@osva-ai/contracts 1.1.0-rc.2 → 1.1.0-rc.3

package/dist/v1-control-plane-human-access.js

@@ -0,0 +1,41 @@
+import { HUMAN_WORKSPACE_PERMISSIONS } from "./human-identity.js";
+import { AUTHORIZATION_ACTIONS } from "./security.js";
+/** How a `/v1` route participates in human session authorization. */
+export const V1_ROUTE_ACCESS_CLASSES = {
+    /** Login, setup, recovery — no session required. */
+    PUBLIC_AUTHENTICATION: "public_authentication",
+    /** Human session routes without workspace-scoped control-plane permissions. */
+    HUMAN_IDENTITY_SESSION: "human_identity_session",
+    /** Human identity admin routes requiring workspace membership permissions. */
+    HUMAN_IDENTITY_WORKSPACE: "human_identity_workspace",
+    /** Standard control-plane route; humans use workspace membership + permission. */
+    CONTROL_PLANE_WORKSPACE: "control_plane_workspace",
+    /** Machine API-key context only (e.g. GET /v1/auth/context). */
+    API_KEY_ONLY: "api_key_only",
+    /** Human principals must not call this route (default deny). */
+    HUMAN_PRINCIPAL_DENIED: "human_principal_denied",
+};
+const ACCESS_CLASS_VALUES = new Set(Object.values(V1_ROUTE_ACCESS_CLASSES));
+export function isV1RouteAccessClass(value) {
+    return ACCESS_CLASS_VALUES.has(value);
+}
+export function authorizationActionToHumanPermission(action) {
+    switch (action) {
+        case AUTHORIZATION_ACTIONS.READ:
+            return HUMAN_WORKSPACE_PERMISSIONS.READ;
+        case AUTHORIZATION_ACTIONS.EXECUTE:
+            return HUMAN_WORKSPACE_PERMISSIONS.EXECUTE;
+        case AUTHORIZATION_ACTIONS.WRITE:
+            return HUMAN_WORKSPACE_PERMISSIONS.WRITE;
+        case AUTHORIZATION_ACTIONS.ADMIN:
+            return HUMAN_WORKSPACE_PERMISSIONS.ADMINISTER_WORKSPACE;
+        default: {
+            const _exhaustive = action;
+            return _exhaustive;
+        }
+    }
+}
+export function isHumanPermittedControlPlaneAccessClass(accessClass) {
+    return accessClass === V1_ROUTE_ACCESS_CLASSES.CONTROL_PLANE_WORKSPACE;
+}
+//# sourceMappingURL=v1-control-plane-human-access.js.map

package/dist/v1-control-plane-human-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1-control-plane-human-access.js","sourceRoot":"","sources":["../src/v1-control-plane-human-access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAEtD,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,oDAAoD;IACpD,qBAAqB,EAAE,uBAAuB;IAC9C,+EAA+E;IAC/E,sBAAsB,EAAE,wBAAwB;IAChD,8EAA8E;IAC9E,wBAAwB,EAAE,0BAA0B;IACpD,kFAAkF;IAClF,uBAAuB,EAAE,yBAAyB;IAClD,gEAAgE;IAChE,YAAY,EAAE,cAAc;IAC5B,gEAAgE;IAChE,sBAAsB,EAAE,wBAAwB;CACxC,CAAC;AAKX,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,MAAM,CAAC,MAAM,CAAC,uBAAuB,CAAC,CACvC,CAAC;AAEF,MAAM,UAAU,oBAAoB,CAClC,KAAa;IAEb,OAAO,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,MAA2B;IAE3B,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,qBAAqB,CAAC,IAAI;YAC7B,OAAO,2BAA2B,CAAC,IAAI,CAAC;QAC1C,KAAK,qBAAqB,CAAC,OAAO;YAChC,OAAO,2BAA2B,CAAC,OAAO,CAAC;QAC7C,KAAK,qBAAqB,CAAC,KAAK;YAC9B,OAAO,2BAA2B,CAAC,KAAK,CAAC;QAC3C,KAAK,qBAAqB,CAAC,KAAK;YAC9B,OAAO,2BAA2B,CAAC,oBAAoB,CAAC;QAC1D,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,WAAW,GAAU,MAAM,CAAC;YAClC,OAAO,WAAW,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uCAAuC,CACrD,WAA+B;IAE/B,OAAO,WAAW,KAAK,uBAAuB,CAAC,uBAAuB,CAAC;AACzE,CAAC"}

package/dist/v1-route-access.d.ts

@@ -0,0 +1,14 @@
+import type { HumanWorkspacePermission } from "./human-identity.js";
+import type { AuthorizationAction } from "./security.js";
+import type { V1RouteAccessClass } from "./v1-control-plane-human-access.js";
+export interface V1RouteAccessRecord {
+    readonly module: string;
+    readonly method: string;
+    readonly path: string;
+    readonly accessClass: V1RouteAccessClass;
+    readonly workspaceScoped: boolean;
+    readonly requiredHumanPermission: HumanWorkspacePermission | null;
+    readonly requiredAuthorizationAction: AuthorizationAction | null;
+    readonly resourceFamily: string;
+}
+//# sourceMappingURL=v1-route-access.d.ts.map

package/dist/v1-route-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1-route-access.d.ts","sourceRoot":"","sources":["../src/v1-route-access.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,uBAAuB,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAClE,QAAQ,CAAC,2BAA2B,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC"}

package/dist/v1-route-access.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=v1-route-access.js.map

package/dist/v1-route-access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"v1-route-access.js","sourceRoot":"","sources":["../src/v1-route-access.ts"],"names":[],"mappings":""}

package/dist/validate-agent-manifest.d.ts

@@ -0,0 +1,14 @@
+import type { AgentManifestV1 } from "./agent-manifest.js";
+export type AgentManifestValidationResult = {
+    readonly ok: true;
+    readonly manifest: AgentManifestV1;
+} | {
+    readonly ok: false;
+    readonly messages: readonly string[];
+};
+/**
+ * Canonical Agent Manifest parse/validation (Zod + declarative cross-field rules).
+ * Does not mutate the input value.
+ */
+export declare function validateAgentManifest(manifest: unknown): AgentManifestValidationResult;
+//# sourceMappingURL=validate-agent-manifest.d.ts.map

package/dist/validate-agent-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-agent-manifest.d.ts","sourceRoot":"","sources":["../src/validate-agent-manifest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAG3D,MAAM,MAAM,6BAA6B,GACrC;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC;AAEjE;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,OAAO,GAChB,6BAA6B,CAiB/B"}

package/dist/validate-agent-manifest.js

@@ -0,0 +1,21 @@
+import { agentManifestSchema } from "./schemas/agent-manifest.js";
+/**
+ * Canonical Agent Manifest parse/validation (Zod + declarative cross-field rules).
+ * Does not mutate the input value.
+ */
+export function validateAgentManifest(manifest) {
+    const result = agentManifestSchema.safeParse(manifest);
+    if (result.success) {
+        return { ok: true, manifest: result.data };
+    }
+    const messages = result.error.issues
+        .map((issue) => issue.message)
+        .filter((message) => message.length > 0);
+    return {
+        ok: false,
+        messages: messages.length > 0
+            ? messages
+            : ["Agent manifest is invalid."],
+    };
+}
+//# sourceMappingURL=validate-agent-manifest.js.map

package/dist/validate-agent-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-agent-manifest.js","sourceRoot":"","sources":["../src/validate-agent-manifest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAMlE;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAiB;IAEjB,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM;SACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;SAC7B,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAE3C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,QAAQ,EACN,QAAQ,CAAC,MAAM,GAAG,CAAC;YACjB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAE,CAAC,4BAA4B,CAAW;KAChD,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@osva-ai/contracts",
-  "version": "1.1.0-rc.2",
+  "version": "1.1.0-rc.3",
   "description": "OSVA public contracts and schemas",
   "license": "Apache-2.0",
   "repository": {