@qlever-llc/trellis 0.5.1 → 0.6.0

package/script/auth/protocol.js

@@ -0,0 +1,687 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkloadActivationRecordSchema = exports.WorkloadActivationActorSchema = exports.WorkloadSchema = exports.WorkloadProfileSchema = exports.PortalFlowStateSchema = exports.WorkloadPortalSelectionSchema = exports.LoginPortalSelectionSchema = exports.WorkloadPortalDefaultSchema = exports.LoginPortalDefaultSchema = exports.PortalSchema = exports.AuthRevokeApprovalResponseSchema = exports.AuthRevokeApprovalSchema = exports.AuthListApprovalsResponseSchema = exports.AuthListApprovalsSchema = exports.AuthValidateRequestResponseSchema = exports.CallerViewSchema = exports.AuthMeResponseSchema = exports.AuthenticatedWorkloadSchema = exports.AuthenticatedDeviceSchema = exports.AuthenticatedServiceSchema = exports.AuthValidateRequestSchema = exports.AuthMeSchema = exports.AuthenticatedUserSchema = exports.AuthGetInstalledContractResponseSchema = exports.AuthGetInstalledContractSchema = exports.AuthListInstalledContractsResponseSchema = exports.AuthListInstalledContractsSchema = exports.InstalledContractDetailSchema = exports.InstalledContractSchema = exports.ContractAnalysisSchema = exports.ContractAnalysisNatsRuleSchema = exports.ContractAnalysisSubjectSchema = exports.ContractAnalysisEventSchema = exports.ContractAnalysisRpcMethodSchema = exports.ContractAnalysisStreamResourceSchema = exports.ContractAnalysisJobsQueueSchema = exports.ContractAnalysisKvResourceSchema = exports.ContractAnalysisSummarySchema = exports.AuthUpgradeServiceContractResponseSchema = exports.AuthUpgradeServiceContractSchema = exports.AuthInstallServiceResponseSchema = exports.AuthInstallServiceSchema = exports.AuthListServicesResponseSchema = exports.AuthListServicesSchema = exports.ApprovalRecordViewSchema = exports.ContractApprovalViewSchema = exports.ApprovalDecisionSchema = exports.ServiceViewSchema = exports.OpenObjectSchema = exports.DigestSchema = void 0;
+exports.AuthListWorkloadActivationsResponseSchema = exports.AuthListWorkloadActivationsSchema = exports.AuthGetWorkloadConnectInfoResponseSchema = exports.AuthGetWorkloadConnectInfoSchema = exports.WaitForWorkloadActivationResponseSchema = exports.AuthGetWorkloadActivationStatusResponseSchema = exports.AuthGetWorkloadActivationStatusSchema = exports.AuthActivateWorkloadResponseSchema = exports.AuthActivateWorkloadSchema = exports.AuthDisableWorkloadInstanceResponseSchema = exports.AuthDisableWorkloadInstanceSchema = exports.AuthListWorkloadInstancesResponseSchema = exports.AuthListWorkloadInstancesSchema = exports.AuthProvisionWorkloadInstanceResponseSchema = exports.AuthProvisionWorkloadInstanceSchema = exports.AuthDisableWorkloadProfileResponseSchema = exports.AuthDisableWorkloadProfileSchema = exports.AuthListWorkloadProfilesResponseSchema = exports.AuthListWorkloadProfilesSchema = exports.AuthCreateWorkloadProfileResponseSchema = exports.AuthCreateWorkloadProfileSchema = exports.AuthClearWorkloadPortalSelectionResponseSchema = exports.AuthClearWorkloadPortalSelectionSchema = exports.AuthSetWorkloadPortalSelectionResponseSchema = exports.AuthSetWorkloadPortalSelectionSchema = exports.AuthListWorkloadPortalSelectionsResponseSchema = exports.AuthListWorkloadPortalSelectionsSchema = exports.AuthSetWorkloadPortalDefaultResponseSchema = exports.AuthSetWorkloadPortalDefaultSchema = exports.AuthGetWorkloadPortalDefaultResponseSchema = exports.AuthGetWorkloadPortalDefaultSchema = exports.AuthClearLoginPortalSelectionResponseSchema = exports.AuthClearLoginPortalSelectionSchema = exports.AuthSetLoginPortalSelectionResponseSchema = exports.AuthSetLoginPortalSelectionSchema = exports.AuthListLoginPortalSelectionsResponseSchema = exports.AuthListLoginPortalSelectionsSchema = exports.AuthSetLoginPortalDefaultResponseSchema = exports.AuthSetLoginPortalDefaultSchema = exports.AuthGetLoginPortalDefaultResponseSchema = exports.AuthGetLoginPortalDefaultSchema = exports.AuthDisablePortalResponseSchema = exports.AuthDisablePortalSchema = exports.AuthListPortalsResponseSchema = exports.AuthListPortalsSchema = exports.AuthCreatePortalResponseSchema = exports.AuthCreatePortalSchema = exports.WorkloadConnectInfoSchema = exports.AuthWorkloadActivationReviewRequestedEventSchema = exports.WorkloadActivationReviewSchema = void 0;
+exports.AuthUpdateUserResponseSchema = exports.AuthUpdateUserSchema = exports.AuthListUsersResponseSchema = exports.AuthListUsersSchema = exports.UserViewSchema = exports.AuthDecideWorkloadActivationReviewResponseSchema = exports.AuthDecideWorkloadActivationReviewSchema = exports.AuthListWorkloadActivationReviewsResponseSchema = exports.AuthListWorkloadActivationReviewsSchema = exports.AuthRevokeWorkloadActivationResponseSchema = exports.AuthRevokeWorkloadActivationSchema = void 0;
+const contracts_1 = require("@qlever-llc/trellis/contracts");
+const typebox_1 = require("typebox");
+const IsoDateStringSchema = typebox_1.Type.String({ format: "date-time" });
+exports.DigestSchema = typebox_1.Type.String({ pattern: "^[A-Za-z0-9_-]+$" });
+exports.OpenObjectSchema = typebox_1.Type.Unsafe({
+    type: "object",
+});
+exports.ServiceViewSchema = typebox_1.Type.Object({
+    sessionKey: typebox_1.Type.String(),
+    displayName: typebox_1.Type.String(),
+    active: typebox_1.Type.Boolean(),
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    namespaces: typebox_1.Type.Array(typebox_1.Type.String()),
+    description: typebox_1.Type.String(),
+    contractId: typebox_1.Type.Optional(typebox_1.Type.String()),
+    contractDigest: typebox_1.Type.Optional(exports.DigestSchema),
+    resourceBindings: typebox_1.Type.Optional(contracts_1.ContractResourceBindingsSchema),
+    createdAt: IsoDateStringSchema,
+}, { additionalProperties: false });
+exports.ApprovalDecisionSchema = typebox_1.Type.Union([
+    typebox_1.Type.Literal("approved"),
+    typebox_1.Type.Literal("denied"),
+]);
+exports.ContractApprovalViewSchema = typebox_1.Type.Object({
+    contractDigest: exports.DigestSchema,
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    displayName: typebox_1.Type.String({ minLength: 1 }),
+    description: typebox_1.Type.String({ minLength: 1 }),
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.ApprovalRecordViewSchema = typebox_1.Type.Object({
+    user: typebox_1.Type.String({ minLength: 1 }),
+    answer: exports.ApprovalDecisionSchema,
+    answeredAt: IsoDateStringSchema,
+    updatedAt: IsoDateStringSchema,
+    approval: exports.ContractApprovalViewSchema,
+}, { additionalProperties: false });
+exports.AuthListServicesSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
+exports.AuthListServicesResponseSchema = typebox_1.Type.Object({
+    services: typebox_1.Type.Array(exports.ServiceViewSchema),
+}, { additionalProperties: false });
+exports.AuthInstallServiceSchema = typebox_1.Type.Object({
+    sessionKey: typebox_1.Type.String(),
+    displayName: typebox_1.Type.String({ minLength: 1 }),
+    active: typebox_1.Type.Optional(typebox_1.Type.Boolean()),
+    namespaces: typebox_1.Type.Array(typebox_1.Type.String()),
+    description: typebox_1.Type.String({ minLength: 1 }),
+    contract: exports.OpenObjectSchema,
+}, { additionalProperties: false });
+exports.AuthInstallServiceResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+    sessionKey: typebox_1.Type.String(),
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    contractDigest: exports.DigestSchema,
+    resourceBindings: contracts_1.ContractResourceBindingsSchema,
+}, { additionalProperties: false });
+exports.AuthUpgradeServiceContractSchema = typebox_1.Type.Object({
+    sessionKey: typebox_1.Type.String(),
+    contract: exports.OpenObjectSchema,
+}, { additionalProperties: false });
+exports.AuthUpgradeServiceContractResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+    sessionKey: typebox_1.Type.String(),
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    contractDigest: exports.DigestSchema,
+    resourceBindings: contracts_1.ContractResourceBindingsSchema,
+}, { additionalProperties: false });
+exports.ContractAnalysisSummarySchema = typebox_1.Type.Object({
+    namespaces: typebox_1.Type.Array(typebox_1.Type.String()),
+    rpcMethods: typebox_1.Type.Number(),
+    events: typebox_1.Type.Number(),
+    natsPublish: typebox_1.Type.Number(),
+    natsSubscribe: typebox_1.Type.Number(),
+    kvResources: typebox_1.Type.Number(),
+    jobsQueues: typebox_1.Type.Number(),
+    streamResources: typebox_1.Type.Number(),
+}, { additionalProperties: false });
+exports.ContractAnalysisKvResourceSchema = typebox_1.Type.Object({
+    alias: typebox_1.Type.String({ minLength: 1 }),
+    purpose: typebox_1.Type.String({ minLength: 1 }),
+    required: typebox_1.Type.Boolean(),
+    history: typebox_1.Type.Number(),
+    ttlMs: typebox_1.Type.Number(),
+    maxValueBytes: typebox_1.Type.Optional(typebox_1.Type.Number()),
+}, { additionalProperties: false });
+exports.ContractAnalysisJobsQueueSchema = typebox_1.Type.Object({
+    queueType: typebox_1.Type.String({ minLength: 1 }),
+    payload: typebox_1.Type.Object({ schema: typebox_1.Type.String({ minLength: 1 }) }, {
+        additionalProperties: false,
+    }),
+    result: typebox_1.Type.Optional(typebox_1.Type.Object({ schema: typebox_1.Type.String({ minLength: 1 }) }, {
+        additionalProperties: false,
+    })),
+    maxDeliver: typebox_1.Type.Number(),
+    backoffMs: typebox_1.Type.Array(typebox_1.Type.Number()),
+    ackWaitMs: typebox_1.Type.Number(),
+    defaultDeadlineMs: typebox_1.Type.Optional(typebox_1.Type.Number()),
+    progress: typebox_1.Type.Boolean(),
+    logs: typebox_1.Type.Boolean(),
+    dlq: typebox_1.Type.Boolean(),
+    concurrency: typebox_1.Type.Number(),
+}, { additionalProperties: false });
+exports.ContractAnalysisStreamResourceSchema = typebox_1.Type.Object({
+    alias: typebox_1.Type.String({ minLength: 1 }),
+    purpose: typebox_1.Type.String({ minLength: 1 }),
+    required: typebox_1.Type.Boolean(),
+    retention: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    storage: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    numReplicas: typebox_1.Type.Optional(typebox_1.Type.Number()),
+    maxAgeMs: typebox_1.Type.Optional(typebox_1.Type.Number()),
+    maxBytes: typebox_1.Type.Optional(typebox_1.Type.Number()),
+    maxMsgs: typebox_1.Type.Optional(typebox_1.Type.Number()),
+    discard: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    subjects: typebox_1.Type.Array(typebox_1.Type.String({ minLength: 1 }), { minItems: 1 }),
+    sources: typebox_1.Type.Optional(typebox_1.Type.Array(typebox_1.Type.Object({
+        fromAlias: typebox_1.Type.String({ minLength: 1 }),
+        streamName: typebox_1.Type.String({ minLength: 1 }),
+        filterSubject: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+        subjectTransformDest: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }))),
+}, { additionalProperties: false });
+exports.ContractAnalysisRpcMethodSchema = typebox_1.Type.Object({
+    key: typebox_1.Type.String(),
+    subject: typebox_1.Type.String(),
+    wildcardSubject: typebox_1.Type.String(),
+    callerCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.ContractAnalysisEventSchema = typebox_1.Type.Object({
+    key: typebox_1.Type.String(),
+    subject: typebox_1.Type.String(),
+    wildcardSubject: typebox_1.Type.String(),
+    publishCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    subscribeCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.ContractAnalysisSubjectSchema = typebox_1.Type.Object({
+    key: typebox_1.Type.String(),
+    subject: typebox_1.Type.String(),
+    publishCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    subscribeCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.ContractAnalysisNatsRuleSchema = typebox_1.Type.Object({
+    kind: typebox_1.Type.String(),
+    subject: typebox_1.Type.String(),
+    wildcardSubject: typebox_1.Type.String(),
+    requiredCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.ContractAnalysisSchema = typebox_1.Type.Object({
+    namespaces: typebox_1.Type.Array(typebox_1.Type.String()),
+    rpc: typebox_1.Type.Object({ methods: typebox_1.Type.Array(exports.ContractAnalysisRpcMethodSchema) }, {
+        additionalProperties: false,
+    }),
+    events: typebox_1.Type.Object({ events: typebox_1.Type.Array(exports.ContractAnalysisEventSchema) }, {
+        additionalProperties: false,
+    }),
+    subjects: typebox_1.Type.Optional(typebox_1.Type.Object({ subjects: typebox_1.Type.Array(exports.ContractAnalysisSubjectSchema) }, {
+        additionalProperties: false,
+    })),
+    nats: typebox_1.Type.Object({
+        publish: typebox_1.Type.Array(exports.ContractAnalysisNatsRuleSchema),
+        subscribe: typebox_1.Type.Array(exports.ContractAnalysisNatsRuleSchema),
+    }, { additionalProperties: false }),
+    resources: typebox_1.Type.Object({
+        kv: typebox_1.Type.Array(exports.ContractAnalysisKvResourceSchema),
+        jobs: typebox_1.Type.Array(exports.ContractAnalysisJobsQueueSchema),
+        streams: typebox_1.Type.Array(exports.ContractAnalysisStreamResourceSchema),
+    }, { additionalProperties: false }),
+}, { additionalProperties: false });
+exports.InstalledContractSchema = typebox_1.Type.Object({
+    digest: exports.DigestSchema,
+    id: typebox_1.Type.String({ minLength: 1 }),
+    displayName: typebox_1.Type.String({ minLength: 1 }),
+    description: typebox_1.Type.String({ minLength: 1 }),
+    sessionKey: typebox_1.Type.Optional(typebox_1.Type.String()),
+    installedAt: IsoDateStringSchema,
+    analysisSummary: typebox_1.Type.Optional(exports.ContractAnalysisSummarySchema),
+    resourceBindings: typebox_1.Type.Optional(contracts_1.ContractResourceBindingsSchema),
+}, { additionalProperties: false });
+exports.InstalledContractDetailSchema = typebox_1.Type.Object({
+    digest: exports.DigestSchema,
+    id: typebox_1.Type.String({ minLength: 1 }),
+    displayName: typebox_1.Type.String({ minLength: 1 }),
+    description: typebox_1.Type.String({ minLength: 1 }),
+    sessionKey: typebox_1.Type.Optional(typebox_1.Type.String()),
+    installedAt: IsoDateStringSchema,
+    analysisSummary: typebox_1.Type.Optional(exports.ContractAnalysisSummarySchema),
+    analysis: typebox_1.Type.Optional(exports.ContractAnalysisSchema),
+    resources: typebox_1.Type.Optional(contracts_1.ContractResourcesSchema),
+    resourceBindings: typebox_1.Type.Optional(contracts_1.ContractResourceBindingsSchema),
+    contract: exports.OpenObjectSchema,
+}, { additionalProperties: false });
+exports.AuthListInstalledContractsSchema = typebox_1.Type.Object({
+    sessionKey: typebox_1.Type.Optional(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.AuthListInstalledContractsResponseSchema = typebox_1.Type.Object({
+    contracts: typebox_1.Type.Array(exports.InstalledContractSchema),
+}, { additionalProperties: false });
+exports.AuthGetInstalledContractSchema = typebox_1.Type.Object({
+    digest: exports.DigestSchema,
+}, { additionalProperties: false });
+exports.AuthGetInstalledContractResponseSchema = typebox_1.Type.Object({
+    contract: exports.InstalledContractDetailSchema,
+}, { additionalProperties: false });
+exports.AuthenticatedUserSchema = typebox_1.Type.Object({
+    id: typebox_1.Type.String(),
+    origin: typebox_1.Type.String(),
+    active: typebox_1.Type.Boolean(),
+    name: typebox_1.Type.String(),
+    email: typebox_1.Type.String(),
+    image: typebox_1.Type.Optional(typebox_1.Type.String()),
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    lastLogin: typebox_1.Type.Optional(IsoDateStringSchema),
+}, { additionalProperties: false });
+exports.AuthMeSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthValidateRequestSchema = typebox_1.Type.Object({
+    sessionKey: typebox_1.Type.String(),
+    proof: typebox_1.Type.String(),
+    subject: typebox_1.Type.String(),
+    payloadHash: typebox_1.Type.String(),
+    capabilities: typebox_1.Type.Optional(typebox_1.Type.Array(typebox_1.Type.String())),
+}, { additionalProperties: false });
+exports.AuthenticatedServiceSchema = typebox_1.Type.Object({
+    type: typebox_1.Type.Literal("service"),
+    id: typebox_1.Type.String(),
+    name: typebox_1.Type.String(),
+    active: typebox_1.Type.Boolean(),
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.AuthenticatedDeviceSchema = typebox_1.Type.Object({
+    type: typebox_1.Type.Literal("device"),
+    deviceId: typebox_1.Type.String({ minLength: 1 }),
+    deviceType: typebox_1.Type.String({ minLength: 1 }),
+    runtimePublicKey: typebox_1.Type.String({ minLength: 1 }),
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    active: typebox_1.Type.Boolean(),
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.AuthenticatedWorkloadSchema = typebox_1.Type.Object({
+    type: typebox_1.Type.Literal("workload"),
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    active: typebox_1.Type.Boolean(),
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+const NullableAuthenticatedUserSchema = typebox_1.Type.Union([
+    exports.AuthenticatedUserSchema,
+    typebox_1.Type.Null(),
+]);
+const NullableAuthenticatedWorkloadSchema = typebox_1.Type.Union([
+    exports.AuthenticatedWorkloadSchema,
+    typebox_1.Type.Null(),
+]);
+const NullableAuthenticatedServiceSchema = typebox_1.Type.Union([
+    exports.AuthenticatedServiceSchema,
+    typebox_1.Type.Null(),
+]);
+exports.AuthMeResponseSchema = typebox_1.Type.Object({
+    user: NullableAuthenticatedUserSchema,
+    workload: NullableAuthenticatedWorkloadSchema,
+    service: NullableAuthenticatedServiceSchema,
+}, { additionalProperties: false });
+exports.CallerViewSchema = typebox_1.Type.Union([
+    typebox_1.Type.Object({
+        type: typebox_1.Type.Literal("user"),
+        id: typebox_1.Type.String(),
+        origin: typebox_1.Type.String(),
+        active: typebox_1.Type.Boolean(),
+        name: typebox_1.Type.String(),
+        email: typebox_1.Type.String(),
+        image: typebox_1.Type.Optional(typebox_1.Type.String()),
+        capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    }, { additionalProperties: false }),
+    exports.AuthenticatedServiceSchema,
+    exports.AuthenticatedWorkloadSchema,
+]);
+exports.AuthValidateRequestResponseSchema = typebox_1.Type.Object({
+    allowed: typebox_1.Type.Boolean(),
+    inboxPrefix: typebox_1.Type.String(),
+    caller: exports.CallerViewSchema,
+}, { additionalProperties: false });
+exports.AuthListApprovalsSchema = typebox_1.Type.Object({
+    user: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    digest: typebox_1.Type.Optional(exports.DigestSchema),
+}, { additionalProperties: false });
+exports.AuthListApprovalsResponseSchema = typebox_1.Type.Object({
+    approvals: typebox_1.Type.Array(exports.ApprovalRecordViewSchema),
+}, { additionalProperties: false });
+exports.AuthRevokeApprovalSchema = typebox_1.Type.Object({
+    contractDigest: exports.DigestSchema,
+    user: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+}, { additionalProperties: false });
+exports.AuthRevokeApprovalResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.PortalSchema = typebox_1.Type.Object({
+    portalId: typebox_1.Type.String({ minLength: 1 }),
+    appContractId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    entryUrl: typebox_1.Type.String({ minLength: 1 }),
+    disabled: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+const NullablePortalIdSchema = typebox_1.Type.Union([
+    typebox_1.Type.String({ minLength: 1 }),
+    typebox_1.Type.Null(),
+]);
+exports.LoginPortalDefaultSchema = typebox_1.Type.Object({
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.WorkloadPortalDefaultSchema = typebox_1.Type.Object({
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.LoginPortalSelectionSchema = typebox_1.Type.Object({
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.WorkloadPortalSelectionSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.PortalFlowStateSchema = typebox_1.Type.Union([
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("choose_provider"),
+        flowId: typebox_1.Type.String({ minLength: 1 }),
+        providers: typebox_1.Type.Array(typebox_1.Type.Object({
+            id: typebox_1.Type.String({ minLength: 1 }),
+            displayName: typebox_1.Type.String({ minLength: 1 }),
+        }, { additionalProperties: false })),
+        app: typebox_1.Type.Object({
+            contractId: typebox_1.Type.String({ minLength: 1 }),
+            contractDigest: exports.DigestSchema,
+            displayName: typebox_1.Type.String({ minLength: 1 }),
+            description: typebox_1.Type.String({ minLength: 1 }),
+            context: typebox_1.Type.Optional(exports.OpenObjectSchema),
+        }, { additionalProperties: false }),
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("approval_required"),
+        flowId: typebox_1.Type.String({ minLength: 1 }),
+        user: typebox_1.Type.Object({
+            origin: typebox_1.Type.String({ minLength: 1 }),
+            id: typebox_1.Type.String({ minLength: 1 }),
+            name: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+            email: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+            image: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+        }, { additionalProperties: false }),
+        approval: exports.ContractApprovalViewSchema,
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("approval_denied"),
+        flowId: typebox_1.Type.String({ minLength: 1 }),
+        approval: exports.ContractApprovalViewSchema,
+        returnLocation: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("insufficient_capabilities"),
+        flowId: typebox_1.Type.String({ minLength: 1 }),
+        user: typebox_1.Type.Optional(typebox_1.Type.Object({
+            origin: typebox_1.Type.String({ minLength: 1 }),
+            id: typebox_1.Type.String({ minLength: 1 }),
+            name: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+        }, { additionalProperties: false })),
+        approval: exports.ContractApprovalViewSchema,
+        missingCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+        userCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+        returnLocation: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("redirect"),
+        location: typebox_1.Type.String({ minLength: 1 }),
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("expired"),
+    }, { additionalProperties: false }),
+]);
+exports.WorkloadProfileSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    allowedDigests: typebox_1.Type.Array(exports.DigestSchema),
+    reviewMode: typebox_1.Type.Optional(typebox_1.Type.Union([typebox_1.Type.Literal("none"), typebox_1.Type.Literal("required")])),
+    disabled: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.WorkloadSchema = typebox_1.Type.Object({
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    state: typebox_1.Type.Union([
+        typebox_1.Type.Literal("registered"),
+        typebox_1.Type.Literal("activated"),
+        typebox_1.Type.Literal("revoked"),
+        typebox_1.Type.Literal("disabled"),
+    ]),
+    createdAt: IsoDateStringSchema,
+    activatedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
+    revokedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
+}, { additionalProperties: false });
+exports.WorkloadActivationActorSchema = typebox_1.Type.Object({
+    origin: typebox_1.Type.String({ minLength: 1 }),
+    id: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.WorkloadActivationRecordSchema = typebox_1.Type.Object({
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    activatedBy: typebox_1.Type.Optional(exports.WorkloadActivationActorSchema),
+    state: typebox_1.Type.Union([typebox_1.Type.Literal("activated"), typebox_1.Type.Literal("revoked")]),
+    activatedAt: IsoDateStringSchema,
+    revokedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
+}, { additionalProperties: false });
+exports.WorkloadActivationReviewSchema = typebox_1.Type.Object({
+    reviewId: typebox_1.Type.String({ minLength: 1 }),
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    state: typebox_1.Type.Union([
+        typebox_1.Type.Literal("pending"),
+        typebox_1.Type.Literal("approved"),
+        typebox_1.Type.Literal("rejected"),
+    ]),
+    requestedAt: IsoDateStringSchema,
+    decidedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
+    reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+}, { additionalProperties: false });
+exports.AuthWorkloadActivationReviewRequestedEventSchema = typebox_1.Type.Object({
+    reviewId: typebox_1.Type.String({ minLength: 1 }),
+    handoffId: typebox_1.Type.String({ minLength: 1 }),
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    requestedAt: IsoDateStringSchema,
+    requestedBy: typebox_1.Type.Object({
+        origin: typebox_1.Type.String({ minLength: 1 }),
+        id: typebox_1.Type.String({ minLength: 1 }),
+    }, { additionalProperties: false }),
+}, { additionalProperties: false });
+exports.WorkloadConnectInfoSchema = typebox_1.Type.Object({
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    contractDigest: exports.DigestSchema,
+    transport: typebox_1.Type.Object({
+        natsServers: typebox_1.Type.Array(typebox_1.Type.String({ minLength: 1 })),
+        sentinel: typebox_1.Type.Object({
+            jwt: typebox_1.Type.String({ minLength: 1 }),
+            seed: typebox_1.Type.String({ minLength: 1 }),
+        }, { additionalProperties: false }),
+    }, { additionalProperties: false }),
+    auth: typebox_1.Type.Object({
+        mode: typebox_1.Type.Literal("workload_identity"),
+        iatSkewSeconds: typebox_1.Type.Number(),
+    }, { additionalProperties: false }),
+}, { additionalProperties: false });
+exports.AuthCreatePortalSchema = typebox_1.Type.Object({
+    portalId: typebox_1.Type.String({ minLength: 1 }),
+    appContractId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    entryUrl: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthCreatePortalResponseSchema = typebox_1.Type.Object({
+    portal: exports.PortalSchema,
+}, { additionalProperties: false });
+exports.AuthListPortalsSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthListPortalsResponseSchema = typebox_1.Type.Object({
+    portals: typebox_1.Type.Array(exports.PortalSchema),
+}, { additionalProperties: false });
+exports.AuthDisablePortalSchema = typebox_1.Type.Object({
+    portalId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthDisablePortalResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.AuthGetLoginPortalDefaultSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthGetLoginPortalDefaultResponseSchema = typebox_1.Type.Object({
+    defaultPortal: exports.LoginPortalDefaultSchema,
+}, { additionalProperties: false });
+exports.AuthSetLoginPortalDefaultSchema = typebox_1.Type.Object({
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.AuthSetLoginPortalDefaultResponseSchema = typebox_1.Type.Object({
+    defaultPortal: exports.LoginPortalDefaultSchema,
+}, { additionalProperties: false });
+exports.AuthListLoginPortalSelectionsSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthListLoginPortalSelectionsResponseSchema = typebox_1.Type.Object({
+    selections: typebox_1.Type.Array(exports.LoginPortalSelectionSchema),
+}, { additionalProperties: false });
+exports.AuthSetLoginPortalSelectionSchema = typebox_1.Type.Object({
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.AuthSetLoginPortalSelectionResponseSchema = typebox_1.Type.Object({
+    selection: exports.LoginPortalSelectionSchema,
+}, { additionalProperties: false });
+exports.AuthClearLoginPortalSelectionSchema = typebox_1.Type.Object({
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthClearLoginPortalSelectionResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.AuthGetWorkloadPortalDefaultSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthGetWorkloadPortalDefaultResponseSchema = typebox_1.Type.Object({
+    defaultPortal: exports.WorkloadPortalDefaultSchema,
+}, { additionalProperties: false });
+exports.AuthSetWorkloadPortalDefaultSchema = typebox_1.Type.Object({
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.AuthSetWorkloadPortalDefaultResponseSchema = typebox_1.Type.Object({
+    defaultPortal: exports.WorkloadPortalDefaultSchema,
+}, { additionalProperties: false });
+exports.AuthListWorkloadPortalSelectionsSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthListWorkloadPortalSelectionsResponseSchema = typebox_1.Type.Object({
+    selections: typebox_1.Type.Array(exports.WorkloadPortalSelectionSchema),
+}, { additionalProperties: false });
+exports.AuthSetWorkloadPortalSelectionSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    portalId: NullablePortalIdSchema,
+}, { additionalProperties: false });
+exports.AuthSetWorkloadPortalSelectionResponseSchema = typebox_1.Type.Object({
+    selection: exports.WorkloadPortalSelectionSchema,
+}, { additionalProperties: false });
+exports.AuthClearWorkloadPortalSelectionSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthClearWorkloadPortalSelectionResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.AuthCreateWorkloadProfileSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    allowedDigests: typebox_1.Type.Array(exports.DigestSchema),
+    reviewMode: typebox_1.Type.Optional(typebox_1.Type.Union([typebox_1.Type.Literal("none"), typebox_1.Type.Literal("required")])),
+    contract: typebox_1.Type.Optional(typebox_1.Type.Object({}, { additionalProperties: true })),
+}, { additionalProperties: false });
+exports.AuthCreateWorkloadProfileResponseSchema = typebox_1.Type.Object({
+    profile: exports.WorkloadProfileSchema,
+}, { additionalProperties: false });
+exports.AuthListWorkloadProfilesSchema = typebox_1.Type.Object({
+    contractId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    disabled: typebox_1.Type.Optional(typebox_1.Type.Boolean()),
+}, { additionalProperties: false });
+exports.AuthListWorkloadProfilesResponseSchema = typebox_1.Type.Object({
+    profiles: typebox_1.Type.Array(exports.WorkloadProfileSchema),
+}, { additionalProperties: false });
+exports.AuthDisableWorkloadProfileSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthDisableWorkloadProfileResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.AuthProvisionWorkloadInstanceSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.String({ minLength: 1 }),
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    activationKey: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthProvisionWorkloadInstanceResponseSchema = typebox_1.Type.Object({
+    instance: exports.WorkloadSchema,
+}, { additionalProperties: false });
+exports.AuthListWorkloadInstancesSchema = typebox_1.Type.Object({
+    profileId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    state: typebox_1.Type.Optional(typebox_1.Type.Union([
+        typebox_1.Type.Literal("registered"),
+        typebox_1.Type.Literal("activated"),
+        typebox_1.Type.Literal("revoked"),
+        typebox_1.Type.Literal("disabled"),
+    ])),
+}, { additionalProperties: false });
+exports.AuthListWorkloadInstancesResponseSchema = typebox_1.Type.Object({
+    instances: typebox_1.Type.Array(exports.WorkloadSchema),
+}, { additionalProperties: false });
+exports.AuthDisableWorkloadInstanceSchema = typebox_1.Type.Object({
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthDisableWorkloadInstanceResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.AuthActivateWorkloadSchema = typebox_1.Type.Object({
+    handoffId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthActivateWorkloadResponseSchema = typebox_1.Type.Union([
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("activated"),
+        instanceId: typebox_1.Type.String({ minLength: 1 }),
+        profileId: typebox_1.Type.String({ minLength: 1 }),
+        activatedAt: IsoDateStringSchema,
+        confirmationCode: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("pending_review"),
+        reviewId: typebox_1.Type.String({ minLength: 1 }),
+        instanceId: typebox_1.Type.String({ minLength: 1 }),
+        profileId: typebox_1.Type.String({ minLength: 1 }),
+        requestedAt: IsoDateStringSchema,
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("rejected"),
+        reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+]);
+exports.AuthGetWorkloadActivationStatusSchema = typebox_1.Type.Object({
+    handoffId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthGetWorkloadActivationStatusResponseSchema = exports.AuthActivateWorkloadResponseSchema;
+exports.WaitForWorkloadActivationResponseSchema = typebox_1.Type.Union([
+    typebox_1.Type.Object({ status: typebox_1.Type.Literal("pending") }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("activated"),
+        activatedAt: IsoDateStringSchema,
+        confirmationCode: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+        connectInfo: exports.WorkloadConnectInfoSchema,
+    }, { additionalProperties: false }),
+    typebox_1.Type.Object({
+        status: typebox_1.Type.Literal("rejected"),
+        reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    }, { additionalProperties: false }),
+]);
+exports.AuthGetWorkloadConnectInfoSchema = typebox_1.Type.Object({
+    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
+    contractDigest: exports.DigestSchema,
+    iat: typebox_1.Type.Number(),
+    sig: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthGetWorkloadConnectInfoResponseSchema = typebox_1.Type.Object({
+    status: typebox_1.Type.Literal("ready"),
+    connectInfo: exports.WorkloadConnectInfoSchema,
+}, { additionalProperties: false });
+exports.AuthListWorkloadActivationsSchema = typebox_1.Type.Object({
+    instanceId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    profileId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    state: typebox_1.Type.Optional(typebox_1.Type.Union([typebox_1.Type.Literal("activated"), typebox_1.Type.Literal("revoked")])),
+}, { additionalProperties: false });
+exports.AuthListWorkloadActivationsResponseSchema = typebox_1.Type.Object({
+    activations: typebox_1.Type.Array(exports.WorkloadActivationRecordSchema),
+}, { additionalProperties: false });
+exports.AuthRevokeWorkloadActivationSchema = typebox_1.Type.Object({
+    instanceId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthRevokeWorkloadActivationResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });
+exports.AuthListWorkloadActivationReviewsSchema = typebox_1.Type.Object({
+    instanceId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    profileId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+    state: typebox_1.Type.Optional(typebox_1.Type.Union([
+        typebox_1.Type.Literal("pending"),
+        typebox_1.Type.Literal("approved"),
+        typebox_1.Type.Literal("rejected"),
+    ])),
+}, { additionalProperties: false });
+exports.AuthListWorkloadActivationReviewsResponseSchema = typebox_1.Type.Object({
+    reviews: typebox_1.Type.Array(exports.WorkloadActivationReviewSchema),
+}, { additionalProperties: false });
+exports.AuthDecideWorkloadActivationReviewSchema = typebox_1.Type.Object({
+    reviewId: typebox_1.Type.String({ minLength: 1 }),
+    decision: typebox_1.Type.Union([typebox_1.Type.Literal("approve"), typebox_1.Type.Literal("reject")]),
+    reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+}, { additionalProperties: false });
+exports.AuthDecideWorkloadActivationReviewResponseSchema = typebox_1.Type.Object({
+    review: exports.WorkloadActivationReviewSchema,
+    activation: typebox_1.Type.Optional(exports.WorkloadActivationRecordSchema),
+    confirmationCode: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
+}, { additionalProperties: false });
+exports.UserViewSchema = typebox_1.Type.Object({
+    origin: typebox_1.Type.String(),
+    id: typebox_1.Type.String(),
+    name: typebox_1.Type.Optional(typebox_1.Type.String()),
+    email: typebox_1.Type.Optional(typebox_1.Type.String()),
+    active: typebox_1.Type.Boolean(),
+    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.AuthListUsersSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
+exports.AuthListUsersResponseSchema = typebox_1.Type.Object({
+    users: typebox_1.Type.Array(exports.UserViewSchema),
+}, { additionalProperties: false });
+exports.AuthUpdateUserSchema = typebox_1.Type.Object({
+    origin: typebox_1.Type.String(),
+    id: typebox_1.Type.String(),
+    active: typebox_1.Type.Optional(typebox_1.Type.Boolean()),
+    capabilities: typebox_1.Type.Optional(typebox_1.Type.Array(typebox_1.Type.String())),
+}, { additionalProperties: false });
+exports.AuthUpdateUserResponseSchema = typebox_1.Type.Object({
+    success: typebox_1.Type.Boolean(),
+}, { additionalProperties: false });