@qlever-llc/trellis 0.6.0 → 0.7.0-rc.2

package/script/auth/protocol.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WorkloadActivationRecordSchema = exports.WorkloadActivationActorSchema = exports.WorkloadSchema = exports.WorkloadProfileSchema = exports.PortalFlowStateSchema = exports.WorkloadPortalSelectionSchema = exports.LoginPortalSelectionSchema = exports.WorkloadPortalDefaultSchema = exports.LoginPortalDefaultSchema = exports.PortalSchema = exports.AuthRevokeApprovalResponseSchema = exports.AuthRevokeApprovalSchema = exports.AuthListApprovalsResponseSchema = exports.AuthListApprovalsSchema = exports.AuthValidateRequestResponseSchema = exports.CallerViewSchema = exports.AuthMeResponseSchema = exports.AuthenticatedWorkloadSchema = exports.AuthenticatedDeviceSchema = exports.AuthenticatedServiceSchema = exports.AuthValidateRequestSchema = exports.AuthMeSchema = exports.AuthenticatedUserSchema = exports.AuthGetInstalledContractResponseSchema = exports.AuthGetInstalledContractSchema = exports.AuthListInstalledContractsResponseSchema = exports.AuthListInstalledContractsSchema = exports.InstalledContractDetailSchema = exports.InstalledContractSchema = exports.ContractAnalysisSchema = exports.ContractAnalysisNatsRuleSchema = exports.ContractAnalysisSubjectSchema = exports.ContractAnalysisEventSchema = exports.ContractAnalysisRpcMethodSchema = exports.ContractAnalysisStreamResourceSchema = exports.ContractAnalysisJobsQueueSchema = exports.ContractAnalysisKvResourceSchema = exports.ContractAnalysisSummarySchema = exports.AuthUpgradeServiceContractResponseSchema = exports.AuthUpgradeServiceContractSchema = exports.AuthInstallServiceResponseSchema = exports.AuthInstallServiceSchema = exports.AuthListServicesResponseSchema = exports.AuthListServicesSchema = exports.ApprovalRecordViewSchema = exports.ContractApprovalViewSchema = exports.ApprovalDecisionSchema = exports.ServiceViewSchema = exports.OpenObjectSchema = exports.DigestSchema = void 0;
-exports.AuthListWorkloadActivationsResponseSchema = exports.AuthListWorkloadActivationsSchema = exports.AuthGetWorkloadConnectInfoResponseSchema = exports.AuthGetWorkloadConnectInfoSchema = exports.WaitForWorkloadActivationResponseSchema = exports.AuthGetWorkloadActivationStatusResponseSchema = exports.AuthGetWorkloadActivationStatusSchema = exports.AuthActivateWorkloadResponseSchema = exports.AuthActivateWorkloadSchema = exports.AuthDisableWorkloadInstanceResponseSchema = exports.AuthDisableWorkloadInstanceSchema = exports.AuthListWorkloadInstancesResponseSchema = exports.AuthListWorkloadInstancesSchema = exports.AuthProvisionWorkloadInstanceResponseSchema = exports.AuthProvisionWorkloadInstanceSchema = exports.AuthDisableWorkloadProfileResponseSchema = exports.AuthDisableWorkloadProfileSchema = exports.AuthListWorkloadProfilesResponseSchema = exports.AuthListWorkloadProfilesSchema = exports.AuthCreateWorkloadProfileResponseSchema = exports.AuthCreateWorkloadProfileSchema = exports.AuthClearWorkloadPortalSelectionResponseSchema = exports.AuthClearWorkloadPortalSelectionSchema = exports.AuthSetWorkloadPortalSelectionResponseSchema = exports.AuthSetWorkloadPortalSelectionSchema = exports.AuthListWorkloadPortalSelectionsResponseSchema = exports.AuthListWorkloadPortalSelectionsSchema = exports.AuthSetWorkloadPortalDefaultResponseSchema = exports.AuthSetWorkloadPortalDefaultSchema = exports.AuthGetWorkloadPortalDefaultResponseSchema = exports.AuthGetWorkloadPortalDefaultSchema = exports.AuthClearLoginPortalSelectionResponseSchema = exports.AuthClearLoginPortalSelectionSchema = exports.AuthSetLoginPortalSelectionResponseSchema = exports.AuthSetLoginPortalSelectionSchema = exports.AuthListLoginPortalSelectionsResponseSchema = exports.AuthListLoginPortalSelectionsSchema = exports.AuthSetLoginPortalDefaultResponseSchema = exports.AuthSetLoginPortalDefaultSchema = exports.AuthGetLoginPortalDefaultResponseSchema = exports.AuthGetLoginPortalDefaultSchema = exports.AuthDisablePortalResponseSchema = exports.AuthDisablePortalSchema = exports.AuthListPortalsResponseSchema = exports.AuthListPortalsSchema = exports.AuthCreatePortalResponseSchema = exports.AuthCreatePortalSchema = exports.WorkloadConnectInfoSchema = exports.AuthWorkloadActivationReviewRequestedEventSchema = exports.WorkloadActivationReviewSchema = void 0;
-exports.AuthUpdateUserResponseSchema = exports.AuthUpdateUserSchema = exports.AuthListUsersResponseSchema = exports.AuthListUsersSchema = exports.UserViewSchema = exports.AuthDecideWorkloadActivationReviewResponseSchema = exports.AuthDecideWorkloadActivationReviewSchema = exports.AuthListWorkloadActivationReviewsResponseSchema = exports.AuthListWorkloadActivationReviewsSchema = exports.AuthRevokeWorkloadActivationResponseSchema = exports.AuthRevokeWorkloadActivationSchema = void 0;
+exports.DevicePortalDefaultSchema = exports.LoginPortalDefaultSchema = exports.PortalSchema = exports.AuthRevokeApprovalResponseSchema = exports.AuthRevokeApprovalSchema = exports.AuthListApprovalsResponseSchema = exports.AuthListApprovalsSchema = exports.AuthValidateRequestResponseSchema = exports.CallerViewSchema = exports.AuthMeResponseSchema = exports.AuthenticatedDeviceSchema = exports.AuthenticatedServiceSchema = exports.AuthValidateRequestSchema = exports.AuthMeSchema = exports.AuthenticatedUserSchema = exports.AuthGetInstalledContractResponseSchema = exports.AuthGetInstalledContractSchema = exports.AuthListInstalledContractsResponseSchema = exports.AuthListInstalledContractsSchema = exports.InstalledContractDetailSchema = exports.InstalledContractSchema = exports.ContractAnalysisSchema = exports.ContractAnalysisNatsRuleSchema = exports.ContractAnalysisSubjectSchema = exports.ContractAnalysisEventSchema = exports.ContractAnalysisRpcMethodSchema = exports.ContractAnalysisStreamResourceSchema = exports.ContractAnalysisJobsQueueSchema = exports.ContractAnalysisKvResourceSchema = exports.ContractAnalysisSummarySchema = exports.AuthUpgradeServiceContractResponseSchema = exports.AuthUpgradeServiceContractSchema = exports.AuthInstallServiceResponseSchema = exports.AuthInstallServiceSchema = exports.AuthListServicesResponseSchema = exports.AuthListServicesSchema = exports.AuthDisableInstanceGrantPolicyResponseSchema = exports.AuthDisableInstanceGrantPolicySchema = exports.AuthUpsertInstanceGrantPolicyResponseSchema = exports.AuthUpsertInstanceGrantPolicySchema = exports.AuthListInstanceGrantPoliciesResponseSchema = exports.AuthListInstanceGrantPoliciesSchema = exports.InstanceGrantPolicySchema = exports.InstanceGrantPolicyActorSchema = exports.ApprovalRecordViewSchema = exports.ContractApprovalViewSchema = exports.ApprovalDecisionSchema = exports.ServiceViewSchema = exports.OpenObjectSchema = exports.DigestSchema = void 0;
+exports.AuthActivateDeviceSchema = exports.AuthDisableDeviceInstanceResponseSchema = exports.AuthDisableDeviceInstanceSchema = exports.AuthListDeviceInstancesResponseSchema = exports.AuthListDeviceInstancesSchema = exports.AuthProvisionDeviceInstanceResponseSchema = exports.AuthProvisionDeviceInstanceSchema = exports.AuthDisableDeviceProfileResponseSchema = exports.AuthDisableDeviceProfileSchema = exports.AuthListDeviceProfilesResponseSchema = exports.AuthListDeviceProfilesSchema = exports.AuthCreateDeviceProfileResponseSchema = exports.AuthCreateDeviceProfileSchema = exports.AuthClearDevicePortalSelectionResponseSchema = exports.AuthClearDevicePortalSelectionSchema = exports.AuthSetDevicePortalSelectionResponseSchema = exports.AuthSetDevicePortalSelectionSchema = exports.AuthListDevicePortalSelectionsResponseSchema = exports.AuthListDevicePortalSelectionsSchema = exports.AuthSetDevicePortalDefaultResponseSchema = exports.AuthSetDevicePortalDefaultSchema = exports.AuthGetDevicePortalDefaultResponseSchema = exports.AuthGetDevicePortalDefaultSchema = exports.AuthClearLoginPortalSelectionResponseSchema = exports.AuthClearLoginPortalSelectionSchema = exports.AuthSetLoginPortalSelectionResponseSchema = exports.AuthSetLoginPortalSelectionSchema = exports.AuthListLoginPortalSelectionsResponseSchema = exports.AuthListLoginPortalSelectionsSchema = exports.AuthSetLoginPortalDefaultResponseSchema = exports.AuthSetLoginPortalDefaultSchema = exports.AuthGetLoginPortalDefaultResponseSchema = exports.AuthGetLoginPortalDefaultSchema = exports.AuthDisablePortalResponseSchema = exports.AuthDisablePortalSchema = exports.AuthListPortalsResponseSchema = exports.AuthListPortalsSchema = exports.AuthCreatePortalResponseSchema = exports.AuthCreatePortalSchema = exports.DeviceConnectInfoSchema = exports.AuthDeviceActivationReviewRequestedEventSchema = exports.DeviceActivationReviewSchema = exports.DeviceActivationRecordSchema = exports.DeviceActivationActorSchema = exports.DeviceSchema = exports.DeviceMetadataSchema = exports.DeviceProfileSchema = exports.PortalFlowStateSchema = exports.DevicePortalSelectionSchema = exports.LoginPortalSelectionSchema = void 0;
+exports.AuthUpdateUserResponseSchema = exports.AuthUpdateUserSchema = exports.AuthListUsersResponseSchema = exports.AuthListUsersSchema = exports.UserViewSchema = exports.AuthDecideDeviceActivationReviewResponseSchema = exports.AuthDecideDeviceActivationReviewSchema = exports.AuthListDeviceActivationReviewsResponseSchema = exports.AuthListDeviceActivationReviewsSchema = exports.AuthRevokeDeviceActivationResponseSchema = exports.AuthRevokeDeviceActivationSchema = exports.AuthListDeviceActivationsResponseSchema = exports.AuthListDeviceActivationsSchema = exports.AuthGetDeviceConnectInfoResponseSchema = exports.AuthGetDeviceConnectInfoSchema = exports.WaitForDeviceActivationResponseSchema = exports.AuthGetDeviceActivationStatusResponseSchema = exports.AuthGetDeviceActivationStatusSchema = exports.AuthActivateDeviceResponseSchema = void 0;
 const contracts_1 = require("@qlever-llc/trellis/contracts");
 const typebox_1 = require("typebox");
 const IsoDateStringSchema = typebox_1.Type.String({ format: "date-time" });
@@ -40,6 +40,43 @@ exports.ApprovalRecordViewSchema = typebox_1.Type.Object({
     updatedAt: IsoDateStringSchema,
     approval: exports.ContractApprovalViewSchema,
 }, { additionalProperties: false });
+exports.InstanceGrantPolicyActorSchema = typebox_1.Type.Object({
+    origin: typebox_1.Type.String({ minLength: 1 }),
+    id: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.InstanceGrantPolicySchema = typebox_1.Type.Object({
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    allowedOrigins: typebox_1.Type.Optional(typebox_1.Type.Array(typebox_1.Type.String({ minLength: 1 }))),
+    impliedCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+    disabled: typebox_1.Type.Boolean(),
+    createdAt: IsoDateStringSchema,
+    updatedAt: IsoDateStringSchema,
+    source: typebox_1.Type.Object({
+        kind: typebox_1.Type.Literal("admin_policy"),
+        createdBy: typebox_1.Type.Optional(exports.InstanceGrantPolicyActorSchema),
+        updatedBy: typebox_1.Type.Optional(exports.InstanceGrantPolicyActorSchema),
+    }, { additionalProperties: false }),
+}, { additionalProperties: false });
+exports.AuthListInstanceGrantPoliciesSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
+exports.AuthListInstanceGrantPoliciesResponseSchema = typebox_1.Type.Object({
+    policies: typebox_1.Type.Array(exports.InstanceGrantPolicySchema),
+}, { additionalProperties: false });
+exports.AuthUpsertInstanceGrantPolicySchema = typebox_1.Type.Object({
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+    allowedOrigins: typebox_1.Type.Optional(typebox_1.Type.Array(typebox_1.Type.String({ minLength: 1 }))),
+    impliedCapabilities: typebox_1.Type.Array(typebox_1.Type.String()),
+}, { additionalProperties: false });
+exports.AuthUpsertInstanceGrantPolicyResponseSchema = typebox_1.Type.Object({
+    policy: exports.InstanceGrantPolicySchema,
+}, { additionalProperties: false });
+exports.AuthDisableInstanceGrantPolicySchema = typebox_1.Type.Object({
+    contractId: typebox_1.Type.String({ minLength: 1 }),
+}, { additionalProperties: false });
+exports.AuthDisableInstanceGrantPolicyResponseSchema = typebox_1.Type.Object({
+    policy: exports.InstanceGrantPolicySchema,
+}, { additionalProperties: false });
 exports.AuthListServicesSchema = typebox_1.Type.Object({}, {
     additionalProperties: false,
 });
@@ -241,20 +278,12 @@ exports.AuthenticatedDeviceSchema = typebox_1.Type.Object({
     active: typebox_1.Type.Boolean(),
     capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
 }, { additionalProperties: false });
-exports.AuthenticatedWorkloadSchema = typebox_1.Type.Object({
-    type: typebox_1.Type.Literal("workload"),
-    instanceId: typebox_1.Type.String({ minLength: 1 }),
-    publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
-    profileId: typebox_1.Type.String({ minLength: 1 }),
-    active: typebox_1.Type.Boolean(),
-    capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
-}, { additionalProperties: false });
 const NullableAuthenticatedUserSchema = typebox_1.Type.Union([
     exports.AuthenticatedUserSchema,
     typebox_1.Type.Null(),
 ]);
-const NullableAuthenticatedWorkloadSchema = typebox_1.Type.Union([
-    exports.AuthenticatedWorkloadSchema,
+const NullableAuthenticatedDeviceSchema = typebox_1.Type.Union([
+    exports.AuthenticatedDeviceSchema,
     typebox_1.Type.Null(),
 ]);
 const NullableAuthenticatedServiceSchema = typebox_1.Type.Union([
@@ -263,7 +292,7 @@ const NullableAuthenticatedServiceSchema = typebox_1.Type.Union([
 ]);
 exports.AuthMeResponseSchema = typebox_1.Type.Object({
     user: NullableAuthenticatedUserSchema,
-    workload: NullableAuthenticatedWorkloadSchema,
+    device: NullableAuthenticatedDeviceSchema,
     service: NullableAuthenticatedServiceSchema,
 }, { additionalProperties: false });
 exports.CallerViewSchema = typebox_1.Type.Union([
@@ -278,7 +307,7 @@ exports.CallerViewSchema = typebox_1.Type.Union([
         capabilities: typebox_1.Type.Array(typebox_1.Type.String()),
     }, { additionalProperties: false }),
     exports.AuthenticatedServiceSchema,
-    exports.AuthenticatedWorkloadSchema,
+    exports.AuthenticatedDeviceSchema,
 ]);
 exports.AuthValidateRequestResponseSchema = typebox_1.Type.Object({
     allowed: typebox_1.Type.Boolean(),
@@ -312,14 +341,14 @@ const NullablePortalIdSchema = typebox_1.Type.Union([
 exports.LoginPortalDefaultSchema = typebox_1.Type.Object({
     portalId: NullablePortalIdSchema,
 }, { additionalProperties: false });
-exports.WorkloadPortalDefaultSchema = typebox_1.Type.Object({
+exports.DevicePortalDefaultSchema = typebox_1.Type.Object({
     portalId: NullablePortalIdSchema,
 }, { additionalProperties: false });
 exports.LoginPortalSelectionSchema = typebox_1.Type.Object({
     contractId: typebox_1.Type.String({ minLength: 1 }),
     portalId: NullablePortalIdSchema,
 }, { additionalProperties: false });
-exports.WorkloadPortalSelectionSchema = typebox_1.Type.Object({
+exports.DevicePortalSelectionSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.String({ minLength: 1 }),
     portalId: NullablePortalIdSchema,
 }, { additionalProperties: false });
@@ -378,17 +407,19 @@ exports.PortalFlowStateSchema = typebox_1.Type.Union([
         status: typebox_1.Type.Literal("expired"),
     }, { additionalProperties: false }),
 ]);
-exports.WorkloadProfileSchema = typebox_1.Type.Object({
+exports.DeviceProfileSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.String({ minLength: 1 }),
     contractId: typebox_1.Type.String({ minLength: 1 }),
     allowedDigests: typebox_1.Type.Array(exports.DigestSchema),
     reviewMode: typebox_1.Type.Optional(typebox_1.Type.Union([typebox_1.Type.Literal("none"), typebox_1.Type.Literal("required")])),
     disabled: typebox_1.Type.Boolean(),
 }, { additionalProperties: false });
-exports.WorkloadSchema = typebox_1.Type.Object({
+exports.DeviceMetadataSchema = typebox_1.Type.Record(typebox_1.Type.String({ minLength: 1 }), typebox_1.Type.String({ minLength: 1 }));
+exports.DeviceSchema = typebox_1.Type.Object({
     instanceId: typebox_1.Type.String({ minLength: 1 }),
     publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
     profileId: typebox_1.Type.String({ minLength: 1 }),
+    metadata: typebox_1.Type.Optional(exports.DeviceMetadataSchema),
     state: typebox_1.Type.Union([
         typebox_1.Type.Literal("registered"),
         typebox_1.Type.Literal("activated"),
@@ -399,21 +430,22 @@ exports.WorkloadSchema = typebox_1.Type.Object({
     activatedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
     revokedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
 }, { additionalProperties: false });
-exports.WorkloadActivationActorSchema = typebox_1.Type.Object({
+exports.DeviceActivationActorSchema = typebox_1.Type.Object({
     origin: typebox_1.Type.String({ minLength: 1 }),
     id: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.WorkloadActivationRecordSchema = typebox_1.Type.Object({
+exports.DeviceActivationRecordSchema = typebox_1.Type.Object({
     instanceId: typebox_1.Type.String({ minLength: 1 }),
     publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
     profileId: typebox_1.Type.String({ minLength: 1 }),
-    activatedBy: typebox_1.Type.Optional(exports.WorkloadActivationActorSchema),
+    activatedBy: typebox_1.Type.Optional(exports.DeviceActivationActorSchema),
     state: typebox_1.Type.Union([typebox_1.Type.Literal("activated"), typebox_1.Type.Literal("revoked")]),
     activatedAt: IsoDateStringSchema,
     revokedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
 }, { additionalProperties: false });
-exports.WorkloadActivationReviewSchema = typebox_1.Type.Object({
+exports.DeviceActivationReviewSchema = typebox_1.Type.Object({
     reviewId: typebox_1.Type.String({ minLength: 1 }),
+    linkRequestId: typebox_1.Type.String({ minLength: 1 }),
     instanceId: typebox_1.Type.String({ minLength: 1 }),
     publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
     profileId: typebox_1.Type.String({ minLength: 1 }),
@@ -426,8 +458,9 @@ exports.WorkloadActivationReviewSchema = typebox_1.Type.Object({
     decidedAt: typebox_1.Type.Union([IsoDateStringSchema, typebox_1.Type.Null()]),
     reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
 }, { additionalProperties: false });
-exports.AuthWorkloadActivationReviewRequestedEventSchema = typebox_1.Type.Object({
+exports.AuthDeviceActivationReviewRequestedEventSchema = typebox_1.Type.Object({
     reviewId: typebox_1.Type.String({ minLength: 1 }),
+    linkRequestId: typebox_1.Type.String({ minLength: 1 }),
     handoffId: typebox_1.Type.String({ minLength: 1 }),
     instanceId: typebox_1.Type.String({ minLength: 1 }),
     publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
@@ -438,7 +471,7 @@ exports.AuthWorkloadActivationReviewRequestedEventSchema = typebox_1.Type.Object
         id: typebox_1.Type.String({ minLength: 1 }),
     }, { additionalProperties: false }),
 }, { additionalProperties: false });
-exports.WorkloadConnectInfoSchema = typebox_1.Type.Object({
+exports.DeviceConnectInfoSchema = typebox_1.Type.Object({
     instanceId: typebox_1.Type.String({ minLength: 1 }),
     profileId: typebox_1.Type.String({ minLength: 1 }),
     contractId: typebox_1.Type.String({ minLength: 1 }),
@@ -451,7 +484,7 @@ exports.WorkloadConnectInfoSchema = typebox_1.Type.Object({
         }, { additionalProperties: false }),
     }, { additionalProperties: false }),
     auth: typebox_1.Type.Object({
-        mode: typebox_1.Type.Literal("workload_identity"),
+        mode: typebox_1.Type.Literal("device_identity"),
         iatSkewSeconds: typebox_1.Type.Number(),
     }, { additionalProperties: false }),
 }, { additionalProperties: false });
@@ -463,7 +496,9 @@ exports.AuthCreatePortalSchema = typebox_1.Type.Object({
 exports.AuthCreatePortalResponseSchema = typebox_1.Type.Object({
     portal: exports.PortalSchema,
 }, { additionalProperties: false });
-exports.AuthListPortalsSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthListPortalsSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
 exports.AuthListPortalsResponseSchema = typebox_1.Type.Object({
     portals: typebox_1.Type.Array(exports.PortalSchema),
 }, { additionalProperties: false });
@@ -473,7 +508,9 @@ exports.AuthDisablePortalSchema = typebox_1.Type.Object({
 exports.AuthDisablePortalResponseSchema = typebox_1.Type.Object({
     success: typebox_1.Type.Boolean(),
 }, { additionalProperties: false });
-exports.AuthGetLoginPortalDefaultSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthGetLoginPortalDefaultSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
 exports.AuthGetLoginPortalDefaultResponseSchema = typebox_1.Type.Object({
     defaultPortal: exports.LoginPortalDefaultSchema,
 }, { additionalProperties: false });
@@ -483,7 +520,9 @@ exports.AuthSetLoginPortalDefaultSchema = typebox_1.Type.Object({
 exports.AuthSetLoginPortalDefaultResponseSchema = typebox_1.Type.Object({
     defaultPortal: exports.LoginPortalDefaultSchema,
 }, { additionalProperties: false });
-exports.AuthListLoginPortalSelectionsSchema = typebox_1.Type.Object({}, { additionalProperties: false });
+exports.AuthListLoginPortalSelectionsSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
 exports.AuthListLoginPortalSelectionsResponseSchema = typebox_1.Type.Object({
     selections: typebox_1.Type.Array(exports.LoginPortalSelectionSchema),
 }, { additionalProperties: false });
@@ -500,65 +539,70 @@ exports.AuthClearLoginPortalSelectionSchema = typebox_1.Type.Object({
 exports.AuthClearLoginPortalSelectionResponseSchema = typebox_1.Type.Object({
     success: typebox_1.Type.Boolean(),
 }, { additionalProperties: false });
-exports.AuthGetWorkloadPortalDefaultSchema = typebox_1.Type.Object({}, { additionalProperties: false });
-exports.AuthGetWorkloadPortalDefaultResponseSchema = typebox_1.Type.Object({
-    defaultPortal: exports.WorkloadPortalDefaultSchema,
+exports.AuthGetDevicePortalDefaultSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
+exports.AuthGetDevicePortalDefaultResponseSchema = typebox_1.Type.Object({
+    defaultPortal: exports.DevicePortalDefaultSchema,
 }, { additionalProperties: false });
-exports.AuthSetWorkloadPortalDefaultSchema = typebox_1.Type.Object({
+exports.AuthSetDevicePortalDefaultSchema = typebox_1.Type.Object({
     portalId: NullablePortalIdSchema,
 }, { additionalProperties: false });
-exports.AuthSetWorkloadPortalDefaultResponseSchema = typebox_1.Type.Object({
-    defaultPortal: exports.WorkloadPortalDefaultSchema,
+exports.AuthSetDevicePortalDefaultResponseSchema = typebox_1.Type.Object({
+    defaultPortal: exports.DevicePortalDefaultSchema,
 }, { additionalProperties: false });
-exports.AuthListWorkloadPortalSelectionsSchema = typebox_1.Type.Object({}, { additionalProperties: false });
-exports.AuthListWorkloadPortalSelectionsResponseSchema = typebox_1.Type.Object({
-    selections: typebox_1.Type.Array(exports.WorkloadPortalSelectionSchema),
+exports.AuthListDevicePortalSelectionsSchema = typebox_1.Type.Object({}, {
+    additionalProperties: false,
+});
+exports.AuthListDevicePortalSelectionsResponseSchema = typebox_1.Type.Object({
+    selections: typebox_1.Type.Array(exports.DevicePortalSelectionSchema),
 }, { additionalProperties: false });
-exports.AuthSetWorkloadPortalSelectionSchema = typebox_1.Type.Object({
+exports.AuthSetDevicePortalSelectionSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.String({ minLength: 1 }),
     portalId: NullablePortalIdSchema,
 }, { additionalProperties: false });
-exports.AuthSetWorkloadPortalSelectionResponseSchema = typebox_1.Type.Object({
-    selection: exports.WorkloadPortalSelectionSchema,
+exports.AuthSetDevicePortalSelectionResponseSchema = typebox_1.Type.Object({
+    selection: exports.DevicePortalSelectionSchema,
 }, { additionalProperties: false });
-exports.AuthClearWorkloadPortalSelectionSchema = typebox_1.Type.Object({
+exports.AuthClearDevicePortalSelectionSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.AuthClearWorkloadPortalSelectionResponseSchema = typebox_1.Type.Object({
+exports.AuthClearDevicePortalSelectionResponseSchema = typebox_1.Type.Object({
     success: typebox_1.Type.Boolean(),
 }, { additionalProperties: false });
-exports.AuthCreateWorkloadProfileSchema = typebox_1.Type.Object({
+exports.AuthCreateDeviceProfileSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.String({ minLength: 1 }),
     contractId: typebox_1.Type.String({ minLength: 1 }),
     allowedDigests: typebox_1.Type.Array(exports.DigestSchema),
     reviewMode: typebox_1.Type.Optional(typebox_1.Type.Union([typebox_1.Type.Literal("none"), typebox_1.Type.Literal("required")])),
     contract: typebox_1.Type.Optional(typebox_1.Type.Object({}, { additionalProperties: true })),
 }, { additionalProperties: false });
-exports.AuthCreateWorkloadProfileResponseSchema = typebox_1.Type.Object({
-    profile: exports.WorkloadProfileSchema,
+exports.AuthCreateDeviceProfileResponseSchema = typebox_1.Type.Object({
+    profile: exports.DeviceProfileSchema,
 }, { additionalProperties: false });
-exports.AuthListWorkloadProfilesSchema = typebox_1.Type.Object({
+exports.AuthListDeviceProfilesSchema = typebox_1.Type.Object({
     contractId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     disabled: typebox_1.Type.Optional(typebox_1.Type.Boolean()),
 }, { additionalProperties: false });
-exports.AuthListWorkloadProfilesResponseSchema = typebox_1.Type.Object({
-    profiles: typebox_1.Type.Array(exports.WorkloadProfileSchema),
+exports.AuthListDeviceProfilesResponseSchema = typebox_1.Type.Object({
+    profiles: typebox_1.Type.Array(exports.DeviceProfileSchema),
 }, { additionalProperties: false });
-exports.AuthDisableWorkloadProfileSchema = typebox_1.Type.Object({
+exports.AuthDisableDeviceProfileSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.AuthDisableWorkloadProfileResponseSchema = typebox_1.Type.Object({
+exports.AuthDisableDeviceProfileResponseSchema = typebox_1.Type.Object({
     success: typebox_1.Type.Boolean(),
 }, { additionalProperties: false });
-exports.AuthProvisionWorkloadInstanceSchema = typebox_1.Type.Object({
+exports.AuthProvisionDeviceInstanceSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.String({ minLength: 1 }),
     publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
     activationKey: typebox_1.Type.String({ minLength: 1 }),
+    metadata: typebox_1.Type.Optional(exports.DeviceMetadataSchema),
 }, { additionalProperties: false });
-exports.AuthProvisionWorkloadInstanceResponseSchema = typebox_1.Type.Object({
-    instance: exports.WorkloadSchema,
+exports.AuthProvisionDeviceInstanceResponseSchema = typebox_1.Type.Object({
+    instance: exports.DeviceSchema,
 }, { additionalProperties: false });
-exports.AuthListWorkloadInstancesSchema = typebox_1.Type.Object({
+exports.AuthListDeviceInstancesSchema = typebox_1.Type.Object({
     profileId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     state: typebox_1.Type.Optional(typebox_1.Type.Union([
         typebox_1.Type.Literal("registered"),
@@ -567,19 +611,20 @@ exports.AuthListWorkloadInstancesSchema = typebox_1.Type.Object({
         typebox_1.Type.Literal("disabled"),
     ])),
 }, { additionalProperties: false });
-exports.AuthListWorkloadInstancesResponseSchema = typebox_1.Type.Object({
-    instances: typebox_1.Type.Array(exports.WorkloadSchema),
+exports.AuthListDeviceInstancesResponseSchema = typebox_1.Type.Object({
+    instances: typebox_1.Type.Array(exports.DeviceSchema),
 }, { additionalProperties: false });
-exports.AuthDisableWorkloadInstanceSchema = typebox_1.Type.Object({
+exports.AuthDisableDeviceInstanceSchema = typebox_1.Type.Object({
     instanceId: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.AuthDisableWorkloadInstanceResponseSchema = typebox_1.Type.Object({
+exports.AuthDisableDeviceInstanceResponseSchema = typebox_1.Type.Object({
     success: typebox_1.Type.Boolean(),
 }, { additionalProperties: false });
-exports.AuthActivateWorkloadSchema = typebox_1.Type.Object({
+exports.AuthActivateDeviceSchema = typebox_1.Type.Object({
     handoffId: typebox_1.Type.String({ minLength: 1 }),
+    linkRequestId: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.AuthActivateWorkloadResponseSchema = typebox_1.Type.Union([
+exports.AuthActivateDeviceResponseSchema = typebox_1.Type.Union([
     typebox_1.Type.Object({
         status: typebox_1.Type.Literal("activated"),
         instanceId: typebox_1.Type.String({ minLength: 1 }),
@@ -590,6 +635,7 @@ exports.AuthActivateWorkloadResponseSchema = typebox_1.Type.Union([
     typebox_1.Type.Object({
         status: typebox_1.Type.Literal("pending_review"),
         reviewId: typebox_1.Type.String({ minLength: 1 }),
+        linkRequestId: typebox_1.Type.String({ minLength: 1 }),
         instanceId: typebox_1.Type.String({ minLength: 1 }),
         profileId: typebox_1.Type.String({ minLength: 1 }),
         requestedAt: IsoDateStringSchema,
@@ -599,48 +645,50 @@ exports.AuthActivateWorkloadResponseSchema = typebox_1.Type.Union([
         reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     }, { additionalProperties: false }),
 ]);
-exports.AuthGetWorkloadActivationStatusSchema = typebox_1.Type.Object({
+exports.AuthGetDeviceActivationStatusSchema = typebox_1.Type.Object({
     handoffId: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.AuthGetWorkloadActivationStatusResponseSchema = exports.AuthActivateWorkloadResponseSchema;
-exports.WaitForWorkloadActivationResponseSchema = typebox_1.Type.Union([
-    typebox_1.Type.Object({ status: typebox_1.Type.Literal("pending") }, { additionalProperties: false }),
+exports.AuthGetDeviceActivationStatusResponseSchema = exports.AuthActivateDeviceResponseSchema;
+exports.WaitForDeviceActivationResponseSchema = typebox_1.Type.Union([
+    typebox_1.Type.Object({ status: typebox_1.Type.Literal("pending") }, {
+        additionalProperties: false,
+    }),
     typebox_1.Type.Object({
         status: typebox_1.Type.Literal("activated"),
         activatedAt: IsoDateStringSchema,
         confirmationCode: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
-        connectInfo: exports.WorkloadConnectInfoSchema,
+        connectInfo: exports.DeviceConnectInfoSchema,
     }, { additionalProperties: false }),
     typebox_1.Type.Object({
         status: typebox_1.Type.Literal("rejected"),
         reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     }, { additionalProperties: false }),
 ]);
-exports.AuthGetWorkloadConnectInfoSchema = typebox_1.Type.Object({
+exports.AuthGetDeviceConnectInfoSchema = typebox_1.Type.Object({
     publicIdentityKey: typebox_1.Type.String({ minLength: 1 }),
     contractDigest: exports.DigestSchema,
     iat: typebox_1.Type.Number(),
     sig: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.AuthGetWorkloadConnectInfoResponseSchema = typebox_1.Type.Object({
+exports.AuthGetDeviceConnectInfoResponseSchema = typebox_1.Type.Object({
     status: typebox_1.Type.Literal("ready"),
-    connectInfo: exports.WorkloadConnectInfoSchema,
+    connectInfo: exports.DeviceConnectInfoSchema,
 }, { additionalProperties: false });
-exports.AuthListWorkloadActivationsSchema = typebox_1.Type.Object({
+exports.AuthListDeviceActivationsSchema = typebox_1.Type.Object({
     instanceId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     profileId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     state: typebox_1.Type.Optional(typebox_1.Type.Union([typebox_1.Type.Literal("activated"), typebox_1.Type.Literal("revoked")])),
 }, { additionalProperties: false });
-exports.AuthListWorkloadActivationsResponseSchema = typebox_1.Type.Object({
-    activations: typebox_1.Type.Array(exports.WorkloadActivationRecordSchema),
+exports.AuthListDeviceActivationsResponseSchema = typebox_1.Type.Object({
+    activations: typebox_1.Type.Array(exports.DeviceActivationRecordSchema),
 }, { additionalProperties: false });
-exports.AuthRevokeWorkloadActivationSchema = typebox_1.Type.Object({
+exports.AuthRevokeDeviceActivationSchema = typebox_1.Type.Object({
     instanceId: typebox_1.Type.String({ minLength: 1 }),
 }, { additionalProperties: false });
-exports.AuthRevokeWorkloadActivationResponseSchema = typebox_1.Type.Object({
+exports.AuthRevokeDeviceActivationResponseSchema = typebox_1.Type.Object({
     success: typebox_1.Type.Boolean(),
 }, { additionalProperties: false });
-exports.AuthListWorkloadActivationReviewsSchema = typebox_1.Type.Object({
+exports.AuthListDeviceActivationReviewsSchema = typebox_1.Type.Object({
     instanceId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     profileId: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
     state: typebox_1.Type.Optional(typebox_1.Type.Union([
@@ -649,17 +697,17 @@ exports.AuthListWorkloadActivationReviewsSchema = typebox_1.Type.Object({
         typebox_1.Type.Literal("rejected"),
     ])),
 }, { additionalProperties: false });
-exports.AuthListWorkloadActivationReviewsResponseSchema = typebox_1.Type.Object({
-    reviews: typebox_1.Type.Array(exports.WorkloadActivationReviewSchema),
+exports.AuthListDeviceActivationReviewsResponseSchema = typebox_1.Type.Object({
+    reviews: typebox_1.Type.Array(exports.DeviceActivationReviewSchema),
 }, { additionalProperties: false });
-exports.AuthDecideWorkloadActivationReviewSchema = typebox_1.Type.Object({
+exports.AuthDecideDeviceActivationReviewSchema = typebox_1.Type.Object({
     reviewId: typebox_1.Type.String({ minLength: 1 }),
     decision: typebox_1.Type.Union([typebox_1.Type.Literal("approve"), typebox_1.Type.Literal("reject")]),
     reason: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
 }, { additionalProperties: false });
-exports.AuthDecideWorkloadActivationReviewResponseSchema = typebox_1.Type.Object({
-    review: exports.WorkloadActivationReviewSchema,
-    activation: typebox_1.Type.Optional(exports.WorkloadActivationRecordSchema),
+exports.AuthDecideDeviceActivationReviewResponseSchema = typebox_1.Type.Object({
+    review: exports.DeviceActivationReviewSchema,
+    activation: typebox_1.Type.Optional(exports.DeviceActivationRecordSchema),
     confirmationCode: typebox_1.Type.Optional(typebox_1.Type.String({ minLength: 1 })),
 }, { additionalProperties: false });
 exports.UserViewSchema = typebox_1.Type.Object({

package/script/contracts/mod.d.ts

@@ -1,8 +1,8 @@
 import type { TSchema } from "typebox";
 import { canonicalizeJson, digestJson, isJsonValue, type JsonValue } from "./canonical.ts";
-import { type EventDesc, type InferSchemaType, type OperationDesc, type RPCDesc, type Schema, type SchemaLike, type SubjectDesc, schema, type TrellisAPI, unwrapSchema } from "./runtime.ts";
+import { type EventDesc, type InferSchemaType, type OperationDesc, type RPCDesc, type Schema, schema, type SchemaLike, type SubjectDesc, type TrellisAPI, unwrapSchema } from "./runtime.ts";
 import { type SubjectParam } from "./schema_pointers.ts";
-export { ContractJobQueueResourceSchema, ContractJobsResourceSchema, ContractKvResourceSchema, ContractResourceBindingsSchema, ContractResourcesSchema, ContractSchemaRefSchema, ContractStreamResourceSchema, type EventHeader, EventHeaderSchema, type InstalledServiceContract, InstalledServiceContractSchema, IsoDateSchema, type JobsQueueBinding, JobsQueueBindingSchema, type JobsResourceBinding, JobsResourceBindingSchema, type KvResourceBinding, KvResourceBindingSchema, type Paginated, PaginatedSchema, type StreamResourceBinding, StreamResourceBindingSchema, } from "./protocol.ts";
+export { ContractJobQueueResourceSchema, ContractJobsResourceSchema, ContractKvResourceSchema, ContractResourceBindingsSchema, ContractResourcesSchema, ContractSchemaRefSchema, ContractStoreResourceSchema, ContractStreamResourceSchema, type EventHeader, EventHeaderSchema, type InstalledServiceContract, InstalledServiceContractSchema, IsoDateSchema, type JobsQueueBinding, JobsQueueBindingSchema, type JobsResourceBinding, JobsResourceBindingSchema, type KvResourceBinding, KvResourceBindingSchema, type StoreResourceBinding, StoreResourceBindingSchema, type Paginated, PaginatedSchema, type StreamResourceBinding, StreamResourceBindingSchema, } from "./protocol.ts";
 export declare const CONTRACT_FORMAT_V1: "trellis.contract.v1";
 export declare const CATALOG_FORMAT_V1: "trellis.catalog.v1";
 declare const CONTRACT_MODULE_METADATA: unique symbol;
@@ -16,6 +16,7 @@ export type ContractManifestMetadata = {
     displayName: string;
     description: string;
 };
+export type ContractKind = "service" | "app" | "portal" | "device" | "cli";
 export type Capability = string;
 export type JsonSchema = JsonValue | boolean;
 export type ContractSchemaRef<TSchemaName extends string = string> = {
@@ -92,6 +93,13 @@ export type ContractKvResource = {
     ttlMs?: number;
     maxValueBytes?: number;
 };
+export type ContractStoreResource = {
+    purpose: string;
+    required?: boolean;
+    ttlMs?: number;
+    maxObjectBytes?: number;
+    maxTotalBytes?: number;
+};
 export type ContractStreamResource = {
     purpose: string;
     required?: boolean;
@@ -99,6 +107,7 @@ export type ContractStreamResource = {
 };
 export type ContractResources = {
     kv?: Record<string, ContractKvResource>;
+    store?: Record<string, ContractStoreResource>;
     streams?: Record<string, ContractStreamResource>;
     jobs?: ContractJobsResource;
 };
@@ -122,6 +131,7 @@ export type TrellisContractV1 = {
     id: string;
     displayName: string;
     description: string;
+    kind: ContractKind;
     schemas?: ContractSchemas;
     uses?: ContractUses;
     rpc?: Record<string, ContractRpcMethod>;
@@ -210,6 +220,13 @@ export type ContractSourceKvResource = {
     ttlMs?: number;
     maxValueBytes?: number;
 };
+export type ContractSourceStoreResource = {
+    purpose: string;
+    required?: boolean;
+    ttlMs?: number;
+    maxObjectBytes?: number;
+    maxTotalBytes?: number;
+};
 export type ContractSourceStreamResource = {
     purpose: string;
     required?: boolean;
@@ -217,6 +234,7 @@ export type ContractSourceStreamResource = {
 };
 export type ContractSourceResources<TSchemaName extends string = string> = {
     kv?: Record<string, ContractSourceKvResource>;
+    store?: Record<string, ContractSourceStoreResource>;
     streams?: Record<string, ContractSourceStreamResource>;
     jobs?: ContractSourceJobsResource<TSchemaName>;
 };
@@ -241,6 +259,7 @@ export type TrellisContractSource = {
     id: string;
     displayName: string;
     description: string;
+    kind: ContractKind;
     schemas?: ContractSourceSchemas;
     uses?: Record<string, ContractSourceUse>;
     rpc?: Record<string, ContractSourceRpcMethod>;
@@ -447,6 +466,7 @@ export type DefineContractInput<TSchemas extends Readonly<Record<string, TSchema
     id: string;
     displayName: string;
     description: string;
+    kind: ContractKind;
     schemas?: TSchemas;
     uses?: TUses;
     rpc?: TRpc;