@opengeni/contracts 3.1.0-canary.2 → 3.1.2

package/dist/organization-access.d.ts

@@ -0,0 +1,412 @@
+import { z } from "zod";
+import { Permission } from "./permissions.js";
+export declare const OrganizationAccessPreset: z.ZodEnum<{
+    custom: "custom";
+    full: "full";
+    read_only: "read_only";
+}>;
+export type OrganizationAccessPreset = z.infer<typeof OrganizationAccessPreset>;
+export declare const OrganizationWorkspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"all">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"selected">;
+    workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+}, z.core.$strict>], "kind">;
+export type OrganizationWorkspaceScope = z.infer<typeof OrganizationWorkspaceScope>;
+export declare const OrganizationActor: z.ZodEnum<{
+    organization: "organization";
+    user: "user";
+}>;
+export type OrganizationActor = z.infer<typeof OrganizationActor>;
+/** Custom has no implicit permissions. Presets are expanded only by this helper. */
+export declare function organizationAccessPresetPermissions(preset: OrganizationAccessPreset): Permission[];
+/** True when nothing can be changed, including an empty set and secret-value reads. */
+export declare function isReadOnlyPermissionSet(permissions: readonly Permission[]): boolean;
+declare const OrganizationAccessPolicyInput: z.ZodObject<{
+    preset: z.ZodEnum<{
+        custom: "custom";
+        full: "full";
+        read_only: "read_only";
+    }>;
+    permissions: z.ZodArray<z.ZodLazy<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>>;
+    workspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"selected">;
+        workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>;
+export type OrganizationAccessPolicy = z.infer<typeof OrganizationAccessPolicyInput>;
+/** Canonical ordering, alias mapping and labels; never adds an unrequested grant. */
+export declare function normalizeOrganizationAccessPolicy(policy: OrganizationAccessPolicy): OrganizationAccessPolicy;
+export declare const OrganizationAccessPolicy: z.ZodPipe<z.ZodObject<{
+    preset: z.ZodEnum<{
+        custom: "custom";
+        full: "full";
+        read_only: "read_only";
+    }>;
+    permissions: z.ZodArray<z.ZodLazy<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>>;
+    workspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"all">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"selected">;
+        workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>, z.ZodTransform<{
+    preset: "custom" | "full" | "read_only";
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+    workspaceScope: {
+        kind: "all";
+    } | {
+        kind: "selected";
+        workspaceIds: string[];
+    };
+}, {
+    preset: "custom" | "full" | "read_only";
+    permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+    workspaceScope: {
+        kind: "all";
+    } | {
+        kind: "selected";
+        workspaceIds: string[];
+    };
+}>>;
+/** Change what a connected agent can do. Only the person who connected it can. */
+export declare const UpdateOrganizationMcpConnectionRequest: z.ZodObject<{
+    access: z.ZodPipe<z.ZodObject<{
+        preset: z.ZodEnum<{
+            custom: "custom";
+            full: "full";
+            read_only: "read_only";
+        }>;
+        permissions: z.ZodArray<z.ZodLazy<z.ZodEnum<{
+            "account:admin": "account:admin";
+            "account:read": "account:read";
+            "api_keys:manage": "api_keys:manage";
+            "artifacts:publish": "artifacts:publish";
+            "artifacts:read": "artifacts:read";
+            "billing:manage": "billing:manage";
+            "billing:read": "billing:read";
+            "capabilities:manage": "capabilities:manage";
+            "codemode:call": "codemode:call";
+            "connections:read": "connections:read";
+            "connections:write": "connections:write";
+            "documents:manage": "documents:manage";
+            "documents:search": "documents:search";
+            "enrollments:manage": "enrollments:manage";
+            "enrollments:read": "enrollments:read";
+            "environments:manage": "environments:manage";
+            "environments:use": "environments:use";
+            "files:read": "files:read";
+            "files:upload": "files:upload";
+            "files:write": "files:write";
+            "github:manage": "github:manage";
+            "github:use": "github:use";
+            "goals:manage": "goals:manage";
+            "mcp_servers:attach": "mcp_servers:attach";
+            "members:manage": "members:manage";
+            "rigs:manage": "rigs:manage";
+            "rigs:use": "rigs:use";
+            "scheduled_tasks:manage": "scheduled_tasks:manage";
+            "scheduled_tasks:run": "scheduled_tasks:run";
+            "secrets:list": "secrets:list";
+            "secrets:read": "secrets:read";
+            "secrets:use": "secrets:use";
+            "secrets:write": "secrets:write";
+            "sessions:control": "sessions:control";
+            "sessions:create": "sessions:create";
+            "sessions:read": "sessions:read";
+            "stream:acknowledge": "stream:acknowledge";
+            "stream:control": "stream:control";
+            "stream:view": "stream:view";
+            "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
+            "variable-sets:attach": "variable-sets:attach";
+            "variable-sets:list": "variable-sets:list";
+            "variable-sets:manage": "variable-sets:manage";
+            "variable-sets:read": "variable-sets:read";
+            "variable-sets:use": "variable-sets:use";
+            "variable-sets:write": "variable-sets:write";
+            "workspace:admin": "workspace:admin";
+            "workspace:create": "workspace:create";
+            "workspace:read": "workspace:read";
+        }>>>;
+        workspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"all">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"selected">;
+            workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>, z.ZodTransform<{
+        preset: "custom" | "full" | "read_only";
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        workspaceScope: {
+            kind: "all";
+        } | {
+            kind: "selected";
+            workspaceIds: string[];
+        };
+    }, {
+        preset: "custom" | "full" | "read_only";
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        workspaceScope: {
+            kind: "all";
+        } | {
+            kind: "selected";
+            workspaceIds: string[];
+        };
+    }>>;
+}, z.core.$strict>;
+/**
+ * The answer to a pending agent sign-in: deny it, or approve it for one
+ * organization with the access the agent gets there.
+ */
+export declare const McpConnectionDecision: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    decision: z.ZodLiteral<"deny">;
+}, z.core.$strict>, z.ZodObject<{
+    decision: z.ZodLiteral<"approve">;
+    organizationId: z.ZodString;
+    access: z.ZodPipe<z.ZodObject<{
+        preset: z.ZodEnum<{
+            custom: "custom";
+            full: "full";
+            read_only: "read_only";
+        }>;
+        permissions: z.ZodArray<z.ZodLazy<z.ZodEnum<{
+            "account:admin": "account:admin";
+            "account:read": "account:read";
+            "api_keys:manage": "api_keys:manage";
+            "artifacts:publish": "artifacts:publish";
+            "artifacts:read": "artifacts:read";
+            "billing:manage": "billing:manage";
+            "billing:read": "billing:read";
+            "capabilities:manage": "capabilities:manage";
+            "codemode:call": "codemode:call";
+            "connections:read": "connections:read";
+            "connections:write": "connections:write";
+            "documents:manage": "documents:manage";
+            "documents:search": "documents:search";
+            "enrollments:manage": "enrollments:manage";
+            "enrollments:read": "enrollments:read";
+            "environments:manage": "environments:manage";
+            "environments:use": "environments:use";
+            "files:read": "files:read";
+            "files:upload": "files:upload";
+            "files:write": "files:write";
+            "github:manage": "github:manage";
+            "github:use": "github:use";
+            "goals:manage": "goals:manage";
+            "mcp_servers:attach": "mcp_servers:attach";
+            "members:manage": "members:manage";
+            "rigs:manage": "rigs:manage";
+            "rigs:use": "rigs:use";
+            "scheduled_tasks:manage": "scheduled_tasks:manage";
+            "scheduled_tasks:run": "scheduled_tasks:run";
+            "secrets:list": "secrets:list";
+            "secrets:read": "secrets:read";
+            "secrets:use": "secrets:use";
+            "secrets:write": "secrets:write";
+            "sessions:control": "sessions:control";
+            "sessions:create": "sessions:create";
+            "sessions:read": "sessions:read";
+            "stream:acknowledge": "stream:acknowledge";
+            "stream:control": "stream:control";
+            "stream:view": "stream:view";
+            "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
+            "variable-sets:attach": "variable-sets:attach";
+            "variable-sets:list": "variable-sets:list";
+            "variable-sets:manage": "variable-sets:manage";
+            "variable-sets:read": "variable-sets:read";
+            "variable-sets:use": "variable-sets:use";
+            "variable-sets:write": "variable-sets:write";
+            "workspace:admin": "workspace:admin";
+            "workspace:create": "workspace:create";
+            "workspace:read": "workspace:read";
+        }>>>;
+        workspaceScope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            kind: z.ZodLiteral<"all">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"selected">;
+            workspaceIds: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+        }, z.core.$strict>], "kind">;
+    }, z.core.$strict>, z.ZodTransform<{
+        preset: "custom" | "full" | "read_only";
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        workspaceScope: {
+            kind: "all";
+        } | {
+            kind: "selected";
+            workspaceIds: string[];
+        };
+    }, {
+        preset: "custom" | "full" | "read_only";
+        permissions: ("account:admin" | "account:read" | "api_keys:manage" | "artifacts:publish" | "artifacts:read" | "billing:manage" | "billing:read" | "capabilities:manage" | "codemode:call" | "connections:read" | "connections:write" | "documents:manage" | "documents:search" | "enrollments:manage" | "enrollments:read" | "environments:manage" | "environments:use" | "files:read" | "files:upload" | "files:write" | "github:manage" | "github:use" | "goals:manage" | "mcp_servers:attach" | "members:manage" | "rigs:manage" | "rigs:use" | "scheduled_tasks:manage" | "scheduled_tasks:run" | "secrets:list" | "secrets:read" | "secrets:use" | "secrets:write" | "sessions:control" | "sessions:create" | "sessions:read" | "stream:acknowledge" | "stream:control" | "stream:view" | "terminal:attach" | "usage_allowances:manage" | "variable-sets:attach" | "variable-sets:list" | "variable-sets:manage" | "variable-sets:read" | "variable-sets:use" | "variable-sets:write" | "workspace:admin" | "workspace:create" | "workspace:read")[];
+        workspaceScope: {
+            kind: "all";
+        } | {
+            kind: "selected";
+            workspaceIds: string[];
+        };
+    }>>;
+}, z.core.$strict>], "decision">;
+export declare const OrganizationServiceAccountRole: z.ZodEnum<{
+    admin: "admin";
+    member: "member";
+}>;
+export type OrganizationServiceAccountRole = z.infer<typeof OrganizationServiceAccountRole>;
+/** What only an organization administrator can do; a member service account's keys never hold it. */
+export declare const ORGANIZATION_ADMIN_ONLY_PERMISSIONS: readonly Permission[];
+/** The permissions a service account's keys may hold, given its role. */
+export declare function serviceAccountAllowsPermission(role: OrganizationServiceAccountRole, permission: Permission): boolean;
+export declare const OrganizationServiceAccount: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodNullable<z.ZodString>;
+    role: z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>;
+    activeKeyCount: z.ZodNumber;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strip>;
+export type OrganizationServiceAccount = z.infer<typeof OrganizationServiceAccount>;
+export declare const ListOrganizationServiceAccountsResponse: z.ZodObject<{
+    serviceAccounts: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        organizationId: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        role: z.ZodEnum<{
+            admin: "admin";
+            member: "member";
+        }>;
+        activeKeyCount: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ListOrganizationServiceAccountsResponse = z.infer<typeof ListOrganizationServiceAccountsResponse>;
+export declare const CreateOrganizationServiceAccountRequest: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    role: z.ZodDefault<z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>>;
+}, z.core.$strict>;
+export type CreateOrganizationServiceAccountRequest = z.infer<typeof CreateOrganizationServiceAccountRequest>;
+export declare const UpdateOrganizationServiceAccountRequest: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    role: z.ZodOptional<z.ZodEnum<{
+        admin: "admin";
+        member: "member";
+    }>>;
+}, z.core.$strict>;
+export type UpdateOrganizationServiceAccountRequest = z.infer<typeof UpdateOrganizationServiceAccountRequest>;
+export {};

package/dist/organization-access.js

@@ -0,0 +1,39 @@
+import {
+  CreateOrganizationServiceAccountRequest,
+  ListOrganizationServiceAccountsResponse,
+  McpConnectionDecision,
+  ORGANIZATION_ADMIN_ONLY_PERMISSIONS,
+  OrganizationAccessPolicy,
+  OrganizationAccessPreset,
+  OrganizationActor,
+  OrganizationServiceAccount,
+  OrganizationServiceAccountRole,
+  OrganizationWorkspaceScope,
+  UpdateOrganizationMcpConnectionRequest,
+  UpdateOrganizationServiceAccountRequest,
+  isReadOnlyPermissionSet,
+  normalizeOrganizationAccessPolicy,
+  organizationAccessPresetPermissions,
+  serviceAccountAllowsPermission
+} from "./chunk-SWRN2DJ3.js";
+import "./chunk-HRRU4QPI.js";
+import "./chunk-56SNIMDO.js";
+export {
+  CreateOrganizationServiceAccountRequest,
+  ListOrganizationServiceAccountsResponse,
+  McpConnectionDecision,
+  ORGANIZATION_ADMIN_ONLY_PERMISSIONS,
+  OrganizationAccessPolicy,
+  OrganizationAccessPreset,
+  OrganizationActor,
+  OrganizationServiceAccount,
+  OrganizationServiceAccountRole,
+  OrganizationWorkspaceScope,
+  UpdateOrganizationMcpConnectionRequest,
+  UpdateOrganizationServiceAccountRequest,
+  isReadOnlyPermissionSet,
+  normalizeOrganizationAccessPolicy,
+  organizationAccessPresetPermissions,
+  serviceAccountAllowsPermission
+};
+//# sourceMappingURL=organization-access.js.map

package/dist/organization-access.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/organization-integration-policy.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+/** Catalog identities, never endpoint/domain matching. Custom transports are explicit categories. */
+export declare const OrganizationIntegrationKey: z.ZodString;
+export declare const OrganizationIntegrationPolicy: z.ZodObject<{
+    mode: z.ZodDefault<z.ZodEnum<{
+        restricted: "restricted";
+        unrestricted: "unrestricted";
+    }>>;
+    allowedIntegrationKeys: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    revision: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>;
+export type OrganizationIntegrationPolicy = z.infer<typeof OrganizationIntegrationPolicy>;
+export declare const UpdateOrganizationIntegrationPolicyRequest: z.ZodObject<{
+    mode: z.ZodEnum<{
+        restricted: "restricted";
+        unrestricted: "unrestricted";
+    }>;
+    allowedIntegrationKeys: z.ZodArray<z.ZodString>;
+    expectedRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type UpdateOrganizationIntegrationPolicyRequest = z.infer<typeof UpdateOrganizationIntegrationPolicyRequest>;
+export declare class OrganizationIntegrationDeniedError extends Error {
+    constructor();
+}
+/** integrationKey must come from trusted classification, not client-supplied metadata. */
+export declare function assertOrganizationIntegrationAllowed(policy: OrganizationIntegrationPolicy, integrationKey: string | null): void;

package/dist/organization-membership-lifecycle.d.ts

@@ -195,6 +195,34 @@ export declare const UpdateOrganizationPrivateSessionSettingsRequest: z.ZodObjec
     operationId: z.ZodString;
 }, z.core.$strict>;
 export type UpdateOrganizationPrivateSessionSettingsRequest = z.infer<typeof UpdateOrganizationPrivateSessionSettingsRequest>;
+/**
+ * An organization's privacy choices, after the deployment's limits. A product
+ * that embeds Opengeni can only narrow these: `limits` says which choices are
+ * fixed for every organization on this deployment.
+ */
+export declare const OrganizationPrivacySettings: z.ZodObject<{
+    organizationId: z.ZodString;
+    defaultVisibility: z.ZodEnum<{
+        private: "private";
+        workspace: "workspace";
+    }>;
+    adminsSeePrivateSchedules: z.ZodBoolean;
+    limits: z.ZodObject<{
+        onlyMeAllowed: z.ZodBoolean;
+        defaultVisibilityLocked: z.ZodBoolean;
+        adminsSeePrivateSchedulesLocked: z.ZodBoolean;
+    }, z.core.$strip>;
+    updatedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type OrganizationPrivacySettings = z.infer<typeof OrganizationPrivacySettings>;
+export declare const UpdateOrganizationPrivacySettingsRequest: z.ZodObject<{
+    defaultVisibility: z.ZodOptional<z.ZodEnum<{
+        private: "private";
+        workspace: "workspace";
+    }>>;
+    adminsSeePrivateSchedules: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type UpdateOrganizationPrivacySettingsRequest = z.infer<typeof UpdateOrganizationPrivacySettingsRequest>;
 export declare const OrganizationWorkspaceAccessMember: z.ZodObject<{
     membershipId: z.ZodString;
     organizationMembershipId: z.ZodNullable<z.ZodString>;
@@ -296,6 +324,7 @@ export declare const OrganizationWorkspaceRoleDefinition: z.ZodObject<{
         "scheduled_tasks:run": "scheduled_tasks:run";
         "secrets:list": "secrets:list";
         "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
         "secrets:write": "secrets:write";
         "sessions:control": "sessions:control";
         "sessions:create": "sessions:create";
@@ -304,6 +333,7 @@ export declare const OrganizationWorkspaceRoleDefinition: z.ZodObject<{
         "stream:control": "stream:control";
         "stream:view": "stream:view";
         "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
         "variable-sets:attach": "variable-sets:attach";
         "variable-sets:list": "variable-sets:list";
         "variable-sets:manage": "variable-sets:manage";
@@ -363,6 +393,7 @@ export declare const OrganizationAdministrationOverview: z.ZodObject<{
             "scheduled_tasks:run": "scheduled_tasks:run";
             "secrets:list": "secrets:list";
             "secrets:read": "secrets:read";
+            "secrets:use": "secrets:use";
             "secrets:write": "secrets:write";
             "sessions:control": "sessions:control";
             "sessions:create": "sessions:create";
@@ -371,6 +402,7 @@ export declare const OrganizationAdministrationOverview: z.ZodObject<{
             "stream:control": "stream:control";
             "stream:view": "stream:view";
             "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
             "variable-sets:attach": "variable-sets:attach";
             "variable-sets:list": "variable-sets:list";
             "variable-sets:manage": "variable-sets:manage";
@@ -470,6 +502,7 @@ export declare const PutOrganizationWorkspaceMemberRequest: z.ZodDiscriminatedUn
         "scheduled_tasks:run": "scheduled_tasks:run";
         "secrets:list": "secrets:list";
         "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
         "secrets:write": "secrets:write";
         "sessions:control": "sessions:control";
         "sessions:create": "sessions:create";
@@ -478,6 +511,7 @@ export declare const PutOrganizationWorkspaceMemberRequest: z.ZodDiscriminatedUn
         "stream:control": "stream:control";
         "stream:view": "stream:view";
         "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
         "variable-sets:attach": "variable-sets:attach";
         "variable-sets:list": "variable-sets:list";
         "variable-sets:manage": "variable-sets:manage";
@@ -694,6 +728,10 @@ export type RetryOrganizationUserSetupDeliveryRequest = z.infer<typeof RetryOrga
 export declare const CompleteSelfServiceOrganizationSetupRequest: z.ZodObject<{
     organizationName: z.ZodString;
     operationId: z.ZodString;
+    useCase: z.ZodOptional<z.ZodEnum<{
+        cloud: "cloud";
+        embed: "embed";
+    }>>;
 }, z.core.$strip>;
 export type CompleteSelfServiceOrganizationSetupRequest = z.infer<typeof CompleteSelfServiceOrganizationSetupRequest>;
 export declare const CompleteSelfServiceOrganizationSetupResponse: z.ZodObject<{