@cat-factory/contracts 0.245.0 → 0.246.0

package/dist/tool-servers.d.ts

@@ -38,6 +38,54 @@ export declare const toolServerCredentialSchema: v.ObjectSchema<{
     readonly usage: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
 }, undefined>;
 export type ToolServerCredential = v.InferOutput<typeof toolServerCredentialSchema>;
+/** Which OAuth grant a declaration uses, mirroring kernel's `McpOAuthConfig['grant']`. */
+export declare const toolServerOAuthGrantSchema: v.PicklistSchema<["authorization_code", "client_credentials"], undefined>;
+export type ToolServerOAuthGrant = v.InferOutput<typeof toolServerOAuthGrantSchema>;
+/**
+ * The non-secret state of a workspace's OAuth grant for one tool server: what is persisted beside
+ * the sealed tokens, and what the operator surface renders.
+ *
+ * Never a token, and never a refresh token's presence dressed up as one. The only reason this is a
+ * record rather than a boolean is that "connected" is four separate questions an operator asks in
+ * sequence — is there a grant, whose account is it, will it keep working, and did the last renewal
+ * fail — and a single flag answers the first while silently implying the other three.
+ */
+export declare const toolServerOAuthStatusSchema: v.ObjectSchema<{
+    readonly grant: v.PicklistSchema<["authorization_code", "client_credentials"], undefined>;
+    /**
+     * Whether this workspace holds a grant for the server.
+     *
+     * For `client_credentials` this is a fact about a CACHED token rather than about a human
+     * decision: nothing needs granting, so a false here means only that no token has been minted
+     * yet, and a dispatch mints one. The surface therefore renders the two grants differently and
+     * this field is deliberately not overloaded to say so.
+     */
+    readonly connected: v.BooleanSchema<undefined>;
+    /** Scopes the authorization server actually granted, when it named them. */
+    readonly scopes: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
+    /** When the grant was established (epoch ms). */
+    readonly connectedAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+    /** The user who granted it, so a board can tell whose vendor account its runs authenticate as. */
+    readonly connectedBy: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    /** When the current access token expires (epoch ms), when the server stated an expiry. */
+    readonly expiresAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+    /**
+     * Whether a refresh token was issued.
+     *
+     * `false` on an `authorization_code` grant is a real and reportable state, not a detail: the
+     * connection works until the access token expires and then needs granting again by hand, which
+     * an operator can only plan around if the surface says so before it happens.
+     */
+    readonly refreshable: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+    /**
+     * Why the last token exchange failed, when one did. Present ALONGSIDE `connected: true`, which
+     * is the point: the grant is still on file and is no longer producing tokens, and reporting that
+     * as a clean connection is how an operator ends up debugging the agent instead of the vendor.
+     * Scrubbed at the emit site.
+     */
+    readonly lastError: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+}, undefined>;
+export type ToolServerOAuthStatus = v.InferOutput<typeof toolServerOAuthStatusSchema>;
 /**
  * One declared tool server, as an operator sees it.
  *
@@ -87,6 +135,46 @@ export declare const toolServerViewSchema: v.ObjectSchema<{
         readonly required: v.BooleanSchema<undefined>;
         readonly usage: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
     }, undefined>, undefined>;
+    /**
+     * The OAuth declaration's state for THIS workspace, when the server declares one. Absent ⇒ the
+     * server authenticates with static credentials (or none), and the Connect affordance does not
+     * apply to it at all.
+     */
+    readonly oauth: v.OptionalSchema<v.ObjectSchema<{
+        readonly grant: v.PicklistSchema<["authorization_code", "client_credentials"], undefined>;
+        /**
+         * Whether this workspace holds a grant for the server.
+         *
+         * For `client_credentials` this is a fact about a CACHED token rather than about a human
+         * decision: nothing needs granting, so a false here means only that no token has been minted
+         * yet, and a dispatch mints one. The surface therefore renders the two grants differently and
+         * this field is deliberately not overloaded to say so.
+         */
+        readonly connected: v.BooleanSchema<undefined>;
+        /** Scopes the authorization server actually granted, when it named them. */
+        readonly scopes: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
+        /** When the grant was established (epoch ms). */
+        readonly connectedAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+        /** The user who granted it, so a board can tell whose vendor account its runs authenticate as. */
+        readonly connectedBy: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        /** When the current access token expires (epoch ms), when the server stated an expiry. */
+        readonly expiresAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+        /**
+         * Whether a refresh token was issued.
+         *
+         * `false` on an `authorization_code` grant is a real and reportable state, not a detail: the
+         * connection works until the access token expires and then needs granting again by hand, which
+         * an operator can only plan around if the surface says so before it happens.
+         */
+        readonly refreshable: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+        /**
+         * Why the last token exchange failed, when one did. Present ALONGSIDE `connected: true`, which
+         * is the point: the grant is still on file and is no longer producing tokens, and reporting that
+         * as a clean connection is how an operator ends up debugging the agent instead of the vendor.
+         * Scrubbed at the emit site.
+         */
+        readonly lastError: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+    }, undefined>, undefined>;
     /** Whether this deployment can reach the server to probe it. */
     readonly probeable: v.BooleanSchema<undefined>;
     /** Why not, when `probeable` is false. Always present in that case, absent otherwise. */
@@ -135,6 +223,46 @@ export declare const toolServersViewSchema: v.ObjectSchema<{
             readonly required: v.BooleanSchema<undefined>;
             readonly usage: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
         }, undefined>, undefined>;
+        /**
+         * The OAuth declaration's state for THIS workspace, when the server declares one. Absent ⇒ the
+         * server authenticates with static credentials (or none), and the Connect affordance does not
+         * apply to it at all.
+         */
+        readonly oauth: v.OptionalSchema<v.ObjectSchema<{
+            readonly grant: v.PicklistSchema<["authorization_code", "client_credentials"], undefined>;
+            /**
+             * Whether this workspace holds a grant for the server.
+             *
+             * For `client_credentials` this is a fact about a CACHED token rather than about a human
+             * decision: nothing needs granting, so a false here means only that no token has been minted
+             * yet, and a dispatch mints one. The surface therefore renders the two grants differently and
+             * this field is deliberately not overloaded to say so.
+             */
+            readonly connected: v.BooleanSchema<undefined>;
+            /** Scopes the authorization server actually granted, when it named them. */
+            readonly scopes: v.OptionalSchema<v.ArraySchema<v.StringSchema<undefined>, undefined>, undefined>;
+            /** When the grant was established (epoch ms). */
+            readonly connectedAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+            /** The user who granted it, so a board can tell whose vendor account its runs authenticate as. */
+            readonly connectedBy: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+            /** When the current access token expires (epoch ms), when the server stated an expiry. */
+            readonly expiresAt: v.OptionalSchema<v.NumberSchema<undefined>, undefined>;
+            /**
+             * Whether a refresh token was issued.
+             *
+             * `false` on an `authorization_code` grant is a real and reportable state, not a detail: the
+             * connection works until the access token expires and then needs granting again by hand, which
+             * an operator can only plan around if the surface says so before it happens.
+             */
+            readonly refreshable: v.OptionalSchema<v.BooleanSchema<undefined>, undefined>;
+            /**
+             * Why the last token exchange failed, when one did. Present ALONGSIDE `connected: true`, which
+             * is the point: the grant is still on file and is no longer producing tokens, and reporting that
+             * as a clean connection is how an operator ends up debugging the agent instead of the vendor.
+             * Scrubbed at the emit site.
+             */
+            readonly lastError: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
+        }, undefined>, undefined>;
         /** Whether this deployment can reach the server to probe it. */
         readonly probeable: v.BooleanSchema<undefined>;
         /** Why not, when `probeable` is false. Always present in that case, absent otherwise. */
@@ -161,10 +289,16 @@ export type ToolServersView = v.InferOutput<typeof toolServersViewSchema>;
  * - `protocol_error` — it answered, but not as an MCP server: a non-JSON body, a JSON-RPC error, a
  *   protocol version it would not negotiate. The url probably names something that is not this
  *   server.
+ * - `oauth_not_connected` — the declaration authenticates with OAuth and this workspace has not
+ *   granted it. Kept apart from `credentials_missing` because there is no value to type: the
+ *   remedy is the Connect flow, and an operator sent to the credential checklist would find no row.
+ * - `oauth_token_failed` — a grant is on file and produced no access token (revoked or expired
+ *   refresh, an authorization server that refused, discovery that failed). The dispatch reports
+ *   the same condition as `oauth_token_failed`; `error` carries the cause.
  * - `not_probeable` — the probe was refused before it began; see
  *   {@link toolServerNotProbeableReasonSchema}.
  */
-export declare const toolServerProbeStatusSchema: v.PicklistSchema<["ok", "credentials_missing", "credential_refused", "unreachable", "http_error", "protocol_error", "not_probeable"], undefined>;
+export declare const toolServerProbeStatusSchema: v.PicklistSchema<["ok", "credentials_missing", "credential_refused", "oauth_not_connected", "oauth_token_failed", "unreachable", "http_error", "protocol_error", "not_probeable"], undefined>;
 export type ToolServerProbeStatus = v.InferOutput<typeof toolServerProbeStatusSchema>;
 /**
  * Whether the tools the definition NARROWED to actually exist on the server.
@@ -192,7 +326,7 @@ export type ToolServerAllowedToolsCheck = v.InferOutput<typeof toolServerAllowed
 /** What one probe answered. */
 export declare const toolServerProbeResultSchema: v.ObjectSchema<{
     readonly serverId: v.StringSchema<undefined>;
-    readonly status: v.PicklistSchema<["ok", "credentials_missing", "credential_refused", "unreachable", "http_error", "protocol_error", "not_probeable"], undefined>;
+    readonly status: v.PicklistSchema<["ok", "credentials_missing", "credential_refused", "oauth_not_connected", "oauth_token_failed", "unreachable", "http_error", "protocol_error", "not_probeable"], undefined>;
     /** Present when `status` is `not_probeable`, absent otherwise. */
     readonly notProbeableReason: v.OptionalSchema<v.PicklistSchema<["stdio_transport", "container_local_url", "url_not_allowed"], undefined>, undefined>;
     /** The `serverInfo` the handshake returned. Present on `ok`. */
@@ -233,6 +367,53 @@ export declare const toolServerProbeResultSchema: v.ObjectSchema<{
     readonly error: v.OptionalSchema<v.StringSchema<undefined>, undefined>;
 }, undefined>;
 export type ToolServerProbeResult = v.InferOutput<typeof toolServerProbeResultSchema>;
+/**
+ * What starting an OAuth grant answers: the vendor's own authorization URL, for the SPA to send
+ * the operator to.
+ *
+ * A url handed back rather than a 302, because the caller is a `fetch` from the settings panel and
+ * a redirect there would be followed by the browser into a cross-origin document the SPA cannot
+ * observe. It also keeps the refusals (`503` when the redirect URL is unconfigured, `409` when the
+ * declaration is not an `authorization_code` one) as ordinary error envelopes with a
+ * `details.reason` the panel can translate, which a redirect response cannot carry.
+ */
+export declare const toolServerOAuthStartSchema: v.ObjectSchema<{
+    readonly url: v.StringSchema<undefined>;
+}, undefined>;
+export type ToolServerOAuthStart = v.InferOutput<typeof toolServerOAuthStartSchema>;
+/**
+ * What the SPA hands back to finish a grant: the two values the vendor put in the redirect it sent
+ * the operator's browser to.
+ *
+ * POSTED BY THE SPA rather than read off a redirect the backend receives, and that is the whole
+ * security shape of this flow. A vendor's redirect is a third-party browser navigation carrying no
+ * `Authorization` header, so a backend route receiving it directly cannot know WHO is completing
+ * the grant, and the session and permission checks such a route makes are unreachable code on any
+ * deployment where sessions are bearer tokens. Landing the redirect on an SPA page that re-presents
+ * these two values over the authenticated API is what makes the user binding and the
+ * `secrets.manage` re-check real rather than decorative.
+ *
+ * Neither value is a secret this side minted: `code` is single-use at the authorization server and
+ * `state` is sealed, so the pair is inert to anyone who cannot also open the seal.
+ */
+export declare const toolServerOAuthCompletionSchema: v.ObjectSchema<{
+    readonly code: v.StringSchema<undefined>;
+    readonly state: v.StringSchema<undefined>;
+}, undefined>;
+export type ToolServerOAuthCompletion = v.InferOutput<typeof toolServerOAuthCompletionSchema>;
+/**
+ * What completing a grant answers: which server was connected, so the page that finishes the flow
+ * can name it before sending the operator back to the panel.
+ *
+ * The server id comes from the SEALED state rather than from anything the caller sent, which is
+ * why it is worth returning at all: it is the one fact the SPA could not otherwise know, having
+ * handed off to the vendor and come back on a fixed redirect URL that carries no board or server.
+ */
+export declare const toolServerOAuthCompletedSchema: v.ObjectSchema<{
+    readonly serverId: v.StringSchema<undefined>;
+    readonly workspaceId: v.StringSchema<undefined>;
+}, undefined>;
+export type ToolServerOAuthCompleted = v.InferOutput<typeof toolServerOAuthCompletedSchema>;
 /**
  * How many tool NAMES a probe result carries back.
  *

package/dist/tool-servers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-servers.d.ts","sourceRoot":"","sources":["../src/tool-servers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA8B5B,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,gDAAgC,CAAA;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kCAAkC,4FAI7C,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAEnG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;aAIrC,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB;;;;IAI/B;;;;OAIG;;IAEH,8EAA8E;;IAE9E;;;;;;;OAOG;;IAEH;;;;;;;;;OASG;;IAEH,6FAA6F;;IAE7F,4CAA4C;;;;;;IAE5C,gEAAgE;;IAEhE,yFAAyF;;aAEzF,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEvE,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB;;;;;QAxChC;;;;WAIG;;QAEH,8EAA8E;;QAE9E;;;;;;;WAOG;;QAEH;;;;;;;;;WASG;;QAEH,6FAA6F;;QAE7F,4CAA4C;;;;;;QAE5C,gEAAgE;;QAEhE,yFAAyF;;;aAQzF,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,2BAA2B,kJAQtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iCAAiC;;IAE5C,gFAAgF;;IAEhF,6FAA6F;;aAE7F,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAEjG,+BAA+B;AAC/B,eAAO,MAAM,2BAA2B;;;IAGtC,kEAAkE;;IAElE,gEAAgE;;;IAGhE,mEAAmE;;IAEnE;;;;;OAKG;;IAEH,0FAA0F;;IAE1F,oEAAoE;;IAEpE,mGAAmG;;;QA7BnG,gFAAgF;;QAEhF,6FAA6F;;;IA6B7F,oFAAoF;;IAEpF,4FAA4F;;IAE5F,mEAAmE;;IAEnE;;;;OAIG;;aAEH,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAEpC,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAAS,CAAA"}
+{"version":3,"file":"tool-servers.d.ts","sourceRoot":"","sources":["../src/tool-servers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AA8B5B,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,gDAAgC,CAAA;AACtE,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAEjF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kCAAkC,4FAI7C,CAAA;AACF,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,kCAAkC,CAAC,CAAA;AAEnG;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B;;;;aAIrC,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF,0FAA0F;AAC1F,eAAO,MAAM,0BAA0B,2EAA2D,CAAA;AAClG,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B;;IAEtC;;;;;;;OAOG;;IAEH,4EAA4E;;IAE5E,iDAAiD;;IAEjD,kGAAkG;;IAElG,0FAA0F;;IAE1F;;;;;;OAMG;;IAEH;;;;;OAKG;;aAEH,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB;;;;IAI/B;;;;OAIG;;IAEH,8EAA8E;;IAE9E;;;;;;;OAOG;;IAEH;;;;;;;;;OASG;;IAEH,6FAA6F;;IAE7F,4CAA4C;;;;;;IAE5C;;;;OAIG;;;QApFH;;;;;;;WAOG;;QAEH,4EAA4E;;QAE5E,iDAAiD;;QAEjD,kGAAkG;;QAElG,0FAA0F;;QAE1F;;;;;;WAMG;;QAEH;;;;;WAKG;;;IAwDH,gEAAgE;;IAEhE,yFAAyF;;aAEzF,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,oBAAoB,CAAC,CAAA;AAEvE,0FAA0F;AAC1F,eAAO,MAAM,qBAAqB;;;;;QA9ChC;;;;WAIG;;QAEH,8EAA8E;;QAE9E;;;;;;;WAOG;;QAEH;;;;;;;;;WASG;;QAEH,6FAA6F;;QAE7F,4CAA4C;;;;;;QAE5C;;;;WAIG;;;YApFH;;;;;;;eAOG;;YAEH,4EAA4E;;YAE5E,iDAAiD;;YAEjD,kGAAkG;;YAElG,0FAA0F;;YAE1F;;;;;;eAMG;;YAEH;;;;;eAKG;;;QAwDH,gEAAgE;;QAEhE,yFAAyF;;;aAQzF,CAAA;AACF,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,eAAO,MAAM,2BAA2B,+LAUtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iCAAiC;;IAE5C,gFAAgF;;IAEhF,6FAA6F;;aAE7F,CAAA;AACF,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,iCAAiC,CAAC,CAAA;AAEjG,+BAA+B;AAC/B,eAAO,MAAM,2BAA2B;;;IAGtC,kEAAkE;;IAElE,gEAAgE;;;IAGhE,mEAAmE;;IAEnE;;;;;OAKG;;IAEH,0FAA0F;;IAE1F,oEAAoE;;IAEpE,mGAAmG;;;QA7BnG,gFAAgF;;QAEhF,6FAA6F;;;IA6B7F,oFAAoF;;IAEpF,4FAA4F;;IAE5F,mEAAmE;;IAEnE;;;;OAIG;;aAEH,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,2BAA2B,CAAC,CAAA;AAErF;;;;;;;;;GASG;AACH,eAAO,MAAM,0BAA0B;;aAErC,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAEnF;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,+BAA+B;;;aAG1C,CAAA;AACF,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,+BAA+B,CAAC,CAAA;AAE7F;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B;;;aAGzC,CAAA;AACF,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,8BAA8B,CAAC,CAAA;AAE3F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAE1C;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,IAAI,CAAA;AAEpC,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,QAAS,CAAA"}

package/dist/tool-servers.js

@@ -66,6 +66,52 @@ export const toolServerCredentialSchema = v.object({
     required: v.boolean(),
     usage: v.optional(v.string()),
 });
+/** Which OAuth grant a declaration uses, mirroring kernel's `McpOAuthConfig['grant']`. */
+export const toolServerOAuthGrantSchema = v.picklist(['authorization_code', 'client_credentials']);
+/**
+ * The non-secret state of a workspace's OAuth grant for one tool server: what is persisted beside
+ * the sealed tokens, and what the operator surface renders.
+ *
+ * Never a token, and never a refresh token's presence dressed up as one. The only reason this is a
+ * record rather than a boolean is that "connected" is four separate questions an operator asks in
+ * sequence — is there a grant, whose account is it, will it keep working, and did the last renewal
+ * fail — and a single flag answers the first while silently implying the other three.
+ */
+export const toolServerOAuthStatusSchema = v.object({
+    grant: toolServerOAuthGrantSchema,
+    /**
+     * Whether this workspace holds a grant for the server.
+     *
+     * For `client_credentials` this is a fact about a CACHED token rather than about a human
+     * decision: nothing needs granting, so a false here means only that no token has been minted
+     * yet, and a dispatch mints one. The surface therefore renders the two grants differently and
+     * this field is deliberately not overloaded to say so.
+     */
+    connected: v.boolean(),
+    /** Scopes the authorization server actually granted, when it named them. */
+    scopes: v.optional(v.array(v.string())),
+    /** When the grant was established (epoch ms). */
+    connectedAt: v.optional(v.number()),
+    /** The user who granted it, so a board can tell whose vendor account its runs authenticate as. */
+    connectedBy: v.optional(v.string()),
+    /** When the current access token expires (epoch ms), when the server stated an expiry. */
+    expiresAt: v.optional(v.number()),
+    /**
+     * Whether a refresh token was issued.
+     *
+     * `false` on an `authorization_code` grant is a real and reportable state, not a detail: the
+     * connection works until the access token expires and then needs granting again by hand, which
+     * an operator can only plan around if the surface says so before it happens.
+     */
+    refreshable: v.optional(v.boolean()),
+    /**
+     * Why the last token exchange failed, when one did. Present ALONGSIDE `connected: true`, which
+     * is the point: the grant is still on file and is no longer producing tokens, and reporting that
+     * as a clean connection is how an operator ends up debugging the agent instead of the vendor.
+     * Scrubbed at the emit site.
+     */
+    lastError: v.optional(v.string()),
+});
 /**
  * One declared tool server, as an operator sees it.
  *
@@ -111,6 +157,12 @@ export const toolServerViewSchema = v.object({
     allowedTools: v.optional(v.array(v.string())),
     /** The credentials it asks for, by name. */
     credentials: v.array(toolServerCredentialSchema),
+    /**
+     * The OAuth declaration's state for THIS workspace, when the server declares one. Absent ⇒ the
+     * server authenticates with static credentials (or none), and the Connect affordance does not
+     * apply to it at all.
+     */
+    oauth: v.optional(toolServerOAuthStatusSchema),
     /** Whether this deployment can reach the server to probe it. */
     probeable: v.boolean(),
     /** Why not, when `probeable` is false. Always present in that case, absent otherwise. */
@@ -139,6 +191,12 @@ export const toolServersViewSchema = v.object({
  * - `protocol_error` — it answered, but not as an MCP server: a non-JSON body, a JSON-RPC error, a
  *   protocol version it would not negotiate. The url probably names something that is not this
  *   server.
+ * - `oauth_not_connected` — the declaration authenticates with OAuth and this workspace has not
+ *   granted it. Kept apart from `credentials_missing` because there is no value to type: the
+ *   remedy is the Connect flow, and an operator sent to the credential checklist would find no row.
+ * - `oauth_token_failed` — a grant is on file and produced no access token (revoked or expired
+ *   refresh, an authorization server that refused, discovery that failed). The dispatch reports
+ *   the same condition as `oauth_token_failed`; `error` carries the cause.
  * - `not_probeable` — the probe was refused before it began; see
  *   {@link toolServerNotProbeableReasonSchema}.
  */
@@ -146,6 +204,8 @@ export const toolServerProbeStatusSchema = v.picklist([
     'ok',
     'credentials_missing',
     'credential_refused',
+    'oauth_not_connected',
+    'oauth_token_failed',
     'unreachable',
     'http_error',
     'protocol_error',
@@ -210,6 +270,50 @@ export const toolServerProbeResultSchema = v.object({
      */
     error: v.optional(v.string()),
 });
+/**
+ * What starting an OAuth grant answers: the vendor's own authorization URL, for the SPA to send
+ * the operator to.
+ *
+ * A url handed back rather than a 302, because the caller is a `fetch` from the settings panel and
+ * a redirect there would be followed by the browser into a cross-origin document the SPA cannot
+ * observe. It also keeps the refusals (`503` when the redirect URL is unconfigured, `409` when the
+ * declaration is not an `authorization_code` one) as ordinary error envelopes with a
+ * `details.reason` the panel can translate, which a redirect response cannot carry.
+ */
+export const toolServerOAuthStartSchema = v.object({
+    url: v.string(),
+});
+/**
+ * What the SPA hands back to finish a grant: the two values the vendor put in the redirect it sent
+ * the operator's browser to.
+ *
+ * POSTED BY THE SPA rather than read off a redirect the backend receives, and that is the whole
+ * security shape of this flow. A vendor's redirect is a third-party browser navigation carrying no
+ * `Authorization` header, so a backend route receiving it directly cannot know WHO is completing
+ * the grant, and the session and permission checks such a route makes are unreachable code on any
+ * deployment where sessions are bearer tokens. Landing the redirect on an SPA page that re-presents
+ * these two values over the authenticated API is what makes the user binding and the
+ * `secrets.manage` re-check real rather than decorative.
+ *
+ * Neither value is a secret this side minted: `code` is single-use at the authorization server and
+ * `state` is sealed, so the pair is inert to anyone who cannot also open the seal.
+ */
+export const toolServerOAuthCompletionSchema = v.object({
+    code: v.string(),
+    state: v.string(),
+});
+/**
+ * What completing a grant answers: which server was connected, so the page that finishes the flow
+ * can name it before sending the operator back to the panel.
+ *
+ * The server id comes from the SEALED state rather than from anything the caller sent, which is
+ * why it is worth returning at all: it is the one fact the SPA could not otherwise know, having
+ * handed off to the vendor and come back on a fixed redirect URL that carries no board or server.
+ */
+export const toolServerOAuthCompletedSchema = v.object({
+    serverId: v.string(),
+    workspaceId: v.string(),
+});
 /**
  * How many tool NAMES a probe result carries back.
  *

package/dist/tool-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-servers.js","sourceRoot":"","sources":["../src/tool-servers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,6FAA6F;AAC7F,yBAAyB;AACzB,EAAE;AACF,oGAAoG;AACpG,+FAA+F;AAC/F,mGAAmG;AACnG,iGAAiG;AACjG,oGAAoG;AACpG,EAAE;AACF,sCAAsC;AACtC,EAAE;AACF,oGAAoG;AACpG,6FAA6F;AAC7F,mDAAmD;AACnD,qGAAqG;AACrG,gBAAgB;AAChB,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,iGAAiG;AACjG,uDAAuD;AACvD,EAAE;AACF,mGAAmG;AACnG,6FAA6F;AAC7F,8EAA8E;AAC9E,8EAA8E;AAE9E,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAGtE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3D,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;CAClB,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,yBAAyB;IACpC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtC,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAChD,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;CACnE,CAAC,CAAA;AAGF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACvC,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,QAAQ,CAAC;IACpD,IAAI;IACJ,qBAAqB;IACrB,oBAAoB;IACpB,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,eAAe;CAChB,CAAC,CAAA;AAGF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAA;AAGF,+BAA+B;AAC/B,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,2BAA2B;IACnC,kEAAkE;IAClE,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAClE,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,mEAAmE;IACnE,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,0FAA0F;IAC1F,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACtC,mGAAmG;IACnG,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAC3D,oFAAoF;IACpF,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,4FAA4F;IAC5F,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,mEAAmE;IACnE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAE1C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAEpC,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA"}
+{"version":3,"file":"tool-servers.js","sourceRoot":"","sources":["../src/tool-servers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,8EAA8E;AAC9E,6FAA6F;AAC7F,yBAAyB;AACzB,EAAE;AACF,oGAAoG;AACpG,+FAA+F;AAC/F,mGAAmG;AACnG,iGAAiG;AACjG,oGAAoG;AACpG,EAAE;AACF,sCAAsC;AACtC,EAAE;AACF,oGAAoG;AACpG,6FAA6F;AAC7F,mDAAmD;AACnD,qGAAqG;AACrG,gBAAgB;AAChB,EAAE;AACF,oGAAoG;AACpG,kGAAkG;AAClG,iGAAiG;AACjG,uDAAuD;AACvD,EAAE;AACF,mGAAmG;AACnG,6FAA6F;AAC7F,8EAA8E;AAC9E,8EAA8E;AAE9E,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAGtE;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC3D,iBAAiB;IACjB,qBAAqB;IACrB,iBAAiB;CAClB,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAA;AAGF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC,CAAC,CAAA;AAGlG;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,KAAK,EAAE,0BAA0B;IACjC;;;;;;;OAOG;IACH,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,4EAA4E;IAC5E,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,iDAAiD;IACjD,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,kGAAkG;IAClG,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnC,0FAA0F;IAC1F,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC;;;;;;OAMG;IACH,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACpC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAA;AAGF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,yBAAyB;IACpC;;;;OAIG;IACH,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,8EAA8E;IAC9E,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAChC;;;;;;;OAOG;IACH,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B;;;;;;;;;OASG;IACH,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACtC,6FAA6F;IAC7F,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,4CAA4C;IAC5C,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC;IAChD;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC9C,gEAAgE;IAChE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,yFAAyF;IACzF,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;CACnE,CAAC,CAAA;AAGF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC;CACvC,CAAC,CAAA;AAGF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,QAAQ,CAAC;IACpD,IAAI;IACJ,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,aAAa;IACb,YAAY;IACZ,gBAAgB;IAChB,eAAe;CAChB,CAAC,CAAA;AAGF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAAG,CAAC,CAAC,MAAM,CAAC;IACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC7B,gFAAgF;IAChF,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;CACrB,CAAC,CAAA;AAGF,+BAA+B;AAC/B,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,2BAA2B;IACnC,kEAAkE;IAClE,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,kCAAkC,CAAC;IAClE,gEAAgE;IAChE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,mEAAmE;IACnE,eAAe,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACvC;;;;;OAKG;IACH,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,0FAA0F;IAC1F,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtC,oEAAoE;IACpE,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IACtC,mGAAmG;IACnG,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,iCAAiC,CAAC;IAC3D,oFAAoF;IACpF,qBAAqB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,4FAA4F;IAC5F,kBAAkB,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnD,mEAAmE;IACnE,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAClC;;;;OAIG;IACH,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAA;AAGF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CAChB,CAAC,CAAA;AAGF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,CAAC,CAAC,MAAM,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;CAClB,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAA;AAGF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAA;AAE1C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAA;AAEpC,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/contracts",
-  "version": "0.245.0",
+  "version": "0.246.0",
   "description": "Valibot wire contract shared between the Agent Architecture Board frontend and backend.",
   "repository": {
     "type": "git",