@tai42/api-client 16.0.0 → 17.0.0

package/dist/schemas/auth-routes.js

@@ -0,0 +1,42 @@
+/** Route catalog, scope mapping and public-route response schemas. */
+import { z } from 'zod';
+/** `{ url: scope_id }` — every URL currently mapped to a scope. */
+export const authScopes = z.record(z.string(), z.string());
+export const addUrlToScopeResult = z.object({ scope_id: z.string(), url: z.string() });
+export const removeUrlFromScopeResult = z.object({ url: z.string() });
+export const removeScopeResult = z.object({ scope_id: z.string(), deleted_keys: z.number() });
+/**
+ * A route's authorization ACTION class, joined onto the catalog from the route
+ * registry. `read`/`write` routes are GRANTABLE — a role's per-tag level opens
+ * them; `fenced`/`secret` routes are ADMIN-ONLY and never grantable (no per-tag
+ * level reaches them). `null` marks a path the registry carries no metadata for
+ * (an unregistered/ungated path — no feature tags, no action).
+ */
+export const routeAction = z.enum(['read', 'write', 'fenced', 'secret']);
+/**
+ * One row of the route catalog (`GET /api/auth/routes`) — a plain HTTP route with
+ * its current mapping, JOINED with its route-registry metadata. `mapped` is the
+ * scope id, the public marker, or `null` when the path is unmapped (the mapper's
+ * "unassigned" bucket source). `methods` is the route's method set with `HEAD`
+ * removed. `tags` are the route's feature-group labels, `summary` its one-line
+ * description, and `action` its authorization class — the join fields the Roles
+ * grant editor reads to derive grantable feature groups and mark the admin-only
+ * (fenced/secret) routes it must never offer a grant for. An unregistered path
+ * carries `tags: []`, `summary: ''`, `action: null`.
+ */
+export const authRoute = z.object({
+    path: z.string(),
+    methods: z.array(z.string()),
+    mapped: z.string().nullable(),
+    tags: z.array(z.string()),
+    summary: z.string(),
+    action: routeAction.nullable(),
+});
+export const authRoutes = z.array(authRoute);
+/** `GET /api/auth/public-routes` — the sorted urls pinned to the public marker. */
+export const publicRoutes = z.array(z.string());
+/** `POST /api/auth/public-routes` — the pinned url. */
+export const pinPublicResult = z.object({ url: z.string() });
+/** `DELETE /api/auth/public-routes` — the unpinned url (404 when not pinned). */
+export const unpinPublicResult = z.object({ url: z.string() });
+//# sourceMappingURL=auth-routes.js.map

package/dist/schemas/auth-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-routes.js","sourceRoot":"","sources":["../../src/schemas/auth-routes.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,mEAAmE;AACnE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7C,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEhD,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}

package/dist/schemas/backup.d.ts

@@ -0,0 +1,78 @@
+/** Backup section, document and import-report response schemas. */
+import { z } from 'zod';
+export declare const backupSections: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    secret: z.ZodBoolean;
+}, z.core.$strip>>;
+/** The exported backup document — validated when the UI reads a picked file. */
+export declare const backupDocument: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    created_at: z.ZodString;
+    sections: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    errors: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+export type BackupDocument = z.infer<typeof backupDocument>;
+export declare const backupImportReport: z.ZodObject<{
+    ok: z.ZodBoolean;
+    sections: z.ZodRecord<z.ZodString, z.ZodObject<{
+        created: z.ZodNumber;
+        updated: z.ZodNumber;
+        skipped: z.ZodNumber;
+        errors: z.ZodArray<z.ZodString>;
+        new_api_keys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            user_id: z.ZodString;
+            description: z.ZodString;
+            api_key: z.ZodString;
+        }, z.core.$strip>>>;
+        fanout: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"local-only">;
+            note: z.ZodString;
+        }, z.core.$strip>, z.ZodObject<{
+            op: z.ZodString;
+            reachable: z.ZodBoolean;
+            local_only: z.ZodBoolean;
+            results: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                outcome: z.ZodEnum<{
+                    failed: "failed";
+                    resyncing: "resyncing";
+                    recycling: "recycling";
+                    stale: "stale";
+                    applied: "applied";
+                    missing: "missing";
+                    departed: "departed";
+                    timed_out: "timed_out";
+                }>;
+                payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+                error: z.ZodNullable<z.ZodString>;
+                detail: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            error: z.ZodNullable<z.ZodString>;
+            mode: z.ZodLiteral<"fleet">;
+        }, z.core.$strip>, z.ZodObject<{
+            op: z.ZodString;
+            reachable: z.ZodBoolean;
+            local_only: z.ZodBoolean;
+            results: z.ZodArray<z.ZodObject<{
+                name: z.ZodString;
+                outcome: z.ZodEnum<{
+                    failed: "failed";
+                    resyncing: "resyncing";
+                    recycling: "recycling";
+                    stale: "stale";
+                    applied: "applied";
+                    missing: "missing";
+                    departed: "departed";
+                    timed_out: "timed_out";
+                }>;
+                payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+                error: z.ZodNullable<z.ZodString>;
+                detail: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+            error: z.ZodNullable<z.ZodString>;
+            mode: z.ZodLiteral<"unreachable">;
+        }, z.core.$strip>], "mode">>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type BackupImportReport = z.infer<typeof backupImportReport>;
+//# sourceMappingURL=backup.d.ts.map

package/dist/schemas/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/schemas/backup.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,cAAc;;;kBAA+D,CAAC;AAE3F,gFAAgF;AAChF,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyB7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/schemas/backup.js

@@ -0,0 +1,33 @@
+/** Backup section, document and import-report response schemas. */
+import { z } from 'zod';
+import { fleetReportFanout } from './fleet';
+export const backupSections = z.array(z.object({ name: z.string(), secret: z.boolean() }));
+/** The exported backup document — validated when the UI reads a picked file. */
+export const backupDocument = z.object({
+    version: z.literal(1),
+    created_at: z.string(),
+    sections: z.record(z.string(), z.unknown()),
+    errors: z.record(z.string(), z.string()).optional(),
+});
+export const backupImportReport = z.object({
+    ok: z.boolean(),
+    sections: z.record(z.string(), z.object({
+        created: z.number(),
+        updated: z.number(),
+        skipped: z.number(),
+        errors: z.array(z.string()),
+        new_api_keys: z
+            .array(z.object({
+            user_id: z.string(),
+            description: z.string(),
+            api_key: z.string(),
+        }))
+            .optional(),
+        // The `manifest` and `env` sections apply through the config pipeline, so their
+        // report carries the mode-wrapped fleet `fanout` of the restore's reload; other
+        // sections omit it. Parsed EXPLICITLY so the shared fleet-report handler can
+        // surface a failed restore propagation — otherwise zod would strip it silently.
+        fanout: fleetReportFanout.optional(),
+    })),
+});
+//# sourceMappingURL=backup.js.map

package/dist/schemas/backup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/schemas/backup.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,CAChB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,CAAC;aACZ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACpB,CAAC,CACH;aACA,QAAQ,EAAE;QACb,gFAAgF;QAChF,gFAAgF;QAChF,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}

package/dist/schemas/capabilities.d.ts

@@ -0,0 +1,109 @@
+/** Caller capability projection and auth-capabilities schemas. */
+import { z } from 'zod';
+/** A concrete route the caller can reach, with the methods that pass its jq fence. */
+export declare const routeEntry: z.ZodObject<{
+    path: z.ZodString;
+    methods: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type RouteEntry = z.infer<typeof routeEntry>;
+/**
+ * A dynamic route pattern the caller can reach — a mount/pattern surface not
+ * enumerable into concrete paths, projected only when its scope AND jq admit it.
+ */
+export declare const patternEntry: z.ZodObject<{
+    pattern: z.ZodString;
+    scope_id: z.ZodString;
+}, z.core.$strip>;
+export type PatternEntry = z.infer<typeof patternEntry>;
+/**
+ * A sub-MCP mount the caller can reach, with the tools it exposes and its
+ * transport. Shares the {@link subMcpMount} shape with the registry list, adding
+ * the `slug` the projection carries inline (the list keys mounts by slug instead).
+ */
+export declare const subMcpEntry: z.ZodObject<{
+    tools: z.ZodArray<z.ZodString>;
+    transport: z.ZodString;
+    slug: z.ZodString;
+}, z.core.$strip>;
+export type SubMcpEntry = z.infer<typeof subMcpEntry>;
+/**
+ * `GET /api/auth/me` — the caller's derived capability projection: the concrete
+ * (path, method) surface, dynamic patterns, sub-MCP mounts, tools, and agents it
+ * can reach RIGHT NOW (derived server-side, never stored). `admin` is the
+ * condition-free `"*"` discriminator (a TOTAL projection); a scoped
+ * session carries `admin: false` and a jq-exact `routes` list. `owner_user_id` is
+ * the key's owner claim, `null` for a key with no owner claim. `principal` is the
+ * caller's principal (kind + display name), `null` when no principal row backs the
+ * credential. The invariant is projection ⊆ gate: every projected surface is one
+ * the server would admit, so the UI can filter on it without ever advertising a
+ * door the gate denies.
+ */
+export declare const meProjection: z.ZodObject<{
+    user_id: z.ZodString;
+    owner_user_id: z.ZodNullable<z.ZodString>;
+    principal: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        user_id: z.ZodString;
+        kind: z.ZodEnum<{
+            human: "human";
+            service: "service";
+        }>;
+        display_name: z.ZodString;
+    }, z.core.$strip>>>;
+    admin: z.ZodBoolean;
+    scopes: z.ZodArray<z.ZodString>;
+    routes: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        methods: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+    route_patterns: z.ZodArray<z.ZodObject<{
+        pattern: z.ZodString;
+        scope_id: z.ZodString;
+    }, z.core.$strip>>;
+    sub_mcp: z.ZodArray<z.ZodObject<{
+        tools: z.ZodArray<z.ZodString>;
+        transport: z.ZodString;
+        slug: z.ZodString;
+    }, z.core.$strip>>;
+    tools: z.ZodArray<z.ZodString>;
+    agents: z.ZodArray<z.ZodString>;
+    mintable: z.ZodBoolean;
+}, z.core.$strip>;
+export type MeProjection = z.infer<typeof meProjection>;
+/**
+ * `POST /api/auth/claim-links` — a one-time claim link minted in the key-create
+ * flow. `claim_path` is a fragment-carrier path (`/login#claim=<token>`, never an
+ * absolute URL — the Studio composes the origin); `token` is the raw claim token
+ * returned exactly ONCE; `expires_at` is an ISO-8601 instant.
+ */
+export declare const claimLinkCreated: z.ZodObject<{
+    claim_path: z.ZodString;
+    token: z.ZodString;
+    expires_at: z.ZodString;
+}, z.core.$strip>;
+export type ClaimLinkCreated = z.infer<typeof claimLinkCreated>;
+/**
+ * `POST /api/auth/logout` — the single authed logout dispatcher's result.
+ * `revoked` is `true` when a live accounts session was revoked; a plain `sk-` key
+ * has nothing to revoke and answers `404` (a loud absent-session signal), never a
+ * `revoked: false` body. Non-strict, so a SUCCESSFUL logout never throws
+ * `ApiSchemaError` on an additive field.
+ */
+export declare const logoutResult: z.ZodObject<{
+    revoked: z.ZodBoolean;
+}, z.core.$strip>;
+export type LogoutResult = z.infer<typeof logoutResult>;
+/**
+ * `GET /api/auth/capabilities` — whether this deployment can MINT API keys
+ * locally. `mintable: false` means every configured identity provider is
+ * validator-only (keys are issued at an external issuer), so the key-creation
+ * UI disables up front instead of surfacing a raw mint failure. Non-strict.
+ */
+export declare const authCapabilities: z.ZodObject<{
+    mintable: z.ZodBoolean;
+    providers: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        mintable: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AuthCapabilities = z.infer<typeof authCapabilities>;
+//# sourceMappingURL=capabilities.d.ts.map

package/dist/schemas/capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.d.ts","sourceRoot":"","sources":["../../src/schemas/capabilities.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,sFAAsF;AACtF,eAAO,MAAM,UAAU;;;iBAGrB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,YAAY;;;iBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,WAAW;;;;iBAA2C,CAAC;AACpE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAYvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;iBAI3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;iBAAqC,CAAC;AAC/D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB;;;;;;iBAG3B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC"}

package/dist/schemas/capabilities.js

@@ -0,0 +1,78 @@
+/** Caller capability projection and auth-capabilities schemas. */
+import { z } from 'zod';
+import { principalRef } from './principals';
+import { subMcpMount } from './sub-mcp';
+/** A concrete route the caller can reach, with the methods that pass its jq fence. */
+export const routeEntry = z.object({
+    path: z.string(),
+    methods: z.array(z.string()),
+});
+/**
+ * A dynamic route pattern the caller can reach — a mount/pattern surface not
+ * enumerable into concrete paths, projected only when its scope AND jq admit it.
+ */
+export const patternEntry = z.object({
+    pattern: z.string(),
+    scope_id: z.string(),
+});
+/**
+ * A sub-MCP mount the caller can reach, with the tools it exposes and its
+ * transport. Shares the {@link subMcpMount} shape with the registry list, adding
+ * the `slug` the projection carries inline (the list keys mounts by slug instead).
+ */
+export const subMcpEntry = subMcpMount.extend({ slug: z.string() });
+/**
+ * `GET /api/auth/me` — the caller's derived capability projection: the concrete
+ * (path, method) surface, dynamic patterns, sub-MCP mounts, tools, and agents it
+ * can reach RIGHT NOW (derived server-side, never stored). `admin` is the
+ * condition-free `"*"` discriminator (a TOTAL projection); a scoped
+ * session carries `admin: false` and a jq-exact `routes` list. `owner_user_id` is
+ * the key's owner claim, `null` for a key with no owner claim. `principal` is the
+ * caller's principal (kind + display name), `null` when no principal row backs the
+ * credential. The invariant is projection ⊆ gate: every projected surface is one
+ * the server would admit, so the UI can filter on it without ever advertising a
+ * door the gate denies.
+ */
+export const meProjection = z.object({
+    user_id: z.string(),
+    owner_user_id: z.string().nullable(),
+    principal: principalRef.nullable().optional(),
+    admin: z.boolean(),
+    scopes: z.array(z.string()),
+    routes: z.array(routeEntry),
+    route_patterns: z.array(patternEntry),
+    sub_mcp: z.array(subMcpEntry),
+    tools: z.array(z.string()),
+    agents: z.array(z.string()),
+    mintable: z.boolean(),
+});
+/**
+ * `POST /api/auth/claim-links` — a one-time claim link minted in the key-create
+ * flow. `claim_path` is a fragment-carrier path (`/login#claim=<token>`, never an
+ * absolute URL — the Studio composes the origin); `token` is the raw claim token
+ * returned exactly ONCE; `expires_at` is an ISO-8601 instant.
+ */
+export const claimLinkCreated = z.object({
+    claim_path: z.string(),
+    token: z.string(),
+    expires_at: z.string(),
+});
+/**
+ * `POST /api/auth/logout` — the single authed logout dispatcher's result.
+ * `revoked` is `true` when a live accounts session was revoked; a plain `sk-` key
+ * has nothing to revoke and answers `404` (a loud absent-session signal), never a
+ * `revoked: false` body. Non-strict, so a SUCCESSFUL logout never throws
+ * `ApiSchemaError` on an additive field.
+ */
+export const logoutResult = z.object({ revoked: z.boolean() });
+/**
+ * `GET /api/auth/capabilities` — whether this deployment can MINT API keys
+ * locally. `mintable: false` means every configured identity provider is
+ * validator-only (keys are issued at an external issuer), so the key-creation
+ * UI disables up front instead of surfacing a raw mint failure. Non-strict.
+ */
+export const authCapabilities = z.object({
+    mintable: z.boolean(),
+    providers: z.array(z.object({ name: z.string(), mintable: z.boolean() })),
+});
+//# sourceMappingURL=capabilities.js.map

package/dist/schemas/capabilities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capabilities.js","sourceRoot":"","sources":["../../src/schemas/capabilities.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,sFAAsF;AACtF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC7B,CAAC,CAAC;AAGH;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;CACrB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAGpE;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,SAAS,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE;IAClB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;IAC3B,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC7B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAG/D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;CAC1E,CAAC,CAAC"}

package/dist/schemas/channels.d.ts

@@ -0,0 +1,7 @@
+/** Installed channel-plugin catalog response schema. */
+import { z } from 'zod';
+export declare const channels: z.ZodObject<{
+    channels: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type Channels = z.infer<typeof channels>;
+//# sourceMappingURL=channels.d.ts.map

package/dist/schemas/channels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.d.ts","sourceRoot":"","sources":["../../src/schemas/channels.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAMxB,eAAO,MAAM,QAAQ;;iBAEnB,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,QAAQ,CAAC,CAAC"}

package/dist/schemas/channels.js

@@ -0,0 +1,9 @@
+/** Installed channel-plugin catalog response schema. */
+import { z } from 'zod';
+// The installed channel-plugin catalog: names registered via the manifest's
+// channel modules. A deployment with none bound answers questions only in this
+// inbox (the Studio default).
+export const channels = z.object({
+    channels: z.array(z.string()),
+});
+//# sourceMappingURL=channels.js.map

package/dist/schemas/channels.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channels.js","sourceRoot":"","sources":["../../src/schemas/channels.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,+EAA+E;AAC/E,8BAA8B;AAE9B,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC9B,CAAC,CAAC"}

package/dist/schemas/config.d.ts

@@ -0,0 +1,17 @@
+/** Environment-config and config-mode response schemas. */
+import { z } from 'zod';
+export declare const envConfig: z.ZodObject<{
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+    secret_keys: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * `GET /api/config/mode` — the active config backend mode (`file` / `k8s`). The
+ * skeleton emits only `config_mode`; `read_only` is a UI-side gate, tolerated-absent
+ * and defaulting to `false` (writable) so a normal response never drifts, while a
+ * genuinely read-only deployment can opt in by emitting `read_only: true`.
+ */
+export declare const configMode: z.ZodObject<{
+    config_mode: z.ZodString;
+    read_only: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+//# sourceMappingURL=config.d.ts.map

package/dist/schemas/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/schemas/config.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,SAAS;;;iBAGpB,CAAC;AACH;;;;;GAKG;AACH,eAAO,MAAM,UAAU;;;iBAGrB,CAAC"}

package/dist/schemas/config.js

@@ -0,0 +1,17 @@
+/** Environment-config and config-mode response schemas. */
+import { z } from 'zod';
+export const envConfig = z.object({
+    env: z.record(z.string(), z.string()),
+    secret_keys: z.array(z.string()),
+});
+/**
+ * `GET /api/config/mode` — the active config backend mode (`file` / `k8s`). The
+ * skeleton emits only `config_mode`; `read_only` is a UI-side gate, tolerated-absent
+ * and defaulting to `false` (writable) so a normal response never drifts, while a
+ * genuinely read-only deployment can opt in by emitting `read_only: true`.
+ */
+export const configMode = z.object({
+    config_mode: z.string(),
+    read_only: z.boolean().default(false),
+});
+//# sourceMappingURL=config.js.map

package/dist/schemas/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/schemas/config.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AACH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACtC,CAAC,CAAC"}