@anchrd/colab-sdk 0.0.0-stage → 0.1.1

package/dist/actions/actions.js

@@ -0,0 +1,177 @@
+import { z } from "zod";
+import { ColumnType, TaskColumn } from "../columns/columns.js";
+import { packages } from "../grammar/grammar.js";
+import { InstructionsLink } from "../instructions/instructions.js";
+import { Limit as PageSize } from "../list-input.js";
+import { MessageAuthor, MessageId } from "../messages/messages.js";
+import { BoardShownKind, NodeId, NodeKind, NodePath } from "../nodes/nodes.js";
+import { RunId, RunStatus } from "../runs/runs.js";
+import { UserId } from "../users/users.js";
+// Actions (#46, Seiten › Actions, E43, E67): one list over every board and chat with what waits on a
+// person. Every row is a node shown live, never a copy, and a node is one row, never two: a task of
+// mine whose chat has something unread is the same row. Every input field carries its description
+// (trap C004).
+export const actionFilters = ["all", "tasks", "chats"];
+export const ActionListInput = z.strictObject({
+    filter: z
+        .enum(actionFilters)
+        .optional()
+        .describe("Which rows: all, tasks (tasks, due processes, open runs and dashboard runs with entries assigned to you) or chats (rows with something unread, a task's chat included). Notices of other parts of Colab come only with all. Leaving it out gives all. count always counts all."),
+    userId: UserId.optional().describe("Whose Actions to read, `user_…`. Only an admin in admin mode reads another person's, to see where they are stuck; anyone else gets not_found. Leaving it out reads your own."),
+    cursor: z
+        .string()
+        .max(200)
+        .optional()
+        .describe("The nextCursor of the previous page, unchanged, for the rows after it. Leaving it out starts with the newest."),
+    limit: PageSize.optional().describe("How many rows one page holds, 1 to 100. Leaving it out gives 50."),
+});
+// The two sections of the page: waiting (open tasks, chats, a due process) and in progress (tasks
+// in progress, an open run).
+export const ActionSection = z.enum(["waiting", "progress"]);
+export const ActionTask = z.strictObject({
+    column: TaskColumn,
+    // The columns of type done, discarded and blocked of the task's own board (a run's own columns
+    // for a run's task), in their order on the board: the buttons that move it there. Empty when the
+    // board has none.
+    buttons: z.array(TaskColumn),
+    // A machine moved it into its column last: "handed over by the Operator".
+    handedOver: z.boolean(),
+});
+export const ActionChat = z.strictObject({
+    // The messages of others not read yet, by the person themselves (not their AI).
+    unreadCount: z.number().int(),
+    lastMessage: z.strictObject({
+        messageId: MessageId,
+        author: MessageAuthor,
+        // The first line of its text that is not empty, at most 200 characters.
+        line: z.string(),
+        createdAt: z.iso.datetime(),
+    }),
+});
+// A process board or a dashboard that is due for its Operator.
+export const ActionProcess = z.strictObject({
+    kind: z.enum(["board", "dashboard"]),
+    // The moment of the schedule the next run stands for.
+    dueAt: z.iso.datetime(),
+});
+export const ActionRun = z.strictObject({
+    runId: RunId,
+    status: RunStatus,
+    // A dashboard run (E78): the keys of the metrics and summaries assigned to the person that they
+    // have not written yet, in the configuration's order; null for a process run.
+    entries: z.array(z.string()).nullable(),
+});
+// One row: the node, where it waits, since when, and what makes it wait. Exactly one of task,
+// process and run, or none of them on a row that is a chat alone; chat beside any of them.
+export const ActionItem = z.strictObject({
+    node: z.strictObject({
+        nodeId: NodeId,
+        kind: NodeKind,
+        name: z.string(),
+        // Where it stands, from the first level the person can read; a task's last crumb is its board.
+        // A ticket of the validation board (#47) is called after its node, its crumb is the board.
+        path: NodePath,
+        // The validation status (#47): the type of the column the ticket of a document, table or file
+        // stands in, and a ticket's own; null for every other node.
+        status: ColumnType.nullable(),
+        // What a board is, like `NodeListItem.boardKind` (#227); null for every other kind.
+        boardKind: BoardShownKind.nullable(),
+    }),
+    section: ActionSection,
+    // Since when it waits: a task since it came into its column, a chat since its first unread
+    // message, a due process since its moment, an open run since it started.
+    since: z.iso.datetime(),
+    task: ActionTask.nullable(),
+    chat: ActionChat.nullable(),
+    process: ActionProcess.nullable(),
+    run: ActionRun.nullable(),
+});
+// What another package puts into a person's Actions (#334, E81, E82): "access invalid" for every
+// admin, "Operator paused" for its responsible person. Gathered when asked like every row, never
+// stored here: the package stops naming it once the access is replaced or the Operator resumed, and
+// the row is gone. ⚠️ Never a field called `key` (`redactSecrets` strikes it over `/mcp`).
+//
+// Every text is a closed word with its values, never a sentence (#379, E22): the UI words it in the
+// reader's language, and the AI reads the same structure.
+// What the notice is, for its icon: an access that stopped working, a paused Operator.
+export const ActionNoticeKind = z.enum(["credential", "paused"]);
+// Its title: which notice, and the name it is about.
+export const ActionNoticeTitle = z.discriminatedUnion("text", [
+    // "Access invalid: <the credential's name>".
+    z.strictObject({ text: z.literal("credentialInvalid"), name: z.string() }),
+    // "Operator paused: daily limit reached".
+    z.strictObject({ text: z.literal("pausedLimit") }),
+    // "Operator paused: <failures> failures".
+    z.strictObject({ text: z.literal("pausedFailures"), failures: z.number().int().positive() }),
+]);
+// One step of the grey path below the title: a word the UI translates, or a name shown as it is.
+export const ActionNoticeCrumb = z.union([
+    z.strictObject({ word: z.enum(["settings", "operator", "access"]) }),
+    z.strictObject({ name: z.string() }),
+]);
+// The line with the reason, said by the provider of the access or by the Operator.
+export const ActionNoticeReason = z.strictObject({
+    author: z.strictObject({ name: z.string(), kind: z.enum(["provider", "machine"]) }),
+    line: z.discriminatedUnion("text", [
+        // "The token has been refused since <since>. <paused> are paused."
+        z.strictObject({
+            text: z.literal("credentialRefused"),
+            since: z.iso.datetime(),
+            // The names of the Operators that run on it, every one of them paused now.
+            paused: z.array(z.string()),
+        }),
+        // "<runs> of <limit> runs today. Without resuming it goes on at <until>."
+        z.strictObject({
+            text: z.literal("limitReached"),
+            runs: z.number().int().nonnegative(),
+            limit: z.number().int().positive(),
+            until: z.iso.datetime(),
+        }),
+        // "Last at <at>: <detail>", the last failed run; null without one.
+        z.strictObject({
+            text: z.literal("lastFailure"),
+            at: z.iso.datetime().nullable(),
+            detail: z.string().nullable(),
+        }),
+    ]),
+});
+// A button of the row: its word and where it leads, a path within Colab. The first is the primary.
+export const ActionNoticeButton = z.strictObject({
+    label: z.enum(["replaceCredential", "resume", "changeLimit", "viewLog"]),
+    href: z.string(),
+});
+export const ActionNotice = z.strictObject({
+    // The package that names it.
+    package: z.enum(packages),
+    // Its identity within the package: one row per package and noticeKey, however often it is named.
+    noticeKey: z.string().min(1).max(200),
+    kind: ActionNoticeKind,
+    title: ActionNoticeTitle,
+    path: z.array(ActionNoticeCrumb).max(8),
+    reason: ActionNoticeReason,
+    // Where the row leads: the page of the access or the Operator, a path within Colab.
+    href: z.string(),
+    buttons: z.array(ActionNoticeButton).max(3),
+});
+export const ActionNoticeItem = z.strictObject({
+    notice: ActionNotice,
+    section: ActionSection,
+    // Since when the package says it waits.
+    since: z.iso.datetime(),
+});
+// A row of the list: a node, or a notice of another package.
+export const ActionRow = z.union([ActionItem, ActionNoticeItem]);
+export function isNodeRow(row) {
+    return "node" in row;
+}
+export const ActionList = z.strictObject({
+    // Newest first by since, then by node id (a notice by package and noticeKey). The filters tasks
+    // and chats leave the notices out.
+    items: z.array(ActionRow),
+    nextCursor: z.string().nullable(),
+    // Every row without the filter, for the number at the Actions icon.
+    count: z.number().int(),
+    // Only for a machine reading its own Actions over MCP, never over REST: the INSTRUCTIONS of its
+    // root folder as one link of #39's chain, empty when there is none (traps P033, P034).
+    instructions: InstructionsLink.optional(),
+});

package/dist/admin-mode.d.ts

@@ -0,0 +1,2 @@
+export declare const adminModeHeader = "colab-admin-mode";
+export declare const adminModeOn = "on";

package/dist/admin-mode.js

@@ -0,0 +1,5 @@
+// The header the UI sends with every request while a person has switched admin mode on (E71, #19).
+// `access` reads it at the door (#24); any other value than `on` means off. Over `/mcp` the same
+// question is the argument `asAdmin`, never this header.
+export const adminModeHeader = "colab-admin-mode";
+export const adminModeOn = "on";

package/dist/apps/apps.d.ts

@@ -0,0 +1,108 @@
+import { z } from "zod";
+export declare const AppId: z.ZodTemplateLiteral<`app_${string}`>;
+export declare const SessionId: z.ZodTemplateLiteral<`session_${string}`>;
+export declare const App: z.ZodObject<{
+    appId: z.ZodTemplateLiteral<`app_${string}`>;
+    clientId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    logo: z.ZodNullable<z.ZodString>;
+    lastActiveAt: z.ZodISODateTime;
+    registeredAt: z.ZodNullable<z.ZodISODateTime>;
+    resource: z.ZodString;
+    scopes: z.ZodArray<z.ZodString>;
+    connectedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type App = z.infer<typeof App>;
+export declare const AppList: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        appId: z.ZodTemplateLiteral<`app_${string}`>;
+        clientId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        logo: z.ZodNullable<z.ZodString>;
+        lastActiveAt: z.ZodISODateTime;
+        registeredAt: z.ZodNullable<z.ZodISODateTime>;
+        resource: z.ZodString;
+        scopes: z.ZodArray<z.ZodString>;
+        connectedAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodTemplateLiteral<`app_${string}`>>;
+}, z.core.$strict>;
+export type AppList = z.infer<typeof AppList>;
+export declare const AppListInput: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    userId: z.ZodTemplateLiteral<`user_${string}`>;
+    cursor: z.ZodOptional<z.ZodTemplateLiteral<`app_${string}`>>;
+}, z.core.$strict>;
+export type AppListInput = z.infer<typeof AppListInput>;
+export declare const OwnAppListQuery: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodTemplateLiteral<`app_${string}`>>;
+}, z.core.$strict>;
+export type OwnAppListQuery = z.infer<typeof OwnAppListQuery>;
+export declare const AppRevokeInput: z.ZodObject<{
+    appId: z.ZodTemplateLiteral<`app_${string}`>;
+}, z.core.$strict>;
+export type AppRevokeInput = z.infer<typeof AppRevokeInput>;
+export declare const AppRevoked: z.ZodObject<{
+    appId: z.ZodTemplateLiteral<`app_${string}`>;
+    name: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type AppRevoked = z.infer<typeof AppRevoked>;
+export declare const Session: z.ZodObject<{
+    sessionId: z.ZodTemplateLiteral<`session_${string}`>;
+    current: z.ZodBoolean;
+    userAgent: z.ZodNullable<z.ZodString>;
+    country: z.ZodNullable<z.ZodString>;
+    city: z.ZodNullable<z.ZodString>;
+    lastActiveAt: z.ZodISODateTime;
+    ip: z.ZodNullable<z.ZodString>;
+    signInMethod: z.ZodNullable<z.ZodEnum<{
+        password: "password";
+        google: "google";
+        microsoft: "microsoft";
+        passkey: "passkey";
+        key: "key";
+    }>>;
+    signedInAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type Session = z.infer<typeof Session>;
+export declare const SessionList: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        sessionId: z.ZodTemplateLiteral<`session_${string}`>;
+        current: z.ZodBoolean;
+        userAgent: z.ZodNullable<z.ZodString>;
+        country: z.ZodNullable<z.ZodString>;
+        city: z.ZodNullable<z.ZodString>;
+        lastActiveAt: z.ZodISODateTime;
+        ip: z.ZodNullable<z.ZodString>;
+        signInMethod: z.ZodNullable<z.ZodEnum<{
+            password: "password";
+            google: "google";
+            microsoft: "microsoft";
+            passkey: "passkey";
+            key: "key";
+        }>>;
+        signedInAt: z.ZodISODateTime;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodTemplateLiteral<`session_${string}`>>;
+}, z.core.$strict>;
+export type SessionList = z.infer<typeof SessionList>;
+export declare const SessionListInput: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    userId: z.ZodTemplateLiteral<`user_${string}`>;
+    cursor: z.ZodOptional<z.ZodTemplateLiteral<`session_${string}`>>;
+}, z.core.$strict>;
+export type SessionListInput = z.infer<typeof SessionListInput>;
+export declare const OwnSessionListQuery: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodTemplateLiteral<`session_${string}`>>;
+}, z.core.$strict>;
+export type OwnSessionListQuery = z.infer<typeof OwnSessionListQuery>;
+export declare const SessionRevokeInput: z.ZodObject<{
+    sessionId: z.ZodTemplateLiteral<`session_${string}`>;
+}, z.core.$strict>;
+export type SessionRevokeInput = z.infer<typeof SessionRevokeInput>;
+export declare const SessionsRevoked: z.ZodObject<{
+    sessionIds: z.ZodArray<z.ZodTemplateLiteral<`session_${string}`>>;
+}, z.core.$strict>;
+export type SessionsRevoked = z.infer<typeof SessionsRevoked>;

package/dist/apps/apps.js

@@ -0,0 +1,73 @@
+import { z } from "zod";
+import { idSchema } from "../ids/ids.js";
+import { Limit } from "../list-input.js";
+import { SignInMethod, UserId } from "../users/users.js";
+// Connected apps and sessions (Einstellungen › Verbundene Apps, Nutzer › Person › Apps, #27): the
+// inputs of the `access_app_*` and `access_session_*` tools, the doors under `/auth/apps` and
+// `/auth/sessions` a person uses for themselves, and the answers.
+//
+// An app is the pair of a person and a registered OAuth client: its id is the id of that pair's
+// consent, never the `client_id`, which many people share. Claude on the phone and on the computer is
+// one app (the connector reaches Colab from the provider's server); two computers with Claude Code are
+// two apps, because each registers its own client.
+export const AppId = idSchema("app");
+export const SessionId = idSchema("session");
+const Paging = {
+    limit: Limit.optional(),
+};
+export const App = z.strictObject({
+    appId: AppId,
+    // The registration's `client_id`, the same for everybody who connected this client.
+    clientId: z.string(),
+    // From the registration (`client_name`, `logo_uri`); a client may leave both out.
+    name: z.string().nullable(),
+    logo: z.string().nullable(),
+    // The last time a token was issued or renewed for this pair; before the first one, the consent.
+    // Colab removes an app 30 days after it (the UI shows the date in the tooltip).
+    lastActiveAt: z.iso.datetime(),
+    // The ⓘ: when the client registered, what it may reach, and the last time the person connected it.
+    registeredAt: z.iso.datetime().nullable(),
+    resource: z.string(),
+    scopes: z.array(z.string()),
+    connectedAt: z.iso.datetime(),
+});
+export const AppList = z.strictObject({ items: z.array(App), nextCursor: AppId.nullable() });
+// The admin's list for one person; `userId` is mandatory (there is no installation-wide list).
+export const AppListInput = z.strictObject({
+    userId: UserId,
+    cursor: AppId.optional(),
+    ...Paging,
+});
+// The person's own list at `GET /auth/apps`: the same paging, the person from the session.
+export const OwnAppListQuery = z.strictObject({ cursor: AppId.optional(), ...Paging });
+export const AppRevokeInput = z.strictObject({ appId: AppId });
+// What fell, by name (trap P334): after the revocation nothing else can be read about it.
+export const AppRevoked = z.strictObject({ appId: AppId, name: z.string().nullable() });
+export const Session = z.strictObject({
+    sessionId: SessionId,
+    // The session this request came with ("Diese Sitzung"); always false in an admin's list.
+    current: z.boolean(),
+    // The browser and device are read from it by the UI ("Chrome auf macOS", "MacBook Pro").
+    userAgent: z.string().nullable(),
+    // From the sign-in's request, approximate ("Palma, Spanien").
+    country: z.string().nullable(),
+    city: z.string().nullable(),
+    lastActiveAt: z.iso.datetime(),
+    // The ⓘ: IP, how the person signed in, and when.
+    ip: z.string().nullable(),
+    signInMethod: SignInMethod.nullable(),
+    signedInAt: z.iso.datetime(),
+});
+export const SessionList = z.strictObject({
+    items: z.array(Session),
+    nextCursor: SessionId.nullable(),
+});
+export const SessionListInput = z.strictObject({
+    userId: UserId,
+    cursor: SessionId.optional(),
+    ...Paging,
+});
+export const OwnSessionListQuery = z.strictObject({ cursor: SessionId.optional(), ...Paging });
+export const SessionRevokeInput = z.strictObject({ sessionId: SessionId });
+// The sessions that ended: one for `…/:sessionId/revoke`, every other one for `/auth/sessions/revoke`.
+export const SessionsRevoked = z.strictObject({ sessionIds: z.array(SessionId) });

package/dist/archive/archive.d.ts

@@ -0,0 +1,25 @@
+import { z } from "zod";
+export declare const NodeArchiveInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+}, z.core.$strict>;
+export type NodeArchiveInput = z.infer<typeof NodeArchiveInput>;
+export declare const NodeRestoreInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+}, z.core.$strict>;
+export type NodeRestoreInput = z.infer<typeof NodeRestoreInput>;
+export declare const NodeArchived: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    archivedAt: z.ZodNullable<z.ZodISODateTime>;
+    nodes: z.ZodNumber;
+}, z.core.$strict>;
+export type NodeArchived = z.infer<typeof NodeArchived>;
+export declare const NodePurgeInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+}, z.core.$strict>;
+export type NodePurgeInput = z.infer<typeof NodePurgeInput>;
+export declare const NodePurged: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    names: z.ZodArray<z.ZodString>;
+    deleted: z.ZodRecord<z.ZodString, z.ZodNumber>;
+}, z.core.$strict>;
+export type NodePurged = z.infer<typeof NodePurged>;

package/dist/archive/archive.js

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import { NodeId } from "../nodes/nodes.js";
+// The archive (#37, Seiten › Archiv, E44, E66): the inputs of `intelligence_node_archive`,
+// `_restore` and `_purge`, and their answers. Archiving takes the whole subtree along and can be
+// undone; only an archived node can be deleted for good, and never by a machine (D124).
+export const NodeArchiveInput = z.strictObject({
+    nodeId: NodeId.describe("The node to archive, with everything in it that is not archived yet. A root folder cannot be archived."),
+});
+export const NodeRestoreInput = z.strictObject({
+    nodeId: NodeId.describe("The archived node to bring back to its place, with what was archived together with it. Something archived on its own before stays archived; under an archived folder, restore the folder first."),
+});
+// Archive and restore answer the same: the state now, and how many nodes changed with this call.
+export const NodeArchived = z.strictObject({
+    nodeId: NodeId,
+    archivedAt: z.iso.datetime().nullable(),
+    nodes: z.number().int(),
+});
+export const NodePurgeInput = z.strictObject({
+    nodeId: NodeId.describe("The archived node to delete for good, with everything archived under it. It cannot be undone."),
+});
+export const NodePurged = z.strictObject({
+    nodeId: NodeId,
+    // The names of every node that fell, as the protocol records them.
+    names: z.array(z.string()),
+    // Per table, the rows that fell.
+    deleted: z.record(z.string(), z.number().int()),
+});

package/dist/auth/auth.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+export declare const SignUpInput: z.ZodObject<{
+    name: z.ZodString;
+    email: z.ZodEmail;
+    password: z.ZodString;
+    callbackURL: z.ZodOptional<z.ZodString>;
+    rememberMe: z.ZodOptional<z.ZodBoolean>;
+    locale: z.ZodOptional<z.ZodEnum<{
+        en: "en";
+        de: "de";
+    }>>;
+    timezone: z.ZodOptional<z.ZodString>;
+    theme: z.ZodOptional<z.ZodEnum<{
+        light: "light";
+        dark: "dark";
+        system: "system";
+    }>>;
+}, z.core.$strict>;
+export type SignUpInput = z.infer<typeof SignUpInput>;
+export declare const SetPasswordInput: z.ZodObject<{
+    newPassword: z.ZodString;
+}, z.core.$strict>;
+export type SetPasswordInput = z.infer<typeof SetPasswordInput>;
+export declare const PasskeyDeleteInput: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strict>;
+export type PasskeyDeleteInput = z.infer<typeof PasskeyDeleteInput>;

package/dist/auth/auth.js

@@ -0,0 +1,22 @@
+import { z } from "zod";
+import { Locale, Name, Theme, TimeZone } from "../profile/profile.js";
+// The sign-in doors under `/auth` that Colab checks itself. The rest of `/auth` is Better Auth's
+// own and validated there.
+// The body of `POST /auth/sign-up/email`. Strict, so a sign-up cannot set a picture or a field the
+// account must not choose for itself (its kind, a lock). The language, zone and theme may come
+// along: the UI sends what the browser says.
+export const SignUpInput = z.strictObject({
+    name: Name,
+    email: z.email(),
+    password: z.string().min(1),
+    callbackURL: z.string().optional(),
+    rememberMe: z.boolean().optional(),
+    locale: Locale.optional(),
+    timezone: TimeZone.optional(),
+    theme: Theme.optional(),
+});
+// The body of `POST /auth/set-password`, the first password of an account that signs in with
+// Google or Microsoft. Only presence is checked here; the length is Better Auth's rule.
+export const SetPasswordInput = z.strictObject({ newPassword: z.string().min(1) });
+// The body of `POST /auth/passkey/delete-passkey`, Colab's own door in place of Better Auth's.
+export const PasskeyDeleteInput = z.strictObject({ id: z.string().min(1) });

package/dist/authorization/authorization.d.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+export declare const AuthorizationRequest: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strict>;
+export type AuthorizationRequest = z.infer<typeof AuthorizationRequest>;
+export declare const Identity: z.ZodObject<{
+    userId: z.ZodString;
+    kind: z.ZodEnum<{
+        machine: "machine";
+        human: "human";
+    }>;
+    name: z.ZodString;
+    email: z.ZodString;
+    image: z.ZodNullable<z.ZodString>;
+    locale: z.ZodNullable<z.ZodString>;
+    timezone: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type Identity = z.infer<typeof Identity>;
+export declare const Rules: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+export type Rules = z.infer<typeof Rules>;
+export declare const AuthorizationResponse: z.ZodObject<{
+    identity: z.ZodObject<{
+        userId: z.ZodString;
+        kind: z.ZodEnum<{
+            machine: "machine";
+            human: "human";
+        }>;
+        name: z.ZodString;
+        email: z.ZodString;
+        image: z.ZodNullable<z.ZodString>;
+        locale: z.ZodNullable<z.ZodString>;
+        timezone: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    rules: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+export type AuthorizationResponse = z.infer<typeof AuthorizationResponse>;

package/dist/authorization/authorization.js

@@ -0,0 +1,23 @@
+import { z } from "zod";
+// `POST /auth/service/authorization` (A22, #26): the runtime door for an outside service. Its key in
+// the `authorization` header says WHICH service asks; the person's token in the body says FOR WHOM
+// (the RFC 7662 shape). The answer is who that is and what they may do at THIS service. Taken from
+// anchrd/gate `packages/sdk/src/contract/contract.ts` (9d8ece3) and reworked to Colab's names.
+export const AuthorizationRequest = z.strictObject({ token: z.string().min(1) });
+// Who the token belongs to. ⚠️ `z.object`, not strict, on purpose: Colab is the trusted sender and
+// may add a field without breaking an older SDK (Postel). The doors that take input stay strict.
+export const Identity = z.object({
+    userId: z.string().min(1),
+    kind: z.enum(["human", "machine"]),
+    name: z.string(),
+    email: z.string(),
+    // The address of the person's picture in this installation, relative (`/auth/profile-image/…`);
+    // null for a machine and for a person without one.
+    image: z.string().nullable(),
+    locale: z.string().nullable(),
+    timezone: z.string().nullable(),
+});
+// What the person may do at the asking service: interface → functions. `can(interface, function)`
+// is a membership question on it, decided locally by the SDK.
+export const Rules = z.record(z.string().min(1), z.array(z.string().min(1)));
+export const AuthorizationResponse = z.object({ identity: Identity, rules: Rules });