@opengeni/contracts 1.0.1 → 2.3.0-canary.0

package/dist/connection-authority.d.ts

@@ -0,0 +1,501 @@
+import { z } from "zod";
+/** The only generic grant action that authorizes use of a connection. */
+export declare const ConnectionUseAction: z.ZodLiteral<"connection.use">;
+export type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;
+/**
+ * Connection authority is either workspace-owned or user-owned. Omission is
+ * intentionally compatible with the historical workspace connection path.
+ */
+export declare const ConnectionAuthorityEnvelope: z.ZodObject<{
+    scope: z.ZodDefault<z.ZodEnum<{
+        user: "user";
+        workspace: "workspace";
+    }>>;
+    userDelegation: z.ZodOptional<z.ZodObject<{
+        authorityId: z.ZodString;
+        grantId: z.ZodString;
+        organizationId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodNullable<z.ZodString>;
+        action: z.ZodString;
+        mode: z.ZodEnum<{
+            always: "always";
+            once: "once";
+            session: "session";
+        }>;
+        context: z.ZodEnum<{
+            user_private: "user_private";
+            workspace_shared: "workspace_shared";
+        }>;
+        authorityEpoch: z.ZodNullable<z.ZodNumber>;
+        authorityGeneration: z.ZodNumber;
+        grantGeneration: z.ZodNumber;
+        resourceVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;
+export declare const ConnectionAuthorityGrant: z.ZodObject<{
+    grantId: z.ZodString;
+    targetWorkspaceId: z.ZodString;
+    targetSessionId: z.ZodNullable<z.ZodString>;
+    mode: z.ZodEnum<{
+        always: "always";
+        once: "once";
+        session: "session";
+    }>;
+    context: z.ZodEnum<{
+        user_private: "user_private";
+        workspace_shared: "workspace_shared";
+    }>;
+    authorityEpoch: z.ZodNullable<z.ZodNumber>;
+    generation: z.ZodNumber;
+    status: z.ZodEnum<{
+        active: "active";
+        consumed: "consumed";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    delegation: z.ZodLazy<z.ZodObject<{
+        authorityId: z.ZodString;
+        grantId: z.ZodString;
+        organizationId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodNullable<z.ZodString>;
+        action: z.ZodString;
+        mode: z.ZodEnum<{
+            always: "always";
+            once: "once";
+            session: "session";
+        }>;
+        context: z.ZodEnum<{
+            user_private: "user_private";
+            workspace_shared: "workspace_shared";
+        }>;
+        authorityEpoch: z.ZodNullable<z.ZodNumber>;
+        authorityGeneration: z.ZodNumber;
+        grantGeneration: z.ZodNumber;
+        resourceVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+    action: z.ZodLiteral<"connection.use">;
+}, z.core.$strict>;
+export type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;
+/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */
+export declare const ConnectionAuthoritySummary: z.ZodObject<{
+    authorityId: z.ZodString;
+    resourceId: z.ZodString;
+    originWorkspaceId: z.ZodNullable<z.ZodString>;
+    generation: z.ZodNumber;
+    status: z.ZodEnum<{
+        active: "active";
+        retained: "retained";
+        revoked: "revoked";
+    }>;
+    grants: z.ZodArray<z.ZodObject<{
+        grantId: z.ZodString;
+        targetWorkspaceId: z.ZodString;
+        targetSessionId: z.ZodNullable<z.ZodString>;
+        mode: z.ZodEnum<{
+            always: "always";
+            once: "once";
+            session: "session";
+        }>;
+        context: z.ZodEnum<{
+            user_private: "user_private";
+            workspace_shared: "workspace_shared";
+        }>;
+        authorityEpoch: z.ZodNullable<z.ZodNumber>;
+        generation: z.ZodNumber;
+        status: z.ZodEnum<{
+            active: "active";
+            consumed: "consumed";
+            expired: "expired";
+            revoked: "revoked";
+        }>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        delegation: z.ZodLazy<z.ZodObject<{
+            authorityId: z.ZodString;
+            grantId: z.ZodString;
+            organizationId: z.ZodString;
+            workspaceId: z.ZodString;
+            sessionId: z.ZodNullable<z.ZodString>;
+            action: z.ZodString;
+            mode: z.ZodEnum<{
+                always: "always";
+                once: "once";
+                session: "session";
+            }>;
+            context: z.ZodEnum<{
+                user_private: "user_private";
+                workspace_shared: "workspace_shared";
+            }>;
+            authorityEpoch: z.ZodNullable<z.ZodNumber>;
+            authorityGeneration: z.ZodNumber;
+            grantGeneration: z.ZodNumber;
+            resourceVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>;
+        action: z.ZodLiteral<"connection.use">;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;
+export declare const ListConnectionAuthoritiesQuery: z.ZodObject<{
+    scope: z.ZodLiteral<"user">;
+    cursor: z.ZodOptional<z.ZodString>;
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strict>;
+export declare const ListConnectionAuthoritiesResponse: z.ZodObject<{
+    scope: z.ZodLiteral<"user">;
+    authorities: z.ZodArray<z.ZodObject<{
+        authorityId: z.ZodString;
+        resourceId: z.ZodString;
+        originWorkspaceId: z.ZodNullable<z.ZodString>;
+        generation: z.ZodNumber;
+        status: z.ZodEnum<{
+            active: "active";
+            retained: "retained";
+            revoked: "revoked";
+        }>;
+        grants: z.ZodArray<z.ZodObject<{
+            grantId: z.ZodString;
+            targetWorkspaceId: z.ZodString;
+            targetSessionId: z.ZodNullable<z.ZodString>;
+            mode: z.ZodEnum<{
+                always: "always";
+                once: "once";
+                session: "session";
+            }>;
+            context: z.ZodEnum<{
+                user_private: "user_private";
+                workspace_shared: "workspace_shared";
+            }>;
+            authorityEpoch: z.ZodNullable<z.ZodNumber>;
+            generation: z.ZodNumber;
+            status: z.ZodEnum<{
+                active: "active";
+                consumed: "consumed";
+                expired: "expired";
+                revoked: "revoked";
+            }>;
+            expiresAt: z.ZodNullable<z.ZodString>;
+            delegation: z.ZodLazy<z.ZodObject<{
+                authorityId: z.ZodString;
+                grantId: z.ZodString;
+                organizationId: z.ZodString;
+                workspaceId: z.ZodString;
+                sessionId: z.ZodNullable<z.ZodString>;
+                action: z.ZodString;
+                mode: z.ZodEnum<{
+                    always: "always";
+                    once: "once";
+                    session: "session";
+                }>;
+                context: z.ZodEnum<{
+                    user_private: "user_private";
+                    workspace_shared: "workspace_shared";
+                }>;
+                authorityEpoch: z.ZodNullable<z.ZodNumber>;
+                authorityGeneration: z.ZodNumber;
+                grantGeneration: z.ZodNumber;
+                resourceVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            }, z.core.$strip>>;
+            action: z.ZodLiteral<"connection.use">;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export declare const IssueConnectionUseGrantRequest: z.ZodObject<{
+    scope: z.ZodLiteral<"user">;
+    mode: z.ZodEnum<{
+        always: "always";
+        session: "session";
+    }>;
+    context: z.ZodEnum<{
+        user_private: "user_private";
+        workspace_shared: "workspace_shared";
+    }>;
+    sessionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    expectedAuthorityEpoch: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+    workspaceSharedAcknowledged: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;
+export declare const RevokeConnectionUseGrantQuery: z.ZodObject<{
+    scope: z.ZodLiteral<"user">;
+}, z.core.$strict>;
+export declare const ConnectionUseGrantMutationResponse: z.ZodObject<{
+    scope: z.ZodLiteral<"user">;
+    grant: z.ZodObject<{
+        grantId: z.ZodString;
+        targetWorkspaceId: z.ZodString;
+        targetSessionId: z.ZodNullable<z.ZodString>;
+        mode: z.ZodEnum<{
+            always: "always";
+            once: "once";
+            session: "session";
+        }>;
+        context: z.ZodEnum<{
+            user_private: "user_private";
+            workspace_shared: "workspace_shared";
+        }>;
+        authorityEpoch: z.ZodNullable<z.ZodNumber>;
+        generation: z.ZodNumber;
+        status: z.ZodEnum<{
+            active: "active";
+            consumed: "consumed";
+            expired: "expired";
+            revoked: "revoked";
+        }>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        delegation: z.ZodLazy<z.ZodObject<{
+            authorityId: z.ZodString;
+            grantId: z.ZodString;
+            organizationId: z.ZodString;
+            workspaceId: z.ZodString;
+            sessionId: z.ZodNullable<z.ZodString>;
+            action: z.ZodString;
+            mode: z.ZodEnum<{
+                always: "always";
+                once: "once";
+                session: "session";
+            }>;
+            context: z.ZodEnum<{
+                user_private: "user_private";
+                workspace_shared: "workspace_shared";
+            }>;
+            authorityEpoch: z.ZodNullable<z.ZodNumber>;
+            authorityGeneration: z.ZodNumber;
+            grantGeneration: z.ZodNumber;
+            resourceVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>>;
+        action: z.ZodLiteral<"connection.use">;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;
+export declare const ConnectionUseGrantRevocationResponse: z.ZodObject<{
+    scope: z.ZodLiteral<"user">;
+    grant: z.ZodObject<{
+        grantId: z.ZodString;
+        generation: z.ZodNumber;
+        status: z.ZodLiteral<"revoked">;
+        revokedAt: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ConnectionUseGrantRevocationResponse = z.infer<typeof ConnectionUseGrantRevocationResponse>;
+export declare const ConnectionAuthoritySelectionSource: z.ZodEnum<{
+    explicit_workspace: "explicit_workspace";
+    legacy_user_compatibility: "legacy_user_compatibility";
+    legacy_workspace_omission: "legacy_workspace_omission";
+    user_delegation: "user_delegation";
+}>;
+export type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;
+export declare const ConnectionUseSelectionSource: z.ZodString;
+export type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;
+/**
+ * Internal, credential-free authority frozen when work is accepted. Personal
+ * owner identity is retained only for live authorization and usage/audit
+ * attribution; it is never part of the public delegation envelope.
+ */
+export declare const ConnectionUseAuthoritySnapshot: z.ZodObject<{
+    organizationId: z.ZodString;
+    originWorkspaceId: z.ZodString;
+    targetWorkspaceId: z.ZodString;
+    targetSessionId: z.ZodString;
+    targetSessionVisibility: z.ZodEnum<{
+        user_private: "user_private";
+        workspace_shared: "workspace_shared";
+    }>;
+    targetSessionAuthorityEpoch: z.ZodNumber;
+    acceptedWork: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"turn">;
+        turnId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"scheduled_task">;
+        taskId: z.ZodString;
+        taskAuthorityRevision: z.ZodNumber;
+        runId: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    connectionId: z.ZodString;
+    connectionGeneration: z.ZodNumber;
+    connectionStatus: z.ZodLiteral<"active">;
+    providerDomain: z.ZodString;
+    connectionKind: z.ZodEnum<{
+        api_key: "api_key";
+        app_install: "app_install";
+        delegated: "delegated";
+        oauth2: "oauth2";
+    }>;
+    scope: z.ZodEnum<{
+        legacy_user: "legacy_user";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    ownerSubjectId: z.ZodNullable<z.ZodString>;
+    ownerOrganizationMembershipId: z.ZodNullable<z.ZodString>;
+    ownerMembershipAuthorizationRevision: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+    authoritySource: z.ZodEnum<{
+        explicit_workspace: "explicit_workspace";
+        legacy_user_compatibility: "legacy_user_compatibility";
+        legacy_workspace_omission: "legacy_workspace_omission";
+        user_delegation: "user_delegation";
+    }>;
+    selectionSources: z.ZodArray<z.ZodString>;
+    userDelegation: z.ZodNullable<z.ZodObject<{
+        authorityId: z.ZodString;
+        grantId: z.ZodString;
+        organizationId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodNullable<z.ZodString>;
+        action: z.ZodString;
+        mode: z.ZodEnum<{
+            always: "always";
+            once: "once";
+            session: "session";
+        }>;
+        context: z.ZodEnum<{
+            user_private: "user_private";
+            workspace_shared: "workspace_shared";
+        }>;
+        authorityEpoch: z.ZodNullable<z.ZodNumber>;
+        authorityGeneration: z.ZodNumber;
+        grantGeneration: z.ZodNumber;
+        resourceVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$strip>>;
+}, z.core.$strict>;
+export type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;
+export declare const ConnectionUseDenialReason: z.ZodEnum<{
+    accepted_attempt_authority_required: "accepted_attempt_authority_required";
+    accepted_snapshot_digest_changed: "accepted_snapshot_digest_changed";
+    authority_generation_changed: "authority_generation_changed";
+    authority_identity_changed: "authority_identity_changed";
+    authority_missing: "authority_missing";
+    authority_status_inactive: "authority_status_inactive";
+    connection_generation_changed: "connection_generation_changed";
+    connection_identity_changed: "connection_identity_changed";
+    connection_missing: "connection_missing";
+    connection_owner_changed: "connection_owner_changed";
+    connection_status_inactive: "connection_status_inactive";
+    grant_already_consumed: "grant_already_consumed";
+    grant_expired: "grant_expired";
+    grant_generation_changed: "grant_generation_changed";
+    grant_identity_changed: "grant_identity_changed";
+    grant_missing: "grant_missing";
+    grant_status_inactive: "grant_status_inactive";
+    owner_membership_inactive: "owner_membership_inactive";
+    session_authority_epoch_changed: "session_authority_epoch_changed";
+    session_identity_changed: "session_identity_changed";
+    session_inactive: "session_inactive";
+    session_visibility_changed: "session_visibility_changed";
+    tenant_mismatch: "tenant_mismatch";
+    workspace_access_inactive: "workspace_access_inactive";
+}>;
+export type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;
+/** Metadata-only attribution emitted after pre-use authorization. */
+export declare const ConnectionUseAttribution: z.ZodObject<{
+    organizationId: z.ZodString;
+    workspaceId: z.ZodString;
+    sessionId: z.ZodString;
+    connectionId: z.ZodString;
+    connectionGeneration: z.ZodNumber;
+    scope: z.ZodEnum<{
+        legacy_user: "legacy_user";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    ownerSubjectId: z.ZodNullable<z.ZodString>;
+    authorityId: z.ZodNullable<z.ZodString>;
+    grantId: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;
+export declare const ConnectionUseAuditFact: z.ZodObject<{
+    organizationId: z.ZodString;
+    workspaceId: z.ZodString;
+    sessionId: z.ZodString;
+    connectionId: z.ZodString;
+    connectionGeneration: z.ZodNumber;
+    scope: z.ZodEnum<{
+        legacy_user: "legacy_user";
+        user: "user";
+        workspace: "workspace";
+    }>;
+    ownerSubjectId: z.ZodNullable<z.ZodString>;
+    authorityId: z.ZodNullable<z.ZodString>;
+    grantId: z.ZodNullable<z.ZodString>;
+    outcome: z.ZodEnum<{
+        authorized: "authorized";
+        denied: "denied";
+    }>;
+    denialReason: z.ZodNullable<z.ZodEnum<{
+        accepted_attempt_authority_required: "accepted_attempt_authority_required";
+        accepted_snapshot_digest_changed: "accepted_snapshot_digest_changed";
+        authority_generation_changed: "authority_generation_changed";
+        authority_identity_changed: "authority_identity_changed";
+        authority_missing: "authority_missing";
+        authority_status_inactive: "authority_status_inactive";
+        connection_generation_changed: "connection_generation_changed";
+        connection_identity_changed: "connection_identity_changed";
+        connection_missing: "connection_missing";
+        connection_owner_changed: "connection_owner_changed";
+        connection_status_inactive: "connection_status_inactive";
+        grant_already_consumed: "grant_already_consumed";
+        grant_expired: "grant_expired";
+        grant_generation_changed: "grant_generation_changed";
+        grant_identity_changed: "grant_identity_changed";
+        grant_missing: "grant_missing";
+        grant_status_inactive: "grant_status_inactive";
+        owner_membership_inactive: "owner_membership_inactive";
+        session_authority_epoch_changed: "session_authority_epoch_changed";
+        session_identity_changed: "session_identity_changed";
+        session_inactive: "session_inactive";
+        session_visibility_changed: "session_visibility_changed";
+        tenant_mismatch: "tenant_mismatch";
+        workspace_access_inactive: "workspace_access_inactive";
+    }>>;
+    occurredAt: z.ZodString;
+}, z.core.$strict>;
+export type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;
+export declare const ConnectionUseAuthorizationResult: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"authorized">;
+    attribution: z.ZodObject<{
+        organizationId: z.ZodString;
+        workspaceId: z.ZodString;
+        sessionId: z.ZodString;
+        connectionId: z.ZodString;
+        connectionGeneration: z.ZodNumber;
+        scope: z.ZodEnum<{
+            legacy_user: "legacy_user";
+            user: "user";
+            workspace: "workspace";
+        }>;
+        ownerSubjectId: z.ZodNullable<z.ZodString>;
+        authorityId: z.ZodNullable<z.ZodString>;
+        grantId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"denied">;
+    reason: z.ZodEnum<{
+        accepted_attempt_authority_required: "accepted_attempt_authority_required";
+        accepted_snapshot_digest_changed: "accepted_snapshot_digest_changed";
+        authority_generation_changed: "authority_generation_changed";
+        authority_identity_changed: "authority_identity_changed";
+        authority_missing: "authority_missing";
+        authority_status_inactive: "authority_status_inactive";
+        connection_generation_changed: "connection_generation_changed";
+        connection_identity_changed: "connection_identity_changed";
+        connection_missing: "connection_missing";
+        connection_owner_changed: "connection_owner_changed";
+        connection_status_inactive: "connection_status_inactive";
+        grant_already_consumed: "grant_already_consumed";
+        grant_expired: "grant_expired";
+        grant_generation_changed: "grant_generation_changed";
+        grant_identity_changed: "grant_identity_changed";
+        grant_missing: "grant_missing";
+        grant_status_inactive: "grant_status_inactive";
+        owner_membership_inactive: "owner_membership_inactive";
+        session_authority_epoch_changed: "session_authority_epoch_changed";
+        session_identity_changed: "session_identity_changed";
+        session_inactive: "session_inactive";
+        session_visibility_changed: "session_visibility_changed";
+        tenant_mismatch: "tenant_mismatch";
+        workspace_access_inactive: "workspace_access_inactive";
+    }>;
+}, z.core.$strict>], "status">;
+export type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;