terse-types 0.0.30 → 0.0.31

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/ACL.d.ts ADDED
@@ -0,0 +1,375 @@
1
+ import * as z from "zod";
2
+ import { IntegrationType } from "./Integrations.js";
3
+ export declare const slackACLResourceTypeSchema: z.ZodEnum<{
4
+ channel: "channel";
5
+ dm_user: "dm_user";
6
+ }>;
7
+ export type SlackACLResourceType = z.infer<typeof slackACLResourceTypeSchema>;
8
+ export declare const notionACLResourceTypeSchema: z.ZodEnum<{
9
+ page: "page";
10
+ database: "database";
11
+ }>;
12
+ export type NotionACLResourceType = z.infer<typeof notionACLResourceTypeSchema>;
13
+ export declare const githubACLResourceTypeSchema: z.ZodLiteral<"repository">;
14
+ export type GitHubACLResourceType = z.infer<typeof githubACLResourceTypeSchema>;
15
+ export declare const gmailACLResourceTypeSchema: z.ZodEnum<{
16
+ send: "send";
17
+ draft: "draft";
18
+ }>;
19
+ export type GmailACLResourceType = z.infer<typeof gmailACLResourceTypeSchema>;
20
+ /** Built-in web / image capabilities use `IntegrationType.TERSE` in configs; resourceType distinguishes them. */
21
+ export declare const terseACLResourceTypeSchema: z.ZodEnum<{
22
+ web_capability: "web_capability";
23
+ image_edit_capability: "image_edit_capability";
24
+ }>;
25
+ export type TerseACLResourceType = z.infer<typeof terseACLResourceTypeSchema>;
26
+ export declare const linearACLResourceTypeSchema: z.ZodEnum<{
27
+ integration: "integration";
28
+ team: "team";
29
+ project: "project";
30
+ }>;
31
+ export type LinearACLResourceType = z.infer<typeof linearACLResourceTypeSchema>;
32
+ export declare const posthogACLResourceTypeSchema: z.ZodLiteral<"project">;
33
+ export type PosthogACLResourceType = z.infer<typeof posthogACLResourceTypeSchema>;
34
+ export declare const datadogACLResourceTypeSchema: z.ZodEnum<{
35
+ integration: "integration";
36
+ index: "index";
37
+ }>;
38
+ export type DatadogACLResourceType = z.infer<typeof datadogACLResourceTypeSchema>;
39
+ export declare const launchDarklyACLResourceTypeSchema: z.ZodEnum<{
40
+ environment: "environment";
41
+ project: "project";
42
+ }>;
43
+ export type LaunchDarklyACLResourceType = z.infer<typeof launchDarklyACLResourceTypeSchema>;
44
+ export declare const attioACLResourceTypeSchema: z.ZodEnum<{
45
+ object: "object";
46
+ integration: "integration";
47
+ }>;
48
+ export type AttioACLResourceType = z.infer<typeof attioACLResourceTypeSchema>;
49
+ export declare const workosACLResourceTypeSchema: z.ZodEnum<{
50
+ integration: "integration";
51
+ organization: "organization";
52
+ }>;
53
+ export type WorkOSACLResourceType = z.infer<typeof workosACLResourceTypeSchema>;
54
+ export declare const snowflakeACLResourceTypeSchema: z.ZodLiteral<"integration">;
55
+ export type SnowflakeACLResourceType = z.infer<typeof snowflakeACLResourceTypeSchema>;
56
+ export declare const slackACLRuleSchema: z.ZodObject<{
57
+ integrationId: z.ZodString;
58
+ resourceId: z.ZodString;
59
+ integrationType: z.ZodLiteral<IntegrationType.SLACK>;
60
+ resourceType: z.ZodEnum<{
61
+ channel: "channel";
62
+ dm_user: "dm_user";
63
+ }>;
64
+ }, z.core.$strip>;
65
+ export declare const notionACLRuleSchema: z.ZodObject<{
66
+ integrationId: z.ZodString;
67
+ resourceId: z.ZodString;
68
+ integrationType: z.ZodLiteral<IntegrationType.NOTION>;
69
+ resourceType: z.ZodEnum<{
70
+ page: "page";
71
+ database: "database";
72
+ }>;
73
+ }, z.core.$strip>;
74
+ export declare const githubACLRuleSchema: z.ZodObject<{
75
+ integrationId: z.ZodString;
76
+ resourceId: z.ZodString;
77
+ integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
78
+ resourceType: z.ZodLiteral<"repository">;
79
+ }, z.core.$strip>;
80
+ export declare const gmailACLRuleSchema: z.ZodObject<{
81
+ integrationId: z.ZodString;
82
+ resourceId: z.ZodString;
83
+ integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
84
+ resourceType: z.ZodEnum<{
85
+ send: "send";
86
+ draft: "draft";
87
+ }>;
88
+ }, z.core.$strip>;
89
+ export declare const terseACLRuleSchema: z.ZodObject<{
90
+ integrationId: z.ZodString;
91
+ resourceId: z.ZodString;
92
+ integrationType: z.ZodLiteral<IntegrationType.TERSE>;
93
+ resourceType: z.ZodEnum<{
94
+ web_capability: "web_capability";
95
+ image_edit_capability: "image_edit_capability";
96
+ }>;
97
+ }, z.core.$strip>;
98
+ export declare const linearACLRuleSchema: z.ZodObject<{
99
+ integrationId: z.ZodString;
100
+ resourceId: z.ZodString;
101
+ integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
102
+ resourceType: z.ZodEnum<{
103
+ integration: "integration";
104
+ team: "team";
105
+ project: "project";
106
+ }>;
107
+ }, z.core.$strip>;
108
+ export declare const posthogACLRuleSchema: z.ZodObject<{
109
+ integrationId: z.ZodString;
110
+ resourceId: z.ZodString;
111
+ integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
112
+ resourceType: z.ZodLiteral<"project">;
113
+ }, z.core.$strip>;
114
+ export declare const datadogACLRuleSchema: z.ZodObject<{
115
+ integrationId: z.ZodString;
116
+ resourceId: z.ZodString;
117
+ integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
118
+ resourceType: z.ZodEnum<{
119
+ integration: "integration";
120
+ index: "index";
121
+ }>;
122
+ }, z.core.$strip>;
123
+ export declare const launchDarklyACLRuleSchema: z.ZodObject<{
124
+ integrationId: z.ZodString;
125
+ resourceId: z.ZodString;
126
+ integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
127
+ resourceType: z.ZodEnum<{
128
+ environment: "environment";
129
+ project: "project";
130
+ }>;
131
+ }, z.core.$strip>;
132
+ export declare const attioACLRuleSchema: z.ZodObject<{
133
+ integrationId: z.ZodString;
134
+ resourceId: z.ZodString;
135
+ integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
136
+ resourceType: z.ZodEnum<{
137
+ object: "object";
138
+ integration: "integration";
139
+ }>;
140
+ }, z.core.$strip>;
141
+ export declare const workosACLRuleSchema: z.ZodObject<{
142
+ integrationId: z.ZodString;
143
+ resourceId: z.ZodString;
144
+ integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
145
+ resourceType: z.ZodEnum<{
146
+ integration: "integration";
147
+ organization: "organization";
148
+ }>;
149
+ }, z.core.$strip>;
150
+ export declare const snowflakeACLRuleSchema: z.ZodObject<{
151
+ integrationId: z.ZodString;
152
+ resourceId: z.ZodString;
153
+ integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
154
+ resourceType: z.ZodLiteral<"integration">;
155
+ }, z.core.$strip>;
156
+ export declare const aclRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
157
+ integrationId: z.ZodString;
158
+ resourceId: z.ZodString;
159
+ integrationType: z.ZodLiteral<IntegrationType.SLACK>;
160
+ resourceType: z.ZodEnum<{
161
+ channel: "channel";
162
+ dm_user: "dm_user";
163
+ }>;
164
+ }, z.core.$strip>, z.ZodObject<{
165
+ integrationId: z.ZodString;
166
+ resourceId: z.ZodString;
167
+ integrationType: z.ZodLiteral<IntegrationType.NOTION>;
168
+ resourceType: z.ZodEnum<{
169
+ page: "page";
170
+ database: "database";
171
+ }>;
172
+ }, z.core.$strip>, z.ZodObject<{
173
+ integrationId: z.ZodString;
174
+ resourceId: z.ZodString;
175
+ integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
176
+ resourceType: z.ZodLiteral<"repository">;
177
+ }, z.core.$strip>, z.ZodObject<{
178
+ integrationId: z.ZodString;
179
+ resourceId: z.ZodString;
180
+ integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
181
+ resourceType: z.ZodEnum<{
182
+ send: "send";
183
+ draft: "draft";
184
+ }>;
185
+ }, z.core.$strip>, z.ZodObject<{
186
+ integrationId: z.ZodString;
187
+ resourceId: z.ZodString;
188
+ integrationType: z.ZodLiteral<IntegrationType.TERSE>;
189
+ resourceType: z.ZodEnum<{
190
+ web_capability: "web_capability";
191
+ image_edit_capability: "image_edit_capability";
192
+ }>;
193
+ }, z.core.$strip>, z.ZodObject<{
194
+ integrationId: z.ZodString;
195
+ resourceId: z.ZodString;
196
+ integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
197
+ resourceType: z.ZodEnum<{
198
+ integration: "integration";
199
+ team: "team";
200
+ project: "project";
201
+ }>;
202
+ }, z.core.$strip>, z.ZodObject<{
203
+ integrationId: z.ZodString;
204
+ resourceId: z.ZodString;
205
+ integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
206
+ resourceType: z.ZodLiteral<"project">;
207
+ }, z.core.$strip>, z.ZodObject<{
208
+ integrationId: z.ZodString;
209
+ resourceId: z.ZodString;
210
+ integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
211
+ resourceType: z.ZodEnum<{
212
+ integration: "integration";
213
+ index: "index";
214
+ }>;
215
+ }, z.core.$strip>, z.ZodObject<{
216
+ integrationId: z.ZodString;
217
+ resourceId: z.ZodString;
218
+ integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
219
+ resourceType: z.ZodEnum<{
220
+ environment: "environment";
221
+ project: "project";
222
+ }>;
223
+ }, z.core.$strip>, z.ZodObject<{
224
+ integrationId: z.ZodString;
225
+ resourceId: z.ZodString;
226
+ integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
227
+ resourceType: z.ZodEnum<{
228
+ object: "object";
229
+ integration: "integration";
230
+ }>;
231
+ }, z.core.$strip>, z.ZodObject<{
232
+ integrationId: z.ZodString;
233
+ resourceId: z.ZodString;
234
+ integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
235
+ resourceType: z.ZodEnum<{
236
+ integration: "integration";
237
+ organization: "organization";
238
+ }>;
239
+ }, z.core.$strip>, z.ZodObject<{
240
+ integrationId: z.ZodString;
241
+ resourceId: z.ZodString;
242
+ integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
243
+ resourceType: z.ZodLiteral<"integration">;
244
+ }, z.core.$strip>], "integrationType">;
245
+ export declare const aclRulesSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
246
+ integrationId: z.ZodString;
247
+ resourceId: z.ZodString;
248
+ integrationType: z.ZodLiteral<IntegrationType.SLACK>;
249
+ resourceType: z.ZodEnum<{
250
+ channel: "channel";
251
+ dm_user: "dm_user";
252
+ }>;
253
+ }, z.core.$strip>, z.ZodObject<{
254
+ integrationId: z.ZodString;
255
+ resourceId: z.ZodString;
256
+ integrationType: z.ZodLiteral<IntegrationType.NOTION>;
257
+ resourceType: z.ZodEnum<{
258
+ page: "page";
259
+ database: "database";
260
+ }>;
261
+ }, z.core.$strip>, z.ZodObject<{
262
+ integrationId: z.ZodString;
263
+ resourceId: z.ZodString;
264
+ integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
265
+ resourceType: z.ZodLiteral<"repository">;
266
+ }, z.core.$strip>, z.ZodObject<{
267
+ integrationId: z.ZodString;
268
+ resourceId: z.ZodString;
269
+ integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
270
+ resourceType: z.ZodEnum<{
271
+ send: "send";
272
+ draft: "draft";
273
+ }>;
274
+ }, z.core.$strip>, z.ZodObject<{
275
+ integrationId: z.ZodString;
276
+ resourceId: z.ZodString;
277
+ integrationType: z.ZodLiteral<IntegrationType.TERSE>;
278
+ resourceType: z.ZodEnum<{
279
+ web_capability: "web_capability";
280
+ image_edit_capability: "image_edit_capability";
281
+ }>;
282
+ }, z.core.$strip>, z.ZodObject<{
283
+ integrationId: z.ZodString;
284
+ resourceId: z.ZodString;
285
+ integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
286
+ resourceType: z.ZodEnum<{
287
+ integration: "integration";
288
+ team: "team";
289
+ project: "project";
290
+ }>;
291
+ }, z.core.$strip>, z.ZodObject<{
292
+ integrationId: z.ZodString;
293
+ resourceId: z.ZodString;
294
+ integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
295
+ resourceType: z.ZodLiteral<"project">;
296
+ }, z.core.$strip>, z.ZodObject<{
297
+ integrationId: z.ZodString;
298
+ resourceId: z.ZodString;
299
+ integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
300
+ resourceType: z.ZodEnum<{
301
+ integration: "integration";
302
+ index: "index";
303
+ }>;
304
+ }, z.core.$strip>, z.ZodObject<{
305
+ integrationId: z.ZodString;
306
+ resourceId: z.ZodString;
307
+ integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
308
+ resourceType: z.ZodEnum<{
309
+ environment: "environment";
310
+ project: "project";
311
+ }>;
312
+ }, z.core.$strip>, z.ZodObject<{
313
+ integrationId: z.ZodString;
314
+ resourceId: z.ZodString;
315
+ integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
316
+ resourceType: z.ZodEnum<{
317
+ object: "object";
318
+ integration: "integration";
319
+ }>;
320
+ }, z.core.$strip>, z.ZodObject<{
321
+ integrationId: z.ZodString;
322
+ resourceId: z.ZodString;
323
+ integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
324
+ resourceType: z.ZodEnum<{
325
+ integration: "integration";
326
+ organization: "organization";
327
+ }>;
328
+ }, z.core.$strip>, z.ZodObject<{
329
+ integrationId: z.ZodString;
330
+ resourceId: z.ZodString;
331
+ integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
332
+ resourceType: z.ZodLiteral<"integration">;
333
+ }, z.core.$strip>], "integrationType">>;
334
+ export type ACLRule = z.infer<typeof aclRuleSchema>;
335
+ export type SlackACLRule = z.infer<typeof slackACLRuleSchema>;
336
+ export type NotionACLRule = z.infer<typeof notionACLRuleSchema>;
337
+ export type GitHubACLRule = z.infer<typeof githubACLRuleSchema>;
338
+ export type GmailACLRule = z.infer<typeof gmailACLRuleSchema>;
339
+ export type TerseACLRule = z.infer<typeof terseACLRuleSchema>;
340
+ export type WebACLRule = TerseACLRule & {
341
+ resourceType: "web_capability";
342
+ };
343
+ export type ImageEditACLRule = TerseACLRule & {
344
+ resourceType: "image_edit_capability";
345
+ };
346
+ export type LinearACLRule = z.infer<typeof linearACLRuleSchema>;
347
+ export type PosthogACLRule = z.infer<typeof posthogACLRuleSchema>;
348
+ export type DatadogACLRule = z.infer<typeof datadogACLRuleSchema>;
349
+ export type LaunchDarklyACLRule = z.infer<typeof launchDarklyACLRuleSchema>;
350
+ export type AttioACLRule = z.infer<typeof attioACLRuleSchema>;
351
+ export type WorkOSACLRule = z.infer<typeof workosACLRuleSchema>;
352
+ export type SnowflakeACLRule = z.infer<typeof snowflakeACLRuleSchema>;
353
+ export declare function findACLRule(rules: ACLRule[], rule: Pick<ACLRule, "integrationType" | "integrationId" | "resourceType" | "resourceId">): ACLRule | undefined;
354
+ export declare function hasACLRule(rules: ACLRule[], rule: Pick<ACLRule, "integrationType" | "integrationId" | "resourceType" | "resourceId">): boolean;
355
+ export declare function getACLRulesForResourceType(params: {
356
+ rules: ACLRule[];
357
+ integrationType: ACLRule["integrationType"];
358
+ integrationId: string;
359
+ resourceType: ACLRule["resourceType"];
360
+ }): ACLRule[];
361
+ export declare function hasAnyACLRuleForIntegration(params: {
362
+ rules: ACLRule[];
363
+ integrationType: ACLRule["integrationType"];
364
+ integrationId: string;
365
+ }): boolean;
366
+ /**
367
+ * ACL validators are colocated with the output/tool definitions they protect.
368
+ * Each validator receives model tool args, the flat per-run `ACLRule[]`, and run configs (`readOnly`, `integrationId`).
369
+ * Validators decide in-scope only; they must not persist ACL state, mutate configs, or affect deterministic developer-authored tool calls.
370
+ */
371
+ export declare function getACLRulesForIntegration(params: {
372
+ rules: ACLRule[];
373
+ integrationType: ACLRule["integrationType"];
374
+ integrationId: string;
375
+ }): ACLRule[];
package/dist/ACL.js ADDED
@@ -0,0 +1,105 @@
1
+ import * as z from "zod";
2
+ import { IntegrationType } from "./Integrations.js";
3
+ const baseACLRuleSchema = z.object({
4
+ integrationId: z.string(),
5
+ resourceId: z.string()
6
+ });
7
+ export const slackACLResourceTypeSchema = z.enum(["channel", "dm_user"]);
8
+ export const notionACLResourceTypeSchema = z.enum(["page", "database"]);
9
+ export const githubACLResourceTypeSchema = z.literal("repository");
10
+ export const gmailACLResourceTypeSchema = z.enum(["send", "draft"]);
11
+ /** Built-in web / image capabilities use `IntegrationType.TERSE` in configs; resourceType distinguishes them. */
12
+ export const terseACLResourceTypeSchema = z.enum(["web_capability", "image_edit_capability"]);
13
+ export const linearACLResourceTypeSchema = z.enum(["integration", "team", "project"]);
14
+ export const posthogACLResourceTypeSchema = z.literal("project");
15
+ export const datadogACLResourceTypeSchema = z.enum(["integration", "index"]);
16
+ export const launchDarklyACLResourceTypeSchema = z.enum(["project", "environment"]);
17
+ export const attioACLResourceTypeSchema = z.enum(["integration", "object"]);
18
+ export const workosACLResourceTypeSchema = z.enum(["integration", "organization"]);
19
+ export const snowflakeACLResourceTypeSchema = z.literal("integration");
20
+ export const slackACLRuleSchema = baseACLRuleSchema.extend({
21
+ integrationType: z.literal(IntegrationType.SLACK),
22
+ resourceType: slackACLResourceTypeSchema
23
+ });
24
+ export const notionACLRuleSchema = baseACLRuleSchema.extend({
25
+ integrationType: z.literal(IntegrationType.NOTION),
26
+ resourceType: notionACLResourceTypeSchema
27
+ });
28
+ export const githubACLRuleSchema = baseACLRuleSchema.extend({
29
+ integrationType: z.literal(IntegrationType.GITHUB),
30
+ resourceType: githubACLResourceTypeSchema
31
+ });
32
+ export const gmailACLRuleSchema = baseACLRuleSchema.extend({
33
+ integrationType: z.literal(IntegrationType.GMAIL),
34
+ resourceType: gmailACLResourceTypeSchema
35
+ });
36
+ export const terseACLRuleSchema = baseACLRuleSchema.extend({
37
+ integrationType: z.literal(IntegrationType.TERSE),
38
+ resourceType: terseACLResourceTypeSchema
39
+ });
40
+ export const linearACLRuleSchema = baseACLRuleSchema.extend({
41
+ integrationType: z.literal(IntegrationType.LINEAR),
42
+ resourceType: linearACLResourceTypeSchema
43
+ });
44
+ export const posthogACLRuleSchema = baseACLRuleSchema.extend({
45
+ integrationType: z.literal(IntegrationType.POSTHOG),
46
+ resourceType: posthogACLResourceTypeSchema
47
+ });
48
+ export const datadogACLRuleSchema = baseACLRuleSchema.extend({
49
+ integrationType: z.literal(IntegrationType.DATADOG),
50
+ resourceType: datadogACLResourceTypeSchema
51
+ });
52
+ export const launchDarklyACLRuleSchema = baseACLRuleSchema.extend({
53
+ integrationType: z.literal(IntegrationType.LAUNCHDARKLY),
54
+ resourceType: launchDarklyACLResourceTypeSchema
55
+ });
56
+ export const attioACLRuleSchema = baseACLRuleSchema.extend({
57
+ integrationType: z.literal(IntegrationType.ATTIO),
58
+ resourceType: attioACLResourceTypeSchema
59
+ });
60
+ export const workosACLRuleSchema = baseACLRuleSchema.extend({
61
+ integrationType: z.literal(IntegrationType.WORKOS),
62
+ resourceType: workosACLResourceTypeSchema
63
+ });
64
+ export const snowflakeACLRuleSchema = baseACLRuleSchema.extend({
65
+ integrationType: z.literal(IntegrationType.SNOWFLAKE),
66
+ resourceType: snowflakeACLResourceTypeSchema
67
+ });
68
+ export const aclRuleSchema = z.discriminatedUnion("integrationType", [
69
+ slackACLRuleSchema,
70
+ notionACLRuleSchema,
71
+ githubACLRuleSchema,
72
+ gmailACLRuleSchema,
73
+ terseACLRuleSchema,
74
+ linearACLRuleSchema,
75
+ posthogACLRuleSchema,
76
+ datadogACLRuleSchema,
77
+ launchDarklyACLRuleSchema,
78
+ attioACLRuleSchema,
79
+ workosACLRuleSchema,
80
+ snowflakeACLRuleSchema
81
+ ]);
82
+ export const aclRulesSchema = z.array(aclRuleSchema);
83
+ export function findACLRule(rules, rule) {
84
+ return rules.find(candidate => candidate.integrationType === rule.integrationType &&
85
+ candidate.integrationId === rule.integrationId &&
86
+ candidate.resourceType === rule.resourceType &&
87
+ candidate.resourceId === rule.resourceId);
88
+ }
89
+ export function hasACLRule(rules, rule) {
90
+ return !!findACLRule(rules, rule);
91
+ }
92
+ export function getACLRulesForResourceType(params) {
93
+ return params.rules.filter(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId && rule.resourceType === params.resourceType);
94
+ }
95
+ export function hasAnyACLRuleForIntegration(params) {
96
+ return params.rules.some(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId);
97
+ }
98
+ /**
99
+ * ACL validators are colocated with the output/tool definitions they protect.
100
+ * Each validator receives model tool args, the flat per-run `ACLRule[]`, and run configs (`readOnly`, `integrationId`).
101
+ * Validators decide in-scope only; they must not persist ACL state, mutate configs, or affect deterministic developer-authored tool calls.
102
+ */
103
+ export function getACLRulesForIntegration(params) {
104
+ return params.rules.filter(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId);
105
+ }
@@ -0,0 +1,17 @@
1
+ export declare const integrationACLPolicy: {
2
+ readonly github: "scoped";
3
+ readonly gmail: "scoped";
4
+ readonly linear: "scoped";
5
+ readonly slack: "scoped";
6
+ readonly notion: "scoped";
7
+ readonly terse: "capability";
8
+ readonly posthog: "scoped";
9
+ readonly datadog: "scoped";
10
+ readonly cron_job: "none";
11
+ readonly launchdarkly: "scoped";
12
+ readonly workos: "integration";
13
+ readonly attio: "scoped";
14
+ readonly snowflake: "integration";
15
+ readonly webhook: "none";
16
+ readonly webmonitor: "none";
17
+ };
@@ -0,0 +1,18 @@
1
+ import { IntegrationType } from "./Integrations.js";
2
+ export const integrationACLPolicy = {
3
+ [IntegrationType.GITHUB]: "scoped",
4
+ [IntegrationType.GMAIL]: "scoped",
5
+ [IntegrationType.LINEAR]: "scoped",
6
+ [IntegrationType.SLACK]: "scoped",
7
+ [IntegrationType.NOTION]: "scoped",
8
+ [IntegrationType.TERSE]: "capability",
9
+ [IntegrationType.POSTHOG]: "scoped",
10
+ [IntegrationType.DATADOG]: "scoped",
11
+ [IntegrationType.CRON_JOB]: "none",
12
+ [IntegrationType.LAUNCHDARKLY]: "scoped",
13
+ [IntegrationType.WORKOS]: "integration",
14
+ [IntegrationType.ATTIO]: "scoped",
15
+ [IntegrationType.SNOWFLAKE]: "integration",
16
+ [IntegrationType.WEBHOOK]: "none",
17
+ [IntegrationType.WEBMONITOR]: "none"
18
+ };
@@ -183,7 +183,9 @@ export declare const ApiRoutes: {
183
183
  };
184
184
  BILLING: {
185
185
  CATALOG: string;
186
+ STATUS: string;
186
187
  CONTEXT: string;
188
+ USAGE_BUCKETS: string;
187
189
  CHECKOUT_SESSION: string;
188
190
  CHANGE: string;
189
191
  PORTAL_SESSION: string;
@@ -183,7 +183,9 @@
183
183
  },
184
184
  "BILLING": {
185
185
  "CATALOG": "/billing/catalog",
186
+ "STATUS": "/billing/status",
186
187
  "CONTEXT": "/billing/context",
188
+ "USAGE_BUCKETS": "/billing/usage-buckets",
187
189
  "CHECKOUT_SESSION": "/billing/checkout-session",
188
190
  "CHANGE": "/billing/change",
189
191
  "PORTAL_SESSION": "/billing/portal-session",
package/dist/Billing.d.ts CHANGED
@@ -91,18 +91,16 @@ export declare const billingContextResponseSchema: z.ZodObject<{
91
91
  period: z.ZodEnum<typeof TimePeriods>;
92
92
  }, z.core.$strip>], "kind">>;
93
93
  }, z.core.$strip>;
94
- usage: z.ZodObject<{
95
- buckets: z.ZodArray<z.ZodObject<{
96
- startTimestamp: z.ZodNumber;
97
- endTimestamp: z.ZodNumber;
98
- inputTokenCredits: z.ZodNumber;
99
- outputTokenCredits: z.ZodNumber;
100
- cachedInputCredits: z.ZodNumber;
101
- runCredits: z.ZodNumber;
102
- }, z.core.$strip>>;
103
- }, z.core.$strip>;
104
94
  }, z.core.$strip>;
105
95
  export type BillingContextResponse = z.infer<typeof billingContextResponseSchema>;
96
+ export declare const billingStatusResponseSchema: z.ZodObject<{
97
+ billingEnabled: z.ZodBoolean;
98
+ hasStripeCustomer: z.ZodBoolean;
99
+ hasActivePaidSubscription: z.ZodBoolean;
100
+ canManageBilling: z.ZodBoolean;
101
+ planKey: z.ZodNullable<z.ZodEnum<typeof PlanKey>>;
102
+ }, z.core.$strip>;
103
+ export type BillingStatusResponse = z.infer<typeof billingStatusResponseSchema>;
106
104
  export declare const completedEventUsageSchema: z.ZodObject<{
107
105
  inputTokens: z.ZodNumber;
108
106
  outputTokens: z.ZodNumber;
@@ -156,14 +154,6 @@ export declare const billingRecordLlmResponseSchema: z.ZodObject<{
156
154
  }, z.core.$strip>;
157
155
  export type BillingRecordLlmResponse = z.infer<typeof billingRecordLlmResponseSchema>;
158
156
  export declare const billingRecordLlmPayloadSchema: z.ZodObject<{
159
- usage: z.ZodObject<{
160
- inputTokens: z.ZodNumber;
161
- outputTokens: z.ZodNumber;
162
- totalTokens: z.ZodNumber;
163
- inputTokensDetails: z.ZodObject<{
164
- cached_tokens: z.ZodNumber;
165
- }, z.core.$strip>;
166
- }, z.core.$strip>;
167
157
  model: z.ZodObject<{
168
158
  providerId: z.ZodEnum<{
169
159
  anthropic: "anthropic";
@@ -172,6 +162,14 @@ export declare const billingRecordLlmPayloadSchema: z.ZodObject<{
172
162
  modelId: z.ZodString;
173
163
  value: z.ZodString;
174
164
  }, z.core.$strip>;
165
+ usage: z.ZodObject<{
166
+ inputTokens: z.ZodNumber;
167
+ outputTokens: z.ZodNumber;
168
+ totalTokens: z.ZodNumber;
169
+ inputTokensDetails: z.ZodObject<{
170
+ cached_tokens: z.ZodNumber;
171
+ }, z.core.$strip>;
172
+ }, z.core.$strip>;
175
173
  responseId: z.ZodString;
176
174
  }, z.core.$strip>;
177
175
  export type BillingRecordLlmPayload = z.infer<typeof billingRecordLlmPayloadSchema>;
@@ -224,8 +222,24 @@ export declare const billingContextQuerySchema: z.ZodObject<{
224
222
  timezone: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string, string | undefined>>;
225
223
  }, z.core.$strip>;
226
224
  export type BillingContextQuery = z.infer<typeof billingContextQuerySchema>;
227
- export declare const getOrCreateCustomerRequestBodySchema: z.ZodObject<{}, z.core.$strict>;
228
- export type GetOrCreateCustomerRequestBody = z.infer<typeof getOrCreateCustomerRequestBodySchema>;
225
+ /** Query params for GET /billing/usage-buckets (same range semantics as the chart on the billing page). */
226
+ export declare const billingUsageBucketsQuerySchema: z.ZodObject<{
227
+ start: z.ZodOptional<z.ZodCoercedDate<unknown>>;
228
+ end: z.ZodOptional<z.ZodCoercedDate<unknown>>;
229
+ timezone: z.ZodPipe<z.ZodOptional<z.ZodString>, z.ZodTransform<string, string | undefined>>;
230
+ }, z.core.$strip>;
231
+ export type BillingUsageBucketsQuery = z.infer<typeof billingUsageBucketsQuerySchema>;
232
+ export declare const billingUsageBucketsResponseSchema: z.ZodObject<{
233
+ buckets: z.ZodArray<z.ZodObject<{
234
+ startTimestamp: z.ZodNumber;
235
+ endTimestamp: z.ZodNumber;
236
+ inputTokenCredits: z.ZodNumber;
237
+ outputTokenCredits: z.ZodNumber;
238
+ cachedInputCredits: z.ZodNumber;
239
+ runCredits: z.ZodNumber;
240
+ }, z.core.$strip>>;
241
+ }, z.core.$strip>;
242
+ export type BillingUsageBucketsResponse = z.infer<typeof billingUsageBucketsResponseSchema>;
229
243
  export declare const billingStripeRedirectResponseSchema: z.ZodObject<{
230
244
  url: z.ZodString;
231
245
  }, z.core.$strip>;
@@ -275,10 +289,6 @@ export declare const runGateDecisionSchema: z.ZodDiscriminatedUnion<[z.ZodObject
275
289
  }, z.core.$strip>], "allow">;
276
290
  export type RunGateDecision = z.infer<typeof runGateDecisionSchema>;
277
291
  export declare function parseRunGateDenyReason(raw: unknown): RunGateDenyReason;
278
- export declare const getOrCreateCustomerResponseSchema: z.ZodObject<{
279
- customerId: z.ZodString;
280
- }, z.core.$strip>;
281
- export type GetOrCreateCustomerResponse = z.infer<typeof getOrCreateCustomerResponseSchema>;
282
292
  export declare const planSchema: z.ZodObject<{
283
293
  key: z.ZodEnum<typeof PlanKey>;
284
294
  name: z.ZodString;
@@ -337,11 +347,14 @@ export declare const BILLING_SERVICE_CALLBACK_JWT_ISSUER: "terse-billing";
337
347
  export declare const BILLING_SERVICE_CALLBACK_JWT_AUDIENCE: "terse-api";
338
348
  export declare const terseBillingJwtClaimsSchema: z.ZodObject<{
339
349
  organizationId: z.ZodString;
350
+ userId: z.ZodOptional<z.ZodString>;
340
351
  }, z.core.$strip>;
341
352
  export type TerseBillingJwtClaims = z.infer<typeof terseBillingJwtClaimsSchema>;
342
353
  export declare const BillingRoutes: {
343
354
  CATALOG: string;
355
+ STATUS: string;
344
356
  CONTEXT: string;
357
+ USAGE_BUCKETS: string;
345
358
  CHECKOUT_SESSION: string;
346
359
  CHANGE: string;
347
360
  PORTAL_SESSION: string;