@clawscarf/cli 0.1.0-alpha.1

package/services/access/repo/postgres.js

@@ -0,0 +1,341 @@
+import { randomUUID, createCipheriv, createDecipheriv, randomBytes, } from "node:crypto";
+import { z } from "zod";
+import { SessionLogoutProtection } from "./session-logout.js";
+import { AccessError } from "../types/errors.js";
+import { hash } from "../types/credential.js";
+const loginSchema = z
+    .object({
+    state: z.string(),
+    nonce: z.string(),
+    codeVerifier: z.string(),
+    returnTo: z.string(),
+    setupTokenHash: z.string().optional(),
+    invitationTokenHash: z.string().optional(),
+})
+    .strict();
+const user = (row) => ({
+    id: row.id,
+    identity: `clawscarf:${row.id}`,
+    email: row.email,
+    name: row.name.trim() || row.email,
+});
+/** Durable sessions and enrollment for one team server. */
+export class PostgresAccessStore {
+    pool;
+    key;
+    administrator;
+    client;
+    logoutProtection;
+    constructor(pool, key, administrator, client) {
+        this.pool = pool;
+        this.key = key;
+        this.administrator = administrator;
+        this.client = client;
+        if (key.length !== 32)
+            throw Error("Access encryption key must contain 32 bytes.");
+        this.logoutProtection = new SessionLogoutProtection(key);
+    }
+    async transaction(work) {
+        const client = this.client ?? (await this.pool.connect());
+        try {
+            await client.query("BEGIN");
+            const result = await work(client);
+            await client.query("COMMIT");
+            return result;
+        }
+        catch (error) {
+            await client.query("ROLLBACK");
+            throw error;
+        }
+        finally {
+            if (!this.client)
+                client.release();
+        }
+    }
+    async withEnrollmentLock(work) {
+        const client = await this.pool.connect();
+        let locked = false;
+        try {
+            const result = await client.query("SELECT pg_try_advisory_lock(174992004) AS locked");
+            locked = result.rows[0]?.locked === true;
+            if (!locked)
+                throw new AccessError("rate_limited", "Another membership change is in progress. Try again.");
+            return await work(new PostgresAccessStore(this.pool, this.key, this.administrator, client));
+        }
+        finally {
+            try {
+                if (locked)
+                    await client.query("SELECT pg_advisory_unlock(174992004)");
+            }
+            finally {
+                client.release();
+            }
+        }
+    }
+    async invitations() {
+        const result = await (this.client ?? this.pool).query(`SELECT id,email,expires_at::text AS "expiresAt",
+       CASE WHEN revoked_at IS NOT NULL THEN 'revoked' WHEN accepted_at IS NOT NULL THEN 'accepted'
+       WHEN expires_at<=clock_timestamp() THEN 'expired' ELSE 'pending' END AS status
+       FROM clawscarf_access.invitations ORDER BY expires_at DESC LIMIT 1000`);
+        return result.rows.map((row) => ({
+            ...row,
+            expiresAt: new Date(row.expiresAt).toISOString(),
+        }));
+    }
+    async createInvitation(sponsorId, email, tokenHash) {
+        const result = await (this.client ?? this.pool).query(`INSERT INTO clawscarf_access.invitations(id,token_hash,email,sponsor_id,sponsor_revision)
+       SELECT $1,$2,$3,id,revision FROM clawscarf_access.users WHERE id=$4 AND admitted
+       AND (SELECT count(*) FROM clawscarf_access.invitations WHERE accepted_at IS NULL AND revoked_at IS NULL AND expires_at>now())<1000
+       RETURNING id,email,expires_at`, [randomUUID(), tokenHash, email.toLowerCase(), sponsorId]);
+        const row = result.rows[0];
+        if (!row)
+            throw new AccessError("rate_limited", "Cannot create another invitation.");
+        return {
+            id: row.id,
+            email: row.email,
+            expiresAt: row.expires_at.toISOString(),
+            status: "pending",
+        };
+    }
+    async revokeInvitation(id) {
+        await (this.client ?? this.pool).query("UPDATE clawscarf_access.invitations SET revoked_at=clock_timestamp() WHERE id=$1 AND accepted_at IS NULL", [id]);
+    }
+    async bindInvitation(digest, identity, credentialHash) {
+        if (!identity.emailVerified)
+            throw new AccessError("email_unverified", "Use a verified email address.");
+        return this.transaction(async (client) => {
+            const result = await client.query(`UPDATE clawscarf_access.invitations i SET subject=$2 FROM clawscarf_access.users u
+         WHERE i.token_hash=$1 AND i.sponsor_id=u.id AND u.admitted AND u.revision=i.sponsor_revision
+         AND u.issuer=$3 AND i.email=$4 AND (i.subject IS NULL OR i.subject=$2)
+         AND i.accepted_at IS NULL AND i.revoked_at IS NULL AND i.expires_at>clock_timestamp()
+         RETURNING u.*`, [
+                digest,
+                identity.subject,
+                identity.issuer,
+                identity.email.toLowerCase(),
+            ]);
+            const sponsor = result.rows[0];
+            if (!sponsor)
+                throw new AccessError("invalid_authorization", "Invitation expired, was used, or belongs to another account.");
+            await client.query(`INSERT INTO clawscarf_access.browser_sessions(hash,purpose,user_id,admission_revision,csrf,expires_at)
+         VALUES($1,'invitation',$2,$3,'',clock_timestamp()+interval '3 minutes')`, [credentialHash, sponsor.id, sponsor.revision]);
+            return { hash: credentialHash, user: user(sponsor), csrfToken: "" };
+        });
+    }
+    async finishInvitation(digest, userId, sessionHash, csrf, logoutUrl) {
+        await this.transaction(async (client) => {
+            const result = await client.query(`UPDATE clawscarf_access.invitations i SET accepted_at=clock_timestamp()
+         FROM clawscarf_access.users sponsor,clawscarf_access.users target
+         WHERE i.token_hash=$1 AND target.id=$2 AND target.subject=i.subject AND target.email=i.email
+         AND sponsor.id=i.sponsor_id AND sponsor.admitted AND sponsor.revision=i.sponsor_revision
+         AND target.issuer=sponsor.issuer AND NOT target.admitted
+         AND i.accepted_at IS NULL AND i.revoked_at IS NULL AND i.expires_at>clock_timestamp()`, [digest, userId]);
+            if (result.rowCount !== 1)
+                throw new AccessError("invalid_authorization", "Invitation is no longer available.");
+            await client.query("UPDATE clawscarf_access.users SET admitted=true,revision=revision+1 WHERE id=$1", [userId]);
+            await this.insertSession(client, userId, sessionHash, csrf, logoutUrl);
+        });
+    }
+    async eligibleIdentities() {
+        const result = await (this.client ?? this.pool).query("SELECT id FROM clawscarf_access.users WHERE admitted ORDER BY id");
+        return result.rows.map((row) => `clawscarf:${row.id}`);
+    }
+    async people() {
+        const result = await (this.client ?? this.pool).query("SELECT id, email, name, revision, admitted FROM clawscarf_access.users WHERE admitted ORDER BY name, id LIMIT 1000");
+        return result.rows.map(user);
+    }
+    async person(id) {
+        const result = await (this.client ?? this.pool).query("SELECT * FROM clawscarf_access.users WHERE id=$1", [id]);
+        return result.rows[0] ? user(result.rows[0]) : null;
+    }
+    async initialize() {
+        return this.transaction(async (client) => {
+            await client.query("SELECT pg_advisory_xact_lock(174992001)");
+            const existing = await client.query("SELECT u.*,s.id AS server_id FROM clawscarf_access.server s JOIN clawscarf_access.users u ON u.id=s.administrator_id");
+            const row = existing.rows[0];
+            if (row) {
+                if (row.issuer !== this.administrator.issuer ||
+                    (!this.administrator.claimRequired &&
+                        row.subject !== this.administrator.subject))
+                    throw Error("Configured initial identity differs from this server database.");
+                return { serverId: row.server_id, administrator: user(row) };
+            }
+            const id = randomUUID(), serverId = randomUUID(), a = this.administrator;
+            const inserted = await client.query("INSERT INTO clawscarf_access.users(id,issuer,subject,email,name,admitted) VALUES($1,$2,$3,$4,$5,$6) RETURNING *", [id, a.issuer, a.subject, a.email, a.name, !a.claimRequired]);
+            const created = inserted.rows[0];
+            if (!created)
+                throw Error("Administrator initialization failed.");
+            await client.query("INSERT INTO clawscarf_access.server(id,administrator_id,setup_complete) VALUES($1,$2,$3)", [serverId, id, !a.claimRequired]);
+            return { serverId, administrator: user(created) };
+        });
+    }
+    seal(value) {
+        const iv = randomBytes(12), cipher = createCipheriv("aes-256-gcm", this.key, iv);
+        const payload = Buffer.concat([
+            cipher.update(JSON.stringify(value)),
+            cipher.final(),
+        ]);
+        return Buffer.concat([iv, cipher.getAuthTag(), payload]).toString("base64url");
+    }
+    open(value) {
+        const bytes = Buffer.from(value, "base64url"), cipher = createDecipheriv("aes-256-gcm", this.key, bytes.subarray(0, 12));
+        cipher.setAuthTag(bytes.subarray(12, 28));
+        return loginSchema.parse(JSON.parse(Buffer.concat([
+            cipher.update(bytes.subarray(28)),
+            cipher.final(),
+        ]).toString()));
+    }
+    async beginLogin(cookieHash, value) {
+        await this.transaction(async (client) => {
+            await client.query("SELECT pg_advisory_xact_lock(174992002)");
+            await client.query("DELETE FROM clawscarf_access.login_transactions WHERE expires_at<=now()");
+            const count = await client.query("SELECT count(*)::int AS count FROM clawscarf_access.login_transactions");
+            if ((count.rows[0]?.count ?? 1000) >= 1000)
+                throw new AccessError("rate_limited", "Too many pending logins. Try again later.");
+            await client.query("INSERT INTO clawscarf_access.login_transactions(cookie_hash,state_hash,payload) VALUES($1,$2,$3)", [cookieHash, hash(value.state), this.seal(value)]);
+        });
+    }
+    async consumeLogin(cookieHash, state) {
+        const result = await (this.client ?? this.pool).query("DELETE FROM clawscarf_access.login_transactions WHERE cookie_hash=$1 AND state_hash=$2 AND expires_at>now() RETURNING payload", [cookieHash, hash(state)]);
+        return result.rows[0] ? this.open(result.rows[0].payload) : null;
+    }
+    async admitIdentity(identity) {
+        const result = await (this.client ?? this.pool).query("UPDATE clawscarf_access.users SET email=$3,name=$4 WHERE issuer=$1 AND subject=$2 AND admitted RETURNING *", [
+            identity.issuer,
+            identity.subject,
+            identity.email.toLowerCase(),
+            identity.name,
+        ]);
+        const row = result.rows[0];
+        if (!row)
+            throw new AccessError("forbidden", "This account has not been admitted to this server.");
+        return user(row);
+    }
+    async createSession(userId, digest, csrfToken, logoutUrl) {
+        await this.insertSession(this.client ?? this.pool, userId, digest, csrfToken, logoutUrl);
+    }
+    async insertSession(client, userId, digest, csrfToken, logoutUrl) {
+        const result = await client.query("INSERT INTO clawscarf_access.browser_sessions(hash,user_id,admission_revision,csrf,logout_redirect) SELECT $1,id,revision,$3,$4 FROM clawscarf_access.users WHERE id=$2 AND admitted", [
+            digest,
+            userId,
+            csrfToken,
+            logoutUrl === null
+                ? null
+                : this.logoutProtection.seal(digest, logoutUrl),
+        ]);
+        if (result.rowCount !== 1)
+            throw new AccessError("forbidden", "This account is not admitted.");
+    }
+    async authenticateSession(digest) {
+        const result = await (this.client ?? this.pool).query("SELECT u.*,s.csrf FROM clawscarf_access.browser_sessions s JOIN clawscarf_access.users u ON u.id=s.user_id WHERE s.hash=$1 AND s.expires_at>clock_timestamp() AND (u.admitted OR s.purpose='enrollment' OR (s.purpose='setup' AND EXISTS(SELECT 1 FROM clawscarf_access.server initial WHERE initial.administrator_id=u.id AND NOT initial.setup_complete AND initial.setup_expires_at>clock_timestamp()))) AND s.admission_revision=u.revision AND (s.parent_hash IS NULL OR EXISTS(SELECT 1 FROM clawscarf_access.browser_sessions parent JOIN clawscarf_access.users parent_user ON parent_user.id=parent.user_id WHERE parent.hash=s.parent_hash AND parent.parent_hash IS NULL AND parent.expires_at>clock_timestamp() AND parent_user.admitted AND parent_user.revision=parent.admission_revision))", [digest]);
+        return result.rows[0]
+            ? {
+                hash: digest,
+                user: user(result.rows[0]),
+                csrfToken: result.rows[0].csrf,
+            }
+            : null;
+    }
+    async createDelegation(parentHash, digest) {
+        const result = await (this.client ?? this.pool).query(`INSERT INTO clawscarf_access.browser_sessions(hash,purpose,parent_hash,user_id,admission_revision,csrf,expires_at)
+      SELECT $1,'management',s.hash,s.user_id,s.admission_revision,s.csrf,LEAST(s.expires_at,clock_timestamp()+interval '3 minutes')
+      FROM clawscarf_access.browser_sessions s JOIN clawscarf_access.users u ON u.id=s.user_id
+      WHERE s.hash=$2 AND s.parent_hash IS NULL AND s.expires_at>clock_timestamp() AND u.admitted AND s.admission_revision=u.revision`, [digest, parentHash]);
+        if (result.rowCount !== 1)
+            throw new AccessError("unauthenticated", "Sign in to continue.");
+    }
+    async createEnrollmentDelegation(parentHash, userId, digest) {
+        const result = await (this.client ?? this.pool).query(`INSERT INTO clawscarf_access.browser_sessions(hash,purpose,parent_hash,user_id,admission_revision,csrf,expires_at)
+      SELECT $1,'enrollment',s.hash,target.id,target.revision,s.csrf,LEAST(s.expires_at,clock_timestamp()+interval '3 minutes')
+      FROM clawscarf_access.browser_sessions s JOIN clawscarf_access.users actor ON actor.id=s.user_id
+      CROSS JOIN clawscarf_access.users target
+      WHERE s.hash=$2 AND s.parent_hash IS NULL AND s.expires_at>clock_timestamp() AND actor.admitted AND actor.revision=s.admission_revision AND target.id=$3 AND NOT target.admitted`, [digest, parentHash, userId]);
+        if (result.rowCount !== 1)
+            throw new AccessError("forbidden", "Enrollment is unavailable.");
+    }
+    async prepareEnrollment(identity) {
+        const result = await (this.client ?? this.pool).query(`INSERT INTO clawscarf_access.users(id,issuer,subject,email,name)
+      VALUES($1,$2,$3,$4,$5) ON CONFLICT(issuer,subject) DO UPDATE SET email=excluded.email,name=excluded.name
+      WHERE NOT clawscarf_access.users.admitted RETURNING *`, [
+            randomUUID(),
+            identity.issuer,
+            identity.subject,
+            identity.email,
+            identity.name,
+        ]);
+        const row = result.rows[0];
+        if (!row)
+            throw new AccessError("invalid_request", "This person is already admitted.");
+        return user(row);
+    }
+    async activateEnrollment(id) {
+        await (this.client ?? this.pool).query("UPDATE clawscarf_access.users SET admitted=true,revision=revision+1 WHERE id=$1 AND NOT admitted", [id]);
+    }
+    async removeEnrollment(id) {
+        await (this.client ?? this.pool).query("UPDATE clawscarf_access.users SET admitted=false,revision=revision+1 WHERE id=$1", [id]);
+    }
+    async revokeDelegation(digest) {
+        await (this.client ?? this.pool).query("DELETE FROM clawscarf_access.browser_sessions WHERE hash=$1 AND (parent_hash IS NOT NULL OR purpose IN ('setup','invitation'))", [digest]);
+    }
+    async revokeSession(digest) {
+        const result = await (this.client ?? this.pool).query("DELETE FROM clawscarf_access.browser_sessions WHERE hash=$1 RETURNING logout_redirect", [digest]);
+        const row = result.rows[0];
+        if (!row)
+            throw new AccessError("unauthenticated", "Sign in to continue.");
+        return row.logout_redirect === null
+            ? null
+            : this.logoutProtection.open(digest, row.logout_redirect);
+    }
+    async administratorSetup() {
+        const result = await (this.client ?? this.pool).query("SELECT setup_complete,setup_expires_at FROM clawscarf_access.server");
+        const row = result.rows[0];
+        if (!row)
+            throw new AccessError("dependency_unavailable", "Server identity is unavailable.");
+        return {
+            complete: row.setup_complete,
+            expiresAt: row.setup_expires_at?.toISOString() ?? null,
+        };
+    }
+    async beginAdministratorSetup(digest) {
+        await this.transaction(async (client) => {
+            const result = await client.query("UPDATE clawscarf_access.server SET setup_token_hash=$1,setup_expires_at=clock_timestamp()+interval '15 minutes' WHERE NOT setup_complete", [digest]);
+            if (result.rowCount !== 1)
+                throw new AccessError("forbidden", "Administrator setup is already complete.");
+            await client.query("DELETE FROM clawscarf_access.browser_sessions WHERE purpose='setup'");
+        });
+    }
+    async bindAdministrator(digest, identity, sessionHash) {
+        if (!identity.emailVerified)
+            throw new AccessError("email_unverified", "Use a verified email address.");
+        return this.transaction(async (client) => {
+            const claim = await client.query(`UPDATE clawscarf_access.server SET setup_subject=$2
+         WHERE NOT setup_complete AND setup_token_hash=$1 AND setup_expires_at>clock_timestamp()
+         AND (setup_subject IS NULL OR setup_subject=$2) RETURNING administrator_id`, [digest, identity.subject]);
+            const id = claim.rows[0]?.administrator_id;
+            if (!id)
+                throw new AccessError("invalid_authorization", "Setup expired, was already used, or belongs to another account.");
+            const result = await client.query("UPDATE clawscarf_access.users SET subject=$2,email=$3,name=$4 WHERE id=$1 AND issuer=$5 AND NOT admitted RETURNING *", [
+                id,
+                identity.subject,
+                identity.email.toLowerCase(),
+                identity.name,
+                identity.issuer,
+            ]);
+            const person = result.rows[0];
+            if (!person)
+                throw new AccessError("forbidden", "This identity cannot claim the server.");
+            await client.query("INSERT INTO clawscarf_access.browser_sessions(hash,purpose,user_id,admission_revision,csrf,expires_at) SELECT $1,'setup',id,revision,'',clock_timestamp()+interval '3 minutes' FROM clawscarf_access.users WHERE id=$2", [sessionHash, id]);
+            return user(person);
+        });
+    }
+    async finishAdministratorSetup(digest, userId, sessionHash, csrfToken, logoutUrl) {
+        await this.transaction(async (client) => {
+            const claimed = await client.query("UPDATE clawscarf_access.server SET setup_complete=true,setup_token_hash=NULL,setup_expires_at=NULL WHERE NOT setup_complete AND setup_token_hash=$1 AND administrator_id=$2 AND setup_subject IS NOT NULL AND setup_expires_at>clock_timestamp() RETURNING id", [digest, userId]);
+            if (claimed.rowCount !== 1)
+                throw new AccessError("invalid_authorization", "Setup expired or was already used.");
+            await client.query("UPDATE clawscarf_access.users SET admitted=true,revision=revision+1 WHERE id=$1", [userId]);
+            await client.query("DELETE FROM clawscarf_access.browser_sessions WHERE purpose='setup' AND user_id=$1", [userId]);
+            await this.insertSession(client, userId, sessionHash, csrfToken, logoutUrl);
+        });
+    }
+}

package/services/access/repo/session-logout.js

@@ -0,0 +1,28 @@
+import { createCipheriv, createDecipheriv, hkdfSync, randomBytes, } from "node:crypto";
+/** Logout hints can contain ID tokens. Bind encrypted storage to one browser session. */
+export class SessionLogoutProtection {
+    key;
+    constructor(key) {
+        this.key = Buffer.from(hkdfSync("sha256", key, "clawscarf", "browser-session-logout", 32));
+    }
+    seal(sessionHash, url) {
+        const nonce = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.key, nonce);
+        cipher.setAAD(Buffer.from(sessionHash));
+        const ciphertext = Buffer.concat([
+            cipher.update(url, "utf8"),
+            cipher.final(),
+        ]);
+        return Buffer.concat([nonce, cipher.getAuthTag(), ciphertext]).toString("base64url");
+    }
+    open(sessionHash, sealed) {
+        const packed = Buffer.from(sealed, "base64url");
+        const decipher = createDecipheriv("aes-256-gcm", this.key, packed.subarray(0, 12));
+        decipher.setAAD(Buffer.from(sessionHash));
+        decipher.setAuthTag(packed.subarray(12, 28));
+        return Buffer.concat([
+            decipher.update(packed.subarray(28)),
+            decipher.final(),
+        ]).toString("utf8");
+    }
+}

package/services/access/types/credential.js

@@ -0,0 +1,2 @@
+import { createHash } from "node:crypto";
+export const hash = (value) => createHash("sha256").update(value).digest("hex");

package/services/access/types/errors.js

@@ -0,0 +1,7 @@
+export class AccessError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}

package/services/access/types/ingress.js

@@ -0,0 +1 @@
+export {};

package/services/access/types/model.js

@@ -0,0 +1 @@
+export {};

package/services/access/types/native-errors.js

@@ -0,0 +1,7 @@
+export class NativeFailure extends Error {
+    code;
+    constructor(code) {
+        super(code);
+        this.code = code;
+    }
+}

package/services/access/types/native.js

@@ -0,0 +1 @@
+export {};

package/services/cloud/generated/client.gen.d.ts

@@ -0,0 +1,12 @@
+import { type Client, type ClientOptions, type Config } from '../../../generated/http/client/index.js';
+import type { ClientOptions as ClientOptions2 } from './types.gen.js';
+/**
+ * The `createClientConfig()` function will be called on client initialization
+ * and the returned object will become the client's initial configuration.
+ *
+ * You may want to initialize your client this way instead of calling
+ * `setConfig()`. This is useful for example if you're using Next.js
+ * to ensure your client always has the correct values.
+ */
+export type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (override?: Config<ClientOptions & T>) => Config<Required<ClientOptions> & T>;
+export declare const client: Client;

package/services/cloud/generated/client.gen.js

@@ -0,0 +1,3 @@
+// This file is auto-generated by @hey-api/openapi-ts
+import { createClient, createConfig } from '../../../generated/http/client/index.js';
+export const client = createClient(createConfig({ baseUrl: 'services' }));

package/services/cloud/generated/index.d.ts

@@ -0,0 +1,2 @@
+export { beginConnectionSetupBrowser, callConnectorRuntime, cancelConnectionSetup, completeConnectionSetup, createConnection, describeConnectorRuntime, disconnectConnection, getAccount, getCliIdentity, getConnection, getConnectionSetup, getConnectionUsage, getConnector, getConnectorRuntimeInvocation, getConnectorRuntimeResultPage, getInstallation, getInstallationCredentials, getInstallationIdentity, getProvisioner, getRuntimeScope, getSession, health, listConnections, listConnectors, listInstallations, lookupConnectorRuntimeInvocation, maintainConnections, type Options, refreshConnection, registerInstallation, returnConnectionCallback, revokeInstallationCredential, revokeProvisioner, rotateInstallationCredential, rotateProvisioner, searchConnectorRuntime, startConnectionSetup, updateConnection } from './sdk.gen.js';
+export type { AdministratorAssertion, BeginConnectionSetupBrowserData, BeginConnectionSetupBrowserError, BeginConnectionSetupBrowserErrors, BeginConnectionSetupBrowserResponse, BeginConnectionSetupBrowserResponses, CallConnectorRuntimeData, CallConnectorRuntimeError, CallConnectorRuntimeErrors, CallConnectorRuntimeResponse, CallConnectorRuntimeResponses, CancelConnectionSetupData, CancelConnectionSetupError, CancelConnectionSetupErrors, CancelConnectionSetupResponse, CancelConnectionSetupResponses, ClientOptions, CompleteConnectionSetupData, CompleteConnectionSetupError, CompleteConnectionSetupErrors, CompleteConnectionSetupResponse, CompleteConnectionSetupResponses, Connection, ConnectionFailure, ConnectionId, ConnectionInvocation, ConnectionInvocationId, ConnectionList, ConnectionProblem, ConnectionReturnDestination, ConnectionRevision, ConnectionSetup, ConnectionSetupContinuation, ConnectionSetupId, ConnectionUsage, Connector, ConnectorActionDetail, ConnectorActionSummary, ConnectorAgentGrant, ConnectorId, ConnectorList, ConnectorResultPage, ConnectorResultReference, ConnectorResultUnavailable, ConnectorRuntimeCall, ConnectorRuntimeContext, ConnectorRuntimeDescribe, ConnectorRuntimeDescription, ConnectorRuntimeInvocation, ConnectorRuntimeInvocationLookup, ConnectorRuntimeMatch, ConnectorRuntimeResultPage, ConnectorRuntimeSearch, ConnectorRuntimeSearchGuidance, ConnectorRuntimeSearchResult, CreateConnection, CreateConnectionData, CreateConnectionError, CreateConnectionErrors, CreateConnectionResponse, CreateConnectionResponses, DescribeConnectorRuntimeData, DescribeConnectorRuntimeError, DescribeConnectorRuntimeErrors, DescribeConnectorRuntimeResponse, DescribeConnectorRuntimeResponses, DisconnectConnectionData, DisconnectConnectionError, DisconnectConnectionErrors, DisconnectConnectionResponse, DisconnectConnectionResponses, GetAccountData, GetAccountError, GetAccountErrors, GetAccountResponse, GetAccountResponses, GetCliIdentityData, GetCliIdentityError, GetCliIdentityErrors, GetCliIdentityResponse, GetCliIdentityResponses, GetConnectionData, GetConnectionError, GetConnectionErrors, GetConnectionResponse, GetConnectionResponses, GetConnectionSetupData, GetConnectionSetupError, GetConnectionSetupErrors, GetConnectionSetupResponse, GetConnectionSetupResponses, GetConnectionUsageData, GetConnectionUsageError, GetConnectionUsageErrors, GetConnectionUsageResponse, GetConnectionUsageResponses, GetConnectorData, GetConnectorError, GetConnectorErrors, GetConnectorResponse, GetConnectorResponses, GetConnectorRuntimeInvocationData, GetConnectorRuntimeInvocationError, GetConnectorRuntimeInvocationErrors, GetConnectorRuntimeInvocationResponse, GetConnectorRuntimeInvocationResponses, GetConnectorRuntimeResultPageData, GetConnectorRuntimeResultPageError, GetConnectorRuntimeResultPageErrors, GetConnectorRuntimeResultPageResponse, GetConnectorRuntimeResultPageResponses, GetInstallationCredentialsData, GetInstallationCredentialsError, GetInstallationCredentialsErrors, GetInstallationCredentialsResponse, GetInstallationCredentialsResponses, GetInstallationData, GetInstallationError, GetInstallationErrors, GetInstallationIdentityData, GetInstallationIdentityError, GetInstallationIdentityErrors, GetInstallationIdentityResponse, GetInstallationIdentityResponses, GetInstallationResponse, GetInstallationResponses, GetProvisionerData, GetProvisionerError, GetProvisionerErrors, GetProvisionerResponse, GetProvisionerResponses, GetRuntimeScopeData, GetRuntimeScopeError, GetRuntimeScopeErrors, GetRuntimeScopeResponse, GetRuntimeScopeResponses, GetSessionData, GetSessionError, GetSessionErrors, GetSessionResponse, GetSessionResponses, HealthData, HealthResponse, HealthResponses, Id, IdempotencyKey, Installation, ListConnectionsData, ListConnectionsError, ListConnectionsErrors, ListConnectionsResponse, ListConnectionsResponses, ListConnectorsData, ListConnectorsError, ListConnectorsErrors, ListConnectorsResponse, ListConnectorsResponses, ListInstallationsData, ListInstallationsError, ListInstallationsErrors, ListInstallationsResponse, ListInstallationsResponses, LookupConnectorRuntimeInvocationData, LookupConnectorRuntimeInvocationError, LookupConnectorRuntimeInvocationErrors, LookupConnectorRuntimeInvocationResponse, LookupConnectorRuntimeInvocationResponses, MaintainConnectionsData, MaintainConnectionsError, MaintainConnectionsErrors, MaintainConnectionsResponse, MaintainConnectionsResponses, Problem, RefreshConnectionData, RefreshConnectionError, RefreshConnectionErrors, RefreshConnectionResponse, RefreshConnectionResponses, RegisterInstallationData, RegisterInstallationError, RegisterInstallationErrors, RegisterInstallationResponse, RegisterInstallationResponses, RetryGuidance, ReturnConnectionCallbackData, ReturnConnectionCallbackError, ReturnConnectionCallbackErrors, ReturnConnectionCallbackResponse, ReturnConnectionCallbackResponses, RevokeInstallationCredentialData, RevokeInstallationCredentialError, RevokeInstallationCredentialErrors, RevokeInstallationCredentialResponse, RevokeInstallationCredentialResponses, RevokeProvisionerData, RevokeProvisionerError, RevokeProvisionerErrors, RevokeProvisionerResponse, RevokeProvisionerResponses, RotateInstallationCredentialData, RotateInstallationCredentialError, RotateInstallationCredentialErrors, RotateInstallationCredentialResponse, RotateInstallationCredentialResponses, RotateProvisionerData, RotateProvisionerError, RotateProvisionerErrors, RotateProvisionerResponse, RotateProvisionerResponses, SearchConnectorRuntimeData, SearchConnectorRuntimeError, SearchConnectorRuntimeErrors, SearchConnectorRuntimeResponse, SearchConnectorRuntimeResponses, StartConnectionSetup, StartConnectionSetupData, StartConnectionSetupError, StartConnectionSetupErrors, StartConnectionSetupResponse, StartConnectionSetupResponses, UpdateConnection, UpdateConnectionData, UpdateConnectionError, UpdateConnectionErrors, UpdateConnectionResponse, UpdateConnectionResponses } from './types.gen.js';

package/services/cloud/generated/index.js

@@ -0,0 +1,2 @@
+// This file is auto-generated by @hey-api/openapi-ts
+export { beginConnectionSetupBrowser, callConnectorRuntime, cancelConnectionSetup, completeConnectionSetup, createConnection, describeConnectorRuntime, disconnectConnection, getAccount, getCliIdentity, getConnection, getConnectionSetup, getConnectionUsage, getConnector, getConnectorRuntimeInvocation, getConnectorRuntimeResultPage, getInstallation, getInstallationCredentials, getInstallationIdentity, getProvisioner, getRuntimeScope, getSession, health, listConnections, listConnectors, listInstallations, lookupConnectorRuntimeInvocation, maintainConnections, refreshConnection, registerInstallation, returnConnectionCallback, revokeInstallationCredential, revokeProvisioner, rotateInstallationCredential, rotateProvisioner, searchConnectorRuntime, startConnectionSetup, updateConnection } from './sdk.gen.js';

package/services/cloud/generated/sdk.gen.d.ts

@@ -0,0 +1,145 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from '../../../generated/http/client/index.js';
+import type { BeginConnectionSetupBrowserData, BeginConnectionSetupBrowserErrors, BeginConnectionSetupBrowserResponses, CallConnectorRuntimeData, CallConnectorRuntimeErrors, CallConnectorRuntimeResponses, CancelConnectionSetupData, CancelConnectionSetupErrors, CancelConnectionSetupResponses, CompleteConnectionSetupData, CompleteConnectionSetupErrors, CompleteConnectionSetupResponses, CreateConnectionData, CreateConnectionErrors, CreateConnectionResponses, DescribeConnectorRuntimeData, DescribeConnectorRuntimeErrors, DescribeConnectorRuntimeResponses, DisconnectConnectionData, DisconnectConnectionErrors, DisconnectConnectionResponses, GetAccountData, GetAccountErrors, GetAccountResponses, GetCliIdentityData, GetCliIdentityErrors, GetCliIdentityResponses, GetConnectionData, GetConnectionErrors, GetConnectionResponses, GetConnectionSetupData, GetConnectionSetupErrors, GetConnectionSetupResponses, GetConnectionUsageData, GetConnectionUsageErrors, GetConnectionUsageResponses, GetConnectorData, GetConnectorErrors, GetConnectorResponses, GetConnectorRuntimeInvocationData, GetConnectorRuntimeInvocationErrors, GetConnectorRuntimeInvocationResponses, GetConnectorRuntimeResultPageData, GetConnectorRuntimeResultPageErrors, GetConnectorRuntimeResultPageResponses, GetInstallationCredentialsData, GetInstallationCredentialsErrors, GetInstallationCredentialsResponses, GetInstallationData, GetInstallationErrors, GetInstallationIdentityData, GetInstallationIdentityErrors, GetInstallationIdentityResponses, GetInstallationResponses, GetProvisionerData, GetProvisionerErrors, GetProvisionerResponses, GetRuntimeScopeData, GetRuntimeScopeErrors, GetRuntimeScopeResponses, GetSessionData, GetSessionErrors, GetSessionResponses, HealthData, HealthResponses, ListConnectionsData, ListConnectionsErrors, ListConnectionsResponses, ListConnectorsData, ListConnectorsErrors, ListConnectorsResponses, ListInstallationsData, ListInstallationsErrors, ListInstallationsResponses, LookupConnectorRuntimeInvocationData, LookupConnectorRuntimeInvocationErrors, LookupConnectorRuntimeInvocationResponses, MaintainConnectionsData, MaintainConnectionsErrors, MaintainConnectionsResponses, RefreshConnectionData, RefreshConnectionErrors, RefreshConnectionResponses, RegisterInstallationData, RegisterInstallationErrors, RegisterInstallationResponses, ReturnConnectionCallbackData, ReturnConnectionCallbackErrors, ReturnConnectionCallbackResponses, RevokeInstallationCredentialData, RevokeInstallationCredentialErrors, RevokeInstallationCredentialResponses, RevokeProvisionerData, RevokeProvisionerErrors, RevokeProvisionerResponses, RotateInstallationCredentialData, RotateInstallationCredentialErrors, RotateInstallationCredentialResponses, RotateProvisionerData, RotateProvisionerErrors, RotateProvisionerResponses, SearchConnectorRuntimeData, SearchConnectorRuntimeErrors, SearchConnectorRuntimeResponses, StartConnectionSetupData, StartConnectionSetupErrors, StartConnectionSetupResponses, UpdateConnectionData, UpdateConnectionErrors, UpdateConnectionResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare const health: <ThrowOnError extends boolean = false>(options?: Options<HealthData, ThrowOnError>) => RequestResult<HealthResponses, unknown, ThrowOnError>;
+export declare const getSession: <ThrowOnError extends boolean = false>(options?: Options<GetSessionData, ThrowOnError>) => RequestResult<GetSessionResponses, GetSessionErrors, ThrowOnError>;
+export declare const listInstallations: <ThrowOnError extends boolean = false>(options?: Options<ListInstallationsData, ThrowOnError>) => RequestResult<ListInstallationsResponses, ListInstallationsErrors, ThrowOnError>;
+export declare const registerInstallation: <ThrowOnError extends boolean = false>(options: Options<RegisterInstallationData, ThrowOnError>) => RequestResult<RegisterInstallationResponses, RegisterInstallationErrors, ThrowOnError>;
+export declare const getInstallation: <ThrowOnError extends boolean = false>(options: Options<GetInstallationData, ThrowOnError>) => RequestResult<GetInstallationResponses, GetInstallationErrors, ThrowOnError>;
+export declare const getInstallationIdentity: <ThrowOnError extends boolean = false>(options: Options<GetInstallationIdentityData, ThrowOnError>) => RequestResult<GetInstallationIdentityResponses, GetInstallationIdentityErrors, ThrowOnError>;
+export declare const revokeInstallationCredential: <ThrowOnError extends boolean = false>(options: Options<RevokeInstallationCredentialData, ThrowOnError>) => RequestResult<RevokeInstallationCredentialResponses, RevokeInstallationCredentialErrors, ThrowOnError>;
+export declare const rotateInstallationCredential: <ThrowOnError extends boolean = false>(options: Options<RotateInstallationCredentialData, ThrowOnError>) => RequestResult<RotateInstallationCredentialResponses, RotateInstallationCredentialErrors, ThrowOnError>;
+export declare const revokeProvisioner: <ThrowOnError extends boolean = false>(options?: Options<RevokeProvisionerData, ThrowOnError>) => RequestResult<RevokeProvisionerResponses, RevokeProvisionerErrors, ThrowOnError>;
+export declare const getProvisioner: <ThrowOnError extends boolean = false>(options?: Options<GetProvisionerData, ThrowOnError>) => RequestResult<GetProvisionerResponses, GetProvisionerErrors, ThrowOnError>;
+export declare const rotateProvisioner: <ThrowOnError extends boolean = false>(options: Options<RotateProvisionerData, ThrowOnError>) => RequestResult<RotateProvisionerResponses, RotateProvisionerErrors, ThrowOnError>;
+export declare const getRuntimeScope: <ThrowOnError extends boolean = false>(options?: Options<GetRuntimeScopeData, ThrowOnError>) => RequestResult<GetRuntimeScopeResponses, GetRuntimeScopeErrors, ThrowOnError>;
+export declare const getInstallationCredentials: <ThrowOnError extends boolean = false>(options: Options<GetInstallationCredentialsData, ThrowOnError>) => RequestResult<GetInstallationCredentialsResponses, GetInstallationCredentialsErrors, ThrowOnError>;
+export declare const getCliIdentity: <ThrowOnError extends boolean = false>(options?: Options<GetCliIdentityData, ThrowOnError>) => RequestResult<GetCliIdentityResponses, GetCliIdentityErrors, ThrowOnError>;
+export declare const getAccount: <ThrowOnError extends boolean = false>(options?: Options<GetAccountData, ThrowOnError>) => RequestResult<GetAccountResponses, GetAccountErrors, ThrowOnError>;
+/**
+ * Browse available connectors
+ *
+ * Selected connector contract. Unavailable until the complete service and customer journey are wired and qualified.
+ */
+export declare const listConnectors: <ThrowOnError extends boolean = false>(options: Options<ListConnectorsData, ThrowOnError>) => RequestResult<ListConnectorsResponses, ListConnectorsErrors, ThrowOnError>;
+/**
+ * Read connector metadata
+ *
+ * Selected connector contract. Unavailable until the complete service and customer journey are wired and qualified.
+ */
+export declare const getConnector: <ThrowOnError extends boolean = false>(options: Options<GetConnectorData, ThrowOnError>) => RequestResult<GetConnectorResponses, GetConnectorErrors, ThrowOnError>;
+/**
+ * List server connections
+ *
+ * Return connection metadata and setup status after verifying current native administrator authority. Credentials and setup continuation URLs are excluded. A failed read never establishes an empty collection.
+ */
+export declare const listConnections: <ThrowOnError extends boolean = false>(options: Options<ListConnectionsData, ThrowOnError>) => RequestResult<ListConnectionsResponses, ListConnectionsErrors, ThrowOnError>;
+/**
+ * Create a named connection
+ *
+ * Create a named server-owned connection after verifying current native administrator authority. This neither authorizes a provider account nor starts external authentication. Agent grants are checked before activation. Identical authorized retries return the same record.
+ */
+export declare const createConnection: <ThrowOnError extends boolean = false>(options: Options<CreateConnectionData, ThrowOnError>) => RequestResult<CreateConnectionResponses, CreateConnectionErrors, ThrowOnError>;
+/**
+ * Disconnect an account
+ *
+ * Revoke local use immediately and cancel pending setup. Provider cleanup is durable and may complete later. Never continue granting local use because provider deletion failed. Retain receipts and exact cleanup references.
+ */
+export declare const disconnectConnection: <ThrowOnError extends boolean = false>(options: Options<DisconnectConnectionData, ThrowOnError>) => RequestResult<DisconnectConnectionResponses, DisconnectConnectionErrors, ThrowOnError>;
+/**
+ * Read a connection
+ *
+ * Read a named connection's agent grant, state, revision, setup and cleanup status, and safe failure summary. Recheck effective native administrator authority before reading. Credentials and setup continuation URLs are never included.
+ */
+export declare const getConnection: <ThrowOnError extends boolean = false>(options: Options<GetConnectionData, ThrowOnError>) => RequestResult<GetConnectionResponses, GetConnectionErrors, ThrowOnError>;
+/**
+ * Replace connection name and agent grant
+ *
+ * Replace both editable fields against the quoted current connection revision. Revocation and selected-agent changes take effect at the next broker boundary, including already pending operations.
+ */
+export declare const updateConnection: <ThrowOnError extends boolean = false>(options: Options<UpdateConnectionData, ThrowOnError>) => RequestResult<UpdateConnectionResponses, UpdateConnectionErrors, ThrowOnError>;
+/**
+ * Start connection or reconnection
+ *
+ * Persist one setup attempt before requesting its hosted authentication link. Admission and permission checks use ClawScarf state; setup performs no native management. Clients poll the returned setup and navigate to its continuation URL as soon as available. Account use remains disabled until callback identity, effective native administrator authority and selected agents are verified. Only its initiating user may continue. Reconnection keeps the current active account until the exact replacement is verified. A changed retry payload conflicts; uncertain setup creation is not blindly replayed. New attempts and provider preparation/allocation require the current published catalog. Authentication preparation has its own durable receipt; an uncertain preparation or allocation blocks replacement until resolved.
+ */
+export declare const startConnectionSetup: <ThrowOnError extends boolean = false>(options: Options<StartConnectionSetupData, ThrowOnError>) => RequestResult<StartConnectionSetupResponses, StartConnectionSetupErrors, ThrowOnError>;
+/**
+ * Cancel a setup attempt
+ *
+ * Idempotently cancel this exact setup attempt and schedule provider cleanup. A late callback cannot activate it. Completed setup cannot be cancelled; disconnect the connection explicitly.
+ */
+export declare const cancelConnectionSetup: <ThrowOnError extends boolean = false>(options: Options<CancelConnectionSetupData, ThrowOnError>) => RequestResult<CancelConnectionSetupResponses, CancelConnectionSetupErrors, ThrowOnError>;
+/**
+ * Read or continue a setup attempt
+ *
+ * Return current setup and its unexpired continuation URL only to the initiating user with current native administrator authority. This read never redeems a callback, creates an account or restarts expired setup.
+ */
+export declare const getConnectionSetup: <ThrowOnError extends boolean = false>(options: Options<GetConnectionSetupData, ThrowOnError>) => RequestResult<GetConnectionSetupResponses, GetConnectionSetupErrors, ThrowOnError>;
+/**
+ * Refresh connection status
+ *
+ * Observe the exact bound provider account after verifying native administrator authority and current revision. The initiator may finish an unexpired setup from a durably recorded identity receipt. Never redeem the callback again or infer identity from account status alone.
+ */
+export declare const refreshConnection: <ThrowOnError extends boolean = false>(options: Options<RefreshConnectionData, ThrowOnError>) => RequestResult<RefreshConnectionResponses, RefreshConnectionErrors, ThrowOnError>;
+/**
+ * Connector search
+ *
+ * Installation credential and trusted native agent context select currently permitted exact connections. Human cookies and CLI credentials are not accepted. No server identity is accepted in the payload.
+ */
+export declare const searchConnectorRuntime: <ThrowOnError extends boolean = false>(options: Options<SearchConnectorRuntimeData, ThrowOnError>) => RequestResult<SearchConnectorRuntimeResponses, SearchConnectorRuntimeErrors, ThrowOnError>;
+/**
+ * Connector describe
+ *
+ * Installation credential and trusted native agent context select currently permitted exact connections. Human cookies and CLI credentials are not accepted. No server identity is accepted in the payload.
+ */
+export declare const describeConnectorRuntime: <ThrowOnError extends boolean = false>(options: Options<DescribeConnectorRuntimeData, ThrowOnError>) => RequestResult<DescribeConnectorRuntimeResponses, DescribeConnectorRuntimeErrors, ThrowOnError>;
+/**
+ * Connector call
+ *
+ * Durable invocation identity is scoped to server credential, native session and toolCallId. Identical replay returns the existing receipt; changed arguments conflict. Never automatically redispatch an uncertain call. Exact connection generation must still be current. New dispatch also requires the published catalog and current action version; authorized receipt replay does not require retired catalog metadata.
+ */
+export declare const callConnectorRuntime: <ThrowOnError extends boolean = false>(options: Options<CallConnectorRuntimeData, ThrowOnError>) => RequestResult<CallConnectorRuntimeResponses, CallConnectorRuntimeErrors, ThrowOnError>;
+/**
+ * Recover an invocation result
+ *
+ * Read an existing result under the current server credential and matching agent grant. Never dispatch the operation again. Revoked connection generations do not regain access after native state restoration.
+ */
+export declare const getConnectorRuntimeInvocation: <ThrowOnError extends boolean = false>(options: Options<GetConnectorRuntimeInvocationData, ThrowOnError>) => RequestResult<GetConnectorRuntimeInvocationResponses, GetConnectorRuntimeInvocationErrors, ThrowOnError>;
+/**
+ * Read a bounded page of retained result JSON
+ *
+ * Read an existing result under the current server credential and matching agent grant. Never dispatch the operation again. Revoked connection generations do not regain access after native state restoration.
+ */
+export declare const getConnectorRuntimeResultPage: <ThrowOnError extends boolean = false>(options: Options<GetConnectorRuntimeResultPageData, ThrowOnError>) => RequestResult<GetConnectorRuntimeResultPageResponses, GetConnectorRuntimeResultPageErrors, ThrowOnError>;
+/**
+ * Find a receipt from its original native call identity
+ *
+ * Read an existing result under the current server credential and matching agent grant. Never dispatch the operation again. Revoked connection generations do not regain access after native state restoration.
+ */
+export declare const lookupConnectorRuntimeInvocation: <ThrowOnError extends boolean = false>(options: Options<LookupConnectorRuntimeInvocationData, ThrowOnError>) => RequestResult<LookupConnectorRuntimeInvocationResponses, LookupConnectorRuntimeInvocationErrors, ThrowOnError>;
+/**
+ * Submit the receipt from the returning browser after checking its current installation identity and native authority. Polling a setup cannot activate it.
+ */
+export declare const completeConnectionSetup: <ThrowOnError extends boolean = false>(options: Options<CompleteConnectionSetupData, ThrowOnError>) => RequestResult<CompleteConnectionSetupResponses, CompleteConnectionSetupErrors, ThrowOnError>;
+export declare const maintainConnections: <ThrowOnError extends boolean = false>(options?: Options<MaintainConnectionsData, ThrowOnError>) => RequestResult<MaintainConnectionsResponses, MaintainConnectionsErrors, ThrowOnError>;
+export declare const returnConnectionCallback: <ThrowOnError extends boolean = false>(options: Options<ReturnConnectionCallbackData, ThrowOnError>) => RequestResult<ReturnConnectionCallbackResponses, ReturnConnectionCallbackErrors, ThrowOnError>;
+export declare const beginConnectionSetupBrowser: <ThrowOnError extends boolean = false>(options: Options<BeginConnectionSetupBrowserData, ThrowOnError>) => RequestResult<BeginConnectionSetupBrowserResponses, BeginConnectionSetupBrowserErrors, ThrowOnError>;
+/**
+ * Read current execution allowance
+ *
+ * Current account and installation allowance for this installation. Shared provider budgets are private.
+ */
+export declare const getConnectionUsage: <ThrowOnError extends boolean = false>(options: Options<GetConnectionUsageData, ThrowOnError>) => RequestResult<GetConnectionUsageResponses, GetConnectionUsageErrors, ThrowOnError>;