@aexhq/sdk 0.46.5-canary → 0.50.0

package/dist/_contracts/schemas/mcp-server.js

@@ -1,209 +0,0 @@
-/**
- * Schemas for the two MCP server declarations on the request side: the
- * non-secret `McpServerRef` that enters the hashed submission, and the
- * `SessionConfigMcpServer` a `session.json` may carry with inline `headers`.
- *
- * Two rules are DEFERRED BACK to `session-config.ts` through {@link McpWirePolicy}
- * rather than moved here, and that is deliberate:
- * `scripts/cicd/check-parser-ratchet.mjs`'s sibling gate
- * `scripts/cicd/check-contract-parity.mjs` locates the SSRF host deny-list
- * inside `session-config.ts` — it slices the file from `denyReasonForHostIp` to
- * `parseRemoteMcpTransport` and byte-compares that region against
- * `platform/packages/shared/src/blueprint.ts`. Moving either function here would
- * break the only cross-repo check that keeps the two deny-lists identical, so
- * the schema takes them as parameters instead.
- */
-import * as z from "zod/mini";
-import { parseWire, wireObject } from "./wire.js";
-export const MCP_SERVER_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,62}$/;
-/**
- * Canonical error string for any attempt to declare a stdio-shaped MCP
- * server (`transport: "stdio"`, or a stdio-only field like `command` /
- * `args` / `env`). Pinned in source so every surface — shared parser,
- * SDK builder, CLI flag parser, dashboard form — surfaces the same
- * message and a user can find it via grep.
- */
-export const REMOTE_MCP_STDIO_REJECTED_MESSAGE = "stdio MCP servers are not supported by Aex. Aex supports remote MCP servers over HTTP/SSE only.";
-/**
- * Stdio-only fields. Used by the shape gate to detect a stdio declaration even
- * when the caller omits `transport: "stdio"` (e.g. `{ url, command }` — the
- * presence of `command` alone identifies it).
- */
-const STDIO_ONLY_FIELDS = ["command", "args", "env"];
-function isStdioShaped(value) {
-    if (value === null || typeof value !== "object") {
-        return false;
-    }
-    const record = value;
-    return (record.transport === "stdio" || STDIO_ONLY_FIELDS.some((field) => record[field] !== undefined));
-}
-/**
- * A remote-only precondition on any MCP declaration, whatever else is wrong
- * with it.
- *
- * Deliberately its own schema, parsed BEFORE the strict object rather than
- * carried on it as a `.check()`. Zod raises `unrecognized_keys` while parsing
- * the object body and skips the object's own checks once the body has issues
- * (measured), and `errorFromZod` ranks a rejected key ahead of every other issue
- * at the same depth — so no rule expressed on the object can outrank an unknown
- * key. `{ command: "local", unknown: true }` must report stdio, not `unknown`,
- * which is exactly the sequencing the hand-written parser had: reject the stdio
- * shape, then apply the allow-list.
- */
-export const RemoteMcpShapeSchema = z.unknown().check(z.refine((value) => !isStdioShaped(value), {
-    error: REMOTE_MCP_STDIO_REJECTED_MESSAGE,
-    abort: true
-}));
-/**
- * Throw the canonical stdio-rejected error if the record carries any
- * stdio-only marker (`transport: "stdio"`, `command`, `args`, `env`).
- * Used by both the shared parser and the SDK `McpServer.remote`
- * builder so every entry point surfaces the same message.
- */
-export function rejectStdioMcpShape(record) {
-    parseWire(RemoteMcpShapeSchema, record);
-}
-function toUrl(value) {
-    try {
-        return new URL(value);
-    }
-    catch {
-        return undefined;
-    }
-}
-function mcpServerName(path) {
-    const message = `${path}.name must match ${MCP_SERVER_NAME_PATTERN.source}`;
-    return z.string({ error: message }).check(z.regex(MCP_SERVER_NAME_PATTERN, { error: message }));
-}
-/**
- * An http(s) MCP endpoint with no userinfo, on a host the SSRF deny-list allows.
- *
- * Each check aborts so the reported failure is the first one a reader would hit,
- * matching the sequential `new URL()` / protocol / userinfo / host ladder this
- * replaces. Auth belongs in `secrets.mcpServers[].headers`: a
- * `https://user:pass@host` URL would otherwise be persisted in the non-secret
- * session snapshot and hashed into the idempotency key.
- */
-function mcpServerUrl(path, policy) {
-    const nonEmpty = `${path}.url must be a non-empty string`;
-    return z.string({ error: nonEmpty }).check(z.minLength(1, { error: nonEmpty, abort: true }), z.refine((value) => toUrl(value) !== undefined, {
-        error: (issue) => `${path}.url is not a valid URL: ${String(issue.input)}`,
-        abort: true
-    }), z.refine((value) => {
-        const protocol = toUrl(value)?.protocol;
-        return protocol === "https:" || protocol === "http:";
-    }, {
-        error: (issue) => `${path}.url must use http or https (got ${toUrl(issue.input)?.protocol ?? ""})`,
-        abort: true
-    }), z.refine((value) => {
-        const url = toUrl(value);
-        return url !== undefined && url.username === "" && url.password === "";
-    }, {
-        error: `${path}.url must not contain userinfo (username/password); use secrets.mcpServers[].headers for auth`,
-        abort: true
-    }), z.refine((value) => denyReason(value, policy) === null, {
-        error: (issue) => `${path}.url ${denyReason(issue.input, policy) ?? ""}`,
-        abort: true
-    }));
-}
-function denyReason(value, policy) {
-    const url = toUrl(value);
-    return url === undefined ? null : policy.denyReasonForHost(url);
-}
-/**
- * The optional remote transport, validated by the policy's parser so the
- * permitted set is stated once — in `session-config.ts`, alongside
- * {@link McpWirePolicy}'s other deferred rule.
- *
- * The value shape is therefore opaque to the generated document (L2); the
- * permitted values live in the description registered on the objects below.
- */
-function mcpServerTransport(path, policy) {
-    const field = `${path}.transport`;
-    const failure = (value) => {
-        try {
-            policy.parseTransport(value, field);
-            return null;
-        }
-        catch (error) {
-            return error.message;
-        }
-    };
-    return z.optional(z.unknown().check(z.refine((value) => failure(value) === null, {
-        error: (issue) => failure(issue.input) ?? "",
-        abort: true
-    })));
-}
-/** Per-request headers, kept out of the non-secret ref — see {@link mcpServerRefSchema}. */
-function mcpHeaders(path) {
-    return z.optional(z.record(z.string(), z.string({
-        error: (issue) => `${path}.headers.${lastSegment(issue.path)} must be a string`
-    }), { error: `${path}.headers, when provided, must be a string-keyed object` }));
-}
-function lastSegment(issuePath) {
-    const segment = issuePath?.[issuePath.length - 1];
-    return segment === undefined ? "" : String(segment);
-}
-/**
- * Wire shape of the NON-SECRET half of an MCP server declaration.
- *
- * Headers belong on `SessionConfigMcpServer`, and the wire
- * `submission.mcpServers` must NEVER contain them, so anything other than
- * `{name, url, transport}` is rejected explicitly — a caller accidentally
- * inlining `headers` into the non-secret half fails loudly instead of having the
- * field silently dropped.
- */
-export function mcpServerRefSchema(path, policy) {
-    return wireObject(path, {
-        name: mcpServerName(path),
-        url: mcpServerUrl(path, policy),
-        transport: mcpServerTransport(path, policy)
-    }, {
-        unknownKey: (objectPath, key, permitted) => `${objectPath}.${key} is not an allowed field for McpServerRef; permitted: ${permitted.join(", ")}`
-    });
-}
-/**
- * Wire shape of a session-config MCP entry: the non-secret ref plus the inline
- * `headers` the SDK splits out at submission time, so config loaded from
- * `--config session.json` cannot smuggle unrelated fields past the parser.
- */
-export function sessionConfigMcpServerSchema(path, policy) {
-    return wireObject(path, {
-        name: mcpServerName(path),
-        url: mcpServerUrl(path, policy),
-        transport: mcpServerTransport(path, policy),
-        headers: mcpHeaders(path)
-    }, {
-        unknownKey: (objectPath, key, permitted) => `${objectPath}.${key} is not an allowed field for SessionConfigMcpServer; permitted: ${permitted.join(", ")}`
-    });
-}
-/** Reject a stdio shape, then validate the non-secret ref mounted at `path`. */
-export function parseMcpServerRefWire(input, path, policy) {
-    parseWire(RemoteMcpShapeSchema, input);
-    return parseWire(mcpServerRefSchema(path, policy), input);
-}
-/** Reject a stdio shape, then validate a session-config entry mounted at `path`. */
-export function parseSessionConfigMcpServerWire(input, path, policy) {
-    parseWire(RemoteMcpShapeSchema, input);
-    return parseWire(sessionConfigMcpServerSchema(path, policy), input);
-}
-/**
- * Drop an absent `transport` so an omitted field never lands as an explicit
- * `undefined` on the hashed payload.
- *
- * Separate from the schema per D4 — see
- * {@link import("./asset-ref.js").normalizeAssetRef}.
- */
-export function normalizeMcpServerRef(wire) {
-    // `transport` is validated by the policy's parser, which is what narrows it;
-    // the schema itself only knows the value passed that gate.
-    const transport = wire.transport;
-    return transport === undefined
-        ? { name: wire.name, url: wire.url }
-        : { name: wire.name, url: wire.url, transport };
-}
-/** As {@link normalizeMcpServerRef}, preserving inline `headers` when supplied. */
-export function normalizeSessionConfigMcpServer(wire) {
-    const ref = normalizeMcpServerRef(wire);
-    return wire.headers === undefined ? ref : { ...ref, headers: wire.headers };
-}

package/dist/_contracts/schemas/models.d.ts

@@ -1,29 +0,0 @@
-/**
- * Schema for a public model id — a Vercel AI Gateway `creator/model` slug.
- *
- * Structural only. There is no closed model set: an unknown-but-well-formed
- * slug is accepted so a slightly-old client can still name a newly-launched
- * model, and the gateway arbitrates at submit time. See `models.ts`.
- *
- * The pattern is declared here, next to the schema that enforces it, and
- * re-exported by `models.ts` as `MODEL_SLUG_PATTERN` — same reason as the
- * sibling vocabularies: the parser module imports this one, so the constant
- * cannot live there without a cycle.
- */
-import * as z from "zod/mini";
-/**
- * Structural gateway model-slug shape: a lowercase `creator`, a `/`, then the
- * model segment. Matches Vercel AI Gateway `creator/model` slugs
- * (e.g. `anthropic/claude-sonnet-4-6`, `openai/gpt-4.1`, `x-ai/grok-2`).
- */
-export declare const MODEL_SLUG_PATTERN: RegExp;
-type ModelSlugSchema = ReturnType<typeof buildModelSlug>;
-declare function buildModelSlug(field: string): z.ZodMiniString<string>;
-/**
- * The model-slug schema mounted at `field`.
- *
- * Each check aborts so the reported failure is the first one a reader would
- * hit, matching the sequential type/emptiness/pattern ladder it replaces.
- */
-export declare function modelSlugSchema(field: string): ModelSlugSchema;
-export {};

package/dist/_contracts/schemas/models.js

@@ -1,51 +0,0 @@
-/**
- * Schema for a public model id — a Vercel AI Gateway `creator/model` slug.
- *
- * Structural only. There is no closed model set: an unknown-but-well-formed
- * slug is accepted so a slightly-old client can still name a newly-launched
- * model, and the gateway arbitrates at submit time. See `models.ts`.
- *
- * The pattern is declared here, next to the schema that enforces it, and
- * re-exported by `models.ts` as `MODEL_SLUG_PATTERN` — same reason as the
- * sibling vocabularies: the parser module imports this one, so the constant
- * cannot live there without a cycle.
- */
-import * as z from "zod/mini";
-/**
- * Structural gateway model-slug shape: a lowercase `creator`, a `/`, then the
- * model segment. Matches Vercel AI Gateway `creator/model` slugs
- * (e.g. `anthropic/claude-sonnet-4-6`, `openai/gpt-4.1`, `x-ai/grok-2`).
- */
-export const MODEL_SLUG_PATTERN = /^[a-z0-9-]+\/[A-Za-z0-9._:-]+$/;
-/**
- * The field name is part of every message this schema raises, and the same slug
- * rule is mounted at several wire paths (`submission.model`, a session request
- * config's model, an SDK-selected model). Building per path keeps the messages
- * naming the field the caller actually sent; the paths are a small closed set
- * of literals, so the built schemas are memoised rather than rebuilt per call.
- */
-const byField = new Map();
-function buildModelSlug(field) {
-    const notASlugString = `${field} must be a non-empty gateway model slug string ("creator/model")`;
-    return z
-        .string({ error: notASlugString })
-        .check(z.minLength(1, { error: notASlugString, abort: true }), z.refine((value) => MODEL_SLUG_PATTERN.test(value), {
-        error: (issue) => `${field} must be a gateway model slug of the form "creator/model" matching ${MODEL_SLUG_PATTERN.source} (got ${JSON.stringify(issue.input)})`,
-        abort: true
-    }));
-}
-/**
- * The model-slug schema mounted at `field`.
- *
- * Each check aborts so the reported failure is the first one a reader would
- * hit, matching the sequential type/emptiness/pattern ladder it replaces.
- */
-export function modelSlugSchema(field) {
-    const existing = byField.get(field);
-    if (existing !== undefined) {
-        return existing;
-    }
-    const built = buildModelSlug(field);
-    byField.set(field, built);
-    return built;
-}

package/dist/_contracts/schemas/numeric.d.ts

@@ -1,18 +0,0 @@
-/**
- * Numeric wire primitives shared by the request schemas.
- *
- * Each takes the wire path it is mounted at so the message names the field the
- * caller actually sent, matching the `optionalPositiveInt(value, "limits.maxTurns")`
- * style these replace.
- */
-import * as z from "zod/mini";
-/**
- * A positive safe integer — a count. Rejects non-numbers, non-integers,
- * unsafe integers, and `<= 0`.
- */
-export declare function positiveInt(path: string): z.ZodMiniNumber<number>;
-/**
- * A positive finite number — an amount, so fractional values are allowed
- * (`maxSpendUsd: 2.5`). Rejects non-numbers, NaN/Infinity, and `<= 0`.
- */
-export declare function positiveNumber(path: string): z.ZodMiniNumber<number>;

package/dist/_contracts/schemas/numeric.js

@@ -1,28 +0,0 @@
-/**
- * Numeric wire primitives shared by the request schemas.
- *
- * Each takes the wire path it is mounted at so the message names the field the
- * caller actually sent, matching the `optionalPositiveInt(value, "limits.maxTurns")`
- * style these replace.
- */
-import * as z from "zod/mini";
-/**
- * A positive safe integer — a count. Rejects non-numbers, non-integers,
- * unsafe integers, and `<= 0`.
- */
-export function positiveInt(path) {
-    const message = `${path} must be a positive safe integer`;
-    return z
-        .number({ error: message })
-        .check(z.refine((value) => Number.isSafeInteger(value) && value > 0, { error: message, abort: true }));
-}
-/**
- * A positive finite number — an amount, so fractional values are allowed
- * (`maxSpendUsd: 2.5`). Rejects non-numbers, NaN/Infinity, and `<= 0`.
- */
-export function positiveNumber(path) {
-    const message = `${path} must be a positive finite number`;
-    return z
-        .number({ error: message })
-        .check(z.refine((value) => Number.isFinite(value) && value > 0, { error: message, abort: true }));
-}

package/dist/_contracts/schemas/post-hook.d.ts

@@ -1,45 +0,0 @@
-/**
- * Schema for the private post-agent-run verifier hook.
- *
- * Shape gate only. Turning `timeout` into milliseconds, defaulting `maxTurns`,
- * and collapsing an empty command to "no hook" are all normalisation and live in
- * `../post-hook.ts` — a `.transform()` here would make the output half of the
- * generated spec ungenerable (D4/L1), and the duration parse must keep throwing
- * its own branded `parseDurationToMs` error rather than a re-worded schema one.
- */
-import * as z from "zod/mini";
-/**
- * Wire shape of a `postHook`, mounted at `path`.
- *
- * Built per call rather than once at module load because the wire path is a
- * parameter of the parser — the same shape is reported as `postHook` on a
- * session config and as `submission.postHook` under a submission, and every
- * message this family emits names the path the caller actually sent.
- *
- * Declaration order is the permitted-key order reported on an unknown field.
- */
-export declare function postHookSchema(path: string): z.ZodMiniObject<{
-    command: z.ZodMiniString<string>;
-    timeout: z.ZodMiniOptional<z.ZodMiniString<string>>;
-    maxTurns: z.ZodMiniOptional<z.ZodMiniNumber<number>>;
-    maxChars: z.ZodMiniOptional<z.ZodMiniNullable<z.ZodMiniNumber<number>>>;
-}, z.core.$strict>;
-/**
- * The key-and-command gate, without the sibling field rules.
- *
- * A blank command means "no hook", and that answer is reached BEFORE `timeout`,
- * `maxTurns` and `maxChars` are looked at — which is the whole point of the
- * blank-command rule: callers pre-fill a hook config with placeholder values and
- * leave the command empty until they want it to run. Validating the siblings
- * first would reject exactly the configs the rule exists to allow.
- *
- * So the parse happens in two passes: this one decides whether there is a hook
- * at all, and the full {@link postHookSchema} validates the rest only once there
- * is. Both read their keys from the same shape, so there is still one
- * declaration of what a `postHook` may contain.
- */
-export declare function postHookGateSchema(path: string): z.ZodMiniObject<{
-    command: z.ZodMiniString<string>;
-}, z.core.$strict>;
-/** Validated `postHook` wire input, before normalisation. */
-export type PostHookWire = z.infer<ReturnType<typeof postHookSchema>>;

package/dist/_contracts/schemas/post-hook.js

@@ -1,68 +0,0 @@
-/**
- * Schema for the private post-agent-run verifier hook.
- *
- * Shape gate only. Turning `timeout` into milliseconds, defaulting `maxTurns`,
- * and collapsing an empty command to "no hook" are all normalisation and live in
- * `../post-hook.ts` — a `.transform()` here would make the output half of the
- * generated spec ungenerable (D4/L1), and the duration parse must keep throwing
- * its own branded `parseDurationToMs` error rather than a re-worded schema one.
- */
-import * as z from "zod/mini";
-import { wireObject } from "./wire.js";
-/**
- * A non-negative safe integer.
- *
- * Deliberately not `positiveInt` from `./numeric.js`: this admits `0` (a hook
- * may be given no repair turns at all) and the wording it fails with — "a
- * non-negative integer" — is the message this family already emits.
- */
-function nonNegativeInt(path) {
-    const message = `${path} must be a non-negative integer`;
-    return z
-        .number({ error: message })
-        .check(z.refine((value) => Number.isSafeInteger(value) && value >= 0, {
-        error: message,
-        abort: true
-    }));
-}
-/**
- * Wire shape of a `postHook`, mounted at `path`.
- *
- * Built per call rather than once at module load because the wire path is a
- * parameter of the parser — the same shape is reported as `postHook` on a
- * session config and as `submission.postHook` under a submission, and every
- * message this family emits names the path the caller actually sent.
- *
- * Declaration order is the permitted-key order reported on an unknown field.
- */
-export function postHookSchema(path) {
-    return wireObject(path, {
-        command: z.string({ error: `${path}.command must be a string` }),
-        timeout: z.optional(z.string({
-            error: (issue) => `${path}.timeout must be a duration string (e.g. "5m", "30s"); got ${JSON.stringify(issue.input)}`
-        })),
-        maxTurns: z.optional(nonNegativeInt(`${path}.maxTurns`)),
-        maxChars: z.optional(z.nullable(nonNegativeInt(`${path}.maxChars`)))
-    });
-}
-/**
- * The key-and-command gate, without the sibling field rules.
- *
- * A blank command means "no hook", and that answer is reached BEFORE `timeout`,
- * `maxTurns` and `maxChars` are looked at — which is the whole point of the
- * blank-command rule: callers pre-fill a hook config with placeholder values and
- * leave the command empty until they want it to run. Validating the siblings
- * first would reject exactly the configs the rule exists to allow.
- *
- * So the parse happens in two passes: this one decides whether there is a hook
- * at all, and the full {@link postHookSchema} validates the rest only once there
- * is. Both read their keys from the same shape, so there is still one
- * declaration of what a `postHook` may contain.
- */
-export function postHookGateSchema(path) {
-    const { command, ...rest } = postHookSchema(path).def.shape;
-    return wireObject(path, {
-        command,
-        ...Object.fromEntries(Object.keys(rest).map((key) => [key, z.optional(z.unknown())]))
-    });
-}

package/dist/_contracts/schemas/response-assets.d.ts

@@ -1,75 +0,0 @@
-/**
- * Response schemas for the `assets.*` family — the content-addressed byte store
- * every workspace resource is built on.
- *
- * `POST /assets/presign` has THREE distinct 200 bodies and they are genuinely
- * different objects, not one object with optional halves: a dedup hit carries
- * `contentType` and no upload grant, a single-PUT mint carries `uploadUrl` and
- * `requiredHeaders` and no `contentType`, and a multipart mint carries a
- * `multipart` block and no top-level upload fields. A union of three strict
- * objects says that; one object with everything optional would accept a
- * nonsensical mixture and assert almost nothing.
- */
-import * as z from "zod/mini";
-export declare const AssetPresignResponseSchema: z.ZodMiniUnion<readonly [z.ZodMiniObject<{
-    ok: z.ZodMiniLiteral<true>;
-    exists: z.ZodMiniLiteral<true>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-    sizeBytes: z.ZodMiniNumberFormat;
-    contentType: z.ZodMiniString<string>;
-    storagePath: z.ZodMiniString<string>;
-}, z.core.$strict>, z.ZodMiniObject<{
-    ok: z.ZodMiniLiteral<true>;
-    exists: z.ZodMiniLiteral<false>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-    sizeBytes: z.ZodMiniNumberFormat;
-    storagePath: z.ZodMiniString<string>;
-    uploadUrl: z.ZodMiniString<string>;
-    requiredHeaders: z.ZodMiniRecord<z.ZodMiniString<string>, z.ZodMiniString<string>>;
-    expiresInSeconds: z.ZodMiniNumberFormat;
-}, z.core.$strict>, z.ZodMiniObject<{
-    ok: z.ZodMiniLiteral<true>;
-    exists: z.ZodMiniLiteral<false>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-    sizeBytes: z.ZodMiniNumberFormat;
-    multipart: z.ZodMiniObject<{
-        uploadId: z.ZodMiniString<string>;
-        key: z.ZodMiniString<string>;
-        partSize: z.ZodMiniNumberFormat;
-        partCount: z.ZodMiniNumberFormat;
-        partUrls: z.ZodMiniArray<z.ZodMiniObject<{
-            partNumber: z.ZodMiniNumberFormat;
-            url: z.ZodMiniString<string>;
-        }, z.core.$strict>>;
-        expiresInSeconds: z.ZodMiniNumberFormat;
-    }, z.core.$strict>;
-}, z.core.$strict>]>;
-export declare const AssetFinalizeResponseSchema: z.ZodMiniObject<{
-    ok: z.ZodMiniLiteral<true>;
-    exists: z.ZodMiniLiteral<true>;
-    assetId: z.ZodMiniString<string>;
-    contentHash: z.ZodMiniString<string>;
-    sizeBytes: z.ZodMiniNumberFormat;
-    contentType: z.ZodMiniString<string>;
-}, z.core.$strict>;
-export declare const AssetMpuPresignPartsResponseSchema: z.ZodMiniObject<{
-    ok: z.ZodMiniLiteral<true>;
-    partUrls: z.ZodMiniArray<z.ZodMiniObject<{
-        partNumber: z.ZodMiniNumberFormat;
-        url: z.ZodMiniString<string>;
-    }, z.core.$strict>>;
-    expiresInSeconds: z.ZodMiniNumberFormat;
-}, z.core.$strict>;
-/**
- * `POST /assets/mpu/abort`.
- *
- * Worth knowing while reading a green C4: the handler swallows a failing S3
- * `AbortMultipartUpload` and still answers `{ ok: true }`, so this schema
- * passing does not mean the abort happened.
- */
-export declare const AssetMpuAbortResponseSchema: z.ZodMiniObject<{
-    ok: z.ZodMiniLiteral<true>;
-}, z.core.$strict>;

package/dist/_contracts/schemas/response-assets.js

@@ -1,81 +0,0 @@
-/**
- * Response schemas for the `assets.*` family — the content-addressed byte store
- * every workspace resource is built on.
- *
- * `POST /assets/presign` has THREE distinct 200 bodies and they are genuinely
- * different objects, not one object with optional halves: a dedup hit carries
- * `contentType` and no upload grant, a single-PUT mint carries `uploadUrl` and
- * `requiredHeaders` and no `contentType`, and a multipart mint carries a
- * `multipart` block and no top-level upload fields. A union of three strict
- * objects says that; one object with everything optional would accept a
- * nonsensical mixture and assert almost nothing.
- */
-import * as z from "zod/mini";
-import { describeResponse, responseObject, wireLiteral, wireNonEmptyString, wireNonNegativeInteger, wirePositiveInteger, wireString } from "./response-common.js";
-const PresignedPartSchema = responseObject({
-    partNumber: wirePositiveInteger,
-    url: wireNonEmptyString
-});
-/** Dedup hit: the bytes are already stored, so no upload grant is minted. */
-const AssetPresignExistingSchema = responseObject({
-    ok: wireLiteral(true),
-    exists: wireLiteral(true),
-    assetId: wireNonEmptyString,
-    contentHash: wireNonEmptyString,
-    sizeBytes: wireNonNegativeInteger,
-    contentType: wireString,
-    storagePath: wireNonEmptyString
-});
-/** Single-PUT mint. Note the ABSENCE of `contentType` — the server sends none here. */
-const AssetPresignSinglePutSchema = responseObject({
-    ok: wireLiteral(true),
-    exists: wireLiteral(false),
-    assetId: wireNonEmptyString,
-    contentHash: wireNonEmptyString,
-    sizeBytes: wireNonNegativeInteger,
-    storagePath: wireNonEmptyString,
-    uploadUrl: wireNonEmptyString,
-    requiredHeaders: z.record(wireString, wireString),
-    expiresInSeconds: wirePositiveInteger
-});
-/** Multipart mint. No top-level `storagePath` — the key rides inside `multipart`. */
-const AssetPresignMultipartSchema = responseObject({
-    ok: wireLiteral(true),
-    exists: wireLiteral(false),
-    assetId: wireNonEmptyString,
-    contentHash: wireNonEmptyString,
-    sizeBytes: wireNonNegativeInteger,
-    multipart: responseObject({
-        uploadId: wireNonEmptyString,
-        key: wireNonEmptyString,
-        partSize: wirePositiveInteger,
-        partCount: wirePositiveInteger,
-        partUrls: z.array(PresignedPartSchema),
-        expiresInSeconds: wirePositiveInteger
-    })
-});
-export const AssetPresignResponseSchema = describeResponse("AssetPresignResponse", "One of three: a dedup hit, a single-PUT upload grant, or a multipart upload plan.", z.union([AssetPresignExistingSchema, AssetPresignSinglePutSchema, AssetPresignMultipartSchema], {
-    error: "asset presign response must be a dedup hit (exists:true), a single-PUT grant " +
-        "(uploadUrl + requiredHeaders) or a multipart plan (multipart)"
-}));
-export const AssetFinalizeResponseSchema = describeResponse("AssetFinalizeResponse", "The committed asset identity. Identical on the single-PUT and multipart-complete paths.", responseObject({
-    ok: wireLiteral(true),
-    exists: wireLiteral(true),
-    assetId: wireNonEmptyString,
-    contentHash: wireNonEmptyString,
-    sizeBytes: wireNonNegativeInteger,
-    contentType: wireString
-}));
-export const AssetMpuPresignPartsResponseSchema = describeResponse("AssetMpuPresignPartsResponse", "Fresh presigned URLs for the requested multipart part numbers, in request order.", responseObject({
-    ok: wireLiteral(true),
-    partUrls: z.array(PresignedPartSchema),
-    expiresInSeconds: wirePositiveInteger
-}));
-/**
- * `POST /assets/mpu/abort`.
- *
- * Worth knowing while reading a green C4: the handler swallows a failing S3
- * `AbortMultipartUpload` and still answers `{ ok: true }`, so this schema
- * passing does not mean the abort happened.
- */
-export const AssetMpuAbortResponseSchema = describeResponse("AssetMpuAbortResponse", "Acknowledgement of a multipart abort. `ok: true` even when the underlying S3 abort failed.", responseObject({ ok: wireLiteral(true) }));