liftRootIdentitySuspensionResult(userId));
+}
+//# sourceMappingURL=suspension.js.map