@opengeni/contracts 0.44.1 → 0.50.0

package/src/canonical-human-identities.ts

@@ -0,0 +1,93 @@
+import { z } from "zod";
+
+export const CanonicalHumanIdentityStatus = z.enum([
+  "active",
+  "recovery_required",
+  "disputed",
+  "disabled",
+]);
+export type CanonicalHumanIdentityStatus = z.infer<typeof CanonicalHumanIdentityStatus>;
+
+export const CanonicalHumanLoginBindingStatus = z.enum([
+  "active",
+  "recovery_pending",
+  "stale",
+  "disputed",
+  "revoked",
+]);
+export type CanonicalHumanLoginBindingStatus = z.infer<typeof CanonicalHumanLoginBindingStatus>;
+
+export const CanonicalHumanRecoveryState = z.enum([
+  "ready",
+  "recovery_required",
+  "lost_factor",
+  "disputed",
+  "disabled",
+]);
+export type CanonicalHumanRecoveryState = z.infer<typeof CanonicalHumanRecoveryState>;
+
+export const CanonicalHumanLoginBinding = z.object({
+  id: z.string().uuid(),
+  providerId: z.string().min(1).max(128),
+  providerAccountId: z.string().min(1).max(1024),
+  status: CanonicalHumanLoginBindingStatus,
+  revision: z.number().int().positive(),
+  verifiedAt: z.string().datetime(),
+  lastVerifiedAt: z.string().datetime(),
+  revokedAt: z.string().datetime().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+});
+export type CanonicalHumanLoginBinding = z.infer<typeof CanonicalHumanLoginBinding>;
+
+export const CanonicalHumanIdentityProjection = z.object({
+  activeIdentity: z.object({
+    id: z.string().uuid(),
+    displayName: z.string().min(1).max(256),
+    status: CanonicalHumanIdentityStatus,
+    identityRevision: z.number().int().positive(),
+    authRevision: z.number().int().positive(),
+    activeLoginBindingId: z.string().uuid().nullable(),
+    recoveryState: CanonicalHumanRecoveryState,
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+  }),
+  loginBindings: z.array(CanonicalHumanLoginBinding).max(64),
+});
+export type CanonicalHumanIdentityProjection = z.infer<typeof CanonicalHumanIdentityProjection>;
+
+const OperationFields = {
+  operationId: z.string().uuid().optional(),
+  expectedIdentityRevision: z.number().int().positive(),
+  reason: z.string().trim().min(1).max(512),
+} as const;
+
+export const LinkCanonicalHumanLoginBindingRequest = z.object({
+  ...OperationFields,
+  providerId: z.string().trim().min(1).max(128),
+  providerAccountId: z.string().trim().min(1).max(1024),
+});
+export type LinkCanonicalHumanLoginBindingRequest = z.infer<
+  typeof LinkCanonicalHumanLoginBindingRequest
+>;
+
+export const CanonicalHumanBindingOperationRequest = z.object({
+  ...OperationFields,
+});
+export type CanonicalHumanBindingOperationRequest = z.infer<
+  typeof CanonicalHumanBindingOperationRequest
+>;
+
+export const CanonicalHumanIdentityMutationOutcome = z.enum(["applied", "lost_factor", "disputed"]);
+export type CanonicalHumanIdentityMutationOutcome = z.infer<
+  typeof CanonicalHumanIdentityMutationOutcome
+>;
+
+export const CanonicalHumanIdentityMutationResponse = z.object({
+  outcome: CanonicalHumanIdentityMutationOutcome,
+  operationId: z.string().uuid(),
+  identity: CanonicalHumanIdentityProjection,
+});
+export type CanonicalHumanIdentityMutationResponse = z.infer<
+  typeof CanonicalHumanIdentityMutationResponse
+>;

package/src/codex-provider-account-authority.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+
+const PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+
+/**
+ * Opaque authority frozen at a Codex provider-account acceptance boundary.
+ *
+ * The snapshot deliberately carries no organization, membership, credential,
+ * provider-account, subject, label, quota, token, or plan identity. A later
+ * activation slice may use the user generation only together with separately
+ * authorized durable state; this value is never sufficient authority alone.
+ */
+export const CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion("scope", [
+  z
+    .object({
+      version: z.literal(1),
+      scope: z.literal("workspace"),
+    })
+    .strict(),
+  z
+    .object({
+      version: z.literal(1),
+      scope: z.literal("user"),
+      authorityGeneration: PositiveSafeInteger,
+    })
+    .strict(),
+]);
+
+export type CodexProviderAccountAuthoritySnapshotV1 = z.infer<
+  typeof CodexProviderAccountAuthoritySnapshotV1
+>;
+
+/** Explicit compatibility value for all pre-foundation accepted work. */
+export const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
+  version: 1,
+  scope: "workspace",
+} as const satisfies CodexProviderAccountAuthoritySnapshotV1;