@workwae/sdk 0.1.0-alpha.1 → 0.1.0-alpha.2

package/contract/mcp-keys/models.d.ts

@@ -0,0 +1,125 @@
+import * as z from "zod";
+export declare const McpKeyScope: z.ZodEnum<{
+    read: "read";
+    write: "write";
+    send: "send";
+}>;
+export type McpKeyScope = z.infer<typeof McpKeyScope>;
+export declare const McpKeyScopes: z.ZodArray<z.ZodEnum<{
+    read: "read";
+    write: "write";
+    send: "send";
+}>>;
+export declare const McpKey: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    scopes: z.ZodArray<z.ZodEnum<{
+        read: "read";
+        write: "write";
+        send: "send";
+    }>>;
+    accountId: z.ZodUUID;
+    expiresAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+    createdAt: z.ZodPreprocess<z.ZodDate, Date>;
+    lastUsedAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+    sendPolicy: z.ZodNullable<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            confirm: "confirm";
+            drafts_only: "drafts_only";
+        }>>;
+        allowedRecipientDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        dailySendLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        externalRecipientConfirmation: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type McpKey = z.infer<typeof McpKey>;
+export declare const McpKeyList: z.ZodObject<{
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        scopes: z.ZodArray<z.ZodEnum<{
+            read: "read";
+            write: "write";
+            send: "send";
+        }>>;
+        accountId: z.ZodUUID;
+        expiresAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+        createdAt: z.ZodPreprocess<z.ZodDate, Date>;
+        lastUsedAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+        sendPolicy: z.ZodNullable<z.ZodObject<{
+            mode: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                confirm: "confirm";
+                drafts_only: "drafts_only";
+            }>>;
+            allowedRecipientDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            dailySendLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            externalRecipientConfirmation: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type McpKeyList = z.infer<typeof McpKeyList>;
+export declare const CreatedMcpKey: z.ZodObject<{
+    id: z.ZodUUID;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    scopes: z.ZodArray<z.ZodEnum<{
+        read: "read";
+        write: "write";
+        send: "send";
+    }>>;
+    accountId: z.ZodUUID;
+    expiresAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+    createdAt: z.ZodPreprocess<z.ZodDate, Date>;
+    lastUsedAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+    sendPolicy: z.ZodNullable<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            confirm: "confirm";
+            drafts_only: "drafts_only";
+        }>>;
+        allowedRecipientDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        dailySendLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        externalRecipientConfirmation: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    key: z.ZodString;
+    mcpUrl: z.ZodURL;
+}, z.core.$strip>;
+export type CreatedMcpKey = z.infer<typeof CreatedMcpKey>;
+export declare const CreateMcpKey: z.ZodObject<{
+    name: z.ZodDefault<z.ZodString>;
+    scopes: z.ZodArray<z.ZodEnum<{
+        read: "read";
+        write: "write";
+        send: "send";
+    }>>;
+    expiresAt: z.ZodOptional<z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>>;
+    sendPolicy: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            confirm: "confirm";
+            drafts_only: "drafts_only";
+        }>>;
+        allowedRecipientDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+        dailySendLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        externalRecipientConfirmation: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type CreateMcpKey = z.infer<typeof CreateMcpKey>;
+export declare const McpKeyIdInput: z.ZodObject<{
+    accountId: z.ZodUUID;
+    keyId: z.ZodUUID;
+}, z.core.$strip>;
+export type McpKeyIdInput = z.infer<typeof McpKeyIdInput>;
+export declare const ConnectSessionMcp: z.ZodObject<{
+    scopes: z.ZodArray<z.ZodEnum<{
+        read: "read";
+        write: "write";
+        send: "send";
+    }>>;
+    name: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+export type ConnectSessionMcp = z.infer<typeof ConnectSessionMcp>;

package/contract/mcp-keys/routes.d.ts

@@ -0,0 +1,151 @@
+import * as z from "zod";
+export declare const mcpKeys: {
+    create: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        accountId: z.ZodUUID;
+        name: z.ZodDefault<z.ZodString>;
+        scopes: z.ZodArray<z.ZodEnum<{
+            read: "read";
+            write: "write";
+            send: "send";
+        }>>;
+        expiresAt: z.ZodOptional<z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>>;
+        sendPolicy: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            mode: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                confirm: "confirm";
+                drafts_only: "drafts_only";
+            }>>;
+            allowedRecipientDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            dailySendLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            externalRecipientConfirmation: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>, z.ZodObject<{
+        id: z.ZodUUID;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        scopes: z.ZodArray<z.ZodEnum<{
+            read: "read";
+            write: "write";
+            send: "send";
+        }>>;
+        accountId: z.ZodUUID;
+        expiresAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+        createdAt: z.ZodPreprocess<z.ZodDate, Date>;
+        lastUsedAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+        sendPolicy: z.ZodNullable<z.ZodObject<{
+            mode: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                confirm: "confirm";
+                drafts_only: "drafts_only";
+            }>>;
+            allowedRecipientDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+            dailySendLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+            externalRecipientConfirmation: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>>;
+        key: z.ZodString;
+        mcpUrl: z.ZodURL;
+    }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<import("@orpc/contract").MergedErrorMap<Record<never, never>, import("../errors.js").DeclaredErrors<{
+        readonly invalid_input: "The request does not match the operation's input schema (a malformed body included); data.issues names each problem.";
+        readonly unauthenticated: "No usable credential: none was sent, or it is malformed, unknown, revoked or an expired account token.";
+        readonly api_key_expired: "The API key is past its expiry (or the grace of the rotation that replaced it).";
+        readonly missing_scope: "The API key lacks the scope the operation needs.";
+        readonly role_forbidden: "The member's role does not allow the operation.";
+        readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
+        readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
+        readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
+        readonly overloaded: "The API is shedding load; retry after Retry-After.";
+        readonly payload_too_large: "The request body is larger than the API accepts.";
+        readonly internal_error: "An unexpected failure on our side.";
+        readonly invalid_idempotency_key: "POST only: the Idempotency-Key header is not 1 to 255 printable ASCII characters.";
+        readonly idempotency_key_reused: "POST only: the Idempotency-Key was used in the last 24 hours with another method, path or body.";
+        readonly idempotency_key_in_progress: "POST only: the request first sent with this Idempotency-Key has not been answered yet.";
+    }>>, {
+        mcp_key_limit: {
+            status: 409;
+            message: string;
+        };
+        account_not_found: {
+            status: 404;
+            message: string;
+        };
+    }>, Record<never, never>>;
+    list: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        accountId: z.ZodUUID;
+    }, z.core.$strip>, z.ZodObject<{
+        items: z.ZodArray<z.ZodObject<{
+            id: z.ZodUUID;
+            name: z.ZodString;
+            prefix: z.ZodString;
+            scopes: z.ZodArray<z.ZodEnum<{
+                read: "read";
+                write: "write";
+                send: "send";
+            }>>;
+            accountId: z.ZodUUID;
+            expiresAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+            createdAt: z.ZodPreprocess<z.ZodDate, Date>;
+            lastUsedAt: z.ZodNullable<z.ZodPreprocess<z.ZodDate, Date>>;
+            sendPolicy: z.ZodNullable<z.ZodObject<{
+                mode: z.ZodOptional<z.ZodEnum<{
+                    allow: "allow";
+                    confirm: "confirm";
+                    drafts_only: "drafts_only";
+                }>>;
+                allowedRecipientDomains: z.ZodOptional<z.ZodNullable<z.ZodArray<z.ZodString>>>;
+                dailySendLimit: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+                externalRecipientConfirmation: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>, import("@orpc/contract").MergedErrorMap<import("@orpc/contract").MergedErrorMap<Record<never, never>, import("../errors.js").DeclaredErrors<{
+        readonly invalid_input: "The request does not match the operation's input schema (a malformed body included); data.issues names each problem.";
+        readonly unauthenticated: "No usable credential: none was sent, or it is malformed, unknown, revoked or an expired account token.";
+        readonly api_key_expired: "The API key is past its expiry (or the grace of the rotation that replaced it).";
+        readonly missing_scope: "The API key lacks the scope the operation needs.";
+        readonly role_forbidden: "The member's role does not allow the operation.";
+        readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
+        readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
+        readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
+        readonly overloaded: "The API is shedding load; retry after Retry-After.";
+        readonly payload_too_large: "The request body is larger than the API accepts.";
+        readonly internal_error: "An unexpected failure on our side.";
+        readonly invalid_idempotency_key: "POST only: the Idempotency-Key header is not 1 to 255 printable ASCII characters.";
+        readonly idempotency_key_reused: "POST only: the Idempotency-Key was used in the last 24 hours with another method, path or body.";
+        readonly idempotency_key_in_progress: "POST only: the request first sent with this Idempotency-Key has not been answered yet.";
+    }>>, import("../errors.js").DeclaredErrors<{
+        readonly account_not_found: "The account does not exist, or the caller is an account token for another account.";
+    }>>, Record<never, never>>;
+    delete: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
+        accountId: z.ZodUUID;
+        keyId: z.ZodUUID;
+    }, z.core.$strip>, z.ZodVoid, import("@orpc/contract").MergedErrorMap<import("@orpc/contract").MergedErrorMap<Record<never, never>, import("../errors.js").DeclaredErrors<{
+        readonly invalid_input: "The request does not match the operation's input schema (a malformed body included); data.issues names each problem.";
+        readonly unauthenticated: "No usable credential: none was sent, or it is malformed, unknown, revoked or an expired account token.";
+        readonly api_key_expired: "The API key is past its expiry (or the grace of the rotation that replaced it).";
+        readonly missing_scope: "The API key lacks the scope the operation needs.";
+        readonly role_forbidden: "The member's role does not allow the operation.";
+        readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
+        readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
+        readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
+        readonly overloaded: "The API is shedding load; retry after Retry-After.";
+        readonly payload_too_large: "The request body is larger than the API accepts.";
+        readonly internal_error: "An unexpected failure on our side.";
+        readonly invalid_idempotency_key: "POST only: the Idempotency-Key header is not 1 to 255 printable ASCII characters.";
+        readonly idempotency_key_reused: "POST only: the Idempotency-Key was used in the last 24 hours with another method, path or body.";
+        readonly idempotency_key_in_progress: "POST only: the request first sent with this Idempotency-Key has not been answered yet.";
+    }>>, {
+        mcp_key_not_found: {
+            status: 404;
+            message: string;
+        };
+        account_not_found: {
+            status: 404;
+            message: string;
+        };
+    }>, Record<never, never>>;
+};

package/contract/meetings/models.d.ts

@@ -4,8 +4,6 @@ export declare const MeetingService: z.ZodEnum<{
     webex: "webex";
 }>;
 export type MeetingService = z.infer<typeof MeetingService>;
-/** reauth_required: the service refused the grant (revoked, expired); connect again. Mail and
- * calendar sync are not affected. */
 export declare const MeetingConnectionStatus: z.ZodEnum<{
     active: "active";
     reauth_required: "reauth_required";
@@ -28,7 +26,6 @@ export declare const MeetingConnection: z.ZodObject<{
     updatedAt: z.ZodPreprocess<z.ZodDate, Date>;
 }, z.core.$strip>;
 export type MeetingConnection = z.infer<typeof MeetingConnection>;
-/** At most one per service. */
 export declare const MeetingConnectionList: z.ZodObject<{
     items: z.ZodArray<z.ZodObject<{
         service: z.ZodEnum<{
@@ -48,12 +45,6 @@ export declare const MeetingConnectionList: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type MeetingConnectionList = z.infer<typeof MeetingConnectionList>;
-/**
- * zoom_oauth / webex_oauth: the tenant's own sign-in app for per-account grants, instead of the
- * platform's. zoom_s2s: a Zoom Server-to-Server OAuth app. webex_service_app: a Webex Service App
- * authorized by an organization administrator. A server app creates meetings for every account
- * without a grant of its own, hosted by the service user with the mailbox's address.
- */
 export declare const MeetingAppKind: z.ZodEnum<{
     zoom_oauth: "zoom_oauth";
     zoom_s2s: "zoom_s2s";
@@ -61,7 +52,6 @@ export declare const MeetingAppKind: z.ZodEnum<{
     webex_service_app: "webex_service_app";
 }>;
 export type MeetingAppKind = z.infer<typeof MeetingAppKind>;
-/** Server apps only: unverified until used or tested, then the outcome of the last of those. */
 export declare const MeetingAppStatus: z.ZodEnum<{
     active: "active";
     unverified: "unverified";
@@ -124,29 +114,34 @@ export declare const MeetingAppList: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type MeetingAppList = z.infer<typeof MeetingAppList>;
-export declare const CreateMeetingApp: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodLiteral<"zoom_oauth">;
-    name: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"zoom_s2s">;
-    name: z.ZodString;
-    accountId: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"webex_oauth">;
-    name: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"webex_service_app">;
-    name: z.ZodString;
-    clientId: z.ZodString;
-    clientSecret: z.ZodString;
-    refreshToken: z.ZodString;
-}, z.core.$strip>], "kind">;
+export declare const CreateMeetingApp: z.ZodDiscriminatedUnion<[
+    z.ZodObject<{
+        kind: z.ZodLiteral<"zoom_oauth">;
+        name: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+    }, z.core.$strip>,
+    z.ZodObject<{
+        kind: z.ZodLiteral<"zoom_s2s">;
+        name: z.ZodString;
+        accountId: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+    }, z.core.$strip>,
+    z.ZodObject<{
+        kind: z.ZodLiteral<"webex_oauth">;
+        name: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+    }, z.core.$strip>,
+    z.ZodObject<{
+        kind: z.ZodLiteral<"webex_service_app">;
+        name: z.ZodString;
+        clientId: z.ZodString;
+        clientSecret: z.ZodString;
+        refreshToken: z.ZodString;
+    }, z.core.$strip>
+], "kind">;
 export type CreateMeetingApp = z.infer<typeof CreateMeetingApp>;
 export declare const MeetingAppCheck: z.ZodObject<{
     name: z.ZodString;

package/contract/meetings/routes.d.ts

@@ -34,6 +34,8 @@ export declare const meetingApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -45,29 +47,34 @@ export declare const meetingApps: {
     }>>, import("../errors.js").DeclaredErrors<{
         readonly plan_module_unavailable: `The tenant's plan does not include ${string}.`;
     }>>, Record<never, never>>;
-    create: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        kind: z.ZodLiteral<"zoom_oauth">;
-        name: z.ZodString;
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        kind: z.ZodLiteral<"zoom_s2s">;
-        name: z.ZodString;
-        accountId: z.ZodString;
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        kind: z.ZodLiteral<"webex_oauth">;
-        name: z.ZodString;
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-    }, z.core.$strip>, z.ZodObject<{
-        kind: z.ZodLiteral<"webex_service_app">;
-        name: z.ZodString;
-        clientId: z.ZodString;
-        clientSecret: z.ZodString;
-        refreshToken: z.ZodString;
-    }, z.core.$strip>], "kind">, z.ZodObject<{
+    create: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodDiscriminatedUnion<[
+        z.ZodObject<{
+            kind: z.ZodLiteral<"zoom_oauth">;
+            name: z.ZodString;
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+        }, z.core.$strip>,
+        z.ZodObject<{
+            kind: z.ZodLiteral<"zoom_s2s">;
+            name: z.ZodString;
+            accountId: z.ZodString;
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+        }, z.core.$strip>,
+        z.ZodObject<{
+            kind: z.ZodLiteral<"webex_oauth">;
+            name: z.ZodString;
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+        }, z.core.$strip>,
+        z.ZodObject<{
+            kind: z.ZodLiteral<"webex_service_app">;
+            name: z.ZodString;
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+            refreshToken: z.ZodString;
+        }, z.core.$strip>
+    ], "kind">, z.ZodObject<{
         id: z.ZodUUID;
         kind: z.ZodEnum<{
             zoom_oauth: "zoom_oauth";
@@ -99,6 +106,8 @@ export declare const meetingApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -159,6 +168,8 @@ export declare const meetingApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -190,6 +201,8 @@ export declare const meetingApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -236,6 +249,8 @@ export declare const meetingConnections: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -267,6 +282,8 @@ export declare const meetingConnections: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -287,7 +304,6 @@ export declare const meetingConnections: {
     }>, Record<never, never>>;
 };
 export declare const meetingConnectSessions: {
-    /** Returns the hosted page's link; the session itself is only read by its token. */
     create: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
         accountId: z.ZodUUID;
         service: z.ZodEnum<{
@@ -309,6 +325,8 @@ export declare const meetingConnectSessions: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -348,7 +366,6 @@ export declare const meetingConnectSessions: {
         };
     }>, Record<never, never>>;
 };
-/** Unauthenticated: the hosted page reads its session by the token in its URL. */
 export declare const hostedMeetingConnectSessions: {
     get: import("@orpc/contract").ContractProcedureBuilderWithInputOutput<z.ZodObject<{
         token: z.ZodString;
@@ -372,6 +389,8 @@ export declare const hostedMeetingConnectSessions: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";

package/contract/oauth-apps/models.d.ts

@@ -1,11 +1,5 @@
 import * as z from "zod";
-/** A Pub/Sub topic id as users.watch takes it: projects/<project id>/topics/<topic>. */
 export declare const PUBSUB_TOPIC_PATTERN: RegExp;
-/**
- * Gmail push for the accounts of a tenant Google app: users.watch publishes to `topic`, which
- * must be in the Cloud project of the app's OAuth client, and the tenant's push subscription
- * delivers to the app's gmailPushEndpoint with OIDC tokens issued for `serviceAccount`.
- */
 export declare const GmailPushSettings: z.ZodObject<{
     topic: z.ZodString;
     serviceAccount: z.ZodEmail;

package/contract/oauth-apps/routes.d.ts

@@ -30,6 +30,8 @@ export declare const oauthApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -82,6 +84,8 @@ export declare const oauthApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -131,6 +135,8 @@ export declare const oauthApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";
@@ -166,6 +172,8 @@ export declare const oauthApps: {
         readonly missing_scope: "The API key lacks the scope the operation needs.";
         readonly role_forbidden: "The member's role does not allow the operation.";
         readonly account_token_forbidden: "An account token called an operation account tokens cannot call.";
+        readonly account_scope_forbidden: "A credential limited to specific accounts called an operation that reaches beyond them.";
+        readonly mcp_only_key: "An MCP-only key (minted for an end user's MCP client) was used outside the MCP server.";
         readonly rate_limited: "The tenant used up its plan's request rate; Retry-After says when the window ends.";
         readonly too_many_requests: "The credential has too many requests in flight at once; retry after Retry-After.";
         readonly overloaded: "The API is shedding load; retry after Retry-After.";