npm - @opencode/protocol - Versions diffs - 0.0.0-dev-19447 → 0.0.0-dev-19449 - Mend

@opencode/protocol 0.0.0-dev-19447 → 0.0.0-dev-19449

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/groups/event.d.ts +185 -0
package/dist/groups/permission.d.ts +12 -1
package/dist/groups/permission.js +12 -0
package/dist/groups/session.d.ts +175 -0
package/dist/groups/session.js +2 -0
package/package.json +2 -2

package/dist/groups/event.d.ts CHANGED Viewed

@@ -367,6 +367,15 @@ export declare const EventGroup: HttpApiGroup.HttpApiGroup<"server.event", HttpA
             };
         }>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly version: Schema.String;
         readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
             create: () => string & import("effect/Brand").Brand<"SessionID">;
@@ -451,6 +460,15 @@ export declare const EventGroup: HttpApiGroup.HttpApiGroup<"server.event", HttpA
             };
         }>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly version: Schema.String;
         readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
             create: () => string & import("effect/Brand").Brand<"SessionID">;
@@ -827,6 +845,66 @@ export declare const EventGroup: HttpApiGroup.HttpApiGroup<"server.event", HttpA
             descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
         };
     }>;
+}, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "Event.ID"> & {
+        create: () => string & import("effect/Brand").Brand<"Event.ID">;
+    };
+    readonly created: Schema.Finite;
+    readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Unknown>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>, never, never>;
+    readonly type: Schema.Literal<"session.permissions.updated">;
+    readonly durable: Schema.Struct<{
+        readonly aggregateID: Schema.String;
+        readonly seq: Schema.brand<Schema.Int, "Event.Seq">;
+        readonly version: Schema.decodeTo<Schema.toType<Schema.brand<Schema.Int, "Event.Version">>, Schema.Literal<number>, never, never>;
+    }>;
+    readonly location: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
+        readonly directory: Schema.brand<Schema.String, "AbsolutePath">;
+        readonly workspaceID: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>>, Schema.optionalKey<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>, never, never>;
+    }>>>, Schema.optionalKey<Schema.Struct<{
+        readonly directory: Schema.brand<Schema.String, "AbsolutePath">;
+        readonly workspaceID: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>>, Schema.optionalKey<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>, never, never>;
+    }>>, never, never>;
+    readonly data: Schema.Struct<{
+        readonly permissions: Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>;
+        readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
+            create: () => string & import("effect/Brand").Brand<"SessionID">;
+            descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
+        };
+    }>;
+}> & {
+    type: "session.permissions.updated";
+    durability: "durable";
+    durable: {
+        readonly version: number;
+        readonly aggregate: string;
+    };
+    data: Schema.Struct<{
+        readonly permissions: Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>;
+        readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
+            create: () => string & import("effect/Brand").Brand<"SessionID">;
+            descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
+        };
+    }>;
 }, Schema.Struct<{
     readonly id: Schema.brand<Schema.String, "Event.ID"> & {
         create: () => string & import("effect/Brand").Brand<"Event.ID">;
@@ -6616,6 +6694,11 @@ export declare const EventGroup: HttpApiGroup.HttpApiGroup<"server.event", HttpA
             readonly providerID: string & import("effect/Brand").Brand<"Provider.ID">;
             readonly variant?: (string & import("effect/Brand").Brand<"Model.VariantID">) | undefined;
         } | undefined;
+        readonly permissions?: readonly {
+            readonly action: string;
+            readonly resource: string;
+            readonly effect: "allow" | "deny" | "ask";
+        }[] | undefined;
         readonly agent?: (string & import("effect/Brand").Brand<"Agent.ID">) | undefined;
         readonly subpath?: (string & import("effect/Brand").Brand<"RelativePath">) | undefined;
         readonly parentID?: (string & import("effect/Brand").Brand<"SessionID">) | undefined;
@@ -6729,6 +6812,30 @@ export declare const EventGroup: HttpApiGroup.HttpApiGroup<"server.event", HttpA
     readonly metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
+} | {
+    readonly id: string & import("effect/Brand").Brand<"Event.ID">;
+    readonly data: {
+        readonly permissions: readonly {
+            readonly action: string;
+            readonly resource: string;
+            readonly effect: "allow" | "deny" | "ask";
+        }[];
+        readonly sessionID: string & import("effect/Brand").Brand<"SessionID">;
+    };
+    readonly durable: {
+        readonly aggregateID: string;
+        readonly seq: number & import("effect/Brand").Brand<"Event.Seq">;
+        readonly version: number & import("effect/Brand").Brand<"Event.Version">;
+    };
+    readonly type: "session.permissions.updated";
+    readonly created: number;
+    readonly location?: {
+        readonly directory: string & import("effect/Brand").Brand<"AbsolutePath">;
+        readonly workspaceID?: (string & import("effect/Brand").Brand<"Workspace.ID">) | undefined;
+    } | undefined;
+    readonly metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
 } | {
     readonly id: string & import("effect/Brand").Brand<"Event.ID">;
     readonly data: {
@@ -8651,6 +8758,15 @@ export declare const OpenCodeEvent: Schema.Union<readonly [Schema.Struct<{
             };
         }>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly version: Schema.String;
         readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
             create: () => string & import("effect/Brand").Brand<"SessionID">;
@@ -8735,6 +8851,15 @@ export declare const OpenCodeEvent: Schema.Union<readonly [Schema.Struct<{
             };
         }>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly version: Schema.String;
         readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
             create: () => string & import("effect/Brand").Brand<"SessionID">;
@@ -9111,6 +9236,66 @@ export declare const OpenCodeEvent: Schema.Union<readonly [Schema.Struct<{
             descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
         };
     }>;
+}, Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "Event.ID"> & {
+        create: () => string & import("effect/Brand").Brand<"Event.ID">;
+    };
+    readonly created: Schema.Finite;
+    readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Unknown>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>, never, never>;
+    readonly type: Schema.Literal<"session.permissions.updated">;
+    readonly durable: Schema.Struct<{
+        readonly aggregateID: Schema.String;
+        readonly seq: Schema.brand<Schema.Int, "Event.Seq">;
+        readonly version: Schema.decodeTo<Schema.toType<Schema.brand<Schema.Int, "Event.Version">>, Schema.Literal<number>, never, never>;
+    }>;
+    readonly location: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
+        readonly directory: Schema.brand<Schema.String, "AbsolutePath">;
+        readonly workspaceID: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>>, Schema.optionalKey<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>, never, never>;
+    }>>>, Schema.optionalKey<Schema.Struct<{
+        readonly directory: Schema.brand<Schema.String, "AbsolutePath">;
+        readonly workspaceID: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>>, Schema.optionalKey<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>, never, never>;
+    }>>, never, never>;
+    readonly data: Schema.Struct<{
+        readonly permissions: Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>;
+        readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
+            create: () => string & import("effect/Brand").Brand<"SessionID">;
+            descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
+        };
+    }>;
+}> & {
+    type: "session.permissions.updated";
+    durability: "durable";
+    durable: {
+        readonly version: number;
+        readonly aggregate: string;
+    };
+    data: Schema.Struct<{
+        readonly permissions: Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>;
+        readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
+            create: () => string & import("effect/Brand").Brand<"SessionID">;
+            descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
+        };
+    }>;
 }, Schema.Struct<{
     readonly id: Schema.brand<Schema.String, "Event.ID"> & {
         create: () => string & import("effect/Brand").Brand<"Event.ID">;

package/dist/groups/permission.d.ts CHANGED Viewed

@@ -153,4 +153,15 @@ export declare const makePermissionGroup: <LocationId extends HttpApiMiddleware.
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly reply: Schema.Literals<readonly ["once", "always", "reject"]>;
     readonly message: Schema.optional<Schema.String>;
-}>>, never, Schema.toCodecJson<HttpApiSchema.NoContent>, Schema.toCodecJson<typeof SessionNotFoundError | typeof PermissionNotFoundError>, SessionLocationId, HttpApiMiddleware.Requires<SessionLocationId>>, false>;
+}>>, never, Schema.toCodecJson<HttpApiSchema.NoContent>, Schema.toCodecJson<typeof SessionNotFoundError | typeof PermissionNotFoundError>, SessionLocationId, HttpApiMiddleware.Requires<SessionLocationId>> | HttpApiEndpoint.HttpApiEndpoint<"session.permission.rules", "PUT", "/api/session/:sessionID/permission/rules", Schema.toCodecStringTree<Schema.Struct<{
+    sessionID: Schema.brand<Schema.String, "SessionID"> & {
+        create: () => string & import("effect/Brand").Brand<"SessionID">;
+        descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
+    };
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly permissions: Schema.$Array<Schema.Struct<{
+        readonly action: Schema.String;
+        readonly resource: Schema.String;
+        readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+    }>>;
+}>>, never, Schema.toCodecJson<HttpApiSchema.NoContent>, Schema.toCodecJson<typeof SessionNotFoundError>, SessionLocationId, HttpApiMiddleware.Requires<SessionLocationId>>, false>;

package/dist/groups/permission.js CHANGED Viewed

@@ -93,5 +93,17 @@ export const makePermissionGroup = (locationMiddleware, sessionLocationMiddlewar
     identifier: "v2.session.permission.reply",
     summary: "Reply to pending permission request",
     description: "Respond to a pending permission request owned by a session.",
+})))
+    .add(HttpApiEndpoint.put("session.permission.rules", "/api/session/:sessionID/permission/rules", {
+    params: { sessionID: Session.ID },
+    payload: Schema.Struct({ permissions: Permission.Ruleset }),
+    success: HttpApiSchema.NoContent,
+    error: SessionNotFoundError,
+})
+    .middleware(sessionLocationMiddleware)
+    .annotateMerge(OpenApi.annotations({
+    identifier: "v2.session.permission.rules",
+    summary: "Replace session permission rules",
+    description: "Replace the session-scoped permission rules. Rules are evaluated after the agent's rules, and the last matching rule wins.",
 })))
     .annotateMerge(OpenApi.annotations({ title: "permission", description: "Experimental permission routes." }));

package/dist/groups/session.d.ts CHANGED Viewed

@@ -275,6 +275,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
         }>;
         readonly subpath: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "RelativePath">>>, Schema.optionalKey<Schema.brand<Schema.String, "RelativePath">>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly revert: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
             readonly messageID: Schema.brand<Schema.String, "Session.Message.ID"> & {
                 create: () => string & import("effect/Brand").Brand<"Session.Message.ID">;
@@ -536,6 +545,11 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
         }>, never, never>;
     }>>;
     readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly permissions: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly action: Schema.String;
+        readonly resource: Schema.String;
+        readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+    }>>>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
     readonly data: Schema.Struct<{
         readonly id: Schema.brand<Schema.String, "SessionID"> & {
@@ -668,6 +682,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
         }>;
         readonly subpath: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "RelativePath">>>, Schema.optionalKey<Schema.brand<Schema.String, "RelativePath">>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly revert: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
             readonly messageID: Schema.brand<Schema.String, "Session.Message.ID"> & {
                 create: () => string & import("effect/Brand").Brand<"Session.Message.ID">;
@@ -852,6 +875,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
         }>;
         readonly subpath: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "RelativePath">>>, Schema.optionalKey<Schema.brand<Schema.String, "RelativePath">>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly revert: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
             readonly messageID: Schema.brand<Schema.String, "Session.Message.ID"> & {
                 create: () => string & import("effect/Brand").Brand<"Session.Message.ID">;
@@ -1735,6 +1767,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
         }>;
         readonly subpath: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "RelativePath">>>, Schema.optionalKey<Schema.brand<Schema.String, "RelativePath">>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly revert: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
             readonly messageID: Schema.brand<Schema.String, "Session.Message.ID"> & {
                 create: () => string & import("effect/Brand").Brand<"Session.Message.ID">;
@@ -1917,6 +1958,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
             }>;
             readonly subpath: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "RelativePath">>>, Schema.optionalKey<Schema.brand<Schema.String, "RelativePath">>, never, never>;
             readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+            readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+                readonly action: Schema.String;
+                readonly resource: Schema.String;
+                readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+            }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+                readonly action: Schema.String;
+                readonly resource: Schema.String;
+                readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+            }>>>, never, never>;
             readonly revert: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
                 readonly messageID: Schema.brand<Schema.String, "Session.Message.ID"> & {
                     create: () => string & import("effect/Brand").Brand<"Session.Message.ID">;
@@ -2813,6 +2863,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
         }>;
         readonly subpath: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "RelativePath">>>, Schema.optionalKey<Schema.brand<Schema.String, "RelativePath">>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly revert: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
             readonly messageID: Schema.brand<Schema.String, "Session.Message.ID"> & {
                 create: () => string & import("effect/Brand").Brand<"Session.Message.ID">;
@@ -3007,6 +3066,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
         }>;
         readonly subpath: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "RelativePath">>>, Schema.optionalKey<Schema.brand<Schema.String, "RelativePath">>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly revert: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
             readonly messageID: Schema.brand<Schema.String, "Session.Message.ID"> & {
                 create: () => string & import("effect/Brand").Brand<"Session.Message.ID">;
@@ -4690,6 +4758,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
             };
         }>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly version: Schema.String;
         readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
             create: () => string & import("effect/Brand").Brand<"SessionID">;
@@ -4774,6 +4851,15 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
             };
         }>, never, never>;
         readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>, never, never>;
+        readonly permissions: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>>, Schema.optionalKey<Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>>, never, never>;
         readonly version: Schema.String;
         readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
             create: () => string & import("effect/Brand").Brand<"SessionID">;
@@ -5150,6 +5236,66 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
             descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
         };
     }>;
+}) | (Schema.Struct<{
+    readonly id: Schema.brand<Schema.String, "Event.ID"> & {
+        create: () => string & import("effect/Brand").Brand<"Event.ID">;
+    };
+    readonly created: Schema.Finite;
+    readonly metadata: Schema.decodeTo<Schema.optional<Schema.toType<Schema.$Record<Schema.String, Schema.Unknown>>>, Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>, never, never>;
+    readonly type: Schema.Literal<"session.permissions.updated">;
+    readonly durable: Schema.Struct<{
+        readonly aggregateID: Schema.String;
+        readonly seq: Schema.brand<Schema.Int, "Event.Seq">;
+        readonly version: Schema.decodeTo<Schema.toType<Schema.brand<Schema.Int, "Event.Version">>, Schema.Literal<number>, never, never>;
+    }>;
+    readonly location: Schema.decodeTo<Schema.optional<Schema.toType<Schema.Struct<{
+        readonly directory: Schema.brand<Schema.String, "AbsolutePath">;
+        readonly workspaceID: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>>, Schema.optionalKey<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>, never, never>;
+    }>>>, Schema.optionalKey<Schema.Struct<{
+        readonly directory: Schema.brand<Schema.String, "AbsolutePath">;
+        readonly workspaceID: Schema.decodeTo<Schema.optional<Schema.toType<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>>, Schema.optionalKey<Schema.brand<Schema.String, "Workspace.ID"> & {
+            ascending: (id?: string) => string & import("effect/Brand").Brand<"Workspace.ID">;
+            create: () => string & import("effect/Brand").Brand<"Workspace.ID">;
+        }>, never, never>;
+    }>>, never, never>;
+    readonly data: Schema.Struct<{
+        readonly permissions: Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>;
+        readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
+            create: () => string & import("effect/Brand").Brand<"SessionID">;
+            descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
+        };
+    }>;
+}> & {
+    type: "session.permissions.updated";
+    durability: "durable";
+    durable: {
+        readonly version: number;
+        readonly aggregate: string;
+    };
+    data: Schema.Struct<{
+        readonly permissions: Schema.$Array<Schema.Struct<{
+            readonly action: Schema.String;
+            readonly resource: Schema.String;
+            readonly effect: Schema.Literals<readonly ["allow", "deny", "ask"]>;
+        }>>;
+        readonly sessionID: Schema.brand<Schema.String, "SessionID"> & {
+            create: () => string & import("effect/Brand").Brand<"SessionID">;
+            descending: (id?: string) => string & import("effect/Brand").Brand<"SessionID">;
+        };
+    }>;
 }) | (Schema.Struct<{
     readonly id: Schema.brand<Schema.String, "Event.ID"> & {
         create: () => string & import("effect/Brand").Brand<"Event.ID">;
@@ -8552,6 +8698,11 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
             readonly providerID: string & import("effect/Brand").Brand<"Provider.ID">;
             readonly variant?: (string & import("effect/Brand").Brand<"Model.VariantID">) | undefined;
         } | undefined;
+        readonly permissions?: readonly {
+            readonly action: string;
+            readonly resource: string;
+            readonly effect: "allow" | "deny" | "ask";
+        }[] | undefined;
         readonly agent?: (string & import("effect/Brand").Brand<"Agent.ID">) | undefined;
         readonly subpath?: (string & import("effect/Brand").Brand<"RelativePath">) | undefined;
         readonly parentID?: (string & import("effect/Brand").Brand<"SessionID">) | undefined;
@@ -8665,6 +8816,30 @@ export declare const makeSessionGroup: <I extends HttpApiMiddleware.AnyId, S>(se
     readonly metadata?: {
         readonly [x: string]: unknown;
     } | undefined;
+} | {
+    readonly id: string & import("effect/Brand").Brand<"Event.ID">;
+    readonly data: {
+        readonly permissions: readonly {
+            readonly action: string;
+            readonly resource: string;
+            readonly effect: "allow" | "deny" | "ask";
+        }[];
+        readonly sessionID: string & import("effect/Brand").Brand<"SessionID">;
+    };
+    readonly durable: {
+        readonly aggregateID: string;
+        readonly seq: number & import("effect/Brand").Brand<"Event.Seq">;
+        readonly version: number & import("effect/Brand").Brand<"Event.Version">;
+    };
+    readonly type: "session.permissions.updated";
+    readonly created: number;
+    readonly location?: {
+        readonly directory: string & import("effect/Brand").Brand<"AbsolutePath">;
+        readonly workspaceID?: (string & import("effect/Brand").Brand<"Workspace.ID">) | undefined;
+    } | undefined;
+    readonly metadata?: {
+        readonly [x: string]: unknown;
+    } | undefined;
 } | {
     readonly id: string & import("effect/Brand").Brand<"Event.ID">;
     readonly data: {

package/dist/groups/session.js CHANGED Viewed

@@ -15,6 +15,7 @@ import { ConflictError, CommandExecutionError, CommandNotFoundError, InvalidCurs
 import { Agent } from "@opencode/schema/agent";
 import { Skill } from "@opencode/schema/skill";
 import { Model } from "@opencode/schema/model";
+import { Permission } from "@opencode/schema/permission";
 import { Location } from "@opencode/schema/location";
 import { SessionEvent } from "@opencode/schema/session-event";
 import { EventLog } from "@opencode/schema/event-log";
@@ -129,6 +130,7 @@ export const makeSessionGroup = (sessionLocationMiddleware) => HttpApiGroup.make
         model: Model.Ref.pipe(Schema.optional),
         location: Location.Ref.pipe(Schema.optional),
         metadata: Session.Metadata.pipe(Schema.optional),
+        permissions: Permission.Ruleset.pipe(Schema.optional),
     }),
     success: Schema.Struct({ data: Session.Info }),
 }).annotateMerge(OpenApi.annotations({

package/package.json CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "@opencode/protocol",
-  "version": "0.0.0-dev-19447",
+  "version": "0.0.0-dev-19449",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -32,7 +32,7 @@
     "typecheck": "tsgo --noEmit"
   },
   "dependencies": {
-    "@opencode/schema": "0.0.0-dev-19447",
+    "@opencode/schema": "0.0.0-dev-19449",
     "effect": "4.0.0-rc.112"
   },
   "devDependencies": {