@opengeni/contracts 3.1.0-canary.1 → 3.1.2

package/src/connector-attachments.ts

@@ -1,3 +1,4 @@
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 
 export const CONNECTOR_ATTACHMENT_TRANSFER_VERSION = 1 as const;
@@ -102,20 +103,22 @@ function publicMetadataContainsCredential(publicValue: string, credential: strin
   return publicValue.includes(credential);
 }
 
-export const ConnectorAttachmentProviderIdentity = z
-  .object({
-    provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),
-    kind: z.literal("attachment"),
-    value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES)
-      .min(1)
-      .refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {
-        message: "must not contain control characters",
-      })
-      .refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {
-        message: "must be an opaque provider attachment identity, not a URL",
-      }),
-  })
-  .strict();
+export const ConnectorAttachmentProviderIdentity = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),
+      kind: z.literal("attachment"),
+      value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES)
+        .min(1)
+        .refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {
+          message: "must not contain control characters",
+        })
+        .refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {
+          message: "must be an opaque provider attachment identity, not a URL",
+        }),
+    })
+    .strict(),
+);
 export type ConnectorAttachmentProviderIdentity = z.infer<
   typeof ConnectorAttachmentProviderIdentity
 >;
@@ -146,92 +149,100 @@ export const ConnectorAttachmentMediaType = boundedString(
     message: "must not contain an HTTP URL reference",
   });
 
-export const ConnectorAttachmentSha256 = z.string().regex(SHA256_PATTERN);
+export const ConnectorAttachmentSha256 = /* @__PURE__ */ defineSchema(() =>
+  z.string().regex(SHA256_PATTERN),
+);
 
-export const ConnectorAttachmentPrivateSource = z
-  .object({
-    url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(
-      (value, context) => {
-        let parsed: URL;
-        try {
-          parsed = new URL(value);
-        } catch {
+export const ConnectorAttachmentPrivateSource = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(
+        (value, context) => {
+          let parsed: URL;
+          try {
+            parsed = new URL(value);
+          } catch {
+            context.addIssue({
+              code: "custom",
+              message: "must be an absolute URL",
+            });
+            return;
+          }
+          if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            context.addIssue({ code: "custom", message: "must use http or https" });
+          }
+          if (parsed.username || parsed.password) {
+            context.addIssue({
+              code: "custom",
+              message: "must not contain URL userinfo",
+            });
+          }
+          if (parsed.hash) {
+            context.addIssue({
+              code: "custom",
+              message: "must not contain a URL fragment",
+            });
+          }
+        },
+      ),
+      expiresAt: z.iso.datetime({ offset: true }),
+    })
+    .strict(),
+);
+export type ConnectorAttachmentPrivateSource = z.infer<typeof ConnectorAttachmentPrivateSource>;
+
+export const ConnectorAttachmentTransfer = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      providerAttachmentId: ConnectorAttachmentProviderIdentity,
+      fileName: ConnectorAttachmentFileName,
+      mediaType: ConnectorAttachmentMediaType,
+      byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+      contentSha256: ConnectorAttachmentSha256,
+      source: ConnectorAttachmentPrivateSource,
+    })
+    .strict()
+    .superRefine((attachment, context) => {
+      const publicValues = [
+        attachment.providerAttachmentId.value,
+        attachment.fileName,
+        attachment.mediaType,
+      ];
+      for (const credential of privateUrlCredentialValues(attachment.source.url)) {
+        if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {
           context.addIssue({
             code: "custom",
-            message: "must be an absolute URL",
+            message: "private source credentials must not appear in public attachment metadata",
           });
           return;
         }
-        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-          context.addIssue({ code: "custom", message: "must use http or https" });
-        }
-        if (parsed.username || parsed.password) {
-          context.addIssue({
-            code: "custom",
-            message: "must not contain URL userinfo",
-          });
-        }
-        if (parsed.hash) {
+      }
+    }),
+);
+export type ConnectorAttachmentTransfer = z.infer<typeof ConnectorAttachmentTransfer>;
+
+export const ConnectorAttachmentTransferEnvelope = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),
+      attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),
+    })
+    .strict()
+    .superRefine((envelope, context) => {
+      const identities = new Set<string>();
+      for (const [index, attachment] of envelope.attachments.entries()) {
+        const identity = `${attachment.providerAttachmentId.provider}\0${attachment.providerAttachmentId.value}`;
+        if (identities.has(identity)) {
           context.addIssue({
             code: "custom",
-            message: "must not contain a URL fragment",
+            message: "provider attachment identities must be unique",
+            path: ["attachments", index, "providerAttachmentId"],
           });
         }
-      },
-    ),
-    expiresAt: z.iso.datetime({ offset: true }),
-  })
-  .strict();
-export type ConnectorAttachmentPrivateSource = z.infer<typeof ConnectorAttachmentPrivateSource>;
-
-export const ConnectorAttachmentTransfer = z
-  .object({
-    providerAttachmentId: ConnectorAttachmentProviderIdentity,
-    fileName: ConnectorAttachmentFileName,
-    mediaType: ConnectorAttachmentMediaType,
-    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
-    contentSha256: ConnectorAttachmentSha256,
-    source: ConnectorAttachmentPrivateSource,
-  })
-  .strict()
-  .superRefine((attachment, context) => {
-    const publicValues = [
-      attachment.providerAttachmentId.value,
-      attachment.fileName,
-      attachment.mediaType,
-    ];
-    for (const credential of privateUrlCredentialValues(attachment.source.url)) {
-      if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {
-        context.addIssue({
-          code: "custom",
-          message: "private source credentials must not appear in public attachment metadata",
-        });
-        return;
-      }
-    }
-  });
-export type ConnectorAttachmentTransfer = z.infer<typeof ConnectorAttachmentTransfer>;
-
-export const ConnectorAttachmentTransferEnvelope = z
-  .object({
-    version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),
-    attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),
-  })
-  .strict()
-  .superRefine((envelope, context) => {
-    const identities = new Set<string>();
-    for (const [index, attachment] of envelope.attachments.entries()) {
-      const identity = `${attachment.providerAttachmentId.provider}\0${attachment.providerAttachmentId.value}`;
-      if (identities.has(identity)) {
-        context.addIssue({
-          code: "custom",
-          message: "provider attachment identities must be unique",
-          path: ["attachments", index, "providerAttachmentId"],
-        });
+        identities.add(identity);
       }
-      identities.add(identity);
-    }
-  });
+    }),
+);
 export type ConnectorAttachmentTransferEnvelope = z.infer<
   typeof ConnectorAttachmentTransferEnvelope
 >;
@@ -275,41 +286,45 @@ export const ConnectorAttachmentSandboxPath = boundedString(
     { message: "must be a confined connector attachment sandbox path" },
   );
 
-export const ConnectorAttachmentReceipt = z
-  .object({
-    providerAttachmentId: ConnectorAttachmentProviderIdentity,
-    fileName: ConnectorAttachmentFileName,
-    mediaType: ConnectorAttachmentMediaType,
-    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
-    contentSha256: ConnectorAttachmentSha256,
-    sandboxPath: ConnectorAttachmentSandboxPath,
-  })
-  .strict()
-  .superRefine((receipt, context) => {
-    const segments = receipt.sandboxPath.split("/");
-    if (segments[2] !== receipt.providerAttachmentId.provider) {
-      context.addIssue({
-        code: "custom",
-        message: "sandbox path provider must match the provider attachment identity",
-        path: ["sandboxPath"],
-      });
-    }
-    if (segments[4] !== receipt.fileName) {
-      context.addIssue({
-        code: "custom",
-        message: "sandbox path filename must match the attachment filename",
-        path: ["sandboxPath"],
-      });
-    }
-  });
+export const ConnectorAttachmentReceipt = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      providerAttachmentId: ConnectorAttachmentProviderIdentity,
+      fileName: ConnectorAttachmentFileName,
+      mediaType: ConnectorAttachmentMediaType,
+      byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+      contentSha256: ConnectorAttachmentSha256,
+      sandboxPath: ConnectorAttachmentSandboxPath,
+    })
+    .strict()
+    .superRefine((receipt, context) => {
+      const segments = receipt.sandboxPath.split("/");
+      if (segments[2] !== receipt.providerAttachmentId.provider) {
+        context.addIssue({
+          code: "custom",
+          message: "sandbox path provider must match the provider attachment identity",
+          path: ["sandboxPath"],
+        });
+      }
+      if (segments[4] !== receipt.fileName) {
+        context.addIssue({
+          code: "custom",
+          message: "sandbox path filename must match the attachment filename",
+          path: ["sandboxPath"],
+        });
+      }
+    }),
+);
 export type ConnectorAttachmentReceipt = z.infer<typeof ConnectorAttachmentReceipt>;
 
-export const ConnectorAttachmentReceiptEnvelope = z
-  .object({
-    version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),
-    attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),
-  })
-  .strict();
+export const ConnectorAttachmentReceiptEnvelope = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),
+      attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),
+    })
+    .strict(),
+);
 export type ConnectorAttachmentReceiptEnvelope = z.infer<typeof ConnectorAttachmentReceiptEnvelope>;
 
 export function parseConnectorAttachmentTransferEnvelope(

package/src/connector-destinations.ts

@@ -1,59 +1,63 @@
+import { defineSchema } from "./define-schema";
 import { z } from "zod";
 
-export const ConnectorDocumentDestinationAuthority = z.enum([
-  "organization",
-  "workspace",
-  "personal",
-]);
+export const ConnectorDocumentDestinationAuthority = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["organization", "workspace", "personal"]),
+);
 export type ConnectorDocumentDestinationAuthority = z.infer<
   typeof ConnectorDocumentDestinationAuthority
 >;
 
-export const ConnectorDocumentDestinationSelection = z.object({
-  authorityKind: ConnectorDocumentDestinationAuthority,
-  collectionId: z.string().uuid().nullable().default(null),
-});
+export const ConnectorDocumentDestinationSelection = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    authorityKind: ConnectorDocumentDestinationAuthority,
+    collectionId: z.string().uuid().nullable().default(null),
+  }),
+);
 export type ConnectorDocumentDestinationSelection = z.infer<
   typeof ConnectorDocumentDestinationSelection
 >;
 
-export const ConnectorDocumentDestination = z
-  .object({
-    authorityKind: ConnectorDocumentDestinationAuthority,
-    authorityAccountId: z.string().uuid(),
-    authorityWorkspaceId: z.string().uuid().nullable(),
-    authoritySubjectId: z.string().trim().min(1).max(1024).nullable(),
-    collectionId: z.string().uuid().nullable().default(null),
-  })
-  .superRefine((destination, context) => {
-    if (destination.authorityKind === "organization") {
-      if (destination.authorityWorkspaceId !== null || destination.authoritySubjectId !== null) {
+export const ConnectorDocumentDestination = /* @__PURE__ */ defineSchema(() =>
+  z
+    .object({
+      authorityKind: ConnectorDocumentDestinationAuthority,
+      authorityAccountId: z.string().uuid(),
+      authorityWorkspaceId: z.string().uuid().nullable(),
+      authoritySubjectId: z.string().trim().min(1).max(1024).nullable(),
+      collectionId: z.string().uuid().nullable().default(null),
+    })
+    .superRefine((destination, context) => {
+      if (destination.authorityKind === "organization") {
+        if (destination.authorityWorkspaceId !== null || destination.authoritySubjectId !== null) {
+          context.addIssue({
+            code: "custom",
+            message:
+              "organization connector destinations cannot bind workspace or subject authority",
+          });
+        }
+        return;
+      }
+      if (destination.authorityWorkspaceId === null) {
         context.addIssue({
           code: "custom",
-          message: "organization connector destinations cannot bind workspace or subject authority",
+          message: "workspace and personal connector destinations require workspace authority",
         });
       }
-      return;
-    }
-    if (destination.authorityWorkspaceId === null) {
-      context.addIssue({
-        code: "custom",
-        message: "workspace and personal connector destinations require workspace authority",
-      });
-    }
-    if (destination.authorityKind === "workspace" && destination.authoritySubjectId !== null) {
-      context.addIssue({
-        code: "custom",
-        message: "workspace connector destinations cannot bind subject authority",
-      });
-    }
-    if (destination.authorityKind === "personal" && destination.authoritySubjectId === null) {
-      context.addIssue({
-        code: "custom",
-        message: "personal connector destinations require immutable subject authority",
-      });
-    }
-  });
+      if (destination.authorityKind === "workspace" && destination.authoritySubjectId !== null) {
+        context.addIssue({
+          code: "custom",
+          message: "workspace connector destinations cannot bind subject authority",
+        });
+      }
+      if (destination.authorityKind === "personal" && destination.authoritySubjectId === null) {
+        context.addIssue({
+          code: "custom",
+          message: "personal connector destinations require immutable subject authority",
+        });
+      }
+    }),
+);
 export type ConnectorDocumentDestination = z.infer<typeof ConnectorDocumentDestination>;
 
 export function bindConnectorDocumentDestination(

package/src/connector-tool-permissions.ts

@@ -0,0 +1,117 @@
+import { defineSchema } from "./define-schema";
+import { z } from "zod";
+import { MCP_MAX_CATALOG_TOOL_ENTRIES } from "./mcp-catalog-limits";
+
+export const ConnectorToolPermission = /* @__PURE__ */ defineSchema(() =>
+  z.enum(["allow", "ask", "block"]),
+);
+export type ConnectorToolPermission = z.infer<typeof ConnectorToolPermission>;
+
+export const ConnectorToolPermissionEntry = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    name: z.string().min(1).max(512),
+    title: z.string().optional(),
+    description: z.string().optional(),
+    group: z.enum(["read", "write", "other"]),
+    permission: ConnectorToolPermission,
+    inherited: z.boolean(),
+    resetReason: z.literal("operation_changed").optional(),
+    approvalRequired: z.boolean(),
+    source: z.enum(["recommended", "connector_default", "tool", "action", "conflict"]).optional(),
+    conditional: z.boolean().optional(),
+    actionPermissions: z
+      .array(
+        z.object({
+          actionName: z.string(),
+          permission: ConnectorToolPermission,
+        }),
+      )
+      .optional(),
+  }),
+);
+export type ConnectorToolPermissionEntry = z.infer<typeof ConnectorToolPermissionEntry>;
+
+export const ConnectorToolPermissionsResponse = /* @__PURE__ */ defineSchema(() =>
+  z.object({
+    connectionId: z.string(),
+    serverId: z.string(),
+    defaultPermission: ConnectorToolPermission.nullable(),
+    tools: z.array(ConnectorToolPermissionEntry),
+    discoveryError: z.string().nullable(),
+    canManage: z.boolean(),
+    appliesTo: z.literal("next_attempt").optional(),
+    revision: z.string().optional(),
+    accountLabel: z.string().optional(),
+    instanceKey: z.string().optional(),
+    accounts: z
+      .array(
+        z.object({
+          connectionId: z.string(),
+          label: z.string(),
+          scope: z.enum(["personal", "workspace", "none"]),
+          instanceKey: z.string().optional(),
+        }),
+      )
+      .optional(),
+  }),
+);
+export type ConnectorToolPermissionsResponse = z.infer<typeof ConnectorToolPermissionsResponse>;
+
+// Group changes name the currently displayed tools explicitly. MCP annotations
+// organize the UI only; they never grant future tools permission automatically.
+export const UpdateConnectorToolPermissionsRequest = /* @__PURE__ */ defineSchema(() =>
+  z.discriminatedUnion("target", [
+    z
+      .object({
+        connectionId: z.string().min(1).max(512),
+        target: z.literal("default"),
+        permission: ConnectorToolPermission.nullable(),
+        expectedRevision: z.string().optional(),
+        instanceKey: z.string().optional(),
+      })
+      .strict(),
+    z
+      .object({
+        connectionId: z.string().min(1).max(512),
+        target: z.literal("tools"),
+        toolNames: z
+          .array(
+            z
+              .string()
+              .min(1)
+              .max(512)
+              .refine((name) => name !== "*" && name === name.trim(), {
+                message: "Tool names must be exact and cannot use the connector-default wildcard.",
+              }),
+          )
+          .min(1)
+          .max(MCP_MAX_CATALOG_TOOL_ENTRIES),
+        permission: ConnectorToolPermission.nullable(),
+        expectedRevision: z.string().optional(),
+        instanceKey: z.string().optional(),
+      })
+      .strict(),
+    z
+      .object({
+        connectionId: z.string().min(1).max(512),
+        target: z.literal("action"),
+        toolName: z
+          .string()
+          .min(1)
+          .max(512)
+          .refine((value) => value !== "*" && value === value.trim()),
+        actionName: z
+          .string()
+          .min(1)
+          .max(512)
+          .refine((value) => value !== "*" && value === value.trim()),
+        permission: ConnectorToolPermission.nullable(),
+        expectedRevision: z.string().optional(),
+        instanceKey: z.string().optional(),
+      })
+      .strict(),
+  ]),
+);
+export type UpdateConnectorToolPermissionsRequest = z.infer<
+  typeof UpdateConnectorToolPermissionsRequest
+>;