@opengeni/contracts 0.50.0 → 1.0.0

package/dist/model-picker-order.js

@@ -0,0 +1,42 @@
+// src/model-picker-order.ts
+var MODEL_PICKER_BILLING_CLASS_ORDER = [
+  "opengeni_credits",
+  "external",
+  "codex_subscription",
+  "supergrok_subscription",
+  "claude_subscription",
+  "byok",
+  "organization_byok"
+];
+function modelPickerBillingClassFor(model) {
+  if (model.provider === "workspace-claude-subscription" || model.providerId === "workspace-claude-subscription" || model.provider === "organization-claude-subscription" || model.providerId === "organization-claude-subscription")
+    return "claude_subscription";
+  if (model.cost === "credits" || model.cost === "free") return "opengeni_credits";
+  if (model.cost === "workspace") return "byok";
+  if (model.cost === "organization") return "organization_byok";
+  const source = model.source;
+  const credential = model.credentialSource;
+  const payer = model.billing?.upstreamPayer;
+  if (source === "supergrok" || credential?.kind === "connected_subscription" && credential.provider === "xai") {
+    return "supergrok_subscription";
+  }
+  if (source === "codex" || credential?.kind === "connected_subscription" || payer === "connected_subscription") {
+    return "codex_subscription";
+  }
+  if (source === "workspace_gateway" || credential?.kind === "workspace_connection" || payer === "workspace") {
+    return "byok";
+  }
+  if (credential?.kind === "organization_connection" || payer === "organization") {
+    return "organization_byok";
+  }
+  return "opengeni_credits";
+}
+function compareModelPickerOrder(left, right) {
+  const classDelta = MODEL_PICKER_BILLING_CLASS_ORDER.indexOf(left.billingClass) - MODEL_PICKER_BILLING_CLASS_ORDER.indexOf(right.billingClass);
+  return classDelta || +right.selectable - +left.selectable || (left.label < right.label ? -1 : left.label > right.label ? 1 : 0);
+}
+export {
+  compareModelPickerOrder,
+  modelPickerBillingClassFor
+};
+//# sourceMappingURL=model-picker-order.js.map

package/dist/model-picker-order.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/model-picker-order.ts"],"sourcesContent":["export type ModelPickerBillingClass =\n  // Legacy public identifier for the OpenGeni presentation group, including\n  // free deployment models. Never use this UI grouping to decide settlement.\n  | \"opengeni_credits\"\n  | \"external\"\n  | \"codex_subscription\"\n  | \"supergrok_subscription\"\n  | \"claude_subscription\"\n  | \"byok\"\n  | \"organization_byok\";\n\n// Every closed billing class has a unique first character. Keeping the order\n// as initials avoids duplicating the full public labels in browser bundles.\nconst MODEL_PICKER_BILLING_CLASS_ORDER: readonly ModelPickerBillingClass[] = [\n  \"opengeni_credits\",\n  \"external\",\n  \"codex_subscription\",\n  \"supergrok_subscription\",\n  \"claude_subscription\",\n  \"byok\",\n  \"organization_byok\",\n];\n\nexport type ModelPickerBillingCandidate = {\n  provider?: string | undefined;\n  providerId?: string | undefined;\n  source?: string | undefined;\n  cost?: \"free\" | \"credits\" | \"subscription\" | \"workspace\" | \"organization\" | undefined;\n  billing?:\n    | {\n        upstreamPayer?: string | undefined;\n        metering?: string | undefined;\n      }\n    | undefined;\n  credentialSource?:\n    | {\n        kind?: string | undefined;\n        provider?: string | undefined;\n      }\n    | undefined;\n};\n\nexport function modelPickerBillingClassFor(\n  model: ModelPickerBillingCandidate,\n): ModelPickerBillingClass {\n  if (\n    model.provider === \"workspace-claude-subscription\" ||\n    model.providerId === \"workspace-claude-subscription\" ||\n    model.provider === \"organization-claude-subscription\" ||\n    model.providerId === \"organization-claude-subscription\"\n  )\n    return \"claude_subscription\";\n  if (model.cost === \"credits\" || model.cost === \"free\") return \"opengeni_credits\";\n  if (model.cost === \"workspace\") return \"byok\";\n  if (model.cost === \"organization\") return \"organization_byok\";\n  const source = model.source;\n  const credential = model.credentialSource;\n  const payer = model.billing?.upstreamPayer;\n  if (\n    source === \"supergrok\" ||\n    (credential?.kind === \"connected_subscription\" && credential.provider === \"xai\")\n  ) {\n    return \"supergrok_subscription\";\n  }\n  if (\n    source === \"codex\" ||\n    credential?.kind === \"connected_subscription\" ||\n    payer === \"connected_subscription\"\n  ) {\n    return \"codex_subscription\";\n  }\n  if (\n    source === \"workspace_gateway\" ||\n    credential?.kind === \"workspace_connection\" ||\n    payer === \"workspace\"\n  ) {\n    return \"byok\";\n  }\n  if (credential?.kind === \"organization_connection\" || payer === \"organization\") {\n    return \"organization_byok\";\n  }\n  return \"opengeni_credits\";\n}\n\nexport function compareModelPickerOrder(\n  left: { billingClass: ModelPickerBillingClass; selectable: boolean; label: string },\n  right: { billingClass: ModelPickerBillingClass; selectable: boolean; label: string },\n): number {\n  const classDelta =\n    MODEL_PICKER_BILLING_CLASS_ORDER.indexOf(left.billingClass) -\n    MODEL_PICKER_BILLING_CLASS_ORDER.indexOf(right.billingClass);\n  return (\n    classDelta ||\n    +right.selectable - +left.selectable ||\n    (left.label < right.label ? -1 : left.label > right.label ? 1 : 0)\n  );\n}\n"],"mappings":";AAaA,IAAM,mCAAuE;AAAA,EAC3E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBO,SAAS,2BACd,OACyB;AACzB,MACE,MAAM,aAAa,mCACnB,MAAM,eAAe,mCACrB,MAAM,aAAa,sCACnB,MAAM,eAAe;AAErB,WAAO;AACT,MAAI,MAAM,SAAS,aAAa,MAAM,SAAS,OAAQ,QAAO;AAC9D,MAAI,MAAM,SAAS,YAAa,QAAO;AACvC,MAAI,MAAM,SAAS,eAAgB,QAAO;AAC1C,QAAM,SAAS,MAAM;AACrB,QAAM,aAAa,MAAM;AACzB,QAAM,QAAQ,MAAM,SAAS;AAC7B,MACE,WAAW,eACV,YAAY,SAAS,4BAA4B,WAAW,aAAa,OAC1E;AACA,WAAO;AAAA,EACT;AACA,MACE,WAAW,WACX,YAAY,SAAS,4BACrB,UAAU,0BACV;AACA,WAAO;AAAA,EACT;AACA,MACE,WAAW,uBACX,YAAY,SAAS,0BACrB,UAAU,aACV;AACA,WAAO;AAAA,EACT;AACA,MAAI,YAAY,SAAS,6BAA6B,UAAU,gBAAgB;AAC9E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,wBACd,MACA,OACQ;AACR,QAAM,aACJ,iCAAiC,QAAQ,KAAK,YAAY,IAC1D,iCAAiC,QAAQ,MAAM,YAAY;AAC7D,SACE,cACA,CAAC,MAAM,aAAa,CAAC,KAAK,eACzB,KAAK,QAAQ,MAAM,QAAQ,KAAK,KAAK,QAAQ,MAAM,QAAQ,IAAI;AAEpE;","names":[]}

package/dist/organization-access.d.ts

@@ -0,0 +1,231 @@
+import { z } from "zod";
+import { Permission } from "./permissions.js";
+export declare const OrganizationAccessPreset: z.ZodEnum<{
+    custom: "custom";
+    full: "full";
+    read_only: "read_only";
+}>;
+export type OrganizationAccessPreset = z.infer<typeof OrganizationAccessPreset>;
+export declare const OrganizationWorkspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"all">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"selected">;
+    workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+}, z.core.$strict>], "kind">;
+export type OrganizationWorkspaceScope = z.infer<typeof OrganizationWorkspaceScope>;
+export declare const OrganizationActor: z.ZodEnum<{
+    organization: "organization";
+    user: "user";
+}>;
+export type OrganizationActor = z.infer<typeof OrganizationActor>;
+/** Custom has no implicit permissions. Presets are expanded only by this helper. */
+export declare function organizationAccessPresetPermissions(preset: OrganizationAccessPreset): Permission[];
+/** True when nothing can be changed, including an empty set and secret-value reads. */
+export declare function isReadOnlyPermissionSet(permissions: readonly Permission[]): boolean;
+declare const OrganizationAccessPolicyInput: z.ZodObject<{
+    preset: z.ZodEnum<{
+        custom: "custom";
+        full: "full";
+        read_only: "read_only";
+    }>;
+    permissions: z.ZodArray<z.ZodLazy<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>>;
+    workspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"selected">;
+        workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type OrganizationAccessPolicy = z.infer<typeof OrganizationAccessPolicyInput>;
+/** Canonical ordering, alias mapping and labels; never adds an unrequested grant. */
+export declare function normalizeOrganizationAccessPolicy(policy: OrganizationAccessPolicy): OrganizationAccessPolicy;
+export declare const OrganizationAccessPolicy: z.ZodPipe<z.ZodObject<{
+    preset: z.ZodEnum<{
+        custom: "custom";
+        full: "full";
+        read_only: "read_only";
+    }>;
+    permissions: z.ZodArray<z.ZodLazy<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>>;
+    workspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"selected">;
+        workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>, z.ZodTransform<{
+    preset: "custom" | "full" | "read_only";
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+    workspaceScope: {
+        kind: "all";
+    } | {
+        kind: "selected";
+        workspaceIds: string[];
+    };
+}, {
+    preset: "custom" | "full" | "read_only";
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+    workspaceScope: {
+        kind: "all";
+    } | {
+        kind: "selected";
+        workspaceIds: string[];
+    };
+}>>;
+export declare const OrganizationServiceAccountRole: z.ZodEnum<{
+    admin: "admin";
+    member: "member";
+}>;
+export type OrganizationServiceAccountRole = z.infer<typeof OrganizationServiceAccountRole>;
+/** What only an organization administrator can do; a member service account's keys never hold it. */
+export declare const ORGANIZATION_ADMIN_ONLY_PERMISSIONS: readonly Permission[];
+/** The permissions a service account's keys may hold, given its role. */
+export declare function serviceAccountAllowsPermission(role: OrganizationServiceAccountRole, permission: Permission): boolean;
+export declare const OrganizationServiceAccount: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    role: z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>;
+    activeKeyCount: z.ZodNumber;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type OrganizationServiceAccount = z.infer<typeof OrganizationServiceAccount>;
+export declare const ListOrganizationServiceAccountsResponse: z.ZodObject<{
+    serviceAccounts: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        organizationId: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        role: z.ZodEnum<{
+            admin: "admin";
+            member: "member";
+        }>;
+        activeKeyCount: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListOrganizationServiceAccountsResponse = z.infer<typeof ListOrganizationServiceAccountsResponse>;
+export declare const CreateOrganizationServiceAccountRequest: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    role: z.ZodDefault<z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>>;
+}, z.core.$strict>;
+export type CreateOrganizationServiceAccountRequest = z.infer<typeof CreateOrganizationServiceAccountRequest>;
+export declare const UpdateOrganizationServiceAccountRequest: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    role: z.ZodOptional<z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>>;
+}, z.core.$strict>;
+export type UpdateOrganizationServiceAccountRequest = z.infer<typeof UpdateOrganizationServiceAccountRequest>;
+export {};

package/dist/organization-access.js

@@ -0,0 +1,34 @@
+import {
+  CreateOrganizationServiceAccountRequest,
+  ListOrganizationServiceAccountsResponse,
+  ORGANIZATION_ADMIN_ONLY_PERMISSIONS,
+  OrganizationAccessPolicy,
+  OrganizationAccessPreset,
+  OrganizationActor,
+  OrganizationServiceAccount,
+  OrganizationServiceAccountRole,
+  OrganizationWorkspaceScope,
+  UpdateOrganizationServiceAccountRequest,
+  isReadOnlyPermissionSet,
+  normalizeOrganizationAccessPolicy,
+  organizationAccessPresetPermissions,
+  serviceAccountAllowsPermission
+} from "./chunk-RJ76DRPO.js";
+import "./chunk-QR5D2IQC.js";
+export {
+  CreateOrganizationServiceAccountRequest,
+  ListOrganizationServiceAccountsResponse,
+  ORGANIZATION_ADMIN_ONLY_PERMISSIONS,
+  OrganizationAccessPolicy,
+  OrganizationAccessPreset,
+  OrganizationActor,
+  OrganizationServiceAccount,
+  OrganizationServiceAccountRole,
+  OrganizationWorkspaceScope,
+  UpdateOrganizationServiceAccountRequest,
+  isReadOnlyPermissionSet,
+  normalizeOrganizationAccessPolicy,
+  organizationAccessPresetPermissions,
+  serviceAccountAllowsPermission
+};
+//# sourceMappingURL=organization-access.js.map

package/dist/organization-access.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/organization-integration-policy.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+/** Catalog identities, never endpoint/domain matching. Custom transports are explicit categories. */
+export declare const OrganizationIntegrationKey: z.ZodString;
+export declare const OrganizationIntegrationPolicy: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<{
+        restricted: "restricted";
+        unrestricted: "unrestricted";
+    }>>;
+    allowedIntegrationKeys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    revision: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type OrganizationIntegrationPolicy = z.infer<typeof OrganizationIntegrationPolicy>;
+export declare const UpdateOrganizationIntegrationPolicyRequest: z.ZodObject<{
+    mode: z.ZodEnum<{
+        restricted: "restricted";
+        unrestricted: "unrestricted";
+    }>;
+    allowedIntegrationKeys: z.ZodArray<z.ZodString>;
+    expectedRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type UpdateOrganizationIntegrationPolicyRequest = z.infer<typeof UpdateOrganizationIntegrationPolicyRequest>;
+export declare class OrganizationIntegrationDeniedError extends Error {
+    constructor();
+}
+/** integrationKey must come from trusted classification, not client-supplied metadata. */
+export declare function assertOrganizationIntegrationAllowed(policy: OrganizationIntegrationPolicy, integrationKey: string | null): void;