@tai42/api-client 16.0.0 → 17.0.0

package/dist/schemas/profiles.d.ts

@@ -0,0 +1,180 @@
+/** Settings-profile record, version, diff and apply response schemas. */
+import { z } from 'zod';
+/**
+ * `GET /api/config/profiles` — one row per stored profile. The list is
+ * names+descriptions ONLY (action=read); no `env`, no `secret_keys`, no bodies.
+ * (No `last_modified`: the list carries identity, not history — version metadata
+ * is the `/versions` surface — so the list renders no last-modified column.)
+ */
+export declare const settingsProfileSummary: z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>;
+export type SettingsProfileSummary = z.infer<typeof settingsProfileSummary>;
+export declare const settingsProfileList: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    description: z.ZodString;
+}, z.core.$strip>>;
+/**
+ * `GET /api/config/profiles/{name}` and each version body — the stored profile
+ * document (action=secret). `env` carries REAL values; `secret_keys` is the
+ * per-profile secret-marks band folded into the secret-mask union for masking.
+ */
+export declare const settingsProfileBody: z.ZodObject<{
+    description: z.ZodString;
+    env: z.ZodRecord<z.ZodString, z.ZodString>;
+    secret_keys: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SettingsProfileBody = z.infer<typeof settingsProfileBody>;
+/** `PUT /api/config/profiles/{name}` — a minimal save ack; `version` is the new store version. */
+export declare const settingsProfileSaved: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    version: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type SettingsProfileSaved = z.infer<typeof settingsProfileSaved>;
+/** `DELETE /api/config/profiles/{name}` — a minimal removal ack. */
+export declare const settingsProfileDeleted: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+}, z.core.$strip>;
+/** `POST /api/config/profiles/{name}/rollback` — the restore ack; `version` is the resulting active version. */
+export declare const settingsProfileRollback: z.ZodObject<{
+    ok: z.ZodLiteral<true>;
+    version: z.ZodNumber;
+}, z.core.$strip>;
+export type SettingsProfileRollback = z.infer<typeof settingsProfileRollback>;
+/**
+ * `POST /api/config/profiles/{name}/diff` — the SAVED profile vs the stored env
+ * (action=secret). `changed` carries real `old`/`new` values (UI masks via
+ * JsonDiff); `recycle_keys`/`refused_keys` are the diff's recycle-class and
+ * boundary-refused key names, called out in the UI before apply.
+ */
+export declare const settingsProfileDiff: z.ZodObject<{
+    added: z.ZodArray<z.ZodString>;
+    removed: z.ZodArray<z.ZodString>;
+    changed: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        old: z.ZodString;
+        new: z.ZodString;
+    }, z.core.$strip>>;
+    recycle_keys: z.ZodArray<z.ZodString>;
+    refused_keys: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export type SettingsProfileDiff = z.infer<typeof settingsProfileDiff>;
+/**
+ * `POST /api/config/profiles/{name}/apply` — the dedicated `profile_apply_response`
+ * (action=fenced, destructive). NAMES-ONLY (no env value in any
+ * section): `hot` is the hot-swapped key names; `recycle` is the orchestrator's
+ * per-worker section — one `{name, kind, status, generation_before}` row per recycled
+ * target, `generation_before` the life that was recycled, the applier's OWN row carrying
+ * the `self-deferred` status literal when the diff has serve-affecting recycle keys;
+ * `fresh` is the per-kind list of NEW ready lives observed since the pre-apply snapshot
+ * (each `{name, kind, generation}`), evidence of fresh capacity and never claimed as any
+ * target's successor; `refused` is `[]` on success by construction (populated
+ * `{key, reason}` only on a refusal), the populated refusal surfaces being the diff
+ * preview and the refusal error report. `fanout` is the mode-wrapped fleet broadcast,
+ * parsed EXPLICITLY so a failed propagation reaches the shared fleet-report handler. A
+ * drift throws `ApiSchemaError`.
+ */
+export declare const profileApplyResponse: z.ZodObject<{
+    hot: z.ZodArray<z.ZodString>;
+    recycle: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodString;
+        status: z.ZodString;
+        generation_before: z.ZodNumber;
+    }, z.core.$strip>>;
+    fresh: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        kind: z.ZodString;
+        generation: z.ZodNumber;
+    }, z.core.$strip>>;
+    refused: z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        reason: z.ZodString;
+    }, z.core.$strip>>;
+    fanout: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"local-only">;
+        note: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodString;
+        reachable: z.ZodBoolean;
+        local_only: z.ZodBoolean;
+        results: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            outcome: z.ZodEnum<{
+                failed: "failed";
+                resyncing: "resyncing";
+                recycling: "recycling";
+                stale: "stale";
+                applied: "applied";
+                missing: "missing";
+                departed: "departed";
+                timed_out: "timed_out";
+            }>;
+            payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+            error: z.ZodNullable<z.ZodString>;
+            detail: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        error: z.ZodNullable<z.ZodString>;
+        mode: z.ZodLiteral<"fleet">;
+    }, z.core.$strip>, z.ZodObject<{
+        op: z.ZodString;
+        reachable: z.ZodBoolean;
+        local_only: z.ZodBoolean;
+        results: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            outcome: z.ZodEnum<{
+                failed: "failed";
+                resyncing: "resyncing";
+                recycling: "recycling";
+                stale: "stale";
+                applied: "applied";
+                missing: "missing";
+                departed: "departed";
+                timed_out: "timed_out";
+            }>;
+            payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+            error: z.ZodNullable<z.ZodString>;
+            detail: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        error: z.ZodNullable<z.ZodString>;
+        mode: z.ZodLiteral<"unreachable">;
+    }, z.core.$strip>], "mode">;
+}, z.core.$strip>;
+export type ProfileApplyResponse = z.infer<typeof profileApplyResponse>;
+/**
+ * `GET /api/config/profiles/{name}/versions` — version METADATA only (action=read;
+ * no bodies), the generic versioned-store row minus `body`. `is_current` flags the
+ * active pointer.
+ */
+export declare const settingsProfileVersionMeta: z.ZodObject<{
+    version: z.ZodNumber;
+    tags: z.ZodArray<z.ZodString>;
+    created_at: z.ZodString;
+    is_current: z.ZodBoolean;
+}, z.core.$strip>;
+export type SettingsProfileVersionMeta = z.infer<typeof settingsProfileVersionMeta>;
+export declare const settingsProfileVersionList: z.ZodArray<z.ZodObject<{
+    version: z.ZodNumber;
+    tags: z.ZodArray<z.ZodString>;
+    created_at: z.ZodString;
+    is_current: z.ZodBoolean;
+}, z.core.$strip>>;
+/**
+ * `GET /api/config/profiles/{name}/versions/{version}` — one immutable version WITH
+ * its `body` (action=secret; body rendered masked per the secret-mask union). The generic
+ * versioned-store row shape.
+ */
+export declare const settingsProfileVersion: z.ZodObject<{
+    version: z.ZodNumber;
+    tags: z.ZodArray<z.ZodString>;
+    created_at: z.ZodString;
+    is_current: z.ZodBoolean;
+    body: z.ZodObject<{
+        description: z.ZodString;
+        env: z.ZodRecord<z.ZodString, z.ZodString>;
+        secret_keys: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SettingsProfileVersion = z.infer<typeof settingsProfileVersion>;
+//# sourceMappingURL=profiles.d.ts.map

package/dist/schemas/profiles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.d.ts","sourceRoot":"","sources":["../../src/schemas/profiles.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAQxB;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB;;;iBAGjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAC5E,eAAO,MAAM,mBAAmB;;;kBAAkC,CAAC;AAEnE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,kGAAkG;AAClG,eAAO,MAAM,oBAAoB;;;iBAG/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE,oEAAoE;AACpE,eAAO,MAAM,sBAAsB;;iBAAoC,CAAC;AAExE,gHAAgH;AAChH,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;iBAM9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAa/B,CAAC;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAExE;;;;GAIG;AACH,eAAO,MAAM,0BAA0B;;;;;iBAKrC,CAAC;AACH,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AACpF,eAAO,MAAM,0BAA0B;;;;;kBAAsC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBAEjC,CAAC;AACH,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/schemas/profiles.js

@@ -0,0 +1,100 @@
+/** Settings-profile record, version, diff and apply response schemas. */
+import { z } from 'zod';
+import { fleetReportFanout } from './fleet';
+// The admin-only `/api/config/profiles/*` surface. Secrets ride the wire in the
+// clear (secret/fenced routes); masking is CLIENT-SIDE per the secret-mask union. A drift
+// on any of these throws `ApiSchemaError`.
+/**
+ * `GET /api/config/profiles` — one row per stored profile. The list is
+ * names+descriptions ONLY (action=read); no `env`, no `secret_keys`, no bodies.
+ * (No `last_modified`: the list carries identity, not history — version metadata
+ * is the `/versions` surface — so the list renders no last-modified column.)
+ */
+export const settingsProfileSummary = z.object({
+    name: z.string(),
+    description: z.string(),
+});
+export const settingsProfileList = z.array(settingsProfileSummary);
+/**
+ * `GET /api/config/profiles/{name}` and each version body — the stored profile
+ * document (action=secret). `env` carries REAL values; `secret_keys` is the
+ * per-profile secret-marks band folded into the secret-mask union for masking.
+ */
+export const settingsProfileBody = z.object({
+    description: z.string(),
+    env: z.record(z.string(), z.string()),
+    secret_keys: z.array(z.string()),
+});
+/** `PUT /api/config/profiles/{name}` — a minimal save ack; `version` is the new store version. */
+export const settingsProfileSaved = z.object({
+    ok: z.literal(true),
+    version: z.number().optional(),
+});
+/** `DELETE /api/config/profiles/{name}` — a minimal removal ack. */
+export const settingsProfileDeleted = z.object({ ok: z.literal(true) });
+/** `POST /api/config/profiles/{name}/rollback` — the restore ack; `version` is the resulting active version. */
+export const settingsProfileRollback = z.object({
+    ok: z.literal(true),
+    version: z.number(),
+});
+/**
+ * `POST /api/config/profiles/{name}/diff` — the SAVED profile vs the stored env
+ * (action=secret). `changed` carries real `old`/`new` values (UI masks via
+ * JsonDiff); `recycle_keys`/`refused_keys` are the diff's recycle-class and
+ * boundary-refused key names, called out in the UI before apply.
+ */
+export const settingsProfileDiff = z.object({
+    added: z.array(z.string()),
+    removed: z.array(z.string()),
+    changed: z.array(z.object({ key: z.string(), old: z.string(), new: z.string() })),
+    recycle_keys: z.array(z.string()),
+    refused_keys: z.array(z.string()),
+});
+/**
+ * `POST /api/config/profiles/{name}/apply` — the dedicated `profile_apply_response`
+ * (action=fenced, destructive). NAMES-ONLY (no env value in any
+ * section): `hot` is the hot-swapped key names; `recycle` is the orchestrator's
+ * per-worker section — one `{name, kind, status, generation_before}` row per recycled
+ * target, `generation_before` the life that was recycled, the applier's OWN row carrying
+ * the `self-deferred` status literal when the diff has serve-affecting recycle keys;
+ * `fresh` is the per-kind list of NEW ready lives observed since the pre-apply snapshot
+ * (each `{name, kind, generation}`), evidence of fresh capacity and never claimed as any
+ * target's successor; `refused` is `[]` on success by construction (populated
+ * `{key, reason}` only on a refusal), the populated refusal surfaces being the diff
+ * preview and the refusal error report. `fanout` is the mode-wrapped fleet broadcast,
+ * parsed EXPLICITLY so a failed propagation reaches the shared fleet-report handler. A
+ * drift throws `ApiSchemaError`.
+ */
+export const profileApplyResponse = z.object({
+    hot: z.array(z.string()),
+    recycle: z.array(z.object({
+        name: z.string(),
+        kind: z.string(),
+        status: z.string(),
+        generation_before: z.number(),
+    })),
+    fresh: z.array(z.object({ name: z.string(), kind: z.string(), generation: z.number() })),
+    refused: z.array(z.object({ key: z.string(), reason: z.string() })),
+    fanout: fleetReportFanout,
+});
+/**
+ * `GET /api/config/profiles/{name}/versions` — version METADATA only (action=read;
+ * no bodies), the generic versioned-store row minus `body`. `is_current` flags the
+ * active pointer.
+ */
+export const settingsProfileVersionMeta = z.object({
+    version: z.number(),
+    tags: z.array(z.string()),
+    created_at: z.string(),
+    is_current: z.boolean(),
+});
+export const settingsProfileVersionList = z.array(settingsProfileVersionMeta);
+/**
+ * `GET /api/config/profiles/{name}/versions/{version}` — one immutable version WITH
+ * its `body` (action=secret; body rendered masked per the secret-mask union). The generic
+ * versioned-store row shape.
+ */
+export const settingsProfileVersion = settingsProfileVersionMeta.extend({
+    body: settingsProfileBody,
+});
+//# sourceMappingURL=profiles.js.map

package/dist/schemas/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/schemas/profiles.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C,gFAAgF;AAChF,0FAA0F;AAC1F,2CAA2C;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAEnE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrC,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CACjC,CAAC,CAAC;AAGH,kGAAkG;AAClG,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAGH,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAExE,gHAAgH;AAChH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAGH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjF,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;CAClC,CAAC,CAAC;AAGH;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3C,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,KAAK,CACd,CAAC,CAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;KAC9B,CAAC,CACH;IACD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,MAAM,CAAC;IACtE,IAAI,EAAE,mBAAmB;CAC1B,CAAC,CAAC"}

package/dist/schemas/roles.d.ts

@@ -0,0 +1,125 @@
+/** Role grant, version and audit response schemas. */
+import { z } from 'zod';
+/** A role's per-tag ACCESS LEVEL: `none` (no access), `read`, or `write`. */
+export declare const grantLevel: z.ZodEnum<{
+    none: "none";
+    read: "read";
+    write: "write";
+}>;
+export type GrantLevel = z.infer<typeof grantLevel>;
+/** A role's editable grant map: feature-group TAG name → the role's access level. */
+export declare const roleGrants: z.ZodRecord<z.ZodString, z.ZodEnum<{
+    none: "none";
+    read: "read";
+    write: "write";
+}>>;
+export type RoleGrants = z.infer<typeof roleGrants>;
+export declare const roleList: z.ZodArray<z.ZodObject<{
+    allow_all: z.ZodDefault<z.ZodBoolean>;
+    base_tier: z.ZodDefault<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
+    condition: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
+        content: z.ZodOptional<z.ZodString>;
+        id: z.ZodOptional<z.ZodString>;
+        kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>, z.ZodNull]>>;
+    description: z.ZodString;
+    grants: z.ZodRecord<z.ZodString, z.ZodEnum<{
+        none: "none";
+        read: "read";
+        write: "write";
+    }>>;
+    name: z.ZodString;
+    scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>>;
+/** `DELETE /api/auth/roles/{name}` — the deleted role's name. */
+export declare const roleDeleted: z.ZodObject<{
+    name: z.ZodString;
+    deleted: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * One immutable role-version row (`GET /api/auth/roles/{name}/versions` →
+ * `versions`). `body` is the role body at that version; `is_current` flags the
+ * active pointer. Mirrors the generic versioned-store row shape.
+ */
+export declare const roleVersion: z.ZodObject<{
+    version: z.ZodNumber;
+    body: z.ZodObject<{
+        allow_all: z.ZodDefault<z.ZodBoolean>;
+        base_tier: z.ZodDefault<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
+        condition: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
+            content: z.ZodOptional<z.ZodString>;
+            id: z.ZodOptional<z.ZodString>;
+            kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>, z.ZodNull]>>;
+        description: z.ZodString;
+        grants: z.ZodRecord<z.ZodString, z.ZodEnum<{
+            none: "none";
+            read: "read";
+            write: "write";
+        }>>;
+        name: z.ZodString;
+        scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>;
+    tags: z.ZodArray<z.ZodString>;
+    created_at: z.ZodString;
+    is_current: z.ZodBoolean;
+}, z.core.$strip>;
+export type RoleVersion = z.infer<typeof roleVersion>;
+/**
+ * One who/action/before→after audit row (`GET /api/auth/roles/{name}/versions` →
+ * `audit`). Its `body` carries the mutation kind, the actor, and the before/after
+ * role bodies (both `null` for a create's `before` / a delete's `after`).
+ */
+export declare const roleAuditEvent: z.ZodObject<{
+    version: z.ZodNumber;
+    body: z.ZodObject<{
+        action: z.ZodString;
+        actor: z.ZodNullable<z.ZodString>;
+        before: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+        after: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+    }, z.core.$strip>;
+    tags: z.ZodArray<z.ZodString>;
+    created_at: z.ZodString;
+    is_current: z.ZodBoolean;
+}, z.core.$strip>;
+export type RoleAuditEvent = z.infer<typeof roleAuditEvent>;
+/** `GET /api/auth/roles/{name}/versions` — the append-only history + audit trail. */
+export declare const roleVersions: z.ZodObject<{
+    versions: z.ZodArray<z.ZodObject<{
+        version: z.ZodNumber;
+        body: z.ZodObject<{
+            allow_all: z.ZodDefault<z.ZodBoolean>;
+            base_tier: z.ZodDefault<z.ZodUnion<readonly [z.ZodString, z.ZodNull]>>;
+            condition: z.ZodDefault<z.ZodUnion<readonly [z.ZodObject<{
+                content: z.ZodOptional<z.ZodString>;
+                id: z.ZodOptional<z.ZodString>;
+                kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            }, z.core.$strict>, z.ZodNull]>>;
+            description: z.ZodString;
+            grants: z.ZodRecord<z.ZodString, z.ZodEnum<{
+                none: "none";
+                read: "read";
+                write: "write";
+            }>>;
+            name: z.ZodString;
+            scopes: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        }, z.core.$strip>;
+        tags: z.ZodArray<z.ZodString>;
+        created_at: z.ZodString;
+        is_current: z.ZodBoolean;
+    }, z.core.$strip>>;
+    audit: z.ZodArray<z.ZodObject<{
+        version: z.ZodNumber;
+        body: z.ZodObject<{
+            action: z.ZodString;
+            actor: z.ZodNullable<z.ZodString>;
+            before: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+            after: z.ZodNullable<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+        }, z.core.$strip>;
+        tags: z.ZodArray<z.ZodString>;
+        created_at: z.ZodString;
+        is_current: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type RoleVersions = z.infer<typeof roleVersions>;
+//# sourceMappingURL=roles.d.ts.map

package/dist/schemas/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/schemas/roles.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,6EAA6E;AAC7E,eAAO,MAAM,UAAU;;;;EAAoC,CAAC;AAC5D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,qFAAqF;AACrF,eAAO,MAAM,UAAU;;;;GAAmC,CAAC;AAC3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;kBAAoB,CAAC;AAE1C,iEAAiE;AACjE,eAAO,MAAM,WAAW;;;iBAAuD,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;iBAMtB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;iBAWzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,qFAAqF;AACrF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGvB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/schemas/roles.js

@@ -0,0 +1,46 @@
+/** Role grant, version and audit response schemas. */
+import { z } from 'zod';
+import { roleBody } from './served';
+import { jsonValue } from './shared';
+/** A role's per-tag ACCESS LEVEL: `none` (no access), `read`, or `write`. */
+export const grantLevel = z.enum(['none', 'read', 'write']);
+/** A role's editable grant map: feature-group TAG name → the role's access level. */
+export const roleGrants = z.record(z.string(), grantLevel);
+export const roleList = z.array(roleBody);
+/** `DELETE /api/auth/roles/{name}` — the deleted role's name. */
+export const roleDeleted = z.object({ name: z.string(), deleted: z.boolean() });
+/**
+ * One immutable role-version row (`GET /api/auth/roles/{name}/versions` →
+ * `versions`). `body` is the role body at that version; `is_current` flags the
+ * active pointer. Mirrors the generic versioned-store row shape.
+ */
+export const roleVersion = z.object({
+    version: z.number(),
+    body: roleBody,
+    tags: z.array(z.string()),
+    created_at: z.string(),
+    is_current: z.boolean(),
+});
+/**
+ * One who/action/before→after audit row (`GET /api/auth/roles/{name}/versions` →
+ * `audit`). Its `body` carries the mutation kind, the actor, and the before/after
+ * role bodies (both `null` for a create's `before` / a delete's `after`).
+ */
+export const roleAuditEvent = z.object({
+    version: z.number(),
+    body: z.object({
+        action: z.string(),
+        actor: z.string().nullable(),
+        before: jsonValue.nullable(),
+        after: jsonValue.nullable(),
+    }),
+    tags: z.array(z.string()),
+    created_at: z.string(),
+    is_current: z.boolean(),
+});
+/** `GET /api/auth/roles/{name}/versions` — the append-only history + audit trail. */
+export const roleVersions = z.object({
+    versions: z.array(roleVersion),
+    audit: z.array(roleAuditEvent),
+});
+//# sourceMappingURL=roles.js.map

package/dist/schemas/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/schemas/roles.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAG5D,qFAAqF;AACrF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,CAAC,CAAC;AAG3D,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;AAE1C,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AAEhF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,QAAQ;IACd,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAGH;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;QAClB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;QAC5B,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE;KAC5B,CAAC;IACF,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE;CACxB,CAAC,CAAC;AAGH,qFAAqF;AACrF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC;IAC9B,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC;CAC/B,CAAC,CAAC"}

package/dist/schemas/schedules.d.ts

@@ -0,0 +1,25 @@
+/** Schedule listing and server-clock response schemas. */
+import { z } from 'zod';
+export declare const scheduleItem: z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    schedule: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+    target: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+    args: z.ZodOptional<z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+    kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+}, z.core.$loose>;
+export declare const scheduleList: z.ZodArray<z.ZodObject<{
+    name: z.ZodString;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    schedule: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+    target: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+    args: z.ZodOptional<z.ZodArray<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+    kwargs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>>;
+}, z.core.$loose>>;
+export type ScheduleItem = z.infer<typeof scheduleItem>;
+export declare const serverDateTime: z.ZodObject<{
+    utc: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
+    local: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+    system: z.ZodOptional<z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>>;
+}, z.core.$loose>;
+//# sourceMappingURL=schedules.d.ts.map

package/dist/schemas/schedules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedules.d.ts","sourceRoot":"","sources":["../../src/schemas/schedules.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAOxB,eAAO,MAAM,YAAY;;;;;;;iBASf,CAAC;AACX,eAAO,MAAM,YAAY;;;;;;;kBAAwB,CAAC;AAClD,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC;AAExD,eAAO,MAAM,cAAc;;;;iBAMjB,CAAC"}

package/dist/schemas/schedules.js

@@ -0,0 +1,24 @@
+/** Schedule listing and server-clock response schemas. */
+import { z } from 'zod';
+import { jsonValue } from './shared';
+// The skeleton returns opaque backend-tool results; the table reads a few known
+// fields and passes the rest through untouched.
+export const scheduleItem = z
+    .object({
+    name: z.string(),
+    enabled: z.boolean().optional(),
+    schedule: jsonValue.optional(),
+    target: jsonValue.optional(),
+    args: z.array(jsonValue).optional(),
+    kwargs: z.record(z.string(), jsonValue).optional(),
+})
+    .loose();
+export const scheduleList = z.array(scheduleItem);
+export const serverDateTime = z
+    .object({
+    utc: jsonValue,
+    local: jsonValue.optional(),
+    system: jsonValue.optional(),
+})
+    .loose();
+//# sourceMappingURL=schedules.js.map

package/dist/schemas/schedules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schedules.js","sourceRoot":"","sources":["../../src/schemas/schedules.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,gFAAgF;AAChF,gDAAgD;AAEhD,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC/B,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC9B,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC5B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE;CACnD,CAAC;KACD,KAAK,EAAE,CAAC;AACX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAGlD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC5B,MAAM,CAAC;IACN,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE;IAC3B,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE;CAC7B,CAAC;KACD,KAAK,EAAE,CAAC"}