@work-shape/catalyst-asset-schemas 0.8.0-rc.5 → 0.8.0-rc.7

package/dist/index.d.ts

@@ -51,6 +51,11 @@ interface AgentConfig {
      */
     knowledgeBases?: string[];
     initialPrompts: AgentInitialPromptConfig[];
+    /**
+     * An agent that ships with the platform: its fields as the release shipped them last. Only
+     * the release seed writes it; every other write keeps it as stored.
+     */
+    shipped?: Record<string, unknown>;
 }
 interface SkillConfig {
     name: string;
@@ -145,7 +150,11 @@ declare const FIRST_PARTY_AUTH_SCOPES: readonly ["*", "me:read", "me:delete", "c
 type ChatSessionAuthScope = (typeof CHAT_SESSION_AUTH_SCOPES)[number];
 type FirstPartyAuthScope = (typeof FIRST_PARTY_AUTH_SCOPES)[number];
 type OperationScope = Exclude<FirstPartyAuthScope, "*">;
-declare const ACTIONS: readonly ["agent.read", "agent.write", "agent.publish", "agent.delete", "skill.read", "skill.write", "skill.delete", "skill.approve", "connection.read", "connection.use", "connection.write", "connection.delete", "connection.approve", "app.read", "app.write", "app.publish", "app.approve", "app.delete", "app.use", "workflow.read", "workflow.write", "workflow.publish", "workflow.approve", "workflow.delete", "workflow.use", "workflow.read_run_data", "data_store.read", "data_store.write", "data_store.publish", "data_store.delete", "data_store.insert", "data_store.execute", "data_store.records", "knowledge_base.read", "knowledge_base.write", "knowledge_base.publish", "knowledge_base.delete", "knowledge_base.use", "mail_sender.use", "guardrail.read", "guardrail.write", "guardrail.publish", "guardrail.delete", "operations.approve", "feedback.review", "users.manage", "usage.view", "audit.view", "api_access.manage", "service_principals.manage", "agent_models.manage", "assets.release", "builder", "publisher"];
+/**
+ * Every right of the platform, one file per domain under `contract-values/`. The order is kept:
+ * `GRANTABLE_ACTIONS` filters it, and the rights dialog lists rights in it.
+ */
+declare const ACTIONS: readonly ["agent.read", "agent.write", "agent.publish", "agent.delete", "skill.read", "skill.write", "skill.delete", "skill.approve", "connection.read", "connection.use", "connection.write", "connection.delete", "connection.approve", "app.read", "app.write", "app.publish", "app.approve", "app.delete", "app.use", "workflow.read", "workflow.write", "workflow.publish", "workflow.approve", "workflow.delete", "workflow.use", "workflow.read_run_data", "data_store.read", "data_store.write", "data_store.publish", "data_store.delete", "data_store.insert", "data_store.execute", "data_store.records", "knowledge_base.read", "knowledge_base.write", "knowledge_base.publish", "knowledge_base.delete", "knowledge_base.use", "mail_sender.use", "guardrail.read", "guardrail.write", "guardrail.publish", "guardrail.delete", "operations.approve", "feedback.review", "users.manage", "usage.view", "audit.view", "api_access.manage", "service_principals.manage", "agent_models.manage", "roles.edit_built_in", "assets.release", "builder", "publisher"];
 type PlatformAction = (typeof ACTIONS)[number];
 type AppErrorCode = (typeof APP_ERROR_CODES)[number];
 /** The HTTP status every error code answers with. */
@@ -200,9 +209,9 @@ type GrantScopeKind = (typeof GRANT_SCOPE_KINDS)[number];
 /** Where a role's grant lies: the whole instance, one workspace or one asset. */
 declare const ROLE_GRANT_SCOPE_KINDS: readonly ["instance", "workspace", "asset"];
 type RoleGrantScopeKind = (typeof ROLE_GRANT_SCOPE_KINDS)[number];
-/** What a release did to an action of a built-in role's default that waits for a superadmin. */
+/** What a release did to an action of a built-in role's default that waits for a decision. */
 declare const ROLE_PENDING_CHANGES: readonly ["added", "removed"];
-/** A superadmin's decision on a pending action: apply what the release did, or dismiss it. */
+/** The decision on a pending action: apply what the release did, or dismiss it. */
 declare const ROLE_PENDING_DECISIONS: readonly ["apply", "dismiss"];
 type RolePendingDecision = (typeof ROLE_PENDING_DECISIONS)[number];
 declare const GRANT_EFFECTS: readonly ["allow", "deny"];
@@ -326,8 +335,10 @@ declare const ATTACHMENT_CREATE_OUTCOMES: readonly ["created", "already_availabl
 type AttachmentCreateOutcome = (typeof ATTACHMENT_CREATE_OUTCOMES)[number];
 declare const STRUCTURED_DATA_REVIEW_REASONS: readonly ["uncertain", "conflicting"];
 type StructuredDataReviewReason = (typeof STRUCTURED_DATA_REVIEW_REASONS)[number];
-declare const FOLLOW_UP_MODES: readonly ["queue"];
-declare const FOLLOW_UP_STATUSES: readonly ["pending", "dispatched", "cancelled"];
+/** Queued: sent as the next turn. Steer: taken in by the author's own running turn (FU-2). */
+declare const FOLLOW_UP_MODES: readonly ["queue", "steer"];
+/** `consumed`: a steer the running turn took in; `dispatched`: started as a turn of its own. */
+declare const FOLLOW_UP_STATUSES: readonly ["pending", "dispatched", "consumed", "cancelled"];
 declare const AGENT_RUN_STATUSES: readonly ["queued", "running", "waiting_for_decision", "waiting_for_subagents", "cancelling", "completed", "cancelled", "failed"];
 type AgentRunStatus = (typeof AGENT_RUN_STATUSES)[number];
 declare const AGENT_RUN_FAILURE_CATEGORIES: readonly ["app_error", "internal_error", "runtime_interrupted", "abort_error", "unknown_error"];
@@ -749,6 +760,7 @@ declare const agentConfigSchema: z.ZodObject<{
             de: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>]>;
     }, z.core.$strip>>>;
+    shipped: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
 /** The id of a Workflow, which is the name of its asset: part of `workflow.<id>.start`. */
 declare const WORKFLOW_NAME_PATTERN: RegExp;

package/dist/index.js

@@ -15,93 +15,99 @@ var SKILL_RESOURCE_MEDIA_TYPES = [
 ];
 var APP_AUDIENCES = ["self", "workspace", "instance"];
 
-// src/contract-values.ts
-var AUTH_SCOPE_WILDCARD = "*";
-var CHAT_SESSION_AUTH_SCOPES = [
-  "me:read",
-  "me:delete",
-  "config:read",
-  "conversation:read",
-  "conversation:write",
-  "run:start",
-  "run:observe",
-  "run:cancel",
-  "run:command"
-];
-var FIRST_PARTY_AUTH_SCOPES = [
-  AUTH_SCOPE_WILDCARD,
-  ...CHAT_SESSION_AUTH_SCOPES,
-  "collaboration_workspace:read",
-  "collaboration_workspace:manage",
-  "me:write",
-  "governance:read",
-  "governance:write",
-  "user_admin:read",
-  "user_admin:write",
-  "api_access:read",
-  "api_access:write",
-  "config_assets:read",
-  "config_assets:write",
-  // Moving the published pointer of an asset. A credential that writes drafts with
-  // `config_assets:write` publishes none of them without this one.
-  "config_assets:publish",
-  "config_assets:release",
-  // The rows of a Data Store: reading them, and adding or loading them. The definition of a
-  // store and its migrations stay under `config_assets:*`. A scope caps what a key may be
-  // used for; whether its holder may do it is decided by the grants.
-  "data_store_rows:read",
-  "data_store_rows:write"
-];
-var ACTIONS = [
+// src/contract-values/agent.ts
+var AGENT_ACTIONS = [
   "agent.read",
   "agent.write",
   "agent.publish",
-  "agent.delete",
+  "agent.delete"
+];
+
+// src/contract-values/skill.ts
+var SKILL_ACTIONS = [
   "skill.read",
   "skill.write",
   "skill.delete",
-  "skill.approve",
+  "skill.approve"
+];
+
+// src/contract-values/connection.ts
+var CONNECTION_ACTIONS = [
   "connection.read",
   "connection.use",
   "connection.write",
   "connection.delete",
-  "connection.approve",
+  "connection.approve"
+];
+
+// src/contract-values/app.ts
+var APP_ACTIONS = [
   "app.read",
   "app.write",
   "app.publish",
   "app.approve",
   "app.delete",
-  "app.use",
+  "app.use"
+];
+
+// src/contract-values/workflow.ts
+var WORKFLOW_ACTIONS = [
   "workflow.read",
   "workflow.write",
   "workflow.publish",
   "workflow.approve",
   "workflow.delete",
   "workflow.use",
-  "workflow.read_run_data",
+  "workflow.read_run_data"
+];
+
+// src/contract-values/data-store.ts
+var DATA_STORE_ACTIONS = [
   "data_store.read",
   "data_store.write",
   "data_store.publish",
   "data_store.delete",
   "data_store.insert",
   "data_store.execute",
-  "data_store.records",
+  "data_store.records"
+];
+
+// src/contract-values/knowledge-base.ts
+var KNOWLEDGE_BASE_ACTIONS = [
   "knowledge_base.read",
   "knowledge_base.write",
   "knowledge_base.publish",
   "knowledge_base.delete",
-  "knowledge_base.use",
+  "knowledge_base.use"
+];
+
+// src/contract-values/mail-sender.ts
+var MAIL_SENDER_ACTIONS = [
   // Sending e-mail as one sender of the instance (`mail.send`). The `admin` role holds it on
   // the sender `system`; a member only by a grant.
-  "mail_sender.use",
+  "mail_sender.use"
+];
+
+// src/contract-values/guardrail.ts
+var GUARDRAIL_ACTIONS = [
   "guardrail.read",
   "guardrail.write",
   "guardrail.publish",
-  "guardrail.delete",
-  "operations.approve",
+  "guardrail.delete"
+];
+
+// src/contract-values/operations.ts
+var OPERATIONS_ACTIONS = ["operations.approve"];
+
+// src/contract-values/feedback.ts
+var FEEDBACK_ACTIONS = [
   // Reading the written feedback on agent messages and marking it handled (LU-4): on the
   // instance, or on one workspace for the agents it owns. No bundle carries it.
-  "feedback.review",
+  "feedback.review"
+];
+
+// src/contract-values/administration.ts
+var ADMINISTRATION_ACTIONS = [
   "users.manage",
   "usage.view",
   "audit.view",
@@ -110,11 +116,71 @@ var ACTIONS = [
   // Their keys stay with `api_access.manage`.
   "service_principals.manage",
   "agent_models.manage",
-  "assets.release",
+  // Editing and resetting the built-in roles `user` and `admin`, and deciding their pending
+  // actions (Felix, 2026-10-21). Its default sits with `superadmin` alone.
+  "roles.edit_built_in",
+  "assets.release"
+];
+
+// src/contract-values/workspace.ts
+var WORKSPACE_ACTIONS = [
   // The two bundles of a workspace: one row each, expanded by the evaluator (`bundleCarries`).
   "builder",
   "publisher"
 ];
+
+// src/contract-values.ts
+var AUTH_SCOPE_WILDCARD = "*";
+var CHAT_SESSION_AUTH_SCOPES = [
+  "me:read",
+  "me:delete",
+  "config:read",
+  "conversation:read",
+  "conversation:write",
+  "run:start",
+  "run:observe",
+  "run:cancel",
+  "run:command"
+];
+var FIRST_PARTY_AUTH_SCOPES = [
+  AUTH_SCOPE_WILDCARD,
+  ...CHAT_SESSION_AUTH_SCOPES,
+  "collaboration_workspace:read",
+  "collaboration_workspace:manage",
+  "me:write",
+  "governance:read",
+  "governance:write",
+  "user_admin:read",
+  "user_admin:write",
+  "api_access:read",
+  "api_access:write",
+  "config_assets:read",
+  "config_assets:write",
+  // Moving the published pointer of an asset. A credential that writes drafts with
+  // `config_assets:write` publishes none of them without this one.
+  "config_assets:publish",
+  "config_assets:release",
+  // The rows of a Data Store: reading them, and adding or loading them. The definition of a
+  // store and its migrations stay under `config_assets:*`. A scope caps what a key may be
+  // used for; whether its holder may do it is decided by the grants.
+  "data_store_rows:read",
+  "data_store_rows:write"
+];
+var ACTIONS = [
+  ...AGENT_ACTIONS,
+  ...SKILL_ACTIONS,
+  ...CONNECTION_ACTIONS,
+  ...APP_ACTIONS,
+  ...WORKFLOW_ACTIONS,
+  ...DATA_STORE_ACTIONS,
+  ...KNOWLEDGE_BASE_ACTIONS,
+  ...MAIL_SENDER_ACTIONS,
+  ...GUARDRAIL_ACTIONS,
+  ...OPERATIONS_ACTIONS,
+  ...FEEDBACK_ACTIONS,
+  ...ADMINISTRATION_ACTIONS,
+  ...WORKSPACE_ACTIONS
+];
 var APP_ERROR_STATUS_CODES = {
   BAD_REQUEST: 400,
   UNAUTHENTICATED: 401,
@@ -370,8 +436,8 @@ var CONVERSATION_ATTACHMENT_STATUSES = [
 ];
 var ATTACHMENT_CREATE_OUTCOMES = ["created", "already_available"];
 var STRUCTURED_DATA_REVIEW_REASONS = ["uncertain", "conflicting"];
-var FOLLOW_UP_MODES = ["queue"];
-var FOLLOW_UP_STATUSES = ["pending", "dispatched", "cancelled"];
+var FOLLOW_UP_MODES = ["queue", "steer"];
+var FOLLOW_UP_STATUSES = ["pending", "dispatched", "consumed", "cancelled"];
 var AGENT_RUN_STATUSES = [
   "queued",
   "running",
@@ -932,7 +998,14 @@ var agentConfigSchema = z.object({
       title: localizedStringSchema,
       prompt: localizedStringSchema
     })
-  ).default([])
+  ).default([]),
+  /**
+   * An agent that ships with the platform, such as Workshaper: the fields as the release
+   * shipped them last. Only the release seed writes it, and every other write keeps it as
+   * stored. A field the instance left as shipped takes what the next release ships; one it
+   * changed stays the instance's.
+   */
+  shipped: z.record(z.string(), z.unknown()).optional()
 });
 var WORKFLOW_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,62}$/u;
 var WORKFLOW_NAME_RULE = "A Workflow id starts with a lowercase letter and holds lowercase letters, digits, '_' and '-', at most 63 characters";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@work-shape/catalyst-asset-schemas",
-  "version": "0.8.0-rc.5",
+  "version": "0.8.0-rc.7",
   "license": "MIT",
   "repository": {
     "type": "git",