@work-shape/catalyst-api-contract 0.8.0-rc.5 → 0.8.0-rc.7

package/dist/index.js

@@ -806,7 +806,7 @@ import { z as z46 } from "zod";
 // package.json
 var package_default = {
   name: "@work-shape/catalyst-api-contract",
-  version: "0.8.0-rc.5",
+  version: "0.8.0-rc.7",
   license: "MIT",
   repository: {
     type: "git",
@@ -1051,6 +1051,7 @@ import { z as z11 } from "zod";
 // src/access.ts
 import {
   ACCESS_SOURCES,
+  APP_AUDIENCES,
   GRANT_EFFECTS,
   GRANT_HOLDER_KINDS,
   GRANT_SCOPE_KINDS,
@@ -1107,23 +1108,87 @@ var effectivePermissionsQuerySchema = z10.object({
   holderKind: z10.enum(PRINCIPAL_HOLDER_KINDS2),
   holderId: storedText
 });
+var accessEntrySchema = z10.object({
+  action: z10.string(),
+  effect: grantEffectSchema,
+  scopeKind: grantScopeKindSchema,
+  scopeId: z10.string().optional(),
+  /**
+   * `membership`: held by being a member of the workspace the entry names, such as opening
+   * the published Apps of that workspace. A legacy permission list is grant rows since AP-4
+   * and reads as `grant`.
+   */
+  source: z10.enum(ACCESS_SOURCES),
+  /** The role the entry is held through, for the source `role`. */
+  roleId: z10.string().optional()
+});
 var effectivePermissionsSchema = z10.object({
   /** A holder that is not active holds nothing, whatever the entries say. */
   holderActive: z10.boolean(),
-  items: z10.array(
+  items: z10.array(accessEntrySchema)
+});
+var namedWorkspaceSchema = z10.object({ personal: z10.boolean(), name: z10.string().optional() });
+var namedPlaceSchema = z10.object({
+  scopeAsset: z10.object({
+    kind: z10.string(),
+    name: z10.string().optional(),
+    title: z10.string().optional(),
+    active: z10.boolean()
+  }).optional(),
+  scopeWorkspace: namedWorkspaceSchema.optional()
+});
+var rightConditionsSchema = z10.object({
+  availability: z10.enum(APP_AUDIENCES).optional(),
+  onlyInWorkspaces: z10.array(namedWorkspaceSchema).optional()
+});
+var accessOriginSchema = accessEntrySchema.omit({ action: true }).extend(namedPlaceSchema.shape);
+var accessOriginRoleSchema = z10.object({
+  id: z10.string(),
+  name: z10.string(),
+  builtIn: z10.boolean()
+});
+var REFUSAL_REASONS = ["denied", "no_grant", "holder_inactive"];
+var refusalReasonSchema = z10.enum(REFUSAL_REASONS);
+var ASSET_CHECK_VERBS = ["read", "use", "write", "delete"];
+var assetCheckVerbSchema = z10.enum(ASSET_CHECK_VERBS);
+var holderRightsSchema = z10.object({
+  holderActive: z10.boolean(),
+  /** Every role an origin names. */
+  roles: z10.array(accessOriginRoleSchema),
+  rights: z10.array(
     z10.object({
       action: z10.string(),
-      effect: grantEffectSchema,
       scopeKind: grantScopeKindSchema,
       scopeId: z10.string().optional(),
-      /**
-       * `membership`: held by being a member of the workspace the entry names, such as opening
-       * the published Apps of that workspace. A legacy permission list is grant rows since AP-4
-       * and reads as `grant`.
-       */
-      source: z10.enum(ACCESS_SOURCES),
-      /** The role the entry is held through, for the source `role`. */
-      roleId: z10.string().optional()
+      allowed: z10.boolean(),
+      /** For a right that is refused. */
+      reason: refusalReasonSchema.optional(),
+      grantedBy: z10.array(accessOriginSchema),
+      deniedBy: accessOriginSchema.optional()
+    }).extend(namedPlaceSchema.shape).extend(rightConditionsSchema.shape)
+  )
+});
+var assetRightsCheckQuerySchema = effectivePermissionsQuerySchema.extend({
+  /** A kind the instance registers. */
+  kind: storedText,
+  /**
+   * The asset, by the id its asset rows name. Left out for a name no asset and no row has:
+   * then only what holds on every asset of the kind decides.
+   */
+  assetId: storedText.optional()
+});
+var assetRightsCheckSchema = z10.object({
+  holderActive: z10.boolean(),
+  roles: z10.array(accessOriginRoleSchema),
+  actions: z10.array(
+    rightConditionsSchema.extend({
+      verb: assetCheckVerbSchema,
+      action: z10.string(),
+      allowed: z10.boolean(),
+      reason: refusalReasonSchema.optional(),
+      /** The covering deny that refuses, or the first covering allow. */
+      decidedBy: accessOriginSchema.optional(),
+      deniedThrough: assetCheckVerbSchema.optional()
     })
   )
 });
@@ -1296,6 +1361,40 @@ var accessOperations = {
     errors: ["NOT_FOUND"],
     rateClass: "read"
   }),
+  "permissions.rights": defineOperation({
+    id: "permissions.rights",
+    method: "GET",
+    path: "/api/v1/instance/access/rights",
+    summary: "List what one holder holds and is refused, each right decided with where it comes from",
+    tag: "Access",
+    auth: "user",
+    scope: "user_admin:read",
+    // The read of `permissions.effective`: one's own, or another holder's behind the right
+    // to administer them. The handler checks it.
+    requires: [],
+    effect: "reading",
+    query: effectivePermissionsQuerySchema,
+    response: json(holderRightsSchema),
+    errors: ["NOT_FOUND"],
+    rateClass: "read"
+  }),
+  "permissions.check": defineOperation({
+    id: "permissions.check",
+    method: "GET",
+    path: "/api/v1/instance/access/check",
+    summary: "Decide what one holder may do with one asset, with the entry that decides each right",
+    tag: "Access",
+    auth: "user",
+    scope: "user_admin:read",
+    // The read of `permissions.effective`: one's own, or another holder's behind the right
+    // to administer them. The handler checks it.
+    requires: [],
+    effect: "reading",
+    query: assetRightsCheckQuerySchema,
+    response: json(assetRightsCheckSchema),
+    errors: ["NOT_FOUND"],
+    rateClass: "read"
+  }),
   "workspaces.limits.list": defineOperation({
     id: "workspaces.limits.list",
     method: "GET",
@@ -1354,6 +1453,7 @@ import {
   AUTH_PRINCIPAL_KINDS,
   DELETION_STATES,
   FIRST_PARTY_AUTH_SCOPES,
+  FOLLOW_UP_MODES,
   SERVICE_PRINCIPAL_PERMISSIONS,
   SERVICE_PRINCIPAL_STATUSES,
   USER_STATUSES
@@ -1404,6 +1504,12 @@ var apiUserSchema = z12.object({
   emailVerified: z12.boolean().optional(),
   /** The language the person chose. Left out, they get the instance's default language. */
   locale: localeCodeSchema.optional(),
+  /**
+   * What a message the person sends during their own run does: `steer` (the default) is read
+   * by the running turn, `queue` waits as the next turn. Left out where the answer names no
+   * record: `queue`.
+   */
+  followUpMode: z12.enum(FOLLOW_UP_MODES).optional(),
   /** An active instance admin a signed-in person can ask for help; no directory access needed. */
   instanceAdminName: z12.string().optional(),
   roles: z12.array(z12.string()),
@@ -1487,10 +1593,12 @@ var updateAdministeredUserRequestSchema = z12.object({
 });
 var updateCurrentUserRequestSchema = z12.object({
   displayLabel: z12.string().min(1).optional(),
-  locale: localeCodeSchema.nullable().optional()
-}).refine((body) => body.displayLabel !== void 0 || body.locale !== void 0, {
-  message: "Name displayLabel, locale or both"
-});
+  locale: localeCodeSchema.nullable().optional(),
+  followUpMode: z12.enum(FOLLOW_UP_MODES).optional()
+}).refine(
+  (body) => body.displayLabel !== void 0 || body.locale !== void 0 || body.followUpMode !== void 0,
+  { message: "Name displayLabel, locale, followUpMode or several" }
+);
 var changeCurrentUserPasswordRequestSchema = z12.object({
   currentPassword: z12.string().min(1),
   newPassword: z12.string().min(8)
@@ -2062,7 +2170,7 @@ import { z as z17 } from "zod";
 
 // src/assets.ts
 import {
-  APP_AUDIENCES,
+  APP_AUDIENCES as APP_AUDIENCES2,
   OPERATION_EFFECTS as OPERATION_EFFECTS3,
   WORKSPACE_USE_ASSET_KINDS,
   ASSET_ACCESS_VERBS,
@@ -2163,7 +2271,7 @@ var assetFileSchema = z15.object({
   text: z15.string().optional(),
   base64: z15.string().optional()
 });
-var appAudienceSchema = z15.enum(APP_AUDIENCES);
+var appAudienceSchema = z15.enum(APP_AUDIENCES2);
 var publishNarrativeSchema = z15.object({
   summary: z15.string(),
   /** Empty where no guardrail in force stops a step, and for an App. */
@@ -2588,7 +2696,7 @@ var assetPreconditionRequiredDetailsSchema = z15.object({
 // src/conversations.ts
 import {
   AGENT_PREVIEW_SOURCES,
-  FOLLOW_UP_MODES,
+  FOLLOW_UP_MODES as FOLLOW_UP_MODES2,
   FOLLOW_UP_STATUSES,
   TOOL_DECISION_MODES,
   TOOL_DECISION_OUTCOMES
@@ -2691,7 +2799,14 @@ var userMessageMetadataSchema = z16.object({
     revision: z16.number().int().positive(),
     source: z16.enum(AGENT_PREVIEW_SOURCES)
   }).optional(),
-  attachmentManifest: z16.unknown()
+  attachmentManifest: z16.unknown(),
+  /** Set on a message its person steered into their running turn (FU-2). */
+  steered: z16.object({
+    runId: z16.string(),
+    followUpId: z16.string(),
+    authorUserId: z16.string(),
+    typedAt: timestampSchema
+  }).optional()
 });
 var assistantToolCallsMessageMetadataSchema = z16.object({
   version: messageMetadataVersionSchema,
@@ -2996,6 +3111,20 @@ var agentRuntimeEventSchema = z16.discriminatedUnion("type", [
       metadata: z16.record(z16.string(), z16.unknown()).optional()
     })
   }),
+  z16.object({
+    type: z16.literal("user_message_steered"),
+    runId: z16.string(),
+    sequence: z16.number(),
+    createdAt: timestampSchema,
+    followUpId: z16.string(),
+    message: z16.object({
+      id: z16.string(),
+      role: z16.literal("user"),
+      text: z16.string(),
+      createdAt: timestampSchema,
+      metadata: z16.record(z16.string(), z16.unknown()).optional()
+    })
+  }),
   z16.object({
     type: z16.literal("tool_call_preparing"),
     runId: z16.string(),
@@ -3160,6 +3289,13 @@ var agentRunProjectionPartSchema = z16.discriminatedUnion("type", [
     text: z16.string(),
     open: z16.boolean()
   }),
+  z16.object({
+    /** A message the run's person steered into it, where the run took it in (FU-2). */
+    type: z16.literal("user_message"),
+    messageId: z16.string(),
+    text: z16.string(),
+    createdAt: timestampSchema
+  }),
   z16.object({
     type: z16.literal("tool_call"),
     toolCallId: z16.string(),
@@ -3246,7 +3382,7 @@ var conversationFollowUpSchema = z16.object({
   authorUserId: z16.string(),
   authorDisplayLabel: z16.string().optional(),
   text: z16.string(),
-  mode: z16.enum(FOLLOW_UP_MODES),
+  mode: z16.enum(FOLLOW_UP_MODES2),
   status: z16.enum(FOLLOW_UP_STATUSES),
   position: z16.number().int().positive(),
   agentName: z16.string(),
@@ -3261,8 +3397,8 @@ var queuedConversationRunResponseSchema = z16.object({
   followUp: conversationFollowUpSchema
 });
 var startConversationRunRequestSchema = z16.object({
-  followUp: z16.literal("queue").optional().describe(
-    "Queue the message when this conversation has an active run. Without this option, an active run still returns CONFLICT."
+  followUp: z16.enum(FOLLOW_UP_MODES2).optional().describe(
+    "What happens when this conversation has an active run. `queue` sends the message as the next turn. `steer` hands it to the running turn at its next step when the run is the caller's own under the same credential and the message has no attachments, and queues it otherwise. Without this option, an active run still returns CONFLICT."
   ),
   idempotencyKey: z16.string().min(1),
   agentName: z16.string().min(1).optional(),
@@ -3553,6 +3689,18 @@ var pagePreviewRequestSchema = z18.object({
   /** The revision to show. Left out, the newest one. */
   fileSetId: z18.string().optional()
 }).strict();
+var draftHostsSchema = z18.object({
+  /**
+   * The held-back hosts the caller may allow for their own view of this draft with
+   * `apps.allow_draft_host`. Empty where the caller may not.
+   */
+  allowable: z18.array(z18.string()),
+  /**
+   * Whether the draft reads data through its actions, from a Connection, a Data Store or a
+   * Workflow: what the preview reads, it can send to an allowed host.
+   */
+  readsData: z18.boolean()
+});
 var pagePreviewSchema = z18.object({
   /** A path on the instance, ending with a slash. Relative files of the Page resolve below it. */
   url: z18.string(),
@@ -3560,7 +3708,13 @@ var pagePreviewSchema = z18.object({
   fileSetId: z18.string(),
   number: z18.number().int().positive(),
   /** Names this mount of the frame. A bridge call of the frame carries it. */
-  pageSessionId: z18.string()
+  pageSessionId: z18.string(),
+  /**
+   * The outside hosts the manifest lists that this frame may not connect to. A Page of a
+   * conversation connects to none until a person allows one for their own view (DRAFT-HOSTS-1).
+   */
+  heldBackHosts: z18.array(z18.string()).optional(),
+  draftHosts: draftHostsSchema.optional()
 });
 
 // src/apps.ts
@@ -3664,11 +3818,19 @@ var appPreviewSchema = pagePreviewSchema.extend({
   interfacePath: z19.string(),
   /**
    * The outside hosts the shown revision's manifest lists that its frame may not connect to:
-   * those a draft adds to what is published, until it is published. Always empty for the
-   * published view.
+   * those a draft adds to what is published, until it is published or the caller allowed one
+   * for their own view (DRAFT-HOSTS-1). Always empty for the published view.
    */
   heldBackHosts: z19.array(z19.string())
 });
+var allowDraftHostRequestSchema = z19.object({
+  fileSetId: z19.string().min(1).max(200),
+  host: z19.string().min(1).max(253)
+}).strict();
+var allowDraftHostResponseSchema = z19.object({
+  host: z19.string(),
+  allowed: z19.literal(true)
+});
 var pageSessionProof = {
   fileSetId: z19.string().min(1).max(200),
   token: z19.string().min(1).max(512)
@@ -3840,6 +4002,22 @@ var appOperations = {
     errors: ["NOT_FOUND", "CONFLICT", "REVISION_CONFLICT", "VALIDATION_FAILED"],
     rateClass: "write"
   }),
+  // Only where release config sets `apps.draftHosts.enabled`; elsewhere it answers 404.
+  "apps.allow_draft_host": defineRegisteredOperation({
+    id: "apps.allow_draft_host",
+    method: "POST",
+    path: "/api/v1/apps/draft-hosts",
+    summary: "Allow an outside host a draft lists for the caller's own view of that draft, before it is published",
+    tag: "Apps",
+    auth: "user",
+    scope: "config_assets:write",
+    requires: [],
+    effect: "changing",
+    body: allowDraftHostRequestSchema,
+    response: json(allowDraftHostResponseSchema),
+    errors: ["NOT_FOUND", "FORBIDDEN", "VALIDATION_FAILED"],
+    rateClass: "write"
+  }),
   "apps.get_from_page": defineOperation({
     id: "apps.get_from_page",
     method: "GET",
@@ -4974,11 +5152,16 @@ var connectionDetailSchema = z24.object({
   oauth: connectionOAuthSchema.optional()
 });
 var connectionOAuthStartSchema = z24.object({
+  /** The sign-in, for `connections.oauth_sign_in`. It proves nothing and opens nothing. */
+  signInId: z24.string(),
   authorizationUrl: z24.string().url(),
   providerHost: z24.string(),
   scopes: z24.array(z24.string()),
   expiresAt: timestampSchema
 });
+var connectionOAuthSignInSchema = z24.object({
+  state: z24.enum(["waiting", "ended"])
+});
 var connectionDisconnectSchema = z24.object({
   state: z24.literal("revoked"),
   providerRevocation: z24.enum(CONNECTION_PROVIDER_REVOCATIONS)
@@ -5014,6 +5197,32 @@ var connectionToolsSchema = z24.object({
     })
   )
 });
+var localizedTextSchema = z24.union([
+  z24.string(),
+  z24.strictObject({ en: z24.string().optional(), de: z24.string().optional() })
+]);
+var connectorTypeOffersSchema = z24.object({
+  types: z24.array(
+    z24.object({
+      type: z24.string(),
+      title: localizedTextSchema,
+      description: localizedTextSchema,
+      service: z24.string().optional(),
+      documentSource: z24.boolean(),
+      authScheme: z24.string(),
+      settings: z24.record(z24.string(), z24.unknown()),
+      fields: z24.array(
+        z24.object({
+          label: localizedTextSchema,
+          help: localizedTextSchema.optional(),
+          optional: z24.boolean(),
+          setting: z24.string().optional(),
+          secret: z24.boolean()
+        })
+      )
+    })
+  )
+});
 var connectionSecretWriteSchema = z24.object({
   value: z24.string().min(1).max(SECRET_VALUE_MAX_CHARS),
   expectedVersion: z24.number().int().positive().nullable()
@@ -5140,6 +5349,20 @@ var connectionOperations = {
     errors: ["NOT_FOUND", "CONFLICT"],
     rateClass: "write"
   }),
+  "connections.oauth_sign_in": defineRegisteredOperation({
+    id: "connections.oauth_sign_in",
+    method: "GET",
+    path: "/api/v1/connections/:name/oauth/sign-ins/:signInId",
+    summary: "Read whether a shared OAuth sign-in the caller started still waits for the browser to come back",
+    tag: "Connections",
+    auth: "user",
+    scope: "config_assets:read",
+    requires: [],
+    effect: "reading",
+    response: json(connectionOAuthSignInSchema),
+    errors: ["NOT_FOUND"],
+    rateClass: "read"
+  }),
   // One callback per Connection: a code sent back for one Connection is never taken for
   // another's sign-in.
   "connections.oauth_complete": defineRegisteredOperation({
@@ -5176,6 +5399,20 @@ var connectionOperations = {
     rateClass: "write"
   }),
   // A path of its own: `agent-tools` would be a valid Connection name under `/connections/`.
+  "connections.connector_types": defineRegisteredOperation({
+    id: "connections.connector_types",
+    method: "GET",
+    path: "/api/v1/connector-types",
+    summary: "List the Connector types a person who may make a Connection can connect from a form",
+    tag: "Connections",
+    auth: "principal",
+    scope: "config_assets:read",
+    requires: [],
+    effect: "reading",
+    response: json(connectorTypeOffersSchema),
+    errors: [],
+    rateClass: "read"
+  }),
   "connections.list_tools": defineRegisteredOperation({
     id: "connections.list_tools",
     method: "GET",
@@ -5195,7 +5432,7 @@ var connectionOperations = {
 // src/operations/data-stores.ts
 import { workflowDataFlowsSchema } from "@work-shape/catalyst-asset-schemas";
 import {
-  APP_AUDIENCES as APP_AUDIENCES2,
+  APP_AUDIENCES as APP_AUDIENCES3,
   DATA_STORE_CONDITIONS,
   DATA_STORE_INSERT_CONFLICT_MODES,
   DATA_STORE_MIGRATION_OUTCOMES,
@@ -5376,7 +5613,7 @@ var dataStoreSourceSchema = z25.object({
   title: z25.string()
 });
 var dataStoreAudienceSchema = z25.object({
-  app: z25.object({ audience: z25.enum(APP_AUDIENCES2), people: z25.number().int() }).optional(),
+  app: z25.object({ audience: z25.enum(APP_AUDIENCES3), people: z25.number().int() }).optional(),
   workspace: z25.object({ title: z25.string(), members: z25.number().int() }).optional(),
   /** The holders by a grant row, named only to a caller who administers users. */
   holders: z25.array(
@@ -5982,6 +6219,23 @@ var conversationOperations = {
     errors: ["NOT_FOUND", "FORBIDDEN", "CONFLICT"],
     rateClass: "write"
   }),
+  // As if it had been sent with `followUp: "steer"`: only its author, in their own run under the
+  // same credential, and only without attachments. Otherwise CONFLICT, and it stays queued.
+  "conversations.follow_ups.steer": defineOperation({
+    id: "conversations.follow_ups.steer",
+    method: "POST",
+    path: "/api/v1/conversations/:conversationId/follow-ups/:followUpId/steer",
+    summary: "Hand your pending follow-up message to your running turn after its current step",
+    tag: "Conversations",
+    auth: "user",
+    scope: "conversation:write",
+    requires: [],
+    effect: "changing",
+    body: z27.object({}),
+    response: json(z27.object({ followUp: conversationFollowUpSchema })),
+    errors: ["NOT_FOUND", "FORBIDDEN", "CONFLICT"],
+    rateClass: "write"
+  }),
   "conversations.follow_ups.dispatch": defineOperation({
     id: "conversations.follow_ups.dispatch",
     method: "POST",
@@ -7979,7 +8233,7 @@ var roleOperations = {
     id: "roles.update",
     method: "PATCH",
     path: "/api/v1/instance/access/roles/:roleId",
-    summary: "Change a role's name, description or grants. Only a superadmin edits `user` and `admin`; `superadmin` is never edited.",
+    summary: "Change a role's name, description or grants. Editing `user` and `admin` also needs `roles.edit_built_in`; `superadmin` is never edited.",
     tag: "Access",
     auth: "user",
     scope: "user_admin:write",
@@ -8008,7 +8262,7 @@ var roleOperations = {
     id: "roles.reset",
     method: "POST",
     path: "/api/v1/instance/access/roles/:roleId/reset",
-    summary: "Reset `user` or `admin` to the release's default, which also settles every pending action. Only a superadmin resets.",
+    summary: "Reset `user` or `admin` to the release's default, which also settles every pending action. Needs `users.manage` and `roles.edit_built_in`.",
     tag: "Access",
     auth: "user",
     scope: "user_admin:write",
@@ -8022,7 +8276,7 @@ var roleOperations = {
     id: "roles.pending.decide",
     method: "POST",
     path: "/api/v1/instance/access/roles/:roleId/pending",
-    summary: "Decide one action a release changed in the default of an edited `user` or `admin`: apply it or dismiss it. Only a superadmin decides.",
+    summary: "Decide one action a release changed in the default of an edited `user` or `admin`: apply it or dismiss it. Needs `users.manage` and `roles.edit_built_in`.",
     tag: "Access",
     auth: "user",
     scope: "user_admin:write",
@@ -8606,7 +8860,9 @@ var workflowOperations = {
     response: json(
       z44.object({
         draftRevision: z44.number().int().positive(),
-        unpublishedRevision: z44.number().int().positive()
+        unpublishedRevision: z44.number().int().positive(),
+        /** The live Apps that start the Workflow and stop working without it (DP-0). */
+        warnings: z44.array(assetWarningSchema)
       })
     ),
     errors: ["NOT_FOUND", "VALIDATION_FAILED"],
@@ -8835,6 +9091,39 @@ import {
 } from "@work-shape/catalyst-asset-schemas";
 
 // src/operations/index.ts
+var operationAreas = {
+  access: accessOperations,
+  account: accountOperations,
+  agents: agentOperations,
+  "api-access": apiAccessOperations,
+  "approval-requests": approvalRequestOperations,
+  apps: appOperations,
+  assets: assetOperations,
+  "collaboration-workspaces": collaborationWorkspaceOperations,
+  "config-assets": configAssetOperations,
+  connections: connectionOperations,
+  "conversation-files": conversationFileOperations,
+  conversations: conversationOperations,
+  credentials: credentialOperations,
+  "data-stores": dataStoreOperations,
+  feedback: feedbackOperations,
+  governance: governanceOperations,
+  guardrails: guardrailOperations,
+  instance: instanceOperations,
+  jobs: jobOperations,
+  knowledge: knowledgeOperations,
+  operations: operationRunOperations,
+  pages: pageOperations,
+  "personal-api-keys": personalApiKeyOperations,
+  platform: platformOperations,
+  reference: referenceOperations,
+  roles: roleOperations,
+  "scheduled-starts": scheduledStartOperations,
+  system: systemOperations,
+  users: userOperations,
+  "workflow-principal-rights": workflowPrincipalRightsOperations,
+  workflows: workflowOperations
+};
 var apiOperations = {
   ...scheduledStartOperations,
   ...approvalRequestOperations,
@@ -8874,6 +9163,7 @@ var schemas_exports = {};
 __export(schemas_exports, {
   API_ERROR_MEANINGS: () => API_ERROR_MEANINGS,
   APP_ASSET_KIND: () => APP_ASSET_KIND,
+  ASSET_CHECK_VERBS: () => ASSET_CHECK_VERBS,
   ASSET_GET_FILES_MAX_BYTES: () => ASSET_GET_FILES_MAX_BYTES,
   ASSET_PUT_FILES_MAX_BYTES: () => ASSET_PUT_FILES_MAX_BYTES,
   ASSET_RELEASE_SYNC_MAX_ITEMS: () => ASSET_RELEASE_SYNC_MAX_ITEMS,
@@ -8888,11 +9178,14 @@ __export(schemas_exports, {
   INVALID_JSON_BODY_REASON: () => INVALID_JSON_BODY_REASON,
   LIVE_ONCE_PART_MAX_LENGTH: () => LIVE_ONCE_PART_MAX_LENGTH,
   MAX_LIST_LIMIT: () => MAX_LIST_LIMIT,
+  REFUSAL_REASONS: () => REFUSAL_REASONS,
   ROLE_GRANTS_MAX: () => ROLE_GRANTS_MAX,
   UNKNOWN_OPERATION_REASON: () => UNKNOWN_OPERATION_REASON,
   VIEW_RUNTIME: () => VIEW_RUNTIME,
   VIEW_SHELL: () => VIEW_SHELL,
   VIEW_SHELL_MESSAGES: () => VIEW_SHELL_MESSAGES,
+  accessOriginRoleSchema: () => accessOriginRoleSchema,
+  accessOriginSchema: () => accessOriginSchema,
   activeRunSummarySchema: () => activeRunSummarySchema,
   addWorkspaceMemberRequestSchema: () => addWorkspaceMemberRequestSchema,
   administeredCollaborationWorkspaceSchema: () => administeredCollaborationWorkspaceSchema,
@@ -8914,6 +9207,8 @@ __export(schemas_exports, {
   agentRuntimeMessageMetadataSchema: () => agentRuntimeMessageMetadataSchema,
   agentToolReferenceSchema: () => agentToolReferenceSchema,
   agentTryConversationResponseSchema: () => agentTryConversationResponseSchema,
+  allowDraftHostRequestSchema: () => allowDraftHostRequestSchema,
+  allowDraftHostResponseSchema: () => allowDraftHostResponseSchema,
   annotateFeedbackRequestSchema: () => annotateFeedbackRequestSchema,
   apiCredentialSchema: () => apiCredentialSchema,
   apiCredentialScopeSchema: () => apiCredentialScopeSchema,
@@ -8958,6 +9253,8 @@ __export(schemas_exports, {
   assetRevisionConflictDetailsSchema: () => assetRevisionConflictDetailsSchema,
   assetRevisionConflictSchema: () => assetRevisionConflictSchema,
   assetRevisionSelectorSchema: () => assetRevisionSelectorSchema,
+  assetRightsCheckQuerySchema: () => assetRightsCheckQuerySchema,
+  assetRightsCheckSchema: () => assetRightsCheckSchema,
   assetSchema: () => assetSchema,
   assetScopeQuerySchema: () => assetScopeQuerySchema,
   assetScopeSchema: () => assetScopeSchema,
@@ -9040,6 +9337,7 @@ __export(schemas_exports, {
   draftAttachmentSchema: () => draftAttachmentSchema,
   draftAttachmentStatusSchema: () => draftAttachmentStatusSchema,
   draftAttachmentUploadResponseSchema: () => draftAttachmentUploadResponseSchema,
+  draftHostsSchema: () => draftHostsSchema,
   effectivePermissionsQuerySchema: () => effectivePermissionsQuerySchema,
   effectivePermissionsSchema: () => effectivePermissionsSchema,
   exchangeApiKeyResponseSchema: () => exchangeApiKeyResponseSchema,
@@ -9049,6 +9347,7 @@ __export(schemas_exports, {
   grantHolderKindSchema: () => grantHolderKindSchema,
   grantScopeKindSchema: () => grantScopeKindSchema,
   healthSchema: () => healthSchema,
+  holderRightsSchema: () => holderRightsSchema,
   infrastructureCheckSchema: () => infrastructureCheckSchema,
   infrastructureClassSchema: () => infrastructureClassSchema,
   infrastructureOriginSchema: () => infrastructureOriginSchema,
@@ -9903,6 +10202,7 @@ export {
   APP_BRIDGE_NAME_MAX_CHARS,
   APP_BRIDGE_REQUEST_ID_MAX_CHARS,
   APP_BRIDGE_VERSION,
+  ASSET_CHECK_VERBS,
   ASSET_GET_FILES_MAX_BYTES,
   ASSET_PUT_FILES_MAX_BYTES,
   ASSET_RELEASE_SYNC_MAX_ITEMS,
@@ -9927,6 +10227,7 @@ export {
   MAX_LIST_LIMIT,
   OPERATION_HEADERS,
   PUBLISHED_CLI_VERSION,
+  REFUSAL_REASONS,
   RELEASE_VERSION,
   ROLE_GRANTS_MAX,
   UNKNOWN_OPERATION_REASON,
@@ -9936,6 +10237,8 @@ export {
   WORKFLOW_RUN_KEY_MAX_CHARS,
   WORKFLOW_RUN_OUTPUT_PREVIEW_MAX_CHARS,
   WORKFLOW_STEP_SOURCE_KINDS,
+  accessOriginRoleSchema,
+  accessOriginSchema,
   activeRunSummarySchema,
   addWorkspaceMemberRequestSchema,
   administeredCollaborationWorkspaceSchema,
@@ -9957,6 +10260,8 @@ export {
   agentRuntimeMessageMetadataSchema,
   agentToolReferenceSchema,
   agentTryConversationResponseSchema,
+  allowDraftHostRequestSchema,
+  allowDraftHostResponseSchema,
   annotateFeedbackRequestSchema,
   apiCredentialSchema,
   apiCredentialScopeSchema,
@@ -10010,6 +10315,8 @@ export {
   assetRevisionConflictDetailsSchema,
   assetRevisionConflictSchema,
   assetRevisionSelectorSchema,
+  assetRightsCheckQuerySchema,
+  assetRightsCheckSchema,
   assetSchema,
   assetScopeQuerySchema,
   assetScopeSchema,
@@ -10061,6 +10368,7 @@ export {
   connectionDetailSchema,
   connectionDisconnectSchema,
   connectionNameParamsSchema,
+  connectionOAuthSignInSchema,
   connectionOAuthStartSchema,
   connectionOperationDetailSchema,
   connectionOperationStatusSchema,
@@ -10070,6 +10378,7 @@ export {
   connectionTestResultSchema,
   connectionToolSchema,
   connectionToolsSchema,
+  connectorTypeOffersSchema,
   conversationFollowUpSchema,
   conversationListItemSchema,
   conversationResourceBaseSchema,
@@ -10112,6 +10421,7 @@ export {
   draftAttachmentSchema,
   draftAttachmentStatusSchema,
   draftAttachmentUploadResponseSchema,
+  draftHostsSchema,
   dryRunGuardrailRequestSchema,
   dryRunGuardrailResponseSchema,
   effectivePermissionsQuerySchema,
@@ -10128,6 +10438,7 @@ export {
   guardrailHitsSchema,
   guardrailOperations,
   healthSchema,
+  holderRightsSchema,
   infrastructureCheckSchema,
   infrastructureClassSchema,
   infrastructureOriginSchema,
@@ -10184,6 +10495,7 @@ export {
   notReadySchema,
   openApiDocumentSchema,
   openConversationSubjectRequestSchema,
+  operationAreas,
   operationPathParamNames,
   operationRunOriginSchema,
   operationRunSchema,