@opengeni/contracts 0.44.1 → 1.0.1

package/src/canonical-human-identities.ts

@@ -0,0 +1,93 @@
+import { z } from "zod";
+
+export const CanonicalHumanIdentityStatus = z.enum([
+  "active",
+  "recovery_required",
+  "disputed",
+  "disabled",
+]);
+export type CanonicalHumanIdentityStatus = z.infer<typeof CanonicalHumanIdentityStatus>;
+
+export const CanonicalHumanLoginBindingStatus = z.enum([
+  "active",
+  "recovery_pending",
+  "stale",
+  "disputed",
+  "revoked",
+]);
+export type CanonicalHumanLoginBindingStatus = z.infer<typeof CanonicalHumanLoginBindingStatus>;
+
+export const CanonicalHumanRecoveryState = z.enum([
+  "ready",
+  "recovery_required",
+  "lost_factor",
+  "disputed",
+  "disabled",
+]);
+export type CanonicalHumanRecoveryState = z.infer<typeof CanonicalHumanRecoveryState>;
+
+export const CanonicalHumanLoginBinding = z.object({
+  id: z.string().uuid(),
+  providerId: z.string().min(1).max(128),
+  providerAccountId: z.string().min(1).max(1024),
+  status: CanonicalHumanLoginBindingStatus,
+  revision: z.number().int().positive(),
+  verifiedAt: z.string().datetime(),
+  lastVerifiedAt: z.string().datetime(),
+  revokedAt: z.string().datetime().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+});
+export type CanonicalHumanLoginBinding = z.infer<typeof CanonicalHumanLoginBinding>;
+
+export const CanonicalHumanIdentityProjection = z.object({
+  activeIdentity: z.object({
+    id: z.string().uuid(),
+    displayName: z.string().min(1).max(256),
+    status: CanonicalHumanIdentityStatus,
+    identityRevision: z.number().int().positive(),
+    authRevision: z.number().int().positive(),
+    activeLoginBindingId: z.string().uuid().nullable(),
+    recoveryState: CanonicalHumanRecoveryState,
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime(),
+  }),
+  loginBindings: z.array(CanonicalHumanLoginBinding).max(64),
+});
+export type CanonicalHumanIdentityProjection = z.infer<typeof CanonicalHumanIdentityProjection>;
+
+const OperationFields = {
+  operationId: z.string().uuid().optional(),
+  expectedIdentityRevision: z.number().int().positive(),
+  reason: z.string().trim().min(1).max(512),
+} as const;
+
+export const LinkCanonicalHumanLoginBindingRequest = z.object({
+  ...OperationFields,
+  providerId: z.string().trim().min(1).max(128),
+  providerAccountId: z.string().trim().min(1).max(1024),
+});
+export type LinkCanonicalHumanLoginBindingRequest = z.infer<
+  typeof LinkCanonicalHumanLoginBindingRequest
+>;
+
+export const CanonicalHumanBindingOperationRequest = z.object({
+  ...OperationFields,
+});
+export type CanonicalHumanBindingOperationRequest = z.infer<
+  typeof CanonicalHumanBindingOperationRequest
+>;
+
+export const CanonicalHumanIdentityMutationOutcome = z.enum(["applied", "lost_factor", "disputed"]);
+export type CanonicalHumanIdentityMutationOutcome = z.infer<
+  typeof CanonicalHumanIdentityMutationOutcome
+>;
+
+export const CanonicalHumanIdentityMutationResponse = z.object({
+  outcome: CanonicalHumanIdentityMutationOutcome,
+  operationId: z.string().uuid(),
+  identity: CanonicalHumanIdentityProjection,
+});
+export type CanonicalHumanIdentityMutationResponse = z.infer<
+  typeof CanonicalHumanIdentityMutationResponse
+>;

package/src/codex-provider-account-authority.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+
+const PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+
+/**
+ * Opaque authority frozen at a Codex provider-account acceptance boundary.
+ *
+ * The snapshot deliberately carries no organization, membership, credential,
+ * provider-account, subject, label, quota, token, or plan identity. A later
+ * activation slice may use the user generation only together with separately
+ * authorized durable state; this value is never sufficient authority alone.
+ */
+export const CodexProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion("scope", [
+  z
+    .object({
+      version: z.literal(1),
+      scope: z.literal("workspace"),
+    })
+    .strict(),
+  z
+    .object({
+      version: z.literal(1),
+      scope: z.literal("user"),
+      authorityGeneration: PositiveSafeInteger,
+    })
+    .strict(),
+]);
+
+export type CodexProviderAccountAuthoritySnapshotV1 = z.infer<
+  typeof CodexProviderAccountAuthoritySnapshotV1
+>;
+
+/** Explicit compatibility value for all pre-foundation accepted work. */
+export const LEGACY_WORKSPACE_CODEX_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
+  version: 1,
+  scope: "workspace",
+} as const satisfies CodexProviderAccountAuthoritySnapshotV1;

package/src/google-drive.ts

@@ -17,9 +17,13 @@ export const GOOGLE_DRIVE_READONLY_SCOPE =
 export const GOOGLE_DRIVE_CREDENTIAL_ROLE = "google_drive_metadata" as const;
 export const GOOGLE_DRIVE_CREDENTIAL_LABEL = "Google Drive read-only source sync" as const;
 export const GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL = "Google Drive metadata browser" as const;
+export const GOOGLE_DRIVE_PUBLICATION_SERVER_ID = "google-drive-publishing" as const;
+export const GOOGLE_DRIVE_PUBLICATION_TOOL_NAME = "google_drive_publish_file" as const;
+export const GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION = "create" as const;
 
 export const GoogleDriveOAuthCapability = z.enum([
   "picker_file_read",
+  "publish_file",
   "source_metadata_discovery",
   "source_content_read",
   "recursive_source_sync",
@@ -27,7 +31,7 @@ export const GoogleDriveOAuthCapability = z.enum([
 export type GoogleDriveOAuthCapability = z.infer<typeof GoogleDriveOAuthCapability>;
 
 export type GoogleDriveOAuthScopeDecision = {
-  accessMode: "metadata_readonly" | "readonly" | null;
+  accessMode: "file_only" | "metadata_readonly" | "readonly" | null;
   capabilities: GoogleDriveOAuthCapability[];
 };
 
@@ -43,11 +47,13 @@ export function googleDriveOAuthScopeDecision(
   const granted = new Set(grantedScopes);
   const hasFullDrive = granted.has(GOOGLE_DRIVE_FULL_SCOPE);
   const hasSourceContentRead = hasFullDrive || granted.has(GOOGLE_DRIVE_READONLY_SCOPE);
+  const hasFileWrite = hasFullDrive || granted.has(GOOGLE_DRIVE_FILE_SCOPE);
   const hasSourceMetadataDiscovery =
     hasSourceContentRead || granted.has(GOOGLE_DRIVE_METADATA_READONLY_SCOPE);
-  const hasPickerFileRead = hasSourceContentRead || granted.has(GOOGLE_DRIVE_FILE_SCOPE);
+  const hasPickerFileRead = hasSourceContentRead || hasFileWrite;
   const capabilities: GoogleDriveOAuthCapability[] = [];
   if (hasPickerFileRead) capabilities.push("picker_file_read");
+  if (hasFileWrite) capabilities.push("publish_file");
   if (hasSourceMetadataDiscovery) capabilities.push("source_metadata_discovery");
   if (hasSourceContentRead) {
     capabilities.push("source_content_read", "recursive_source_sync");
@@ -57,7 +63,9 @@ export function googleDriveOAuthScopeDecision(
       ? "readonly"
       : hasSourceMetadataDiscovery
         ? "metadata_readonly"
-        : null,
+        : hasFileWrite
+          ? "file_only"
+          : null,
     capabilities,
   };
 }
@@ -148,6 +156,26 @@ export const GoogleDriveSelectedSource = z.object({
 });
 export type GoogleDriveSelectedSource = z.infer<typeof GoogleDriveSelectedSource>;
 
+export const GoogleDriveOutputDestination = z
+  .object({
+    folderId: z.string().min(1).max(256),
+    folderName: z.string().min(1).max(1024),
+    driveId: z.string().min(1).max(256).nullable(),
+    location: z.enum(["my_drive", "shared_drive"]),
+    selectedAt: z.string().datetime({ offset: true }),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if ((value.location === "my_drive") !== (value.driveId === null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["driveId"],
+        message: "Google Drive destination location does not match its drive identity",
+      });
+    }
+  });
+export type GoogleDriveOutputDestination = z.infer<typeof GoogleDriveOutputDestination>;
+
 export const GoogleDriveConnectionMetadata = z
   .object({
     credentialRole: z.literal(GOOGLE_DRIVE_CREDENTIAL_ROLE),
@@ -159,8 +187,9 @@ export const GoogleDriveConnectionMetadata = z
     googleEmail: z.string().email().max(320),
     googleDisplayName: z.string().min(1).max(512).nullable(),
     verifiedAt: z.string().datetime({ offset: true }),
-    accessMode: z.enum(["metadata_readonly", "readonly"]),
+    accessMode: z.enum(["file_only", "metadata_readonly", "readonly"]),
     lifecycle: GoogleDriveConnectionLifecycle.optional(),
+    outputDestination: GoogleDriveOutputDestination.optional(),
     documentDestination: ConnectorDocumentDestination.optional(),
     selectedSources: z.array(GoogleDriveSelectedSource).max(100).optional(),
     /** @deprecated Read `selectedSources`; retained while existing connections migrate. */
@@ -171,6 +200,7 @@ export type GoogleDriveConnectionMetadata = z.infer<typeof GoogleDriveConnection
 
 export const GoogleDriveOAuthStartRequest = z.object({
   connectionId: z.string().uuid().optional(),
+  capability: z.enum(["source_read", "publish"]).default("source_read"),
 });
 export type GoogleDriveOAuthStartRequest = z.infer<typeof GoogleDriveOAuthStartRequest>;
 
@@ -192,6 +222,48 @@ export const GoogleDriveDisconnectRequest = z.object({
 });
 export type GoogleDriveDisconnectRequest = z.infer<typeof GoogleDriveDisconnectRequest>;
 
+export const GoogleDrivePublicationExportFile = z
+  .object({
+    fileId: z.string().uuid(),
+    filename: z.string().trim().min(1).max(512),
+    contentType: z.string().trim().min(1).max(256),
+    sizeBytes: z.number().int().positive(),
+    sha256: z.string().regex(/^[0-9a-f]{64}$/u),
+    artifactId: z.string().regex(/^[0-9a-f]{32}$/u),
+    versionId: z.string().regex(/^[0-9a-f]{32}$/u),
+    materializationJobId: z.string().regex(/^[0-9a-f]{32}$/u),
+    sourceHeadSequence: z.number().int().nonnegative(),
+    sourceStateHash: z.string().regex(/^sha256:[0-9a-f]{64}$/u),
+  })
+  .strict();
+export type GoogleDrivePublicationExportFile = z.infer<typeof GoogleDrivePublicationExportFile>;
+
+export const GoogleDrivePublicationToolInput = z
+  .object({
+    title: z.string().trim().min(1).max(512),
+    modality: z.enum(["document", "spreadsheet", "presentation"]),
+    file: GoogleDrivePublicationExportFile,
+    idempotencyKey: z.string().trim().min(1).max(200),
+  })
+  .strict();
+export type GoogleDrivePublicationToolInput = z.infer<typeof GoogleDrivePublicationToolInput>;
+
+export const GoogleDrivePublicationReceipt = z
+  .object({
+    connectionId: z.string().uuid(),
+    providerFileId: z.string().min(1).max(256),
+    webViewLink: z.string().url(),
+    mimeType: z.enum([
+      "application/vnd.google-apps.document",
+      "application/vnd.google-apps.spreadsheet",
+      "application/vnd.google-apps.presentation",
+    ]),
+    destination: GoogleDriveOutputDestination,
+    replayed: z.boolean(),
+  })
+  .strict();
+export type GoogleDrivePublicationReceipt = z.infer<typeof GoogleDrivePublicationReceipt>;
+
 export const GoogleDriveBrowseItem = z.object({
   id: z.string().min(1).max(256),
   name: z.string().min(1).max(1024),