terse-types 0.0.36 → 0.0.37

package/dist/ACL.d.ts

@@ -0,0 +1,375 @@
+import * as z from "zod";
+import { IntegrationType } from "./Integrations.js";
+export declare const slackACLResourceTypeSchema: z.ZodEnum<{
+    channel: "channel";
+    dm_user: "dm_user";
+}>;
+export type SlackACLResourceType = z.infer<typeof slackACLResourceTypeSchema>;
+export declare const notionACLResourceTypeSchema: z.ZodEnum<{
+    page: "page";
+    database: "database";
+}>;
+export type NotionACLResourceType = z.infer<typeof notionACLResourceTypeSchema>;
+export declare const githubACLResourceTypeSchema: z.ZodLiteral<"repository">;
+export type GitHubACLResourceType = z.infer<typeof githubACLResourceTypeSchema>;
+export declare const gmailACLResourceTypeSchema: z.ZodEnum<{
+    send: "send";
+    draft: "draft";
+}>;
+export type GmailACLResourceType = z.infer<typeof gmailACLResourceTypeSchema>;
+/** Built-in web / image capabilities use `IntegrationType.TERSE` in configs; resourceType distinguishes them. */
+export declare const terseACLResourceTypeSchema: z.ZodEnum<{
+    web_capability: "web_capability";
+    image_edit_capability: "image_edit_capability";
+}>;
+export type TerseACLResourceType = z.infer<typeof terseACLResourceTypeSchema>;
+export declare const linearACLResourceTypeSchema: z.ZodEnum<{
+    integration: "integration";
+    team: "team";
+    project: "project";
+}>;
+export type LinearACLResourceType = z.infer<typeof linearACLResourceTypeSchema>;
+export declare const posthogACLResourceTypeSchema: z.ZodLiteral<"project">;
+export type PosthogACLResourceType = z.infer<typeof posthogACLResourceTypeSchema>;
+export declare const datadogACLResourceTypeSchema: z.ZodEnum<{
+    integration: "integration";
+    index: "index";
+}>;
+export type DatadogACLResourceType = z.infer<typeof datadogACLResourceTypeSchema>;
+export declare const launchDarklyACLResourceTypeSchema: z.ZodEnum<{
+    environment: "environment";
+    project: "project";
+}>;
+export type LaunchDarklyACLResourceType = z.infer<typeof launchDarklyACLResourceTypeSchema>;
+export declare const attioACLResourceTypeSchema: z.ZodEnum<{
+    object: "object";
+    integration: "integration";
+}>;
+export type AttioACLResourceType = z.infer<typeof attioACLResourceTypeSchema>;
+export declare const workosACLResourceTypeSchema: z.ZodEnum<{
+    integration: "integration";
+    organization: "organization";
+}>;
+export type WorkOSACLResourceType = z.infer<typeof workosACLResourceTypeSchema>;
+export declare const snowflakeACLResourceTypeSchema: z.ZodLiteral<"integration">;
+export type SnowflakeACLResourceType = z.infer<typeof snowflakeACLResourceTypeSchema>;
+export declare const slackACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.SLACK>;
+    resourceType: z.ZodEnum<{
+        channel: "channel";
+        dm_user: "dm_user";
+    }>;
+}, z.core.$strip>;
+export declare const notionACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.NOTION>;
+    resourceType: z.ZodEnum<{
+        page: "page";
+        database: "database";
+    }>;
+}, z.core.$strip>;
+export declare const githubACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
+    resourceType: z.ZodLiteral<"repository">;
+}, z.core.$strip>;
+export declare const gmailACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
+    resourceType: z.ZodEnum<{
+        send: "send";
+        draft: "draft";
+    }>;
+}, z.core.$strip>;
+export declare const terseACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.TERSE>;
+    resourceType: z.ZodEnum<{
+        web_capability: "web_capability";
+        image_edit_capability: "image_edit_capability";
+    }>;
+}, z.core.$strip>;
+export declare const linearACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        team: "team";
+        project: "project";
+    }>;
+}, z.core.$strip>;
+export declare const posthogACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
+    resourceType: z.ZodLiteral<"project">;
+}, z.core.$strip>;
+export declare const datadogACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        index: "index";
+    }>;
+}, z.core.$strip>;
+export declare const launchDarklyACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
+    resourceType: z.ZodEnum<{
+        environment: "environment";
+        project: "project";
+    }>;
+}, z.core.$strip>;
+export declare const attioACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
+    resourceType: z.ZodEnum<{
+        object: "object";
+        integration: "integration";
+    }>;
+}, z.core.$strip>;
+export declare const workosACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        organization: "organization";
+    }>;
+}, z.core.$strip>;
+export declare const snowflakeACLRuleSchema: z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
+    resourceType: z.ZodLiteral<"integration">;
+}, z.core.$strip>;
+export declare const aclRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.SLACK>;
+    resourceType: z.ZodEnum<{
+        channel: "channel";
+        dm_user: "dm_user";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.NOTION>;
+    resourceType: z.ZodEnum<{
+        page: "page";
+        database: "database";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
+    resourceType: z.ZodLiteral<"repository">;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
+    resourceType: z.ZodEnum<{
+        send: "send";
+        draft: "draft";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.TERSE>;
+    resourceType: z.ZodEnum<{
+        web_capability: "web_capability";
+        image_edit_capability: "image_edit_capability";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        team: "team";
+        project: "project";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
+    resourceType: z.ZodLiteral<"project">;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        index: "index";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
+    resourceType: z.ZodEnum<{
+        environment: "environment";
+        project: "project";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
+    resourceType: z.ZodEnum<{
+        object: "object";
+        integration: "integration";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        organization: "organization";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
+    resourceType: z.ZodLiteral<"integration">;
+}, z.core.$strip>], "integrationType">;
+export declare const aclRulesSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.SLACK>;
+    resourceType: z.ZodEnum<{
+        channel: "channel";
+        dm_user: "dm_user";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.NOTION>;
+    resourceType: z.ZodEnum<{
+        page: "page";
+        database: "database";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
+    resourceType: z.ZodLiteral<"repository">;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
+    resourceType: z.ZodEnum<{
+        send: "send";
+        draft: "draft";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.TERSE>;
+    resourceType: z.ZodEnum<{
+        web_capability: "web_capability";
+        image_edit_capability: "image_edit_capability";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        team: "team";
+        project: "project";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
+    resourceType: z.ZodLiteral<"project">;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        index: "index";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
+    resourceType: z.ZodEnum<{
+        environment: "environment";
+        project: "project";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
+    resourceType: z.ZodEnum<{
+        object: "object";
+        integration: "integration";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
+    resourceType: z.ZodEnum<{
+        integration: "integration";
+        organization: "organization";
+    }>;
+}, z.core.$strip>, z.ZodObject<{
+    integrationId: z.ZodString;
+    resourceId: z.ZodString;
+    integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
+    resourceType: z.ZodLiteral<"integration">;
+}, z.core.$strip>], "integrationType">>;
+export type ACLRule = z.infer<typeof aclRuleSchema>;
+export type SlackACLRule = z.infer<typeof slackACLRuleSchema>;
+export type NotionACLRule = z.infer<typeof notionACLRuleSchema>;
+export type GitHubACLRule = z.infer<typeof githubACLRuleSchema>;
+export type GmailACLRule = z.infer<typeof gmailACLRuleSchema>;
+export type TerseACLRule = z.infer<typeof terseACLRuleSchema>;
+export type WebACLRule = TerseACLRule & {
+    resourceType: "web_capability";
+};
+export type ImageEditACLRule = TerseACLRule & {
+    resourceType: "image_edit_capability";
+};
+export type LinearACLRule = z.infer<typeof linearACLRuleSchema>;
+export type PosthogACLRule = z.infer<typeof posthogACLRuleSchema>;
+export type DatadogACLRule = z.infer<typeof datadogACLRuleSchema>;
+export type LaunchDarklyACLRule = z.infer<typeof launchDarklyACLRuleSchema>;
+export type AttioACLRule = z.infer<typeof attioACLRuleSchema>;
+export type WorkOSACLRule = z.infer<typeof workosACLRuleSchema>;
+export type SnowflakeACLRule = z.infer<typeof snowflakeACLRuleSchema>;
+export declare function findACLRule(rules: ACLRule[], rule: Pick<ACLRule, "integrationType" | "integrationId" | "resourceType" | "resourceId">): ACLRule | undefined;
+export declare function hasACLRule(rules: ACLRule[], rule: Pick<ACLRule, "integrationType" | "integrationId" | "resourceType" | "resourceId">): boolean;
+export declare function getACLRulesForResourceType(params: {
+    rules: ACLRule[];
+    integrationType: ACLRule["integrationType"];
+    integrationId: string;
+    resourceType: ACLRule["resourceType"];
+}): ACLRule[];
+export declare function hasAnyACLRuleForIntegration(params: {
+    rules: ACLRule[];
+    integrationType: ACLRule["integrationType"];
+    integrationId: string;
+}): boolean;
+/**
+ * ACL validators are colocated with the output/tool definitions they protect.
+ * Each validator receives model tool args, the flat per-run `ACLRule[]`, and run configs (`readOnly`, `integrationId`).
+ * Validators decide in-scope only; they must not persist ACL state, mutate configs, or affect deterministic developer-authored tool calls.
+ */
+export declare function getACLRulesForIntegration(params: {
+    rules: ACLRule[];
+    integrationType: ACLRule["integrationType"];
+    integrationId: string;
+}): ACLRule[];

package/dist/ACL.js

@@ -0,0 +1,105 @@
+import * as z from "zod";
+import { IntegrationType } from "./Integrations.js";
+const baseACLRuleSchema = z.object({
+    integrationId: z.string(),
+    resourceId: z.string()
+});
+export const slackACLResourceTypeSchema = z.enum(["channel", "dm_user"]);
+export const notionACLResourceTypeSchema = z.enum(["page", "database"]);
+export const githubACLResourceTypeSchema = z.literal("repository");
+export const gmailACLResourceTypeSchema = z.enum(["send", "draft"]);
+/** Built-in web / image capabilities use `IntegrationType.TERSE` in configs; resourceType distinguishes them. */
+export const terseACLResourceTypeSchema = z.enum(["web_capability", "image_edit_capability"]);
+export const linearACLResourceTypeSchema = z.enum(["integration", "team", "project"]);
+export const posthogACLResourceTypeSchema = z.literal("project");
+export const datadogACLResourceTypeSchema = z.enum(["integration", "index"]);
+export const launchDarklyACLResourceTypeSchema = z.enum(["project", "environment"]);
+export const attioACLResourceTypeSchema = z.enum(["integration", "object"]);
+export const workosACLResourceTypeSchema = z.enum(["integration", "organization"]);
+export const snowflakeACLResourceTypeSchema = z.literal("integration");
+export const slackACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.SLACK),
+    resourceType: slackACLResourceTypeSchema
+});
+export const notionACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.NOTION),
+    resourceType: notionACLResourceTypeSchema
+});
+export const githubACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.GITHUB),
+    resourceType: githubACLResourceTypeSchema
+});
+export const gmailACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.GMAIL),
+    resourceType: gmailACLResourceTypeSchema
+});
+export const terseACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.TERSE),
+    resourceType: terseACLResourceTypeSchema
+});
+export const linearACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.LINEAR),
+    resourceType: linearACLResourceTypeSchema
+});
+export const posthogACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.POSTHOG),
+    resourceType: posthogACLResourceTypeSchema
+});
+export const datadogACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.DATADOG),
+    resourceType: datadogACLResourceTypeSchema
+});
+export const launchDarklyACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.LAUNCHDARKLY),
+    resourceType: launchDarklyACLResourceTypeSchema
+});
+export const attioACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.ATTIO),
+    resourceType: attioACLResourceTypeSchema
+});
+export const workosACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.WORKOS),
+    resourceType: workosACLResourceTypeSchema
+});
+export const snowflakeACLRuleSchema = baseACLRuleSchema.extend({
+    integrationType: z.literal(IntegrationType.SNOWFLAKE),
+    resourceType: snowflakeACLResourceTypeSchema
+});
+export const aclRuleSchema = z.discriminatedUnion("integrationType", [
+    slackACLRuleSchema,
+    notionACLRuleSchema,
+    githubACLRuleSchema,
+    gmailACLRuleSchema,
+    terseACLRuleSchema,
+    linearACLRuleSchema,
+    posthogACLRuleSchema,
+    datadogACLRuleSchema,
+    launchDarklyACLRuleSchema,
+    attioACLRuleSchema,
+    workosACLRuleSchema,
+    snowflakeACLRuleSchema
+]);
+export const aclRulesSchema = z.array(aclRuleSchema);
+export function findACLRule(rules, rule) {
+    return rules.find(candidate => candidate.integrationType === rule.integrationType &&
+        candidate.integrationId === rule.integrationId &&
+        candidate.resourceType === rule.resourceType &&
+        candidate.resourceId === rule.resourceId);
+}
+export function hasACLRule(rules, rule) {
+    return !!findACLRule(rules, rule);
+}
+export function getACLRulesForResourceType(params) {
+    return params.rules.filter(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId && rule.resourceType === params.resourceType);
+}
+export function hasAnyACLRuleForIntegration(params) {
+    return params.rules.some(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId);
+}
+/**
+ * ACL validators are colocated with the output/tool definitions they protect.
+ * Each validator receives model tool args, the flat per-run `ACLRule[]`, and run configs (`readOnly`, `integrationId`).
+ * Validators decide in-scope only; they must not persist ACL state, mutate configs, or affect deterministic developer-authored tool calls.
+ */
+export function getACLRulesForIntegration(params) {
+    return params.rules.filter(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId);
+}

package/dist/ACLPolicy.d.ts

@@ -0,0 +1,17 @@
+export declare const integrationACLPolicy: {
+    readonly github: "scoped";
+    readonly gmail: "scoped";
+    readonly linear: "scoped";
+    readonly slack: "scoped";
+    readonly notion: "scoped";
+    readonly terse: "capability";
+    readonly posthog: "scoped";
+    readonly datadog: "scoped";
+    readonly cron_job: "none";
+    readonly launchdarkly: "scoped";
+    readonly workos: "integration";
+    readonly attio: "scoped";
+    readonly snowflake: "integration";
+    readonly webhook: "none";
+    readonly webmonitor: "none";
+};

package/dist/ACLPolicy.js

@@ -0,0 +1,18 @@
+import { IntegrationType } from "./Integrations.js";
+export const integrationACLPolicy = {
+    [IntegrationType.GITHUB]: "scoped",
+    [IntegrationType.GMAIL]: "scoped",
+    [IntegrationType.LINEAR]: "scoped",
+    [IntegrationType.SLACK]: "scoped",
+    [IntegrationType.NOTION]: "scoped",
+    [IntegrationType.TERSE]: "capability",
+    [IntegrationType.POSTHOG]: "scoped",
+    [IntegrationType.DATADOG]: "scoped",
+    [IntegrationType.CRON_JOB]: "none",
+    [IntegrationType.LAUNCHDARKLY]: "scoped",
+    [IntegrationType.WORKOS]: "integration",
+    [IntegrationType.ATTIO]: "scoped",
+    [IntegrationType.SNOWFLAKE]: "integration",
+    [IntegrationType.WEBHOOK]: "none",
+    [IntegrationType.WEBMONITOR]: "none"
+};

package/dist/ApiRouteBuilder.d.ts

@@ -140,6 +140,7 @@ export declare const ApiRoutes: {
     };
     SDK: {
         ME: string;
+        ME_ORGANIZATIONS: string;
         SAMPLE_EVENTS: string;
         HYDRATE_SAMPLE_EVENT: string;
         VERIFY_JOB_SERVER: string;
@@ -152,7 +153,9 @@ export declare const ApiRoutes: {
         LISTEN: string;
         CREATE_PROJECT: string;
         DEPLOY: string;
+        IDENTIFY: string;
         DEVICE_TOKEN_EXCHANGE: string;
+        SWITCH_ORGANIZATION: string;
         INTEGRATION_FIELDS: string;
         INTEGRATION_FORM_SUBMIT: string;
         JOB_WEBHOOK_TRIGGER: string;

package/dist/ApiRoutes.json

@@ -140,6 +140,7 @@
     },
     "SDK": {
         "ME": "/sdk/me",
+        "ME_ORGANIZATIONS": "/sdk/me/organizations",
         "SAMPLE_EVENTS": "/sdk/sample-events",
         "HYDRATE_SAMPLE_EVENT": "/sdk/sample-events/hydrate",
         "VERIFY_JOB_SERVER": "/sdk/agents/:agentId/verify-job-server",
@@ -152,7 +153,9 @@
         "LISTEN": "/sdk/listen",
         "CREATE_PROJECT": "/sdk/projects",
         "DEPLOY": "/sdk/deploy",
+        "IDENTIFY": "/sdk/auth/identify",
         "DEVICE_TOKEN_EXCHANGE": "/sdk/auth/device-token-exchange",
+        "SWITCH_ORGANIZATION": "/sdk/auth/switch-organization",
         "INTEGRATION_FIELDS": "/sdk/integrations/:integrationType/fields",
         "INTEGRATION_FORM_SUBMIT": "/sdk/integrations/:integrationType/form-submit",
         "JOB_WEBHOOK_TRIGGER": "/webhook/terse/trigger"

package/dist/getConfigACLRules.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Pure config-to-ACL derivation (no network I/O).
+ *
+ * ACL and `readOnly` apply only to model-selected tool calls during agent runs; see `ACL.ts`
+ * for the full product contract.
+ */
+import type { ACLRule } from "./ACL.js";
+import type { ConfigData } from "./Configs.js";
+export declare function getConfigACLRules(config: ConfigData): ACLRule[];
+export declare function getMergedACLRules(configs: ConfigData[]): ACLRule[];

package/dist/types.d.ts

@@ -226,6 +226,11 @@ export declare const deviceTokenExchangeUserSchema: z.ZodObject<{
     firstName: z.ZodNullable<z.ZodString>;
     displayName: z.ZodNullable<z.ZodString>;
 }, z.core.$strip>;
+export declare const sdkOrganizationSummarySchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export type SdkOrganizationSummary = z.infer<typeof sdkOrganizationSummarySchema>;
 export declare const deviceTokenExchangeResponseSchema: z.ZodObject<{
     apiKey: z.ZodString;
     user: z.ZodObject<{
@@ -233,8 +238,55 @@ export declare const deviceTokenExchangeResponseSchema: z.ZodObject<{
         firstName: z.ZodNullable<z.ZodString>;
         displayName: z.ZodNullable<z.ZodString>;
     }, z.core.$strip>;
+    organization: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
 }, z.core.$strip>;
 export type DeviceTokenExchangeResponse = z.infer<typeof deviceTokenExchangeResponseSchema>;
+export declare const identifyUserSchema: z.ZodObject<{
+    workosId: z.ZodString;
+    email: z.ZodString;
+    firstName: z.ZodNullable<z.ZodString>;
+    lastName: z.ZodNullable<z.ZodString>;
+    displayName: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const identifyOrganizationSchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    roles: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const identifyResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        workosId: z.ZodString;
+        email: z.ZodString;
+        firstName: z.ZodNullable<z.ZodString>;
+        lastName: z.ZodNullable<z.ZodString>;
+        displayName: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        roles: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type IdentifyResponse = z.infer<typeof identifyResponseSchema>;
+export declare const sdkOrganizationsListResponseSchema: z.ZodObject<{
+    organizations: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>>;
+    activeOrganizationId: z.ZodString;
+}, z.core.$strip>;
+export type SdkOrganizationsListResponse = z.infer<typeof sdkOrganizationsListResponseSchema>;
+export declare const switchOrganizationResponseSchema: z.ZodObject<{
+    apiKey: z.ZodString;
+    organization: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type SwitchOrganizationResponse = z.infer<typeof switchOrganizationResponseSchema>;
 export declare const triggerMetadataSchema: z.ZodObject<{
     webhookUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
@@ -9719,10 +9771,19 @@ export declare const apiTokenUpdateRequestSchema: z.ZodObject<{
     name: z.ZodString;
 }, z.core.$strip>;
 export type ApiTokenUpdateRequest = z.infer<typeof apiTokenUpdateRequestSchema>;
+export declare const identifyRequestSchema: z.ZodObject<{
+    accessToken: z.ZodString;
+}, z.core.$strip>;
+export type IdentifyRequest = z.infer<typeof identifyRequestSchema>;
 export declare const deviceTokenExchangeRequestSchema: z.ZodObject<{
     accessToken: z.ZodString;
+    organizationId: z.ZodString;
 }, z.core.$strip>;
 export type DeviceTokenExchangeRequest = z.infer<typeof deviceTokenExchangeRequestSchema>;
+export declare const switchOrganizationRequestSchema: z.ZodObject<{
+    organizationId: z.ZodString;
+}, z.core.$strip>;
+export type SwitchOrganizationRequest = z.infer<typeof switchOrganizationRequestSchema>;
 export declare const sdkToolExecuteRequestSchema: z.ZodObject<{
     toolName: z.ZodString;
     params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;