@fragno-dev/backoffice-api 0.0.0-stage → 0.0.0

package/dist/v0/integrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.d.ts","names":[],"sources":["../../src/v0/integrations.ts"],"mappings":";;;cAOa;;;;cAKA,oCAAkC,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;cAoBlC,sCAAoC,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;cASpC,sCAAoC,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;;;;;;cAkBpC,kCAAgC,EAAA,QAAA,EAAA;;;;;cAYhC,+BAA6B,EAAA,QAAA,EAAA;cAW7B;gBAAA,EAAA,QAAA,EAAA;;cAIA,6BAA2B,EAAA,QAAA,EAAA;;;cAQ3B,6BAA2B,EAAA,QAAA,EAAA,mBAAA,EAAA,YAAA,EAAA,UAAA,EAAA,WAAA,EAAA;cAU3B,6BAA2B,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAc5B,wBAAwB,EAAE,cAAc;cAEvC,qBAAmB,EAAA,QAAA,EAAA;cAWnB,wCAAsC,EAAA,QAAA,EAAA;;;;cAMtC,6BAA2B,EAAA,QAAA,EAAA;;;;;;;;;;;KAoB5B,wBAAwB,EAAE,cAAc;;KAGxC,wBAAwB,EAAE,cAAc;;cAGvC,6BAA2B,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAe3B,qCAAmC,EAAA,QAAA,EAAA,YAAA,EAAA,UAAA,EAAA,WAAA,EAAA,QAAA,oBAAA,EAAA,KAAA,kBAAA;;KAKpC,gCAAgC,EAAE,cAAc;cAE/C,sCAAoC,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAUpC,6BAA2B,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAS3B,gCAA8B,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;KA4C/B,2BAA2B,EAAE,cAAc;;cAG1C,kCAAgC,EAAA,QAAA,EAAA;;;;cAOhC,6BAA2B,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;;;;KAY5B,wBAAwB,EAAE,cAAc;;cAGvC,kCAAgC,EAAA,QAAA,EAAA;;;;;cAchC,mCAAiC,EAAA,QAAA,EAAA;;;;;;;;KAYlC,8BAA8B,EAAE,cAAc;cAE7C,iDAA+C,EAAA,QAAA,EAAA;;;;;;;;;;;cAe/C,2BAAyB,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;KAmC1B,sBAAsB,EAAE,cAAc;;cAGrC,6BAA2B,EAAA,QAAA,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAyB5B,4BAA4B,EAAE,cAAc;;cAG3C,4BAA0B,EAAA,QAAA,EAAA;;;;cAU1B,+BAA6B,EAAA,QAAA,EAAA;;;;;;;;;;cAqB7B,mCAAiC,EAAA,QAAA,EAAA,uBAAA,EAAA;;;;;;;cAajC,yBAAuB,EAAA,QAAA,EAAA;;;;;;;;;;;;;;KAgBxB,oBAAoB,EAAE,cAAc;cAEnC,sCAAoC,EAAA,QAAA,EAAA;;;;;cAapC,yBAAuB,EAAA,QAAA,EAAA;;;;;;;cAcvB"}

package/dist/v0/integrations.js

@@ -0,0 +1,255 @@
+import { BACKOFFICE_PERMISSION } from "./shared/permissions.js";
+import { isoDateTimeOutputSchema } from "./shared/datetime.js";
+import { jsonValueSchema } from "./shared/json.js";
+import { z } from "zod";
+//#region src/v0/integrations.ts
+const integrationVerificationCheckShape = {
+	id: z.lazy(() => z.string().min(1)),
+	label: z.lazy(() => z.string())
+};
+const integrationVerificationCheckSchema = z.lazy(() => z.discriminatedUnion("status", [z.strictObject({
+	...integrationVerificationCheckShape,
+	status: z.literal("not-checked"),
+	reason: z.string()
+}), z.strictObject({
+	...integrationVerificationCheckShape,
+	status: z.enum(["passed", "failed"]),
+	checkedAt: isoDateTimeOutputSchema.describe("Time of the actual check, not configuration storage."),
+	message: z.string()
+})])).meta({ id: "IntegrationVerificationCheck" });
+const integrationConfigurationStatusSchema = z.lazy(() => z.discriminatedUnion("status", [z.strictObject({
+	status: z.literal("missing"),
+	missingFields: z.array(z.string())
+}), z.strictObject({ status: z.literal("configured") })])).meta({ id: "IntegrationConfigurationStatus" });
+const integrationAuthorizationStatusSchema = z.lazy(() => z.discriminatedUnion("status", [
+	z.strictObject({ status: z.literal("not-required") }),
+	z.strictObject({ status: z.literal("not-checked") }),
+	z.strictObject({ status: z.literal("missing") }),
+	z.strictObject({ status: z.literal("available").describe("Credentials or confirmed consent exist; this does not prove live service access.") }),
+	z.strictObject({ status: z.literal("expired") })
+])).meta({ id: "IntegrationAuthorizationStatus" });
+const integrationSetupSubmissionSchema = z.lazy(() => z.strictObject({
+	kind: z.literal("input"),
+	input: jsonValueSchema.describe("Direct JSON setup input validated against the source's current requirements. Null is a submitted value, never a check sentinel.").meta({ codemodeType: "JsonValue" })
+}));
+/** Connection IDs preserve source identity and resolve only within the selected execution scope. */
+const integrationConnectionIdSchema = z.lazy(() => z.string().regex(/^[a-z][a-z0-9-]*#[\s\S]+$/, "Integration connection ID must be namespace#local-id.").describe("Deterministic scoped address such as backoffice#reson8, not a credential or a separately revocable binding. The suffix preserves the source's identity.")).meta({ id: "IntegrationConnectionId" });
+const integrationSetupProgressShape = { connectionId: integrationConnectionIdSchema };
+const integrationSetupCheckSchema = z.lazy(() => z.strictObject({ kind: z.literal("check").describe("Read authoritative setup state; user confirmation is not proof of consent.") }));
+const integrationJsonSchemaSchema = z.lazy(() => z.union([z.boolean(), z.record(z.string(), z.unknown())]).describe("Authoritative JSON Schema supplied by the integration, never inferred from an action ID.")).meta({ id: "IntegrationJsonSchema" });
+const integrationInspectionSchema = z.lazy(() => z.strictObject({
+	configuration: integrationConfigurationStatusSchema,
+	authorization: integrationAuthorizationStatusSchema,
+	checks: z.array(integrationVerificationCheckSchema).describe("Supported checks distinguish missing evidence from actual timestamped results; saved configuration alone proves no live health."),
+	nextSteps: z.array(z.string())
+}));
+const integrationIdSchema = z.lazy(() => z.string().min(1).describe("Service identity returned by discover; it does not identify an integration mechanism.")).meta({ id: "IntegrationId" });
+const integrationConnectionSetupTargetSchema = z.lazy(() => z.strictObject({
+	kind: z.literal("connection"),
+	connectionId: integrationConnectionIdSchema
+})).meta({ id: "IntegrationConnectionSetupTarget" });
+const integrationAuthMethodSchema = z.lazy(() => z.enum([
+	"none",
+	"api-key",
+	"bearer",
+	"basic",
+	"client-credentials",
+	"oauth",
+	"signature",
+	"app-installation"
+]).describe("How the connection authenticates to its provider; for inbound webhooks, how deliveries authenticate. Signature means an HMAC-signed body.")).meta({ id: "IntegrationAuthMethod" });
+/** Integration connection identity is supplied by the runtime, not by private adapter inspection. */
+const integrationConnectionSchema = z.lazy(() => integrationInspectionSchema._zod.innerType.extend({
+	connectionId: integrationConnectionIdSchema,
+	integrationId: integrationIdSchema,
+	name: z.string(),
+	authMethod: integrationAuthMethodSchema.nullable().describe("Null while nothing stored at the address chooses a method, such as before API setup.")
+})).meta({ id: "IntegrationConnection" });
+const integrationConnectionSettingsSchema = z.lazy(() => z.record(z.string(), jsonValueSchema).nullable()).meta({ id: "IntegrationConnectionSettings" });
+const inspectedIntegrationConnectionSchema = z.lazy(() => integrationConnectionSchema._zod.innerType.extend({ settings: integrationConnectionSettingsSchema.describe("Stored values that are not secret, shaped like this connection's reconfigure input. Start a replacement from them, change what was asked, and supply secrets and omitted fields again. Null when the source takes no replacement or nothing is stored.") })).meta({ id: "InspectedIntegrationConnection" });
+const configuredIntegrationSchema = z.lazy(() => integrationConnectionSchema._zod.innerType.extend({ configuration: z.strictObject({ status: z.literal("configured") }) })).meta({ id: "ConfiguredIntegrationConnection" });
+/** Public integration setup progress never exposes private continuation state or binding data. */
+const integrationSetupProgressSchema = z.lazy(() => z.discriminatedUnion("status", [
+	z.strictObject({
+		...integrationSetupProgressShape,
+		status: z.literal("needs-input"),
+		instructions: z.string(),
+		inputSchema: integrationJsonSchemaSchema,
+		secretFields: z.array(z.string()).describe("Secret property names for input controls, as dot-separated paths when nested; never secret values.")
+	}),
+	z.strictObject({
+		...integrationSetupProgressShape,
+		status: z.literal("needs-authorization"),
+		instructions: z.string(),
+		authorizationUrl: z.url()
+	}),
+	z.strictObject({
+		...integrationSetupProgressShape,
+		status: z.literal("pending"),
+		message: z.string()
+	}),
+	z.strictObject({
+		...integrationSetupProgressShape,
+		status: z.literal("ready")
+	}),
+	z.strictObject({
+		...integrationSetupProgressShape,
+		status: z.literal("blocked"),
+		reason: z.string()
+	}),
+	z.strictObject({
+		...integrationSetupProgressShape,
+		status: z.literal("expired"),
+		reason: z.string()
+	})
+])).meta({ id: "IntegrationSetupProgress" });
+/** Connection operations select an address, never a caller-supplied owner scope. */
+const integrationConnectionInputSchema = z.lazy(() => z.strictObject({ connectionId: integrationConnectionIdSchema }));
+/** Named setup distinguishes checking source-owned state from submitting any JSON value, including null. */
+const integrationSetupInputSchema = z.lazy(() => z.discriminatedUnion("kind", [integrationSetupCheckSchema._zod.innerType.extend(integrationConnectionInputSchema._zod.innerType.shape), integrationSetupSubmissionSchema._zod.innerType.extend(integrationConnectionInputSchema._zod.innerType.shape)]));
+/** Disconnecting repeats the address, so removal is never a side effect of an edited command. */
+const integrationDisconnectInputSchema = z.lazy(() => integrationConnectionInputSchema._zod.innerType.extend({ confirm: integrationConnectionIdSchema.describe("Repeat connectionId to confirm removing its source-owned configuration and credentials.") }).refine((input) => input.confirm === input.connectionId, {
+	message: "Integration disconnect confirmation must repeat the connection ID.",
+	path: ["confirm"]
+}));
+/** Disconnect results report source state; the address stays valid for a later setup. */
+const integrationDisconnectResultSchema = z.lazy(() => z.strictObject({
+	connectionId: integrationConnectionIdSchema,
+	status: z.enum(["disconnected", "not-configured"]).describe("Not-configured means nothing was stored at this address in the selected scope.")
+})).meta({ id: "IntegrationDisconnectResult" });
+const integrationConnectionEventsBackfillResultSchema = z.lazy(() => z.strictObject({ connections: z.array(z.strictObject({
+	connectionId: integrationConnectionIdSchema,
+	service: integrationIdSchema,
+	state: z.enum(["ready", "unavailable"])
+})) })).meta({ id: "IntegrationConnectionEventsBackfillResult" });
+/** Integration discovery reports service availability in the selected scope, not live health. */
+const integrationOverviewSchema = z.lazy(() => z.strictObject({
+	id: integrationIdSchema,
+	label: z.string(),
+	description: z.string(),
+	connectionCardinality: z.enum(["singleton", "multiple"]).describe("Singleton means one scoped configuration; multiple means separately selectable connections. Credentials remain in their existing service-owned stores."),
+	availability: z.discriminatedUnion("status", [z.strictObject({ status: z.literal("available") }), z.strictObject({
+		status: z.literal("unavailable"),
+		reason: z.string()
+	})]).describe("Whether this service's configuration store is available in the selected scope, not whether credentials are present or live service access works.").meta({ id: "IntegrationAvailability" }),
+	setupTargets: z.array(integrationConnectionSetupTargetSchema).describe("Known named setup targets, including unconfigured fixed slots; never invented account or attempt IDs."),
+	automationEvents: z.array(z.strictObject({
+		source: z.string(),
+		eventType: z.string()
+	})).describe("Source-specific activity events; declared identities do not prove live event delivery. Connection state changes arrive for every service as source integrations, keyed by subject.connectionId.")
+})).meta({ id: "IntegrationOverview" });
+/** Integration list pages project existing configured connections, not independent binding records. */
+const integrationListOutputSchema = z.lazy(() => z.strictObject({
+	connections: z.array(configuredIntegrationSchema),
+	unavailableSources: z.array(z.strictObject({
+		source: z.string().describe("Addresses the source owns: `namespace#` for a whole namespace, or one exact connection ID."),
+		reason: z.string()
+	})).describe("Sources that failed to list in this page. Their connections are missing from the listing, not removed; list again later."),
+	cursor: z.string().nullable().describe("Null means all configured integrations in this scope have been listed.")
+}));
+/** Integration listing starts with a null cursor and never selects an adapter. */
+const integrationListInputSchema = z.lazy(() => z.strictObject({ cursor: z.string().nullable().describe("Null starts the scoped listing; use the returned next cursor.") }));
+/** Action values are JSON; action-specific validation still precedes service side effects. */
+const integrationExecuteInputSchema = z.lazy(() => integrationConnectionInputSchema._zod.innerType.extend({
+	actionId: z.string().min(1),
+	input: jsonValueSchema.describe("JSON action input, validated against the live action schema before dispatch. Binary inputs use schema-declared byte arrays of integers 0–255, never ArrayBuffer or typed arrays; implementations convert them privately.").meta({ codemodeType: "JsonValue" }),
+	unchecked: z.boolean().default(false).describe("Required to run an action whose validation is unchecked: its input and output skip validation and the service alone rejects bad input. Checked actions validate regardless.")
+}));
+/**
+* Whether execution validates an action against its schemas. Unchecked actions publish contracts
+* that cannot be validated faithfully, so callers must opt in to running them.
+*/
+const integrationActionValidationSchema = z.lazy(() => z.discriminatedUnion("kind", [z.strictObject({ kind: z.literal("checked") }), z.strictObject({
+	kind: z.literal("unchecked"),
+	reason: z.string().describe("Why the published schemas cannot be validated.")
+})])).meta({ id: "IntegrationActionValidation" });
+/** Integration action schemas describe the operation's own result, including asynchronous job handles. */
+const integrationActionSchema = z.lazy(() => z.strictObject({
+	id: z.string().min(1).describe("Action identity returned by actions for this connection."),
+	label: z.string(),
+	description: z.string(),
+	validation: integrationActionValidationSchema,
+	inputSchema: integrationJsonSchemaSchema,
+	outputSchema: integrationJsonSchemaSchema.describe("Describes the action's own result, including any asynchronous job handle.")
+})).meta({ id: "IntegrationAction" });
+const integrationGenerateClientInputSchema = z.lazy(() => integrationConnectionInputSchema._zod.innerType.extend({ out: z.string().trim().min(1).describe("Absolute path of the .js module to write under /workspace. Only a module this operation generated is replaced.") }));
+/** Generated clients are snapshots of the connection's action contracts. */
+const integrationClientSchema = z.lazy(() => z.strictObject({
+	path: z.string(),
+	exports: z.array(z.strictObject({
+		name: z.string().describe("Exported function name."),
+		actionId: z.string().describe("Action the function executes.")
+	}))
+})).meta({ id: "IntegrationClient" });
+const integrationsOperations = {
+	"integrations.discover": {
+		description: "Discover available services and unconfigured services in the selected scope. Service availability does not prove live health.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.read],
+		input: z.void(),
+		output: z.lazy(() => z.array(integrationOverviewSchema))
+	},
+	"integrations.list": {
+		description: "List existing configured connections in the selected scope, one cursor page at a time. Deterministic IDs reuse source-owned identities; configuration does not imply live access.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.read],
+		input: integrationListInputSchema,
+		output: integrationListOutputSchema
+	},
+	"integrations.get": {
+		description: "Inspect source-owned connection configuration, its stored non-secret settings, and available evidence without performing a live health check. The connection ID resolves only within the selected scope.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.read],
+		input: integrationConnectionInputSchema,
+		output: inspectedIntegrationConnectionSchema
+	},
+	"integrations.setup": {
+		description: "Read current requirements or submit input for a deterministic connection address. Setup is source-owned; this operation retains no attempt state or independent binding. Ready connections keep their configuration and credentials; reconfigure replaces them.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.manage],
+		input: integrationSetupInputSchema,
+		output: integrationSetupProgressSchema
+	},
+	"integrations.reconfigure": {
+		description: "Read replacement requirements or submit replacement configuration or credentials for an existing connection. Build the replacement from integrations.get settings so unchanged values carry over. Submission replaces source-owned state; continue with setup checks until ready. A missing connection needs setup.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.manage],
+		input: integrationSetupInputSchema,
+		output: integrationSetupProgressSchema
+	},
+	"integrations.disconnect": {
+		description: "Remove a connection's source-owned configuration and credentials in the selected scope. The address stays valid for a later setup. Requires confirm to repeat the connection ID.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.manage],
+		input: integrationDisconnectInputSchema,
+		output: integrationDisconnectResultSchema
+	},
+	"integrations.backfillConnectionEvents": {
+		description: "Record every configured connection's current state in the selected scope as an integrations.connection.ready or connection.unavailable event, for connections that existed before those events were recorded. Routes on those events run for each new event. Events carry each connection's name and auth method. A rerun records a connection again only when its state, name, or auth method differs from every earlier backfill of it, so a rerun adds names to connections recorded before events carried them.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.manage],
+		input: z.void(),
+		output: integrationConnectionEventsBackfillResultSchema
+	},
+	"integrations.actions": {
+		description: "Discover the selected connection's supported actions and authoritative input/output contracts without executing them. Never infer schemas from action IDs.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.read],
+		input: integrationConnectionInputSchema,
+		output: z.lazy(() => z.array(integrationActionSchema))
+	},
+	"integrations.execute": {
+		description: "Execute an explicit connection action with JSON input/output, validated against its live contracts and service permissions. Unchecked actions run only with unchecked: true. Binary inputs are schema-declared byte arrays; results retain the action's domain and asynchronous semantics.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.execute],
+		input: integrationExecuteInputSchema,
+		output: jsonValueSchema.meta({ codemodeType: "JsonValue" })
+	},
+	"integrations.generateClient": {
+		description: "Write a JavaScript module with one typed async function per action of the selected connection, for codemode and saved modules to import. Each function calls integrations.execute; its JSDoc types snapshot the action contracts, so regenerate after the connection's actions change.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.read, BACKOFFICE_PERMISSION.upload.modify],
+		input: integrationGenerateClientInputSchema,
+		output: integrationClientSchema
+	},
+	"integrations.verify": {
+		description: "Perform explicit supported live checks without authorizing the connection or executing service actions. Return timestamped evidence, not blanket health or retained verification state.",
+		permissions: [BACKOFFICE_PERMISSION.integrations.manage],
+		input: integrationConnectionInputSchema,
+		output: integrationConnectionSchema
+	}
+};
+//#endregion
+export { configuredIntegrationSchema, inspectedIntegrationConnectionSchema, integrationActionSchema, integrationActionValidationSchema, integrationAuthMethodSchema, integrationAuthorizationStatusSchema, integrationClientSchema, integrationConfigurationStatusSchema, integrationConnectionEventsBackfillResultSchema, integrationConnectionIdSchema, integrationConnectionInputSchema, integrationConnectionSchema, integrationConnectionSettingsSchema, integrationConnectionSetupTargetSchema, integrationDisconnectInputSchema, integrationDisconnectResultSchema, integrationExecuteInputSchema, integrationGenerateClientInputSchema, integrationIdSchema, integrationInspectionSchema, integrationJsonSchemaSchema, integrationListInputSchema, integrationListOutputSchema, integrationOverviewSchema, integrationSetupCheckSchema, integrationSetupInputSchema, integrationSetupProgressSchema, integrationSetupProgressShape, integrationSetupSubmissionSchema, integrationVerificationCheckSchema, integrationVerificationCheckShape, integrationsOperations };
+
+//# sourceMappingURL=integrations.js.map

package/dist/v0/integrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrations.js","names":[],"sources":["../../src/v0/integrations.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport type { BackofficeApiOperation } from \"../api\";\nimport { isoDateTimeOutputSchema } from \"./shared/datetime\";\nimport { jsonValueSchema } from \"./shared/json\";\nimport { BACKOFFICE_PERMISSION } from \"./shared/permissions\";\n\nexport const integrationVerificationCheckShape = {\n  id: z.lazy(() => z.string().min(1)),\n  label: z.lazy(() => z.string()),\n};\n\nexport const integrationVerificationCheckSchema = z\n  .lazy(() =>\n    z.discriminatedUnion(\"status\", [\n      z.strictObject({\n        ...integrationVerificationCheckShape,\n        status: z.literal(\"not-checked\"),\n        reason: z.string(),\n      }),\n      z.strictObject({\n        ...integrationVerificationCheckShape,\n        status: z.enum([\"passed\", \"failed\"]),\n        checkedAt: isoDateTimeOutputSchema.describe(\n          \"Time of the actual check, not configuration storage.\",\n        ),\n        message: z.string(),\n      }),\n    ]),\n  )\n  .meta({ id: \"IntegrationVerificationCheck\" });\n\nexport const integrationConfigurationStatusSchema = z\n  .lazy(() =>\n    z.discriminatedUnion(\"status\", [\n      z.strictObject({ status: z.literal(\"missing\"), missingFields: z.array(z.string()) }),\n      z.strictObject({ status: z.literal(\"configured\") }),\n    ]),\n  )\n  .meta({ id: \"IntegrationConfigurationStatus\" });\n\nexport const integrationAuthorizationStatusSchema = z\n  .lazy(() =>\n    z.discriminatedUnion(\"status\", [\n      z.strictObject({ status: z.literal(\"not-required\") }),\n      z.strictObject({ status: z.literal(\"not-checked\") }),\n      z.strictObject({ status: z.literal(\"missing\") }),\n      z.strictObject({\n        status: z\n          .literal(\"available\")\n          .describe(\n            \"Credentials or confirmed consent exist; this does not prove live service access.\",\n          ),\n      }),\n      z.strictObject({ status: z.literal(\"expired\") }),\n    ]),\n  )\n  .meta({ id: \"IntegrationAuthorizationStatus\" });\n\nexport const integrationSetupSubmissionSchema = z.lazy(() =>\n  z.strictObject({\n    kind: z.literal(\"input\"),\n    input: jsonValueSchema\n      .describe(\n        \"Direct JSON setup input validated against the source's current requirements. Null is a submitted value, never a check sentinel.\",\n      )\n      .meta({ codemodeType: \"JsonValue\" }),\n  }),\n);\n\n/** Connection IDs preserve source identity and resolve only within the selected execution scope. */\nexport const integrationConnectionIdSchema = z\n  .lazy(() =>\n    z\n      .string()\n      .regex(/^[a-z][a-z0-9-]*#[\\s\\S]+$/, \"Integration connection ID must be namespace#local-id.\")\n      .describe(\n        \"Deterministic scoped address such as backoffice#reson8, not a credential or a separately revocable binding. The suffix preserves the source's identity.\",\n      ),\n  )\n  .meta({ id: \"IntegrationConnectionId\" });\n\nexport const integrationSetupProgressShape = {\n  connectionId: integrationConnectionIdSchema,\n};\n\nexport const integrationSetupCheckSchema = z.lazy(() =>\n  z.strictObject({\n    kind: z\n      .literal(\"check\")\n      .describe(\"Read authoritative setup state; user confirmation is not proof of consent.\"),\n  }),\n);\n\nexport const integrationJsonSchemaSchema = z\n  .lazy(() =>\n    z\n      .union([z.boolean(), z.record(z.string(), z.unknown())])\n      .describe(\n        \"Authoritative JSON Schema supplied by the integration, never inferred from an action ID.\",\n      ),\n  )\n  .meta({ id: \"IntegrationJsonSchema\" });\n\nexport const integrationInspectionSchema = z.lazy(() =>\n  z.strictObject({\n    configuration: integrationConfigurationStatusSchema,\n    authorization: integrationAuthorizationStatusSchema,\n    checks: z\n      .array(integrationVerificationCheckSchema)\n      .describe(\n        \"Supported checks distinguish missing evidence from actual timestamped results; saved configuration alone proves no live health.\",\n      ),\n    nextSteps: z.array(z.string()),\n  }),\n);\n\n/** Integration inspection excludes connection identity, which the runtime attaches separately. */\nexport type IntegrationInspection = z.output<typeof integrationInspectionSchema>;\n\nexport const integrationIdSchema = z\n  .lazy(() =>\n    z\n      .string()\n      .min(1)\n      .describe(\n        \"Service identity returned by discover; it does not identify an integration mechanism.\",\n      ),\n  )\n  .meta({ id: \"IntegrationId\" });\n\nexport const integrationConnectionSetupTargetSchema = z\n  .lazy(() =>\n    z.strictObject({ kind: z.literal(\"connection\"), connectionId: integrationConnectionIdSchema }),\n  )\n  .meta({ id: \"IntegrationConnectionSetupTarget\" });\n\nexport const integrationAuthMethodSchema = z\n  .lazy(() =>\n    z\n      .enum([\n        \"none\",\n        \"api-key\",\n        \"bearer\",\n        \"basic\",\n        \"client-credentials\",\n        \"oauth\",\n        \"signature\",\n        \"app-installation\",\n      ])\n      .describe(\n        \"How the connection authenticates to its provider; for inbound webhooks, how deliveries authenticate. Signature means an HMAC-signed body.\",\n      ),\n  )\n  .meta({ id: \"IntegrationAuthMethod\" });\n\n/** One vocabulary for every source's own auth configuration. */\nexport type IntegrationAuthMethod = z.output<typeof integrationAuthMethodSchema>;\n\n/** Public connection records describe source-owned configuration, never a facade-owned binding. */\nexport type IntegrationConnection = z.output<typeof integrationConnectionSchema>;\n\n/** Integration connection identity is supplied by the runtime, not by private adapter inspection. */\nexport const integrationConnectionSchema = z\n  .lazy(() =>\n    integrationInspectionSchema._zod.innerType.extend({\n      connectionId: integrationConnectionIdSchema,\n      integrationId: integrationIdSchema,\n      name: z.string(),\n      authMethod: integrationAuthMethodSchema\n        .nullable()\n        .describe(\n          \"Null while nothing stored at the address chooses a method, such as before API setup.\",\n        ),\n    }),\n  )\n  .meta({ id: \"IntegrationConnection\" });\n\nexport const integrationConnectionSettingsSchema = z\n  .lazy(() => z.record(z.string(), jsonValueSchema).nullable())\n  .meta({ id: \"IntegrationConnectionSettings\" });\n\n/** Source-owned settings a replacement can start from; they never contain secrets. */\nexport type IntegrationConnectionSettings = z.output<typeof integrationConnectionSettingsSchema>;\n\nexport const inspectedIntegrationConnectionSchema = z\n  .lazy(() =>\n    integrationConnectionSchema._zod.innerType.extend({\n      settings: integrationConnectionSettingsSchema.describe(\n        \"Stored values that are not secret, shaped like this connection's reconfigure input. Start a replacement from them, change what was asked, and supply secrets and omitted fields again. Null when the source takes no replacement or nothing is stored.\",\n      ),\n    }),\n  )\n  .meta({ id: \"InspectedIntegrationConnection\" });\n\nexport const configuredIntegrationSchema = z\n  .lazy(() =>\n    integrationConnectionSchema._zod.innerType.extend({\n      configuration: z.strictObject({ status: z.literal(\"configured\") }),\n    }),\n  )\n  .meta({ id: \"ConfiguredIntegrationConnection\" });\n\n/** Public integration setup progress never exposes private continuation state or binding data. */\nexport const integrationSetupProgressSchema = z\n  .lazy(() =>\n    z.discriminatedUnion(\"status\", [\n      z.strictObject({\n        ...integrationSetupProgressShape,\n        status: z.literal(\"needs-input\"),\n        instructions: z.string(),\n        inputSchema: integrationJsonSchemaSchema,\n        secretFields: z\n          .array(z.string())\n          .describe(\n            \"Secret property names for input controls, as dot-separated paths when nested; never secret values.\",\n          ),\n      }),\n      z.strictObject({\n        ...integrationSetupProgressShape,\n        status: z.literal(\"needs-authorization\"),\n        instructions: z.string(),\n        authorizationUrl: z.url(),\n      }),\n      z.strictObject({\n        ...integrationSetupProgressShape,\n        status: z.literal(\"pending\"),\n        message: z.string(),\n      }),\n      z.strictObject({\n        ...integrationSetupProgressShape,\n        status: z.literal(\"ready\"),\n      }),\n      z.strictObject({\n        ...integrationSetupProgressShape,\n        status: z.literal(\"blocked\"),\n        reason: z.string(),\n      }),\n      z.strictObject({\n        ...integrationSetupProgressShape,\n        status: z.literal(\"expired\"),\n        reason: z.string(),\n      }),\n    ]),\n  )\n  .meta({ id: \"IntegrationSetupProgress\" });\n\n/** Integration setup progress describes current requirements without exposing private continuation data. */\nexport type IntegrationSetupProgress = z.output<typeof integrationSetupProgressSchema>;\n\n/** Connection operations select an address, never a caller-supplied owner scope. */\nexport const integrationConnectionInputSchema = z.lazy(() =>\n  z.strictObject({\n    connectionId: integrationConnectionIdSchema,\n  }),\n);\n\n/** Named setup distinguishes checking source-owned state from submitting any JSON value, including null. */\nexport const integrationSetupInputSchema = z.lazy(() =>\n  z.discriminatedUnion(\"kind\", [\n    integrationSetupCheckSchema._zod.innerType.extend(\n      integrationConnectionInputSchema._zod.innerType.shape,\n    ),\n    integrationSetupSubmissionSchema._zod.innerType.extend(\n      integrationConnectionInputSchema._zod.innerType.shape,\n    ),\n  ]),\n);\n\n/** Setup requests select a scoped address and carry one explicit operation, without private continuation data. */\nexport type IntegrationSetupInput = z.output<typeof integrationSetupInputSchema>;\n\n/** Disconnecting repeats the address, so removal is never a side effect of an edited command. */\nexport const integrationDisconnectInputSchema = z.lazy(() =>\n  integrationConnectionInputSchema._zod.innerType\n    .extend({\n      confirm: integrationConnectionIdSchema.describe(\n        \"Repeat connectionId to confirm removing its source-owned configuration and credentials.\",\n      ),\n    })\n    .refine((input) => input.confirm === input.connectionId, {\n      message: \"Integration disconnect confirmation must repeat the connection ID.\",\n      path: [\"confirm\"],\n    }),\n);\n\n/** Disconnect results report source state; the address stays valid for a later setup. */\nexport const integrationDisconnectResultSchema = z\n  .lazy(() =>\n    z.strictObject({\n      connectionId: integrationConnectionIdSchema,\n      status: z\n        .enum([\"disconnected\", \"not-configured\"])\n        .describe(\"Not-configured means nothing was stored at this address in the selected scope.\"),\n    }),\n  )\n  .meta({ id: \"IntegrationDisconnectResult\" });\n\n/** Disconnect results never retain a removed connection's configuration. */\nexport type IntegrationDisconnectResult = z.output<typeof integrationDisconnectResultSchema>;\n\nexport const integrationConnectionEventsBackfillResultSchema = z\n  .lazy(() =>\n    z.strictObject({\n      connections: z.array(\n        z.strictObject({\n          connectionId: integrationConnectionIdSchema,\n          service: integrationIdSchema,\n          state: z.enum([\"ready\", \"unavailable\"]),\n        }),\n      ),\n    }),\n  )\n  .meta({ id: \"IntegrationConnectionEventsBackfillResult\" });\n\n/** Integration discovery reports service availability in the selected scope, not live health. */\nexport const integrationOverviewSchema = z\n  .lazy(() =>\n    z.strictObject({\n      id: integrationIdSchema,\n      label: z.string(),\n      description: z.string(),\n      connectionCardinality: z\n        .enum([\"singleton\", \"multiple\"])\n        .describe(\n          \"Singleton means one scoped configuration; multiple means separately selectable connections. Credentials remain in their existing service-owned stores.\",\n        ),\n      availability: z\n        .discriminatedUnion(\"status\", [\n          z.strictObject({ status: z.literal(\"available\") }),\n          z.strictObject({ status: z.literal(\"unavailable\"), reason: z.string() }),\n        ])\n        .describe(\n          \"Whether this service's configuration store is available in the selected scope, not whether credentials are present or live service access works.\",\n        )\n        .meta({ id: \"IntegrationAvailability\" }),\n      setupTargets: z\n        .array(integrationConnectionSetupTargetSchema)\n        .describe(\n          \"Known named setup targets, including unconfigured fixed slots; never invented account or attempt IDs.\",\n        ),\n      automationEvents: z\n        .array(z.strictObject({ source: z.string(), eventType: z.string() }))\n        .describe(\n          \"Source-specific activity events; declared identities do not prove live event delivery. Connection state changes arrive for every service as source integrations, keyed by subject.connectionId.\",\n        ),\n    }),\n  )\n  .meta({ id: \"IntegrationOverview\" });\n\n/** Integration discovery metadata has one canonical schema shared by tools and implementations. */\nexport type IntegrationOverview = z.output<typeof integrationOverviewSchema>;\n\n/** Integration list pages project existing configured connections, not independent binding records. */\nexport const integrationListOutputSchema = z.lazy(() =>\n  z.strictObject({\n    connections: z.array(configuredIntegrationSchema),\n    unavailableSources: z\n      .array(\n        z.strictObject({\n          source: z\n            .string()\n            .describe(\n              \"Addresses the source owns: `namespace#` for a whole namespace, or one exact connection ID.\",\n            ),\n          reason: z.string(),\n        }),\n      )\n      .describe(\n        \"Sources that failed to list in this page. Their connections are missing from the listing, not removed; list again later.\",\n      ),\n    cursor: z\n      .string()\n      .nullable()\n      .describe(\"Null means all configured integrations in this scope have been listed.\"),\n  }),\n);\n\n/** Connection pages retain source pagination without allocating new connection identities. */\nexport type IntegrationConnectionPage = z.output<typeof integrationListOutputSchema>;\n\n/** Integration listing starts with a null cursor and never selects an adapter. */\nexport const integrationListInputSchema = z.lazy(() =>\n  z.strictObject({\n    cursor: z\n      .string()\n      .nullable()\n      .describe(\"Null starts the scoped listing; use the returned next cursor.\"),\n  }),\n);\n\n/** Action values are JSON; action-specific validation still precedes service side effects. */\nexport const integrationExecuteInputSchema = z.lazy(() =>\n  integrationConnectionInputSchema._zod.innerType.extend({\n    actionId: z.string().min(1),\n    input: jsonValueSchema\n      .describe(\n        \"JSON action input, validated against the live action schema before dispatch. Binary inputs use schema-declared byte arrays of integers 0–255, never ArrayBuffer or typed arrays; implementations convert them privately.\",\n      )\n      .meta({ codemodeType: \"JsonValue\" }),\n    unchecked: z\n      .boolean()\n      .default(false)\n      .describe(\n        \"Required to run an action whose validation is unchecked: its input and output skip validation and the service alone rejects bad input. Checked actions validate regardless.\",\n      ),\n  }),\n);\n\n/**\n * Whether execution validates an action against its schemas. Unchecked actions publish contracts\n * that cannot be validated faithfully, so callers must opt in to running them.\n */\nexport const integrationActionValidationSchema = z\n  .lazy(() =>\n    z.discriminatedUnion(\"kind\", [\n      z.strictObject({ kind: z.literal(\"checked\") }),\n      z.strictObject({\n        kind: z.literal(\"unchecked\"),\n        reason: z.string().describe(\"Why the published schemas cannot be validated.\"),\n      }),\n    ]),\n  )\n  .meta({ id: \"IntegrationActionValidation\" });\n\n/** Integration action schemas describe the operation's own result, including asynchronous job handles. */\nexport const integrationActionSchema = z\n  .lazy(() =>\n    z.strictObject({\n      id: z.string().min(1).describe(\"Action identity returned by actions for this connection.\"),\n      label: z.string(),\n      description: z.string(),\n      validation: integrationActionValidationSchema,\n      inputSchema: integrationJsonSchemaSchema,\n      outputSchema: integrationJsonSchemaSchema.describe(\n        \"Describes the action's own result, including any asynchronous job handle.\",\n      ),\n    }),\n  )\n  .meta({ id: \"IntegrationAction\" });\n\n/** Integration action metadata contains contracts but no executable handler. */\nexport type IntegrationAction = z.output<typeof integrationActionSchema>;\n\nexport const integrationGenerateClientInputSchema = z.lazy(() =>\n  integrationConnectionInputSchema._zod.innerType.extend({\n    out: z\n      .string()\n      .trim()\n      .min(1)\n      .describe(\n        \"Absolute path of the .js module to write under /workspace. Only a module this operation generated is replaced.\",\n      ),\n  }),\n);\n\n/** Generated clients are snapshots of the connection's action contracts. */\nexport const integrationClientSchema = z\n  .lazy(() =>\n    z.strictObject({\n      path: z.string(),\n      exports: z.array(\n        z.strictObject({\n          name: z.string().describe(\"Exported function name.\"),\n          actionId: z.string().describe(\"Action the function executes.\"),\n        }),\n      ),\n    }),\n  )\n  .meta({ id: \"IntegrationClient\" });\n\nexport const integrationsOperations = {\n  \"integrations.discover\": {\n    description:\n      \"Discover available services and unconfigured services in the selected scope. Service availability does not prove live health.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.read],\n    input: z.void(),\n    output: z.lazy(() => z.array(integrationOverviewSchema)),\n  },\n  \"integrations.list\": {\n    description:\n      \"List existing configured connections in the selected scope, one cursor page at a time. Deterministic IDs reuse source-owned identities; configuration does not imply live access.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.read],\n    input: integrationListInputSchema,\n    output: integrationListOutputSchema,\n  },\n  \"integrations.get\": {\n    description:\n      \"Inspect source-owned connection configuration, its stored non-secret settings, and available evidence without performing a live health check. The connection ID resolves only within the selected scope.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.read],\n    input: integrationConnectionInputSchema,\n    output: inspectedIntegrationConnectionSchema,\n  },\n  \"integrations.setup\": {\n    description:\n      \"Read current requirements or submit input for a deterministic connection address. Setup is source-owned; this operation retains no attempt state or independent binding. Ready connections keep their configuration and credentials; reconfigure replaces them.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.manage],\n    input: integrationSetupInputSchema,\n    output: integrationSetupProgressSchema,\n  },\n  \"integrations.reconfigure\": {\n    description:\n      \"Read replacement requirements or submit replacement configuration or credentials for an existing connection. Build the replacement from integrations.get settings so unchanged values carry over. Submission replaces source-owned state; continue with setup checks until ready. A missing connection needs setup.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.manage],\n    input: integrationSetupInputSchema,\n    output: integrationSetupProgressSchema,\n  },\n  \"integrations.disconnect\": {\n    description:\n      \"Remove a connection's source-owned configuration and credentials in the selected scope. The address stays valid for a later setup. Requires confirm to repeat the connection ID.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.manage],\n    input: integrationDisconnectInputSchema,\n    output: integrationDisconnectResultSchema,\n  },\n  \"integrations.backfillConnectionEvents\": {\n    description:\n      \"Record every configured connection's current state in the selected scope as an integrations.connection.ready or connection.unavailable event, for connections that existed before those events were recorded. Routes on those events run for each new event. Events carry each connection's name and auth method. A rerun records a connection again only when its state, name, or auth method differs from every earlier backfill of it, so a rerun adds names to connections recorded before events carried them.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.manage],\n    input: z.void(),\n    output: integrationConnectionEventsBackfillResultSchema,\n  },\n  \"integrations.actions\": {\n    description:\n      \"Discover the selected connection's supported actions and authoritative input/output contracts without executing them. Never infer schemas from action IDs.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.read],\n    input: integrationConnectionInputSchema,\n    output: z.lazy(() => z.array(integrationActionSchema)),\n  },\n  \"integrations.execute\": {\n    description:\n      \"Execute an explicit connection action with JSON input/output, validated against its live contracts and service permissions. Unchecked actions run only with unchecked: true. Binary inputs are schema-declared byte arrays; results retain the action's domain and asynchronous semantics.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.execute],\n    input: integrationExecuteInputSchema,\n    output: jsonValueSchema.meta({ codemodeType: \"JsonValue\" }),\n  },\n  \"integrations.generateClient\": {\n    description:\n      \"Write a JavaScript module with one typed async function per action of the selected connection, for codemode and saved modules to import. Each function calls integrations.execute; its JSDoc types snapshot the action contracts, so regenerate after the connection's actions change.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.read, BACKOFFICE_PERMISSION.upload.modify],\n    input: integrationGenerateClientInputSchema,\n    output: integrationClientSchema,\n  },\n  \"integrations.verify\": {\n    description:\n      \"Perform explicit supported live checks without authorizing the connection or executing service actions. Return timestamped evidence, not blanket health or retained verification state.\",\n    permissions: [BACKOFFICE_PERMISSION.integrations.manage],\n    input: integrationConnectionInputSchema,\n    output: integrationConnectionSchema,\n  },\n} satisfies Record<string, BackofficeApiOperation>;\n"],"mappings":";;;;;AAOA,MAAa,oCAAoC;CAC/C,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC;CAClC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC;AAChC;AAEA,MAAa,qCAAqC,EAC/C,WACC,EAAE,mBAAmB,UAAU,CAC7B,EAAE,aAAa;CACb,GAAG;CACH,QAAQ,EAAE,QAAQ,aAAa;CAC/B,QAAQ,EAAE,OAAO;AACnB,CAAC,GACD,EAAE,aAAa;CACb,GAAG;CACH,QAAQ,EAAE,KAAK,CAAC,UAAU,QAAQ,CAAC;CACnC,WAAW,wBAAwB,SACjC,sDACF;CACA,SAAS,EAAE,OAAO;AACpB,CAAC,CACH,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,+BAA+B,CAAC;AAE9C,MAAa,uCAAuC,EACjD,WACC,EAAE,mBAAmB,UAAU,CAC7B,EAAE,aAAa;CAAE,QAAQ,EAAE,QAAQ,SAAS;CAAG,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC;AAAE,CAAC,GACnF,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,YAAY,EAAE,CAAC,CACpD,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,iCAAiC,CAAC;AAEhD,MAAa,uCAAuC,EACjD,WACC,EAAE,mBAAmB,UAAU;CAC7B,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,cAAc,EAAE,CAAC;CACpD,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,aAAa,EAAE,CAAC;CACnD,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,SAAS,EAAE,CAAC;CAC/C,EAAE,aAAa,EACb,QAAQ,EACL,QAAQ,WAAW,CAAC,CACpB,SACC,kFACF,EACJ,CAAC;CACD,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,SAAS,EAAE,CAAC;AACjD,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,iCAAiC,CAAC;AAEhD,MAAa,mCAAmC,EAAE,WAChD,EAAE,aAAa;CACb,MAAM,EAAE,QAAQ,OAAO;CACvB,OAAO,gBACJ,SACC,iIACF,CAAC,CACA,KAAK,EAAE,cAAc,YAAY,CAAC;AACvC,CAAC,CACH;;AAGA,MAAa,gCAAgC,EAC1C,WACC,EACG,OAAO,CAAC,CACR,MAAM,6BAA6B,uDAAuD,CAAC,CAC3F,SACC,yJACF,CACJ,CAAC,CACA,KAAK,EAAE,IAAI,0BAA0B,CAAC;AAEzC,MAAa,gCAAgC,EAC3C,cAAc,8BAChB;AAEA,MAAa,8BAA8B,EAAE,WAC3C,EAAE,aAAa,EACb,MAAM,EACH,QAAQ,OAAO,CAAC,CAChB,SAAS,4EAA4E,EAC1F,CAAC,CACH;AAEA,MAAa,8BAA8B,EACxC,WACC,EACG,MAAM,CAAC,EAAE,QAAQ,GAAG,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CACvD,SACC,0FACF,CACJ,CAAC,CACA,KAAK,EAAE,IAAI,wBAAwB,CAAC;AAEvC,MAAa,8BAA8B,EAAE,WAC3C,EAAE,aAAa;CACb,eAAe;CACf,eAAe;CACf,QAAQ,EACL,MAAM,kCAAkC,CAAC,CACzC,SACC,iIACF;CACF,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC;AAC/B,CAAC,CACH;AAKA,MAAa,sBAAsB,EAChC,WACC,EACG,OAAO,CAAC,CACR,IAAI,CAAC,CAAC,CACN,SACC,uFACF,CACJ,CAAC,CACA,KAAK,EAAE,IAAI,gBAAgB,CAAC;AAE/B,MAAa,yCAAyC,EACnD,WACC,EAAE,aAAa;CAAE,MAAM,EAAE,QAAQ,YAAY;CAAG,cAAc;AAA8B,CAAC,CAC/F,CAAC,CACA,KAAK,EAAE,IAAI,mCAAmC,CAAC;AAElD,MAAa,8BAA8B,EACxC,WACC,EACG,KAAK;CACJ;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,CACD,SACC,2IACF,CACJ,CAAC,CACA,KAAK,EAAE,IAAI,wBAAwB,CAAC;;AASvC,MAAa,8BAA8B,EACxC,WACC,4BAA4B,KAAK,UAAU,OAAO;CAChD,cAAc;CACd,eAAe;CACf,MAAM,EAAE,OAAO;CACf,YAAY,4BACT,SAAS,CAAC,CACV,SACC,sFACF;AACJ,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,wBAAwB,CAAC;AAEvC,MAAa,sCAAsC,EAChD,WAAW,EAAE,OAAO,EAAE,OAAO,GAAG,eAAe,CAAC,CAAC,SAAS,CAAC,CAAC,CAC5D,KAAK,EAAE,IAAI,gCAAgC,CAAC;AAK/C,MAAa,uCAAuC,EACjD,WACC,4BAA4B,KAAK,UAAU,OAAO,EAChD,UAAU,oCAAoC,SAC5C,wPACF,EACF,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,iCAAiC,CAAC;AAEhD,MAAa,8BAA8B,EACxC,WACC,4BAA4B,KAAK,UAAU,OAAO,EAChD,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,YAAY,EAAE,CAAC,EACnE,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,kCAAkC,CAAC;;AAGjD,MAAa,iCAAiC,EAC3C,WACC,EAAE,mBAAmB,UAAU;CAC7B,EAAE,aAAa;EACb,GAAG;EACH,QAAQ,EAAE,QAAQ,aAAa;EAC/B,cAAc,EAAE,OAAO;EACvB,aAAa;EACb,cAAc,EACX,MAAM,EAAE,OAAO,CAAC,CAAC,CACjB,SACC,oGACF;CACJ,CAAC;CACD,EAAE,aAAa;EACb,GAAG;EACH,QAAQ,EAAE,QAAQ,qBAAqB;EACvC,cAAc,EAAE,OAAO;EACvB,kBAAkB,EAAE,IAAI;CAC1B,CAAC;CACD,EAAE,aAAa;EACb,GAAG;EACH,QAAQ,EAAE,QAAQ,SAAS;EAC3B,SAAS,EAAE,OAAO;CACpB,CAAC;CACD,EAAE,aAAa;EACb,GAAG;EACH,QAAQ,EAAE,QAAQ,OAAO;CAC3B,CAAC;CACD,EAAE,aAAa;EACb,GAAG;EACH,QAAQ,EAAE,QAAQ,SAAS;EAC3B,QAAQ,EAAE,OAAO;CACnB,CAAC;CACD,EAAE,aAAa;EACb,GAAG;EACH,QAAQ,EAAE,QAAQ,SAAS;EAC3B,QAAQ,EAAE,OAAO;CACnB,CAAC;AACH,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,2BAA2B,CAAC;;AAM1C,MAAa,mCAAmC,EAAE,WAChD,EAAE,aAAa,EACb,cAAc,8BAChB,CAAC,CACH;;AAGA,MAAa,8BAA8B,EAAE,WAC3C,EAAE,mBAAmB,QAAQ,CAC3B,4BAA4B,KAAK,UAAU,OACzC,iCAAiC,KAAK,UAAU,KAClD,GACA,iCAAiC,KAAK,UAAU,OAC9C,iCAAiC,KAAK,UAAU,KAClD,CACF,CAAC,CACH;;AAMA,MAAa,mCAAmC,EAAE,WAChD,iCAAiC,KAAK,UACnC,OAAO,EACN,SAAS,8BAA8B,SACrC,yFACF,EACF,CAAC,CAAC,CACD,QAAQ,UAAU,MAAM,YAAY,MAAM,cAAc;CACvD,SAAS;CACT,MAAM,CAAC,SAAS;AAClB,CAAC,CACL;;AAGA,MAAa,oCAAoC,EAC9C,WACC,EAAE,aAAa;CACb,cAAc;CACd,QAAQ,EACL,KAAK,CAAC,gBAAgB,gBAAgB,CAAC,CAAC,CACxC,SAAS,gFAAgF;AAC9F,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,8BAA8B,CAAC;AAK7C,MAAa,kDAAkD,EAC5D,WACC,EAAE,aAAa,EACb,aAAa,EAAE,MACb,EAAE,aAAa;CACb,cAAc;CACd,SAAS;CACT,OAAO,EAAE,KAAK,CAAC,SAAS,aAAa,CAAC;AACxC,CAAC,CACH,EACF,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,4CAA4C,CAAC;;AAG3D,MAAa,4BAA4B,EACtC,WACC,EAAE,aAAa;CACb,IAAI;CACJ,OAAO,EAAE,OAAO;CAChB,aAAa,EAAE,OAAO;CACtB,uBAAuB,EACpB,KAAK,CAAC,aAAa,UAAU,CAAC,CAAC,CAC/B,SACC,wJACF;CACF,cAAc,EACX,mBAAmB,UAAU,CAC5B,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,WAAW,EAAE,CAAC,GACjD,EAAE,aAAa;EAAE,QAAQ,EAAE,QAAQ,aAAa;EAAG,QAAQ,EAAE,OAAO;CAAE,CAAC,CACzE,CAAC,CAAC,CACD,SACC,kJACF,CAAC,CACA,KAAK,EAAE,IAAI,0BAA0B,CAAC;CACzC,cAAc,EACX,MAAM,sCAAsC,CAAC,CAC7C,SACC,uGACF;CACF,kBAAkB,EACf,MAAM,EAAE,aAAa;EAAE,QAAQ,EAAE,OAAO;EAAG,WAAW,EAAE,OAAO;CAAE,CAAC,CAAC,CAAC,CACpE,SACC,iMACF;AACJ,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,sBAAsB,CAAC;;AAMrC,MAAa,8BAA8B,EAAE,WAC3C,EAAE,aAAa;CACb,aAAa,EAAE,MAAM,2BAA2B;CAChD,oBAAoB,EACjB,MACC,EAAE,aAAa;EACb,QAAQ,EACL,OAAO,CAAC,CACR,SACC,4FACF;EACF,QAAQ,EAAE,OAAO;CACnB,CAAC,CACH,CAAC,CACA,SACC,0HACF;CACF,QAAQ,EACL,OAAO,CAAC,CACR,SAAS,CAAC,CACV,SAAS,wEAAwE;AACtF,CAAC,CACH;;AAMA,MAAa,6BAA6B,EAAE,WAC1C,EAAE,aAAa,EACb,QAAQ,EACL,OAAO,CAAC,CACR,SAAS,CAAC,CACV,SAAS,+DAA+D,EAC7E,CAAC,CACH;;AAGA,MAAa,gCAAgC,EAAE,WAC7C,iCAAiC,KAAK,UAAU,OAAO;CACrD,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;CAC1B,OAAO,gBACJ,SACC,0NACF,CAAC,CACA,KAAK,EAAE,cAAc,YAAY,CAAC;CACrC,WAAW,EACR,QAAQ,CAAC,CACT,QAAQ,KAAK,CAAC,CACd,SACC,6KACF;AACJ,CAAC,CACH;;;;;AAMA,MAAa,oCAAoC,EAC9C,WACC,EAAE,mBAAmB,QAAQ,CAC3B,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,SAAS,EAAE,CAAC,GAC7C,EAAE,aAAa;CACb,MAAM,EAAE,QAAQ,WAAW;CAC3B,QAAQ,EAAE,OAAO,CAAC,CAAC,SAAS,gDAAgD;AAC9E,CAAC,CACH,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,8BAA8B,CAAC;;AAG7C,MAAa,0BAA0B,EACpC,WACC,EAAE,aAAa;CACb,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,0DAA0D;CACzF,OAAO,EAAE,OAAO;CAChB,aAAa,EAAE,OAAO;CACtB,YAAY;CACZ,aAAa;CACb,cAAc,4BAA4B,SACxC,2EACF;AACF,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,oBAAoB,CAAC;AAKnC,MAAa,uCAAuC,EAAE,WACpD,iCAAiC,KAAK,UAAU,OAAO,EACrD,KAAK,EACF,OAAO,CAAC,CACR,KAAK,CAAC,CACN,IAAI,CAAC,CAAC,CACN,SACC,gHACF,EACJ,CAAC,CACH;;AAGA,MAAa,0BAA0B,EACpC,WACC,EAAE,aAAa;CACb,MAAM,EAAE,OAAO;CACf,SAAS,EAAE,MACT,EAAE,aAAa;EACb,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS,yBAAyB;EACnD,UAAU,EAAE,OAAO,CAAC,CAAC,SAAS,+BAA+B;CAC/D,CAAC,CACH;AACF,CAAC,CACH,CAAC,CACA,KAAK,EAAE,IAAI,oBAAoB,CAAC;AAEnC,MAAa,yBAAyB;CACpC,yBAAyB;EACvB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,IAAI;EACrD,OAAO,EAAE,KAAK;EACd,QAAQ,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;CACzD;CACA,qBAAqB;EACnB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,IAAI;EACrD,OAAO;EACP,QAAQ;CACV;CACA,oBAAoB;EAClB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,IAAI;EACrD,OAAO;EACP,QAAQ;CACV;CACA,sBAAsB;EACpB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,MAAM;EACvD,OAAO;EACP,QAAQ;CACV;CACA,4BAA4B;EAC1B,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,MAAM;EACvD,OAAO;EACP,QAAQ;CACV;CACA,2BAA2B;EACzB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,MAAM;EACvD,OAAO;EACP,QAAQ;CACV;CACA,yCAAyC;EACvC,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,MAAM;EACvD,OAAO,EAAE,KAAK;EACd,QAAQ;CACV;CACA,wBAAwB;EACtB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,IAAI;EACrD,OAAO;EACP,QAAQ,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;CACvD;CACA,wBAAwB;EACtB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,OAAO;EACxD,OAAO;EACP,QAAQ,gBAAgB,KAAK,EAAE,cAAc,YAAY,CAAC;CAC5D;CACA,+BAA+B;EAC7B,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,MAAM,sBAAsB,OAAO,MAAM;EAC1F,OAAO;EACP,QAAQ;CACV;CACA,uBAAuB;EACrB,aACE;EACF,aAAa,CAAC,sBAAsB,aAAa,MAAM;EACvD,OAAO;EACP,QAAQ;CACV;AACF"}

package/dist/v0/javascript.d.ts

@@ -0,0 +1,160 @@
+import { z } from "zod";
+//#region src/v0/javascript.d.ts
+declare const javaScriptBuildInputSchema: z.ZodLazy<z.ZodObject<{
+  path: z.ZodString;
+  out: z.ZodString;
+}, z.core.$strict>>;
+declare const javaScriptLogsInputSchema: z.ZodLazy<z.ZodObject<{
+  runId: z.ZodString;
+}, z.core.$strict>>;
+declare const javascriptOperations: {
+  "js.build": {
+    description: string;
+    permissions: ({
+      readonly namespace: "upload";
+      readonly permission: "modify";
+    } | {
+      readonly namespace: "upload";
+      readonly permission: "read";
+    })[];
+    input: z.ZodLazy<z.ZodObject<{
+      path: z.ZodString;
+      out: z.ZodString;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      status: z.ZodLiteral<"success">;
+      path: z.ZodString;
+      artifactPath: z.ZodString;
+      runId: z.ZodString;
+      warnings: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+      status: z.ZodLiteral<"error">;
+      path: z.ZodString;
+      artifactPath: z.ZodString;
+      runId: z.ZodString;
+      error: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+      status: z.ZodLiteral<"rejected">;
+      path: z.ZodString;
+      artifactPath: z.ZodString;
+      error: z.ZodString;
+    }, z.core.$strict>], "status">>;
+  };
+  "js.check": {
+    description: string;
+    permissions: {
+      readonly namespace: "upload";
+      readonly permission: "read";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      path: z.ZodString;
+    }, z.core.$strip>>;
+    output: z.ZodLazy<z.ZodObject<{
+      path: z.ZodString;
+      valid: z.ZodBoolean;
+      diagnostics: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        code: z.ZodNumber;
+        path: z.ZodNullable<z.ZodString>;
+        line: z.ZodNullable<z.ZodNumber>;
+        column: z.ZodNullable<z.ZodNumber>;
+        message: z.ZodString;
+      }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+  };
+  "js.logs": {
+    description: string;
+    permissions: {
+      readonly namespace: "upload";
+      readonly permission: "read";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      runId: z.ZodString;
+    }, z.core.$strict>>;
+    output: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      runId: z.ZodString;
+      status: z.ZodLiteral<"running">;
+    }, z.core.$strip>, z.ZodObject<{
+      runId: z.ZodString;
+      status: z.ZodLiteral<"completed">;
+      logs: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        at: z.ZodNumber;
+        channel: z.ZodEnum<{
+          error: "error";
+          log: "log";
+          info: "info";
+          debug: "debug";
+          warn: "warn";
+          codemode: "codemode";
+        }>;
+        text: z.ZodString;
+      }, z.core.$strip>>>;
+    }, z.core.$strip>, z.ZodObject<{
+      runId: z.ZodString;
+      status: z.ZodLiteral<"failed">;
+      logs: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        at: z.ZodNumber;
+        channel: z.ZodEnum<{
+          error: "error";
+          log: "log";
+          info: "info";
+          debug: "debug";
+          warn: "warn";
+          codemode: "codemode";
+        }>;
+        text: z.ZodString;
+      }, z.core.$strip>>>;
+      error: z.ZodString;
+    }, z.core.$strip>], "status">>;
+  };
+  "js.run": {
+    description: string;
+    permissions: {
+      readonly namespace: "upload";
+      readonly permission: "read";
+    }[];
+    input: z.ZodLazy<z.ZodObject<{
+      path: z.ZodString;
+    }, z.core.$strip>>;
+    output: z.ZodLazy<z.ZodDiscriminatedUnion<[z.ZodObject<{
+      status: z.ZodLiteral<"success">;
+      path: z.ZodString;
+      runId: z.ZodString;
+      logs: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        at: z.ZodNumber;
+        channel: z.ZodEnum<{
+          error: "error";
+          log: "log";
+          info: "info";
+          debug: "debug";
+          warn: "warn";
+          codemode: "codemode";
+        }>;
+        text: z.ZodString;
+      }, z.core.$strip>>>;
+    }, z.core.$strip>, z.ZodObject<{
+      status: z.ZodLiteral<"error">;
+      path: z.ZodString;
+      runId: z.ZodString;
+      error: z.ZodString;
+      logs: z.ZodArray<z.ZodLazy<z.ZodObject<{
+        at: z.ZodNumber;
+        channel: z.ZodEnum<{
+          error: "error";
+          log: "log";
+          info: "info";
+          debug: "debug";
+          warn: "warn";
+          codemode: "codemode";
+        }>;
+        text: z.ZodString;
+      }, z.core.$strip>>>;
+    }, z.core.$strip>, z.ZodObject<{
+      status: z.ZodLiteral<"rejected">;
+      path: z.ZodString;
+      error: z.ZodString;
+    }, z.core.$strip>], "status">>;
+  };
+};
+//#endregion
+export { javaScriptBuildInputSchema, javaScriptLogsInputSchema, javascriptOperations };
+//# sourceMappingURL=javascript.d.ts.map

package/dist/v0/javascript.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.d.ts","names":[],"sources":["../../src/v0/javascript.ts"],"mappings":";;cAwBa,4BAA0B,EAAA,QAAA,EAAA;;;;cAuE1B,2BAAyB,EAAA,QAAA,EAAA;;;cAwBzB"}

package/dist/v0/javascript.js

@@ -0,0 +1,123 @@
+import { BACKOFFICE_PERMISSION } from "./shared/permissions.js";
+import { z } from "zod";
+//#region src/v0/javascript.ts
+/** One console call, unprefixed; `codemode` lines come from the runtime rather than the guest. */
+const javaScriptLogLineSchema = z.lazy(() => z.object({
+	at: z.number().int(),
+	channel: z.enum([
+		"log",
+		"info",
+		"debug",
+		"warn",
+		"error",
+		"codemode"
+	]),
+	text: z.string()
+}));
+const javaScriptCheckDiagnosticSchema = z.lazy(() => z.object({
+	code: z.number().int(),
+	path: z.string().nullable(),
+	line: z.number().int().positive().nullable(),
+	column: z.number().int().positive().nullable(),
+	message: z.string()
+}));
+const javaScriptBuildInputSchema = z.lazy(() => z.strictObject({
+	path: z.string().trim().min(1),
+	out: z.string().trim().min(1)
+}));
+const javaScriptBuildOutputSchema = z.lazy(() => z.discriminatedUnion("status", [
+	z.strictObject({
+		status: z.literal("success"),
+		path: z.string(),
+		artifactPath: z.string(),
+		runId: z.string(),
+		warnings: z.array(z.string())
+	}),
+	z.strictObject({
+		status: z.literal("error"),
+		path: z.string(),
+		artifactPath: z.string(),
+		runId: z.string(),
+		error: z.string()
+	}),
+	z.strictObject({
+		status: z.literal("rejected"),
+		path: z.string(),
+		artifactPath: z.string(),
+		error: z.string()
+	})
+]));
+const javaScriptCheckOutputSchema = z.lazy(() => z.object({
+	path: z.string(),
+	valid: z.boolean(),
+	diagnostics: z.array(javaScriptCheckDiagnosticSchema)
+}));
+const javaScriptFileInputSchema = z.lazy(() => z.object({ path: z.string().trim().min(1) }));
+const javaScriptRunOutputSchema = z.lazy(() => z.discriminatedUnion("status", [
+	z.object({
+		status: z.literal("success"),
+		path: z.string(),
+		runId: z.string(),
+		logs: z.array(javaScriptLogLineSchema)
+	}),
+	z.object({
+		status: z.literal("error"),
+		path: z.string(),
+		runId: z.string(),
+		error: z.string(),
+		logs: z.array(javaScriptLogLineSchema)
+	}),
+	z.object({
+		status: z.literal("rejected"),
+		path: z.string(),
+		error: z.string()
+	})
+]));
+const javaScriptLogsInputSchema = z.lazy(() => z.strictObject({ runId: z.string().trim().min(1) }));
+const javaScriptLogsOutputSchema = z.lazy(() => z.discriminatedUnion("status", [
+	z.object({
+		runId: z.string(),
+		status: z.literal("running")
+	}),
+	z.object({
+		runId: z.string(),
+		status: z.literal("completed"),
+		logs: z.array(javaScriptLogLineSchema)
+	}),
+	z.object({
+		runId: z.string(),
+		status: z.literal("failed"),
+		logs: z.array(javaScriptLogLineSchema),
+		error: z.string()
+	})
+]));
+const javascriptOperations = {
+	"js.build": {
+		description: "Compile a saved JavaScript ES module into a reusable JSON artifact under /workspace without executing or activating it. Consumers validate exports.",
+		permissions: [BACKOFFICE_PERMISSION.upload.read, BACKOFFICE_PERMISSION.upload.modify],
+		input: javaScriptBuildInputSchema,
+		output: javaScriptBuildOutputSchema
+	},
+	"js.check": {
+		description: "Type check a standalone JavaScript file under /static or /workspace against static declarations.",
+		permissions: [BACKOFFICE_PERMISSION.upload.read],
+		input: javaScriptFileInputSchema,
+		output: javaScriptCheckOutputSchema
+	},
+	"js.logs": {
+		description: "Show the console logs and outcome of a codemode run in the current scope, by run ID. Readable only with at least the authority the run had: same principal, no extra delegation, no narrower scope restriction. Codemode run events carry run IDs; runs are kept for 7 days.",
+		permissions: [BACKOFFICE_PERMISSION.upload.read],
+		input: javaScriptLogsInputSchema,
+		output: javaScriptLogsOutputSchema
+	},
+	"js.run": {
+		description: "Run top-level statements in a saved .js source file or a built .json module artifact under /static or /workspace. Ignores exports; artifacts run without compilation and startup errors are returned.",
+		permissions: [BACKOFFICE_PERMISSION.upload.read],
+		input: javaScriptFileInputSchema,
+		output: javaScriptRunOutputSchema
+	}
+};
+//#endregion
+export { javaScriptBuildInputSchema, javaScriptLogsInputSchema, javascriptOperations };
+
+//# sourceMappingURL=javascript.js.map

package/dist/v0/javascript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"javascript.js","names":[],"sources":["../../src/v0/javascript.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport type { BackofficeApiOperation } from \"../api\";\nimport { BACKOFFICE_PERMISSION } from \"./shared/permissions\";\n\n/** One console call, unprefixed; `codemode` lines come from the runtime rather than the guest. */\nconst javaScriptLogLineSchema = z.lazy(() =>\n  z.object({\n    at: z.number().int(),\n    channel: z.enum([\"log\", \"info\", \"debug\", \"warn\", \"error\", \"codemode\"]),\n    text: z.string(),\n  }),\n);\n\nconst javaScriptCheckDiagnosticSchema = z.lazy(() =>\n  z.object({\n    code: z.number().int(),\n    path: z.string().nullable(),\n    line: z.number().int().positive().nullable(),\n    column: z.number().int().positive().nullable(),\n    message: z.string(),\n  }),\n);\n\nexport const javaScriptBuildInputSchema = z.lazy(() =>\n  z.strictObject({\n    path: z.string().trim().min(1),\n    out: z.string().trim().min(1),\n  }),\n);\n\n// `rejected` means no build run was recorded; the other outcomes name their run for js.logs.\nconst javaScriptBuildOutputSchema = z.lazy(() =>\n  z.discriminatedUnion(\"status\", [\n    z.strictObject({\n      status: z.literal(\"success\"),\n      path: z.string(),\n      artifactPath: z.string(),\n      runId: z.string(),\n      warnings: z.array(z.string()),\n    }),\n    z.strictObject({\n      status: z.literal(\"error\"),\n      path: z.string(),\n      artifactPath: z.string(),\n      runId: z.string(),\n      error: z.string(),\n    }),\n    z.strictObject({\n      status: z.literal(\"rejected\"),\n      path: z.string(),\n      artifactPath: z.string(),\n      error: z.string(),\n    }),\n  ]),\n);\n\nconst javaScriptCheckOutputSchema = z.lazy(() =>\n  z.object({\n    path: z.string(),\n    valid: z.boolean(),\n    diagnostics: z.array(javaScriptCheckDiagnosticSchema),\n  }),\n);\n\nconst javaScriptFileInputSchema = z.lazy(() =>\n  z.object({\n    path: z.string().trim().min(1),\n  }),\n);\n\n// `rejected` means no run result: the file was refused or execution could not start or report.\nconst javaScriptRunOutputSchema = z.lazy(() =>\n  z.discriminatedUnion(\"status\", [\n    z.object({\n      status: z.literal(\"success\"),\n      path: z.string(),\n      runId: z.string(),\n      logs: z.array(javaScriptLogLineSchema),\n    }),\n    z.object({\n      status: z.literal(\"error\"),\n      path: z.string(),\n      runId: z.string(),\n      error: z.string(),\n      logs: z.array(javaScriptLogLineSchema),\n    }),\n    z.object({\n      status: z.literal(\"rejected\"),\n      path: z.string(),\n      error: z.string(),\n    }),\n  ]),\n);\n\nexport const javaScriptLogsInputSchema = z.lazy(() =>\n  z.strictObject({\n    runId: z.string().trim().min(1),\n  }),\n);\n\n// A running run has no logs yet: they are stored with its outcome.\nconst javaScriptLogsOutputSchema = z.lazy(() =>\n  z.discriminatedUnion(\"status\", [\n    z.object({ runId: z.string(), status: z.literal(\"running\") }),\n    z.object({\n      runId: z.string(),\n      status: z.literal(\"completed\"),\n      logs: z.array(javaScriptLogLineSchema),\n    }),\n    z.object({\n      runId: z.string(),\n      status: z.literal(\"failed\"),\n      logs: z.array(javaScriptLogLineSchema),\n      error: z.string(),\n    }),\n  ]),\n);\n\nexport const javascriptOperations = {\n  \"js.build\": {\n    description:\n      \"Compile a saved JavaScript ES module into a reusable JSON artifact under /workspace without executing or activating it. Consumers validate exports.\",\n    permissions: [BACKOFFICE_PERMISSION.upload.read, BACKOFFICE_PERMISSION.upload.modify],\n    input: javaScriptBuildInputSchema,\n    output: javaScriptBuildOutputSchema,\n  },\n  \"js.check\": {\n    description:\n      \"Type check a standalone JavaScript file under /static or /workspace against static declarations.\",\n    permissions: [BACKOFFICE_PERMISSION.upload.read],\n    input: javaScriptFileInputSchema,\n    output: javaScriptCheckOutputSchema,\n  },\n  \"js.logs\": {\n    description:\n      \"Show the console logs and outcome of a codemode run in the current scope, by run ID. Readable only with at least the authority the run had: same principal, no extra delegation, no narrower scope restriction. Codemode run events carry run IDs; runs are kept for 7 days.\",\n    // The runtime also requires the reader to hold at least the run's authority.\n    permissions: [BACKOFFICE_PERMISSION.upload.read],\n    input: javaScriptLogsInputSchema,\n    output: javaScriptLogsOutputSchema,\n  },\n  \"js.run\": {\n    description:\n      \"Run top-level statements in a saved .js source file or a built .json module artifact under /static or /workspace. Ignores exports; artifacts run without compilation and startup errors are returned.\",\n    permissions: [BACKOFFICE_PERMISSION.upload.read],\n    input: javaScriptFileInputSchema,\n    output: javaScriptRunOutputSchema,\n  },\n} satisfies Record<string, BackofficeApiOperation>;\n"],"mappings":";;;;AAMA,MAAM,0BAA0B,EAAE,WAChC,EAAE,OAAO;CACP,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI;CACnB,SAAS,EAAE,KAAK;EAAC;EAAO;EAAQ;EAAS;EAAQ;EAAS;CAAU,CAAC;CACrE,MAAM,EAAE,OAAO;AACjB,CAAC,CACH;AAEA,MAAM,kCAAkC,EAAE,WACxC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI;CACrB,MAAM,EAAE,OAAO,CAAC,CAAC,SAAS;CAC1B,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC3C,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS;CAC7C,SAAS,EAAE,OAAO;AACpB,CAAC,CACH;AAEA,MAAa,6BAA6B,EAAE,WAC1C,EAAE,aAAa;CACb,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;CAC7B,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC;AAC9B,CAAC,CACH;AAGA,MAAM,8BAA8B,EAAE,WACpC,EAAE,mBAAmB,UAAU;CAC7B,EAAE,aAAa;EACb,QAAQ,EAAE,QAAQ,SAAS;EAC3B,MAAM,EAAE,OAAO;EACf,cAAc,EAAE,OAAO;EACvB,OAAO,EAAE,OAAO;EAChB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;CAC9B,CAAC;CACD,EAAE,aAAa;EACb,QAAQ,EAAE,QAAQ,OAAO;EACzB,MAAM,EAAE,OAAO;EACf,cAAc,EAAE,OAAO;EACvB,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,OAAO;CAClB,CAAC;CACD,EAAE,aAAa;EACb,QAAQ,EAAE,QAAQ,UAAU;EAC5B,MAAM,EAAE,OAAO;EACf,cAAc,EAAE,OAAO;EACvB,OAAO,EAAE,OAAO;CAClB,CAAC;AACH,CAAC,CACH;AAEA,MAAM,8BAA8B,EAAE,WACpC,EAAE,OAAO;CACP,MAAM,EAAE,OAAO;CACf,OAAO,EAAE,QAAQ;CACjB,aAAa,EAAE,MAAM,+BAA+B;AACtD,CAAC,CACH;AAEA,MAAM,4BAA4B,EAAE,WAClC,EAAE,OAAO,EACP,MAAM,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAC/B,CAAC,CACH;AAGA,MAAM,4BAA4B,EAAE,WAClC,EAAE,mBAAmB,UAAU;CAC7B,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,SAAS;EAC3B,MAAM,EAAE,OAAO;EACf,OAAO,EAAE,OAAO;EAChB,MAAM,EAAE,MAAM,uBAAuB;CACvC,CAAC;CACD,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,OAAO;EACzB,MAAM,EAAE,OAAO;EACf,OAAO,EAAE,OAAO;EAChB,OAAO,EAAE,OAAO;EAChB,MAAM,EAAE,MAAM,uBAAuB;CACvC,CAAC;CACD,EAAE,OAAO;EACP,QAAQ,EAAE,QAAQ,UAAU;EAC5B,MAAM,EAAE,OAAO;EACf,OAAO,EAAE,OAAO;CAClB,CAAC;AACH,CAAC,CACH;AAEA,MAAa,4BAA4B,EAAE,WACzC,EAAE,aAAa,EACb,OAAO,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,EAChC,CAAC,CACH;AAGA,MAAM,6BAA6B,EAAE,WACnC,EAAE,mBAAmB,UAAU;CAC7B,EAAE,OAAO;EAAE,OAAO,EAAE,OAAO;EAAG,QAAQ,EAAE,QAAQ,SAAS;CAAE,CAAC;CAC5D,EAAE,OAAO;EACP,OAAO,EAAE,OAAO;EAChB,QAAQ,EAAE,QAAQ,WAAW;EAC7B,MAAM,EAAE,MAAM,uBAAuB;CACvC,CAAC;CACD,EAAE,OAAO;EACP,OAAO,EAAE,OAAO;EAChB,QAAQ,EAAE,QAAQ,QAAQ;EAC1B,MAAM,EAAE,MAAM,uBAAuB;EACrC,OAAO,EAAE,OAAO;CAClB,CAAC;AACH,CAAC,CACH;AAEA,MAAa,uBAAuB;CAClC,YAAY;EACV,aACE;EACF,aAAa,CAAC,sBAAsB,OAAO,MAAM,sBAAsB,OAAO,MAAM;EACpF,OAAO;EACP,QAAQ;CACV;CACA,YAAY;EACV,aACE;EACF,aAAa,CAAC,sBAAsB,OAAO,IAAI;EAC/C,OAAO;EACP,QAAQ;CACV;CACA,WAAW;EACT,aACE;EAEF,aAAa,CAAC,sBAAsB,OAAO,IAAI;EAC/C,OAAO;EACP,QAAQ;CACV;CACA,UAAU;EACR,aACE;EACF,aAAa,CAAC,sBAAsB,OAAO,IAAI;EAC/C,OAAO;EACP,QAAQ;CACV;AACF"}