@lssm/lib.communication-spec 3.1.1

package/dist/contracts/ecosystem-attachment.operations.d.ts

@@ -0,0 +1,129 @@
+import { type DocBlock } from '@lssm/lib.contracts-spec';
+export declare const CommunicationAttachmentDocBlock: DocBlock;
+export declare const UploadCommunicationAttachmentV1Command: import("@lssm/lib.contracts-spec").OperationSpec<import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    roomId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    principalId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    name: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    mimeType: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    sizeBytes: {
+        type: import("@lssm/lib.schema").FieldType<number, number>;
+        isOptional: false;
+    };
+    sha256: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    contentBase64: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, import("@lssm/lib.schema").SchemaModel<{
+    id: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    name: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    mimeType: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    sizeBytes: {
+        type: import("@lssm/lib.schema").FieldType<number, number>;
+        isOptional: false;
+    };
+    sha256: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    createdAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>, undefined>;
+export declare const DownloadCommunicationAttachmentV1Query: import("@lssm/lib.contracts-spec").OperationSpec<import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    roomId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    principalId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    attachmentId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, import("@lssm/lib.schema").SchemaModel<{
+    attachment: {
+        type: import("@lssm/lib.schema").SchemaModel<{
+            id: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            name: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            mimeType: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            sizeBytes: {
+                type: import("@lssm/lib.schema").FieldType<number, number>;
+                isOptional: false;
+            };
+            sha256: {
+                type: import("@lssm/lib.schema").FieldType<string, string>;
+                isOptional: false;
+            };
+            createdAt: {
+                type: import("@lssm/lib.schema").FieldType<Date, string>;
+                isOptional: false;
+            };
+        }>;
+        isOptional: false;
+    };
+    contentBase64: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, undefined>;

package/dist/contracts/ecosystem-attachment.operations.js

@@ -0,0 +1,2 @@
+// @bun
+import{defineCommand as g,defineQuery as O,docId as s}from"@lssm/lib.contracts-spec";import{defineSchemaModel as o,ScalarTypeEnum as t}from"@lssm/lib.schema";import{defineEnum as i,defineSchemaModel as n,ScalarTypeEnum as e}from"@lssm/lib.schema";var l=i("CommunicationSpaceKind",["personal","organization"]),u=i("CommunicationPrincipalKind",["human","agent","system"]),m=i("CommunicationConnectionPlacement",["device","managed_cloud","self_hosted"]),I=i("CommunicationConnectionNetwork",["email","sms","slack","teams","telegram","whatsapp","discord","matrix"]),d=i("CommunicationEncryptionMode",["client_encrypted","governed_server_indexable"]),y=i("CommunicationMembershipState",["active","revoked"]),A=i("CommunicationReceiptKind",["delivered","read"]),f=i("CommunicationConnectionHealth",["connecting","healthy","degraded","offline","revoked"]),b={id:"communication-os.ecosystem-messaging.v2",title:"CommunicationOS ecosystem messaging contracts",body:"Versioned, workspace-scoped contracts for personal and organization spaces, rooms, human and agent membership, hybrid channel connections, synchronized messages, and revocable outbound authority. CommunicationSpec remains canonical; provider protocols are adapters. V1 thread and draft-only operations remain unchanged.",kind:"reference",route:"/docs/communication-os/ecosystem-messaging-v2",visibility:"public"},x=n({name:"CommunicationScopeV2",description:"Strict tenant, workspace, and space boundary for messaging state",fields:{tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1}}}),D=n({name:"CommunicationSpaceV2",description:"Personal or organization messaging boundary under one account",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},kind:{type:l,isOptional:!1},encryptionMode:{type:d,isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}}),T=n({name:"CommunicationPrincipalV2",description:"Auditable human, agent, or system identity",fields:{id:{type:e.String_unsecure(),isOptional:!1},kind:{type:u,isOptional:!1},displayName:{type:e.String_unsecure(),isOptional:!1},ownerPrincipalId:{type:e.String_unsecure(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),v=n({name:"CommunicationRoomV2",description:"Room or direct-message projection inside one space",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},roomKind:{type:e.String_unsecure(),isOptional:!1},connectionIds:{type:e.String_unsecure(),isArray:!0,isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),w=n({name:"CommunicationRoomMembershipV2",description:"Revocable principal membership and room-scoped capabilities",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},roomId:{type:e.String_unsecure(),isOptional:!1},principalId:{type:e.String_unsecure(),isOptional:!1},role:{type:e.String_unsecure(),isOptional:!1},state:{type:y,isOptional:!1},capabilities:{type:e.String_unsecure(),isArray:!0,isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},revokedAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),k=n({name:"CommunicationChannelConnectionV2",description:"Credential-reference-only local, managed, or self-hosted channel connection",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},network:{type:e.String_unsecure(),isOptional:!1},placement:{type:m,isOptional:!1},externalAccountRef:{type:e.String_unsecure(),isOptional:!1},credentialRef:{type:e.String_unsecure(),isOptional:!1},health:{type:f,isOptional:!1},capabilities:{type:e.String_unsecure(),isArray:!0,isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),a=n({name:"CommunicationAttachmentV2",description:"Public-safe metadata for an opaque, scope-bound message attachment",fields:{id:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},mimeType:{type:e.String_unsecure(),isOptional:!1},sizeBytes:{type:e.Int_unsecure(),isOptional:!1},sha256:{type:e.String_unsecure(),isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}}),M=n({name:"CommunicationMessageV2",description:"Canonical room message with explicit author and encryption posture",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},roomId:{type:e.String_unsecure(),isOptional:!1},authorPrincipalId:{type:e.String_unsecure(),isOptional:!1},connectionId:{type:e.String_unsecure(),isOptional:!0},externalMessageId:{type:e.String_unsecure(),isOptional:!0},body:{type:e.String_unsecure(),isOptional:!0},encryptedEnvelope:{type:e.JSONObject(),isOptional:!0},attachments:{type:a,isArray:!0,isOptional:!0},replyToMessageId:{type:e.String_unsecure(),isOptional:!0},revision:{type:e.Int_unsecure(),isOptional:!1},deletedAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),V=n({name:"CommunicationAuthorityGrantV2",description:"Explicit, revocable messaging authority granted to one principal",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},roomId:{type:e.String_unsecure(),isOptional:!0},connectionId:{type:e.String_unsecure(),isOptional:!0},principalId:{type:e.String_unsecure(),isOptional:!1},capabilities:{type:e.String_unsecure(),isArray:!0,isOptional:!1},grantedBy:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},revokedAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}});var r={id:"communication-os.ecosystem-attachments.v1",title:"CommunicationOS scoped message attachments",body:"Uploads and downloads small message attachments through authenticated, room-authorized operations. Bytes are stored behind opaque identifiers; public message projections expose only name, MIME type, size, digest, and creation time. Runtime limits, digest verification, tenant isolation, and message-reference validation fail closed.",kind:"reference",route:"/docs/communication-os/ecosystem-attachments-v1",visibility:"public"},c={tenantId:{type:t.String_unsecure(),isOptional:!1},workspaceId:{type:t.String_unsecure(),isOptional:!1},spaceId:{type:t.String_unsecure(),isOptional:!1},roomId:{type:t.String_unsecure(),isOptional:!1},principalId:{type:t.String_unsecure(),isOptional:!1}},h=o({name:"UploadCommunicationAttachmentV1Input",fields:{...c,name:{type:t.String_unsecure(),isOptional:!1},mimeType:{type:t.String_unsecure(),isOptional:!1},sizeBytes:{type:t.Int_unsecure(),isOptional:!1},sha256:{type:t.String_unsecure(),isOptional:!1},contentBase64:{type:t.String_unsecure(),isOptional:!1}}}),S=o({name:"DownloadCommunicationAttachmentV1Input",fields:{...c,attachmentId:{type:t.String_unsecure(),isOptional:!1}}}),_=o({name:"DownloadCommunicationAttachmentV1Output",fields:{attachment:{type:a,isOptional:!1},contentBase64:{type:t.String_unsecure(),isOptional:!1}}}),p={VALIDATION_FAILED:{description:"Attachment metadata, digest, encoding, or size is invalid.",http:422,when:"The request is malformed, exceeds the runtime limit, or its digest differs from the decoded bytes."},AUTHORITY_DENIED:{description:"The principal cannot access attachments in this room.",http:403,when:"Active room membership or attachment capability is absent."},ATTACHMENT_NOT_FOUND:{description:"No attachment exists in the selected authorized scope.",http:404,when:"The opaque identifier is absent or belongs to another scope."}},N=g({meta:{key:"communication.attachment.upload",version:"1.0.0",stability:"experimental",owners:["platform.communication-os"],tags:["communication","message","attachment","upload"],description:"Upload one small, digest-verified message attachment",goal:"Let authorized participants attach files without exposing storage locations",context:"Scope and principal authority are derived by protected adapters; bytes are limited and stored behind an opaque identifier",docId:[s(r.id)]},io:{input:h,output:a,errors:p},policy:{auth:"user"}}),P=O({meta:{key:"communication.attachment.download",version:"1.0.0",stability:"experimental",owners:["platform.communication-os"],tags:["communication","message","attachment","download"],description:"Download one attachment from an authorized room scope",goal:"Return bytes only after current room authority is revalidated",context:"Opaque identifiers never widen the server-derived tenant, workspace, space, or room scope",docId:[s(r.id)]},io:{input:S,output:_,errors:p},policy:{auth:"user"}});export{r as CommunicationAttachmentDocBlock,P as DownloadCommunicationAttachmentV1Query,N as UploadCommunicationAttachmentV1Command};

package/dist/contracts/ecosystem-auth.operations.d.ts

@@ -0,0 +1,345 @@
+export declare const ExchangeCommunicationHostSessionV2Input: import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    issuer: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    assertion: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>;
+export declare const ExchangeCommunicationHostSessionV2Output: import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    accessToken: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    principalId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>;
+export declare const ExchangeCommunicationHostSessionV2Command: import("@lssm/lib.contracts-spec").OperationSpec<import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    issuer: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    assertion: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    accessToken: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    principalId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>, undefined>;
+export declare const ExchangeCommunicationDirectSessionV2Input: import("@lssm/lib.schema").SchemaModel<{}>;
+export declare const ExchangeCommunicationDirectSessionV2Output: import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    accessToken: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    principalId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>;
+export declare const ExchangeCommunicationDirectSessionV2Command: import("@lssm/lib.contracts-spec").OperationSpec<import("@lssm/lib.schema").SchemaModel<{}>, import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    accessToken: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    principalId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>, undefined>;
+export declare const CreateCommunicationRealtimeTicketV2Input: import("@lssm/lib.schema").SchemaModel<{
+    readonly tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    readonly workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    readonly spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+}>;
+export declare const CreateCommunicationRealtimeTicketV2Output: import("@lssm/lib.schema").SchemaModel<{
+    ticket: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>;
+export declare const CreateCommunicationRealtimeTicketV2Command: import("@lssm/lib.contracts-spec").OperationSpec<import("@lssm/lib.schema").SchemaModel<{
+    readonly tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    readonly workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    readonly spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+}>, import("@lssm/lib.schema").SchemaModel<{
+    ticket: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>, undefined>;
+export declare const StartCommunicationProviderOAuthV2Input: import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    network: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string, string, string, string, string, string]>;
+        isOptional: false;
+    };
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    placement: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string]>;
+        isOptional: false;
+    };
+    returnPath: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const StartCommunicationProviderOAuthV2Output: import("@lssm/lib.schema").SchemaModel<{
+    authorizationUrl: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>;
+export declare const StartCommunicationProviderOAuthV2Command: import("@lssm/lib.contracts-spec").OperationSpec<import("@lssm/lib.schema").SchemaModel<{
+    tenantId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    workspaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    spaceId: {
+        readonly type: import("@lssm/lib.schema").FieldType<string, string>;
+        readonly isOptional: false;
+    };
+    network: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string, string, string, string, string, string]>;
+        isOptional: false;
+    };
+    providerKey: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    placement: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string]>;
+        isOptional: false;
+    };
+    returnPath: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>, import("@lssm/lib.schema").SchemaModel<{
+    authorizationUrl: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    expiresAt: {
+        type: import("@lssm/lib.schema").FieldType<Date, string>;
+        isOptional: false;
+    };
+}>, undefined>;
+export declare const CompleteCommunicationProviderOAuthV2Input: import("@lssm/lib.schema").SchemaModel<{
+    network: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string, string, string, string, string, string]>;
+        isOptional: false;
+    };
+    state: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    code: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    providerError: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>;
+export declare const CompleteCommunicationProviderOAuthV2Output: import("@lssm/lib.schema").SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    network: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string, string, string, string, string, string]>;
+        isOptional: false;
+    };
+    returnPath: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    returnOrigin: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>;
+export declare const CompleteCommunicationProviderOAuthV2Command: import("@lssm/lib.contracts-spec").OperationSpec<import("@lssm/lib.schema").SchemaModel<{
+    network: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string, string, string, string, string, string]>;
+        isOptional: false;
+    };
+    state: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    code: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+    providerError: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: true;
+    };
+}>, import("@lssm/lib.schema").SchemaModel<{
+    connectionId: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    network: {
+        type: import("@lssm/lib.schema").EnumType<[string, string, string, string, string, string, string, string]>;
+        isOptional: false;
+    };
+    returnPath: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+    returnOrigin: {
+        type: import("@lssm/lib.schema").FieldType<string, string>;
+        isOptional: false;
+    };
+}>, undefined>;

package/dist/contracts/ecosystem-auth.operations.js

@@ -0,0 +1,2 @@
+// @bun
+import{defineCommand as a,docId as f}from"@lssm/lib.contracts-spec";import{defineSchemaModel as i,ScalarTypeEnum as t}from"@lssm/lib.schema";import{defineEnum as o,defineSchemaModel as n,ScalarTypeEnum as e}from"@lssm/lib.schema";var m=o("CommunicationSpaceKind",["personal","organization"]),d=o("CommunicationPrincipalKind",["human","agent","system"]),u=o("CommunicationConnectionPlacement",["device","managed_cloud","self_hosted"]),p=o("CommunicationConnectionNetwork",["email","sms","slack","teams","telegram","whatsapp","discord","matrix"]),y=o("CommunicationEncryptionMode",["client_encrypted","governed_server_indexable"]),h=o("CommunicationMembershipState",["active","revoked"]),E=o("CommunicationReceiptKind",["delivered","read"]),g=o("CommunicationConnectionHealth",["connecting","healthy","degraded","offline","revoked"]),l={id:"communication-os.ecosystem-messaging.v2",title:"CommunicationOS ecosystem messaging contracts",body:"Versioned, workspace-scoped contracts for personal and organization spaces, rooms, human and agent membership, hybrid channel connections, synchronized messages, and revocable outbound authority. CommunicationSpec remains canonical; provider protocols are adapters. V1 thread and draft-only operations remain unchanged.",kind:"reference",route:"/docs/communication-os/ecosystem-messaging-v2",visibility:"public"},V=n({name:"CommunicationScopeV2",description:"Strict tenant, workspace, and space boundary for messaging state",fields:{tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1}}}),D=n({name:"CommunicationSpaceV2",description:"Personal or organization messaging boundary under one account",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},kind:{type:m,isOptional:!1},encryptionMode:{type:y,isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}}),P=n({name:"CommunicationPrincipalV2",description:"Auditable human, agent, or system identity",fields:{id:{type:e.String_unsecure(),isOptional:!1},kind:{type:d,isOptional:!1},displayName:{type:e.String_unsecure(),isOptional:!1},ownerPrincipalId:{type:e.String_unsecure(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),M=n({name:"CommunicationRoomV2",description:"Room or direct-message projection inside one space",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!0},roomKind:{type:e.String_unsecure(),isOptional:!1},connectionIds:{type:e.String_unsecure(),isArray:!0,isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),R=n({name:"CommunicationRoomMembershipV2",description:"Revocable principal membership and room-scoped capabilities",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},roomId:{type:e.String_unsecure(),isOptional:!1},principalId:{type:e.String_unsecure(),isOptional:!1},role:{type:e.String_unsecure(),isOptional:!1},state:{type:h,isOptional:!1},capabilities:{type:e.String_unsecure(),isArray:!0,isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},revokedAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}}),z=n({name:"CommunicationChannelConnectionV2",description:"Credential-reference-only local, managed, or self-hosted channel connection",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},network:{type:e.String_unsecure(),isOptional:!1},placement:{type:u,isOptional:!1},externalAccountRef:{type:e.String_unsecure(),isOptional:!1},credentialRef:{type:e.String_unsecure(),isOptional:!1},health:{type:g,isOptional:!1},capabilities:{type:e.String_unsecure(),isArray:!0,isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),O=n({name:"CommunicationAttachmentV2",description:"Public-safe metadata for an opaque, scope-bound message attachment",fields:{id:{type:e.String_unsecure(),isOptional:!1},name:{type:e.String_unsecure(),isOptional:!1},mimeType:{type:e.String_unsecure(),isOptional:!1},sizeBytes:{type:e.Int_unsecure(),isOptional:!1},sha256:{type:e.String_unsecure(),isOptional:!1},createdAt:{type:e.DateTime(),isOptional:!1}}}),H=n({name:"CommunicationMessageV2",description:"Canonical room message with explicit author and encryption posture",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},roomId:{type:e.String_unsecure(),isOptional:!1},authorPrincipalId:{type:e.String_unsecure(),isOptional:!1},connectionId:{type:e.String_unsecure(),isOptional:!0},externalMessageId:{type:e.String_unsecure(),isOptional:!0},body:{type:e.String_unsecure(),isOptional:!0},encryptedEnvelope:{type:e.JSONObject(),isOptional:!0},attachments:{type:O,isArray:!0,isOptional:!0},replyToMessageId:{type:e.String_unsecure(),isOptional:!0},revision:{type:e.Int_unsecure(),isOptional:!1},deletedAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1},updatedAt:{type:e.DateTime(),isOptional:!1}}}),N=n({name:"CommunicationAuthorityGrantV2",description:"Explicit, revocable messaging authority granted to one principal",fields:{id:{type:e.String_unsecure(),isOptional:!1},tenantId:{type:e.String_unsecure(),isOptional:!1},workspaceId:{type:e.String_unsecure(),isOptional:!1},spaceId:{type:e.String_unsecure(),isOptional:!1},roomId:{type:e.String_unsecure(),isOptional:!0},connectionId:{type:e.String_unsecure(),isOptional:!0},principalId:{type:e.String_unsecure(),isOptional:!1},capabilities:{type:e.String_unsecure(),isArray:!0,isOptional:!1},grantedBy:{type:e.String_unsecure(),isOptional:!1},expiresAt:{type:e.DateTime(),isOptional:!0},revokedAt:{type:e.DateTime(),isOptional:!0},createdAt:{type:e.DateTime(),isOptional:!1}}});var s=["platform.communication-os"],r=[f(l.id)],c={tenantId:{type:t.String_unsecure(),isOptional:!1},workspaceId:{type:t.String_unsecure(),isOptional:!1},spaceId:{type:t.String_unsecure(),isOptional:!1}},S=i({name:"ExchangeCommunicationHostSessionV2Input",description:"Server-to-server exchange of a verified host assertion for a scoped CommunicationOS token",fields:{issuer:{type:t.String_unsecure(),isOptional:!1},assertion:{type:t.String_unsecure(),isOptional:!1},...c}}),C=i({name:"ExchangeCommunicationHostSessionV2Output",fields:{accessToken:{type:t.String_unsecure(),isOptional:!1},principalId:{type:t.String_unsecure(),isOptional:!1},expiresAt:{type:t.DateTime(),isOptional:!1},...c}}),j=a({meta:{key:"communication.auth.host-session.exchange",version:"2.0.0",stability:"experimental",owners:[...s],tags:["communication","auth","host-exchange","isolation"],description:"Exchange a CompanyOS, Pactena, or approved host session for a short-lived scoped token",goal:"Embed CommunicationOS without sharing host cookies or bypassing its own authorization",context:"The server verifies issuer and assertion, maps issuer plus subject to one canonical principal, and evaluates membership independently; email matching never links identities",docId:r},io:{input:S,output:C},policy:{auth:"admin"}}),_=i({name:"ExchangeCommunicationDirectSessionV2Input",description:"Exchange the current first-party AuthOS cookie or native bearer session for its server-derived personal CommunicationOS scope",fields:{}}),v=i({name:"ExchangeCommunicationDirectSessionV2Output",fields:{accessToken:{type:t.String_unsecure(),isOptional:!1},principalId:{type:t.String_unsecure(),isOptional:!1},expiresAt:{type:t.DateTime(),isOptional:!1},...c}}),q=a({meta:{key:"communication.auth.direct-session.exchange",version:"2.0.0",stability:"experimental",owners:[...s],tags:["communication","auth","standalone","isolation"],description:"Exchange a first-party AuthOS session for a short-lived scoped CommunicationOS token",goal:"Let standalone clients authenticate without sharing host sessions",context:"The server accepts the first-party web cookie or a device-vault-backed AuthOS bearer session, then derives both canonical principal and personal scope from the AuthOS issuer and immutable user id; email and client-provided scope are never identity authority",docId:r},io:{input:_,output:v},policy:{auth:"user"}}),x=i({name:"CreateCommunicationRealtimeTicketV2Input",description:"Authorized space scope for one short-lived realtime ticket",fields:c}),k=i({name:"CreateCommunicationRealtimeTicketV2Output",fields:{ticket:{type:t.String_unsecure(),isOptional:!1},expiresAt:{type:t.DateTime(),isOptional:!1}}}),G=a({meta:{key:"communication.auth.realtime-ticket.create",version:"2.0.0",stability:"experimental",owners:[...s],tags:["communication","auth","realtime","ticket"],description:"Mint a single-purpose, short-lived ticket for the realtime gateway",goal:"Authenticate WebSocket upgrades without exposing bearer tokens in URLs",context:"The ticket is audience-bound, space-scoped, expiring, and must be consumed or rejected by the realtime gateway",docId:r},io:{input:x,output:k},policy:{auth:"user"}}),A=i({name:"StartCommunicationProviderOAuthV2Input",description:"Authenticated request for a scope-bound, short-lived provider OAuth authorization flow",fields:{...c,network:{type:p,isOptional:!1},providerKey:{type:t.String_unsecure(),isOptional:!0},placement:{type:u,isOptional:!1},returnPath:{type:t.String_unsecure(),isOptional:!0}}}),b=i({name:"StartCommunicationProviderOAuthV2Output",description:"Opaque provider authorization URL with no raw credential or PKCE verifier exposure",fields:{authorizationUrl:{type:t.String_unsecure(),isOptional:!1},expiresAt:{type:t.DateTime(),isOptional:!1}}}),W=a({meta:{key:"communication.oauth.start",version:"3.0.0",stability:"experimental",owners:[...s],tags:["communication","provider","oauth","pkce","connection"],description:"Start a provider OAuth flow bound to the authenticated principal and exact CommunicationOS scope",goal:"Connect managed provider accounts without exposing credentials or permitting cross-space callback replay",context:"The server creates one-time state and provider-supported PKCE material, stores it with a short expiry, derives an allowlisted host return origin from the authenticated issuer, and accepts only relative return paths; raw verifier and provider tokens never enter browser projections",docId:r},io:{input:A,output:b,errors:{OAUTH_NETWORK_UNSUPPORTED:{description:"The requested network has no configured OAuth provider",http:422,when:"The network uses another connection method or is not enabled"},OAUTH_NOT_AUTHORIZED:{description:"The actor cannot manage connections in this scope",http:403,when:"Membership, policy, or RoleMorph boundaries deny connection administration"},OAUTH_STATE_UNAVAILABLE:{description:"OAuth state could not be stored durably",http:503,when:"The one-time state store is unavailable"}}},policy:{auth:"user"}}),I=i({name:"CompleteCommunicationProviderOAuthV2Input",description:"Provider callback carrying opaque one-time state and either an authorization code or provider error",fields:{network:{type:p,isOptional:!1},state:{type:t.String_unsecure(),isOptional:!1},code:{type:t.String_unsecure(),isOptional:!0},providerError:{type:t.String_unsecure(),isOptional:!0}}}),T=i({name:"CompleteCommunicationProviderOAuthV2Output",description:"Connected provider projection after one-time state consumption and credential-vault storage",fields:{connectionId:{type:t.String_unsecure(),isOptional:!1},network:{type:p,isOptional:!1},returnPath:{type:t.String_unsecure(),isOptional:!1},returnOrigin:{type:t.String_unsecure(),isOptional:!1}}}),F=a({meta:{key:"communication.oauth.complete",version:"3.0.0",stability:"experimental",owners:[...s],tags:["communication","provider","oauth","callback","replay"],description:"Consume a provider OAuth callback once, vault credentials, and create the scoped connection",goal:"Finish provider onboarding without trusting callback scope or persisting browser-visible tokens",context:"Tenant, workspace, space, principal, placement, provider proof material, allowlisted host return origin, and relative return path are recovered only from atomically consumed state; reused, expired, mismatched, or provider-denied callbacks fail closed",docId:r},io:{input:I,output:T,errors:{OAUTH_STATE_INVALID:{description:"OAuth state is missing, expired, mismatched, or already consumed",http:401,when:"The callback cannot atomically recover its exact scoped authorization intent"},OAUTH_PROVIDER_DENIED:{description:"The provider denied or failed the authorization request",http:422,when:"The callback contains an OAuth error or no authorization code"},OAUTH_EXCHANGE_FAILED:{description:"The authorization code could not be exchanged safely",http:502,when:"Provider token exchange, identity discovery, or credential vault storage fails"}}},policy:{auth:"anonymous"}});export{F as CompleteCommunicationProviderOAuthV2Command,I as CompleteCommunicationProviderOAuthV2Input,T as CompleteCommunicationProviderOAuthV2Output,G as CreateCommunicationRealtimeTicketV2Command,x as CreateCommunicationRealtimeTicketV2Input,k as CreateCommunicationRealtimeTicketV2Output,q as ExchangeCommunicationDirectSessionV2Command,_ as ExchangeCommunicationDirectSessionV2Input,v as ExchangeCommunicationDirectSessionV2Output,j as ExchangeCommunicationHostSessionV2Command,S as ExchangeCommunicationHostSessionV2Input,C as ExchangeCommunicationHostSessionV2Output,W as StartCommunicationProviderOAuthV2Command,A as StartCommunicationProviderOAuthV2Input,b as StartCommunicationProviderOAuthV2Output};