@tai42/api-client 20.0.0 → 21.0.0

package/dist/schemas/api-keys.js

@@ -1,29 +1,15 @@
 /** API-key payload and mint/edit/revoke response schemas. */
 import { z } from 'zod';
-import { principalRef } from './principals';
-import { templatedText } from './served';
-import { jsonValue } from './shared';
+import * as openapi from '../generated/openapi-schemas';
 /** The per-key payloads (`GET /api/auth/tokens-payload`). The stable per-mint
- * `key_fingerprint` is nested under `policy_data`; the picker reads it there. */
-export const tokensPayload = z.array(z.object({
-    // The value an `execution_key` binding names.
-    user_id: z.string().min(1),
-    description: z.string(),
-    scopes: z.array(z.string()),
-    policy_data: jsonValue,
-    condition: templatedText.nullable().optional(),
-    // The key's OWNER principal (kind + display name); `null` for a key whose
-    // principal row is absent (an orphaned restore state).
-    principal: principalRef.nullable().optional(),
-    // `true` for a key whose owning principal row is gone (an orphaned key that a
-    // backup restore left without its principal).
-    orphaned: z.boolean().optional(),
-}));
+ * `key_fingerprint` is nested under `policy_data`; the picker reads it there. `principal`
+ * is the key's OWNER (`null` for a key whose principal row is absent), `orphaned` is `true`
+ * for a key whose owning principal row is gone. */
+export const tokensPayload = openapi.tokenPayloadList;
+// Hand-written: the client narrows the mint reply to the raw key it shows once.
 /** Mint reply `{ api_key, key_fingerprint }` narrowed to the raw `sk-…` key,
  *  returned once at creation and never again. */
-export const createdApiKey = z
-    .object({ api_key: z.string(), key_fingerprint: z.string() })
-    .transform((minted) => minted.api_key);
-export const editApiKeyResult = z.object({ user_id: z.string(), updated: z.boolean() });
-export const revokeApiKeyResult = z.object({ user_id: z.string(), revoked: z.boolean() });
+export const createdApiKey = openapi.apiKeyCreateResult.transform((minted) => minted.api_key);
+export const editApiKeyResult = openapi.userUpdateAck;
+export const revokeApiKeyResult = openapi.revokeAck;
 //# sourceMappingURL=api-keys.js.map

package/dist/schemas/api-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC;iFACiF;AACjF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAClC,CAAC,CAAC,MAAM,CAAC;IACP,8CAA8C;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC3B,WAAW,EAAE,SAAS;IACtB,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC9C,0EAA0E;IAC1E,uDAAuD;IACvD,SAAS,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAC7C,8EAA8E;IAC9E,8CAA8C;IAC9C,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACjC,CAAC,CACH,CAAC;AAGF;iDACiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;KAC5D,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACxF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC"}
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/schemas/api-keys.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAExD;;;mDAGmD;AACnD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC;AAGtD,gFAAgF;AAChF;iDACiD;AACjD,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,SAAS,CAAC"}

package/dist/schemas/auth-routes.d.ts

@@ -1,5 +1,5 @@
 /** Route catalog, scope mapping and public-route response schemas. */
-import { z } from 'zod';
+import type { z } from 'zod';
 /** `{ url: scope_id }` — every URL currently mapped to a scope. */
 export declare const authScopes: z.ZodRecord<z.ZodString, z.ZodString>;
 export declare const addUrlToScopeResult: z.ZodObject<{
@@ -10,23 +10,9 @@ export declare const removeUrlFromScopeResult: z.ZodObject<{
     url: z.ZodString;
 }, z.core.$strip>;
 export declare const removeScopeResult: z.ZodObject<{
-    scope_id: z.ZodString;
     deleted_keys: z.ZodNumber;
+    scope_id: z.ZodString;
 }, z.core.$strip>;
-/**
- * A route's authorization ACTION class, joined onto the catalog from the route
- * registry. `read`/`write` routes are GRANTABLE — a role's per-tag level opens
- * them; `fenced`/`secret` routes are ADMIN-ONLY and never grantable (no per-tag
- * level reaches them). `null` marks a path the registry carries no metadata for
- * (an unregistered/ungated path — no feature tags, no action).
- */
-export declare const routeAction: z.ZodEnum<{
-    read: "read";
-    write: "write";
-    fenced: "fenced";
-    secret: "secret";
-}>;
-export type RouteAction = z.infer<typeof routeAction>;
 /**
  * One row of the route catalog (`GET /api/auth/routes`) — a plain HTTP route with
  * its current mapping, JOINED with its route-registry metadata. `mapped` is the
@@ -36,35 +22,54 @@ export type RouteAction = z.infer<typeof routeAction>;
  * description, and `action` its authorization class — the join fields the Roles
  * grant editor reads to derive grantable feature groups and mark the admin-only
  * (fenced/secret) routes it must never offer a grant for. An unregistered path
- * carries `tags: []`, `summary: ''`, `action: null`.
+ * carries `tags: []`, `summary: ''`, `action: null`. `declared_public` is `true` for
+ * a route its registration declares public: it is served without authentication
+ * and no scope mapping or public pin changes that, so the mapper never offers it
+ * for a scope.
  */
 export declare const authRoute: z.ZodObject<{
-    path: z.ZodString;
-    methods: z.ZodArray<z.ZodString>;
-    mapped: z.ZodNullable<z.ZodString>;
-    tags: z.ZodArray<z.ZodString>;
-    summary: z.ZodString;
     action: z.ZodNullable<z.ZodEnum<{
         read: "read";
         write: "write";
-        fenced: "fenced";
         secret: "secret";
+        fenced: "fenced";
     }>>;
+    declared_public: z.ZodBoolean;
+    mapped: z.ZodNullable<z.ZodString>;
+    methods: z.ZodArray<z.ZodString>;
+    path: z.ZodString;
+    summary: z.ZodString;
+    tags: z.ZodArray<z.ZodString>;
 }, z.core.$strip>;
 export type AuthRoute = z.infer<typeof authRoute>;
 export declare const authRoutes: z.ZodArray<z.ZodObject<{
-    path: z.ZodString;
-    methods: z.ZodArray<z.ZodString>;
-    mapped: z.ZodNullable<z.ZodString>;
-    tags: z.ZodArray<z.ZodString>;
-    summary: z.ZodString;
     action: z.ZodNullable<z.ZodEnum<{
         read: "read";
         write: "write";
-        fenced: "fenced";
         secret: "secret";
+        fenced: "fenced";
     }>>;
+    declared_public: z.ZodBoolean;
+    mapped: z.ZodNullable<z.ZodString>;
+    methods: z.ZodArray<z.ZodString>;
+    path: z.ZodString;
+    summary: z.ZodString;
+    tags: z.ZodArray<z.ZodString>;
 }, z.core.$strip>>;
+/**
+ * A route's authorization ACTION class, joined onto the catalog from the route
+ * registry. `read`/`write` routes are GRANTABLE — a role's per-tag level opens
+ * them; `fenced`/`secret` routes are ADMIN-ONLY and never grantable (no per-tag
+ * level reaches them). `null` on a row marks a path the registry carries no metadata
+ * for (an unregistered/ungated path — no feature tags, no action).
+ */
+export declare const routeAction: z.ZodEnum<{
+    read: "read";
+    write: "write";
+    secret: "secret";
+    fenced: "fenced";
+}>;
+export type RouteAction = z.infer<typeof routeAction>;
 /** `GET /api/auth/public-routes` — the sorted urls pinned to the public marker. */
 export declare const publicRoutes: z.ZodArray<z.ZodString>;
 /** `POST /api/auth/public-routes` — the pinned url. */

package/dist/schemas/auth-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-routes.d.ts","sourceRoot":"","sources":["../../src/schemas/auth-routes.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,mEAAmE;AACnE,eAAO,MAAM,UAAU,uCAAmC,CAAC;AAE3D,eAAO,MAAM,mBAAmB;;;iBAAsD,CAAC;AACvF,eAAO,MAAM,wBAAwB;;iBAAgC,CAAC;AACtE,eAAO,MAAM,iBAAiB;;;iBAA+D,CAAC;AAE9F;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;EAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;iBAOpB,CAAC;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAClD,eAAO,MAAM,UAAU;;;;;;;;;;;;kBAAqB,CAAC;AAC7C,mFAAmF;AACnF,eAAO,MAAM,YAAY,yBAAsB,CAAC;AAEhD,uDAAuD;AACvD,eAAO,MAAM,eAAe;;iBAAgC,CAAC;AAC7D,iFAAiF;AACjF,eAAO,MAAM,iBAAiB;;iBAAgC,CAAC"}
+{"version":3,"file":"auth-routes.d.ts","sourceRoot":"","sources":["../../src/schemas/auth-routes.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAI7B,mEAAmE;AACnE,eAAO,MAAM,UAAU,uCAAsB,CAAC;AAE9C,eAAO,MAAM,mBAAmB;;;iBAAsB,CAAC;AACvD,eAAO,MAAM,wBAAwB;;iBAAiB,CAAC;AACvD,eAAO,MAAM,iBAAiB;;;iBAA4B,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;iBAA0B,CAAC;AACjD,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAClD,eAAO,MAAM,UAAU;;;;;;;;;;;;;kBAA2B,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;EAAgD,CAAC;AACzE,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAC;AAEtD,mFAAmF;AACnF,eAAO,MAAM,YAAY,yBAAqB,CAAC;AAE/C,uDAAuD;AACvD,eAAO,MAAM,eAAe;;iBAAiB,CAAC;AAC9C,iFAAiF;AACjF,eAAO,MAAM,iBAAiB;;iBAAiB,CAAC"}

package/dist/schemas/auth-routes.js

@@ -1,18 +1,9 @@
-/** Route catalog, scope mapping and public-route response schemas. */
-import { z } from 'zod';
+import * as openapi from '../generated/openapi-schemas';
 /** `{ url: scope_id }` — every URL currently mapped to a scope. */
-export const authScopes = z.record(z.string(), z.string());
-export const addUrlToScopeResult = z.object({ scope_id: z.string(), url: z.string() });
-export const removeUrlFromScopeResult = z.object({ url: z.string() });
-export const removeScopeResult = z.object({ scope_id: z.string(), deleted_keys: z.number() });
-/**
- * A route's authorization ACTION class, joined onto the catalog from the route
- * registry. `read`/`write` routes are GRANTABLE — a role's per-tag level opens
- * them; `fenced`/`secret` routes are ADMIN-ONLY and never grantable (no per-tag
- * level reaches them). `null` marks a path the registry carries no metadata for
- * (an unregistered/ungated path — no feature tags, no action).
- */
-export const routeAction = z.enum(['read', 'write', 'fenced', 'secret']);
+export const authScopes = openapi.scopeUrlMap;
+export const addUrlToScopeResult = openapi.scopeUrlAck;
+export const removeUrlFromScopeResult = openapi.urlAck;
+export const removeScopeResult = openapi.scopeDeleteResult;
 /**
  * One row of the route catalog (`GET /api/auth/routes`) — a plain HTTP route with
  * its current mapping, JOINED with its route-registry metadata. `mapped` is the
@@ -22,21 +13,25 @@ export const routeAction = z.enum(['read', 'write', 'fenced', 'secret']);
  * description, and `action` its authorization class — the join fields the Roles
  * grant editor reads to derive grantable feature groups and mark the admin-only
  * (fenced/secret) routes it must never offer a grant for. An unregistered path
- * carries `tags: []`, `summary: ''`, `action: null`.
+ * carries `tags: []`, `summary: ''`, `action: null`. `declared_public` is `true` for
+ * a route its registration declares public: it is served without authentication
+ * and no scope mapping or public pin changes that, so the mapper never offers it
+ * for a scope.
+ */
+export const authRoute = openapi.routeMappingRow;
+export const authRoutes = openapi.routeMappingList;
+/**
+ * A route's authorization ACTION class, joined onto the catalog from the route
+ * registry. `read`/`write` routes are GRANTABLE — a role's per-tag level opens
+ * them; `fenced`/`secret` routes are ADMIN-ONLY and never grantable (no per-tag
+ * level reaches them). `null` on a row marks a path the registry carries no metadata
+ * for (an unregistered/ungated path — no feature tags, no action).
  */
-export const authRoute = z.object({
-    path: z.string(),
-    methods: z.array(z.string()),
-    mapped: z.string().nullable(),
-    tags: z.array(z.string()),
-    summary: z.string(),
-    action: routeAction.nullable(),
-});
-export const authRoutes = z.array(authRoute);
+export const routeAction = openapi.routeMappingRow.shape.action.unwrap();
 /** `GET /api/auth/public-routes` — the sorted urls pinned to the public marker. */
-export const publicRoutes = z.array(z.string());
+export const publicRoutes = openapi.stringList;
 /** `POST /api/auth/public-routes` — the pinned url. */
-export const pinPublicResult = z.object({ url: z.string() });
+export const pinPublicResult = openapi.urlAck;
 /** `DELETE /api/auth/public-routes` — the unpinned url (404 when not pinned). */
-export const unpinPublicResult = z.object({ url: z.string() });
+export const unpinPublicResult = openapi.urlAck;
 //# sourceMappingURL=auth-routes.js.map

package/dist/schemas/auth-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-routes.js","sourceRoot":"","sources":["../../src/schemas/auth-routes.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,mEAAmE;AACnE,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAE3D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtE,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE9F;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAGzE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,MAAM,EAAE,WAAW,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;AAC7C,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAEhD,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7D,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC"}
+{"version":3,"file":"auth-routes.js","sourceRoot":"","sources":["../../src/schemas/auth-routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AAExD,mEAAmE;AACnE,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC;AAE9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;AACvD,MAAM,CAAC,MAAM,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC;AACvD,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;AAE3D;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,CAAC;AAEjD,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AAGzE,mFAAmF;AACnF,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC;AAE/C,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;AAC9C,iFAAiF;AACjF,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC"}

package/dist/schemas/backup.d.ts

@@ -4,75 +4,196 @@ export declare const backupSections: z.ZodArray<z.ZodObject<{
     name: z.ZodString;
     secret: z.ZodBoolean;
 }, z.core.$strip>>;
-/** The exported backup document — validated when the UI reads a picked file. */
+/**
+ * A backup document as the import door accepts it — validated when the UI reads a picked
+ * file. Hand-written over the export's document: the import door takes `version` 1 and a
+ * `sections` object, and the export's `errors` map is optional there.
+ */
 export declare const backupDocument: z.ZodObject<{
-    version: z.ZodLiteral<1>;
     created_at: z.ZodString;
     sections: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    version: z.ZodLiteral<1>;
     errors: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
 }, z.core.$strip>;
 export type BackupDocument = z.infer<typeof backupDocument>;
-export declare const backupImportReport: z.ZodObject<{
-    ok: z.ZodBoolean;
-    sections: z.ZodRecord<z.ZodString, z.ZodObject<{
-        created: z.ZodNumber;
-        updated: z.ZodNumber;
-        skipped: z.ZodNumber;
-        errors: z.ZodArray<z.ZodString>;
+/** The api keys a restore minted, shown once: carried in a section report's `details`. */
+export declare const backupNewApiKeys: z.ZodArray<z.ZodObject<{
+    user_id: z.ZodString;
+    description: z.ZodString;
+    api_key: z.ZodString;
+}, z.core.$strip>>;
+export type BackupNewApiKeys = z.infer<typeof backupNewApiKeys>;
+export declare const backupSectionReport: z.ZodObject<{
+    awaiting_respawn: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        keys: z.ZodArray<z.ZodString>;
+        name: z.ZodString;
+    }, z.core.$strip>>>;
+    created: z.ZodDefault<z.ZodNumber>;
+    errors: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    recycle: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+        fresh: z.ZodArray<z.ZodObject<{
+            generation: z.ZodNumber;
+            kind: z.ZodString;
+            name: z.ZodString;
+        }, z.core.$strip>>;
+        recycle: z.ZodArray<z.ZodObject<{
+            detail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            generation_before: z.ZodNumber;
+            kind: z.ZodString;
+            name: z.ZodString;
+            status: z.ZodString;
+        }, z.core.$strip>>;
+        recycle_stopped: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+            detail: z.ZodString;
+            kind: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>>;
+    skipped: z.ZodDefault<z.ZodNumber>;
+    updated: z.ZodDefault<z.ZodNumber>;
+    fanout: z.ZodDefault<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"local-only">;
+        note: z.ZodString;
+    }, z.core.$strip>, z.ZodObject<{
+        error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        local_only: z.ZodDefault<z.ZodBoolean>;
+        op: z.ZodString;
+        reachable: z.ZodDefault<z.ZodBoolean>;
+        results: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            detail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            name: z.ZodString;
+            outcome: z.ZodEnum<{
+                applied: "applied";
+                failed: "failed";
+                missing: "missing";
+                departed: "departed";
+                timed_out: "timed_out";
+                resyncing: "resyncing";
+                recycling: "recycling";
+                stale: "stale";
+            }>;
+            payload: z.ZodDefault<z.ZodNullable<z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        mode: z.ZodLiteral<"fleet">;
+    }, z.core.$strip>, z.ZodObject<{
+        error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        local_only: z.ZodDefault<z.ZodBoolean>;
+        op: z.ZodString;
+        reachable: z.ZodDefault<z.ZodBoolean>;
+        results: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            detail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            name: z.ZodString;
+            outcome: z.ZodEnum<{
+                applied: "applied";
+                failed: "failed";
+                missing: "missing";
+                departed: "departed";
+                timed_out: "timed_out";
+                resyncing: "resyncing";
+                recycling: "recycling";
+                stale: "stale";
+            }>;
+            payload: z.ZodDefault<z.ZodNullable<z.ZodUnknown>>;
+        }, z.core.$strip>>>;
+        mode: z.ZodLiteral<"unreachable">;
+    }, z.core.$strip>], "mode">>>;
+    details: z.ZodDefault<z.ZodObject<{
         new_api_keys: z.ZodOptional<z.ZodArray<z.ZodObject<{
             user_id: z.ZodString;
             description: z.ZodString;
             api_key: z.ZodString;
         }, z.core.$strip>>>;
-        fanout: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    }, z.core.$catchall<z.ZodUnknown>>>;
+}, z.core.$strict>;
+export type BackupSectionReport = z.infer<typeof backupSectionReport>;
+export declare const backupImportReport: z.ZodObject<{
+    ok: z.ZodBoolean;
+    sections: z.ZodRecord<z.ZodString, z.ZodObject<{
+        awaiting_respawn: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            keys: z.ZodArray<z.ZodString>;
+            name: z.ZodString;
+        }, z.core.$strip>>>;
+        created: z.ZodDefault<z.ZodNumber>;
+        errors: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        recycle: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+            fresh: z.ZodArray<z.ZodObject<{
+                generation: z.ZodNumber;
+                kind: z.ZodString;
+                name: z.ZodString;
+            }, z.core.$strip>>;
+            recycle: z.ZodArray<z.ZodObject<{
+                detail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                generation_before: z.ZodNumber;
+                kind: z.ZodString;
+                name: z.ZodString;
+                status: z.ZodString;
+            }, z.core.$strip>>;
+            recycle_stopped: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+                detail: z.ZodString;
+                kind: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>>;
+        skipped: z.ZodDefault<z.ZodNumber>;
+        updated: z.ZodDefault<z.ZodNumber>;
+        fanout: z.ZodDefault<z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
             mode: z.ZodLiteral<"local-only">;
             note: z.ZodString;
         }, z.core.$strip>, z.ZodObject<{
+            error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            local_only: z.ZodDefault<z.ZodBoolean>;
             op: z.ZodString;
-            reachable: z.ZodBoolean;
-            local_only: z.ZodBoolean;
-            results: z.ZodArray<z.ZodObject<{
+            reachable: z.ZodDefault<z.ZodBoolean>;
+            results: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                detail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 name: z.ZodString;
                 outcome: z.ZodEnum<{
-                    failed: "failed";
                     applied: "applied";
-                    resyncing: "resyncing";
-                    recycling: "recycling";
-                    stale: "stale";
+                    failed: "failed";
                     missing: "missing";
                     departed: "departed";
                     timed_out: "timed_out";
+                    resyncing: "resyncing";
+                    recycling: "recycling";
+                    stale: "stale";
                 }>;
-                payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-                error: z.ZodNullable<z.ZodString>;
-                detail: z.ZodNullable<z.ZodString>;
-            }, z.core.$strip>>;
-            error: z.ZodNullable<z.ZodString>;
+                payload: z.ZodDefault<z.ZodNullable<z.ZodUnknown>>;
+            }, z.core.$strip>>>;
             mode: z.ZodLiteral<"fleet">;
         }, z.core.$strip>, z.ZodObject<{
+            error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            local_only: z.ZodDefault<z.ZodBoolean>;
             op: z.ZodString;
-            reachable: z.ZodBoolean;
-            local_only: z.ZodBoolean;
-            results: z.ZodArray<z.ZodObject<{
+            reachable: z.ZodDefault<z.ZodBoolean>;
+            results: z.ZodDefault<z.ZodArray<z.ZodObject<{
+                detail: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+                error: z.ZodDefault<z.ZodNullable<z.ZodString>>;
                 name: z.ZodString;
                 outcome: z.ZodEnum<{
-                    failed: "failed";
                     applied: "applied";
-                    resyncing: "resyncing";
-                    recycling: "recycling";
-                    stale: "stale";
+                    failed: "failed";
                     missing: "missing";
                     departed: "departed";
                     timed_out: "timed_out";
+                    resyncing: "resyncing";
+                    recycling: "recycling";
+                    stale: "stale";
                 }>;
-                payload: z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>;
-                error: z.ZodNullable<z.ZodString>;
-                detail: z.ZodNullable<z.ZodString>;
-            }, z.core.$strip>>;
-            error: z.ZodNullable<z.ZodString>;
+                payload: z.ZodDefault<z.ZodNullable<z.ZodUnknown>>;
+            }, z.core.$strip>>>;
             mode: z.ZodLiteral<"unreachable">;
-        }, z.core.$strip>], "mode">>;
-    }, z.core.$strip>>;
+        }, z.core.$strip>], "mode">>>;
+        details: z.ZodDefault<z.ZodObject<{
+            new_api_keys: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                user_id: z.ZodString;
+                description: z.ZodString;
+                api_key: z.ZodString;
+            }, z.core.$strip>>>;
+        }, z.core.$catchall<z.ZodUnknown>>>;
+    }, z.core.$strict>>;
 }, z.core.$strip>;
 export type BackupImportReport = z.infer<typeof backupImportReport>;
 //# sourceMappingURL=backup.d.ts.map

package/dist/schemas/backup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/schemas/backup.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,cAAc;;;kBAA+D,CAAC;AAE3F,gFAAgF;AAChF,eAAO,MAAM,cAAc;;;;;iBAKzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE5D,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAyB7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../../src/schemas/backup.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,eAAO,MAAM,cAAc;;;kBAA+B,CAAC;AAE3D;;;;GAIG;AACH,eAAO,MAAM,cAAc;;;;;iBAGzB,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAK5D,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB;;;;kBAE5B,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAEhE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAU9B,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAE7B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/schemas/backup.js

@@ -1,33 +1,34 @@
 /** Backup section, document and import-report response schemas. */
 import { z } from 'zod';
+import * as openapi from '../generated/openapi-schemas';
 import { fleetReportFanout } from './fleet';
-export const backupSections = z.array(z.object({ name: z.string(), secret: z.boolean() }));
-/** The exported backup document — validated when the UI reads a picked file. */
-export const backupDocument = z.object({
+export const backupSections = openapi.backupSectionListing;
+/**
+ * A backup document as the import door accepts it — validated when the UI reads a picked
+ * file. Hand-written over the export's document: the import door takes `version` 1 and a
+ * `sections` object, and the export's `errors` map is optional there.
+ */
+export const backupDocument = openapi.backupExportDocument.extend({
     version: z.literal(1),
-    created_at: z.string(),
-    sections: z.record(z.string(), z.unknown()),
-    errors: z.record(z.string(), z.string()).optional(),
+    errors: openapi.backupExportDocument.shape.errors.optional(),
 });
-export const backupImportReport = z.object({
-    ok: z.boolean(),
-    sections: z.record(z.string(), z.object({
-        created: z.number(),
-        updated: z.number(),
-        skipped: z.number(),
-        errors: z.array(z.string()),
-        new_api_keys: z
-            .array(z.object({
-            user_id: z.string(),
-            description: z.string(),
-            api_key: z.string(),
-        }))
-            .optional(),
-        // The `manifest` and `env` sections apply through the config pipeline, so their
-        // report carries the mode-wrapped fleet `fanout` of the restore's reload; other
-        // sections omit it. Parsed EXPLICITLY so the shared fleet-report handler can
-        // surface a failed restore propagation — otherwise zod would strip it silently.
-        fanout: fleetReportFanout.optional(),
-    })),
+// Hand-written: the spec publishes a section's fan-out as one object with optional fields
+// and its `details` as an open map; the client discriminates the fan-out's modes and reads
+// the keys a restore minted.
+/** The api keys a restore minted, shown once: carried in a section report's `details`. */
+export const backupNewApiKeys = z.array(z.object({ user_id: z.string(), description: z.string(), api_key: z.string() }));
+export const backupSectionReport = openapi.backupSectionReport.extend({
+    // The `manifest` and `env` sections apply through the config pipeline, so their
+    // report carries the mode-wrapped fleet `fanout` of the restore's reload; other
+    // sections carry `null`. Parsed EXPLICITLY so the shared fleet-report handler can
+    // surface a failed restore propagation.
+    fanout: fleetReportFanout.nullable().default(null),
+    details: z
+        .object({ new_api_keys: backupNewApiKeys.optional() })
+        .catchall(z.unknown())
+        .default({}),
+});
+export const backupImportReport = openapi.backupImportResult.extend({
+    sections: z.record(z.string(), backupSectionReport),
 });
 //# sourceMappingURL=backup.js.map

package/dist/schemas/backup.js.map

@@ -1 +1 @@
-{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/schemas/backup.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAE3F,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAC3C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE;IACf,QAAQ,EAAE,CAAC,CAAC,MAAM,CAChB,CAAC,CAAC,MAAM,EAAE,EACV,CAAC,CAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3B,YAAY,EAAE,CAAC;aACZ,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;YACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;YACvB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;SACpB,CAAC,CACH;aACA,QAAQ,EAAE;QACb,gFAAgF;QAChF,gFAAgF;QAChF,6EAA6E;QAC7E,gFAAgF;QAChF,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE;KACrC,CAAC,CACH;CACF,CAAC,CAAC"}
+{"version":3,"file":"backup.js","sourceRoot":"","sources":["../../src/schemas/backup.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,OAAO,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAE5C,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,oBAAoB,CAAC;AAE3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC;IAChE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,OAAO,CAAC,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;CAC7D,CAAC,CAAC;AAGH,0FAA0F;AAC1F,2FAA2F;AAC3F,6BAA6B;AAC7B,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CACrC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAChF,CAAC;AAGF,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC;IACpE,gFAAgF;IAChF,gFAAgF;IAChF,kFAAkF;IAClF,wCAAwC;IACxC,MAAM,EAAE,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAClD,OAAO,EAAE,CAAC;SACP,MAAM,CAAC,EAAE,YAAY,EAAE,gBAAgB,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrD,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;SACrB,OAAO,CAAC,EAAE,CAAC;CACf,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC;IAClE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,mBAAmB,CAAC;CACpD,CAAC,CAAC"}