@vertesia/common 1.6.0-dev.20260923.085325Z → 1.6.0-dev.20261008.064737Z

package/src/apikey.ts

@@ -1,19 +1,8 @@
-import type { z } from 'zod';
 import type { PropertyConditions } from './access-control.js';
-import type {
-    ApiKeyArraySchema,
-    ApiKeyListQuerySchema,
-    ApiKeyReadQuerySchema,
-    ApiKeyReadResponseSchema,
-    ApiKeySchema,
-    ApiKeyWithValueSchema,
-    AuthTokenResponseSchema,
-    CreateApiKeyPayloadSchema,
-    UpdateApiKeyPayloadSchema,
-} from './api-schemas/apikey.js';
 import type { UserGroupRef } from './group.js';
 import type { ProjectRef, SystemRoles } from './project.js';
 import type { AccountRef } from './user.js';
+import type * as Wire from './wire-types.generated.js';
 
 /**
  * `ApiKeyTypes` lives in `./apikey-values.js` so the API schemas can read it without importing this
@@ -22,17 +11,17 @@ import type { AccountRef } from './user.js';
 export * from './apikey-values.js';
 
 /**
- * Per-scope, per-verb property-condition arrays that narrow content visibility
- * at query time. Each value array uses $or semantics — any matching condition
- * set grants access. Presence of this object switches content access from
- * allow-all to restrict mode.
+ * Per-scope, per-verb property-condition arrays that narrow resource access.
+ * Each value array uses $or semantics — any matching condition set grants
+ * access. The consumer defines when the presence of its scope switches access
+ * from the baseline to restrict mode.
  *
  * The bare keys `read`/`write`/`delete` apply to the default `'document'`
  * scope. They also receive entries emitted by system-role ABAC ACEs (which
  * predate the scope concept).
  *
  * Non-default scopes appear as prefixed keys: `'collection:read'`,
- * `'collection:write'`, `'task:read'`, etc. — the prefix is the
+ * `'agent_run:control'`, `'task:read'`, etc. — the prefix is the
  * `AceConditions.scope` value, the suffix is the verb derived from the
  * ABAC role's permission set.
  *
@@ -42,8 +31,14 @@ export interface ContentSecurity {
     read?: PropertyConditions[];
     write?: PropertyConditions[];
     delete?: PropertyConditions[];
-    /** Scope-prefixed entries: `'collection:read'`, `'task:write'`, etc. */
-    [scopedKey: string]: PropertyConditions[] | undefined;
+    /**
+     * Either a scope-prefixed conditions entry (`'collection:read'`, `'agent_run:control'`, …) whose
+     * value is a conditions array, OR a cross-project shared-content group keyed by `'@<owner_project_id>'`
+     * whose value is a nested `ContentSecurity` — the SAME shape scoped to that owner project, minus
+     * any further `@` keys (the mint never nests `@` groups inside `@` groups). Distinguish by the
+     * `@` prefix (or `Array.isArray`): bare/scope keys → conditions array; `@`-keys → nested group.
+     */
+    [scopedKey: string]: PropertyConditions[] | ContentSecurity | undefined;
 }
 
 /**
@@ -54,8 +49,8 @@ export interface ContentSecurity {
  * `format: date-time` strings and JSON has no date type, so the previous `Date` declaration
  * described the Mongoose document rather than the response a client parses.
  */
-export type ApiKey = z.infer<typeof ApiKeySchema>;
-export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
+export type ApiKey = Wire.ApiKey;
+export type ApiKeyArray = Wire.ApiKeyArray;
 /**
  * Create and update take DIFFERENT payloads, and did not before.
  *
@@ -64,10 +59,10 @@ export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
  * `role` (which unset a required path). Splitting it is source-breaking for the SDK and is announced
  * as a release operation; the two names say which operation they belong to.
  */
-export type CreateApiKeyPayload = z.infer<typeof CreateApiKeyPayloadSchema>;
-export type UpdateApiKeyPayload = z.infer<typeof UpdateApiKeyPayloadSchema>;
-export type ApiKeyWithValue = z.infer<typeof ApiKeyWithValueSchema>;
-export type ApiKeyReadResponse = z.infer<typeof ApiKeyReadResponseSchema>;
+export type CreateApiKeyPayload = Wire.CreateApiKeyPayload;
+export type UpdateApiKeyPayload = Wire.UpdateApiKeyPayload;
+export type ApiKeyWithValue = Wire.ApiKeyWithValue;
+export type ApiKeyReadResponse = Wire.ApiKeyReadResponse;
 
 export interface CreatePublicKeyPayload {
     name?: string;
@@ -75,9 +70,9 @@ export interface CreatePublicKeyPayload {
     ttl?: number;
 }
 
-export type AuthTokenResponse = z.infer<typeof AuthTokenResponseSchema>;
-export type ApiKeyListQuery = z.infer<typeof ApiKeyListQuerySchema>;
-export type ApiKeyReadQuery = z.infer<typeof ApiKeyReadQuerySchema>;
+export type AuthTokenResponse = Wire.AuthTokenResponse;
+export type ApiKeyListQuery = Wire.ApiKeyListQuery;
+export type ApiKeyReadQuery = Wire.ApiKeyReadQuery;
 
 export interface AuthTokenPayload {
     credential_scope?: 'project' | 'account';
@@ -126,8 +121,8 @@ export interface AuthTokenPayload {
     /** groups */
     groups?: UserGroupRef[]; //group ids
 
-    /** Content security conditions keyed by permission (read/write/delete).
-     *  Presence triggers restrict mode: project:* is dropped from security filters.
+    /** Scoped ABAC conditions keyed by operation.
+     *  Each resource consumer defines its baseline/restrict composition.
      *
      *  Transitional: this field is being renamed to `abac` (see [[pending-migrations]]).
      *  Both fields are typed so consumers can dual-read during the transition.
@@ -197,12 +192,8 @@ export enum PrincipalType {
     Schedule = 'schedule',
 }
 
-export type AccountApiKey = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeySchema>;
-export type AccountApiKeyWithValue = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyWithValueSchema>;
-export type AccountApiKeyArray = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyArraySchema>;
-export type CreateAccountApiKeyPayload = z.infer<
-    typeof import('./api-schemas/apikey.js').CreateAccountApiKeyPayloadSchema
->;
-export type UpdateAccountApiKeyPayload = z.infer<
-    typeof import('./api-schemas/apikey.js').UpdateAccountApiKeyPayloadSchema
->;
+export type AccountApiKey = Wire.AccountApiKey;
+export type AccountApiKeyWithValue = Wire.AccountApiKeyWithValue;
+export type AccountApiKeyArray = Wire.AccountApiKeyArray;
+export type CreateAccountApiKeyPayload = Wire.CreateAccountApiKeyPayload;
+export type UpdateAccountApiKeyPayload = Wire.UpdateAccountApiKeyPayload;