@opengeni/contracts 0.7.0 → 0.9.0

package/dist/index.js

@@ -412,12 +412,18 @@ var Permission = z.enum([
   "github:manage",
   "github:use",
   "api_keys:manage",
+  "connections:read",
+  "connections:write",
   "environments:manage",
   "environments:use",
   // Attach or rotate per-session third-party MCP server credentials. Deliberately
   // not part of the worker's default first-party MCP permission set: a sandboxed
   // agent must not be able to hand itself new bearer credentials.
   "mcp_servers:attach",
+  // Programmatic sandbox -> tool access through the first-party MCP gate. This is
+  // intentionally narrow and is never part of first-party MCP defaults; callers
+  // must receive it through an explicit delegated `ogd_` mint carrying sessionId.
+  "toolspace:call",
   "goals:manage",
   // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;
   // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine
@@ -427,6 +433,9 @@ var Permission = z.enum([
   "enrollments:read",
   "enrollments:manage"
 ]);
+function prefixedMcpToolName(registryId2, toolName) {
+  return `${registryId2}__${toolName}`;
+}
 var ProductAccessMode = z.enum(["local", "configured", "managed"]);
 var BillingMode = z.enum(["disabled", "stripe"]);
 var EntitlementsMode = z.enum(["none", "static", "managed"]);
@@ -882,6 +891,8 @@ var FileDownloadUrlResponse = z.object({
   expiresAt: z.string()
 });
 var DocumentStatus = z.enum(["queued", "indexing", "ready", "failed"]);
+var KnowledgeSourceKind = z.enum(["manual_upload", "meeting_transcript", "repository", "email", "chat", "document", "web", "other"]);
+var DocumentSearchMode = z.enum(["hybrid", "vector", "keyword"]);
 var DocumentBase = z.object({
   id: z.string().uuid(),
   workspaceId: z.string().uuid(),
@@ -900,6 +911,15 @@ var Document = z.object({
   parser: z.string(),
   chunkCount: z.number().int().nonnegative(),
   error: z.string().nullable(),
+  sourceKind: KnowledgeSourceKind,
+  sourceUri: z.string().nullable(),
+  sourceExternalId: z.string().nullable(),
+  sourceTitle: z.string().nullable(),
+  sourceAuthor: z.string().nullable(),
+  sourceCreatedAt: z.string().nullable(),
+  sourceUpdatedAt: z.string().nullable(),
+  sourceVersion: z.string().nullable(),
+  aclTags: z.array(z.string()),
   createdAt: z.string(),
   updatedAt: z.string()
 });
@@ -912,19 +932,97 @@ var DocumentSearchResult = z.object({
   title: z.string(),
   text: z.string(),
   score: z.number(),
+  matchType: DocumentSearchMode,
+  vectorScore: z.number().nullable(),
+  keywordScore: z.number().nullable(),
   chunkIndex: z.number().int().nonnegative(),
-  metadata: z.record(z.string(), z.unknown())
+  metadata: z.record(z.string(), z.unknown()),
+  sourceKind: KnowledgeSourceKind,
+  sourceUri: z.string().nullable(),
+  sourceExternalId: z.string().nullable(),
+  sourceTitle: z.string().nullable(),
+  sourceAuthor: z.string().nullable(),
+  sourceCreatedAt: z.string().nullable(),
+  sourceUpdatedAt: z.string().nullable(),
+  sourceVersion: z.string().nullable(),
+  aclTags: z.array(z.string())
 });
 var CreateDocumentBaseRequest = z.object({
   name: z.string().min(1),
   description: z.string().optional()
 });
 var AddDocumentRequest = z.object({
-  fileId: z.string().uuid()
+  fileId: z.string().uuid(),
+  title: z.string().min(1).optional(),
+  sourceKind: KnowledgeSourceKind.optional(),
+  sourceUri: z.string().min(1).optional(),
+  sourceExternalId: z.string().min(1).optional(),
+  sourceTitle: z.string().min(1).optional(),
+  sourceAuthor: z.string().min(1).optional(),
+  sourceCreatedAt: z.string().datetime({ offset: true }).optional(),
+  sourceUpdatedAt: z.string().datetime({ offset: true }).optional(),
+  sourceVersion: z.string().min(1).optional(),
+  aclTags: z.array(z.string().min(1)).optional()
 });
 var DocumentSearchRequest = z.object({
   query: z.string().min(1),
-  limit: z.number().int().positive().max(20).default(5)
+  baseIds: z.array(z.string().uuid()).optional(),
+  mode: DocumentSearchMode.optional(),
+  sourceKinds: z.array(KnowledgeSourceKind).optional(),
+  aclTags: z.array(z.string().min(1)).optional(),
+  limit: z.number().int().positive().max(50).default(5)
+});
+var KnowledgeMemoryStatus = z.enum(["proposed", "approved", "rejected"]);
+var KnowledgeMemoryKind = z.enum(["semantic", "episodic", "procedural", "decision", "preference"]);
+var KnowledgeSourceRef = z.object({
+  kind: z.enum(["document_chunk", "document", "session_event", "memory", "external"]),
+  id: z.string().min(1),
+  uri: z.string().min(1).optional(),
+  title: z.string().min(1).optional(),
+  metadata: z.record(z.string(), z.unknown()).default({})
+});
+var KnowledgeMemory = z.object({
+  id: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  status: KnowledgeMemoryStatus,
+  kind: KnowledgeMemoryKind,
+  scope: z.string(),
+  text: z.string(),
+  sourceRefs: z.array(KnowledgeSourceRef),
+  confidence: z.number().min(0).max(1),
+  metadata: z.record(z.string(), z.unknown()),
+  createdBySessionId: z.string().uuid().nullable(),
+  reviewedBy: z.string().nullable(),
+  reviewedAt: z.string().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var CreateKnowledgeMemoryRequest = z.object({
+  status: KnowledgeMemoryStatus.default("proposed"),
+  kind: KnowledgeMemoryKind.default("semantic"),
+  scope: z.string().min(1).default("workspace"),
+  text: z.string().min(1),
+  sourceRefs: z.array(KnowledgeSourceRef).default([]),
+  confidence: z.number().min(0).max(1).default(0.5),
+  metadata: z.record(z.string(), z.unknown()).default({}),
+  createdBySessionId: z.string().uuid().optional()
+});
+var UpdateKnowledgeMemoryRequest = z.object({
+  status: KnowledgeMemoryStatus.optional(),
+  kind: KnowledgeMemoryKind.optional(),
+  scope: z.string().min(1).optional(),
+  text: z.string().min(1).optional(),
+  sourceRefs: z.array(KnowledgeSourceRef).optional(),
+  confidence: z.number().min(0).max(1).optional(),
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  reviewedBy: z.string().min(1).optional()
+});
+var KnowledgeMemorySearchRequest = z.object({
+  query: z.string().min(1).optional(),
+  status: KnowledgeMemoryStatus.optional(),
+  kind: KnowledgeMemoryKind.optional(),
+  scope: z.string().min(1).optional(),
+  limit: z.number().int().positive().max(100).default(20)
 });
 var ToolRef = z.object({
   kind: z.literal("mcp"),
@@ -952,6 +1050,12 @@ var SessionMcpServerInput = z.object({
   allowedTools: z.array(z.string().min(1)).optional(),
   timeoutMs: z.number().int().positive().optional(),
   cacheToolsList: z.boolean().optional(),
+  // Human-approval policy for this server's tools. `true` = every tool of this
+  // server requires approval before it runs (a `session.requiresAction` pause
+  // the caller resolves with `user.approvalDecision`); a string[] = ONLY the
+  // listed UNPREFIXED tool names require approval (e.g. reads auto-run, writes
+  // ask); absent / `false` = auto-run everything (the historical default).
+  requireApproval: z.union([z.boolean(), z.array(z.string().min(1))]).optional(),
   // Write-only credential headers. Values are encrypted at rest and never
   // returned in session responses or events; response metadata exposes names.
   headers: z.record(z.string(), z.string()).optional()
@@ -1449,6 +1553,86 @@ var CreateSocialPostRequest = z.object({
   metrics: z.record(z.string(), z.number()).default({}),
   raw: z.record(z.string(), z.unknown()).default({})
 });
+var ConnectionKind = z.enum(["oauth2", "api_key", "app_install", "delegated"]);
+var ConnectionStatus = z.enum(["active", "needs_reauth", "revoked", "error"]);
+var McpServerConnectionRef = z.object({
+  connectionId: z.string().uuid().optional(),
+  providerDomain: z.string().min(1),
+  kind: ConnectionKind.optional(),
+  scopes: z.array(z.string().min(1)).optional(),
+  resource: z.string().min(1).optional(),
+  subjectScope: z.enum(["workspace", "subject"]).optional()
+}).strict();
+var ConnectionMetadata = z.object({
+  id: z.string().uuid(),
+  accountId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  subjectId: z.string().nullable(),
+  providerDomain: z.string(),
+  kind: ConnectionKind,
+  status: ConnectionStatus,
+  grantedScopes: z.array(z.string()),
+  expiresAt: z.string().nullable(),
+  lastRefreshAt: z.string().nullable(),
+  lastUsedAt: z.string().nullable(),
+  lastError: z.string().nullable(),
+  version: z.number().int().positive(),
+  metadata: z.record(z.string(), z.unknown()),
+  createdBySubjectId: z.string().nullable(),
+  updatedBySubjectId: z.string().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var ConnectionCredentialBundle = z.record(z.string(), z.unknown());
+var CreateConnectionRequest = z.object({
+  providerDomain: z.string().min(1),
+  kind: ConnectionKind,
+  subjectId: z.string().min(1).nullable().optional(),
+  credential: ConnectionCredentialBundle,
+  grantedScopes: z.array(z.string().min(1)).default([]),
+  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),
+  metadata: z.record(z.string(), z.unknown()).default({})
+});
+var UpdateConnectionRequest = z.object({
+  providerDomain: z.string().min(1).optional(),
+  subjectId: z.string().min(1).nullable().optional(),
+  kind: ConnectionKind.optional(),
+  status: ConnectionStatus.optional(),
+  credential: ConnectionCredentialBundle.optional(),
+  grantedScopes: z.array(z.string().min(1)).optional(),
+  expiresAt: z.string().datetime({ offset: true }).nullable().optional(),
+  metadata: z.record(z.string(), z.unknown()).optional()
+});
+var ConnectionResponse = z.object({
+  connection: ConnectionMetadata
+});
+var ListConnectionsResponse = z.object({
+  connections: z.array(ConnectionMetadata)
+});
+var OAuthStartRequest = z.object({
+  providerDomain: z.string().min(1).optional(),
+  mcpUrl: z.string().url().optional(),
+  resource: z.string().url().optional(),
+  requestedScopes: z.array(z.string().min(1)).default([]),
+  returnPath: z.string().min(1).optional(),
+  connectionId: z.string().uuid().optional()
+}).refine((value) => Boolean(value.mcpUrl ?? value.resource), {
+  message: "mcpUrl is required",
+  path: ["mcpUrl"]
+});
+var OAuthStartResponse = z.object({
+  state: z.string().min(1),
+  authorizationUrl: z.string().url().nullable(),
+  expiresAt: z.string()
+});
+var IntegrationClientMetadata = z.object({
+  client_id: z.string().url(),
+  client_name: z.literal("OpenGeni"),
+  redirect_uris: z.array(z.string().url()),
+  token_endpoint_auth_method: z.literal("none"),
+  grant_types: z.array(z.enum(["authorization_code", "refresh_token"])),
+  response_types: z.array(z.literal("code"))
+});
 var MarketingDailyAnalysisTaskRequest = z.object({
   name: z.string().min(1).optional(),
   connectionIds: z.array(z.string().uuid()).default([]),
@@ -1462,8 +1646,10 @@ var MarketingDailyAnalysisTaskRequest = z.object({
   overlapPolicy: ScheduledTaskOverlapPolicy.default("skip")
 });
 var CapabilityKind = z.enum(["pack", "mcp", "api", "skill", "plugin"]);
-var CapabilitySource = z.enum(["built_in", "configured", "public_registry", "manual"]);
+var CapabilitySource = z.enum(["built_in", "configured", "public_registry", "registry", "manual"]);
 var CapabilityInstallationStatus = z.enum(["active", "disabled"]);
+var CapabilityCatalogAuthKind = z.enum(["oauth2", "api_key", "none", "unknown"]);
+var CapabilityCatalogTier = z.enum(["verified", "community"]);
 var CapabilityRuntime = z.object({
   available: z.boolean().default(false),
   mcpServerId: z.string().min(1).optional(),
@@ -1484,6 +1670,18 @@ var CapabilityCatalogItem = z.object({
   endpointUrl: z.string().url().nullable().default(null),
   installUrl: z.string().url().nullable().default(null),
   authModel: z.string().min(1).nullable().default(null),
+  providerDomain: z.string().min(1).nullable().default(null),
+  surfaceType: z.string().min(1).nullable().default(null),
+  transport: z.string().min(1).nullable().default(null),
+  mcpUrl: z.string().url().nullable().default(null),
+  authKind: CapabilityCatalogAuthKind.nullable().default(null),
+  credentialFacts: z.array(z.record(z.string(), z.unknown())).default([]),
+  tier: CapabilityCatalogTier.nullable().default(null),
+  provenance: z.string().min(1).nullable().default(null),
+  logoAssetPath: z.string().min(1).nullable().default(null),
+  importBatchId: z.string().uuid().nullable().default(null),
+  stale: z.boolean().default(false),
+  staleAt: z.string().nullable().default(null),
   tools: z.array(ToolRef).default([]),
   runtime: CapabilityRuntime.default({ available: false, notes: null }),
   enabled: z.boolean().default(false),
@@ -1521,6 +1719,7 @@ var CreateCapabilityCatalogItemRequest = z.object({
 var EnableCapabilityRequest = z.object({
   config: z.record(z.string(), z.unknown()).default({}),
   metadata: z.record(z.string(), z.unknown()).default({}),
+  connectionRef: McpServerConnectionRef.optional(),
   /**
    * Credential headers for remote MCP capabilities (for example an
    * Authorization bearer token). Values are encrypted at rest with the
@@ -1628,6 +1827,7 @@ var SessionEventType = z.enum([
   "agent.reasoning.delta",
   "agent.toolCall.created",
   "agent.toolCall.output",
+  "tool.auth_needed",
   "agent.updated",
   "sandbox.operation.started",
   "sandbox.operation.completed",
@@ -1685,6 +1885,17 @@ var SessionEventType = z.enum([
   // the in-session "Running on:" indicator's live flip.
   "codex.account.switched"
 ]);
+var ToolAuthNeededPayload = z.object({
+  serverId: z.string().min(1),
+  toolName: z.string().min(1).nullable().optional(),
+  providerDomain: z.string().min(1),
+  connectionId: z.string().uuid().nullable().optional(),
+  reason: z.enum(["missing_connection", "expired", "insufficient_scope", "refresh_failed"]),
+  scopes: z.array(z.string().min(1)).optional(),
+  resource: z.string().min(1).optional(),
+  authorizationUrl: z.string().url().optional(),
+  subjectId: z.string().min(1).nullable().optional()
+});
 var StreamUrlRotatedPayload = z.object({
   url: z.string().url(),
   token: z.string().nullable(),
@@ -2441,6 +2652,11 @@ var EnrollmentSummary = z.object({
   pubkey: z.string(),
   exposure: z.literal("whole-machine"),
   hasDisplay: z.boolean(),
+  // Present (non-null) only when a display EXISTS but capture is blocked (macOS
+  // Screen Recording / TCC not granted): a human, actionable reason so the UI can
+  // show "display: capture not granted" instead of a bare "headless". null == capture
+  // permitted OR genuinely headless.
+  desktopUnavailableReason: z.string().nullish(),
   allowScreenControl: z.boolean(),
   status: z.enum(["active", "revoked"]),
   os: EnrollmentOs,
@@ -2537,6 +2753,10 @@ var MachineView = z.object({
   os: z.string(),
   arch: z.string(),
   hasDisplay: z.boolean(),
+  // Non-null only when a display exists but capture is blocked (macOS Screen
+  // Recording / TCC not granted) — the UI can surface "display: capture not granted".
+  // null == capture permitted OR headless.
+  desktopUnavailableReason: z.string().nullish(),
   allowScreenControl: z.boolean(),
   sharedSessionCount: z.number().int(),
   lastSeenAt: z.string().nullable(),
@@ -2646,8 +2866,10 @@ export {
   CAPABILITY_DESCRIPTORS,
   CLEARED_RUN_STATE_BLOB,
   CLEARED_RUN_STATE_MARKER,
+  CapabilityCatalogAuthKind,
   CapabilityCatalogItem,
   CapabilityCatalogResponse,
+  CapabilityCatalogTier,
   CapabilityInstallation,
   CapabilityInstallationStatus,
   CapabilityKind,
@@ -2669,14 +2891,21 @@ export {
   CompactSessionContextRequest,
   CompactSessionContextResult,
   CompleteFileUploadResponse,
+  ConnectionCredentialBundle,
+  ConnectionKind,
+  ConnectionMetadata,
+  ConnectionResponse,
+  ConnectionStatus,
   CreateApiKeyRequest,
   CreateApiKeyResponse,
   CreateCapabilityCatalogItemRequest,
   CreateCheckoutRequest,
   CreateCheckoutResponse,
+  CreateConnectionRequest,
   CreateDocumentBaseRequest,
   CreateFileUploadRequest,
   CreateFileUploadResponse,
+  CreateKnowledgeMemoryRequest,
   CreateScheduledTaskRequest,
   CreateSessionRequest,
   CreateSocialConnectionRequest,
@@ -2700,6 +2929,7 @@ export {
   DiscoverMcpCapabilitiesResponse,
   Document,
   DocumentBase,
+  DocumentSearchMode,
   DocumentSearchRequest,
   DocumentSearchResult,
   DocumentStatus,
@@ -2760,8 +2990,16 @@ export {
   GitStatusRequest,
   GitStatusResponse,
   GoalSpec,
+  IntegrationClientMetadata,
+  KnowledgeMemory,
+  KnowledgeMemoryKind,
+  KnowledgeMemorySearchRequest,
+  KnowledgeMemoryStatus,
+  KnowledgeSourceKind,
+  KnowledgeSourceRef,
   LimitAction,
   LimitDecision,
+  ListConnectionsResponse,
   ListEnrollmentsResponse,
   ListWorkspaceMembersResponse,
   MachineKind,
@@ -2771,9 +3009,12 @@ export {
   MachinesResponse,
   ManagedAccount,
   MarketingDailyAnalysisTaskRequest,
+  McpServerConnectionRef,
   MetricSample,
   MintEnrollTokenRequest,
   MintEnrollTokenResponse,
+  OAuthStartRequest,
+  OAuthStartResponse,
   PackInstallation,
   PackInstallationStatus,
   Permission,
@@ -2847,8 +3088,11 @@ export {
   TerminalPtyExitedPayload,
   TerminalPtyOutputDeltaPayload,
   TerminalPtyStartedPayload,
+  ToolAuthNeededPayload,
   ToolRef,
   TriggerScheduledTaskRequest,
+  UpdateConnectionRequest,
+  UpdateKnowledgeMemoryRequest,
   UpdateScheduledTaskRequest,
   UpdateSessionGoalRequest,
   UpdateSessionRequest,
@@ -2871,6 +3115,7 @@ export {
   isClearedRunStateBlob,
   mergeResourceRefs,
   mergeToolRefs,
+  prefixedMcpToolName,
   reasoningEffortForMetadata,
   resourceIdentityKey,
   signDelegatedAccessToken,