@spacefast/common 0.0.13 → 0.0.17

package/dist/contracts/mcp.js

@@ -1,11 +1,6 @@
 import { z } from "zod";
 import { AnyObjectSchema, dataEnvelope } from "./common.js";
 export const hostedMcpSessionStatusSchema = z.enum(["active", "closed", "expired", "interrupted"]);
-export const hostedMcpWorkspaceSummarySchema = z.object({
-    files: z.number().int().nonnegative(),
-    totalBytes: z.number().int().nonnegative(),
-    updatedAt: z.string().datetime().nullable(),
-});
 export const hostedMcpSessionSchema = z.object({
     sessionId: z.string(),
     clientId: z.string().nullable(),
@@ -14,31 +9,16 @@ export const hostedMcpSessionSchema = z.object({
     scopes: z.array(z.string()),
     policy: z.object({
         credential: z.string(),
-        approvals: z.string(),
         tools: z.string(),
     }),
     status: hostedMcpSessionStatusSchema,
     metadata: AnyObjectSchema.nullable(),
-    workspace: hostedMcpWorkspaceSummarySchema,
     ownerId: z.string().nullable(),
     ownerLeaseExpiresAt: z.string().datetime().nullable(),
     createdAt: z.string().datetime(),
     lastSeenAt: z.string().datetime(),
     closedAt: z.string().datetime().nullable(),
 });
-export const hostedMcpApprovalSchema = z.object({
-    id: z.string(),
-    runtime: z.enum(["hosted", "local"]),
-    tool: z.string(),
-    args: AnyObjectSchema,
-    preview: z.unknown(),
-    status: z.enum(["pending", "approved", "denied", "consumed", "expired"]),
-    decision: z.enum(["approve", "deny"]).nullable(),
-    decisionReason: z.string().nullable(),
-    decidedAt: z.string().datetime().nullable(),
-    createdAt: z.string().datetime(),
-    expiresAt: z.string().datetime(),
-});
 export const hostedMcpSessionEventSchema = z.object({
     id: z.string(),
     sessionId: z.string(),
@@ -51,71 +31,6 @@ export const hostedMcpSessionEventSchema = z.object({
     data: AnyObjectSchema.nullable(),
     createdAt: z.string().datetime(),
 });
-export const hostedMcpExecutionRunStatusSchema = z.enum([
-    "queued",
-    "running",
-    "approval_required",
-    "completed",
-    "failed",
-    "canceled",
-]);
-export const hostedMcpExecutionStepSchema = z.object({
-    id: z.string(),
-    runId: z.string(),
-    index: z.number().int().nonnegative(),
-    tool: z.string().nullable(),
-    status: z.string(),
-    dryRun: z.boolean().nullable(),
-    durationMs: z.number().int().nonnegative().nullable(),
-    input: AnyObjectSchema.nullable(),
-    output: z.unknown().nullable(),
-    createdAt: z.string().datetime(),
-});
-export const hostedMcpExecutionArtifactSchema = z.object({
-    id: z.string(),
-    runId: z.string(),
-    kind: z.enum(["log", "warning", "result", "resource", "file", "summary"]),
-    name: z.string(),
-    mimeType: z.string().nullable(),
-    sizeBytes: z.number().int().nonnegative().nullable(),
-    data: z.unknown().nullable(),
-    createdAt: z.string().datetime(),
-});
-export const hostedMcpExecutionRunSchema = z.object({
-    id: z.string(),
-    sessionId: z.string().nullable(),
-    credentialId: z.string().nullable(),
-    tool: z.string(),
-    mode: z.string().nullable(),
-    status: hostedMcpExecutionRunStatusSchema,
-    approvalId: z.string().nullable(),
-    cancellationRequested: z.boolean(),
-    summary: z.string().nullable(),
-    error: z.string().nullable(),
-    startedAt: z.string().datetime(),
-    completedAt: z.string().datetime().nullable(),
-    updatedAt: z.string().datetime(),
-    steps: z.array(hostedMcpExecutionStepSchema).optional(),
-    artifacts: z.array(hostedMcpExecutionArtifactSchema).optional(),
-});
-export const hostedMcpToolPolicySchema = z.object({
-    tool: z.string(),
-    runtime: z.enum(["hosted", "on-device", "both"]),
-    category: z.string(),
-    defaultMode: z.enum(["allow", "approval", "local-only"]),
-    approvalRequired: z.boolean(),
-    requiredScopes: z.array(z.string()),
-    clientPolicy: z.string(),
-    sessionPolicy: z.string(),
-});
-export const hostedMcpPolicyDefaultsSchema = z.object({
-    approvalTtlSeconds: z.number().int().positive(),
-    hostedTransport: z.string(),
-    onDeviceTransport: z.string(),
-    hostedBoundary: z.string(),
-    onDeviceBoundary: z.string(),
-    toolPolicies: z.array(hostedMcpToolPolicySchema),
-});
 export const hostedMcpSummarySchema = z.object({
     rowLimit: z.number().int().positive(),
     sessions: z.object({
@@ -125,37 +40,28 @@ export const hostedMcpSummarySchema = z.object({
         expired: z.number().int().nonnegative(),
         interrupted: z.number().int().nonnegative(),
     }),
-    approvals: z.object({
-        pending: z.number().int().nonnegative(),
-    }),
     events: z.object({
         recent: z.number().int().nonnegative(),
     }),
-    executions: z.object({
-        recent: z.number().int().nonnegative(),
-        running: z.number().int().nonnegative(),
-    }),
 });
 export const hostedMcpDashboardSchema = z.object({
     summary: hostedMcpSummarySchema,
-    policyDefaults: hostedMcpPolicyDefaultsSchema,
     sessions: z.array(hostedMcpSessionSchema),
-    approvals: z.array(hostedMcpApprovalSchema),
     events: z.array(hostedMcpSessionEventSchema),
-    executions: z.array(hostedMcpExecutionRunSchema),
 });
 export const hostedMcpDashboardResponseSchema = dataEnvelope(hostedMcpDashboardSchema);
 export const hostedMcpCloseSessionResponseSchema = dataEnvelope(hostedMcpSessionSchema);
-export const hostedMcpApprovalDecisionRequestSchema = z.object({
-    decision: z.enum(["approve", "deny"]),
-    reason: z.string().max(1_000).optional(),
-});
-export const hostedMcpApprovalResponseSchema = dataEnvelope(hostedMcpApprovalSchema);
 export const hostedMcpSessionEventsResponseSchema = dataEnvelope(z.object({
     session: hostedMcpSessionSchema,
     events: z.array(hostedMcpSessionEventSchema),
 }));
-export const hostedMcpExecutionRunsResponseSchema = dataEnvelope(z.object({
-    runs: z.array(hostedMcpExecutionRunSchema),
+export const hostedMcpPausedExecutionSchema = z.object({
+    text: z.string(),
+    structured: z.unknown(),
+});
+export const hostedMcpPausedExecutionResponseSchema = dataEnvelope(hostedMcpPausedExecutionSchema);
+export const hostedMcpApprovalActionSchema = z.enum(["accept", "decline", "cancel"]);
+export const hostedMcpApprovalResponseSchema = dataEnvelope(z.object({
+    text: z.string(),
+    structured: z.unknown(),
 }));
-export const hostedMcpExecutionRunResponseSchema = dataEnvelope(hostedMcpExecutionRunSchema);

package/dist/contracts/me.js

@@ -30,7 +30,7 @@ export const meResponseSchema = z.object({
         isSuperadmin: z.boolean().describe("Whether the user is a platform operator."),
     })
         .nullable()
-        .describe("Authenticated user identity for user-subject credentials. Null for team- or service-subject machine credentials; creator metadata is retained only for audit attribution, not request identity."),
+        .describe("Authenticated user identity for user-subject credentials. Null for team-subject or service-subject machine credentials. Creator metadata is retained only for audit attribution, not request identity."),
     tenants: z
         .array(z.object({
         id: z.string().describe("Tenant id."),
@@ -85,7 +85,7 @@ export const meResponseSchema = z.object({
         .object({
         gateEnabled: z
             .boolean()
-            .describe("Whether the beta.enrollment_gate flag is on for this deployment."),
+            .describe("Whether the `beta.enrollment_gate` flag is on for this environment."),
         enrolled: z
             .boolean()
             .describe("Whether the subject user is enrolled (beta_enrolled_at is set)."),
@@ -99,6 +99,5 @@ export const meResponseSchema = z.object({
         }))
             .describe("Teams the user may join via the picker (pending invitation, auto-enroll match, or Automattician access)."),
     })
-        .describe("Private-beta state. Dashboards key the blocked screen on gateEnabled && !enrolled, " +
-        "never on !enrolled alone — else launch-day flag-off would still block people."),
+        .describe("Private-beta state. Dashboards key the blocked screen on `gateEnabled && !enrolled`, never on `!enrolled` alone. Otherwise, a launch-day flag-off still blocks people."),
 });

package/dist/contracts/notifications.d.ts

@@ -0,0 +1,108 @@
+import { z } from "zod";
+export declare const notificationKindValues: readonly ["comment.created", "comment.replied", "thread.archived", "thread.unarchived", "mention"];
+export declare const notificationKindSchema: z.ZodEnum<{
+    "comment.created": "comment.created";
+    "comment.replied": "comment.replied";
+    "thread.archived": "thread.archived";
+    "thread.unarchived": "thread.unarchived";
+    mention: "mention";
+}>;
+export declare const notificationSchema: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "comment.created": "comment.created";
+        "comment.replied": "comment.replied";
+        "thread.archived": "thread.archived";
+        "thread.unarchived": "thread.unarchived";
+        mention: "mention";
+    }>;
+    teamId: z.ZodNullable<z.ZodString>;
+    spaceId: z.ZodNullable<z.ZodString>;
+    threadId: z.ZodNullable<z.ZodString>;
+    title: z.ZodString;
+    body: z.ZodNullable<z.ZodString>;
+    actor: z.ZodObject<{
+        name: z.ZodNullable<z.ZodString>;
+        avatarUrl: z.ZodNullable<z.ZodString>;
+        color: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    path: z.ZodNullable<z.ZodString>;
+    versionId: z.ZodNullable<z.ZodString>;
+    link: z.ZodNullable<z.ZodString>;
+    readAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export declare const notificationListQuerySchema: z.ZodObject<{
+    limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    cursor: z.ZodOptional<z.ZodString>;
+    unread: z.ZodDefault<z.ZodOptional<z.ZodCodec<z.ZodString, z.ZodBoolean>>>;
+}, z.core.$strip>;
+export declare const notificationListResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        notifications: z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            kind: z.ZodEnum<{
+                "comment.created": "comment.created";
+                "comment.replied": "comment.replied";
+                "thread.archived": "thread.archived";
+                "thread.unarchived": "thread.unarchived";
+                mention: "mention";
+            }>;
+            teamId: z.ZodNullable<z.ZodString>;
+            spaceId: z.ZodNullable<z.ZodString>;
+            threadId: z.ZodNullable<z.ZodString>;
+            title: z.ZodString;
+            body: z.ZodNullable<z.ZodString>;
+            actor: z.ZodObject<{
+                name: z.ZodNullable<z.ZodString>;
+                avatarUrl: z.ZodNullable<z.ZodString>;
+                color: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>;
+            path: z.ZodNullable<z.ZodString>;
+            versionId: z.ZodNullable<z.ZodString>;
+            link: z.ZodNullable<z.ZodString>;
+            readAt: z.ZodNullable<z.ZodString>;
+            createdAt: z.ZodString;
+        }, z.core.$strip>>;
+        pagination: z.ZodObject<{
+            nextCursor: z.ZodNullable<z.ZodString>;
+            hasMore: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const notificationUnreadCountResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        count: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const notificationReadRequestSchema: z.ZodObject<{
+    ids: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    all: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const notificationReadResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        updated: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const collabNotifyEmailRequestSchema: z.ZodObject<{
+    castActorId: z.ZodString;
+    email: z.ZodEmail;
+}, z.core.$strip>;
+export declare const collabNotifyEmailResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        subscribed: z.ZodLiteral<true>;
+        consentAt: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export declare const collabNotifyEmailUnsubscribeQuerySchema: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strip>;
+export declare const collabNotifyEmailUnsubscribeResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        unsubscribed: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type Notification = z.infer<typeof notificationSchema>;
+export type NotificationListQuery = z.infer<typeof notificationListQuerySchema>;
+export type NotificationReadRequest = z.infer<typeof notificationReadRequestSchema>;
+export type CollabNotifyEmailRequest = z.infer<typeof collabNotifyEmailRequestSchema>;

package/dist/contracts/notifications.js

@@ -0,0 +1,54 @@
+import { z } from "zod";
+import { CursorPaginationSchema, cursorListQuerySchema, dataEnvelope } from "./common.js";
+export const notificationKindValues = [
+    "comment.created",
+    "comment.replied",
+    "thread.archived",
+    "thread.unarchived",
+    "mention",
+];
+export const notificationKindSchema = z.enum(notificationKindValues);
+export const notificationSchema = z.object({
+    id: z.string().min(1),
+    kind: notificationKindSchema,
+    teamId: z.string().nullable(),
+    spaceId: z.string().nullable(),
+    threadId: z.string().nullable(),
+    title: z.string(),
+    body: z.string().nullable(),
+    actor: z.object({
+        name: z.string().nullable(),
+        avatarUrl: z.string().nullable(),
+        color: z.string().nullable(),
+    }),
+    path: z.string().nullable(),
+    versionId: z.string().nullable(),
+    link: z.string().nullable(),
+    readAt: z.string().datetime().nullable(),
+    createdAt: z.string().datetime(),
+});
+export const notificationListQuerySchema = cursorListQuerySchema.extend({
+    unread: z.stringbool().optional().default(false),
+});
+export const notificationListResponseSchema = dataEnvelope(z.object({
+    notifications: z.array(notificationSchema),
+    pagination: CursorPaginationSchema,
+}));
+export const notificationUnreadCountResponseSchema = dataEnvelope(z.object({ count: z.number().int().nonnegative() }));
+export const notificationReadRequestSchema = z.object({
+    ids: z.array(z.string().min(1)).max(100).optional(),
+    all: z.boolean().optional(),
+});
+export const notificationReadResponseSchema = dataEnvelope(z.object({ updated: z.number().int().nonnegative() }));
+export const collabNotifyEmailRequestSchema = z.object({
+    castActorId: z.string().trim().min(1).max(128),
+    email: z.email().max(320),
+});
+export const collabNotifyEmailResponseSchema = dataEnvelope(z.object({
+    subscribed: z.literal(true),
+    consentAt: z.string().datetime(),
+}));
+export const collabNotifyEmailUnsubscribeQuerySchema = z.object({
+    token: z.string().min(1),
+});
+export const collabNotifyEmailUnsubscribeResponseSchema = dataEnvelope(z.object({ unsubscribed: z.boolean() }));

package/dist/contracts/oauth-resources.d.ts

@@ -5,7 +5,24 @@ export declare const OAUTH_API_RESOURCE_PATH: "/v1";
 export type OAuthResourceKey = "api" | "mcp";
 export declare const OAUTH_API_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
 export declare const OAUTH_MCP_TOOL_SCOPE: "mcp:tools";
+export declare const OAUTH_OFFLINE_ACCESS_SCOPE: "offline_access";
 export declare const OAUTH_MCP_RESOURCE_SCOPES: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
+/**
+ * A resource's `allowedScopes` is intersected with the requested scopes on every
+ * token request, and the refresh token stores that intersection — so a resource
+ * that omits `offline_access` cannot mint a refresh token that survives
+ * rotation, and its clients must re-consent in a browser every
+ * `accessTokenTtlSeconds`. Kept separate from OAUTH_MCP_RESOURCE_SCOPES, which
+ * is the list of capabilities the dashboard and CLI offer per agent account.
+ */
+export declare const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
+/**
+ * Interactive MCP clients should be useful after one consent. Authorization is
+ * still bounded by the user's live team role and by approval gates around
+ * sensitive execution; these scopes only let the MCP resource represent those
+ * capabilities. Machine clients may continue to request a narrower set.
+ */
+export declare const OAUTH_MCP_DEFAULT_SCOPES: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
 export declare const OAUTH_PROVIDER_SCOPES: readonly ["openid", "profile", "email", "offline_access", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "mcp:tools"];
 export declare const OAUTH_RESOURCE_DEFINITIONS: {
     readonly api: {
@@ -18,7 +35,7 @@ export declare const OAUTH_RESOURCE_DEFINITIONS: {
         readonly key: "mcp";
         readonly name: "Spacefast MCP";
         readonly accessTokenTtlSeconds: number;
-        readonly allowedScopes: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
+        readonly allowedScopes: readonly ["mcp:tools", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
     };
 };
 /** Resource identifier for the public API: `https://api.<domain>/v1`. */

package/dist/contracts/oauth-resources.js

@@ -13,15 +13,35 @@ export const OAUTH_API_RESOURCE_SCOPES = [
     "domains:write",
 ];
 export const OAUTH_MCP_TOOL_SCOPE = "mcp:tools";
+export const OAUTH_OFFLINE_ACCESS_SCOPE = "offline_access";
 export const OAUTH_MCP_RESOURCE_SCOPES = [
     OAUTH_MCP_TOOL_SCOPE,
     ...OAUTH_API_RESOURCE_SCOPES,
 ];
+/**
+ * A resource's `allowedScopes` is intersected with the requested scopes on every
+ * token request, and the refresh token stores that intersection — so a resource
+ * that omits `offline_access` cannot mint a refresh token that survives
+ * rotation, and its clients must re-consent in a browser every
+ * `accessTokenTtlSeconds`. Kept separate from OAUTH_MCP_RESOURCE_SCOPES, which
+ * is the list of capabilities the dashboard and CLI offer per agent account.
+ */
+export const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES = [
+    ...OAUTH_MCP_RESOURCE_SCOPES,
+    OAUTH_OFFLINE_ACCESS_SCOPE,
+];
+/**
+ * Interactive MCP clients should be useful after one consent. Authorization is
+ * still bounded by the user's live team role and by approval gates around
+ * sensitive execution; these scopes only let the MCP resource represent those
+ * capabilities. Machine clients may continue to request a narrower set.
+ */
+export const OAUTH_MCP_DEFAULT_SCOPES = OAUTH_MCP_RESOURCE_ALLOWED_SCOPES;
 export const OAUTH_PROVIDER_SCOPES = [
     "openid",
     "profile",
     "email",
-    "offline_access",
+    OAUTH_OFFLINE_ACCESS_SCOPE,
     ...OAUTH_API_RESOURCE_SCOPES,
     OAUTH_MCP_TOOL_SCOPE,
 ];
@@ -36,7 +56,7 @@ export const OAUTH_RESOURCE_DEFINITIONS = {
         key: "mcp",
         name: "Spacefast MCP",
         accessTokenTtlSeconds: 15 * 60,
-        allowedScopes: OAUTH_MCP_RESOURCE_SCOPES,
+        allowedScopes: OAUTH_MCP_RESOURCE_ALLOWED_SCOPES,
     },
 };
 /** Resource identifier for the public API: `https://api.<domain>/v1`. */

package/dist/contracts/operations.d.ts

@@ -1,6 +1,5 @@
 import { z } from "zod";
 export declare const userOperationKindSchema: z.ZodEnum<{
-    approval: "approval";
     version_finalize: "version_finalize";
     version_promote_live: "version_promote_live";
     version_delete: "version_delete";
@@ -14,7 +13,6 @@ export declare const userOperationKindSchema: z.ZodEnum<{
     variable_cascade: "variable_cascade";
     webhook_deliver: "webhook_deliver";
     integration_release: "integration_release";
-    agent_run: "agent_run";
 }>;
 export type UserOperationKind = z.infer<typeof userOperationKindSchema>;
 export declare const UserOperationSchema: z.ZodObject<{
@@ -57,7 +55,6 @@ export declare const UserOperationSchema: z.ZodObject<{
     createdAt: z.ZodString;
     finishedAt: z.ZodOptional<z.ZodString>;
     kind: z.ZodEnum<{
-        approval: "approval";
         version_finalize: "version_finalize";
         version_promote_live: "version_promote_live";
         version_delete: "version_delete";
@@ -71,7 +68,6 @@ export declare const UserOperationSchema: z.ZodObject<{
         variable_cascade: "variable_cascade";
         webhook_deliver: "webhook_deliver";
         integration_release: "integration_release";
-        agent_run: "agent_run";
     }>;
     versionSource: z.ZodOptional<z.ZodEnum<{
         direct_upload: "direct_upload";
@@ -80,32 +76,11 @@ export declare const UserOperationSchema: z.ZodObject<{
     }>>;
     integrationRelease: z.ZodOptional<z.ZodObject<{
         environment: z.ZodEnum<{
-            preview: "preview";
             production: "production";
+            preview: "preview";
             development: "development";
         }>;
     }, z.core.$strip>>;
-    agentRun: z.ZodOptional<z.ZodObject<{
-        state: z.ZodEnum<{
-            failed: "failed";
-            completed: "completed";
-            canceled: "canceled";
-            queued: "queued";
-            running: "running";
-            approval_required: "approval_required";
-        }>;
-        tool: z.ZodString;
-        mode: z.ZodOptional<z.ZodString>;
-    }, z.core.$strip>>;
-    approval: z.ZodOptional<z.ZodObject<{
-        decision: z.ZodNullable<z.ZodEnum<{
-            deny: "deny";
-            approve: "approve";
-        }>>;
-        decidedAt: z.ZodNullable<z.ZodString>;
-        expiresAt: z.ZodString;
-        consumedAt: z.ZodNullable<z.ZodString>;
-    }, z.core.$strip>>;
 }, z.core.$strip>;
 export declare const operationListQuerySchema: z.ZodObject<{
     limit: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
@@ -155,7 +130,6 @@ export declare const operationListResponseSchema: z.ZodObject<{
         createdAt: z.ZodString;
         finishedAt: z.ZodOptional<z.ZodString>;
         kind: z.ZodEnum<{
-            approval: "approval";
             version_finalize: "version_finalize";
             version_promote_live: "version_promote_live";
             version_delete: "version_delete";
@@ -169,7 +143,6 @@ export declare const operationListResponseSchema: z.ZodObject<{
             variable_cascade: "variable_cascade";
             webhook_deliver: "webhook_deliver";
             integration_release: "integration_release";
-            agent_run: "agent_run";
         }>;
         versionSource: z.ZodOptional<z.ZodEnum<{
             direct_upload: "direct_upload";
@@ -178,32 +151,11 @@ export declare const operationListResponseSchema: z.ZodObject<{
         }>>;
         integrationRelease: z.ZodOptional<z.ZodObject<{
             environment: z.ZodEnum<{
-                preview: "preview";
                 production: "production";
+                preview: "preview";
                 development: "development";
             }>;
         }, z.core.$strip>>;
-        agentRun: z.ZodOptional<z.ZodObject<{
-            state: z.ZodEnum<{
-                failed: "failed";
-                completed: "completed";
-                canceled: "canceled";
-                queued: "queued";
-                running: "running";
-                approval_required: "approval_required";
-            }>;
-            tool: z.ZodString;
-            mode: z.ZodOptional<z.ZodString>;
-        }, z.core.$strip>>;
-        approval: z.ZodOptional<z.ZodObject<{
-            decision: z.ZodNullable<z.ZodEnum<{
-                deny: "deny";
-                approve: "approve";
-            }>>;
-            decidedAt: z.ZodNullable<z.ZodString>;
-            expiresAt: z.ZodString;
-            consumedAt: z.ZodNullable<z.ZodString>;
-        }, z.core.$strip>>;
     }, z.core.$strip>>;
     pagination: z.ZodObject<{
         nextCursor: z.ZodNullable<z.ZodString>;

package/dist/contracts/operations.js

@@ -14,8 +14,6 @@ export const userOperationKindSchema = z.enum([
     "variable_cascade",
     "webhook_deliver",
     "integration_release",
-    "agent_run",
-    "approval",
 ]);
 export const UserOperationSchema = AsyncOperationSchema.extend({
     kind: userOperationKindSchema,
@@ -29,23 +27,6 @@ export const UserOperationSchema = AsyncOperationSchema.extend({
     })
         .optional()
         .describe("Release environment for an integration tag pointer flip."),
-    agentRun: z
-        .object({
-        state: z.enum(["queued", "running", "approval_required", "completed", "failed", "canceled"]),
-        tool: z.string(),
-        mode: z.string().optional(),
-    })
-        .optional()
-        .describe("Authoritative agent execution state and the tool invocation that produced it."),
-    approval: z
-        .object({
-        decision: z.enum(["approve", "deny"]).nullable(),
-        decidedAt: z.string().datetime().nullable(),
-        expiresAt: z.string().datetime(),
-        consumedAt: z.string().datetime().nullable(),
-    })
-        .optional()
-        .describe("Current approval decision and lifecycle timestamps from the approval authority."),
 });
 export const operationListQuerySchema = cursorListQuerySchema.extend({
     resourceType: z

package/dist/contracts/pages.d.ts

@@ -1,23 +1,26 @@
 import { z } from "zod";
-export declare const SITE_PAGE_IDS: readonly ["404", "denied", "index", "preview"];
+export declare const SITE_PAGE_IDS: readonly ["404", "denied", "access", "index", "preview"];
 export declare const sitePageIdSchema: z.ZodEnum<{
     denied: "denied";
     index: "index";
     preview: "preview";
+    access: "access";
     404: "404";
 }>;
 export type SitePageId = z.infer<typeof sitePageIdSchema>;
-export declare const ROUTE_PAGE_IDS: readonly ["404", "denied"];
+export declare const ROUTE_PAGE_IDS: readonly ["404", "denied", "access"];
 export declare const routePageIdSchema: z.ZodEnum<{
     denied: "denied";
+    access: "access";
     404: "404";
 }>;
 export type RoutePageId = z.infer<typeof routePageIdSchema>;
-export declare const CUSTOM_PAGE_IDS: readonly ["404", "denied", "index", "preview"];
+export declare const CUSTOM_PAGE_IDS: readonly ["404", "denied", "access", "index", "preview"];
 export declare const customPageIdSchema: z.ZodEnum<{
     denied: "denied";
     index: "index";
     preview: "preview";
+    access: "access";
     404: "404";
 }>;
 export type CustomPageId = z.infer<typeof customPageIdSchema>;
@@ -35,7 +38,7 @@ export declare const platformPageIdSchema: z.ZodEnum<{
     "content-too-large": "content-too-large";
 }>;
 export type PlatformPageId = z.infer<typeof platformPageIdSchema>;
-export declare const PAGE_ELEMENTS: readonly ["sf-content", "sf-denial-context", "sf-page-path", "sf-page-title", "sf-page-summary", "sf-spacefast-branding", "sf-files", "sf-file", "sf-logo", "sf-name"];
+export declare const PAGE_ELEMENTS: readonly ["sf-content", "sf-denial-context", "sf-access-status", "sf-access-lanes", "sf-page-path", "sf-page-title", "sf-page-summary", "sf-spacefast-branding", "sf-files", "sf-file", "sf-logo", "sf-name"];
 export type PageElement = (typeof PAGE_ELEMENTS)[number];
 export type PageDefinition = {
     id: SitePageId;
@@ -53,6 +56,7 @@ export declare const runtimePagesSchema: z.ZodObject<{
     routes: z.ZodRecord<z.ZodString, z.ZodObject<{
         pages: z.ZodOptional<z.ZodRecord<z.ZodEnum<{
             denied: "denied";
+            access: "access";
             404: "404";
         }>, z.ZodString>>;
         index: z.ZodOptional<z.ZodString>;

package/dist/contracts/pages.js

@@ -1,9 +1,9 @@
 import { z } from "zod";
-export const SITE_PAGE_IDS = ["404", "denied", "index", "preview"];
+export const SITE_PAGE_IDS = ["404", "denied", "access", "index", "preview"];
 export const sitePageIdSchema = z.enum(SITE_PAGE_IDS);
-export const ROUTE_PAGE_IDS = ["404", "denied"];
+export const ROUTE_PAGE_IDS = ["404", "denied", "access"];
 export const routePageIdSchema = z.enum(ROUTE_PAGE_IDS);
-export const CUSTOM_PAGE_IDS = ["404", "denied", "index", "preview"];
+export const CUSTOM_PAGE_IDS = ["404", "denied", "access", "index", "preview"];
 export const customPageIdSchema = z.enum(CUSTOM_PAGE_IDS);
 export const PLATFORM_PAGE_IDS = [
     "undeployed",
@@ -21,6 +21,8 @@ export const platformPageIdSchema = z.enum(PLATFORM_PAGE_IDS);
 export const PAGE_ELEMENTS = [
     "sf-content",
     "sf-denial-context",
+    "sf-access-status",
+    "sf-access-lanes",
     "sf-page-path",
     "sf-page-title",
     "sf-page-summary",
@@ -45,6 +47,17 @@ export const PAGE_CATALOG = {
         noindex: true,
         customTemplate: false,
     },
+    // The visitor access page: the deny surface WITH lanes (sign in, SSO,
+    // password, request an invite). Rendered by the runtime at the requested URL;
+    // publishers may fully retheme it — the runtime injects the functional lane
+    // blocks into the sf-access-* slots so forms and states stay correct.
+    access: {
+        id: "access",
+        status: 403,
+        cacheControl: "private, no-store",
+        noindex: true,
+        customTemplate: true,
+    },
     index: {
         id: "index",
         status: 200,