@anchrd/colab-sdk 0.0.0-stage → 0.1.1

package/dist/grammar/grammar.js

@@ -0,0 +1,197 @@
+// The naming grammar `package · resource · action` (E54, E64, E66): the word lists in one place, and
+// everything a tool name decides. A new word is proposed to the orchestrator, never invented here.
+//
+// ⚠️ Every word is a single word: no hyphen, no underscore. That is what lets a tool name split at
+// `_` into exactly one reading.
+// The packages that carry tools. `sdk` and `shared` are packages too, but no tool starts with them.
+export const packages = [
+    "intelligence",
+    "access",
+    "connectors",
+    "documentation",
+    "mail",
+    "operator",
+];
+// Singular in tool name and right, plural in the URL. Written out on purpose: a plural rule in code
+// would one day produce a word nobody chose.
+export const resources = {
+    node: "nodes",
+    folder: "folders",
+    document: "documents",
+    table: "tables",
+    board: "boards",
+    task: "tasks",
+    dashboard: "dashboards",
+    file: "files",
+    run: "runs",
+    version: "versions",
+    chat: "chats",
+    message: "messages",
+    action: "actions",
+    grant: "grants",
+    link: "links",
+    user: "users",
+    role: "roles",
+    machine: "machines",
+    app: "apps",
+    session: "sessions",
+    service: "services",
+    interface: "interfaces",
+    function: "functions",
+    invitation: "invitations",
+    connector: "connectors",
+    connection: "connections",
+    call: "calls",
+    event: "events",
+    page: "pages",
+    // An Operator's credential at its provider (#336, "Zugang"): `operator_credential_*`. Not `access`,
+    // a package word (every word stands in one list only), and not `account`, the prefix of Better
+    // Auth's linked sign-in accounts in `access` (`account_…`, PR #351).
+    credential: "credentials",
+    // A sign-in provider set up under Einstellungen › SSO (#358, E90): `access_sso_*`, named by the
+    // ticket. An abbreviation without a plural, so the URL keeps it: `/api/access/sso/:ssoId`.
+    sso: "sso",
+    // The password of a secret document or table (#357, E94), a sub-resource of the node, decided by
+    // the orchestrator: `intelligence_node_secret_create` makes a node secret, `_update` changes the
+    // password, `_get` shows it to an admin in admin mode, `_remove` makes the node public again. One
+    // per node, with an id of its own like every sub-resource (`secret_…`).
+    secret: "secrets",
+};
+// The closed list of actions with a route of their own shape.
+export const actions = ["list", "get", "create", "update", "archive", "restore", "purge"];
+// Domain verbs: always `POST /<resources>/:<resource>Id/<verb>`. `revoke` ends at once and without
+// archive, `remove` takes out an entry without archive (E66).
+export const verbs = [
+    "invite",
+    "resend",
+    "disable",
+    "enable",
+    "rotate",
+    "share",
+    "move",
+    "start",
+    "complete",
+    "test",
+    "revoke",
+    "remove",
+    // Opening a secret document or table with its password for this browser session, 15 minutes
+    // (#357, E94), decided by the orchestrator: `intelligence_node_unlock`. Not `get` (it changes who
+    // may read) and not `create` of a resource (the release is no thing anybody lists or names).
+    "unlock",
+];
+export function isPackage(word) {
+    return packages.includes(word);
+}
+function isResource(word) {
+    // `hasOwn`, not `in`: `constructor` must not pass as a resource.
+    return Object.hasOwn(resources, word);
+}
+export function isAction(word) {
+    return (actions.includes(word) || verbs.includes(word));
+}
+// One word of a name: lowercase, starting with a letter, no hyphen, no underscore (E64). A connector's
+// id and its provider's resources are held to it although they stand in no list here.
+export function isWord(word) {
+    return /^[a-z][a-z0-9]*$/.test(word);
+}
+// A connector's function, the key of its `tools` (`order-list`, `order-line-list`): its provider's
+// resources, each a single word but in no list (they are the provider's, not Colab's), and the
+// action last, from the lists above (#5). The tool is `<id>_<resources>_<action>`
+// (`shopify_order_list`), the right `connectors / <id> / <function>`.
+export function parseConnectorFunction(key) {
+    const words = key.split("-");
+    const action = words.pop() ?? "";
+    if (words.length === 0)
+        throw new Error(`"${key}": needs a resource and an action, "order-list"`);
+    const bad = words.find((word) => !isWord(word));
+    if (bad !== undefined)
+        throw new Error(`"${key}": "${bad}" is not a single lowercase word (E64)`);
+    if (!isAction(action))
+        throw new Error(`"${key}": "${action}" is not an action`);
+    return { resources: words, action };
+}
+// Whether a tool has a REST route. A name that does not start with a package word is a connector's
+// tool (`shopify_order_list`): only an AI calls it, the UI never does, so it has no route under
+// `/api` (#5). The structure test holds that only `connectors` delivers such names, each starting
+// with the id of a connector in the installation's list.
+export function hasRoute(name) {
+    return isPackage(name.split("_")[0] ?? "");
+}
+// Throws with the reason when the name is not a sentence of the grammar.
+export function parseToolName(name) {
+    const parts = name.split("_");
+    const hyphenated = parts.find((part) => part.includes("-"));
+    if (hyphenated !== undefined) {
+        throw new Error(`${name}: "${hyphenated}" contains "-", every word is one word (E64)`);
+    }
+    const [first = "", ...rest] = parts;
+    const last = rest.pop() ?? "";
+    if (rest.length === 0) {
+        throw new Error(`${name}: needs package, at least one resource and an action`);
+    }
+    if (!isPackage(first)) {
+        throw new Error(`${name}: "${first}" is not a package`);
+    }
+    if (!isAction(last)) {
+        throw new Error(`${name}: "${last}" is not an action`);
+    }
+    const unknown = rest.find((word) => !isResource(word));
+    if (unknown !== undefined) {
+        throw new Error(`${name}: "${unknown}" is not a resource`);
+    }
+    return { package: first, resources: rest, action: last };
+}
+// The tools whose route the rule below cannot derive, each with its reason. Written here and nowhere
+// else, so the route test and the guard in front of `/api` read the same answer.
+const routeExceptions = {
+    // A revoke of a SET of grants, named by a right or the prefix of a level in the body
+    // (`intelligence / document`), and the answer is the set that fell (#24, trap P334). There is no
+    // one `grantId` to put into the path.
+    access_role_grant_revoke: { method: "POST", path: "/api/access/roles/:roleId/grants/revoke" },
+};
+// `access_user_invite` → `POST /api/access/users/:userId/invite`.
+export function toolRoute(name) {
+    const exception = routeExceptions[name];
+    if (exception)
+        return exception;
+    const { package: owner, resources: chain, action } = parseToolName(name);
+    const collection = action === "list" || action === "create";
+    const path = chain
+        .map((resource, index) => {
+        const plural = `/${resources[resource]}`;
+        const last = index === chain.length - 1;
+        return last && collection ? plural : `${plural}/:${resource}Id`;
+    })
+        .join("");
+    const base = `/api/${owner}${path}`;
+    switch (action) {
+        case "list":
+        case "get":
+            return { method: "GET", path: base };
+        case "create":
+            return { method: "POST", path: base };
+        case "update":
+            return { method: "PATCH", path: base };
+        case "purge":
+            return { method: "DELETE", path: base };
+        default:
+            // archive, restore and every domain verb.
+            return { method: "POST", path: `${base}/${action}` };
+    }
+}
+// `access_user_invite` → `access / user / invite`.
+export function toolPermission(name) {
+    const { package: owner, resources: chain, action } = parseToolName(name);
+    return [owner, ...chain, action].join(" / ");
+}
+// `access_user_invite` → `user.invite`.
+export function toolEvent(name) {
+    const { resources: chain, action } = parseToolName(name);
+    return [...chain, action].join(".");
+}
+// `access_user_invite` → `UserInviteInput`.
+export function toolSchemaName(name) {
+    const { resources: chain, action } = parseToolName(name);
+    const words = [...chain, action].map((word) => word.charAt(0).toUpperCase() + word.slice(1));
+    return `${words.join("")}Input`;
+}

package/dist/grants/grants.d.ts

@@ -0,0 +1,93 @@
+import { z } from "zod";
+export declare const GrantId: z.ZodTemplateLiteral<`grant_${string}`>;
+export type GrantId = z.infer<typeof GrantId>;
+export declare const GrantRight: z.ZodEnum<{
+    share: "share";
+    write: "write";
+    read: "read";
+}>;
+export type GrantRight = z.infer<typeof GrantRight>;
+export declare const NodeGrantListInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strict>;
+export type NodeGrantListInput = z.infer<typeof NodeGrantListInput>;
+export declare const NodeGrant: z.ZodObject<{
+    grantId: z.ZodNullable<z.ZodTemplateLiteral<`grant_${string}`>>;
+    userId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    kind: z.ZodNullable<z.ZodEnum<{
+        machine: "machine";
+        human: "human";
+    }>>;
+    email: z.ZodNullable<z.ZodString>;
+    right: z.ZodEnum<{
+        share: "share";
+        write: "write";
+        read: "read";
+    }>;
+    creator: z.ZodBoolean;
+    inheritedFrom: z.ZodNullable<z.ZodObject<{
+        nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type NodeGrant = z.infer<typeof NodeGrant>;
+export declare const NodeGrantList: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        grantId: z.ZodNullable<z.ZodTemplateLiteral<`grant_${string}`>>;
+        userId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        kind: z.ZodNullable<z.ZodEnum<{
+            machine: "machine";
+            human: "human";
+        }>>;
+        email: z.ZodNullable<z.ZodString>;
+        right: z.ZodEnum<{
+            share: "share";
+            write: "write";
+            read: "read";
+        }>;
+        creator: z.ZodBoolean;
+        inheritedFrom: z.ZodNullable<z.ZodObject<{
+            nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+            name: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type NodeGrantList = z.infer<typeof NodeGrantList>;
+export declare const NodeShareInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    userId: z.ZodTemplateLiteral<`user_${string}`>;
+    right: z.ZodEnum<{
+        share: "share";
+        write: "write";
+        read: "read";
+    }>;
+}, z.core.$strict>;
+export type NodeShareInput = z.infer<typeof NodeShareInput>;
+export declare const NodeShared: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    grantId: z.ZodTemplateLiteral<`grant_${string}`>;
+    userId: z.ZodString;
+    right: z.ZodEnum<{
+        share: "share";
+        write: "write";
+        read: "read";
+    }>;
+    parentId: z.ZodNullable<z.ZodTemplateLiteral<`node_${string}`>>;
+}, z.core.$strict>;
+export type NodeShared = z.infer<typeof NodeShared>;
+export declare const NodeGrantRevokeInput: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    grantId: z.ZodTemplateLiteral<`grant_${string}`>;
+}, z.core.$strict>;
+export type NodeGrantRevokeInput = z.infer<typeof NodeGrantRevokeInput>;
+export declare const NodeGrantRevoked: z.ZodObject<{
+    nodeId: z.ZodTemplateLiteral<`node_${string}`>;
+    grantId: z.ZodTemplateLiteral<`grant_${string}`>;
+    parentId: z.ZodNullable<z.ZodTemplateLiteral<`node_${string}`>>;
+}, z.core.$strict>;
+export type NodeGrantRevoked = z.infer<typeof NodeGrantRevoked>;

package/dist/grants/grants.js

@@ -0,0 +1,66 @@
+import { z } from "zod";
+import { idSchema } from "../ids/ids.js";
+import { Limit as PageSize } from "../list-input.js";
+import { NodeId } from "../nodes/nodes.js";
+// Sharing a node (#37, Funktionen › Freigeben und Versionen, D138): the inputs of
+// `intelligence_node_grant_list`, `intelligence_node_share` and `intelligence_node_grant_revoke`,
+// and their answers. Like Google Drive: three rights, a grant on a folder reaches everything in it,
+// and the creator's right is no grant and cannot be taken.
+export const GrantId = idSchema("grant").describe("The grant's id, `grant_…`, as intelligence_node_grant_list names it.");
+// Each includes the ones before it: write reads, share writes.
+export const GrantRight = z.enum(["read", "write", "share"]);
+export const NodeGrantListInput = z.strictObject({
+    nodeId: NodeId,
+    cursor: z
+        .string()
+        .max(1000)
+        .optional()
+        .describe("The nextCursor of the previous page, unchanged. Leaving it out starts at the top."),
+    limit: PageSize.optional().describe("How many people one page holds, 1 to 100. Leaving it out gives 100."),
+});
+// One person who reaches the node, with the strongest right they hold and where it comes from.
+export const NodeGrant = z.strictObject({
+    // The grant to revoke: on this node, or on the folder `inheritedFrom`. Null for the creator of the
+    // node or of a folder above it, whose right is no grant.
+    grantId: GrantId.nullable(),
+    userId: z.string(),
+    // As `access` names them today; null for an account that is gone.
+    name: z.string().nullable(),
+    kind: z.enum(["human", "machine"]).nullable(),
+    // The person's address, shown under the name (#150); null for a machine and for an account that
+    // is gone.
+    email: z.string().nullable(),
+    right: GrantRight,
+    // Made this node: holds every right, and nobody takes it.
+    creator: z.boolean(),
+    // The folder the right comes from; null when it stands on this node.
+    inheritedFrom: z.strictObject({ nodeId: NodeId, name: z.string() }).nullable(),
+});
+export const NodeGrantList = z.strictObject({
+    items: z.array(NodeGrant),
+    nextCursor: z.string().nullable(),
+});
+export const NodeShareInput = z.strictObject({
+    nodeId: NodeId,
+    userId: idSchema("user").describe("The person or machine to share with, `user_…`, as intelligence_user_list finds them. A locked account cannot be given a right."),
+    right: GrantRight.describe("read sees the node, write also changes it, share also shares it further. Sharing again with someone who holds a grant sets their right to this one. A node in its creator's own area moves to the top level of Shared."),
+});
+export const NodeShared = z.strictObject({
+    nodeId: NodeId,
+    grantId: GrantId,
+    userId: z.string(),
+    right: GrantRight,
+    // Where the node stands now: null is the top level of Shared.
+    parentId: NodeId.nullable(),
+});
+export const NodeGrantRevokeInput = z.strictObject({
+    nodeId: NodeId,
+    grantId: GrantId.describe("The grant to take back, as intelligence_node_grant_list names it for this node. One on the node itself falls; one on a folder above stays there, and the node moves out of that folder to the top level of Shared with only its own grants."),
+});
+export const NodeGrantRevoked = z.strictObject({
+    nodeId: NodeId,
+    grantId: GrantId,
+    // Where the node stands now: null is the top level of Shared; its creator's root folder when its
+    // last grant fell there.
+    parentId: NodeId.nullable(),
+});

package/dist/ids/ids.d.ts

@@ -0,0 +1,5 @@
+import { z } from "zod";
+import type { Resource } from "../grammar/grammar.js";
+export type Id<R extends Resource> = `${R}_${string}`;
+export declare function createId<R extends Resource>(resource: R): Id<R>;
+export declare function idSchema<R extends Resource>(resource: R): z.ZodTemplateLiteral<[z.ZodLiteral<R>, z.ZodLiteral<"_">] extends infer T ? T extends [z.ZodLiteral<R>, z.ZodLiteral<"_">] ? T extends z.core.$ZodTemplateLiteralPart[] ? `${z.core.$PartsToTemplateLiteral<T>}${string}` : never : never : never>;

package/dist/ids/ids.js

@@ -0,0 +1,12 @@
+import { ulid } from "ulid";
+import { z } from "zod";
+// A ULID in Crockford base32, as `ulid()` writes it: 26 characters, no I, L, O or U.
+const ULID = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+export function createId(resource) {
+    return `${resource}_${ulid()}`;
+}
+// `idSchema("user")` takes `user_01J…` and rejects `node_01J…`. A template literal rather than a
+// refinement, so the JSON Schema an MCP client reads carries the pattern too.
+export function idSchema(resource) {
+    return z.templateLiteral([z.literal(resource), z.literal("_"), z.string().regex(ULID)]);
+}

package/dist/instructions/instructions.d.ts

@@ -0,0 +1,19 @@
+import { z } from "zod";
+export declare const validationSection = "Validation";
+export declare const instructionsNames: readonly ["INSTRUCTIONS", ".INSTRUCTIONS"];
+export declare function isInstructionsName(name: string): boolean;
+export declare const InstructionsLink: z.ZodObject<{
+    path: z.ZodString;
+    status: z.ZodNullable<z.ZodString>;
+    markdown: z.ZodString;
+}, z.core.$strict>;
+export type InstructionsLink = z.infer<typeof InstructionsLink>;
+export declare const Instructions: z.ZodObject<{
+    chain: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        status: z.ZodNullable<z.ZodString>;
+        markdown: z.ZodString;
+    }, z.core.$strict>>;
+    hint: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type Instructions = z.infer<typeof Instructions>;

package/dist/instructions/instructions.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+// The INSTRUCTIONS a person or machine gets over MCP (#39, Nodes › Ordner › INSTRUCTIONS, E31, E67,
+// E93): every INSTRUCTIONS on the way from the top down to a folder, each with its status, and of
+// each only the part meant for the caller (#356). Only text, a path and a status reach a model
+// (trap P033): never an id, an owner or a right. HTTP carries none of it; a person reads the
+// documents themselves.
+// The one fixed heading (E93, #356): `## Validation` tells the holder of `validator` how this area is
+// checked, and nobody else gets it. English, never translated. The headings per node type and
+// `## Operator` of E30 are gone; besides it, only a level-one heading `# @name` opens a section, one
+// machine's own. Everything else counts for every AI.
+export const validationSection = "Validation";
+// The two names an INSTRUCTIONS document may carry in a folder: hidden by default, visible only in a
+// machine's root folder. A folder holds at most one of them.
+export const instructionsNames = ["INSTRUCTIONS", ".INSTRUCTIONS"];
+export function isInstructionsName(name) {
+    return instructionsNames.includes(name);
+}
+// One link of the chain, top down.
+export const InstructionsLink = z.strictObject({
+    // Where it stands, as the caller can read it, from the first readable folder below a root folder
+    // down to the document itself: `Vertrieb/Leads/.INSTRUCTIONS`.
+    path: z.string(),
+    // Its validation status, the type of the column its ticket stands in (#47); null without a
+    // ticket. Every link is handed over, whatever its status (E31).
+    status: z.string().nullable(),
+    // The document's Markdown as its current version holds it, cut to what the caller gets (#356):
+    // the text under no heading, `## Validation` for the holder of `validator`, a machine's own
+    // `# @name` sections.
+    markdown: z.string(),
+});
+export const Instructions = z.strictObject({
+    chain: z.array(InstructionsLink),
+    // Only when the whole chain holds more than 3,000 words (E67): one English sentence.
+    hint: z.string().optional(),
+});

package/dist/interfaces/interfaces.d.ts

@@ -0,0 +1,41 @@
+import { z } from "zod";
+export declare const FunctionNames: z.ZodArray<z.ZodString>;
+export declare const ServiceInterfaceCreateInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+    name: z.ZodString;
+    functions: z.ZodOptional<z.ZodArray<z.ZodString>>;
+}, z.core.$strict>;
+export type ServiceInterfaceCreateInput = z.infer<typeof ServiceInterfaceCreateInput>;
+export declare const ServiceInterfaceUpdateInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+    interfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type ServiceInterfaceUpdateInput = z.infer<typeof ServiceInterfaceUpdateInput>;
+export declare const ServiceInterfaceRemoveInput: z.ZodObject<{
+    serviceId: z.ZodTemplateLiteral<`service_${string}`>;
+    interfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+}, z.core.$strict>;
+export type ServiceInterfaceRemoveInput = z.infer<typeof ServiceInterfaceRemoveInput>;
+export declare const InterfaceRemoved: z.ZodObject<{
+    interfaceId: z.ZodTemplateLiteral<`interface_${string}`>;
+    name: z.ZodString;
+    functions: z.ZodArray<z.ZodString>;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type InterfaceRemoved = z.infer<typeof InterfaceRemoved>;
+export declare const ServiceInterfaceDeclareInput: z.ZodObject<{
+    functions: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ServiceInterfaceDeclareInput = z.infer<typeof ServiceInterfaceDeclareInput>;
+export declare const ServiceInterfaceDeclared: z.ZodObject<{
+    name: z.ZodString;
+    functions: z.ZodArray<z.ZodString>;
+    removed: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type ServiceInterfaceDeclared = z.infer<typeof ServiceInterfaceDeclared>;
+export declare const ServiceInterfaceUndeclared: z.ZodObject<{
+    removed: z.ZodBoolean;
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type ServiceInterfaceUndeclared = z.infer<typeof ServiceInterfaceUndeclared>;

package/dist/interfaces/interfaces.js

@@ -0,0 +1,52 @@
+import { z } from "zod";
+import { InterfaceId, RightWord, ServiceId } from "../services/services.js";
+// The interfaces of an outside service (#26): the admin's tools in `access`, and the service's own
+// door that declares them with its key.
+// A function list as the caller wants it to be. Each name once: a list that names one twice is a
+// mistake, not a wish.
+export const FunctionNames = z
+    .array(RightWord)
+    .max(200)
+    .refine((names) => new Set(names).size === names.length, "Each function once");
+export const ServiceInterfaceCreateInput = z.strictObject({
+    serviceId: ServiceId,
+    name: RightWord,
+    functions: FunctionNames.optional(),
+});
+// Renames the interface and its rights in every role, in one step. A name the service already
+// carries is `conflict`: joining two sets of rights under one name would widen them.
+export const ServiceInterfaceUpdateInput = z.strictObject({
+    serviceId: ServiceId,
+    interfaceId: InterfaceId,
+    name: RightWord,
+});
+export const ServiceInterfaceRemoveInput = z.strictObject({
+    serviceId: ServiceId,
+    interfaceId: InterfaceId,
+});
+// What fell with a removed interface: its functions and the rights the roles held on them (trap
+// P334: the answer names what fell, so the caller can read it).
+export const InterfaceRemoved = z.strictObject({
+    interfaceId: InterfaceId,
+    name: z.string(),
+    functions: z.array(z.string()),
+    permissions: z.array(z.string()),
+});
+// The body of `PUT /auth/service/interfaces/:interface`: the target state of the service's own
+// interface. A function missing from the list goes, with its rights.
+export const ServiceInterfaceDeclareInput = z.strictObject({ functions: FunctionNames });
+// ⚠️ The two answers of the service's own door are `z.object`, not strict, on purpose, like
+// `AuthorizationResponse`: an outside service reads them with the SDK it installed, and Colab, the
+// trusted sender, may add a field without breaking an older SDK (Postel). The inputs stay strict.
+export const ServiceInterfaceDeclared = z.object({
+    name: z.string(),
+    functions: z.array(z.string()),
+    // The functions this declaration dropped, with their rights; empty when nothing fell.
+    removed: z.array(z.string()),
+});
+// The answer of `POST /auth/service/interfaces/:interface/remove`. A service declares its target
+// state and may repeat it: `removed: false` is no error, and `permissions` names what fell.
+export const ServiceInterfaceUndeclared = z.object({
+    removed: z.boolean(),
+    permissions: z.array(z.string()),
+});

package/dist/invitations/invitations.d.ts

@@ -0,0 +1,98 @@
+import { z } from "zod";
+export declare const InvitationId: z.ZodTemplateLiteral<`invitation_${string}`>;
+export declare const RoleChip: z.ZodObject<{
+    roleId: z.ZodTemplateLiteral<`role_${string}`>;
+    name: z.ZodString;
+}, z.core.$strict>;
+export type RoleChip = z.infer<typeof RoleChip>;
+export declare const Delivery: z.ZodObject<{
+    accepted: z.ZodBoolean;
+    cause: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type Delivery = z.infer<typeof Delivery>;
+export declare const InvitationCreateInput: z.ZodObject<{
+    email: z.ZodEmail;
+    roleIds: z.ZodOptional<z.ZodArray<z.ZodTemplateLiteral<`role_${string}`>>>;
+}, z.core.$strict>;
+export type InvitationCreateInput = z.infer<typeof InvitationCreateInput>;
+export declare const InvitationResendInput: z.ZodObject<{
+    invitationId: z.ZodTemplateLiteral<`invitation_${string}`>;
+}, z.core.$strict>;
+export type InvitationResendInput = z.infer<typeof InvitationResendInput>;
+export declare const InvitationRevokeInput: z.ZodObject<{
+    invitationId: z.ZodTemplateLiteral<`invitation_${string}`>;
+}, z.core.$strict>;
+export type InvitationRevokeInput = z.infer<typeof InvitationRevokeInput>;
+export declare const InvitationStatus: z.ZodEnum<{
+    accepted: "accepted";
+    invited: "invited";
+    expired: "expired";
+    revoked: "revoked";
+}>;
+export type InvitationStatus = z.infer<typeof InvitationStatus>;
+export declare const Invitation: z.ZodObject<{
+    invitationId: z.ZodTemplateLiteral<`invitation_${string}`>;
+    email: z.ZodString;
+    roles: z.ZodArray<z.ZodObject<{
+        roleId: z.ZodTemplateLiteral<`role_${string}`>;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    status: z.ZodEnum<{
+        accepted: "accepted";
+        invited: "invited";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+    invitedBy: z.ZodNullable<z.ZodTemplateLiteral<`user_${string}`>>;
+    expiresAt: z.ZodISODateTime;
+    createdAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type Invitation = z.infer<typeof Invitation>;
+export declare const InvitationSent: z.ZodObject<{
+    invitationId: z.ZodTemplateLiteral<`invitation_${string}`>;
+    email: z.ZodString;
+    roles: z.ZodArray<z.ZodObject<{
+        roleId: z.ZodTemplateLiteral<`role_${string}`>;
+        name: z.ZodString;
+    }, z.core.$strict>>;
+    status: z.ZodEnum<{
+        accepted: "accepted";
+        invited: "invited";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+    invitedBy: z.ZodNullable<z.ZodTemplateLiteral<`user_${string}`>>;
+    expiresAt: z.ZodISODateTime;
+    createdAt: z.ZodISODateTime;
+    delivery: z.ZodObject<{
+        accepted: z.ZodBoolean;
+        cause: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type InvitationSent = z.infer<typeof InvitationSent>;
+export declare const InvitationLookupQuery: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strict>;
+export type InvitationLookupQuery = z.infer<typeof InvitationLookupQuery>;
+export declare const InvitationLookup: z.ZodObject<{
+    email: z.ZodString;
+    inviter: z.ZodNullable<z.ZodString>;
+    expired: z.ZodBoolean;
+    expiresAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type InvitationLookup = z.infer<typeof InvitationLookup>;
+export declare const InvitationAcceptInput: z.ZodObject<{
+    token: z.ZodString;
+    name: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strict>;
+export type InvitationAcceptInput = z.infer<typeof InvitationAcceptInput>;
+export declare const InvitationSocialInput: z.ZodObject<{
+    token: z.ZodString;
+    provider: z.ZodEnum<{
+        google: "google";
+        microsoft: "microsoft";
+    }>;
+    callbackURL: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type InvitationSocialInput = z.infer<typeof InvitationSocialInput>;