aimeat 1.35.0 → 1.36.0

package/dist/src/generated/api-types.d.ts

@@ -5568,6 +5568,166 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/providers": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the social-login (OIDC) providers this node offers
+         * @description Discovery endpoint: returns the enabled social-login providers (Google, Casdoor, Microsoft
+         *     Entra ID) so any SPA can render the correct sign-in buttons and start URLs instead of
+         *     hard-coding provider availability. No authentication required.
+         */
+        get: operations["authProviders"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ghii/login/casdoor": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Begin Casdoor sign-in (social login)
+         * @description Starts the Casdoor OIDC sign-in flow and redirects the browser to Casdoor's consent screen.
+         *     Available only when the node has Casdoor sign-in configured (`AIMEAT_CASDOOR_OAUTH_ENABLED=true`
+         *     + endpoint + client credentials); otherwise returns 503. Browser-navigation endpoint.
+         */
+        get: operations["ghiiLoginCasdoorStart"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ghii/login/casdoor/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Casdoor sign-in OIDC redirect callback
+         * @description Casdoor redirects the browser here with `code` and `state`. The node exchanges the code and
+         *     maps the Casdoor identity to a GHII (returning user by subject, or verified-email link, else a
+         *     one-time username choice via `?aimeat_signup=1` + `/v1/ghii/login/casdoor/finalize`). On any
+         *     failure it redirects to `/?auth_error=<CODE>`.
+         */
+        get: operations["ghiiLoginCasdoorCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ghii/login/casdoor/finalize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Complete a first-time Casdoor sign-up with the chosen username
+         * @description Finalizes a brand-new Casdoor sign-up: reads the signed pending-signup cookie (must be for the
+         *     casdoor provider), validates the chosen username, creates the owner + GHII linked to the Casdoor
+         *     account, and establishes an owner session. Idempotent on double-submit. Rate-limited.
+         */
+        post: operations["ghiiLoginCasdoorFinalize"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ghii/login/entra": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Begin Microsoft Entra ID sign-in (social login)
+         * @description Starts the Microsoft Entra ID OIDC sign-in flow and redirects the browser to Microsoft's
+         *     consent screen. Available only when the node has Entra sign-in configured
+         *     (`AIMEAT_ENTRA_OAUTH_ENABLED=true` + client credentials); otherwise returns 503. When the node
+         *     pins a tenant GUID (`AIMEAT_ENTRA_OAUTH_TENANT`), only that tenant's members may complete
+         *     sign-in (the `tid` claim is enforced). Browser-navigation endpoint.
+         */
+        get: operations["ghiiLoginEntraStart"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ghii/login/entra/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Microsoft Entra ID sign-in OIDC redirect callback
+         * @description Entra redirects the browser here with `code` and `state`. The node exchanges the code,
+         *     optionally enforces the configured tenant (`tid`), and maps the identity to a GHII (returning
+         *     user by subject, or verified-email link for a pinned tenant, else a one-time username choice via
+         *     `?aimeat_signup=1` + `/v1/ghii/login/entra/finalize`). A token from a different tenant is
+         *     rejected with `/?auth_error=ENTRA_WRONG_TENANT`. On other failures it redirects to
+         *     `/?auth_error=<CODE>`.
+         */
+        get: operations["ghiiLoginEntraCallback"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/ghii/login/entra/finalize": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Complete a first-time Microsoft Entra ID sign-up with the chosen username
+         * @description Finalizes a brand-new Entra sign-up: reads the signed pending-signup cookie (must be for the
+         *     entra provider), validates the chosen username, creates the owner + GHII linked to the Entra
+         *     account, and establishes an owner session. Idempotent on double-submit. Rate-limited.
+         */
+        post: operations["ghiiLoginEntraFinalize"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/catalogue/directory": {
         parameters: {
             query?: never;
@@ -6475,6 +6635,12 @@ export interface paths {
          *     draft is schema-validated. If the organism's `meta.config` enables a publish gate
          *     (`gates.publish.enabled`), this instead creates a pending approval (202) for human review;
          *     on approval the publish runs. Default (no config) publishes immediately.
+         *
+         *     Change-guard: re-publishing a draft byte-identical to the live `.latest` is a no-op — the draft
+         *     is consumed and the response includes `skipped: true` with no new `.version.N`. `versioned` flag:
+         *     if the objectType is declared `versioned: false` in the manifest (e.g. a transient request
+         *     queue), publish writes only `.latest` and never appends a `.version.N`. Default is `versioned:
+         *     true` (full revision history).
          */
         post: operations["publishOrganismDraft"];
         delete?: never;
@@ -7444,6 +7610,10 @@ export interface paths {
          *     (`try`, `howItWorks`, `business`, `devView`, `help`). Defaults to all links
          *     visible in their declared order. No authentication required (Tier 0) — the
          *     header renders for anonymous visitors too.
+         *
+         *     Also returns a `features` map of node-level feature flags the SPA shell uses to
+         *     gate optional surfaces (currently `{ secretary }` — whether the per-user Secretary
+         *     and specialist agents are enabled on this node; off by default).
          */
         get: operations["getSiteHeaderNav"];
         /**
@@ -23759,7 +23929,12 @@ export interface operations {
                 content: {
                     "application/json": components["schemas"]["AimeatEnvelope"] & {
                         data?: {
-                            /** @description Suggested username (derived from the Google account, free at suggestion time) */
+                            /**
+                             * @description Which OIDC provider this pending sign-up is for (drives which finalize route the SPA calls)
+                             * @enum {string}
+                             */
+                            provider?: "google" | "casdoor" | "entra";
+                            /** @description Suggested username (derived from the provider account, free at suggestion time) */
                             suggested?: string;
                             email?: string | null;
                             displayName?: string;
@@ -23827,6 +24002,8 @@ export interface operations {
                 "application/json": {
                     /** @description The username the user chose or confirmed; blank uses the suggested name */
                     username?: string;
+                    /** @description The display name the user chose; blank uses the provider-supplied name. Editable later (unlike the username). */
+                    displayName?: string;
                 };
             };
         };
@@ -23870,6 +24047,260 @@ export interface operations {
             };
         };
     };
+    authProviders: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Enabled providers */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            providers?: {
+                                /** @enum {string} */
+                                id?: "google" | "casdoor" | "entra";
+                                label?: string;
+                                /** @description Same-node path to begin this provider's sign-in flow */
+                                loginUrl?: string;
+                            }[];
+                        };
+                    };
+                };
+            };
+        };
+    };
+    ghiiLoginCasdoorStart: {
+        parameters: {
+            query?: {
+                /** @description Same-site absolute path to return to after login (must start with `/`). Defaults to `/`. */
+                redirect?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Redirect to the Casdoor authorization endpoint */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Casdoor sign-in is not available on this node */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        error?: {
+                            /** @example FEATURE_DISABLED */
+                            code?: unknown;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    ghiiLoginCasdoorCallback: {
+        parameters: {
+            query: {
+                code: string;
+                state: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Redirect back to the SPA on success (refresh cookie set), or to `/?auth_error=<CODE>` on failure. */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Casdoor sign-in is not available on this node */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    ghiiLoginCasdoorFinalize: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    username?: string;
+                    /** @description The display name the user chose; blank uses the provider-supplied name. Editable later (unlike the username). */
+                    displayName?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Account created (or resolved) and session established */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            ghii?: string;
+                            owner?: string;
+                            displayName?: string;
+                            redirect?: string;
+                        };
+                    };
+                };
+            };
+            /** @description No pending sign-up, or invalid username */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Username already taken */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    ghiiLoginEntraStart: {
+        parameters: {
+            query?: {
+                /** @description Same-site absolute path to return to after login (must start with `/`). Defaults to `/`. */
+                redirect?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Redirect to the Entra authorization endpoint */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Entra sign-in is not available on this node */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        error?: {
+                            /** @example FEATURE_DISABLED */
+                            code?: unknown;
+                        };
+                    };
+                };
+            };
+        };
+    };
+    ghiiLoginEntraCallback: {
+        parameters: {
+            query: {
+                code: string;
+                state: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Redirect back to the SPA on success (refresh cookie set), or to `/?auth_error=<CODE>` on failure. */
+            302: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Entra sign-in is not available on this node */
+            503: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
+    ghiiLoginEntraFinalize: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    username?: string;
+                    /** @description The display name the user chose; blank uses the provider-supplied name. Editable later (unlike the username). */
+                    displayName?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Account created (or resolved) and session established */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["AimeatEnvelope"] & {
+                        data?: {
+                            ghii?: string;
+                            owner?: string;
+                            displayName?: string;
+                            redirect?: string;
+                        };
+                    };
+                };
+            };
+            /** @description No pending sign-up, or invalid username */
+            400: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Username already taken */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+        };
+    };
     searchDirectory: {
         parameters: {
             query?: {
@@ -27398,7 +27829,13 @@ export interface operations {
                 };
                 content: {
                     "application/json": components["schemas"]["AimeatEnvelope"] & {
-                        data?: components["schemas"]["HeaderNavConfig"];
+                        data?: components["schemas"]["HeaderNavConfig"] & {
+                            /** @description Node feature flags the SPA shell uses to gate optional surfaces. */
+                            features?: {
+                                /** @description Whether the Secretary + specialist agents are enabled on this node. */
+                                secretary?: boolean;
+                            };
+                        };
                     };
                 };
             };