@opengeni/contracts 0.31.1 → 0.32.0

package/src/slack-bot-scopes.ts

@@ -16,12 +16,100 @@ export const OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [
   "users:read",
 ] as const;
 
+/** Read-only scope needed only for the optional emoji-reaction summon surface. */
+export const OPENGENI_SLACK_REACTION_REQUIRED_SCOPE = "reactions:read" as const;
+
+/**
+ * Scopes requested by the managed and generated self-hosted manifests.
+ *
+ * `reactions:read` is deliberately not part of the base eligibility contract:
+ * legacy installations may continue using existing Slack interactions and
+ * tools while the reaction setting stays disabled and the UI asks an admin to
+ * reinstall.
+ */
+export const OPENGENI_SLACK_BOT_REQUESTED_SCOPES = [
+  ...OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
+  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,
+] as const;
+
+export const OPENGENI_SLACK_BOT_EVENTS = [
+  "app_mention",
+  "message.channels",
+  "message.groups",
+  "message.im",
+  "message.mpim",
+  "reaction_added",
+] as const;
+
+export const OPENGENI_MANAGED_PUBLIC_BASE_URL = "https://app.opengeni.ai" as const;
+
+function normalizedSlackManifestBaseUrl(publicBaseUrl: string): string {
+  const parsed = new URL(publicBaseUrl);
+  if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
+    throw new Error("Slack bot manifest public base URL must be credential-free HTTPS");
+  }
+  parsed.hash = "";
+  parsed.search = "";
+  parsed.pathname = parsed.pathname.replace(/\/+$/, "");
+  return parsed.toString().replace(/\/$/, "");
+}
+
+/** Canonical managed/self-hosted Slack app manifest. Slack accepts JSON manifests. */
+export function buildOpenGeniSlackBotManifest(publicBaseUrl: string) {
+  const baseUrl = normalizedSlackManifestBaseUrl(publicBaseUrl);
+  return {
+    display_information: { name: "OpenGeni" },
+    features: {
+      bot_user: { display_name: "OpenGeni", always_online: false },
+      slash_commands: [
+        {
+          command: "/opengeni",
+          description: "Start an OpenGeni task in this channel",
+          should_escape: false,
+          url: `${baseUrl}/v1/integrations/slack/commands`,
+        },
+      ],
+      shortcuts: [
+        {
+          callback_id: "opengeni_message",
+          description: "Start an OpenGeni task from this Slack message",
+          name: "Open in OpenGeni",
+          type: "message",
+        },
+      ],
+    },
+    oauth_config: {
+      redirect_urls: [
+        `${baseUrl}/v1/integrations/oauth/callback`,
+        `${baseUrl}/v1/integrations/slack/callback`,
+      ],
+      scopes: { bot: [...OPENGENI_SLACK_BOT_REQUESTED_SCOPES] },
+    },
+    settings: {
+      event_subscriptions: {
+        bot_events: [...OPENGENI_SLACK_BOT_EVENTS],
+        request_url: `${baseUrl}/v1/integrations/slack/events`,
+      },
+      interactivity: {
+        is_enabled: true,
+        request_url: `${baseUrl}/v1/integrations/slack/interactions`,
+      },
+      org_deploy_enabled: false,
+      socket_mode_enabled: false,
+      token_rotation_enabled: false,
+    },
+  } as const;
+}
+
 /**
  * Optional bot grants that remain inside the shipped bot's read/identity
  * boundary. Every other unrequired scope fails closed, including unknown future
  * Slack scopes, so verification, core routing, and UI eligibility cannot drift.
  */
-export const OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = ["team:read"] as const;
+export const OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = [
+  "team:read",
+  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,
+] as const;
 
 /** @deprecated Use evaluateOpenGeniSlackBotScopes; an allowlist is the policy. */
 export const OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = ["channels:join", "chat:write.public"] as const;
@@ -46,6 +134,10 @@ export function areOpenGeniSlackBotScopesAccepted(grantedScopes: readonly string
   );
 }
 
+export function hasOpenGeniSlackReactionScope(grantedScopes: readonly string[]): boolean {
+  return grantedScopes.includes(OPENGENI_SLACK_REACTION_REQUIRED_SCOPE);
+}
+
 export function evaluateOpenGeniSlackBotScopes(
   grantedScopes: readonly string[],
 ): OpenGeniSlackBotScopePolicy {

package/src/workspace-instruction-policies.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 export const WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS = 262_144;
+export const WORKSPACE_INSTRUCTION_POLICY_PROMPT_MAX_UTF8_BYTES = 131_072;
 export const WORKSPACE_INSTRUCTION_POLICY_REASON_MAX_CHARS = 4_096;
 export const WORKSPACE_INSTRUCTION_POLICY_ROLE_KEY_MAX_CHARS = 64;
 export const WORKSPACE_INSTRUCTION_POLICY_SOURCE_ID_MAX_CHARS = 512;
@@ -50,10 +51,23 @@ export function normalizeWorkspaceInstructionPolicyRoleKey(value: string): strin
   return value.normalize("NFKC").trim().toLowerCase().replace(/\s+/gu, "-").replace(/-+/g, "-");
 }
 
-const RequestRoleKey = z
+export const WorkspaceInstructionPolicyRoleKeyInput = z
   .string()
   .transform(normalizeWorkspaceInstructionPolicyRoleKey)
   .pipe(WorkspaceInstructionPolicyRoleKey);
+export type WorkspaceInstructionPolicyRoleKeyInput = z.infer<
+  typeof WorkspaceInstructionPolicyRoleKeyInput
+>;
+
+export const WorkspaceInstructionPolicyRoleSource = z.enum([
+  "session_binding",
+  "metadata_fallback",
+  "none",
+  "invalid_metadata_fallback",
+]);
+export type WorkspaceInstructionPolicyRoleSource = z.infer<
+  typeof WorkspaceInstructionPolicyRoleSource
+>;
 
 const targetShape = {
   kind: WorkspaceInstructionPolicyKind,
@@ -138,6 +152,64 @@ export const WorkspaceInstructionPolicyHead = z.object({
 });
 export type WorkspaceInstructionPolicyHead = z.infer<typeof WorkspaceInstructionPolicyHead>;
 
+export const WorkspaceInstructionPolicySnapshotProvenance = z.object({
+  source: WorkspaceInstructionPolicyProvenanceSource,
+  sourceIdHash: z
+    .string()
+    .regex(/^[0-9a-f]{64}$/)
+    .nullable(),
+});
+export type WorkspaceInstructionPolicySnapshotProvenance = z.infer<
+  typeof WorkspaceInstructionPolicySnapshotProvenance
+>;
+
+export const WorkspaceInstructionPolicySnapshotEntry = z.object({
+  kind: WorkspaceInstructionPolicyKind,
+  scope: WorkspaceInstructionPolicyScope,
+  roleKey: WorkspaceInstructionPolicyRoleKey.nullable(),
+  revisionId: z.string().uuid(),
+  revision: z.number().int().positive(),
+  contentHash: z.string().regex(/^[0-9a-f]{64}$/),
+  activationVersion: z.number().int().positive(),
+  activatedAt: z.string().datetime(),
+  provenance: WorkspaceInstructionPolicySnapshotProvenance,
+});
+export type WorkspaceInstructionPolicySnapshotEntry = z.infer<
+  typeof WorkspaceInstructionPolicySnapshotEntry
+>;
+
+export const WorkspaceInstructionPolicySnapshot = z.object({
+  id: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  sessionId: z.string().uuid(),
+  turnId: z.string().uuid(),
+  attemptId: z.string().uuid(),
+  executionGeneration: z.number().int().positive(),
+  policyRole: WorkspaceInstructionPolicyRoleKey.nullable(),
+  roleSource: WorkspaceInstructionPolicyRoleSource,
+  entryHash: z.string().regex(/^[0-9a-f]{64}$/),
+  entries: z.array(WorkspaceInstructionPolicySnapshotEntry).max(3),
+  createdAt: z.string().datetime(),
+});
+export type WorkspaceInstructionPolicySnapshot = z.infer<typeof WorkspaceInstructionPolicySnapshot>;
+
+export const ResolvedWorkspaceInstructionPolicySnapshotEntry =
+  WorkspaceInstructionPolicySnapshotEntry.extend({
+    content: z.string().min(1).max(WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS),
+  });
+export type ResolvedWorkspaceInstructionPolicySnapshotEntry = z.infer<
+  typeof ResolvedWorkspaceInstructionPolicySnapshotEntry
+>;
+
+export const ResolvedWorkspaceInstructionPolicySnapshot = WorkspaceInstructionPolicySnapshot.extend(
+  {
+    entries: z.array(ResolvedWorkspaceInstructionPolicySnapshotEntry).max(3),
+  },
+);
+export type ResolvedWorkspaceInstructionPolicySnapshot = z.infer<
+  typeof ResolvedWorkspaceInstructionPolicySnapshot
+>;
+
 export const WorkspaceInstructionPolicyActivationEvent = z.object({
   id: z.string().uuid(),
   accountId: z.string().uuid(),
@@ -159,7 +231,7 @@ export const CreateWorkspaceInstructionPolicyDraftRequest = z
   .object({
     kind: WorkspaceInstructionPolicyKind,
     scope: WorkspaceInstructionPolicyScope,
-    roleKey: RequestRoleKey.nullable().default(null),
+    roleKey: WorkspaceInstructionPolicyRoleKeyInput.nullable().default(null),
     content: z
       .string()
       .min(1)
@@ -191,7 +263,7 @@ export type ImportLegacyWorkspaceInstructionPolicyDraftRequest = z.infer<
 export const WorkspaceInstructionPolicyListQuery = z.object({
   kind: WorkspaceInstructionPolicyKind.optional(),
   scope: WorkspaceInstructionPolicyScope.optional(),
-  roleKey: RequestRoleKey.nullable().optional(),
+  roleKey: WorkspaceInstructionPolicyRoleKeyInput.nullable().optional(),
   afterRevision: z.coerce.number().int().positive().optional(),
   limit: z.coerce.number().int().min(1).max(100).default(50),
 });

package/dist/chunk-KGL5BVGF.js

@@ -1,45 +0,0 @@
-// src/slack-bot-scopes.ts
-var OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [
-  "app_mentions:read",
-  "canvases:read",
-  "channels:history",
-  "channels:read",
-  "chat:write",
-  "commands",
-  "files:read",
-  "groups:history",
-  "groups:read",
-  "im:history",
-  "im:read",
-  "im:write",
-  "mpim:history",
-  "mpim:read",
-  "users:read"
-];
-var OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = ["team:read"];
-var OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = ["channels:join", "chat:write.public"];
-function isOpenGeniSlackBotScopeAllowed(scope) {
-  return OPENGENI_SLACK_BOT_REQUIRED_SCOPES.includes(scope) || OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES.includes(scope);
-}
-function areOpenGeniSlackBotScopesAccepted(grantedScopes) {
-  return OPENGENI_SLACK_BOT_REQUIRED_SCOPES.every((scope) => grantedScopes.includes(scope)) && grantedScopes.every(isOpenGeniSlackBotScopeAllowed);
-}
-function evaluateOpenGeniSlackBotScopes(grantedScopes) {
-  const granted = new Set(grantedScopes);
-  const missingRequired = OPENGENI_SLACK_BOT_REQUIRED_SCOPES.filter((scope) => !granted.has(scope));
-  const unsupported = [...granted].filter((scope) => !isOpenGeniSlackBotScopeAllowed(scope)).sort();
-  return {
-    accepted: areOpenGeniSlackBotScopesAccepted(grantedScopes),
-    missingRequired,
-    unsupported
-  };
-}
-
-export {
-  OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
-  OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES,
-  OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES,
-  areOpenGeniSlackBotScopesAccepted,
-  evaluateOpenGeniSlackBotScopes
-};
-//# sourceMappingURL=chunk-KGL5BVGF.js.map

package/dist/chunk-KGL5BVGF.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/slack-bot-scopes.ts"],"sourcesContent":["export const OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [\n  \"app_mentions:read\",\n  \"canvases:read\",\n  \"channels:history\",\n  \"channels:read\",\n  \"chat:write\",\n  \"commands\",\n  \"files:read\",\n  \"groups:history\",\n  \"groups:read\",\n  \"im:history\",\n  \"im:read\",\n  \"im:write\",\n  \"mpim:history\",\n  \"mpim:read\",\n  \"users:read\",\n] as const;\n\n/**\n * Optional bot grants that remain inside the shipped bot's read/identity\n * boundary. Every other unrequired scope fails closed, including unknown future\n * Slack scopes, so verification, core routing, and UI eligibility cannot drift.\n */\nexport const OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = [\"team:read\"] as const;\n\n/** @deprecated Use evaluateOpenGeniSlackBotScopes; an allowlist is the policy. */\nexport const OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = [\"channels:join\", \"chat:write.public\"] as const;\n\nexport type OpenGeniSlackBotScopePolicy = {\n  accepted: boolean;\n  missingRequired: string[];\n  unsupported: string[];\n};\n\nfunction isOpenGeniSlackBotScopeAllowed(scope: string): boolean {\n  return (\n    (OPENGENI_SLACK_BOT_REQUIRED_SCOPES as readonly string[]).includes(scope) ||\n    (OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES as readonly string[]).includes(scope)\n  );\n}\n\nexport function areOpenGeniSlackBotScopesAccepted(grantedScopes: readonly string[]): boolean {\n  return (\n    OPENGENI_SLACK_BOT_REQUIRED_SCOPES.every((scope) => grantedScopes.includes(scope)) &&\n    grantedScopes.every(isOpenGeniSlackBotScopeAllowed)\n  );\n}\n\nexport function evaluateOpenGeniSlackBotScopes(\n  grantedScopes: readonly string[],\n): OpenGeniSlackBotScopePolicy {\n  const granted = new Set(grantedScopes);\n  const missingRequired = OPENGENI_SLACK_BOT_REQUIRED_SCOPES.filter((scope) => !granted.has(scope));\n  const unsupported = [...granted].filter((scope) => !isOpenGeniSlackBotScopeAllowed(scope)).sort();\n  return {\n    accepted: areOpenGeniSlackBotScopesAccepted(grantedScopes),\n    missingRequired,\n    unsupported,\n  };\n}\n"],"mappings":";AAAO,IAAM,qCAAqC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,0CAA0C,CAAC,WAAW;AAG5D,IAAM,sCAAsC,CAAC,iBAAiB,mBAAmB;AAQxF,SAAS,+BAA+B,OAAwB;AAC9D,SACG,mCAAyD,SAAS,KAAK,KACvE,wCAA8D,SAAS,KAAK;AAEjF;AAEO,SAAS,kCAAkC,eAA2C;AAC3F,SACE,mCAAmC,MAAM,CAAC,UAAU,cAAc,SAAS,KAAK,CAAC,KACjF,cAAc,MAAM,8BAA8B;AAEtD;AAEO,SAAS,+BACd,eAC6B;AAC7B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,kBAAkB,mCAAmC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC;AAChG,QAAM,cAAc,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,+BAA+B,KAAK,CAAC,EAAE,KAAK;AAChG,SAAO;AAAA,IACL,UAAU,kCAAkC,aAAa;AAAA,IACzD;AAAA,IACA;AAAA,EACF;AACF;","names":[]}