@tai42/api-client 16.0.0 → 17.0.0

package/dist/schemas/interactions.js

@@ -0,0 +1,124 @@
+/** Interaction question, answer and media response schemas. */
+import { z } from 'zod';
+import { pageWindow } from './shared';
+// Shapes match the skeleton's interactions SSE contract: the SSE
+// `interaction.add` frame carries the question and its answer format; the answer
+// door returns { interaction_id, status }. `answered` is not a wire field — it
+// is a client-side flag the stream hook flips on an `interaction.answered` event.
+export const answerFormat = z.enum(['text', 'confirm', 'select', 'form', 'external']);
+/** The kind of a question's display-only media item: a remote/inline image, or a link. */
+export const mediaKind = z.enum(['image', 'link']);
+/**
+ * One item of a question's display-only media. Applied PER ITEM by the renderer
+ * (never as a strict array on the frame): the frame's `media` field is a loose
+ * `z.array(z.unknown())`, and the renderer `safeParse`s each item with this schema
+ * so one malformed/hostile item is a loud per-item notice, not a whole-frame parse
+ * failure that would silently vanish an answerable question.
+ *
+ * `caption` is `.nullish()` (absent OR `null` both parse to a caption-less item):
+ * a caption-less item may arrive with the key omitted OR with an explicit `null`, so
+ * `.optional()` here would false-fail the explicit `null` and render a good image as
+ * malformed. `url` and `kind` are the only load-bearing fields; the image
+ * src scheme gate and the link neutralization are enforced by the renderer.
+ */
+export const interactionMediaItem = z.object({
+    kind: mediaKind,
+    url: z.string(),
+    caption: z.string().nullish(),
+});
+/**
+ * One per-send choice for a `form` property whose schema is a string (or array of
+ * strings). `value` is what the answer carries; `label` (absent OR null both parse
+ * to no label) is the human text shown in its place. A send may replace a property's
+ * `enum` this way for one ask without republishing the form. Applied per property by
+ * the form preview (safeParsed), so a malformed entry is a loud notice, never silent.
+ */
+export const formOption = z.object({
+    value: z.string(),
+    label: z.string().nullish(),
+});
+/**
+ * Per-send `form` data: `values` prefills top-level properties (keyed by property
+ * name), `options` supplies per-send choice lists (keyed by property name). Both
+ * default to empty. The form preview safeParses this off `format_payload.data`, so a
+ * malformed block is a loud notice rather than a whole-frame parse failure.
+ */
+export const formData = z.object({
+    values: z.record(z.string(), z.unknown()).default({}),
+    options: z.record(z.string(), z.array(formOption)).default({}),
+});
+/**
+ * One page of a stepped `form`: a `title` and the ordered top-level property names it
+ * groups. `format_payload.pages` is the ordered list of these; absent = one page. The
+ * form preview safeParses the list, so a malformed page is a loud notice, never silent.
+ */
+export const formPage = z.object({
+    title: z.string(),
+    fields: z.array(z.string()),
+});
+/** The `form` pages list (`format_payload.pages`), safeParsed as a whole by the preview. */
+export const formPages = z.array(formPage);
+export const interaction = z.object({
+    interaction_id: z.string(),
+    group_id: z.string(),
+    question: z.string().default(''),
+    answer_format: answerFormat,
+    // Format-specific payload: select options, form JSON schema (with optional per-send
+    // `data` and `pages`), external url. The wire sends `null` for formats that carry
+    // none (text/confirm); it is normalized to `{}` so consumers always see an object.
+    format_payload: z
+        .record(z.string(), z.unknown())
+        .nullish()
+        .transform((value) => value ?? {}),
+    created_at: z.string(),
+    timeout_at: z.string(),
+    // Whether the answer body is sensitive and never persisted server-side. Rides
+    // every add frame; an absent value (older frame) normalizes to false.
+    sensitive: z.boolean().default(false),
+    // True only for an external question answered by a signed server-to-server
+    // callback (never by a human); the frame never carries the verifier object.
+    // Absent/undefined for every other question.
+    server_verified: z.boolean().optional(),
+    // Name of the channel plugin the question was also delivered through (e.g.
+    // "telegram"); absent when the question lives only in this inbox.
+    channel: z.string().optional(),
+    // Interaction attribution, each additive and absent when unset. `recipient` is
+    // the channel delivery address the question went to; `origin` is the run id of
+    // the background tool run that asked; `audience` is the user_id the question is
+    // addressed to. Display/binding data only, never an authorization axis; a
+    // present non-string is malformed.
+    recipient: z.string().optional(),
+    origin: z.string().optional(),
+    audience: z.string().optional(),
+    // Display-only media shown WITH the question (images and/or links). Absent when
+    // the question carries none. Deliberately LOOSE (`z.array(z.unknown())`): each
+    // item is `safeParse`d per item by the renderer against `interactionMediaItem`,
+    // so one malformed/hostile item can never fail the whole frame parse and hide an
+    // answerable question. A present non-array value is still malformed.
+    media: z.array(z.unknown()).optional(),
+});
+/** The answer door's response — the blocked caller was woken. */
+export const interactionAnswered = z.object({
+    interaction_id: z.string(),
+    status: z.string(),
+});
+/**
+ * The cancel door's response — a pending ask was WITHDRAWN without an answer (the
+ * asking flow does not resume). `status` is `"cancelled"`; the shape mirrors the
+ * answer door's terminal reply, but the door is distinct so it carries its own
+ * schema.
+ */
+export const interactionCancelled = z.object({
+    interaction_id: z.string(),
+    status: z.string(),
+});
+/**
+ * A page of pending interactions from `GET /api/interactions?page=&pageSize=`. Each
+ * item is the same record the stream's `interaction.add` frame carries. The pending
+ * set is the paged base the tail-only stream applies live deltas over.
+ */
+export const interactionsPage = z.object({
+    items: z.array(interaction),
+    ...pageWindow,
+});
+//# sourceMappingURL=interactions.js.map

package/dist/schemas/interactions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactions.js","sourceRoot":"","sources":["../../src/schemas/interactions.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtC,iEAAiE;AACjE,iFAAiF;AACjF,+EAA+E;AAC/E,kFAAkF;AAElF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAGtF,0FAA0F;AAC1F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAGnD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC9B,CAAC,CAAC;AAGH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;CAC5B,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAC5B,CAAC,CAAC;AAGH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAG3C,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAChC,aAAa,EAAE,YAAY;IAC3B,oFAAoF;IACpF,kFAAkF;IAClF,mFAAmF;IACnF,cAAc,EAAE,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SAC/B,OAAO,EAAE;SACT,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;IACpC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,8EAA8E;IAC9E,sEAAsE;IACtE,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;IACrC,2EAA2E;IAC3E,4EAA4E;IAC5E,6CAA6C;IAC7C,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,2EAA2E;IAC3E,kEAAkE;IAClE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,+EAA+E;IAC/E,+EAA+E;IAC/E,gFAAgF;IAChF,0EAA0E;IAC1E,mCAAmC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,iFAAiF;IACjF,qEAAqE;IACrE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;CACvC,CAAC,CAAC;AAGH,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC3B,GAAG,UAAU;CACd,CAAC,CAAC"}

package/dist/schemas/login.d.ts

@@ -0,0 +1,93 @@
+/** Public login-method aggregator and login-result schemas. */
+import { z } from 'zod';
+/**
+ * One field of a `form` login method. `secret` fields render as password
+ * inputs; `autocomplete` passes through to the input (e.g. "email",
+ * "current-password", "new-password").
+ */
+export declare const loginFormField: z.ZodObject<{
+    name: z.ZodString;
+    label: z.ZodString;
+    secret: z.ZodBoolean;
+    autocomplete: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * The two — and only two — login-method shapes. Discriminated on `shape`; an
+ * unknown shape fails validation loudly (contract drift, not a soft skip).
+ * Optional fields are `.optional()` (absent), never `.nullable()`: the server
+ * serializes with `exclude_none`, so an absent field is OMITTED, never `null`.
+ */
+export declare const loginMethod: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    shape: z.ZodLiteral<"form">;
+    id: z.ZodString;
+    title: z.ZodString;
+    purpose: z.ZodDefault<z.ZodEnum<{
+        login: "login";
+        invite: "invite";
+    }>>;
+    fields: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        label: z.ZodString;
+        secret: z.ZodBoolean;
+        autocomplete: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    submit_path: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    shape: z.ZodLiteral<"button">;
+    id: z.ZodString;
+    label: z.ZodString;
+    icon: z.ZodOptional<z.ZodString>;
+    href: z.ZodString;
+}, z.core.$strip>], "shape">;
+/**
+ * `GET /api/login/methods` (PUBLIC). `needs_setup: true` ⇒ no principal exists
+ * yet, so the deployment must be initialized through the setup door before anyone
+ * can sign in. `setup_login` names the login-credential kinds the setup door can
+ * attach the owner's login with; it is `null`/absent when no login-attaching
+ * accounts provider is configured (a keys-only deployment). Non-strict — the
+ * skeleton may grow additive fields.
+ */
+export declare const loginMethods: z.ZodObject<{
+    methods: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        shape: z.ZodLiteral<"form">;
+        id: z.ZodString;
+        title: z.ZodString;
+        purpose: z.ZodDefault<z.ZodEnum<{
+            login: "login";
+            invite: "invite";
+        }>>;
+        fields: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            label: z.ZodString;
+            secret: z.ZodBoolean;
+            autocomplete: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
+        submit_path: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        shape: z.ZodLiteral<"button">;
+        id: z.ZodString;
+        label: z.ZodString;
+        icon: z.ZodOptional<z.ZodString>;
+        href: z.ZodString;
+    }, z.core.$strip>], "shape">>;
+    needs_setup: z.ZodBoolean;
+    setup_login: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        kinds: z.ZodArray<z.ZodEnum<{
+            invite: "invite";
+            password: "password";
+        }>>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * A successful login/exchange: the minted session token (opaque, `tai-sess-`
+ * prefixed — the client treats it as an opaque string) + its user.
+ */
+export declare const loginResult: z.ZodObject<{
+    token: z.ZodString;
+    user_id: z.ZodString;
+}, z.core.$strip>;
+export type LoginFormField = z.infer<typeof loginFormField>;
+export type LoginMethod = z.infer<typeof loginMethod>;
+export type LoginMethods = z.infer<typeof loginMethods>;
+export type LoginResult = z.infer<typeof loginResult>;
+//# sourceMappingURL=login.d.ts.map

package/dist/schemas/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/schemas/login.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;4BAgBtB,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAOvB,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,WAAW;;;iBAGtB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAC5D,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AACtD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AACxD,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC"}

package/dist/schemas/login.js

@@ -0,0 +1,61 @@
+/** Public login-method aggregator and login-result schemas. */
+import { z } from 'zod';
+/**
+ * One field of a `form` login method. `secret` fields render as password
+ * inputs; `autocomplete` passes through to the input (e.g. "email",
+ * "current-password", "new-password").
+ */
+export const loginFormField = z.object({
+    name: z.string().min(1),
+    label: z.string().min(1),
+    secret: z.boolean(),
+    autocomplete: z.string().optional(),
+});
+/**
+ * The two — and only two — login-method shapes. Discriminated on `shape`; an
+ * unknown shape fails validation loudly (contract drift, not a soft skip).
+ * Optional fields are `.optional()` (absent), never `.nullable()`: the server
+ * serializes with `exclude_none`, so an absent field is OMITTED, never `null`.
+ */
+export const loginMethod = z.discriminatedUnion('shape', [
+    z.object({
+        shape: z.literal('form'),
+        id: z.string().min(1),
+        title: z.string().min(1),
+        purpose: z.enum(['login', 'invite']).default('login'),
+        fields: z.array(loginFormField).min(1),
+        submit_path: z.string().min(1),
+    }),
+    z.object({
+        shape: z.literal('button'),
+        id: z.string().min(1),
+        label: z.string().min(1),
+        icon: z.string().optional(),
+        href: z.string().min(1),
+    }),
+]);
+/**
+ * `GET /api/login/methods` (PUBLIC). `needs_setup: true` ⇒ no principal exists
+ * yet, so the deployment must be initialized through the setup door before anyone
+ * can sign in. `setup_login` names the login-credential kinds the setup door can
+ * attach the owner's login with; it is `null`/absent when no login-attaching
+ * accounts provider is configured (a keys-only deployment). Non-strict — the
+ * skeleton may grow additive fields.
+ */
+export const loginMethods = z.object({
+    methods: z.array(loginMethod),
+    needs_setup: z.boolean(),
+    setup_login: z
+        .object({ kinds: z.array(z.enum(['password', 'invite'])) })
+        .nullable()
+        .optional(),
+});
+/**
+ * A successful login/exchange: the minted session token (opaque, `tai-sess-`
+ * prefixed — the client treats it as an opaque string) + its user.
+ */
+export const loginResult = z.object({
+    token: z.string().min(1),
+    user_id: z.string().min(1),
+});
+//# sourceMappingURL=login.js.map

package/dist/schemas/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/schemas/login.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE;IACnB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,kBAAkB,CAAC,OAAO,EAAE;IACvD,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACrD,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC/B,CAAC;IACF,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC1B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACxB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;CACH,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,WAAW,EAAE,CAAC;SACX,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D,QAAQ,EAAE;SACV,QAAQ,EAAE;CACd,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC3B,CAAC,CAAC"}

package/dist/schemas/manifest-mcp.d.ts

@@ -0,0 +1,125 @@
+/** Live-manifest MCP section, env-ref and config-reload schemas. */
+import { z } from 'zod';
+/**
+ * The back-reference a connector writes onto a manifest MCP entry to mark it
+ * connector-owned: the connection and the provider sub-service that own it.
+ * Hand-authored entries carry no `managed` marker.
+ */
+export declare const connectorRef: z.ZodObject<{
+    connection_id: z.ZodString;
+    provider_id: z.ZodString;
+    sub_service: z.ZodString;
+}, z.core.$strip>;
+export type ConnectorRef = z.infer<typeof connectorRef>;
+/**
+ * One entry of the live manifest's MCP section. Only the `managed` provenance
+ * marker is typed — the connect/disconnect flows write it server-side to point a
+ * connector-owned entry back at its connection, and the editor renders such
+ * entries read-only. `.nullish()` because a hand-authored entry carries `null`
+ * (present) or omits the key. Every other field (title, config, extensions) rides
+ * through `.loose()` unmodeled so the config editor keeps editing the whole
+ * entry — narrowing it to a typed subset would silently strip the fields it saves.
+ */
+export declare const manifestMcpEntry: z.ZodObject<{
+    managed: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        connection_id: z.ZodString;
+        provider_id: z.ZodString;
+        sub_service: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$loose>;
+export type ManifestMcpEntry = z.infer<typeof manifestMcpEntry>;
+export declare const manifestView: z.ZodObject<{
+    mcp: z.ZodArray<z.ZodObject<{
+        managed: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            connection_id: z.ZodString;
+            provider_id: z.ZodString;
+            sub_service: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$loose>>;
+    user_tools: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * One `!ENV ${VAR[:default]}` marker the manifest's MCP section carries
+ * (`GET /api/manifest/mcp-env-refs`) — NAMES and BOOLEANS only, NEVER values.
+ * `pointer` is the RFC 6901 json-pointer of the leaf (`/mcp/<i>/config/...`);
+ * `has_default` is whether the marker carries a `:default`; `set` is whether the
+ * var resolves in the EFFECTIVE env (the resolution truth the install-time
+ * dangling refusal reads), so a var supplied by the deployment shows green, never
+ * a false red. The checklist derives from THIS alone — no env value is ever fetched.
+ */
+export declare const mcpEnvRef: z.ZodObject<{
+    var: z.ZodString;
+    pointer: z.ZodString;
+    has_default: z.ZodBoolean;
+    set: z.ZodBoolean;
+}, z.core.$strip>;
+export type McpEnvRef = z.infer<typeof mcpEnvRef>;
+export declare const mcpEnvRefs: z.ZodArray<z.ZodObject<{
+    var: z.ZodString;
+    pointer: z.ZodString;
+    has_default: z.ZodBoolean;
+    set: z.ZodBoolean;
+}, z.core.$strip>>;
+export type McpEnvRefs = z.infer<typeof mcpEnvRefs>;
+/**
+ * The apply result every config-writer mutation returns (`POST /api/mcp-config`,
+ * `POST /api/config/env`): the serving worker's local reload result (`status` +
+ * `env_keys`) plus the mode-wrapped fleet fan-out of the reload it broadcast. The
+ * `fanout` is parsed EXPLICITLY so the shared fleet-report handler can surface a
+ * failed propagation — zod's unknown-key stripping would otherwise hide it. A drift
+ * throws `ApiSchemaError`.
+ */
+export declare const reloadConfigResult: z.ZodObject<{
+    status: z.ZodString;
+    env_keys: z.ZodNumber;
+    fanout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"local-only">;
+        note: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodString;
+        reachable: z.ZodBoolean;
+        local_only: z.ZodBoolean;
+        results: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            outcome: z.ZodEnum<{
+                failed: "failed";
+                resyncing: "resyncing";
+                recycling: "recycling";
+                stale: "stale";
+                applied: "applied";
+                missing: "missing";
+                departed: "departed";
+                timed_out: "timed_out";
+            }>;
+            payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+            error: z.ZodNullable<z.ZodString>;
+            detail: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        error: z.ZodNullable<z.ZodString>;
+        mode: z.ZodLiteral<"fleet">;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodString;
+        reachable: z.ZodBoolean;
+        local_only: z.ZodBoolean;
+        results: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            outcome: z.ZodEnum<{
+                failed: "failed";
+                resyncing: "resyncing";
+                recycling: "recycling";
+                stale: "stale";
+                applied: "applied";
+                missing: "missing";
+                departed: "departed";
+                timed_out: "timed_out";
+            }>;
+            payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+            error: z.ZodNullable<z.ZodString>;
+            detail: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        error: z.ZodNullable<z.ZodString>;
+        mode: z.ZodLiteral<"unreachable">;
+    }, z.core.$strip>], "mode">;
+}, z.core.$strip>;
+export type ReloadConfigResult = z.infer<typeof reloadConfigResult>;
+//# sourceMappingURL=manifest-mcp.d.ts.map

package/dist/schemas/manifest-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-mcp.d.ts","sourceRoot":"","sources":["../../src/schemas/manifest-mcp.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB;;;;GAIG;AACH,eAAO,MAAM,YAAY;;;;iBAIvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD;;;;;;;;GAQG;AACH,eAAO,MAAM,gBAAgB;;;;;;iBAInB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,YAAY;;;;;;;;;iBAGvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS;;;;;iBAKpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAClD,eAAO,MAAM,UAAU;;;;;kBAAqB,CAAC;AAC7C,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AACpD;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAI7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/schemas/manifest-mcp.js

@@ -0,0 +1,61 @@
+/** Live-manifest MCP section, env-ref and config-reload schemas. */
+import { z } from 'zod';
+import { fleetReportFanout } from './fleet';
+/**
+ * The back-reference a connector writes onto a manifest MCP entry to mark it
+ * connector-owned: the connection and the provider sub-service that own it.
+ * Hand-authored entries carry no `managed` marker.
+ */
+export const connectorRef = z.object({
+    connection_id: z.string(),
+    provider_id: z.string(),
+    sub_service: z.string(),
+});
+/**
+ * One entry of the live manifest's MCP section. Only the `managed` provenance
+ * marker is typed — the connect/disconnect flows write it server-side to point a
+ * connector-owned entry back at its connection, and the editor renders such
+ * entries read-only. `.nullish()` because a hand-authored entry carries `null`
+ * (present) or omits the key. Every other field (title, config, extensions) rides
+ * through `.loose()` unmodeled so the config editor keeps editing the whole
+ * entry — narrowing it to a typed subset would silently strip the fields it saves.
+ */
+export const manifestMcpEntry = z
+    .object({
+    managed: connectorRef.nullish(),
+})
+    .loose();
+export const manifestView = z.object({
+    mcp: z.array(manifestMcpEntry),
+    user_tools: z.array(z.string()),
+});
+/**
+ * One `!ENV ${VAR[:default]}` marker the manifest's MCP section carries
+ * (`GET /api/manifest/mcp-env-refs`) — NAMES and BOOLEANS only, NEVER values.
+ * `pointer` is the RFC 6901 json-pointer of the leaf (`/mcp/<i>/config/...`);
+ * `has_default` is whether the marker carries a `:default`; `set` is whether the
+ * var resolves in the EFFECTIVE env (the resolution truth the install-time
+ * dangling refusal reads), so a var supplied by the deployment shows green, never
+ * a false red. The checklist derives from THIS alone — no env value is ever fetched.
+ */
+export const mcpEnvRef = z.object({
+    var: z.string(),
+    pointer: z.string(),
+    has_default: z.boolean(),
+    set: z.boolean(),
+});
+export const mcpEnvRefs = z.array(mcpEnvRef);
+/**
+ * The apply result every config-writer mutation returns (`POST /api/mcp-config`,
+ * `POST /api/config/env`): the serving worker's local reload result (`status` +
+ * `env_keys`) plus the mode-wrapped fleet fan-out of the reload it broadcast. The
+ * `fanout` is parsed EXPLICITLY so the shared fleet-report handler can surface a
+ * failed propagation — zod's unknown-key stripping would otherwise hide it. A drift
+ * throws `ApiSchemaError`.
+ */
+export const reloadConfigResult = z.object({
+    status: z.string(),
+    env_keys: z.number(),
+    fanout: fleetReportFanout,
+});
+//# sourceMappingURL=manifest-mcp.js.map

package/dist/schemas/manifest-mcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-mcp.js","sourceRoot":"","sources":["../../src/schemas/manifest-mcp.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAGH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE;CAChC,CAAC;KACD,KAAK,EAAE,CAAC;AAGX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAChC,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE;IACxB,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC"}