@willyim/idp 0.1.0 → 0.2.0

package/dist/src/drizzle/index.d.ts

@@ -9,7 +9,6 @@
  * `drizzle-orm` is an optional peer dependency of this subpath only — core
  * never imports it.
  */
-import type { Actor, Workspace } from "../claims.js";
 import type { SessionStore } from "../store.js";
 export declare const IDP_SESSION_TABLE = "idp_session";
 /**
@@ -140,7 +139,14 @@ export declare function idpSessionSqliteTable(name?: string): import("drizzle-or
             tableName: string;
             dataType: "json";
             columnType: "SQLiteTextJson";
-            data: Workspace[];
+            data: {
+                [x: string]: unknown;
+                id: string;
+                slug: string;
+                name: string;
+                domain: string | null;
+                role: string;
+            }[];
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -152,14 +158,25 @@ export declare function idpSessionSqliteTable(name?: string): import("drizzle-or
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: Workspace[];
+            $type: {
+                [x: string]: unknown;
+                id: string;
+                slug: string;
+                name: string;
+                domain: string | null;
+                role: string;
+            }[];
         }>;
         actor: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "actor";
             tableName: string;
             dataType: "json";
             columnType: "SQLiteTextJson";
-            data: Actor | null;
+            data: {
+                [x: string]: unknown;
+                sub: string;
+                email?: string | undefined;
+            } | null;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -171,7 +188,11 @@ export declare function idpSessionSqliteTable(name?: string): import("drizzle-or
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: Actor | null;
+            $type: {
+                [x: string]: unknown;
+                sub: string;
+                email?: string | undefined;
+            } | null;
         }>;
         accessToken: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "access_token";
@@ -415,7 +436,14 @@ export declare function idpSessionPgTable(name?: string): import("drizzle-orm/pg
             tableName: string;
             dataType: "json";
             columnType: "PgJsonb";
-            data: Workspace[];
+            data: {
+                [x: string]: unknown;
+                id: string;
+                slug: string;
+                name: string;
+                domain: string | null;
+                role: string;
+            }[];
             driverParam: unknown;
             notNull: true;
             hasDefault: false;
@@ -427,14 +455,25 @@ export declare function idpSessionPgTable(name?: string): import("drizzle-orm/pg
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: Workspace[];
+            $type: {
+                [x: string]: unknown;
+                id: string;
+                slug: string;
+                name: string;
+                domain: string | null;
+                role: string;
+            }[];
         }>;
         actor: import("drizzle-orm/pg-core").PgColumn<{
             name: "actor";
             tableName: string;
             dataType: "json";
             columnType: "PgJsonb";
-            data: Actor | null;
+            data: {
+                [x: string]: unknown;
+                sub: string;
+                email?: string | undefined;
+            } | null;
             driverParam: unknown;
             notNull: false;
             hasDefault: false;
@@ -446,7 +485,11 @@ export declare function idpSessionPgTable(name?: string): import("drizzle-orm/pg
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: Actor | null;
+            $type: {
+                [x: string]: unknown;
+                sub: string;
+                email?: string | undefined;
+            } | null;
         }>;
         accessToken: import("drizzle-orm/pg-core").PgColumn<{
             name: "access_token";
@@ -694,7 +737,14 @@ export declare const idpSession: import("drizzle-orm/sqlite-core").SQLiteTableWi
             tableName: string;
             dataType: "json";
             columnType: "SQLiteTextJson";
-            data: Workspace[];
+            data: {
+                [x: string]: unknown;
+                id: string;
+                slug: string;
+                name: string;
+                domain: string | null;
+                role: string;
+            }[];
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -706,14 +756,25 @@ export declare const idpSession: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: Workspace[];
+            $type: {
+                [x: string]: unknown;
+                id: string;
+                slug: string;
+                name: string;
+                domain: string | null;
+                role: string;
+            }[];
         }>;
         actor: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "actor";
             tableName: string;
             dataType: "json";
             columnType: "SQLiteTextJson";
-            data: Actor | null;
+            data: {
+                [x: string]: unknown;
+                sub: string;
+                email?: string | undefined;
+            } | null;
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -725,7 +786,11 @@ export declare const idpSession: import("drizzle-orm/sqlite-core").SQLiteTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: Actor | null;
+            $type: {
+                [x: string]: unknown;
+                sub: string;
+                email?: string | undefined;
+            } | null;
         }>;
         accessToken: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: "access_token";

package/dist/src/drizzle/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/drizzle/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,aAAa,CAAA;AAE9D,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkBrE;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkBjE;AAED,0EAA0E;AAC1E,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA0B,CAAA;AAEjD;;;;GAIG;AACH,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;IAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;IAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;IAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAChC,CAAA;AAED,KAAK,eAAe,GAChB,UAAU,CAAC,OAAO,qBAAqB,CAAC,GACxC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAExC,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,YAAY,CA8BzF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/drizzle/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAiB,YAAY,EAAE,MAAM,aAAa,CAAA;AAE9D,eAAO,MAAM,iBAAiB,gBAAgB,CAAA;AAE9C;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,GAAE,MAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkBrE;AAED,uDAAuD;AACvD,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,MAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkBjE;AAED,0EAA0E;AAC1E,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAA0B,CAAA;AAEjD;;;;GAIG;AACH,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;IAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;IAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;IAC/B,MAAM,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAChC,CAAA;AAED,KAAK,eAAe,GAChB,UAAU,CAAC,OAAO,qBAAqB,CAAC,GACxC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAExC,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,YAAY,CA8BzF"}

package/dist/src/errors.d.ts

@@ -0,0 +1,8 @@
+/** The one error type this package throws. Its own module so validation and
+ * the client can both raise it without importing each other. */
+export declare class IdpError extends Error {
+    readonly status: number;
+    readonly body: unknown;
+    constructor(message: string, status: number, body?: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAAA;gEACgE;AAChE,qBAAa,QAAS,SAAQ,KAAK;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;gBACV,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO;CAM5D"}

package/dist/src/errors.js

@@ -0,0 +1,12 @@
+/** The one error type this package throws. Its own module so validation and
+ * the client can both raise it without importing each other. */
+export class IdpError extends Error {
+    status;
+    body;
+    constructor(message, status, body) {
+        super(message);
+        this.name = "IdpError";
+        this.status = status;
+        this.body = body;
+    }
+}

package/dist/src/index.d.ts

@@ -12,10 +12,12 @@
  *   @willyim/idp/drizzle       the session store, and the `idp_session` table
  *   @willyim/idp/react-router  the auth route and the loader guards
  */
-export { createIdpClient, createPkce, DEFAULT_SCOPES, IdpError, type AuthorizationUrlInput, type Discovery, type IdpClient, type IdpClientOptions, type Tokens, } from "./client.js";
+export { createIdpClient, createPkce, DEFAULT_SCOPES, IdpError, SUPPORTED_SCOPES, type AuthorizationUrlInput, type Discovery, type IdpClient, type IdpClientOptions, type IdpScope, type Tokens, } from "./client.js";
 export { createIdp, DEFAULT_SESSION_COOKIE, safeNext, type Idp, type IdpOptions, type Session, type SessionOptions, } from "./session.js";
 export { memorySessions, type MemorySessionStore, type SessionRecord, type SessionStore, } from "./store.js";
 export { grants, normalizeClaims, PERMISSIONS_CLAIM, WORKSPACES_CLAIM, type Actor, type Claims, type Workspace, } from "./claims.js";
+export { createManagementApi, type ManagementApi, type ManagementApiOptions, } from "./api.js";
+export { createUserKeys, readApiKey, type AuthenticatedKey, type AuthenticateOptions, type AuthenticateResult, type CreateUserApiKeyInput, type ListFilter, type MintedUserApiKey, type UserApiKey, type UserKeyCacheOptions, type UserKeys, type UserKeysOptions, type UserKeyValidation, } from "./user-keys.js";
 export { parseDuration, type Duration } from "./duration.js";
 export { clearCookie, parseCookies, readCookie, serializeCookie, type CookieOptions, } from "./cookie.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,eAAe,EACf,UAAU,EACV,cAAc,EACd,QAAQ,EACR,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,QAAQ,EACR,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,MAAM,EACN,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,EACV,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,eAAe,EACf,UAAU,EACV,cAAc,EACd,QAAQ,EACR,gBAAgB,EAChB,KAAK,qBAAqB,EAC1B,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,QAAQ,EACb,KAAK,MAAM,GACZ,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,SAAS,EACT,sBAAsB,EACtB,QAAQ,EACR,KAAK,GAAG,EACR,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AAErB,OAAO,EACL,cAAc,EACd,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACL,MAAM,EACN,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,SAAS,GACf,MAAM,aAAa,CAAA;AAEpB,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,UAAU,CAAA;AAEjB,OAAO,EACL,cAAc,EACd,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACb,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,eAAe,CAAA;AAC5D,OAAO,EACL,WAAW,EACX,YAAY,EACZ,UAAU,EACV,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAA"}

package/dist/src/index.js

@@ -12,9 +12,11 @@
  *   @willyim/idp/drizzle       the session store, and the `idp_session` table
  *   @willyim/idp/react-router  the auth route and the loader guards
  */
-export { createIdpClient, createPkce, DEFAULT_SCOPES, IdpError, } from "./client.js";
+export { createIdpClient, createPkce, DEFAULT_SCOPES, IdpError, SUPPORTED_SCOPES, } from "./client.js";
 export { createIdp, DEFAULT_SESSION_COOKIE, safeNext, } from "./session.js";
 export { memorySessions, } from "./store.js";
 export { grants, normalizeClaims, PERMISSIONS_CLAIM, WORKSPACES_CLAIM, } from "./claims.js";
+export { createManagementApi, } from "./api.js";
+export { createUserKeys, readApiKey, } from "./user-keys.js";
 export { parseDuration } from "./duration.js";
 export { clearCookie, parseCookies, readCookie, serializeCookie, } from "./cookie.js";

package/dist/src/schemas/index.d.ts

@@ -0,0 +1,207 @@
+/**
+ * The wire shapes of the IdP management API (`/api/v1/*`), as zod schemas.
+ *
+ * One definition, three consumers: `apps/idp` validates incoming requests with
+ * them, `scripts/generate-openapi.mjs` turns them into the OpenAPI document,
+ * and the SDK's `api.ts` parses responses against them. Types are `z.infer`,
+ * so there is no generated `.d.ts` to drift out of sync.
+ *
+ * The OIDC endpoints are NOT here — those are standards-defined and live in
+ * `../wire.ts`, next to the code that talks to them.
+ */
+import { z } from "zod";
+export declare const ApplicationSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    app: z.ZodNullable<z.ZodString>;
+    redirectUris: z.ZodArray<z.ZodString>;
+    disabled: z.ZodBoolean;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const UserSchema: z.ZodObject<{
+    id: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    emailVerified: z.ZodBoolean;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const WorkspaceSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+    applicationId: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const ApplicationListSchema: z.ZodObject<{
+    applications: z.ZodArray<z.ZodObject<{
+        clientId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        app: z.ZodNullable<z.ZodString>;
+        redirectUris: z.ZodArray<z.ZodString>;
+        disabled: z.ZodBoolean;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const UserListSchema: z.ZodObject<{
+    users: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        emailVerified: z.ZodBoolean;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const WorkspaceListSchema: z.ZodObject<{
+    workspaces: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        slug: z.ZodString;
+        applicationId: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const RoleSchema: z.ZodEnum<{
+    admin: "admin";
+    member: "member";
+}>;
+export declare const MemberSchema: z.ZodObject<{
+    userId: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    role: z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const MemberListSchema: z.ZodObject<{
+    members: z.ZodArray<z.ZodObject<{
+        userId: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        role: z.ZodEnum<{
+            admin: "admin";
+            member: "member";
+        }>;
+        permissions: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/** Add (existing user) or invite (new email) an app member. */
+export declare const InviteMemberInput: z.ZodObject<{
+    email: z.ZodString;
+    role: z.ZodDefault<z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>>;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const InviteMemberResult: z.ZodObject<{
+    result: z.ZodEnum<{
+        added: "added";
+        invited: "invited";
+    }>;
+}, z.core.$strip>;
+export declare const UpdateMemberInput: z.ZodObject<{
+    role: z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>;
+    permissions: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export declare const CreateWorkspaceInput: z.ZodObject<{
+    name: z.ZodString;
+    slug: z.ZodString;
+}, z.core.$strip>;
+export declare const WorkspaceCreatedSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    slug: z.ZodString;
+}, z.core.$strip>;
+export declare const OkSchema: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>;
+export declare const UserApiKeySchema: z.ZodObject<{
+    id: z.ZodString;
+    userId: z.ZodString;
+    workspaceId: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const UserApiKeyListSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        userId: z.ZodString;
+        workspaceId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        scopes: z.ZodArray<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            revoked: "revoked";
+        }>;
+        createdAt: z.ZodString;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const CreateUserApiKeyInput: z.ZodObject<{
+    userId: z.ZodString;
+    name: z.ZodString;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    workspaceId: z.ZodOptional<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export declare const UserApiKeyCreatedSchema: z.ZodObject<{
+    id: z.ZodString;
+    token: z.ZodString;
+    prefix: z.ZodString;
+}, z.core.$strip>;
+export declare const ValidateUserApiKeyInput: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strip>;
+export declare const UserApiKeyValidationSchema: z.ZodUnion<readonly [z.ZodObject<{
+    valid: z.ZodLiteral<true>;
+    keyId: z.ZodString;
+    userId: z.ZodString;
+    workspaceId: z.ZodNullable<z.ZodString>;
+    scopes: z.ZodArray<z.ZodString>;
+    name: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    valid: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        expired: "expired";
+        revoked: "revoked";
+        not_found: "not_found";
+    }>;
+}, z.core.$strip>]>;
+export declare const AuditEntrySchema: z.ZodObject<{
+    id: z.ZodNumber;
+    tableName: z.ZodString;
+    operation: z.ZodString;
+    rowId: z.ZodNullable<z.ZodString>;
+    userId: z.ZodNullable<z.ZodString>;
+    actor: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const AuditListSchema: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        tableName: z.ZodString;
+        operation: z.ZodString;
+        rowId: z.ZodNullable<z.ZodString>;
+        userId: z.ZodNullable<z.ZodString>;
+        actor: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+//# sourceMappingURL=index.d.ts.map

package/dist/src/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,iBAAiB;;;;;;;iBAO5B,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;iBAMrB,CAAA;AAEF,eAAO,MAAM,eAAe;;;;;;iBAM1B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;iBAAyD,CAAA;AAC3F,eAAO,MAAM,cAAc;;;;;;;;iBAA2C,CAAA;AACtE,eAAO,MAAM,mBAAmB;;;;;;;;iBAAqD,CAAA;AAIrF,eAAO,MAAM,UAAU;;;EAA8B,CAAA;AAErD,eAAO,MAAM,YAAY;;;;;;;;;iBAMvB,CAAA;AACF,eAAO,MAAM,gBAAgB;;;;;;;;;;;iBAA+C,CAAA;AAE5E,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;;iBAI5B,CAAA;AACF,eAAO,MAAM,kBAAkB;;;;;iBAG7B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;;;;;iBAG5B,CAAA;AAEF,eAAO,MAAM,oBAAoB;;;iBAM/B,CAAA;AACF,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAA;AAEF,eAAO,MAAM,QAAQ;;iBAAoC,CAAA;AAIzD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;iBAW3B,CAAA;AACF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;iBAAgD,CAAA;AAEjF,eAAO,MAAM,qBAAqB;;;;;;iBAMhC,CAAA;AACF,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAA;AAEF,eAAO,MAAM,uBAAuB;;iBAAyC,CAAA;AAC7E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;mBAUrC,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;iBAQ3B,CAAA;AACF,eAAO,MAAM,eAAe;;;;;;;;;;iBAAmD,CAAA"}

package/dist/src/schemas/index.js

@@ -0,0 +1,122 @@
+/**
+ * The wire shapes of the IdP management API (`/api/v1/*`), as zod schemas.
+ *
+ * One definition, three consumers: `apps/idp` validates incoming requests with
+ * them, `scripts/generate-openapi.mjs` turns them into the OpenAPI document,
+ * and the SDK's `api.ts` parses responses against them. Types are `z.infer`,
+ * so there is no generated `.d.ts` to drift out of sync.
+ *
+ * The OIDC endpoints are NOT here — those are standards-defined and live in
+ * `../wire.ts`, next to the code that talks to them.
+ */
+import { z } from "zod";
+export const ApplicationSchema = z.object({
+    clientId: z.string(),
+    name: z.string().nullable(),
+    app: z.string().nullable().describe("Application key; consumer workspace claims are filtered by this"),
+    redirectUris: z.array(z.string()),
+    disabled: z.boolean(),
+    createdAt: z.string().describe("ISO 8601 timestamp"),
+});
+export const UserSchema = z.object({
+    id: z.string(),
+    email: z.string(),
+    name: z.string().nullable(),
+    emailVerified: z.boolean(),
+    createdAt: z.string(),
+});
+export const WorkspaceSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    slug: z.string(),
+    applicationId: z.string().nullable(),
+    createdAt: z.string(),
+});
+export const ApplicationListSchema = z.object({ applications: z.array(ApplicationSchema) });
+export const UserListSchema = z.object({ users: z.array(UserSchema) });
+export const WorkspaceListSchema = z.object({ workspaces: z.array(WorkspaceSchema) });
+// --- Write management API (scoped-key authenticated, per-app) ---
+export const RoleSchema = z.enum(["admin", "member"]);
+export const MemberSchema = z.object({
+    userId: z.string(),
+    email: z.string(),
+    name: z.string().nullable(),
+    role: RoleSchema,
+    permissions: z.array(z.string()),
+});
+export const MemberListSchema = z.object({ members: z.array(MemberSchema) });
+/** Add (existing user) or invite (new email) an app member. */
+export const InviteMemberInput = z.object({
+    email: z.string().email(),
+    role: RoleSchema.default("member"),
+    permissions: z.array(z.string()).default([]),
+});
+export const InviteMemberResult = z.object({
+    // "added" = existing user joined now; "invited" = pending invite emailed.
+    result: z.enum(["added", "invited"]),
+});
+export const UpdateMemberInput = z.object({
+    role: RoleSchema,
+    permissions: z.array(z.string()).default([]),
+});
+export const CreateWorkspaceInput = z.object({
+    name: z.string().min(1),
+    slug: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9-]+$/, "lowercase letters, numbers and dashes only"),
+});
+export const WorkspaceCreatedSchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    slug: z.string(),
+});
+export const OkSchema = z.object({ ok: z.literal(true) });
+// --- End-user API keys (the app's own API credentials, stored in the IdP) ---
+export const UserApiKeySchema = z.object({
+    id: z.string(),
+    userId: z.string(),
+    workspaceId: z.string().nullable(),
+    name: z.string(),
+    prefix: z.string().describe("Non-secret token prefix (wak_…) for display"),
+    scopes: z.array(z.string()),
+    status: z.enum(["active", "expired", "revoked"]),
+    createdAt: z.string(),
+    lastUsedAt: z.string().nullable(),
+    expiresAt: z.string().nullable(),
+});
+export const UserApiKeyListSchema = z.object({ keys: z.array(UserApiKeySchema) });
+export const CreateUserApiKeyInput = z.object({
+    userId: z.string().min(1),
+    name: z.string().min(1),
+    scopes: z.array(z.string()).default([]).describe("Subset of the app's product permission catalog"),
+    workspaceId: z.string().optional(),
+    expiresAt: z.iso.datetime().optional().describe("ISO 8601; omit for non-expiring"),
+});
+export const UserApiKeyCreatedSchema = z.object({
+    id: z.string(),
+    token: z.string().describe("Plaintext key — shown exactly once, never stored"),
+    prefix: z.string(),
+});
+export const ValidateUserApiKeyInput = z.object({ token: z.string().min(1) });
+export const UserApiKeyValidationSchema = z.union([
+    z.object({
+        valid: z.literal(true),
+        keyId: z.string(),
+        userId: z.string(),
+        workspaceId: z.string().nullable(),
+        scopes: z.array(z.string()),
+        name: z.string(),
+    }),
+    z.object({ valid: z.literal(false), reason: z.enum(["not_found", "revoked", "expired"]) }),
+]);
+export const AuditEntrySchema = z.object({
+    id: z.number(),
+    tableName: z.string(),
+    operation: z.string(),
+    rowId: z.string().nullable(),
+    userId: z.string().nullable(),
+    actor: z.string().nullable(),
+    createdAt: z.string(),
+});
+export const AuditListSchema = z.object({ entries: z.array(AuditEntrySchema) });

package/dist/src/schemas/openapi.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The published OpenAPI document, built from `./operations.ts`.
+ *
+ * `apps/idp` serves this at `/api/v1/openapi.json`; `npm run openapi` writes
+ * the same object to `openapi/idp-api.json` so the snapshot in the repo is
+ * always what the server would answer.
+ */
+export declare function buildOpenApiDocument(input: {
+    baseUrl: string;
+}): {
+    openapi: string;
+    info: {
+        title: string;
+        version: string;
+        description: string;
+    };
+    servers: {
+        url: string;
+    }[];
+    components: {
+        securitySchemes: {
+            bearerAuth: {
+                type: string;
+                scheme: string;
+                description: string;
+            };
+        };
+    };
+    paths: Record<string, Record<string, unknown>>;
+};
+//# sourceMappingURL=openapi.d.ts.map

package/dist/src/schemas/openapi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../../src/schemas/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAoFH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;EA6B9D"}