@spacefast/common 0.2.1 → 0.4.1

package/dist/contracts/mcp.js

@@ -1,31 +1,9 @@
 import { z } from "zod";
 import { AnyObjectSchema, dataEnvelope } from "./common.js";
-export const HOSTED_MCP_SERVER_VERSION = "2026-08-22";
-export const HOSTED_MCP_TOOL_CATALOG = [
-    {
-        name: "execute",
-        description: "Run JavaScript against the OpenAPI-generated Spacefast catalog in a secure sandbox.",
-    },
-    {
-        name: "skills",
-        description: "Fetch Spacefast how-to guidance for an MCP workflow.",
-    },
-    {
-        name: "resume",
-        description: "Resume an execution that paused for approval or input.",
-    },
-    {
-        name: "publish",
-        description: "Publish inline files as a new immutable Spacefast version.",
-    },
-    {
-        name: "search_docs",
-        description: "Search the published Spacefast documentation. An exact slug or path returns that page in full.",
-    },
-];
 export const hostedMcpSessionStatusSchema = z.enum(["active", "closed", "expired", "interrupted"]);
 export const hostedMcpSessionSchema = z.object({
     sessionId: z.string(),
+    closable: z.boolean(),
     clientId: z.string().nullable(),
     credentialId: z.string().nullable(),
     credentialKind: z.string().nullable(),
@@ -84,6 +62,7 @@ export const hostedMcpSessionEventsResponseSchema = dataEnvelope(z.object({
     events: z.array(hostedMcpSessionEventSchema),
 }));
 export const hostedMcpPausedExecutionSchema = z.object({
+    allowAlways: z.boolean(),
     text: z.string(),
     structured: z.unknown(),
 });

package/dist/contracts/notifications.d.ts

@@ -1,11 +1,12 @@
 import { z } from "zod";
-export declare const notificationKindValues: readonly ["comment.created", "comment.replied", "thread.archived", "thread.unarchived", "mention"];
+export declare const notificationKindValues: readonly ["comment.created", "comment.replied", "thread.archived", "thread.unarchived", "mention", "approval.requested"];
 export declare const notificationKindSchema: z.ZodEnum<{
     "comment.created": "comment.created";
     "comment.replied": "comment.replied";
     "thread.archived": "thread.archived";
     "thread.unarchived": "thread.unarchived";
     mention: "mention";
+    "approval.requested": "approval.requested";
 }>;
 export declare const notificationSchema: z.ZodObject<{
     id: z.ZodString;
@@ -15,6 +16,7 @@ export declare const notificationSchema: z.ZodObject<{
         "thread.archived": "thread.archived";
         "thread.unarchived": "thread.unarchived";
         mention: "mention";
+        "approval.requested": "approval.requested";
     }>;
     teamId: z.ZodNullable<z.ZodString>;
     spaceId: z.ZodNullable<z.ZodString>;
@@ -46,6 +48,7 @@ export declare const notificationListResponseSchema: z.ZodObject<{
             "thread.archived": "thread.archived";
             "thread.unarchived": "thread.unarchived";
             mention: "mention";
+            "approval.requested": "approval.requested";
         }>;
         teamId: z.ZodNullable<z.ZodString>;
         spaceId: z.ZodNullable<z.ZodString>;

package/dist/contracts/notifications.js

@@ -6,6 +6,7 @@ export const notificationKindValues = [
     "thread.archived",
     "thread.unarchived",
     "mention",
+    "approval.requested",
 ];
 export const notificationKindSchema = z.enum(notificationKindValues);
 export const notificationSchema = z.object({

package/dist/contracts/oauth-resources.d.ts

@@ -3,10 +3,10 @@ export declare const OAUTH_AUTHORIZATION_SERVER_PATH: "/v1/auth";
  * mcp origin (`https://mcp.<domain>`), so it has no path entry here. */
 export declare const OAUTH_API_RESOURCE_PATH: "/v1";
 export type OAuthResourceKey = "api" | "mcp";
-export declare const OAUTH_SHARED_API_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
-export declare const OAUTH_API_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger"];
+export declare const OAUTH_SHARED_API_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute"];
+export declare const OAUTH_API_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute", "spaces:publish", "builds:trigger"];
 export declare const OAUTH_OFFLINE_ACCESS_SCOPE: "offline_access";
-export declare const OAUTH_MCP_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write"];
+export declare const OAUTH_MCP_RESOURCE_SCOPES: readonly ["teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute"];
 /**
  * A resource's `allowedScopes` is intersected with the requested scopes on every
  * token request, and the refresh token stores that intersection, so a resource
@@ -15,16 +15,17 @@ export declare const OAUTH_MCP_RESOURCE_SCOPES: readonly ["teams:read", "teams:c
  * `accessTokenTtlSeconds`. Kept separate from OAUTH_MCP_RESOURCE_SCOPES, which
  * is the list of capabilities the dashboard and CLI offer per machine OAuth client.
  */
-export declare const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
-export declare const OAUTH_API_RESOURCE_ALLOWED_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger", "offline_access"];
+export declare const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES: readonly ["teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute", "offline_access"];
+export declare const OAUTH_AGENT_DEFAULT_SCOPES: ("teams:read" | "teams:create" | "teams:members.write" | "spaces:read" | "spaces:write" | "spaces:rename" | "versions:download" | "publish:write" | "domains:read" | "domains:write" | "connectors:read" | "connectors:write" | "connectors:execute")[];
+export declare const OAUTH_API_RESOURCE_ALLOWED_SCOPES: readonly ["teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute", "spaces:publish", "builds:trigger", "offline_access"];
 /**
  * Interactive MCP clients should be useful after one consent. Authorization is
  * still bounded by the user's live team role and by approval gates around
  * sensitive execution; these scopes only let the MCP resource represent those
  * capabilities. Machine clients may continue to request a narrower set.
  */
-export declare const OAUTH_MCP_DEFAULT_SCOPES: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
-export declare const OAUTH_PROVIDER_SCOPES: readonly ["openid", "profile", "email", "offline_access", "teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger"];
+export declare const OAUTH_MCP_DEFAULT_SCOPES: readonly [...("teams:read" | "teams:create" | "teams:members.write" | "spaces:read" | "spaces:write" | "spaces:rename" | "versions:download" | "publish:write" | "domains:read" | "domains:write" | "connectors:read" | "connectors:write" | "connectors:execute")[], "offline_access"];
+export declare const OAUTH_PROVIDER_SCOPES: readonly ["openid", "profile", "email", "offline_access", "teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute", "spaces:publish", "builds:trigger"];
 export declare const OAUTH_SCOPE_DESCRIPTIONS: {
     readonly openid: "Identify the signed-in account.";
     readonly profile: "Read the signed-in account's basic profile.";
@@ -32,15 +33,30 @@ export declare const OAUTH_SCOPE_DESCRIPTIONS: {
     readonly offline_access: "Refresh access without another interactive sign-in.";
     readonly "teams:read": "Read the teams the account belongs to.";
     readonly "teams:create": "Create teams.";
+    readonly "teams:members.write": "Invite people to teams that the account can administer.";
     readonly "spaces:read": "Read spaces, versions, and build status.";
     readonly "spaces:write": "Create and update spaces and their settings.";
     readonly "spaces:rename": "Rename space slugs and managed addresses.";
+    readonly "spaces:delete": "Delete sites.";
+    readonly "versions:download": "Read files from deployment versions.";
     readonly "publish:write": "Publish new immutable versions.";
     readonly "spaces:publish": "Publish a version to an existing space.";
     readonly "builds:trigger": "Start a build for an existing version.";
     readonly "domains:read": "Read domain inventory and DNS diagnostics.";
     readonly "domains:write": "Attach, verify, and mutate domains and DNS records.";
+    readonly "connectors:read": "Read connected services, their tools, and what policy allows.";
+    readonly "connectors:write": "Connect and disconnect services, and set tool policy.";
+    readonly "connectors:execute": "Run tools on services this team connected — acts with real accounts, on real data.";
 };
+/**
+ * Drop scope ids the vocabulary no longer knows (e.g. a removed scope that
+ * older grants still store). Safe and non-widening, same as the api-key
+ * action normalizer: a retired scope gates nothing anywhere, so the surviving
+ * scopes are the real grant — serving the retired id would present a
+ * permission that does not exist, and strict consumers of the provider
+ * vocabulary would reject the whole payload over it.
+ */
+export declare function knownOAuthScopes(scopes: readonly string[]): OAuthScopeId[];
 export declare const OAUTH_SCOPE_RISK_TINTS: readonly ["neutral", "warning", "critical"];
 export type OAuthScopeRiskTint = (typeof OAUTH_SCOPE_RISK_TINTS)[number];
 export type OAuthScopeId = keyof typeof OAUTH_SCOPE_DESCRIPTIONS;
@@ -85,6 +101,11 @@ export declare const OAUTH_SCOPE_COPY: {
         readonly description: "Create teams.";
         readonly riskTint: "warning";
     };
+    readonly "teams:members.write": {
+        readonly label: "Invite team members";
+        readonly description: "Invite people to teams that the account can administer.";
+        readonly riskTint: "critical";
+    };
     readonly "spaces:read": {
         readonly label: "Read your sites";
         readonly description: "Read spaces, versions, and build status.";
@@ -100,6 +121,16 @@ export declare const OAUTH_SCOPE_COPY: {
         readonly description: "Rename space slugs and managed addresses.";
         readonly riskTint: "warning";
     };
+    readonly "spaces:delete": {
+        readonly label: "Delete your sites";
+        readonly description: "Delete sites.";
+        readonly riskTint: "critical";
+    };
+    readonly "versions:download": {
+        readonly label: "Read version files";
+        readonly description: "Read files from deployment versions.";
+        readonly riskTint: "neutral";
+    };
     readonly "publish:write": {
         readonly label: "Publish and manage versions";
         readonly description: "Publish new immutable versions.";
@@ -125,6 +156,21 @@ export declare const OAUTH_SCOPE_COPY: {
         readonly description: "Attach, verify, and mutate domains and DNS records.";
         readonly riskTint: "critical";
     };
+    readonly "connectors:read": {
+        readonly label: "See the services you connected";
+        readonly description: "Read connected services, their tools, and what policy allows.";
+        readonly riskTint: "neutral";
+    };
+    readonly "connectors:write": {
+        readonly label: "Connect and disconnect services";
+        readonly description: "Connect and disconnect services, and set tool policy.";
+        readonly riskTint: "warning";
+    };
+    readonly "connectors:execute": {
+        readonly label: "Act on your connected services";
+        readonly description: "Run tools on services this team connected — acts with real accounts, on real data.";
+        readonly riskTint: "critical";
+    };
 };
 export declare function oauthScopeCopy(scope: string): OAuthScopeCopy;
 export declare const OAUTH_RESOURCE_DEFINITIONS: {
@@ -132,13 +178,13 @@ export declare const OAUTH_RESOURCE_DEFINITIONS: {
         readonly key: "api";
         readonly name: "Spacefast API";
         readonly accessTokenTtlSeconds: number;
-        readonly allowedScopes: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "spaces:publish", "builds:trigger", "offline_access"];
+        readonly allowedScopes: readonly ["teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute", "spaces:publish", "builds:trigger", "offline_access"];
     };
     readonly mcp: {
         readonly key: "mcp";
         readonly name: "Spacefast MCP";
         readonly accessTokenTtlSeconds: number;
-        readonly allowedScopes: readonly ["teams:read", "teams:create", "spaces:read", "spaces:write", "spaces:rename", "publish:write", "domains:read", "domains:write", "offline_access"];
+        readonly allowedScopes: readonly ["teams:read", "teams:create", "teams:members.write", "spaces:read", "spaces:write", "spaces:rename", "spaces:delete", "versions:download", "publish:write", "domains:read", "domains:write", "connectors:read", "connectors:write", "connectors:execute", "offline_access"];
     };
 };
 /** Resource identifier for the public API: `https://api.<domain>/v1`. */

package/dist/contracts/oauth-resources.js

@@ -10,12 +10,18 @@ export const OAUTH_API_RESOURCE_PATH = "/v1";
 export const OAUTH_SHARED_API_RESOURCE_SCOPES = [
     "teams:read",
     "teams:create",
+    "teams:members.write",
     "spaces:read",
     "spaces:write",
     "spaces:rename",
+    "spaces:delete",
+    "versions:download",
     "publish:write",
     "domains:read",
     "domains:write",
+    "connectors:read",
+    "connectors:write",
+    "connectors:execute",
 ];
 export const OAUTH_API_RESOURCE_SCOPES = [
     ...OAUTH_SHARED_API_RESOURCE_SCOPES,
@@ -39,6 +45,10 @@ export const OAUTH_MCP_RESOURCE_ALLOWED_SCOPES = [
     ...OAUTH_MCP_RESOURCE_SCOPES,
     OAUTH_OFFLINE_ACCESS_SCOPE,
 ];
+// Interactive Agent access can request every MCP capability except destructive
+// Space deletion. A person can add that scope explicitly or approve a temporary
+// elevation when an agent asks to delete.
+export const OAUTH_AGENT_DEFAULT_SCOPES = OAUTH_SHARED_API_RESOURCE_SCOPES.filter((scope) => scope !== "spaces:delete");
 export const OAUTH_API_RESOURCE_ALLOWED_SCOPES = [
     ...OAUTH_API_RESOURCE_SCOPES,
     OAUTH_OFFLINE_ACCESS_SCOPE,
@@ -49,7 +59,10 @@ export const OAUTH_API_RESOURCE_ALLOWED_SCOPES = [
  * sensitive execution; these scopes only let the MCP resource represent those
  * capabilities. Machine clients may continue to request a narrower set.
  */
-export const OAUTH_MCP_DEFAULT_SCOPES = OAUTH_MCP_RESOURCE_ALLOWED_SCOPES;
+export const OAUTH_MCP_DEFAULT_SCOPES = [
+    ...OAUTH_AGENT_DEFAULT_SCOPES,
+    OAUTH_OFFLINE_ACCESS_SCOPE,
+];
 export const OAUTH_PROVIDER_SCOPES = [
     "openid",
     "profile",
@@ -64,15 +77,35 @@ export const OAUTH_SCOPE_DESCRIPTIONS = {
     offline_access: "Refresh access without another interactive sign-in.",
     "teams:read": "Read the teams the account belongs to.",
     "teams:create": "Create teams.",
+    "teams:members.write": "Invite people to teams that the account can administer.",
     "spaces:read": "Read spaces, versions, and build status.",
     "spaces:write": "Create and update spaces and their settings.",
     "spaces:rename": "Rename space slugs and managed addresses.",
+    "spaces:delete": "Delete sites.",
+    "versions:download": "Read files from deployment versions.",
     "publish:write": "Publish new immutable versions.",
     "spaces:publish": "Publish a version to an existing space.",
     "builds:trigger": "Start a build for an existing version.",
     "domains:read": "Read domain inventory and DNS diagnostics.",
     "domains:write": "Attach, verify, and mutate domains and DNS records.",
+    "connectors:read": "Read connected services, their tools, and what policy allows.",
+    "connectors:write": "Connect and disconnect services, and set tool policy.",
+    "connectors:execute": "Run tools on services this team connected — acts with real accounts, on real data.",
 };
+const OAUTH_PROVIDER_SCOPE_SET = new Set(OAUTH_PROVIDER_SCOPES);
+/**
+ * Drop scope ids the vocabulary no longer knows (e.g. a removed scope that
+ * older grants still store). Safe and non-widening, same as the api-key
+ * action normalizer: a retired scope gates nothing anywhere, so the surviving
+ * scopes are the real grant — serving the retired id would present a
+ * permission that does not exist, and strict consumers of the provider
+ * vocabulary would reject the whole payload over it.
+ */
+export function knownOAuthScopes(scopes) {
+    return [
+        ...new Set(scopes.filter((scope) => OAUTH_PROVIDER_SCOPE_SET.has(scope))),
+    ];
+}
 export const OAUTH_SCOPE_RISK_TINTS = ["neutral", "warning", "critical"];
 /**
  * Human-facing permission copy shared by every authorization surface. Keep raw
@@ -110,6 +143,11 @@ export const OAUTH_SCOPE_COPY = {
         description: OAUTH_SCOPE_DESCRIPTIONS["teams:create"],
         riskTint: "warning",
     },
+    "teams:members.write": {
+        label: "Invite team members",
+        description: OAUTH_SCOPE_DESCRIPTIONS["teams:members.write"],
+        riskTint: "critical",
+    },
     "spaces:read": {
         label: "Read your sites",
         description: OAUTH_SCOPE_DESCRIPTIONS["spaces:read"],
@@ -125,6 +163,16 @@ export const OAUTH_SCOPE_COPY = {
         description: OAUTH_SCOPE_DESCRIPTIONS["spaces:rename"],
         riskTint: "warning",
     },
+    "spaces:delete": {
+        label: "Delete your sites",
+        description: OAUTH_SCOPE_DESCRIPTIONS["spaces:delete"],
+        riskTint: "critical",
+    },
+    "versions:download": {
+        label: "Read version files",
+        description: OAUTH_SCOPE_DESCRIPTIONS["versions:download"],
+        riskTint: "neutral",
+    },
     "publish:write": {
         label: "Publish and manage versions",
         description: OAUTH_SCOPE_DESCRIPTIONS["publish:write"],
@@ -150,6 +198,21 @@ export const OAUTH_SCOPE_COPY = {
         description: OAUTH_SCOPE_DESCRIPTIONS["domains:write"],
         riskTint: "critical",
     },
+    "connectors:read": {
+        label: "See the services you connected",
+        description: OAUTH_SCOPE_DESCRIPTIONS["connectors:read"],
+        riskTint: "neutral",
+    },
+    "connectors:write": {
+        label: "Connect and disconnect services",
+        description: OAUTH_SCOPE_DESCRIPTIONS["connectors:write"],
+        riskTint: "warning",
+    },
+    "connectors:execute": {
+        label: "Act on your connected services",
+        description: OAUTH_SCOPE_DESCRIPTIONS["connectors:execute"],
+        riskTint: "critical",
+    },
 };
 export function oauthScopeCopy(scope) {
     const match = Object.entries(OAUTH_SCOPE_COPY).find(([knownScope]) => knownScope === scope);

package/dist/contracts/oauth-scope-actions.d.ts

@@ -37,6 +37,10 @@ declare const OAUTH_SCOPE_GRAPH: {
         readonly covers: readonly [];
         readonly actions: readonly ["teams:create"];
     };
+    readonly "teams:members.write": {
+        readonly covers: readonly ["teams:read"];
+        readonly actions: readonly ["teams:members.write"];
+    };
     readonly "spaces:read": {
         readonly covers: readonly [];
         readonly actions: readonly ["spaces:read", "versions:read", "builds:read"];
@@ -49,9 +53,17 @@ declare const OAUTH_SCOPE_GRAPH: {
         readonly covers: readonly [];
         readonly actions: readonly ["spaces:rename"];
     };
+    readonly "spaces:delete": {
+        readonly covers: readonly [];
+        readonly actions: readonly ["spaces:delete"];
+    };
+    readonly "versions:download": {
+        readonly covers: readonly [];
+        readonly actions: readonly ["versions:download"];
+    };
     readonly "publish:write": {
-        readonly covers: readonly ["spaces:read", "spaces:write"];
-        readonly actions: readonly ["spaces:publish", "versions:promote", "versions:download", "builds:trigger", "builds:create"];
+        readonly covers: readonly ["spaces:read", "spaces:write", "versions:download"];
+        readonly actions: readonly ["spaces:publish", "versions:promote", "builds:trigger", "builds:create"];
     };
     readonly "domains:read": {
         readonly covers: readonly [];
@@ -61,6 +73,18 @@ declare const OAUTH_SCOPE_GRAPH: {
         readonly covers: readonly ["domains:read"];
         readonly actions: readonly ["domains:create", "domains:verify", "domains:assign", "domains:bind", "domains:delete", "domains:dns.write", "domains:purchase"];
     };
+    readonly "connectors:read": {
+        readonly covers: readonly [];
+        readonly actions: readonly ["connectors:read"];
+    };
+    readonly "connectors:write": {
+        readonly covers: readonly ["connectors:read"];
+        readonly actions: readonly ["connectors:write"];
+    };
+    readonly "connectors:execute": {
+        readonly covers: readonly ["connectors:read"];
+        readonly actions: readonly ["connectors:execute"];
+    };
     readonly "spaces:publish": {
         readonly covers: readonly [];
         readonly actions: readonly ["spaces:publish"];
@@ -77,7 +101,7 @@ export declare function oauthScopeHasActions(scope: string): scope is OAuthScope
  * dashboard and CLI offer per machine OAuth client. Derived from the graph's
  * own order so the label list reads the way the consent screen does.
  */
-export declare const OAUTH_PRIMARY_SCOPES: ("teams:read" | "teams:create" | "spaces:read" | "spaces:write" | "spaces:rename" | "publish:write" | "domains:read" | "domains:write" | "spaces:publish" | "builds:trigger")[];
+export declare const OAUTH_PRIMARY_SCOPES: ("teams:read" | "teams:create" | "teams:members.write" | "spaces:read" | "spaces:write" | "spaces:rename" | "spaces:delete" | "versions:download" | "publish:write" | "domains:read" | "domains:write" | "connectors:read" | "connectors:write" | "connectors:execute" | "spaces:publish" | "builds:trigger")[];
 /** Every action a scope grants, including the scopes it subsumes. */
 export declare function oauthScopeActionsFor(scope: OAuthScopeWithActions): StatticAction[];
 /** Every action a set of scopes grants together. Unknown scopes grant nothing. */

package/dist/contracts/oauth-scope-actions.js

@@ -37,26 +37,23 @@ export function isTenantAdmissionAction(action) {
 const OAUTH_SCOPE_GRAPH = {
     "teams:read": { covers: [], actions: ["teams:read"] },
     "teams:create": { covers: [], actions: ["teams:create"] },
+    "teams:members.write": { covers: ["teams:read"], actions: ["teams:members.write"] },
     "spaces:read": {
         covers: [],
         actions: ["spaces:read", "versions:read", "builds:read"],
     },
     "spaces:write": { covers: [], actions: ["spaces:create", "spaces:write"] },
     "spaces:rename": { covers: [], actions: ["spaces:rename"] },
+    "spaces:delete": { covers: [], actions: ["spaces:delete"] },
+    "versions:download": { covers: [], actions: ["versions:download"] },
     // The publish tier is read + write plus the version and build verbs a
     // publish flow needs. `spaces:publish` and `builds:trigger` are also offered
     // on their own as granular API-resource scopes; they stay listed here as
     // publish's own actions so a policy holding nothing but them still labels as
     // a publisher.
     "publish:write": {
-        covers: ["spaces:read", "spaces:write"],
-        actions: [
-            "spaces:publish",
-            "versions:promote",
-            "versions:download",
-            "builds:trigger",
-            "builds:create",
-        ],
+        covers: ["spaces:read", "spaces:write", "versions:download"],
+        actions: ["spaces:publish", "versions:promote", "builds:trigger", "builds:create"],
     },
     "domains:read": { covers: [], actions: ["domains:read"] },
     "domains:write": {
@@ -71,6 +68,19 @@ const OAUTH_SCOPE_GRAPH = {
             "domains:purchase",
         ],
     },
+    // Connectors. `write` and `execute` both cover `read` but not each other:
+    // wiring a service up and acting through it are different authorities, and an
+    // agent that only has to call a tool never earns the right to connect a new
+    // account.
+    "connectors:read": { covers: [], actions: ["connectors:read"] },
+    "connectors:write": {
+        covers: ["connectors:read"],
+        actions: ["connectors:write"],
+    },
+    "connectors:execute": {
+        covers: ["connectors:read"],
+        actions: ["connectors:execute"],
+    },
     // Granular API-resource scopes. They never label a policy on their own — the
     // inverse only ranges over the primary scopes below.
     "spaces:publish": { covers: [], actions: ["spaces:publish"] },

package/dist/contracts/operations.d.ts

@@ -171,8 +171,8 @@ export declare const superadminOperationListQuerySchema: z.ZodObject<{
         ready: "ready";
         running: "running";
         succeeded: "succeeded";
-        scheduled: "scheduled";
         blocked: "blocked";
+        scheduled: "scheduled";
         stuck: "stuck";
         retrying: "retrying";
     }>>;