@tai42/api-client 15.0.0 → 16.0.1

package/src/schemas/backup.ts

@@ -0,0 +1,42 @@
+/** Backup section, document and import-report response schemas. */
+import { z } from 'zod';
+import { fleetReportFanout } from './fleet';
+
+export const backupSections = z.array(z.object({ name: z.string(), secret: z.boolean() }));
+
+/** The exported backup document — validated when the UI reads a picked file. */
+export const backupDocument = z.object({
+  version: z.literal(1),
+  created_at: z.string(),
+  sections: z.record(z.string(), z.unknown()),
+  errors: z.record(z.string(), z.string()).optional(),
+});
+export type BackupDocument = z.infer<typeof backupDocument>;
+
+export const backupImportReport = z.object({
+  ok: z.boolean(),
+  sections: z.record(
+    z.string(),
+    z.object({
+      created: z.number(),
+      updated: z.number(),
+      skipped: z.number(),
+      errors: z.array(z.string()),
+      new_api_keys: z
+        .array(
+          z.object({
+            user_id: z.string(),
+            description: z.string(),
+            api_key: z.string(),
+          }),
+        )
+        .optional(),
+      // The `manifest` and `env` sections apply through the config pipeline, so their
+      // report carries the mode-wrapped fleet `fanout` of the restore's reload; other
+      // sections omit it. Parsed EXPLICITLY so the shared fleet-report handler can
+      // surface a failed restore propagation — otherwise zod would strip it silently.
+      fanout: fleetReportFanout.optional(),
+    }),
+  ),
+});
+export type BackupImportReport = z.infer<typeof backupImportReport>;

package/src/schemas/capabilities.ts

@@ -0,0 +1,87 @@
+/** Caller capability projection and auth-capabilities schemas. */
+import { z } from 'zod';
+import { subMcpMount } from './sub-mcp';
+
+/** A concrete route the caller can reach, with the methods that pass its jq fence. */
+export const routeEntry = z.object({
+  path: z.string(),
+  methods: z.array(z.string()),
+});
+export type RouteEntry = z.infer<typeof routeEntry>;
+
+/**
+ * A dynamic route pattern the caller can reach — a mount/pattern surface not
+ * enumerable into concrete paths, projected only when its scope AND jq admit it.
+ */
+export const patternEntry = z.object({
+  pattern: z.string(),
+  scope_id: z.string(),
+});
+export type PatternEntry = z.infer<typeof patternEntry>;
+
+/**
+ * A sub-MCP mount the caller can reach, with the tools it exposes and its
+ * transport. Shares the {@link subMcpMount} shape with the registry list, adding
+ * the `slug` the projection carries inline (the list keys mounts by slug instead).
+ */
+export const subMcpEntry = subMcpMount.extend({ slug: z.string() });
+export type SubMcpEntry = z.infer<typeof subMcpEntry>;
+
+/**
+ * `GET /api/auth/me` — the caller's derived capability projection: the concrete
+ * (path, method) surface, dynamic patterns, sub-MCP mounts, tools, and agents it
+ * can reach RIGHT NOW (derived server-side, never stored). `admin` is the
+ * condition-free ownerless `"*"` discriminator (a TOTAL projection); a scoped
+ * session carries `admin: false` and a jq-exact `routes` list. `owner_user_id` is
+ * the key's owner claim, `null` for an ownerless key. The invariant is
+ * projection ⊆ gate: every projected surface is one the server would admit, so
+ * the UI can filter on it without ever advertising a door the gate denies.
+ */
+export const meProjection = z.object({
+  user_id: z.string(),
+  owner_user_id: z.string().nullable(),
+  admin: z.boolean(),
+  scopes: z.array(z.string()),
+  routes: z.array(routeEntry),
+  route_patterns: z.array(patternEntry),
+  sub_mcp: z.array(subMcpEntry),
+  tools: z.array(z.string()),
+  agents: z.array(z.string()),
+  mintable: z.boolean(),
+});
+export type MeProjection = z.infer<typeof meProjection>;
+
+/**
+ * `POST /api/auth/claim-links` — a one-time claim link minted in the key-create
+ * flow. `claim_path` is a fragment-carrier path (`/login#claim=<token>`, never an
+ * absolute URL — the Studio composes the origin); `token` is the raw claim token
+ * returned exactly ONCE; `expires_at` is an ISO-8601 instant.
+ */
+export const claimLinkCreated = z.object({
+  claim_path: z.string(),
+  token: z.string(),
+  expires_at: z.string(),
+});
+export type ClaimLinkCreated = z.infer<typeof claimLinkCreated>;
+
+/**
+ * `POST /api/auth/logout` — the single authed logout dispatcher's result.
+ * `revoked` is `true` when a live accounts session was revoked; a plain `sk-` key
+ * has nothing to revoke and answers `404` (a loud absent-session signal), never a
+ * `revoked: false` body. Non-strict, so a SUCCESSFUL logout never throws
+ * `ApiSchemaError` on an additive field.
+ */
+export const logoutResult = z.object({ revoked: z.boolean() });
+export type LogoutResult = z.infer<typeof logoutResult>;
+
+/**
+ * `GET /api/auth/capabilities` — whether this deployment can MINT API keys
+ * locally. `mintable: false` means every configured identity provider is
+ * validator-only (keys are issued at an external issuer), so the key-creation
+ * UI disables up front instead of surfacing a raw mint failure. Non-strict.
+ */
+export const authCapabilities = z.object({
+  mintable: z.boolean(),
+  providers: z.array(z.object({ name: z.string(), mintable: z.boolean() })),
+});
+export type AuthCapabilities = z.infer<typeof authCapabilities>;

package/src/schemas/channels.ts

@@ -0,0 +1,11 @@
+/** Installed channel-plugin catalog response schema. */
+import { z } from 'zod';
+
+// The installed channel-plugin catalog: names registered via the manifest's
+// channel modules. A deployment with none bound answers questions only in this
+// inbox (the Studio default).
+
+export const channels = z.object({
+  channels: z.array(z.string()),
+});
+export type Channels = z.infer<typeof channels>;

package/src/schemas/config.ts

@@ -0,0 +1,17 @@
+/** Environment-config and config-mode response schemas. */
+import { z } from 'zod';
+
+export const envConfig = z.object({
+  env: z.record(z.string(), z.string()),
+  secret_keys: z.array(z.string()),
+});
+/**
+ * `GET /api/config/mode` — the active config backend mode (`file` / `k8s`). The
+ * skeleton emits only `config_mode`; `read_only` is a UI-side gate, tolerated-absent
+ * and defaulting to `false` (writable) so a normal response never drifts, while a
+ * genuinely read-only deployment can opt in by emitting `read_only: true`.
+ */
+export const configMode = z.object({
+  config_mode: z.string(),
+  read_only: z.boolean().default(false),
+});

package/src/schemas/connectors.ts

@@ -0,0 +1,138 @@
+/** Connector provider catalog and connection lifecycle schemas. */
+import { z } from 'zod';
+import { fleetReportFanout } from './fleet';
+
+export const subServiceView = z.object({
+  id: z.string(),
+  display_name: z.string(),
+  description: z.string(),
+  scopes: z.array(z.string()),
+});
+
+export const configFieldView = z.object({
+  key: z.string(),
+  label: z.string(),
+  target: z.enum(['env', 'header']),
+  required: z.boolean(),
+  secret: z.boolean(),
+});
+
+export const providerView = z.object({
+  id: z.string(),
+  display_name: z.string(),
+  description: z.string(),
+  // Required and a real URL: the contract's `ProviderDescriptor.icon_url` runs
+  // `check_web_url(schemes=("https",))`, which rejects an empty/relative value, so
+  // an empty or malformed one here is drift and fails the parse loudly.
+  icon_url: z.url(),
+  kind: z.enum(['oauth', 'none']),
+  origin: z.enum(['system', 'community']),
+  category: z.string(),
+  sub_services: z.array(subServiceView),
+  config_fields: z.array(configFieldView),
+});
+export type ProviderView = z.infer<typeof providerView>;
+
+/**
+ * One `connector_category` grouping row served alongside the catalog: the UI's
+ * label and sort key for the providers it groups, so the list can group, order,
+ * and label providers by category without a second read.
+ */
+export const connectorCategoryView = z.object({
+  id: z.string(),
+  display_name: z.string(),
+  sort_order: z.number(),
+});
+export type ConnectorCategoryView = z.infer<typeof connectorCategoryView>;
+
+/**
+ * `GET /api/connectors/providers` — the provider catalog: the providers plus the
+ * category groupings the UI arranges them under. Reshaped from a bare provider
+ * array so the category label/order surface rides the same read.
+ */
+export const providers = z.object({
+  providers: z.array(providerView),
+  categories: z.array(connectorCategoryView),
+});
+export type ProviderCatalogResponse = z.infer<typeof providers>;
+
+export const connectionView = z.object({
+  connection_id: z.string(),
+  provider_id: z.string(),
+  alias: z.string(),
+  kind: z.enum(['oauth', 'none']),
+  account_identity: z.string().nullable(),
+  enabled_sub_services: z.array(z.string()),
+  granted_scopes: z.array(z.string()),
+  // Sub-services whose MCP server did not answer a live reachability probe.
+  // Populated only on the single-connection GET (the list projection is
+  // probe-free and always sends `[]`). Reachability is distinct from
+  // `auth_health_state`: a healthy connection can still have a down sub-service.
+  // Defaulted so a projection that omits it (an older worker mid-rollout) still
+  // parses rather than false-failing the whole view.
+  unreachable_sub_services: z.array(z.string()).default([]),
+  auth_health_state: z.enum(['healthy', 'reconnect_required', 'refresh_failing']),
+  created_at: z.string(),
+});
+export type ConnectionView = z.infer<typeof connectionView>;
+
+export const connectionsList = z.object({
+  items: z.array(connectionView),
+  total: z.number(),
+  // Count of connections whose `auth_health_state` is not healthy across the whole
+  // set (independent of any filter/limit) — the attention-badge count. Optional:
+  // no UI consumes it, and an older worker mid-rollout omits it.
+  unhealthy: z.number().optional(),
+});
+
+// A connector mutation that writes the manifest embeds the mode-wrapped fleet
+// `fanout` of the reload it broadcast; it is `null` when the response path mutated no
+// manifest (an OAuth START opens a flow before any write). Parsed EXPLICITLY so the
+// shared fleet-report handler surfaces a failed propagation on every connector flow —
+// zod's unknown-key stripping would otherwise drop it silently.
+export const startConnectResult = z.union([
+  z.object({ flow_id: z.string(), authorize_url: z.string() }),
+  z.object({
+    connection_id: z.string(),
+    added_manifest_entries: z.array(z.string()),
+    fanout: fleetReportFanout.nullable(),
+  }),
+]);
+
+// A reconnect START opens an OAuth flow and writes no manifest, so it carries no
+// fan-out (the manifest write lands when the flow completes).
+export const reconnectResult = z.object({ flow_id: z.string(), authorize_url: z.string() });
+
+export const disconnectResult = z.object({
+  connection_id: z.string(),
+  upstream_revoke_outcome: z.enum(['success', 'failed', 'skipped']),
+  upstream_revoke_status: z.number().nullable(),
+  removed_manifest_entries: z.array(z.string()),
+  fanout: fleetReportFanout.nullable(),
+});
+
+export const patchSubServicesResult = z.object({
+  connection_id: z.string(),
+  enabled_sub_services: z.array(z.string()),
+  consent_required: z.boolean(),
+  flow_id: z.string().nullable(),
+  authorize_url: z.string().nullable(),
+  added_manifest_entries: z.array(z.string()),
+  removed_manifest_entries: z.array(z.string()),
+  // `null` on a consent-only toggle that forks an OAuth flow without a manifest write.
+  fanout: fleetReportFanout.nullable(),
+});
+
+export const oauthCompleteResult = z.discriminatedUnion('kind', [
+  z.object({
+    kind: z.literal('success'),
+    connection_id: z.string(),
+    return_url: z.string(),
+    // `null` when completing the flow mutated no manifest (a reconcile that changed
+    // nothing).
+    fanout: fleetReportFanout.nullable(),
+  }),
+  z.object({ kind: z.literal('failed'), reason: z.string() }),
+  z.object({ kind: z.literal('cancelled'), message: z.string() }),
+]);
+export type OAuthCompleteResult = z.infer<typeof oauthCompleteResult>;

package/src/schemas/conversations.ts

@@ -0,0 +1,256 @@
+/** Conversation route, thread, transcript and config schemas. */
+import { z } from 'zod';
+import { conversationRoute, targetConversationConfig } from './served';
+import { pageWindow } from './shared';
+
+// The cross-channel conversation monitor's READ side: the stored routing rows
+// (the route picker) from `GET /api/conversations`, a route's threads from
+// `GET /api/conversations/{route}/threads`, and one thread's transcript from
+// `GET /api/conversations/{route}/transcript?thread_id=`. Timestamps are float
+// epoch seconds, not ISO strings, and both paged doors carry the same window
+// fields; the transcript adds the direction it was read in.
+
+/** The inbound door a route is bound to: the authed API, or a channel medium. */
+export const conversationDoor = z.enum(['api', 'channel']);
+export type ConversationDoor = z.infer<typeof conversationDoor>;
+
+/** What a route's turn runs: a registered agent, or a tool dispatch. */
+export const conversationTargetKind = z.enum(['agent', 'tool']);
+export type ConversationTargetKind = z.infer<typeof conversationTargetKind>;
+
+/**
+ * A route's default control mode (`initial_mode`) when a thread carries no
+ * per-thread override: `agent` runs the target turn, `manual` suppresses it for an
+ * operator to answer. The same value vocabulary as a per-thread mode override, but
+ * a distinct concept (the route default vs. one thread's override).
+ */
+export const conversationMode = z.enum(['agent', 'manual']);
+export type ConversationMode = z.infer<typeof conversationMode>;
+
+/**
+ * Where a record sits between intake and a terminal outcome. `failed` is the one
+ * the monitor surfaces loudly; `shed` and `silent` are terminal by design and
+ * never send.
+ */
+export const conversationDeliveryStatus = z.enum([
+  'accepted',
+  'pending_delivery',
+  'provisional',
+  'delivered',
+  'failed',
+  'shed',
+  'silent',
+]);
+export type ConversationDeliveryStatus = z.infer<typeof conversationDeliveryStatus>;
+
+/** The nature of a turn's outcome, orthogonal to where its delivery stands. */
+export const conversationAnswerStatus = z.enum(['answered', 'error', 'silent']);
+export type ConversationAnswerStatus = z.infer<typeof conversationAnswerStatus>;
+
+/**
+ * Who authored a record's outgoing side. `client` is the ordinary turn the flow
+ * answered; `operator` is a message a human sent into the thread, whose text
+ * rides `answer` (its `inbound_text` is empty).
+ */
+export const conversationRecordOrigin = z.enum(['client', 'operator']);
+export type ConversationRecordOrigin = z.infer<typeof conversationRecordOrigin>;
+
+export const conversationRoutes = z.object({
+  items: z.array(conversationRoute),
+  total: z.number(),
+});
+export type ConversationRoutes = z.infer<typeof conversationRoutes>;
+
+/**
+ * The create/replace reply: whether THIS call created the row (vs. replaced an
+ * existing one), the row itself (its `callback_secret` withheld), and the
+ * `callback_secret` returned ONCE for an `api`-door row (`null` for a `channel`
+ * row). The secret signs delivery callbacks and is never re-read from any door, so
+ * a caller that needs it must capture it from this reply.
+ */
+export const conversationRouteWritten = z.object({
+  created: z.boolean(),
+  route_name: z.string(),
+  route: conversationRoute,
+  callback_secret: z.string().nullable(),
+});
+export type ConversationRouteWritten = z.infer<typeof conversationRouteWritten>;
+
+/**
+ * The delete reply: `removed` says whether THIS call removed the routing row (a
+ * retryable reclamation of orphaned thread indexes answers `false` rather than a
+ * 404).
+ */
+export const conversationRouteDeleted = z.object({
+  removed: z.boolean(),
+  route_name: z.string(),
+});
+export type ConversationRouteDeleted = z.infer<typeof conversationRouteDeleted>;
+
+/**
+ * One thread of a route, summarized from its newest record. A `thread_id` holds
+ * an api-door address (`{principal}/{end user}`, percent-encoded), so it never
+ * goes back into a URL as a path segment — the transcript door takes it as a
+ * query value.
+ */
+export const conversationThread = z.object({
+  thread_id: z.string(),
+  client_address: z.string(),
+  last_activity_at: z.number(),
+  message_count: z.number(),
+  last_delivery_status: conversationDeliveryStatus,
+});
+export type ConversationThread = z.infer<typeof conversationThread>;
+
+export const conversationThreadsPage = z.object({
+  items: z.array(conversationThread),
+  ...pageWindow,
+});
+export type ConversationThreadsPage = z.infer<typeof conversationThreadsPage>;
+
+/**
+ * One exchange: the visitor's `inbound_text` — every record answers a message, so
+ * both projections always carry it — and the agent's `answer`, plus where that
+ * answer's delivery stands. The fields after `updated_at` are ADMIN ONLY —
+ * the same door serves a caller-scoped projection that withholds them — so they
+ * are optional here and absence means "not published to this reader".
+ */
+export const conversationMessage = z.object({
+  message_id: z.string(),
+  route_name: z.string(),
+  door: conversationDoor,
+  thread_id: z.string(),
+  client_address: z.string(),
+  caller_principal: z.string().nullable(),
+  inbound_text: z.string(),
+  answer_status: conversationAnswerStatus.nullable(),
+  answer: z.string().nullable(),
+  origin: conversationRecordOrigin,
+  delivery_status: conversationDeliveryStatus,
+  created_at: z.number(),
+  updated_at: z.number(),
+  channel: z.string().nullable().optional(),
+  our_identity: z.string().nullable().optional(),
+  provider_message_id: z.string().nullable().optional(),
+  callback_url: z.string().nullable().optional(),
+  error: z.string().nullable().optional(),
+  outbound_message_ids: z.array(z.string()).optional(),
+  attempts: z.number().optional(),
+});
+export type ConversationMessage = z.infer<typeof conversationMessage>;
+
+/**
+ * The direction a transcript page reads in. `asc` is the reading order (oldest
+ * first); `desc` is the live-tail order, where page 1 is always the newest page
+ * and paging forward walks BACKWARDS through the thread's history.
+ */
+export const transcriptOrder = z.enum(['asc', 'desc']);
+export type TranscriptOrder = z.infer<typeof transcriptOrder>;
+
+/** A transcript page, echoing the order it was read in. */
+export const conversationTranscriptPage = z.object({
+  items: z.array(conversationMessage),
+  ...pageWindow,
+  order: transcriptOrder,
+});
+export type ConversationTranscriptPage = z.infer<typeof conversationTranscriptPage>;
+
+/**
+ * A route-scoped message search (`GET /api/conversations/{route}/messages/search?q`):
+ * every record on the route whose text matches `q`, across threads, newest first.
+ * The record shape is the transcript's exactly, so a hit renders with the same
+ * projection. `truncated` says the match set outran the door's scan cap — surfaced
+ * loudly, never a silent cut.
+ */
+export const conversationMessageSearchPage = z.object({
+  items: z.array(conversationMessage),
+  ...pageWindow,
+});
+export type ConversationMessageSearchPage = z.infer<typeof conversationMessageSearchPage>;
+
+/**
+ * Who answers a thread's incoming messages: `agent` lets the flow reply on its
+ * own; `manual` holds the flow back so a human answers. `source` says whether the
+ * setting is the thread's own (`thread`) or inherited from its route (`route`).
+ */
+export const conversationThreadMode = z.enum(['agent', 'manual']);
+export type ConversationThreadMode = z.infer<typeof conversationThreadMode>;
+
+export const conversationThreadModeState = z.object({
+  mode: conversationThreadMode,
+  source: z.enum(['thread', 'route']),
+});
+export type ConversationThreadModeState = z.infer<typeof conversationThreadModeState>;
+
+/** The receipt a thread-message write returns: the stored id and its thread. */
+export const conversationThreadMessageSent = z.object({
+  message_id: z.string(),
+  thread_id: z.string(),
+});
+export type ConversationThreadMessageSent = z.infer<typeof conversationThreadMessageSent>;
+
+/** Every stored per-target config (`GET /api/conversation-configs`). */
+export const conversationConfigs = z.object({
+  items: z.array(targetConversationConfig),
+  total: z.number(),
+});
+export type ConversationConfigs = z.infer<typeof conversationConfigs>;
+
+/**
+ * The upsert reply: whether THIS call created the config (vs. replaced an existing
+ * one), its key, and the stored row.
+ */
+export const conversationConfigWritten = z.object({
+  created: z.boolean(),
+  target_kind: conversationTargetKind,
+  target_name: z.string(),
+  config: targetConversationConfig,
+});
+export type ConversationConfigWritten = z.infer<typeof conversationConfigWritten>;
+
+/** The config-delete reply: `removed` is always `true` on success (an unknown key is a 404). */
+export const conversationConfigDeleted = z.object({
+  removed: z.boolean(),
+  target_kind: conversationTargetKind,
+  target_name: z.string(),
+});
+export type ConversationConfigDeleted = z.infer<typeof conversationConfigDeleted>;
+
+/**
+ * The admin-only failed-delivery listing (`GET /api/conversations/messages/failed`):
+ * every answer record whose delivery ended `failed`, across every route and caller.
+ * The records are the ADMIN projection (delivery bookkeeping and `error` included),
+ * so the row shape is {@link conversationMessage} exactly. It is NOT a paged window —
+ * the door returns `{items, total}` and nothing more.
+ */
+export const conversationFailedMessages = z.object({
+  items: z.array(conversationMessage),
+  total: z.number(),
+});
+export type ConversationFailedMessages = z.infer<typeof conversationFailedMessages>;
+
+/**
+ * The thread-delete reply (`DELETE /api/conversations/{route_name}/thread?thread_id=`).
+ * `removed` is a COUNT of the answer records this call deleted — `0` when a prior
+ * run already cleared them, when they had aged out under retention, or when the id
+ * was never stored (forgetting is absolute, never a 404 on a valid id).
+ */
+export const conversationThreadDeleted = z.object({
+  removed: z.number(),
+  route_name: z.string(),
+  thread_id: z.string(),
+});
+export type ConversationThreadDeleted = z.infer<typeof conversationThreadDeleted>;
+
+/**
+ * The person-erase reply (`DELETE /api/conversations/persons/{person_id}`).
+ * `removed` counts the answer records deleted across the person's routes; `erased`
+ * says whether THIS call removed the person row (`false` on a retry or an
+ * already-gone person — never a 404).
+ */
+export const conversationPersonDeleted = z.object({
+  person_id: z.string(),
+  removed: z.number(),
+  erased: z.boolean(),
+});
+export type ConversationPersonDeleted = z.infer<typeof conversationPersonDeleted>;

package/src/schemas/extensions.ts

@@ -0,0 +1,34 @@
+/** Extension element/combo and per-tool extension response schemas. */
+import { z } from 'zod';
+
+export const extension = z.object({ name: z.string(), kind: z.string() });
+export const extensions = z.array(extension);
+export type Extension = z.infer<typeof extension>;
+
+/**
+ * One element of an extension combo: a bare extension NAME, or a
+ * `{ name, config }` mapping binding author config (e.g. an `output_schema` JSON
+ * Schema, or an `ask_external` verifier). Both wire forms are admitted so a
+ * config-bearing combo parses without dropping server data. A drift throws
+ * `ApiSchemaError`.
+ */
+export const presetExtensionElement = z.union([
+  z.string(),
+  z.object({ name: z.string(), config: z.record(z.string(), z.unknown()) }),
+]);
+export type PresetExtensionElement = z.infer<typeof presetExtensionElement>;
+
+/**
+ * `GET /api/tools/{name}/extensions` — a tool's FULL lossless list-of-combos plus
+ * the extension catalog. `combos` is a list of combos, each an ordered list of
+ * extension ELEMENTS (a bare name or a config-bearing `{ name, config }` mapping —
+ * `output_schema` carries its schema this way); `[]` when the tool has no map entry.
+ * It carries EVERY combo mapped to the base tool (the union across every `tools`/`mcp`
+ * config), never a single flattened one. `available` is the same flat catalog
+ * `GET /api/extensions` returns. A drift throws `ApiSchemaError`.
+ */
+export const toolExtensions = z.object({
+  combos: z.array(z.array(presetExtensionElement)),
+  available: extensions,
+});
+export type ToolExtensions = z.infer<typeof toolExtensions>;