@anchrd/colab-sdk 0.0.0-stage → 0.1.1

package/dist/sdk.d.ts

@@ -0,0 +1,45 @@
+export { ActionChat, ActionItem, ActionList, ActionListInput, ActionNotice, ActionNoticeButton, ActionNoticeCrumb, ActionNoticeItem, ActionNoticeKind, ActionNoticeReason, ActionNoticeTitle, ActionProcess, ActionRow, ActionRun, ActionSection, ActionTask, actionFilters, isNodeRow, } from "./actions/actions.js";
+export { adminModeHeader, adminModeOn } from "./admin-mode.js";
+export { App, AppId, AppList, AppListInput, AppRevoked, AppRevokeInput, OwnAppListQuery, OwnSessionListQuery, Session, SessionId, SessionList, SessionListInput, SessionRevokeInput, SessionsRevoked, } from "./apps/apps.js";
+export { NodeArchived, NodeArchiveInput, NodePurged, NodePurgeInput, NodeRestoreInput, } from "./archive/archive.js";
+export { PasskeyDeleteInput, SetPasswordInput, SignUpInput, } from "./auth/auth.js";
+export { AuthorizationRequest, AuthorizationResponse, Identity, Rules, } from "./authorization/authorization.js";
+export { BoardColumn, BoardCreateInput, BoardDetail, BoardGetInput, BoardId, BoardKind, BoardLabel, BoardTaskCreateInput, BoardTaskItem, BoardTaskList, BoardTaskListInput, BoardUpdateInput, boardKinds, LabelId, ProcessCheck, TaskDetail, TaskGetInput, TaskId, TaskImage, TaskUpdateInput, } from "./boards/boards.js";
+export { ColumnId, ColumnType, columnTypes, TaskColumn } from "./columns/columns.js";
+export { Connection, ConnectionCreateInput, ConnectionCredential, ConnectionDetail, ConnectionGetInput, ConnectionId, ConnectionList, ConnectionListInput, ConnectionRevokeInput, ConnectionState, ConnectionTested, ConnectionTestInput, ConnectionTestResult, ConnectionUpdateInput, } from "./connections/connections.js";
+export { Call, CallId, CallList, CallListInput, CallSource, Connector, ConnectorField, ConnectorGetInput, ConnectorId, ConnectorList, ConnectorListInput, ConnectorTool, } from "./connectors/connectors.js";
+export { type BoxType, boxTypes, chartTypes, type DashboardBox, DashboardConfig, DashboardCreateInput, DashboardDetail, DashboardGetInput, DashboardId, DashboardKey, DashboardRun, DashboardUpdateInput, rhythms, Schedule, WhileOpen, weekdays, whileOpenModes, } from "./dashboards/dashboards.js";
+export { DirectoryPrincipal, DirectorySearchInput } from "./directory/directory.js";
+export { DocumentCreateInput, DocumentDetail, DocumentGetInput, DocumentUpdateInput, } from "./documents/documents.js";
+export { ErrorCode, ErrorIssue, ErrorResponse, errorCodes } from "./error/error.js";
+export { ActorKind, Event, EventId, EventKind, EventList, EventListInput, } from "./events/events.js";
+export { FileCreateInput, FileDetail, type FileFormat, FileGetInput, FileId, FileUpdateInput, FileUpload, fileFormatExtensions, fileFormatOf, maxFileBytes, UploadTicket, uploadTicketHeader, uploadTicketLifetimeMs, } from "./files/files.js";
+export { FunctionRemoved, ServiceInterfaceFunctionCreateInput, ServiceInterfaceFunctionRemoveInput, ServiceInterfaceFunctionUpdateInput, } from "./functions/functions.js";
+export { type Action, actions, hasRoute, isAction, isPackage, isWord, type Package, packages, parseConnectorFunction, parseToolName, type Resource, type Route, resources, type ToolName, toolEvent, toolPermission, toolRoute, toolSchemaName, verbs, } from "./grammar/grammar.js";
+export { GrantId, GrantRight, NodeGrant, NodeGrantList, NodeGrantListInput, NodeGrantRevoked, NodeGrantRevokeInput, NodeShared, NodeShareInput, } from "./grants/grants.js";
+export { createId, type Id, idSchema } from "./ids/ids.js";
+export { Instructions, InstructionsLink, instructionsNames, isInstructionsName, validationSection, } from "./instructions/instructions.js";
+export { FunctionNames, InterfaceRemoved, ServiceInterfaceCreateInput, ServiceInterfaceDeclared, ServiceInterfaceDeclareInput, ServiceInterfaceRemoveInput, ServiceInterfaceUndeclared, ServiceInterfaceUpdateInput, } from "./interfaces/interfaces.js";
+export { Delivery, Invitation, InvitationAcceptInput, InvitationCreateInput, InvitationId, InvitationLookup, InvitationLookupQuery, InvitationResendInput, InvitationRevokeInput, InvitationSent, InvitationSocialInput, InvitationStatus, RoleChip, } from "./invitations/invitations.js";
+export { defaultLinkDays, LinkId, LinkStatus, maxLinkDays, NodeLink, NodeLinkCreateInput, NodeLinkList, NodeLinkListInput, NodeLinkRevokeInput, NodeLinkUpdateInput, publicLinkPath, } from "./links/links.js";
+export { Flag, Limit } from "./list-input.js";
+export { MachineArchiveInput, MachineCreateInput, MachineId, MachineKey, MachinePurged, MachinePurgeInput, MachineRestoreInput, MachineRotateInput, MachineUpdateInput, } from "./machines/machines.js";
+export { ChatRead, ChatUpdateInput, Message, MessageAuthor, MessageCreateInput, MessageId, MessageList, MessageListInput, messageMaxLength, } from "./messages/messages.js";
+export { BoardShownKind, BoardSystem, FolderCreated, FolderCreateInput, IntelligenceUser, IntelligenceUserList, IntelligenceUserListInput, NodeDetail, NodeGetInput, NodeHit, NodeHitFoundIn, NodeHitGroup, NodeId, NodeKind, NodeList, NodeListInput, NodeListItem, NodeMoved, NodeMoveInput, NodePath, NodePerson, NodeQuery, NodeReader, NodeSearch, NodeSection, NodeSort, NodeUpdateInput, NodeValidation, nodeKinds, responsibleKinds, SearchIndexState, SecretFields, SecretId, } from "./nodes/nodes.js";
+export { Credential, CredentialCreateInput, CredentialGetInput, CredentialId, CredentialKind, CredentialList, CredentialListInput, CredentialRevokeInput, CredentialState, CredentialTested, CredentialTestInput, CredentialTestResult, CredentialUpdateInput, GatewayTarget, MachineDisableInput, MachineEnableInput, MachineGetInput, MachineListInput, modelsOf, Operator, OperatorLimits, OperatorList, OperatorMachineArchiveInput, OperatorMachineCreateInput, OperatorMachineUpdateInput, OperatorModel, type OperatorProviderEntry, OperatorRun, OperatorRunGetInput, OperatorRunId, OperatorRunList, OperatorRunListInput, OperatorRunReason, OperatorRunStatus, OperatorRunTokens, OperatorRunTouched, OperatorRunTrigger, OperatorRunUsage, OperatorState, operatorDefaults, operatorProviders, PauseReason, Subagents, Trigger, } from "./operators/operators.js";
+export { PageDetail, PageGetInput, PageHead, PageHeading, PageId, PageList, PageListInput, PageSummary, } from "./pages/pages.js";
+export { IdempotencyKey, Rev } from "./primitives/primitives.js";
+export { Locale, locales, Name, ProfileImageResponse, ProfileUpdateInput, profileImageMaxBytes, profileImageTypes, Theme, TimeZone, themes, } from "./profile/profile.js";
+export { GrantChange, PermissionsResponse, RightInCode, RightPath, RightTree, Role, RoleArchiveInput, RoleCreateInput, RoleDetail, RoleGetInput, RoleGrantCreateInput, RoleGrantRevokeInput, RoleId, RoleList, RoleListInput, RoleRestoreInput, RoleUpdateInput, } from "./roles/roles.js";
+export { BoardRunCreateInput, DashboardRunCreateInput, RunCompleteInput, RunDetail, RunGetInput, RunId, RunItem, RunList, RunListInput, RunStatus, RunUpdateInput, RunValue, RunValueValue, runStatuses, } from "./runs/runs.js";
+export { RuntimeConfig } from "./runtime-config.js";
+export { NodeSecret, NodeSecretCreateInput, NodeSecretDetail, NodeSecretGetInput, NodeSecretRemoveInput, NodeSecretUpdateInput, NodeUnlocked, NodeUnlockInput, unlockMinutes, } from "./secrets/secrets.js";
+export { type Authorized, type AuthorizeResult, createServiceClient, type InterfaceDeclaredResult, type InterfaceRemovedResult, type ServiceClient, type ServiceClientDeps, type ServiceClientFailure, } from "./service-client/service-client.js";
+export { FunctionId, InterfaceId, RightWord, Service, ServiceArchiveInput, ServiceCreateInput, ServiceFunction, ServiceId, ServiceInterface, ServiceKeyIssued, ServiceList, ServiceListInput, ServiceName, ServicePurged, ServicePurgeInput, ServiceRestoreInput, ServiceRotateInput, ServiceUpdateInput, } from "./services/services.js";
+export { SignInProviders, Sso, SsoId, SsoList, SsoListInput, SsoRemoveInput, SsoSource, SsoUpdateInput, ssoIds, } from "./sso/sso.js";
+export { TableColumn, TableColumnChange, TableColumnType, TableCreateInput, TableDetail, TableGetInput, TableId, TableSaved, TableUpdateInput, tableColumnTypes, tableFormats, } from "./tables/tables.js";
+export { type Actor, defineTool, type Permission, type Tool, type ToolAnnotations, type ToolContext, type ToolInput, type ToolSource, } from "./tool.js";
+export { IntelligenceUserGetInput, IntelligenceUserUpdateInput, NotifyMode, notifyModes, UserSettings, } from "./user-settings/user-settings.js";
+export { MachineFacts, MachineKeyFacts, MachineKind, MessageMachine, OperatorProvider, OwnRoleList, SignInMethod, User, UserDetail, UserDisableInput, UserEnableInput, UserGetInput, UserId, UserKind, UserList, UserListInput, UserListItem, UserStatus, UserTestInput, UserTestResult, UserUpdateInput, } from "./users/users.js";
+export { TicketColumn, TicketMove, TicketSubject, TicketSubjectRef, ValidationBoardId, validationBoardId, } from "./validation/validation.js";
+export { NodeVersion, NodeVersionCreateInput, NodeVersionDetail, NodeVersionGetInput, NodeVersionList, NodeVersionListInput, VersionId, versionKinds, } from "./versions/versions.js";

package/dist/sdk.js

@@ -0,0 +1,48 @@
+// The contract between UI, backends and outside services, published as `@anchrd/colab-sdk`. The
+// package exports only this file, so everything public is named here once.
+// biome-ignore lint/performance/noBarrelFile: this file IS the entry point of the package.
+export { ActionChat, ActionItem, ActionList, ActionListInput, ActionNotice, ActionNoticeButton, ActionNoticeCrumb, ActionNoticeItem, ActionNoticeKind, ActionNoticeReason, ActionNoticeTitle, ActionProcess, ActionRow, ActionRun, ActionSection, ActionTask, actionFilters, isNodeRow, } from "./actions/actions.js";
+export { adminModeHeader, adminModeOn } from "./admin-mode.js";
+export { App, AppId, AppList, AppListInput, AppRevoked, AppRevokeInput, OwnAppListQuery, OwnSessionListQuery, Session, SessionId, SessionList, SessionListInput, SessionRevokeInput, SessionsRevoked, } from "./apps/apps.js";
+export { NodeArchived, NodeArchiveInput, NodePurged, NodePurgeInput, NodeRestoreInput, } from "./archive/archive.js";
+export { PasskeyDeleteInput, SetPasswordInput, SignUpInput, } from "./auth/auth.js";
+export { AuthorizationRequest, AuthorizationResponse, Identity, Rules, } from "./authorization/authorization.js";
+export { BoardColumn, BoardCreateInput, BoardDetail, BoardGetInput, BoardId, BoardKind, BoardLabel, BoardTaskCreateInput, BoardTaskItem, BoardTaskList, BoardTaskListInput, BoardUpdateInput, boardKinds, LabelId, ProcessCheck, TaskDetail, TaskGetInput, TaskId, TaskImage, TaskUpdateInput, } from "./boards/boards.js";
+export { ColumnId, ColumnType, columnTypes, TaskColumn } from "./columns/columns.js";
+export { Connection, ConnectionCreateInput, ConnectionCredential, ConnectionDetail, ConnectionGetInput, ConnectionId, ConnectionList, ConnectionListInput, ConnectionRevokeInput, ConnectionState, ConnectionTested, ConnectionTestInput, ConnectionTestResult, ConnectionUpdateInput, } from "./connections/connections.js";
+export { Call, CallId, CallList, CallListInput, CallSource, Connector, ConnectorField, ConnectorGetInput, ConnectorId, ConnectorList, ConnectorListInput, ConnectorTool, } from "./connectors/connectors.js";
+export { boxTypes, chartTypes, DashboardConfig, DashboardCreateInput, DashboardDetail, DashboardGetInput, DashboardId, DashboardKey, DashboardRun, DashboardUpdateInput, rhythms, Schedule, WhileOpen, weekdays, whileOpenModes, } from "./dashboards/dashboards.js";
+export { DirectoryPrincipal, DirectorySearchInput } from "./directory/directory.js";
+export { DocumentCreateInput, DocumentDetail, DocumentGetInput, DocumentUpdateInput, } from "./documents/documents.js";
+export { ErrorCode, ErrorIssue, ErrorResponse, errorCodes } from "./error/error.js";
+export { ActorKind, Event, EventId, EventKind, EventList, EventListInput, } from "./events/events.js";
+export { FileCreateInput, FileDetail, FileGetInput, FileId, FileUpdateInput, FileUpload, fileFormatExtensions, fileFormatOf, maxFileBytes, UploadTicket, uploadTicketHeader, uploadTicketLifetimeMs, } from "./files/files.js";
+export { FunctionRemoved, ServiceInterfaceFunctionCreateInput, ServiceInterfaceFunctionRemoveInput, ServiceInterfaceFunctionUpdateInput, } from "./functions/functions.js";
+export { actions, hasRoute, isAction, isPackage, isWord, packages, parseConnectorFunction, parseToolName, resources, toolEvent, toolPermission, toolRoute, toolSchemaName, verbs, } from "./grammar/grammar.js";
+export { GrantId, GrantRight, NodeGrant, NodeGrantList, NodeGrantListInput, NodeGrantRevoked, NodeGrantRevokeInput, NodeShared, NodeShareInput, } from "./grants/grants.js";
+export { createId, idSchema } from "./ids/ids.js";
+export { Instructions, InstructionsLink, instructionsNames, isInstructionsName, validationSection, } from "./instructions/instructions.js";
+export { FunctionNames, InterfaceRemoved, ServiceInterfaceCreateInput, ServiceInterfaceDeclared, ServiceInterfaceDeclareInput, ServiceInterfaceRemoveInput, ServiceInterfaceUndeclared, ServiceInterfaceUpdateInput, } from "./interfaces/interfaces.js";
+export { Delivery, Invitation, InvitationAcceptInput, InvitationCreateInput, InvitationId, InvitationLookup, InvitationLookupQuery, InvitationResendInput, InvitationRevokeInput, InvitationSent, InvitationSocialInput, InvitationStatus, RoleChip, } from "./invitations/invitations.js";
+export { defaultLinkDays, LinkId, LinkStatus, maxLinkDays, NodeLink, NodeLinkCreateInput, NodeLinkList, NodeLinkListInput, NodeLinkRevokeInput, NodeLinkUpdateInput, publicLinkPath, } from "./links/links.js";
+export { Flag, Limit } from "./list-input.js";
+export { MachineArchiveInput, MachineCreateInput, MachineId, MachineKey, MachinePurged, MachinePurgeInput, MachineRestoreInput, MachineRotateInput, MachineUpdateInput, } from "./machines/machines.js";
+export { ChatRead, ChatUpdateInput, Message, MessageAuthor, MessageCreateInput, MessageId, MessageList, MessageListInput, messageMaxLength, } from "./messages/messages.js";
+export { BoardShownKind, BoardSystem, FolderCreated, FolderCreateInput, IntelligenceUser, IntelligenceUserList, IntelligenceUserListInput, NodeDetail, NodeGetInput, NodeHit, NodeHitFoundIn, NodeHitGroup, NodeId, NodeKind, NodeList, NodeListInput, NodeListItem, NodeMoved, NodeMoveInput, NodePath, NodePerson, NodeQuery, NodeReader, NodeSearch, NodeSection, NodeSort, NodeUpdateInput, NodeValidation, nodeKinds, responsibleKinds, SearchIndexState, SecretFields, SecretId, } from "./nodes/nodes.js";
+export { Credential, CredentialCreateInput, CredentialGetInput, CredentialId, CredentialKind, CredentialList, CredentialListInput, CredentialRevokeInput, CredentialState, CredentialTested, CredentialTestInput, CredentialTestResult, CredentialUpdateInput, GatewayTarget, MachineDisableInput, MachineEnableInput, MachineGetInput, MachineListInput, modelsOf, Operator, OperatorLimits, OperatorList, OperatorMachineArchiveInput, OperatorMachineCreateInput, OperatorMachineUpdateInput, OperatorModel, OperatorRun, OperatorRunGetInput, OperatorRunId, OperatorRunList, OperatorRunListInput, OperatorRunReason, OperatorRunStatus, OperatorRunTokens, OperatorRunTouched, OperatorRunTrigger, OperatorRunUsage, OperatorState, operatorDefaults, operatorProviders, PauseReason, Subagents, Trigger, } from "./operators/operators.js";
+export { PageDetail, PageGetInput, PageHead, PageHeading, PageId, PageList, PageListInput, PageSummary, } from "./pages/pages.js";
+export { IdempotencyKey, Rev } from "./primitives/primitives.js";
+export { Locale, locales, Name, ProfileImageResponse, ProfileUpdateInput, profileImageMaxBytes, profileImageTypes, Theme, TimeZone, themes, } from "./profile/profile.js";
+export { GrantChange, PermissionsResponse, RightInCode, RightPath, RightTree, Role, RoleArchiveInput, RoleCreateInput, RoleDetail, RoleGetInput, RoleGrantCreateInput, RoleGrantRevokeInput, RoleId, RoleList, RoleListInput, RoleRestoreInput, RoleUpdateInput, } from "./roles/roles.js";
+export { BoardRunCreateInput, DashboardRunCreateInput, RunCompleteInput, RunDetail, RunGetInput, RunId, RunItem, RunList, RunListInput, RunStatus, RunUpdateInput, RunValue, RunValueValue, runStatuses, } from "./runs/runs.js";
+export { RuntimeConfig } from "./runtime-config.js";
+export { NodeSecret, NodeSecretCreateInput, NodeSecretDetail, NodeSecretGetInput, NodeSecretRemoveInput, NodeSecretUpdateInput, NodeUnlocked, NodeUnlockInput, unlockMinutes, } from "./secrets/secrets.js";
+export { createServiceClient, } from "./service-client/service-client.js";
+export { FunctionId, InterfaceId, RightWord, Service, ServiceArchiveInput, ServiceCreateInput, ServiceFunction, ServiceId, ServiceInterface, ServiceKeyIssued, ServiceList, ServiceListInput, ServiceName, ServicePurged, ServicePurgeInput, ServiceRestoreInput, ServiceRotateInput, ServiceUpdateInput, } from "./services/services.js";
+export { SignInProviders, Sso, SsoId, SsoList, SsoListInput, SsoRemoveInput, SsoSource, SsoUpdateInput, ssoIds, } from "./sso/sso.js";
+export { TableColumn, TableColumnChange, TableColumnType, TableCreateInput, TableDetail, TableGetInput, TableId, TableSaved, TableUpdateInput, tableColumnTypes, tableFormats, } from "./tables/tables.js";
+export { defineTool, } from "./tool.js";
+export { IntelligenceUserGetInput, IntelligenceUserUpdateInput, NotifyMode, notifyModes, UserSettings, } from "./user-settings/user-settings.js";
+export { MachineFacts, MachineKeyFacts, MachineKind, MessageMachine, OperatorProvider, OwnRoleList, SignInMethod, User, UserDetail, UserDisableInput, UserEnableInput, UserGetInput, UserId, UserKind, UserList, UserListInput, UserListItem, UserStatus, UserTestInput, UserTestResult, UserUpdateInput, } from "./users/users.js";
+export { TicketColumn, TicketMove, TicketSubject, TicketSubjectRef, ValidationBoardId, validationBoardId, } from "./validation/validation.js";
+export { NodeVersion, NodeVersionCreateInput, NodeVersionDetail, NodeVersionGetInput, NodeVersionList, NodeVersionListInput, VersionId, versionKinds, } from "./versions/versions.js";

package/dist/secrets/secrets.d.ts

@@ -0,0 +1,65 @@
+import { z } from "zod";
+export declare const unlockMinutes = 15;
+export declare const NodeSecretCreateInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    password: z.ZodString;
+    idempotencyKey: z.ZodString;
+}, z.core.$strict>;
+export type NodeSecretCreateInput = z.infer<typeof NodeSecretCreateInput>;
+export declare const NodeSecretUpdateInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    secretId: z.ZodTemplateLiteral<`secret_${string}`>;
+    password: z.ZodString;
+}, z.core.$strict>;
+export type NodeSecretUpdateInput = z.infer<typeof NodeSecretUpdateInput>;
+export declare const NodeSecretGetInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    secretId: z.ZodTemplateLiteral<`secret_${string}`>;
+}, z.core.$strict>;
+export type NodeSecretGetInput = z.infer<typeof NodeSecretGetInput>;
+export declare const NodeSecretRemoveInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    secretId: z.ZodTemplateLiteral<`secret_${string}`>;
+}, z.core.$strict>;
+export type NodeSecretRemoveInput = z.infer<typeof NodeSecretRemoveInput>;
+export declare const NodeUnlockInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    password: z.ZodString;
+}, z.core.$strict>;
+export type NodeUnlockInput = z.infer<typeof NodeUnlockInput>;
+export declare const NodeSecret: z.ZodObject<{
+    secretId: z.ZodTemplateLiteral<`secret_${string}`>;
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    createdBy: z.ZodObject<{
+        userId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        kind: z.ZodNullable<z.ZodEnum<{
+            machine: "machine";
+            human: "human";
+        }>>;
+    }, z.core.$strict>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type NodeSecret = z.infer<typeof NodeSecret>;
+export declare const NodeSecretDetail: z.ZodObject<{
+    secretId: z.ZodTemplateLiteral<`secret_${string}`>;
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    createdBy: z.ZodObject<{
+        userId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        kind: z.ZodNullable<z.ZodEnum<{
+            machine: "machine";
+            human: "human";
+        }>>;
+    }, z.core.$strict>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+    password: z.ZodString;
+}, z.core.$strict>;
+export type NodeSecretDetail = z.infer<typeof NodeSecretDetail>;
+export declare const NodeUnlocked: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    unlockedUntil: z.ZodISODateTime;
+}, z.core.$strict>;
+export type NodeUnlocked = z.infer<typeof NodeUnlocked>;

package/dist/secrets/secrets.js

@@ -0,0 +1,57 @@
+import { z } from "zod";
+import { NodeId, NodePerson, SecretId } from "../nodes/nodes.js";
+import { IdempotencyKey } from "../primitives/primitives.js";
+// Secret documents and tables (#357, Nodes › Geheime Dokumente und Tabellen, E94): the inputs of
+// `intelligence_node_secret_create`, `_update`, `_get`, `_remove` and `intelligence_node_unlock`, and
+// their answers. The content of a secret node and every version of it are encrypted with the
+// installation's key; a person unlocks it with its password in the browser, for this session and
+// `unlockMinutes`. No AI and no machine reads it, an admin in admin mode does.
+// How long an unlock holds on one browser session (E94).
+export const unlockMinutes = 15;
+const Password = z
+    .string()
+    .min(4)
+    .max(200)
+    .describe("The password people unlock the node with, 4 to 200 characters. It is stored encrypted; an admin can show it in the node's settings.");
+const SecretNodeId = NodeId.describe("The document or table that is secret.");
+export const NodeSecretCreateInput = z.strictObject({
+    nodeId: NodeId.describe("The document or table to make secret; you need the right to share it. Other kinds cannot be secret."),
+    password: Password,
+    idempotencyKey: IdempotencyKey,
+});
+export const NodeSecretUpdateInput = z.strictObject({
+    nodeId: SecretNodeId,
+    secretId: SecretId,
+    password: Password.describe("The new password. Whoever unlocked the node with the old one has to unlock it again."),
+});
+export const NodeSecretGetInput = z.strictObject({
+    nodeId: SecretNodeId,
+    secretId: SecretId,
+});
+export const NodeSecretRemoveInput = z.strictObject({
+    nodeId: SecretNodeId,
+    secretId: SecretId.describe("The password to take away: the node is public again for everyone who reads it, its content and every version decrypted."),
+});
+export const NodeUnlockInput = z.strictObject({
+    nodeId: SecretNodeId,
+    password: z
+        .string()
+        .min(1)
+        .max(200)
+        .describe("The node's password, as its creator or an admin gave it to you."),
+});
+// A node's password as its settings show it; never the password itself.
+export const NodeSecret = z.strictObject({
+    secretId: SecretId,
+    nodeId: NodeId,
+    createdBy: NodePerson,
+    createdAt: z.iso.datetime(),
+    updatedAt: z.iso.datetime(),
+});
+// Only for an admin in admin mode, in the browser: the password itself.
+export const NodeSecretDetail = NodeSecret.extend({ password: z.string() });
+// The answer of an unlock: until when this browser session reads the node.
+export const NodeUnlocked = z.strictObject({
+    nodeId: NodeId,
+    unlockedUntil: z.iso.datetime(),
+});

package/dist/service-client/service-client.d.ts

@@ -0,0 +1,35 @@
+import { type Identity, type Rules } from "../authorization/authorization.js";
+import { ErrorResponse } from "../error/error.js";
+import { ServiceInterfaceDeclared, ServiceInterfaceUndeclared } from "../interfaces/interfaces.js";
+export type ServiceClientDeps = {
+    url: string;
+    serviceKey: string;
+    fetch?: typeof fetch;
+    timeoutMs?: number;
+};
+export type ServiceClientFailure = {
+    ok: false;
+    status: number;
+    error: ErrorResponse["error"];
+};
+export type Authorized = {
+    ok: true;
+    identity: Identity;
+    rules: Rules;
+    can(iface: string, fn: string): boolean;
+};
+export type AuthorizeResult = Authorized | ServiceClientFailure;
+export type InterfaceDeclaredResult = ({
+    ok: true;
+} & ServiceInterfaceDeclared) | ServiceClientFailure;
+export type InterfaceRemovedResult = ({
+    ok: true;
+} & ServiceInterfaceUndeclared) | ServiceClientFailure;
+export type ServiceClient = {
+    authorize(bearer: string): Promise<AuthorizeResult>;
+    interfaces: {
+        set(name: string, functions: string[]): Promise<InterfaceDeclaredResult>;
+        remove(name: string): Promise<InterfaceRemovedResult>;
+    };
+};
+export declare function createServiceClient(deps: ServiceClientDeps): ServiceClient;

package/dist/service-client/service-client.js

@@ -0,0 +1,90 @@
+import { AuthorizationResponse, } from "../authorization/authorization.js";
+import { ErrorResponse } from "../error/error.js";
+import { ServiceInterfaceDeclared, ServiceInterfaceUndeclared } from "../interfaces/interfaces.js";
+// The error shape of the answer, or one of our own when the body is not one: a contradictory body
+// must not pass as a refusal (validated, not cast).
+function errorOf(status, body) {
+    const parsed = ErrorResponse.safeParse(body);
+    if (parsed.success)
+        return parsed.data.error;
+    return {
+        code: status === 401 ? "unauthenticated" : "unavailable",
+        message: "Unexpected answer.",
+    };
+}
+const contractBroken = (what) => ({
+    ok: false,
+    status: 502,
+    error: { code: "unavailable", message: `The ${what} does not match the contract.` },
+});
+export function createServiceClient(deps) {
+    const doFetch = deps.fetch ?? fetch;
+    const base = deps.url.replace(/\/+$/, "");
+    async function call(path, method, payload) {
+        let response;
+        try {
+            response = await doFetch(`${base}/auth/service${path}`, {
+                method,
+                signal: AbortSignal.timeout(deps.timeoutMs ?? 10_000),
+                headers: {
+                    authorization: `Bearer ${deps.serviceKey}`,
+                    ...(payload !== undefined && { "content-type": "application/json" }),
+                },
+                ...(payload !== undefined && { body: JSON.stringify(payload) }),
+            });
+        }
+        catch (cause) {
+            // A refused connection or an expired timeout (#194). The thrown message is not passed on:
+            // a runtime may name the request in it, and a result never carries more than we chose.
+            const timedOut = cause instanceof Error && cause.name === "TimeoutError";
+            return {
+                ok: false,
+                status: 503,
+                error: {
+                    code: "unavailable",
+                    message: timedOut
+                        ? "The installation did not answer in time."
+                        : "The installation is not reachable.",
+                },
+            };
+        }
+        const body = await response.json().catch(() => null);
+        if (!response.ok)
+            return { ok: false, status: response.status, error: errorOf(response.status, body) };
+        return { ok: true, body };
+    }
+    const interfacePath = (name) => `/interfaces/${encodeURIComponent(name)}`;
+    return {
+        async authorize(bearer) {
+            const answer = await call("/authorization", "POST", { token: bearer });
+            if (!answer.ok)
+                return answer;
+            const parsed = AuthorizationResponse.safeParse(answer.body);
+            if (!parsed.success)
+                return contractBroken("authorization answer");
+            const { identity, rules } = parsed.data;
+            return {
+                ok: true,
+                identity,
+                rules,
+                can: (iface, fn) => rules[iface]?.includes(fn) ?? false,
+            };
+        },
+        interfaces: {
+            async set(name, functions) {
+                const answer = await call(interfacePath(name), "PUT", { functions });
+                if (!answer.ok)
+                    return answer;
+                const parsed = ServiceInterfaceDeclared.safeParse(answer.body);
+                return parsed.success ? { ok: true, ...parsed.data } : contractBroken("interface answer");
+            },
+            async remove(name) {
+                const answer = await call(`${interfacePath(name)}/remove`, "POST");
+                if (!answer.ok)
+                    return answer;
+                const parsed = ServiceInterfaceUndeclared.safeParse(answer.body);
+                return parsed.success ? { ok: true, ...parsed.data } : contractBroken("interface answer");
+            },
+        },
+    };
+}

package/dist/services/services.d.ts

@@ -0,0 +1,122 @@
+import { z } from "zod";
+export declare const ServiceId: z.ZodTemplateLiteral<`service_${string}`>;
+export declare const InterfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+export declare const FunctionId: z.ZodTemplateLiteral<`function_${string}`>;
+export declare const RightWord: z.ZodString;
+export declare const ServiceName: z.ZodString;
+export declare const McpUrl: z.ZodURL;
+export declare const ServiceFunction: z.ZodObject<{
+    functionId: z.ZodTemplateLiteral<`function_${string}`>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type ServiceFunction = z.infer<typeof ServiceFunction>;
+export declare const ServiceInterface: z.ZodObject<{
+    interfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+    name: z.ZodString;
+    functions: z.ZodArray<z.ZodObject<{
+        functionId: z.ZodTemplateLiteral<`function_${string}`>;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ServiceInterface = z.infer<typeof ServiceInterface>;
+export declare const Service: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+    name: z.ZodString;
+    oauthResource: z.ZodNullable<z.ZodString>;
+    mcpUrl: z.ZodNullable<z.ZodString>;
+    archivedAt: z.ZodNullable<z.ZodISODateTime>;
+    createdAt: z.ZodISODateTime;
+    updatedAt: z.ZodISODateTime;
+    interfaces: z.ZodArray<z.ZodObject<{
+        interfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+        name: z.ZodString;
+        functions: z.ZodArray<z.ZodObject<{
+            functionId: z.ZodTemplateLiteral<`function_${string}`>;
+            name: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Service = z.infer<typeof Service>;
+export declare const ServiceListInput: z.ZodObject<{
+    archived: z.ZodOptional<z.ZodPreprocess<z.ZodBoolean, unknown>>;
+    cursor: z.ZodOptional<z.ZodTemplateLiteral<`service_${string}`>>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strict>;
+export type ServiceListInput = z.infer<typeof ServiceListInput>;
+export declare const ServiceList: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+        name: z.ZodString;
+        oauthResource: z.ZodNullable<z.ZodString>;
+        mcpUrl: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+        interfaces: z.ZodArray<z.ZodObject<{
+            interfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+            name: z.ZodString;
+            functions: z.ZodArray<z.ZodObject<{
+                functionId: z.ZodTemplateLiteral<`function_${string}`>;
+                name: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodTemplateLiteral<`service_${string}`>>;
+}, z.core.$strict>;
+export type ServiceList = z.infer<typeof ServiceList>;
+export declare const ServiceCreateInput: z.ZodObject<{
+    name: z.ZodString;
+    oauthResource: z.ZodOptional<z.ZodURL>;
+    mcpUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>;
+export type ServiceCreateInput = z.infer<typeof ServiceCreateInput>;
+export declare const ServiceKeyIssued: z.ZodObject<{
+    service: z.ZodObject<{
+        serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+        name: z.ZodString;
+        oauthResource: z.ZodNullable<z.ZodString>;
+        mcpUrl: z.ZodNullable<z.ZodString>;
+        archivedAt: z.ZodNullable<z.ZodISODateTime>;
+        createdAt: z.ZodISODateTime;
+        updatedAt: z.ZodISODateTime;
+        interfaces: z.ZodArray<z.ZodObject<{
+            interfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+            name: z.ZodString;
+            functions: z.ZodArray<z.ZodObject<{
+                functionId: z.ZodTemplateLiteral<`function_${string}`>;
+                name: z.ZodString;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    serviceKey: z.ZodString;
+}, z.core.$strict>;
+export type ServiceKeyIssued = z.infer<typeof ServiceKeyIssued>;
+export declare const ServiceUpdateInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+    name: z.ZodOptional<z.ZodString>;
+    oauthResource: z.ZodOptional<z.ZodURL>;
+    mcpUrl: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
+}, z.core.$strict>;
+export type ServiceUpdateInput = z.infer<typeof ServiceUpdateInput>;
+export declare const ServiceRotateInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+}, z.core.$strict>;
+export type ServiceRotateInput = z.infer<typeof ServiceRotateInput>;
+export declare const ServiceArchiveInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+}, z.core.$strict>;
+export type ServiceArchiveInput = z.infer<typeof ServiceArchiveInput>;
+export declare const ServiceRestoreInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+}, z.core.$strict>;
+export type ServiceRestoreInput = z.infer<typeof ServiceRestoreInput>;
+export declare const ServicePurgeInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+}, z.core.$strict>;
+export type ServicePurgeInput = z.infer<typeof ServicePurgeInput>;
+export declare const ServicePurged: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+    name: z.ZodString;
+    grants: z.ZodNumber;
+}, z.core.$strict>;
+export type ServicePurged = z.infer<typeof ServicePurged>;

package/dist/services/services.js

@@ -0,0 +1,89 @@
+import { z } from "zod";
+import { packages } from "../grammar/grammar.js";
+import { idSchema } from "../ids/ids.js";
+import { Flag, Limit } from "../list-input.js";
+// The outside services (Einstellungen › Services, #26): customer edges that sign in from outside
+// through the SDK, each with one key, its interfaces and their functions. Their rights read like the
+// fixed groups' (Rechte): `service / interface / function`, stored by name in the role's grants.
+export const ServiceId = idSchema("service");
+export const InterfaceId = idSchema("interface");
+export const FunctionId = idSchema("function");
+// A name that stands in a right, so one word like every word of a right (E64): `datawarehouse`,
+// `reports`, `read`. The right is `datawarehouse / reports / read`.
+export const RightWord = z
+    .string()
+    .max(64)
+    .regex(/^[a-z][a-z0-9]*$/, "One word: lowercase letters and digits, starting with a letter");
+// A service's name is the first word of its rights, beside the fixed groups; a package's word would
+// make its rights those of the package.
+export const ServiceName = RightWord.refine((name) => !packages.includes(name), "This name belongs to a part of Colab");
+// Where a service answers as an MCP server (E80), so an Operator reaches it directly with a token of
+// its own. Only `https`: the token travels in the header. Locally also `http` on this computer, for
+// the seed's fake service under `bun run dev`.
+const localHosts = new Set(["localhost", "127.0.0.1", "[::1]"]);
+export const McpUrl = z
+    .url()
+    .max(2048)
+    .refine((value) => {
+    // Zod runs this after a failed `url()` too, with a value `URL` cannot read.
+    const url = URL.parse(value);
+    return (url !== null &&
+        (url.protocol === "https:" || (url.protocol === "http:" && localHosts.has(url.hostname))));
+}, "An MCP address starts with https:// (on this computer also http://localhost)");
+export const ServiceFunction = z.strictObject({ functionId: FunctionId, name: z.string() });
+export const ServiceInterface = z.strictObject({
+    interfaceId: InterfaceId,
+    name: z.string(),
+    functions: z.array(ServiceFunction),
+});
+// A service with its interfaces and functions as a tree. ⚠️ Never its key or the key's hash, and no
+// "last seen" (Einstellungen › Services).
+export const Service = z.strictObject({
+    serviceId: ServiceId,
+    name: z.string(),
+    oauthResource: z.string().nullable(),
+    mcpUrl: z.string().nullable(),
+    archivedAt: z.iso.datetime().nullable(),
+    createdAt: z.iso.datetime(),
+    updatedAt: z.iso.datetime(),
+    interfaces: z.array(ServiceInterface),
+});
+export const ServiceListInput = z.strictObject({
+    // The archive instead of the services in use.
+    archived: Flag.optional(),
+    cursor: ServiceId.optional(),
+    limit: Limit.optional(),
+});
+export const ServiceList = z.strictObject({
+    items: z.array(Service),
+    nextCursor: ServiceId.nullable(),
+});
+export const ServiceCreateInput = z.strictObject({
+    name: ServiceName,
+    oauthResource: z.url().optional(),
+    mcpUrl: McpUrl.optional(),
+});
+// The answer of create and rotate: the key, shown this once. Only its hash is stored, so nobody can
+// show it again; a lost key is rotated.
+export const ServiceKeyIssued = z.strictObject({ service: Service, serviceKey: z.string() });
+// Renaming a service renames its rights in every role (the only way that keeps them). The OAuth
+// resource is bound once: set while it is empty, never changed after. The MCP address changes freely;
+// `null` takes it away.
+export const ServiceUpdateInput = z
+    .strictObject({
+    serviceId: ServiceId,
+    name: ServiceName.optional(),
+    oauthResource: z.url().optional(),
+    mcpUrl: McpUrl.nullable().optional(),
+})
+    .refine((input) => input.name !== undefined || input.oauthResource !== undefined || input.mcpUrl !== undefined, { message: "Name a field to change: name, oauthResource or mcpUrl." });
+export const ServiceRotateInput = z.strictObject({ serviceId: ServiceId });
+export const ServiceArchiveInput = z.strictObject({ serviceId: ServiceId });
+export const ServiceRestoreInput = z.strictObject({ serviceId: ServiceId });
+export const ServicePurgeInput = z.strictObject({ serviceId: ServiceId });
+// What fell with a purged service: its name (the row is gone) and how many rights the roles lost.
+export const ServicePurged = z.strictObject({
+    serviceId: ServiceId,
+    name: z.string(),
+    grants: z.number().int(),
+});

package/dist/sso/sso.d.ts

@@ -0,0 +1,70 @@
+import { z } from "zod";
+export declare const ssoIds: readonly ["google", "microsoft"];
+export declare const SsoId: z.ZodEnum<{
+    google: "google";
+    microsoft: "microsoft";
+}>;
+export type SsoId = z.infer<typeof SsoId>;
+export declare const SsoSource: z.ZodEnum<{
+    settings: "settings";
+    environment: "environment";
+}>;
+export type SsoSource = z.infer<typeof SsoSource>;
+export declare const SsoListInput: z.ZodObject<{}, z.core.$strict>;
+export type SsoListInput = z.infer<typeof SsoListInput>;
+export declare const SsoUpdateInput: z.ZodObject<{
+    ssoId: z.ZodEnum<{
+        google: "google";
+        microsoft: "microsoft";
+    }>;
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+}, z.core.$strict>;
+export type SsoUpdateInput = z.infer<typeof SsoUpdateInput>;
+export declare const SsoRemoveInput: z.ZodObject<{
+    ssoId: z.ZodEnum<{
+        google: "google";
+        microsoft: "microsoft";
+    }>;
+}, z.core.$strict>;
+export type SsoRemoveInput = z.infer<typeof SsoRemoveInput>;
+export declare const Sso: z.ZodObject<{
+    ssoId: z.ZodEnum<{
+        google: "google";
+        microsoft: "microsoft";
+    }>;
+    clientId: z.ZodNullable<z.ZodString>;
+    setAt: z.ZodNullable<z.ZodISODateTime>;
+    setBy: z.ZodNullable<z.ZodTemplateLiteral<`user_${string}`>>;
+    source: z.ZodNullable<z.ZodEnum<{
+        settings: "settings";
+        environment: "environment";
+    }>>;
+    redirectUrl: z.ZodURL;
+}, z.core.$strict>;
+export type Sso = z.infer<typeof Sso>;
+export declare const SsoList: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        ssoId: z.ZodEnum<{
+            google: "google";
+            microsoft: "microsoft";
+        }>;
+        clientId: z.ZodNullable<z.ZodString>;
+        setAt: z.ZodNullable<z.ZodISODateTime>;
+        setBy: z.ZodNullable<z.ZodTemplateLiteral<`user_${string}`>>;
+        source: z.ZodNullable<z.ZodEnum<{
+            settings: "settings";
+            environment: "environment";
+        }>>;
+        redirectUrl: z.ZodURL;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNull;
+}, z.core.$strict>;
+export type SsoList = z.infer<typeof SsoList>;
+export declare const SignInProviders: z.ZodObject<{
+    providers: z.ZodArray<z.ZodEnum<{
+        google: "google";
+        microsoft: "microsoft";
+    }>>;
+}, z.core.$strict>;
+export type SignInProviders = z.infer<typeof SignInProviders>;