@spacefast/common 0.2.2 → 0.4.1

package/dist/contracts/builds.d.ts

@@ -63,7 +63,6 @@ declare const InternalBuildInputSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     ref: z.ZodString;
     commit: z.ZodOptional<z.ZodString>;
     branch: z.ZodOptional<z.ZodString>;
-    pullRequestNumber: z.ZodOptional<z.ZodNumber>;
     repository: z.ZodOptional<z.ZodObject<{
         provider: z.ZodString;
         repositoryId: z.ZodNullable<z.ZodString>;
@@ -96,7 +95,6 @@ export declare const BuildCreateInputSchema: z.ZodDiscriminatedUnion<[z.ZodObjec
     ref: z.ZodOptional<z.ZodString>;
     commit: z.ZodOptional<z.ZodString>;
     branch: z.ZodOptional<z.ZodString>;
-    pullRequestNumber: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>], "kind">;
 declare const buildExecutionLaunchSchema: z.ZodObject<{
     state: z.ZodEnum<{
@@ -259,7 +257,6 @@ export declare const buildCreateRequestSchema: z.ZodObject<{
         ref: z.ZodOptional<z.ZodString>;
         commit: z.ZodOptional<z.ZodString>;
         branch: z.ZodOptional<z.ZodString>;
-        pullRequestNumber: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>], "kind">;
     settings: z.ZodOptional<z.ZodObject<{
         rootDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -328,7 +325,6 @@ export declare const spaceBuildCreateRequestSchema: z.ZodDiscriminatedUnion<[z.Z
         ref: z.ZodOptional<z.ZodString>;
         commit: z.ZodOptional<z.ZodString>;
         branch: z.ZodOptional<z.ZodString>;
-        pullRequestNumber: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>], "kind">;
     settings: z.ZodOptional<z.ZodObject<{
         rootDirectory: z.ZodOptional<z.ZodNullable<z.ZodString>>;
@@ -408,6 +404,15 @@ export declare const buildSourceArchiveUploadSchema: z.ZodObject<{
         sha256: z.ZodOptional<z.ZodString>;
         contentType: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
+    bulk: z.ZodOptional<z.ZodObject<{
+        kind: z.ZodLiteral<"zip-cas-v1">;
+        method: z.ZodLiteral<"PUT">;
+        url: z.ZodUnion<[z.ZodString, z.ZodString]>;
+        headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+        maxCompressedBytes: z.ZodNumber;
+        maxExpandedBytes: z.ZodNumber;
+        maxBlobs: z.ZodNumber;
+    }, z.core.$strip>>;
     links: z.ZodObject<{
         refresh: z.ZodString;
         resume: z.ZodOptional<z.ZodString>;
@@ -569,6 +574,15 @@ export declare const buildCreateResponseSchema: z.ZodObject<{
                 sha256: z.ZodOptional<z.ZodString>;
                 contentType: z.ZodOptional<z.ZodString>;
             }, z.core.$strip>>>;
+            bulk: z.ZodOptional<z.ZodObject<{
+                kind: z.ZodLiteral<"zip-cas-v1">;
+                method: z.ZodLiteral<"PUT">;
+                url: z.ZodUnion<[z.ZodString, z.ZodString]>;
+                headers: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+                maxCompressedBytes: z.ZodNumber;
+                maxExpandedBytes: z.ZodNumber;
+                maxBlobs: z.ZodNumber;
+            }, z.core.$strip>>;
             links: z.ZodObject<{
                 refresh: z.ZodString;
                 resume: z.ZodOptional<z.ZodString>;

package/dist/contracts/builds.js

@@ -103,7 +103,6 @@ const InternalBuildInputSchema = z
         ref: z.string().describe("Branch, tag, or ref to build."),
         commit: z.string().optional().describe("Exact commit built, once resolved."),
         branch: z.string().optional().describe("Branch name when the ref is a commit SHA."),
-        pullRequestNumber: z.number().int().positive().optional(),
         repository: z
             .object({
             provider: z.string(),
@@ -161,7 +160,6 @@ export const BuildCreateInputSchema = z
         ref: z.string().optional().describe("Branch, tag, or ref to build."),
         commit: z.string().optional().describe("Exact commit built, once resolved."),
         branch: z.string().optional().describe("Branch name when the ref is a commit SHA."),
-        pullRequestNumber: z.number().int().positive().optional(),
     }),
 ])
     .describe("What a new build should run against.");
@@ -249,12 +247,17 @@ export const buildCreateRequestSchema = z
     .object({
     input: BuildCreateInputSchema,
     settings: BuildSettingsOverrideSchema.optional().describe("Per-run settings overrides, persisted as `settingsSnapshot` after resolution."),
-    target: BuildTargetSchema.partial().optional(),
+    target: BuildTargetSchema.partial()
+        .optional()
+        .describe("Omit to use the Space's channel mapping for the repository ref. Send channel: null or preview: true to prevent automatic promotion. An empty target object also prevents promotion."),
     diagnostics: z
         .array(baseDiagnosticSchema)
         .optional()
         .describe("Diagnostics already known before the build is queued."),
-    wait: z.boolean().default(false),
+    wait: z
+        .boolean()
+        .default(false)
+        .describe("Wait for the build to finish before this request returns. Agents must keep this false and poll the build status. Synchronous clients can set it to true."),
 })
     // Strict so a typo is a validation failure instead of a silently dropped
     // field, and so a body that names a managed `source` can never be read as a

package/dist/contracts/channels.d.ts

@@ -1,4 +1,16 @@
 import { z } from "zod";
+export declare const channelPromotionPolicySchema: z.ZodEnum<{
+    auto: "auto";
+    manual: "manual";
+}>;
+export type ChannelPromotionPolicy = z.infer<typeof channelPromotionPolicySchema>;
+export declare const channelUpdateSchema: z.ZodObject<{
+    promotion: z.ZodEnum<{
+        auto: "auto";
+        manual: "manual";
+    }>;
+}, z.core.$strip>;
+export type ChannelUpdateInput = z.infer<typeof channelUpdateSchema>;
 export declare const channelChangeKindSchema: z.ZodEnum<{
     publish: "publish";
     rollback: "rollback";
@@ -19,6 +31,10 @@ export declare const channelListItemSchema: z.ZodObject<{
     currentVersionId: z.ZodNullable<z.ZodString>;
     currentDeploymentUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     previousVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    promotion: z.ZodEnum<{
+        auto: "auto";
+        manual: "manual";
+    }>;
     updatedAt: z.ZodString;
     lastChange: z.ZodOptional<z.ZodNullable<z.ZodObject<{
         kind: z.ZodNullable<z.ZodEnum<{
@@ -37,6 +53,7 @@ export declare const channelHistoryEntrySchema: z.ZodObject<{
     actorType: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
         system: "system";
         user: "user";
+        visitor: "visitor";
         api_key: "api_key";
         partner_token: "partner_token";
         oauth_client: "oauth_client";
@@ -57,6 +74,10 @@ export declare const channelListResponseSchema: z.ZodObject<{
         currentVersionId: z.ZodNullable<z.ZodString>;
         currentDeploymentUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         previousVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        promotion: z.ZodEnum<{
+            auto: "auto";
+            manual: "manual";
+        }>;
         updatedAt: z.ZodString;
         lastChange: z.ZodOptional<z.ZodNullable<z.ZodObject<{
             kind: z.ZodNullable<z.ZodEnum<{
@@ -68,6 +89,27 @@ export declare const channelListResponseSchema: z.ZodObject<{
         }, z.core.$strip>>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+export declare const channelUpdateResponseSchema: z.ZodObject<{
+    data: z.ZodObject<{
+        name: z.ZodString;
+        currentVersionId: z.ZodNullable<z.ZodString>;
+        currentDeploymentUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        previousVersionId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        promotion: z.ZodEnum<{
+            auto: "auto";
+            manual: "manual";
+        }>;
+        updatedAt: z.ZodString;
+        lastChange: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            kind: z.ZodNullable<z.ZodEnum<{
+                publish: "publish";
+                rollback: "rollback";
+                promote: "promote";
+            }>>;
+            at: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
 export declare const channelHistoryResponseSchema: z.ZodObject<{
     data: z.ZodArray<z.ZodObject<{
         versionId: z.ZodString;
@@ -76,6 +118,7 @@ export declare const channelHistoryResponseSchema: z.ZodObject<{
         actorType: z.ZodOptional<z.ZodNullable<z.ZodEnum<{
             system: "system";
             user: "user";
+            visitor: "visitor";
             api_key: "api_key";
             partner_token: "partner_token";
             oauth_client: "oauth_client";

package/dist/contracts/channels.js

@@ -1,7 +1,17 @@
 import { z } from "zod";
-// Channels READ surface (the platform spec "Channels"): a projection over the
-// `channels` table and the `channel.promoted` activity log. No writes:
-// promotion stays owned by the publish/version lifecycle.
+import { activityActorTypeSchema } from "./activity.js";
+// Channels surface (the platform spec "Channels"): a projection over the
+// `channels` table and the `channel.promoted` activity log. The promotion
+// policy is the one write; pointer moves stay owned by the publish/version
+// lifecycle.
+// Publication policy for a channel: "auto" lets implicit paths (publish
+// finalize, build auto-promote) move the pointer; "manual" holds every
+// implicit promotion — only the explicit promote endpoint flips. The
+// trigger side (what builds) lives on the repository connection.
+export const channelPromotionPolicySchema = z.enum(["auto", "manual"]);
+export const channelUpdateSchema = z.object({
+    promotion: channelPromotionPolicySchema.describe("Whether implicit promotion paths may move this channel's pointer."),
+});
 // How a channel pointer moved: a fresh publish going live, a forward promote,
 // or a rollback to an older version. Recorded on the `channel.promoted` event
 // at write time; null on events that predate kind recording.
@@ -30,7 +40,11 @@ export const channelListItemSchema = z.object({
         .nullable()
         .optional()
         .describe("Last version this channel served before the current pointer (rollback target)."),
-    updatedAt: z.string().datetime().describe("Instant when this channel pointer last moved."),
+    promotion: channelPromotionPolicySchema.describe("auto: publishes and green builds go live; manual: only explicit promotion moves the pointer."),
+    updatedAt: z
+        .string()
+        .datetime()
+        .describe("Instant this channel last changed: a pointer move or a promotion policy change. `lastChange.at` is the pointer-move instant alone."),
     lastChange: channelLastChangeSchema
         .nullable()
         .optional()
@@ -46,8 +60,7 @@ export const channelHistoryEntrySchema = z.object({
         .nullable()
         .optional()
         .describe("Version the channel served immediately before this promotion."),
-    actorType: z
-        .enum(["user", "api_key", "partner_token", "oauth_client", "anonymous_claim", "system"])
+    actorType: activityActorTypeSchema
         .nullable()
         .optional()
         .describe("Kind of actor that performed the promotion."),
@@ -61,6 +74,9 @@ export const channelHistoryEntrySchema = z.object({
 export const channelListResponseSchema = z.object({
     data: z.array(channelListItemSchema),
 });
+export const channelUpdateResponseSchema = z.object({
+    data: channelListItemSchema,
+});
 export const channelHistoryResponseSchema = z.object({
     data: z.array(channelHistoryEntrySchema),
 });

package/dist/contracts/comments.d.ts

@@ -300,6 +300,55 @@ export declare const commentAuthorSchema: z.ZodObject<{
     color: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
 export declare const commentTargetSchema: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+/**
+ * Where a comment's anchor was captured. Mirrors `AnchorSource` in
+ * `@spacefast/collab-sdk` — snake_case because this is the stored shape, not a
+ * platform resource.
+ */
+export declare const commentAnchorSourceSchema: z.ZodObject<{
+    space_id: z.ZodString;
+    version_id: z.ZodNullable<z.ZodString>;
+    canonical_path: z.ZodString;
+    url: z.ZodString;
+}, z.core.$strip>;
+/**
+ * A comment anchored to a file, rather than to something a page rendered.
+ *
+ * The wire `target` stays free-form: Cast stores whatever the producer sent and
+ * the API passes it through unread. THIS is what producers build and consumers
+ * parse, so "is this thread about a file, and which lines" is one answer with
+ * one shape instead of a guess per reader.
+ *
+ * Lines are inclusive and 1-based, the coordinates a diff, a stack trace and a
+ * `path:line` link already use.
+ */
+export declare const commentFileAnchorSchema: z.ZodObject<{
+    v: z.ZodLiteral<2>;
+    resolver_version: z.ZodNumber;
+    type: z.ZodLiteral<"file">;
+    source: z.ZodObject<{
+        space_id: z.ZodString;
+        version_id: z.ZodNullable<z.ZodString>;
+        canonical_path: z.ZodString;
+        url: z.ZodString;
+    }, z.core.$strip>;
+    file: z.ZodObject<{
+        path: z.ZodString;
+        lines: z.ZodOptional<z.ZodObject<{
+            start: z.ZodNumber;
+            end: z.ZodNumber;
+        }, z.core.$strip>>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type CommentFileAnchor = z.infer<typeof commentFileAnchorSchema>;
+/**
+ * The file a target names, or null when it is not a file anchor.
+ *
+ * Total on purpose: every reader of `target` faces free-form JSON, and this is
+ * the one place that decides whether it is a file anchor. A malformed one is
+ * "not a file anchor", never a throw.
+ */
+export declare function commentFileAnchorPath(target: unknown): string | null;
 /**
  * How many attachments one thread or reply may carry. Mirrors Cast's
  * `@attachment_limit`: Cast enforces it on write, this is what REST readers get.

package/dist/contracts/comments.js

@@ -348,6 +348,58 @@ export const commentAuthorSchema = z.object({
     color: z.string().max(64).nullable(),
 });
 export const commentTargetSchema = z.record(z.string(), z.unknown()).nullable();
+/**
+ * Where a comment's anchor was captured. Mirrors `AnchorSource` in
+ * `@spacefast/collab-sdk` — snake_case because this is the stored shape, not a
+ * platform resource.
+ */
+export const commentAnchorSourceSchema = z.object({
+    space_id: z.string().min(1),
+    version_id: z.string().min(1).nullable(),
+    canonical_path: z.string().max(COMMENT_PAGE_PATH_MAX_LENGTH),
+    url: z.string().max(2_048),
+});
+/**
+ * A comment anchored to a file, rather than to something a page rendered.
+ *
+ * The wire `target` stays free-form: Cast stores whatever the producer sent and
+ * the API passes it through unread. THIS is what producers build and consumers
+ * parse, so "is this thread about a file, and which lines" is one answer with
+ * one shape instead of a guess per reader.
+ *
+ * Lines are inclusive and 1-based, the coordinates a diff, a stack trace and a
+ * `path:line` link already use.
+ */
+export const commentFileAnchorSchema = z.object({
+    v: z.literal(2),
+    resolver_version: z.number().int().positive(),
+    type: z.literal("file"),
+    source: commentAnchorSourceSchema,
+    file: z.object({
+        path: z.string().min(1).max(COMMENT_PAGE_PATH_MAX_LENGTH),
+        lines: z
+            .object({
+            start: z.number().int().min(1),
+            end: z.number().int().min(1),
+        })
+            .refine((lines) => lines.end >= lines.start, {
+            message: "Line ranges must end at or after they start.",
+        })
+            .optional(),
+    }),
+});
+/**
+ * The file a target names, or null when it is not a file anchor.
+ *
+ * Total on purpose: every reader of `target` faces free-form JSON, and this is
+ * the one place that decides whether it is a file anchor. A malformed one is
+ * "not a file anchor", never a throw.
+ */
+// oxlint-disable-next-line anti-slop/no-unknown-parameters -- the wire target is deliberately free-form; deciding what it is is this function's whole job.
+export function commentFileAnchorPath(target) {
+    const parsed = commentFileAnchorSchema.safeParse(target);
+    return parsed.success ? parsed.data.file.path : null;
+}
 /**
  * How many attachments one thread or reply may carry. Mirrors Cast's
  * `@attachment_limit`: Cast enforces it on write, this is what REST readers get.
@@ -454,9 +506,16 @@ export const commentListQuerySchema = cursorListQuerySchema.extend({
         .describe("Return only threads that have unread comments for the caller."),
 });
 export const commentCreateSchema = z.object({
-    pagePath: z.string().min(1).max(COMMENT_PAGE_PATH_MAX_LENGTH).default("/"),
+    pagePath: z
+        .string()
+        .min(1)
+        .max(COMMENT_PAGE_PATH_MAX_LENGTH)
+        .default("/")
+        .describe("Page the thread is anchored to. Ignored when `target` is a file anchor: that anchor's `file.path` is the page path, so the thread is always filed under the file it is about."),
     body: z.string().min(1).max(16_000),
-    target: commentTargetSchema.optional(),
+    target: commentTargetSchema
+        .optional()
+        .describe("Where in the page or file this thread points. Stored and returned unread, so producers and consumers agree on its shape between themselves; a file anchor is the one shape the API itself recognizes."),
     idempotencyKey: z.string().min(1).max(320).optional(),
 });
 export const commentReplySchema = z.object({

package/dist/contracts/commerce.d.ts

@@ -32,13 +32,16 @@ export declare const PLAN_CATALOG_CAPS: {
 };
 export declare const QUOTA_ENFORCEMENT_POLICIES: readonly ["warn", "block"];
 export declare const quotaEnforcementPolicySchema: z.ZodEnum<{
-    warn: "warn";
     block: "block";
+    warn: "warn";
 }>;
 export type QuotaEnforcementPolicy = z.infer<typeof quotaEnforcementPolicySchema>;
 export declare const planCatalogEntrySchema: z.ZodObject<{
     features: z.ZodArray<z.ZodEnum<{
+        connectors: "connectors";
         zero: "zero";
+        tags: "tags";
+        functions: "functions";
         "plans.paid.available": "plans.paid.available";
         "anonymous.publishing": "anonymous.publishing";
         "beta.enrollment_gate": "beta.enrollment_gate";
@@ -51,11 +54,10 @@ export declare const planCatalogEntrySchema: z.ZodObject<{
         "collab.notices": "collab.notices";
         "collab.comments": "collab.comments";
         "content.managed": "content.managed";
-        "sites.dedicated_runtime": "sites.dedicated_runtime";
         "collab.drawing": "collab.drawing";
-        tags: "tags";
-        functions: "functions";
+        "sites.jetpack": "sites.jetpack";
         "spaces.slug_rename": "spaces.slug_rename";
+        "content.users": "content.users";
         "pages.templates": "pages.templates";
         "branding.hide": "branding.hide";
     }>>;
@@ -66,14 +68,17 @@ export declare const planCatalogEntrySchema: z.ZodObject<{
         customDomains: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>;
     quotaPolicy: z.ZodOptional<z.ZodEnum<{
-        warn: "warn";
         block: "block";
+        warn: "warn";
     }>>;
 }, z.core.$strict>;
 export type PlanCatalogEntry = z.infer<typeof planCatalogEntrySchema>;
 export declare const planCatalogSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
     features: z.ZodArray<z.ZodEnum<{
+        connectors: "connectors";
         zero: "zero";
+        tags: "tags";
+        functions: "functions";
         "plans.paid.available": "plans.paid.available";
         "anonymous.publishing": "anonymous.publishing";
         "beta.enrollment_gate": "beta.enrollment_gate";
@@ -86,11 +91,10 @@ export declare const planCatalogSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
         "collab.notices": "collab.notices";
         "collab.comments": "collab.comments";
         "content.managed": "content.managed";
-        "sites.dedicated_runtime": "sites.dedicated_runtime";
         "collab.drawing": "collab.drawing";
-        tags: "tags";
-        functions: "functions";
+        "sites.jetpack": "sites.jetpack";
         "spaces.slug_rename": "spaces.slug_rename";
+        "content.users": "content.users";
         "pages.templates": "pages.templates";
         "branding.hide": "branding.hide";
     }>>;
@@ -101,8 +105,8 @@ export declare const planCatalogSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
         customDomains: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>;
     quotaPolicy: z.ZodOptional<z.ZodEnum<{
-        warn: "warn";
         block: "block";
+        warn: "warn";
     }>>;
 }, z.core.$strict>>;
 export type PlanCatalog = z.infer<typeof planCatalogSchema>;
@@ -110,7 +114,10 @@ export declare const defaultPlanNameSchema: z.ZodString;
 export declare const materializedPlanCatalogSchema: z.ZodObject<{
     plans: z.ZodRecord<z.ZodString, z.ZodObject<{
         features: z.ZodArray<z.ZodEnum<{
+            connectors: "connectors";
             zero: "zero";
+            tags: "tags";
+            functions: "functions";
             "plans.paid.available": "plans.paid.available";
             "anonymous.publishing": "anonymous.publishing";
             "beta.enrollment_gate": "beta.enrollment_gate";
@@ -123,11 +130,10 @@ export declare const materializedPlanCatalogSchema: z.ZodObject<{
             "collab.notices": "collab.notices";
             "collab.comments": "collab.comments";
             "content.managed": "content.managed";
-            "sites.dedicated_runtime": "sites.dedicated_runtime";
             "collab.drawing": "collab.drawing";
-            tags: "tags";
-            functions: "functions";
+            "sites.jetpack": "sites.jetpack";
             "spaces.slug_rename": "spaces.slug_rename";
+            "content.users": "content.users";
             "pages.templates": "pages.templates";
             "branding.hide": "branding.hide";
         }>>;
@@ -138,8 +144,8 @@ export declare const materializedPlanCatalogSchema: z.ZodObject<{
             customDomains: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>;
         quotaPolicy: z.ZodOptional<z.ZodEnum<{
-            warn: "warn";
             block: "block";
+            warn: "warn";
         }>>;
     }, z.core.$strict>>;
     defaultPlan: z.ZodNullable<z.ZodString>;

package/dist/contracts/connector-access.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+/**
+ * ACCESS narrowing for connectors, stored on the credential (api key row /
+ * auth grant). Absent (null) means the default derivation applies: a credential
+ * holding `connectors:*` scopes may use the team's shared connections plus —
+ * when a human subject is attached — that member's own personal connections.
+ *
+ * `explicit` narrows a credential to specific connections; it is how a
+ * third-party OAuth client or a narrow agent token is granted "this Linear and
+ * nothing else". Enforcement happens at credential resolution inside the
+ * connectors module, never in route handlers.
+ */
+export declare const ConnectorAccessScopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"all">;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"explicit">;
+    connectionIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>], "kind">;
+export type ConnectorAccessScope = z.infer<typeof ConnectorAccessScopeSchema>;
+/** PATCH body fragment for credentials that can carry connector access. */
+export declare const connectorAccessPatchSchema: z.ZodObject<{
+    connectorAccess: z.ZodOptional<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"all">;
+    }, z.core.$strip>, z.ZodObject<{
+        kind: z.ZodLiteral<"explicit">;
+        connectionIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>], "kind">>>;
+}, z.core.$strip>;

package/dist/contracts/connector-access.js

@@ -0,0 +1,31 @@
+import { z } from "zod";
+/**
+ * ACCESS narrowing for connectors, stored on the credential (api key row /
+ * auth grant). Absent (null) means the default derivation applies: a credential
+ * holding `connectors:*` scopes may use the team's shared connections plus —
+ * when a human subject is attached — that member's own personal connections.
+ *
+ * `explicit` narrows a credential to specific connections; it is how a
+ * third-party OAuth client or a narrow agent token is granted "this Linear and
+ * nothing else". Enforcement happens at credential resolution inside the
+ * connectors module, never in route handlers.
+ */
+export const ConnectorAccessScopeSchema = z.discriminatedUnion("kind", [
+    z
+        .object({ kind: z.literal("all") })
+        .describe("Team connections plus the caller's own personal connections."),
+    z.object({
+        kind: z.literal("explicit"),
+        connectionIds: z
+            .array(z.string())
+            .min(1)
+            .max(200)
+            .describe("Connection ids (`cxn_`) this credential may use. Nothing else resolves."),
+    }),
+]);
+/** PATCH body fragment for credentials that can carry connector access. */
+export const connectorAccessPatchSchema = z.object({
+    connectorAccess: ConnectorAccessScopeSchema.nullable()
+        .optional()
+        .describe("Connector ACCESS narrowing. Null restores the default derivation."),
+});