@multiagency/sdk 0.3.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (78) hide show
  1. package/CHANGES.md +21 -0
  2. package/LICENSE +21 -0
  3. package/README.md +142 -0
  4. package/THIRD-PARTY-NOTICES +127 -0
  5. package/bin/release-server.d.mts +29 -0
  6. package/bin/release-server.mjs +143 -0
  7. package/dist/compensation-contract.d.ts +370 -0
  8. package/dist/compensation-contract.js +51 -0
  9. package/dist/contract/agent-connection.d.ts +86 -0
  10. package/dist/contract/agent-connection.js +36 -0
  11. package/dist/contract/app-access.d.ts +141 -0
  12. package/dist/contract/app-access.js +57 -0
  13. package/dist/contract/app-client.d.ts +140 -0
  14. package/dist/contract/app-client.js +61 -0
  15. package/dist/contract/app-consent.d.ts +68 -0
  16. package/dist/contract/app-consent.js +91 -0
  17. package/dist/contract/assets.d.ts +6 -0
  18. package/dist/contract/assets.js +6 -0
  19. package/dist/contract/client.d.ts +347 -0
  20. package/dist/contract/client.js +81 -0
  21. package/dist/contract/gateway.d.ts +74 -0
  22. package/dist/contract/gateway.js +47 -0
  23. package/dist/contract/index.d.ts +26 -0
  24. package/dist/contract/index.js +25 -0
  25. package/dist/contract/inputs.d.ts +230 -0
  26. package/dist/contract/inputs.js +99 -0
  27. package/dist/contract/intents-account.d.ts +5 -0
  28. package/dist/contract/intents-account.js +8 -0
  29. package/dist/contract/orpc-client.js +2037 -0
  30. package/dist/contract/owner-capabilities.d.ts +81 -0
  31. package/dist/contract/owner-capabilities.js +33 -0
  32. package/dist/contract/owner-client.d.ts +99 -0
  33. package/dist/contract/owner-client.js +146 -0
  34. package/dist/contract/owner-contract.d.ts +1156 -0
  35. package/dist/contract/owner-contract.js +37 -0
  36. package/dist/contract/owner-inputs.d.ts +166 -0
  37. package/dist/contract/owner-inputs.js +1 -0
  38. package/dist/contract/owner-outputs.d.ts +5749 -0
  39. package/dist/contract/owner-outputs.js +751 -0
  40. package/dist/contract/package-version.d.ts +5 -0
  41. package/dist/contract/package-version.js +2 -0
  42. package/dist/contract/payee-entry.d.ts +10 -0
  43. package/dist/contract/payee-entry.js +10 -0
  44. package/dist/contract/payee.d.ts +326 -0
  45. package/dist/contract/payee.js +32 -0
  46. package/dist/contract/permissions.d.ts +20 -0
  47. package/dist/contract/permissions.js +64 -0
  48. package/dist/contract/proposals.d.ts +178 -0
  49. package/dist/contract/proposals.js +27 -0
  50. package/dist/contract/run-log-schema.d.ts +888 -0
  51. package/dist/contract/run-log-schema.js +150 -0
  52. package/dist/contract/run-progress-schema.d.ts +104 -0
  53. package/dist/contract/run-progress-schema.js +20 -0
  54. package/dist/payee-contract.d.ts +9 -0
  55. package/dist/payee-contract.js +15 -0
  56. package/package.json +58 -0
  57. package/provenance.json +61 -0
  58. package/schemas/agentConnection.json +76 -0
  59. package/schemas/agentConnectionIssue.json +22 -0
  60. package/schemas/agentConnectionList.json +88 -0
  61. package/schemas/agentConnectionStarted.json +90 -0
  62. package/schemas/compensationSend.json +40 -0
  63. package/schemas/errorBody.json +16 -0
  64. package/schemas/fileResult.json +67 -0
  65. package/schemas/invoicesView.json +130 -0
  66. package/schemas/ownerCompensationView.json +556 -0
  67. package/schemas/payeeCompensationView.json +546 -0
  68. package/schemas/payeeWorkOrderRequest.json +31 -0
  69. package/schemas/publicWorkOrder.json +94 -0
  70. package/schemas/reportCommand.json +82 -0
  71. package/schemas/requestRecord.json +149 -0
  72. package/schemas/session.json +20 -0
  73. package/schemas/workOrderList.json +43 -0
  74. package/schemas/workOrderRequestResult.json +20 -0
  75. package/skills/app-server/SKILL.md +190 -0
  76. package/skills/getting-started/SKILL.md +90 -0
  77. package/skills/owner-workflows/SKILL.md +157 -0
  78. package/skills/payee-workflows/SKILL.md +200 -0
@@ -0,0 +1,347 @@
1
+ import { z } from "zod";
2
+ import { reportCommand } from "../compensation-contract.js";
3
+ import { agentConnectionIssue } from "./agent-connection.js";
4
+ import { payeeWorkOrderRequest } from "./payee.js";
5
+ export declare const capabilities: z.ZodObject<{
6
+ version: z.ZodLiteral<1>;
7
+ product: z.ZodLiteral<"invoices">;
8
+ capabilities: z.ZodArray<z.ZodString>;
9
+ }, z.core.$strip>;
10
+ export declare const signInChallenge: z.ZodObject<{
11
+ message: z.ZodString;
12
+ recipient: z.ZodString;
13
+ nonce: z.ZodString;
14
+ }, z.core.$strip>;
15
+ export declare const signIn: z.ZodObject<{
16
+ accountId: z.ZodString;
17
+ publicKey: z.ZodString;
18
+ signature: z.ZodString;
19
+ nonce: z.ZodString;
20
+ callbackUrls: z.ZodOptional<z.ZodArray<z.ZodString>>;
21
+ }, z.core.$strip>;
22
+ /** The caller's retained identity for a mutation. The client never mints or replaces one. */
23
+ export type Identity = {
24
+ submission: string;
25
+ } | {
26
+ invoiceId: string;
27
+ } | {
28
+ workOrderId: string;
29
+ } | {
30
+ commandId: string;
31
+ id: string;
32
+ expectedVersion: number;
33
+ };
34
+ /**
35
+ * `session` (401) and `forbidden` (403) stay distinct: a refusal is not proof that the session expired.
36
+ * `unknown`: a mutation was sent and its outcome is not known. Keep the identity and draft, read the
37
+ * existing record, and never send a replacement. `unavailable`: a read failed; reading again is safe.
38
+ */
39
+ export type Failure = {
40
+ ok: false;
41
+ kind: "session";
42
+ status: 401;
43
+ error: string;
44
+ } | {
45
+ ok: false;
46
+ kind: "forbidden";
47
+ status: 403;
48
+ error: string;
49
+ } | {
50
+ ok: false;
51
+ kind: "refused";
52
+ status: number;
53
+ error: string;
54
+ code?: string;
55
+ } | {
56
+ ok: false;
57
+ kind: "unavailable";
58
+ } | {
59
+ ok: false;
60
+ kind: "unknown";
61
+ identity: Identity;
62
+ };
63
+ export type Result<T> = {
64
+ ok: true;
65
+ value: T;
66
+ } | Failure;
67
+ type Fetch = (input: string, init: RequestInit) => Promise<Response>;
68
+ /**
69
+ * Typed payee routes relative to an instance base (`""` or `/i/own-<24 hex>`). Same-origin in a browser; no retries.
70
+ * With `token` (an agent connection, `tac_…`) the client runs outside a browser: `base` is the entry's absolute URL, the
71
+ * token is sent as a bearer and no cookie is sent. Only the connection's permitted routes answer; others are `forbidden`.
72
+ */
73
+ export declare function payeeClient({ base, fetch: send, token }?: {
74
+ base?: string;
75
+ fetch?: Fetch;
76
+ token?: string;
77
+ }): {
78
+ capabilities: () => Promise<Result<{
79
+ version: 1;
80
+ product: "invoices";
81
+ capabilities: string[];
82
+ }>>;
83
+ session: () => Promise<Result<{
84
+ account: string | null;
85
+ agreed: boolean;
86
+ }>>;
87
+ signInChallenge: () => Promise<Result<{
88
+ message: string;
89
+ recipient: string;
90
+ nonce: string;
91
+ }>>;
92
+ signIn: (input: z.infer<typeof signIn>) => Promise<Result<{
93
+ account: string;
94
+ agreed?: boolean | undefined;
95
+ }>>;
96
+ signOut: () => Promise<Result<{
97
+ account: null;
98
+ }>>;
99
+ invoices: () => Promise<Result<{
100
+ invoices: {
101
+ id: string;
102
+ amount: string | null;
103
+ note: string;
104
+ filedAt: string;
105
+ status: "busy" | "failed" | "needs_agreement" | "needs_review" | "paid" | "paying" | "prepared" | "refused" | "unknown" | "waiting";
106
+ revisionConflict: boolean;
107
+ }[];
108
+ agreements: {
109
+ id: string;
110
+ origin: "owner" | "payee";
111
+ amount: string;
112
+ note: string;
113
+ submission?: string | undefined;
114
+ terms?: {
115
+ maxAmount: string;
116
+ until: string;
117
+ } | undefined;
118
+ status: "agreed" | "declined" | "filed" | "proposed" | "requested";
119
+ at: string;
120
+ }[];
121
+ agreed: boolean;
122
+ }>>;
123
+ submitInvoice: (input: {
124
+ submission: string;
125
+ amount: string;
126
+ note: string;
127
+ }) => Promise<Result<{
128
+ id: string;
129
+ status: "busy" | "failed" | "needs_agreement" | "needs_review" | "paid" | "paying" | "prepared" | "refused" | "unknown" | "waiting";
130
+ revisionConflict?: boolean | undefined;
131
+ } | {
132
+ id: string;
133
+ status: "agreed" | "busy" | "declined" | "filed" | "proposed" | "requested";
134
+ }>>;
135
+ continueInvoice: (invoiceId: string) => Promise<Result<{
136
+ id: string;
137
+ status: "busy" | "failed" | "needs_agreement" | "needs_review" | "paid" | "paying" | "prepared" | "refused" | "unknown" | "waiting";
138
+ revisionConflict?: boolean | undefined;
139
+ } | {
140
+ id: string;
141
+ status: "agreed" | "busy" | "declined" | "filed" | "proposed" | "requested";
142
+ }>>;
143
+ workOrders: () => Promise<Result<{
144
+ orders: {
145
+ id: string;
146
+ amount: string;
147
+ note: string;
148
+ until: string;
149
+ createdAt: string;
150
+ }[];
151
+ }>>;
152
+ workOrder: (id: string) => Promise<Result<{
153
+ id: string;
154
+ amount: string;
155
+ note: string;
156
+ until: string;
157
+ createdAt: string;
158
+ invoice: {
159
+ id: string;
160
+ amount: string | null;
161
+ note: string;
162
+ filedAt: string;
163
+ status: "busy" | "failed" | "needs_agreement" | "needs_review" | "paid" | "paying" | "prepared" | "refused" | "unknown" | "waiting";
164
+ revisionConflict: boolean;
165
+ } | null;
166
+ ready: boolean;
167
+ unavailable: boolean;
168
+ }>>;
169
+ fileWorkOrder: (id: string) => Promise<Result<{
170
+ id: string;
171
+ status: "busy" | "failed" | "needs_agreement" | "needs_review" | "paid" | "paying" | "prepared" | "refused" | "unknown" | "waiting";
172
+ revisionConflict?: boolean | undefined;
173
+ } | {
174
+ id: string;
175
+ status: "agreed" | "busy" | "declined" | "filed" | "proposed" | "requested";
176
+ }>>;
177
+ requestWorkOrder: (input: z.infer<typeof payeeWorkOrderRequest>) => Promise<Result<{
178
+ id: string;
179
+ status: "requested";
180
+ }>>;
181
+ compensationSession: () => Promise<Result<{
182
+ account: string | null;
183
+ }>>;
184
+ compensationSignIn: (input: z.infer<typeof signIn>) => Promise<Result<{
185
+ account: string;
186
+ agreed?: boolean | undefined;
187
+ }>>;
188
+ compensation: () => Promise<Result<{
189
+ account: string;
190
+ agreements: {
191
+ id: string;
192
+ version: number;
193
+ terms: {
194
+ payee: string;
195
+ title: string;
196
+ document: string;
197
+ signedOn: string;
198
+ start: string;
199
+ end: string;
200
+ ceiling: string;
201
+ openingApproved: string;
202
+ scope: string;
203
+ };
204
+ recordedBy: string;
205
+ at: string;
206
+ approved: string;
207
+ remaining: string;
208
+ }[];
209
+ requests: {
210
+ id: string;
211
+ version: number;
212
+ payee: string;
213
+ agreementVersion: number;
214
+ report: {
215
+ agreementId: string;
216
+ amount?: string | undefined;
217
+ start: string;
218
+ end: string;
219
+ contributions: string;
220
+ assessment: string;
221
+ evidence: string[];
222
+ };
223
+ state: "approved" | "changes_requested" | "declined" | "draft" | "submitted";
224
+ approvedAmount?: string | undefined;
225
+ feedback: string;
226
+ reviewedBy: string | null;
227
+ at: string;
228
+ payment: {
229
+ mode: "isolated" | "shared";
230
+ id: string;
231
+ until?: string | undefined;
232
+ } | null;
233
+ }[];
234
+ history: {
235
+ sequence: number;
236
+ actor: string;
237
+ record: {
238
+ id: string;
239
+ version: number;
240
+ payee: string;
241
+ agreementVersion: number;
242
+ report: {
243
+ agreementId: string;
244
+ amount?: string | undefined;
245
+ start: string;
246
+ end: string;
247
+ contributions: string;
248
+ assessment: string;
249
+ evidence: string[];
250
+ };
251
+ state: "approved" | "changes_requested" | "declined" | "draft" | "submitted";
252
+ approvedAmount?: string | undefined;
253
+ feedback: string;
254
+ reviewedBy: string | null;
255
+ at: string;
256
+ payment: {
257
+ mode: "isolated" | "shared";
258
+ id: string;
259
+ until?: string | undefined;
260
+ } | null;
261
+ } | {
262
+ id: string;
263
+ version: number;
264
+ terms: {
265
+ payee: string;
266
+ title: string;
267
+ document: string;
268
+ signedOn: string;
269
+ start: string;
270
+ end: string;
271
+ ceiling: string;
272
+ openingApproved: string;
273
+ scope: string;
274
+ };
275
+ recordedBy: string;
276
+ at: string;
277
+ };
278
+ }[];
279
+ payments: {
280
+ requestId: string;
281
+ id: string;
282
+ status: string;
283
+ }[];
284
+ }>>;
285
+ submitReport: (command: z.infer<typeof reportCommand>) => Promise<Result<{
286
+ id: string;
287
+ version: number;
288
+ payee: string;
289
+ agreementVersion: number;
290
+ report: {
291
+ agreementId: string;
292
+ amount?: string | undefined;
293
+ start: string;
294
+ end: string;
295
+ contributions: string;
296
+ assessment: string;
297
+ evidence: string[];
298
+ };
299
+ state: "approved" | "changes_requested" | "declined" | "draft" | "submitted";
300
+ approvedAmount?: string | undefined;
301
+ feedback: string;
302
+ reviewedBy: string | null;
303
+ at: string;
304
+ payment: {
305
+ mode: "isolated" | "shared";
306
+ id: string;
307
+ until?: string | undefined;
308
+ } | null;
309
+ }>>;
310
+ agentConnections: () => Promise<Result<{
311
+ connections: {
312
+ id: string;
313
+ label: string;
314
+ role: "payee";
315
+ permissions: ("compensation.read" | "compensation.submit")[];
316
+ host: string;
317
+ instance: string;
318
+ account: string;
319
+ agentId: string;
320
+ createdAt: string;
321
+ expiresAt: string;
322
+ revoked: boolean;
323
+ }[];
324
+ }>>;
325
+ /** A lost answer is `unavailable`: a started connection is not a money action, and an orphan is listed and revocable. */
326
+ startAgentConnection: (input: z.input<typeof agentConnectionIssue>) => Promise<Result<{
327
+ connection: {
328
+ id: string;
329
+ label: string;
330
+ role: "payee";
331
+ permissions: ("compensation.read" | "compensation.submit")[];
332
+ host: string;
333
+ instance: string;
334
+ account: string;
335
+ agentId: string;
336
+ createdAt: string;
337
+ expiresAt: string;
338
+ revoked: boolean;
339
+ };
340
+ token: string;
341
+ }>>;
342
+ revokeAgentConnection: (id: string) => Promise<Result<{
343
+ revoked: true;
344
+ }>>;
345
+ };
346
+ export type PayeeClient = ReturnType<typeof payeeClient>;
347
+ export {};
@@ -0,0 +1,81 @@
1
+ import { z } from "zod";
2
+ import { requestRecord, reportCommand } from "../compensation-contract.js";
3
+ import { payeeContract } from "../payee-contract.js";
4
+ import { agentConnectionIssue, agentConnectionList, agentConnectionRevoked, agentConnectionStarted } from "./agent-connection.js";
5
+ import { compensationSession, errorBody, fileResult, invoicesView, publicWorkOrder, session, signInResult, signOutResult, payeeCompensationView, workOrderList, payeeWorkOrderRequest, workOrderRequestResult } from "./payee.js";
6
+ export const capabilities = z.object({ version: z.literal(payeeContract.version), product: z.literal(payeeContract.product), capabilities: z.array(z.string()) });
7
+ export const signInChallenge = z.object({ message: z.string(), recipient: z.string(), nonce: z.string() });
8
+ export const signIn = z.object({ accountId: z.string(), publicKey: z.string(), signature: z.string(), nonce: z.string(), callbackUrls: z.array(z.string()).max(3).optional() });
9
+ /**
10
+ * Typed payee routes relative to an instance base (`""` or `/i/own-<24 hex>`). Same-origin in a browser; no retries.
11
+ * With `token` (an agent connection, `tac_…`) the client runs outside a browser: `base` is the entry's absolute URL, the
12
+ * token is sent as a bearer and no cookie is sent. Only the connection's permitted routes answer; others are `forbidden`.
13
+ */
14
+ export function payeeClient({ base = "", fetch: send = globalThis.fetch, token } = {}) {
15
+ async function call(schema, method, path, body, identity) {
16
+ const lost = () => identity ? { ok: false, kind: "unknown", identity } : { ok: false, kind: "unavailable" };
17
+ let response;
18
+ try {
19
+ response = await send(`${base}${path}`, { method, credentials: token ? "omit" : "same-origin",
20
+ headers: { accept: "application/json", ...(token && { authorization: `Bearer ${token}` }), ...(body !== undefined && { "content-type": "application/json" }) },
21
+ ...(body !== undefined && { body: JSON.stringify(body) }) });
22
+ }
23
+ catch {
24
+ return lost();
25
+ }
26
+ let json, readable = true;
27
+ try {
28
+ json = await response.json();
29
+ }
30
+ catch {
31
+ readable = false;
32
+ }
33
+ const answer = errorBody.safeParse(json);
34
+ // 401 and 403 are decided by status alone: a proxy or gateway page still ends the session or refuses.
35
+ if (response.status === 401)
36
+ return { ok: false, kind: "session", status: 401, error: answer.success ? answer.data.error : "Sign in again." };
37
+ if (response.status === 403)
38
+ return { ok: false, kind: "forbidden", status: 403, error: answer.success ? answer.data.error : "This account may not do that." };
39
+ if (!readable)
40
+ return lost();
41
+ if (response.ok) {
42
+ const parsed = schema.safeParse(json);
43
+ return parsed.success ? { ok: true, value: parsed.data } : lost();
44
+ }
45
+ // A gateway or server failure may follow an accepted mutation; only a 4xx answer is a refusal.
46
+ if (response.status >= 500)
47
+ return lost();
48
+ return { ok: false, kind: "refused", status: response.status, error: answer.success ? answer.data.error : "Request refused.", ...(answer.success && answer.data.code && { code: answer.data.code }) };
49
+ }
50
+ return {
51
+ capabilities: () => call(capabilities, "GET", "/api/capabilities"),
52
+ // supplier-session-v1
53
+ session: () => call(session, "GET", "/api/session"),
54
+ signInChallenge: () => call(signInChallenge, "POST", "/api/signin/challenge", {}),
55
+ signIn: (input) => call(signInResult, "POST", "/api/signin", signIn.parse(input)),
56
+ signOut: () => call(signOutResult, "POST", "/api/signout", {}),
57
+ // supplier-invoices-v1
58
+ invoices: () => call(invoicesView, "GET", "/api/invoices"),
59
+ submitInvoice: (input) => call(fileResult, "POST", "/api/invoices", input, { submission: input.submission }),
60
+ continueInvoice: (invoiceId) => call(fileResult, "POST", `/api/invoices/${encodeURIComponent(invoiceId)}/continue`, {}, { invoiceId }),
61
+ // supplier-work-orders-v1
62
+ workOrders: () => call(workOrderList, "GET", "/api/work-orders"),
63
+ workOrder: (id) => call(publicWorkOrder, "GET", `/api/work-orders/${encodeURIComponent(id)}`),
64
+ fileWorkOrder: (id) => call(fileResult, "POST", `/api/work-orders/${encodeURIComponent(id)}/file`, {}, { workOrderId: id }),
65
+ // supplier-work-order-requests-v1
66
+ requestWorkOrder: (input) => call(workOrderRequestResult, "POST", "/api/work-orders", payeeWorkOrderRequest.parse(input), { submission: input.submission }),
67
+ // supplier-compensation-v2
68
+ compensationSession: () => call(compensationSession, "GET", "/api/compensation/session"),
69
+ compensationSignIn: (input) => call(signInResult, "POST", "/api/compensation/signin", signIn.parse(input)),
70
+ compensation: () => call(payeeCompensationView, "GET", "/api/compensation"),
71
+ submitReport: (command) => {
72
+ const parsed = reportCommand.parse(command);
73
+ return call(requestRecord, "POST", "/api/compensation", parsed, { commandId: parsed.commandId, id: parsed.id, expectedVersion: parsed.expectedVersion });
74
+ },
75
+ // supplier-agent-connections-v1: managed from the signed-in browser session only (a bearer is refused).
76
+ agentConnections: () => call(agentConnectionList, "GET", "/api/agent-connections"),
77
+ /** A lost answer is `unavailable`: a started connection is not a money action, and an orphan is listed and revocable. */
78
+ startAgentConnection: (input) => call(agentConnectionStarted, "POST", "/api/agent-connections", agentConnectionIssue.parse(input)),
79
+ revokeAgentConnection: (id) => call(agentConnectionRevoked, "DELETE", `/api/agent-connections/${encodeURIComponent(id)}`),
80
+ };
81
+ }
@@ -0,0 +1,74 @@
1
+ import { z } from "zod";
2
+ export declare const gatewayAccess: z.ZodObject<{
3
+ canSign: z.ZodBoolean;
4
+ canPropose: z.ZodBoolean;
5
+ canVote: z.ZodBoolean;
6
+ canExecute: z.ZodBoolean;
7
+ canManage: z.ZodBoolean;
8
+ }, z.core.$loose>;
9
+ export declare const gatewayAgent: z.ZodObject<{
10
+ name: z.ZodString;
11
+ owner: z.ZodString;
12
+ dao: z.ZodBoolean;
13
+ area: z.ZodOptional<z.ZodEnum<{
14
+ payables: "payables";
15
+ treasury: "treasury";
16
+ }>>;
17
+ managed: z.ZodOptional<z.ZodBoolean>;
18
+ invoices: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
19
+ }, z.core.$loose>;
20
+ /** `GET /gw/me`: the agents this host shows the visitor, and the signed-in account's access to each. */
21
+ export declare const gatewayDiscovery: z.ZodObject<{
22
+ agents: z.ZodArray<z.ZodObject<{
23
+ name: z.ZodString;
24
+ owner: z.ZodString;
25
+ dao: z.ZodBoolean;
26
+ area: z.ZodOptional<z.ZodEnum<{
27
+ payables: "payables";
28
+ treasury: "treasury";
29
+ }>>;
30
+ managed: z.ZodOptional<z.ZodBoolean>;
31
+ invoices: z.ZodOptional<z.ZodNullable<z.ZodURL>>;
32
+ }, z.core.$loose>>;
33
+ invoices: z.ZodNullable<z.ZodURL>;
34
+ viewer: z.ZodNullable<z.ZodObject<{
35
+ account: z.ZodString;
36
+ access: z.ZodRecord<z.ZodString, z.ZodObject<{
37
+ canSign: z.ZodBoolean;
38
+ canPropose: z.ZodBoolean;
39
+ canVote: z.ZodBoolean;
40
+ canExecute: z.ZodBoolean;
41
+ canManage: z.ZodBoolean;
42
+ }, z.core.$loose>>;
43
+ }, z.core.$loose>>;
44
+ apps: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
45
+ demo: z.ZodOptional<z.ZodEnum<{
46
+ invoices: "invoices";
47
+ payables: "payables";
48
+ showcase: "showcase";
49
+ treasury: "treasury";
50
+ }>>;
51
+ capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;
52
+ setupAreas: z.ZodOptional<z.ZodArray<z.ZodEnum<{
53
+ payables: "payables";
54
+ treasury: "treasury";
55
+ }>>>;
56
+ selfService: z.ZodOptional<z.ZodBoolean>;
57
+ walkthroughs: z.ZodOptional<z.ZodBoolean>;
58
+ }, z.core.$loose>;
59
+ export type GatewayDiscovery = z.output<typeof gatewayDiscovery>;
60
+ export type GatewayAgent = z.output<typeof gatewayAgent>;
61
+ /** Why the gateway refused: no valid session, no access to this agent, or no permission for this procedure. */
62
+ export declare const GATEWAY_DENIAL_SCOPES: readonly ["session", "agent", "procedure"];
63
+ export type GatewayDenialScope = (typeof GATEWAY_DENIAL_SCOPES)[number];
64
+ /** The gateway's own 401/403 answer. `access` is absent from older gateways, machine routes and proxies. */
65
+ export declare const gatewayDenial: z.ZodObject<{
66
+ error: z.ZodString;
67
+ access: z.ZodOptional<z.ZodEnum<{
68
+ agent: "agent";
69
+ procedure: "procedure";
70
+ session: "session";
71
+ }>>;
72
+ }, z.core.$loose>;
73
+ /** The scope a gateway denial body declares, or undefined when it declares none: the caller decides its own default. */
74
+ export declare function gatewayDenialScope(body: unknown): GatewayDenialScope | undefined;
@@ -0,0 +1,47 @@
1
+ import { z } from "zod";
2
+ /**
3
+ * The hosted gateway's own routes (`gateway-session-v1`), as owner frontends read them. Discovery describes what this
4
+ * host shows; it grants nothing. Every agent call is still authorized per session, agent and procedure.
5
+ */
6
+ const area = z.enum(["treasury", "payables"]);
7
+ /** An HTTP(S) payee entry. The protocol is checked by the URL schema itself, so a malformed value fails the parse. */
8
+ const entry = z.url({ protocol: /^https?$/ });
9
+ export const gatewayAccess = z.looseObject({ canSign: z.boolean(), canPropose: z.boolean(), canVote: z.boolean(), canExecute: z.boolean(), canManage: z.boolean() });
10
+ export const gatewayAgent = z.looseObject({
11
+ name: z.string().regex(/^[a-z0-9-]{1,32}$/),
12
+ owner: z.string().min(1),
13
+ /** Whether the owner is a Sputnik DAO (owner actions then pass through its votes). */
14
+ dao: z.boolean(),
15
+ area: area.optional(),
16
+ /** A self-service instance created through `/gw/agents`. */
17
+ managed: z.boolean().optional(),
18
+ /** This agent's payee entry, or null when it has none. Absent: the host-wide `invoices` applies. */
19
+ invoices: entry.nullable().optional(),
20
+ });
21
+ /** `GET /gw/me`: the agents this host shows the visitor, and the signed-in account's access to each. */
22
+ export const gatewayDiscovery = z.looseObject({
23
+ agents: z.array(gatewayAgent),
24
+ invoices: entry.nullable(),
25
+ /** Null when signed out, or signed in without access here. */
26
+ viewer: z.looseObject({ account: z.string().min(1), access: z.record(z.string(), gatewayAccess) }).nullable(),
27
+ /** The hosts serving each app area on this deployment. */
28
+ apps: z.record(z.string(), z.string()).optional(),
29
+ demo: z.enum(["showcase", "payables", "treasury", "invoices"]).optional(),
30
+ /** The owner-app capabilities this host provides (`ownerCapabilities`). */
31
+ capabilities: z.array(z.string()).optional(),
32
+ /** The areas the visitor may create agents in here. */
33
+ setupAreas: z.array(area).optional(),
34
+ selfService: z.boolean().optional(),
35
+ walkthroughs: z.boolean().optional(),
36
+ });
37
+ /** Why the gateway refused: no valid session, no access to this agent, or no permission for this procedure. */
38
+ export const GATEWAY_DENIAL_SCOPES = ["session", "agent", "procedure"];
39
+ /** The gateway's own 401/403 answer. `access` is absent from older gateways, machine routes and proxies. */
40
+ export const gatewayDenial = z.looseObject({ error: z.string(), access: z.enum(GATEWAY_DENIAL_SCOPES).optional() });
41
+ /** The scope a gateway denial body declares, or undefined when it declares none: the caller decides its own default. */
42
+ export function gatewayDenialScope(body) {
43
+ const parsed = gatewayDenial.safeParse(body);
44
+ return parsed.success ? parsed.data.access : undefined;
45
+ }
46
+ const accessMatches = true;
47
+ void accessMatches;
@@ -0,0 +1,26 @@
1
+ /**
2
+ * @multiagency/sdk: the platform contract apps compile against instead of copying the platform.
3
+ * The platform's own handlers import these modules; the package is packed from the same files.
4
+ * `@multiagency/sdk/payee` is the payee side alone (zod only), for apps without owner procedures.
5
+ */
6
+ export { contractPackage } from "./package-version.js";
7
+ export { payeeContract, compatiblePayeeFrontend, compatibleRelease } from "../payee-contract.js";
8
+ export * from "./owner-capabilities.js";
9
+ export * from "../compensation-contract.js";
10
+ export * from "./payee.js";
11
+ export * from "./client.js";
12
+ export * from "./agent-connection.js";
13
+ export * from "./owner-outputs.js";
14
+ export * from "./owner-client.js";
15
+ export * from "./app-consent.js";
16
+ export * from "./app-access.js";
17
+ export * from "./app-client.js";
18
+ export type { OwnerInputs, OwnerAction } from "./owner-inputs.js";
19
+ export * from "./inputs.js";
20
+ export { ASSETS } from "./assets.js";
21
+ export { intentsAccount, isNearcomAddress, validIntentsAccount } from "./intents-account.js";
22
+ export { mayCall, type Access } from "./permissions.js";
23
+ export * from "./gateway.js";
24
+ export * from "./proposals.js";
25
+ export * from "./run-progress-schema.js";
26
+ export { RecordingSchema, MAX_RECORDING_BYTES, AGUI_VERSION, AGUI_PROTOCOL_VERSION, type Recording, type RunLogEvent } from "./run-log-schema.js";
@@ -0,0 +1,25 @@
1
+ /**
2
+ * @multiagency/sdk: the platform contract apps compile against instead of copying the platform.
3
+ * The platform's own handlers import these modules; the package is packed from the same files.
4
+ * `@multiagency/sdk/payee` is the payee side alone (zod only), for apps without owner procedures.
5
+ */
6
+ export { contractPackage } from "./package-version.js";
7
+ export { payeeContract, compatiblePayeeFrontend, compatibleRelease } from "../payee-contract.js";
8
+ export * from "./owner-capabilities.js";
9
+ export * from "../compensation-contract.js";
10
+ export * from "./payee.js";
11
+ export * from "./client.js";
12
+ export * from "./agent-connection.js";
13
+ export * from "./owner-outputs.js";
14
+ export * from "./owner-client.js";
15
+ export * from "./app-consent.js";
16
+ export * from "./app-access.js";
17
+ export * from "./app-client.js";
18
+ export * from "./inputs.js";
19
+ export { ASSETS } from "./assets.js";
20
+ export { intentsAccount, isNearcomAddress, validIntentsAccount } from "./intents-account.js";
21
+ export { mayCall } from "./permissions.js";
22
+ export * from "./gateway.js";
23
+ export * from "./proposals.js";
24
+ export * from "./run-progress-schema.js";
25
+ export { RecordingSchema, MAX_RECORDING_BYTES, AGUI_VERSION, AGUI_PROTOCOL_VERSION } from "./run-log-schema.js";