@standards/schema 1.0.0-alpha.418 → 1.0.0-alpha.419

package/dist/{index-B_nj48YC.d.mts → index-D59FeAd4.d.mts}

@@ -1,7 +1,7 @@
 
-import { SchemaError, SchemaErrorCode, ValidationError } from "./exceptions-BQiNZXm5.mjs";
-import { TenantId, Uuid } from "./utils-Cb1wqWLJ.mjs";
-import { ActivityContentDefinition, Attribute, AttributeType, BLOCK_PERIODS, BilateralConfig, BlockContext, BlockDefinition, BlockInput, BlockWidth, CheckboxAttribute, CollectionAction, CollectionContentDefinition, CollectionContentSource, ColumnReference, ContentConfiguration, ContentCreateMode, ContentField, ContentFieldGroup, ContentOpenMode, ContentViewContext, ContentViewDefinition, Currency, CurrencyAttribute, CustomContentDefinition, DateAttribute, DatePrecision, DateRangeValue, DocumentAttribute, DocumentLayout, DocumentsContentDefinition, DynamicValue, Eager, EmailsContentDefinition, FilterOperator, FilterRule, FilterState, FilterValue, FormContentDefinition, FormDensity, FormsContentDefinition, FormulaAttribute, FormulaReturnType, GridPosition, GridViolation, HeightMode, ImageShape, InferAttributeValue, InferQualifiedProps, InputShape, LayoutTraits, ListViewTabVisibility, ListableBlockInput, Location, LocationAttribute, LocationGranularity, MeetingsContentDefinition, MultiRelationAttribute, MultiselectAttribute, NumberAttribute, ObjectBuilderLike, ObjectDefinition, ObjectImage, ObjectRecord, ObjectViewContext, ObjectViewDefinition, Option, PageContentDefinition, PageViewDefinition, Phone, PhoneAttribute, PropertyAttribute, PropertySchema, QualifiedDocumentAttributeBuilder, QualifiedDocumentBrand, QueryState, RecordAppearance, RecordListScope, RecordMetadata, RecordQuery, RecordQueryDefinition, RelationAttribute, RelationTarget, RelativeDateValue, ResourceVisibility, RichtextAttribute, RichtextContentDefinition, RollupAttribute, RollupFunction, SelectAttribute, SingleRelationAttribute, SortRule, StatusAttribute, TextAttribute, TimeFormat, Timestamps, UpdateObjectInput, UserAttribute, UserReferenceType, ViewContentDefinition, ViewRead, ViewerAccess, WithCustomAttributes, WithCustomRecordAttributes, WithoutSystemFields } from "./all-C-tG86Pt.mjs";
+import { SchemaError, SchemaErrorCode, ValidationError } from "./exceptions-C3d0YoMy.mjs";
+import { TenantId, Uuid } from "./utils-Bl7NhRVP.mjs";
+import { ActivityContentDefinition, Attribute, AttributeType, BLOCK_PERIODS, BilateralConfig, BlockContext, BlockDefinition, BlockInput, BlockWidth, CheckboxAttribute, CollectionAction, CollectionContentDefinition, CollectionContentSource, ColumnReference, ContentConfiguration, ContentCreateMode, ContentField, ContentFieldGroup, ContentOpenMode, ContentViewContext, ContentViewDefinition, Currency, CurrencyAttribute, CustomContentDefinition, DateAttribute, DatePrecision, DateRangeValue, DocumentAttribute, DocumentLayout, DocumentsContentDefinition, DynamicValue, Eager, EmailsContentDefinition, FilterOperator, FilterRule, FilterState, FilterValue, FormContentDefinition, FormDensity, FormsContentDefinition, FormulaAttribute, FormulaReturnType, GridPosition, GridViolation, HeightMode, ImageShape, InferAttributeValue, InferQualifiedProps, InputShape, LayoutTraits, ListViewTabVisibility, ListableBlockInput, Location, LocationAttribute, LocationGranularity, MeetingsContentDefinition, MultiRelationAttribute, MultiselectAttribute, NumberAttribute, ObjectBuilderLike, ObjectDefinition, ObjectImage, ObjectRecord, ObjectViewContext, ObjectViewDefinition, Option, PageContentDefinition, PageViewDefinition, Phone, PhoneAttribute, PropertyAttribute, PropertySchema, QualifiedDocumentAttributeBuilder, QualifiedDocumentBrand, QueryState, RecordAppearance, RecordListScope, RecordMetadata, RecordQuery, RecordQueryDefinition, RelationAttribute, RelationTarget, RelativeDateValue, ResourceVisibility, RichtextAttribute, RichtextContentDefinition, RollupAttribute, RollupFunction, SelectAttribute, SingleRelationAttribute, SortRule, StatusAttribute, TextAttribute, TimeFormat, Timestamps, UpdateObjectInput, UserAttribute, UserReferenceType, ViewContentDefinition, ViewRead, ViewerAccess, WithCustomAttributes, WithCustomRecordAttributes, WithoutSystemFields } from "./all-CcI67hiC.mjs";
 import * as z$2 from "zod";
 import z, { z as z$1 } from "zod";
 import { ColorId, CountryIso3, CurrencyCode, IconName } from "@standards/constants";
@@ -562,7 +562,13 @@ export interface OperationDefinition {
   method: HttpMethod;
   path: `/${string}`;
   input: z$1.ZodType;
-  output: OutputType<unknown>;
+  /**
+   * The answer: a zod schema (preferred) validated by the server and decoded
+   * by the client, or a type-only `type<T>()` nothing checks. A schema's
+   * input side is the JSON on the wire, its output side the value both the
+   * handler and the client hold (`isoDateTime`: an ISO string, a `Date`).
+   */
+  output: z$1.ZodType | OutputType<unknown>;
   permission?: OperationPermission;
   status?: OperationStatus;
   throttle?: OperationThrottle;
@@ -643,16 +649,22 @@ export type OperationInput<O extends {
 export type OperationParsedInput<O extends {
   input: z$1.ZodType;
 }> = WithUpload<O, z$1.output<O["input"]>, UploadedPart, UploadedPart>;
-/** What a handler answers. */
+/** What a handler answers, and what a client holds once the body is decoded. */
 export type OperationOutput<O extends {
-  output: OutputType<unknown>;
-}> = O["output"] extends OutputType<infer T> ? T : never;
+  output: z$1.ZodType | OutputType<unknown>;
+}> = OutputOf<O["output"]>;
+/** The JSON on the wire: an output schema's input side; a type-only output's own type. */
+export type OperationWireOutput<O extends {
+  output: z$1.ZodType | OutputType<unknown>;
+}> = WireOf<O["output"]>;
+type OutputOf<X> = X extends z$1.ZodType ? z$1.output<X> : X extends OutputType<infer T> ? T : never;
+type WireOf<X> = X extends z$1.ZodType ? z$1.input<X> : OutputOf<X>;
 /**
  * What a client receives: the handler's output, a `DownloadedFile` for bytes,
  * the open `Response` for events.
  */
 export type OperationResult<O extends {
-  output: OutputType<unknown>;
+  output: z$1.ZodType | OutputType<unknown>;
 }> = O extends {
   readonly response: "bytes";
 } ? DownloadedFile : O extends {
@@ -679,34 +691,160 @@ export declare function operation<const D extends OperationDefinition>(def: D &
 }): Operation<D>;
 export type ActorType = "user" | "agent" | "api_key" | "system";
 export type ActorStatus = "active" | "suspended" | "deleted";
-interface ActorBase {
-  id: Uuid;
-  tenantId: TenantId;
-  displayName: string;
-  avatarUrl?: string | null;
-  metadata: Record<string, unknown>;
-  deletedAt?: Date | null;
-  anonymizedAt?: Date | null;
-  createdAt: Date;
-  updatedAt: Date;
-}
 type SubjectActorType = Exclude<ActorType, "system">;
-type ActiveActorStatus = Exclude<ActorStatus, "deleted">;
-type ActiveSubjectActor = { [Type in SubjectActorType]: { [Status in ActiveActorStatus]: {
-  type: Type;
-  status: Status;
-  subjectId: Uuid;
-}; }[ActiveActorStatus]; }[SubjectActorType];
-type DeletedSubjectActor = { [Type in SubjectActorType]: {
-  type: Type;
-  status: "deleted";
-  subjectId: Uuid | null;
-}; }[SubjectActorType];
-export type Actor = (ActorBase & ActiveSubjectActor) | (ActorBase & DeletedSubjectActor) | (ActorBase & {
-  type: "system";
-  status: ActorStatus;
-  subjectId?: null;
-});
+/**
+ * An actor as every answer carries it, one branch per type and status so the
+ * type narrows on both (a discriminated union on `type`, then on `status`, so
+ * a check reads two keys rather than trying every branch): a subject actor
+ * names its subject until it is deleted (then the subject may be gone); the
+ * system actor has none. Timestamps travel as ISO strings and read as `Date`
+ * (`isoDateTime`).
+ */
+export declare const actorSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"user">;
+  status: z$2.ZodLiteral<"active">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"user">;
+  status: z$2.ZodLiteral<"suspended">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"user">;
+  status: z$2.ZodLiteral<"deleted">;
+  subjectId: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>], "status">, z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"agent">;
+  status: z$2.ZodLiteral<"active">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"agent">;
+  status: z$2.ZodLiteral<"suspended">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"agent">;
+  status: z$2.ZodLiteral<"deleted">;
+  subjectId: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>], "status">, z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"api_key">;
+  status: z$2.ZodLiteral<"active">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"api_key">;
+  status: z$2.ZodLiteral<"suspended">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"api_key">;
+  status: z$2.ZodLiteral<"deleted">;
+  subjectId: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>], "status">, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  type: z$2.ZodLiteral<"system">;
+  status: z$2.ZodEnum<{
+    active: "active";
+    deleted: "deleted";
+    suspended: "suspended";
+  }>;
+  subjectId: z$2.ZodOptional<z$2.ZodNull>;
+}, z$2.core.$strip>], "type">;
+export type Actor = z$2.output<typeof actorSchema>;
 interface CreateActorInputBase {
   displayName: string;
   avatarUrl?: string | null;
@@ -2096,15 +2234,32 @@ export interface InstalledBundleSummary {
   mode: BundleMode;
   /** `null` for an added bundle. */
   origin: BundleOrigin | null;
-  /** The version the workspace holds; `null` for an added bundle. */
+  /**
+   * The version the workspace holds: the applied one for a synced bundle, the
+   * offered one it was added or last updated from for an added bundle; `null`
+   * for an added bundle recorded before its baseline.
+   */
   hash: string | null;
-  /** Names of the bundles a synced bundle uses; empty for an added one. */
+  /** Names of the bundles it uses, as recorded when it was synced, added or updated. */
   uses: string[];
   installedAt: string;
   updatedAt: string;
   /** The actor who installed it; `null` when the system did. */
   installedBy: string | null;
 }
+/**
+ * Where an installed bundle stands: `repair` while a piece it installed no
+ * longer exists, `update` when the host offers another version than the one
+ * it holds, `current` otherwise (and always for a synced bundle or one the
+ * host no longer offers).
+ */
+export type BundleStatus = "current" | "update" | "repair";
+/** One installed bundle as `bundles.status` answers it: its status and the bundles that depend on it. */
+export interface BundleStatusEntry {
+  name: string;
+  status: BundleStatus;
+  usedBy: string[];
+}
 /** What a bundle card shows of its pieces, projected from the bundle and the closure it uses. */
 export interface BundleContents {
   /** The objects the bundle declares; `inWorkspace` when the caller already sees one by that name. */
@@ -2224,6 +2379,105 @@ export interface BundleAddPlan {
   /** Ties `bundles.add` to the workspace this preview saw. */
   fingerprint: string;
 }
+/** What an update piece names: a piece, or one part of an installed object (an attribute, an option). */
+export type BundleUpdatePieceKind = "object" | "view" | "page" | "tab" | "agent" | "attribute" | "option";
+/**
+ * How an update treats a piece: `added` (new), `updated` (untouched since the
+ * bundle wrote it), `conflict` (the admin changed it, the bundle too: kept
+ * unless taken), `missing` (gone: reinstalled unless skipped), `notApplied`
+ * (it would lose stored values, or its name is taken).
+ */
+export type BundleUpdateGroup = "added" | "updated" | "conflict" | "missing" | "notApplied";
+/**
+ * Why a piece is `notApplied`, as a code the screen words: `lossy` (the new
+ * type would lose stored values), `required` (it would become required while
+ * records may be empty), `retype` (no update changes a type), `move` (no
+ * update moves a content between placements), `nameTaken` (its name is held,
+ * `reasonName`), `refused` (adding it is refused here).
+ */
+export type BundleUpdateReasonCode = "lossy" | "required" | "retype" | "move" | "nameTaken" | "refused";
+export interface BundleUpdatePiece {
+  pieceId: string;
+  kind: BundleUpdatePieceKind;
+  group: BundleUpdateGroup;
+  label: string;
+  /** Set on a `notApplied` piece. */
+  reasonCode?: BundleUpdateReasonCode;
+  /** The name that is taken, with `reasonCode: "nameTaken"`. */
+  reasonName?: string;
+}
+/** What updating an added bundle would do, and the fingerprint `bundles.update` must carry. */
+export interface BundleUpdatePlan {
+  pieces: BundleUpdatePiece[];
+  /** Ties `bundles.update` to the workspace this preview saw. */
+  fingerprint: string;
+}
+/**
+ * What uninstalling an added bundle would delete, counted as the system (a
+ * piece another member made private shows in the totals, never by name), and
+ * the fingerprint `bundles.remove` must carry. `blockedBy` names the bundles
+ * that use it: while one does, the uninstall is refused.
+ */
+export interface BundleRemovalPreview {
+  blockedBy: string[];
+  /** Each object that goes, with every one of its records: private and trashed ones included. */
+  objects: {
+    name: string;
+    label: string;
+    records: number;
+  }[];
+  /** The views on those objects the bundle did not write, any owner's, which go with them. */
+  views: number;
+  /**
+   * The contents on views that stay that go too, on views the caller sees: a
+   * tab opening one of its pages, or one reading what goes, the admin's own
+   * included. The view stays, unless it is in `emptiedViews`.
+   */
+  viewContents: {
+    viewLabel: string;
+    contentLabel: string;
+  }[];
+  /** The same contents on views the caller cannot see: counted, never named. */
+  hiddenViewContents: number;
+  pages: number;
+  routines: number;
+  agents: number;
+  /** The skills that will be purged: never one the workspace held before, nor one another bundle installed. */
+  skills: number;
+  /** The relations of objects outside the bundle that point at its objects: removed, their records kept. */
+  inboundRelations: {
+    objectLabel: string;
+    attributeLabel: string;
+  }[];
+  /** The computed fields of objects outside the bundle that read what goes: removed, their records kept. */
+  computedAttributes: {
+    objectLabel: string;
+    attributeLabel: string;
+  }[];
+  /** The relations outside the bundle that also target another object: they keep it and lose its objects. */
+  prunedRelations: {
+    objectLabel: string;
+    attributeLabel: string;
+  }[];
+  /** The views that stay no longer: every main content they held goes, the rest with them. */
+  emptiedViews: {
+    viewLabel: string;
+  }[];
+  /**
+   * What an uninstall does not rewrite and would leave broken: an object's
+   * label or embedding naming a field that goes (`objectLabel` alone), a kept
+   * relation's display or filter naming one (`attributeLabel`),
+   * or a default view left with no main content (`viewLabel`). While one
+   * stands, the uninstall is refused, as under `blockedBy`.
+   */
+  citedBy: {
+    objectLabel: string;
+    attributeLabel?: string;
+    viewLabel?: string;
+  }[];
+  /** Ties `bundles.remove` to the pieces, relations and views this preview saw (not the record counts). */
+  fingerprint: string;
+}
 /** What adding wrote: one entry per object, view or agent created, under the bundle that declares it. */
 export interface BundleAddResult {
   added: {
@@ -4258,6 +4512,11 @@ export interface EnvironmentHarness {
   readonly provider: ProviderName;
   /** The variable that carries the harness's API key (read from the Variables, spec §3.2). */
   readonly apiKeyEnv: string;
+  /**
+   * The variable that carries a subscription sign-in token, when the harness
+   * accepts one (Claude Code `claude setup-token`). The API key wins when both are set.
+   */
+  readonly oauthTokenEnv?: string;
   readonly models: readonly EnvironmentHarnessModel[];
   readonly defaultModel: string;
 }
@@ -4266,6 +4525,7 @@ export declare const ENVIRONMENT_HARNESSES: readonly [{
   readonly label: "Claude Code";
   readonly provider: "anthropic";
   readonly apiKeyEnv: "ANTHROPIC_API_KEY";
+  readonly oauthTokenEnv: "CLAUDE_CODE_OAUTH_TOKEN";
   readonly models: readonly [{
     readonly id: "sonnet";
     readonly label: "Claude Sonnet";
@@ -4496,8 +4756,9 @@ export type ConnectorScope = "actor" | "tenant";
 export interface StartConnectorAuthInput {
   provider: ConnectorProviderId;
   scope: ConnectorScope;
-  /** Page the callback 302s back to. Must match a configured allowed origin; otherwise silently ignored. */
+  /** Page the callback 302s back to, on a configured allowed origin. Exactly one of this or `mode`. */
   returnUrl?: string;
+  mode?: "desktop";
   /** Beyond `read`, which is always requested. */
   capabilities?: Exclude<ConnectorCapability, "read">[];
   /**
@@ -4506,10 +4767,6 @@ export interface StartConnectorAuthInput {
    */
   loginHint?: string;
 }
-/** Result of starting an OAuth flow — the URL the browser must visit. */
-export interface StartConnectorAuthResult {
-  authorizeUrl: string;
-}
 /**
  * Providers this deployment holds OAuth credentials for. A provider absent from
  * the list cannot start an authorization flow, so its card is not offered.
@@ -4530,15 +4787,7 @@ export interface AddSharedMailboxInput {
   /** Visibility of the synced emails: tenant (default UX) or only the adding actor. */
   scope: ConnectorScope;
 }
-/** Query params the OAuth callback redirect appends to the return URL. */
-export declare const CONNECTOR_CALLBACK_PARAM: {
-  readonly status: "connector_status";
-  readonly error: "connector_error";
-  readonly provider: "connector_provider";
-  /** The `QuotaKey` that refused the connection, with `error` at `QUOTA_EXCEEDED`. */
-  readonly quota: "connector_quota";
-};
-/** Values `CONNECTOR_CALLBACK_PARAM.status` can take on the redirect. */
+/** How a connector's consent ended, as the app's surfaces read it. */
 export type ConnectorCallbackStatusValue = "connected" | "error";
 /** The unified verbs an agent calls on typed references. */
 export declare const VERB_NAMES: readonly ["search", "query", "read", "write", "delete", "organize", "copy", "send"];
@@ -8591,7 +8840,7 @@ export type AuditResourceType = (typeof AUDIT_RESOURCE_TYPES)[number];
 /**
  * Actions that can be audited
  */
-export declare const AUDIT_ACTIONS: readonly ["record.created", "record.updated", "record.deleted", "record.restored", "record.purged", "record.access_changed", "agent.access_changed", "agent_session.supervised_read", "object.created", "object.updated", "object.deleted", "attribute.created", "attribute.updated", "attribute.deleted", "view.created", "view.updated", "view.deleted", "bundle.synced", "bundle.removed", "bundle.added", "user.created", "user.invited", "user.updated", "user.deleted", "user.login", "user.logout", "tenant_invitation.created", "tenant_invitation.delivery_failed", "tenant_invitation.resent", "tenant_invitation.revoked", "tenant_invitation.accepted", "role.created", "role.updated", "role.deleted", "role.assigned", "role.revoked", "api_key.detached", "settings.updated", "file.uploaded", "file.updated", "file.deleted"];
+export declare const AUDIT_ACTIONS: readonly ["record.created", "record.updated", "record.deleted", "record.restored", "record.purged", "record.access_changed", "agent.access_changed", "agent_session.supervised_read", "object.created", "object.updated", "object.deleted", "attribute.created", "attribute.updated", "attribute.deleted", "view.created", "view.updated", "view.deleted", "bundle.synced", "bundle.removed", "bundle.added", "bundle.updated", "user.created", "user.invited", "user.updated", "user.deleted", "user.login", "user.logout", "tenant_invitation.created", "tenant_invitation.delivery_failed", "tenant_invitation.resent", "tenant_invitation.revoked", "tenant_invitation.accepted", "role.created", "role.updated", "role.deleted", "role.assigned", "role.revoked", "api_key.detached", "settings.updated", "file.uploaded", "file.updated", "file.deleted"];
 export type AuditAction = (typeof AUDIT_ACTIONS)[number];
 /**
  * Actor type - who performed the action
@@ -13740,6 +13989,61 @@ export declare function normalizePhoneNumber(phoneNumber: string, countryIso3: C
  * // → "+1 555 123 4567"
  */
 export declare function formatPhoneForDisplay(phone: Phone): string;
+/** How long a ticket can be redeemed. The app counts from receiving it, which errs short by a redirect. */
+export declare const OAUTH_TICKET_TTL_MS = 300000;
+/** Which flow an outbound OAuth attempt serves. */
+export type OAuthKind = "connector" | "mcp";
+export type OAuthAttemptStatus = "preparing" | "pending" | "returned" | "exchanging" | "choosing" | "completed" | "failed" | "expired";
+/** Where the browser lands after consent: a web return URL, or the desktop shell. */
+export interface OAuthCompletionInput {
+  returnUrl?: string;
+  mode?: "desktop";
+}
+/** Answer of every start operation: the page to open and when the attempt lapses. */
+export interface OAuthAttemptStarted {
+  attemptId: string;
+  authorizeUrl: string;
+  expiresAt: string;
+}
+/** The GitHub App installations the person can bind, and where to install another. */
+export interface GitHubInstallationChoice {
+  installations: {
+    id: string;
+    login?: string;
+  }[];
+  installUrl: string;
+}
+/** Authenticated projection of an attempt; `errorCode` is a stable reason, never provider text. */
+export interface OAuthAttemptView {
+  attemptId: string;
+  status: OAuthAttemptStatus;
+  kind: OAuthKind;
+  expiresAt: string;
+  result?: Record<string, unknown>;
+  choice?: GitHubInstallationChoice;
+  errorCode?: string;
+}
+/** What completing a ticket or reading an attempt settles on. */
+export type OAuthCompleteOutcome = {
+  status: "completed";
+  attemptId: string;
+  kind: OAuthKind;
+  result: Record<string, unknown>;
+} | {
+  status: "failed";
+  attemptId: string;
+  kind: OAuthKind;
+  errorCode: string;
+  result?: Record<string, unknown>;
+} | ({
+  status: "choose";
+  attemptId: string;
+  kind: "connector";
+} & GitHubInstallationChoice) | {
+  status: "pending";
+  attemptId: string;
+  kind: OAuthKind;
+};
 /** How an MCP server authenticates outbound calls. `oauth` carries no secret
  * on the wire — the tokens stay server-side. */
 export type McpServerAuthType = "none" | "header" | "oauth";
@@ -13811,32 +14115,15 @@ export interface ConnectMcpServerInput {
   auth: McpServerAuthInput;
 }
 /** Starts consent without exposing provider credentials to the browser. */
-export declare enum McpOAuthCompletionMode {
-  Desktop = "desktop"
-}
-export type StartMcpOAuthAttemptInput = Omit<ConnectMcpServerInput, "auth"> & {
-  completionMode?: McpOAuthCompletionMode;
-  returnUrl?: string;
-};
-export interface ReconnectMcpOAuthAttemptInput {
+export type StartMcpOAuthAttemptInput = Omit<ConnectMcpServerInput, "auth"> & OAuthCompletionInput;
+export interface ReconnectMcpOAuthAttemptInput extends OAuthCompletionInput {
   scope?: string;
-  completionMode?: McpOAuthCompletionMode;
-  returnUrl?: string;
 }
-export type McpOAuthAttemptStatus = "preparing" | "pending" | "exchanging" | "completed" | "failed" | "expired";
 export interface McpOAuthAttemptStarted {
   attemptId: string;
   authorizeUrl: string;
   expiresAt: string;
 }
-/** Authenticated projection; errorCode is a stable reason, never provider text. */
-export interface McpOAuthAttemptView {
-  attemptId: string;
-  status: McpOAuthAttemptStatus;
-  serverId?: string;
-  errorCode?: string;
-  expiresAt: string;
-}
 export type EmailCategoryScope = "personal" | "workspace";
 export type EmailClassifiedBy = "model" | "rule" | "manual";
 export type EmailRuleScope = "address" | "domain";