terse-types 0.0.39 → 0.0.40

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/ACL.d.ts ADDED
@@ -0,0 +1,375 @@
1
+ import * as z from "zod";
2
+ import { IntegrationType } from "./Integrations.js";
3
+ export declare const slackACLResourceTypeSchema: z.ZodEnum<{
4
+ channel: "channel";
5
+ dm_user: "dm_user";
6
+ }>;
7
+ export type SlackACLResourceType = z.infer<typeof slackACLResourceTypeSchema>;
8
+ export declare const notionACLResourceTypeSchema: z.ZodEnum<{
9
+ page: "page";
10
+ database: "database";
11
+ }>;
12
+ export type NotionACLResourceType = z.infer<typeof notionACLResourceTypeSchema>;
13
+ export declare const githubACLResourceTypeSchema: z.ZodLiteral<"repository">;
14
+ export type GitHubACLResourceType = z.infer<typeof githubACLResourceTypeSchema>;
15
+ export declare const gmailACLResourceTypeSchema: z.ZodEnum<{
16
+ send: "send";
17
+ draft: "draft";
18
+ }>;
19
+ export type GmailACLResourceType = z.infer<typeof gmailACLResourceTypeSchema>;
20
+ /** Built-in web / image capabilities use `IntegrationType.TERSE` in configs; resourceType distinguishes them. */
21
+ export declare const terseACLResourceTypeSchema: z.ZodEnum<{
22
+ web_capability: "web_capability";
23
+ image_edit_capability: "image_edit_capability";
24
+ }>;
25
+ export type TerseACLResourceType = z.infer<typeof terseACLResourceTypeSchema>;
26
+ export declare const linearACLResourceTypeSchema: z.ZodEnum<{
27
+ integration: "integration";
28
+ team: "team";
29
+ project: "project";
30
+ }>;
31
+ export type LinearACLResourceType = z.infer<typeof linearACLResourceTypeSchema>;
32
+ export declare const posthogACLResourceTypeSchema: z.ZodLiteral<"project">;
33
+ export type PosthogACLResourceType = z.infer<typeof posthogACLResourceTypeSchema>;
34
+ export declare const datadogACLResourceTypeSchema: z.ZodEnum<{
35
+ integration: "integration";
36
+ index: "index";
37
+ }>;
38
+ export type DatadogACLResourceType = z.infer<typeof datadogACLResourceTypeSchema>;
39
+ export declare const launchDarklyACLResourceTypeSchema: z.ZodEnum<{
40
+ environment: "environment";
41
+ project: "project";
42
+ }>;
43
+ export type LaunchDarklyACLResourceType = z.infer<typeof launchDarklyACLResourceTypeSchema>;
44
+ export declare const attioACLResourceTypeSchema: z.ZodEnum<{
45
+ object: "object";
46
+ integration: "integration";
47
+ }>;
48
+ export type AttioACLResourceType = z.infer<typeof attioACLResourceTypeSchema>;
49
+ export declare const workosACLResourceTypeSchema: z.ZodEnum<{
50
+ integration: "integration";
51
+ organization: "organization";
52
+ }>;
53
+ export type WorkOSACLResourceType = z.infer<typeof workosACLResourceTypeSchema>;
54
+ export declare const snowflakeACLResourceTypeSchema: z.ZodLiteral<"integration">;
55
+ export type SnowflakeACLResourceType = z.infer<typeof snowflakeACLResourceTypeSchema>;
56
+ export declare const slackACLRuleSchema: z.ZodObject<{
57
+ integrationId: z.ZodString;
58
+ resourceId: z.ZodString;
59
+ integrationType: z.ZodLiteral<IntegrationType.SLACK>;
60
+ resourceType: z.ZodEnum<{
61
+ channel: "channel";
62
+ dm_user: "dm_user";
63
+ }>;
64
+ }, z.core.$strip>;
65
+ export declare const notionACLRuleSchema: z.ZodObject<{
66
+ integrationId: z.ZodString;
67
+ resourceId: z.ZodString;
68
+ integrationType: z.ZodLiteral<IntegrationType.NOTION>;
69
+ resourceType: z.ZodEnum<{
70
+ page: "page";
71
+ database: "database";
72
+ }>;
73
+ }, z.core.$strip>;
74
+ export declare const githubACLRuleSchema: z.ZodObject<{
75
+ integrationId: z.ZodString;
76
+ resourceId: z.ZodString;
77
+ integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
78
+ resourceType: z.ZodLiteral<"repository">;
79
+ }, z.core.$strip>;
80
+ export declare const gmailACLRuleSchema: z.ZodObject<{
81
+ integrationId: z.ZodString;
82
+ resourceId: z.ZodString;
83
+ integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
84
+ resourceType: z.ZodEnum<{
85
+ send: "send";
86
+ draft: "draft";
87
+ }>;
88
+ }, z.core.$strip>;
89
+ export declare const terseACLRuleSchema: z.ZodObject<{
90
+ integrationId: z.ZodString;
91
+ resourceId: z.ZodString;
92
+ integrationType: z.ZodLiteral<IntegrationType.TERSE>;
93
+ resourceType: z.ZodEnum<{
94
+ web_capability: "web_capability";
95
+ image_edit_capability: "image_edit_capability";
96
+ }>;
97
+ }, z.core.$strip>;
98
+ export declare const linearACLRuleSchema: z.ZodObject<{
99
+ integrationId: z.ZodString;
100
+ resourceId: z.ZodString;
101
+ integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
102
+ resourceType: z.ZodEnum<{
103
+ integration: "integration";
104
+ team: "team";
105
+ project: "project";
106
+ }>;
107
+ }, z.core.$strip>;
108
+ export declare const posthogACLRuleSchema: z.ZodObject<{
109
+ integrationId: z.ZodString;
110
+ resourceId: z.ZodString;
111
+ integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
112
+ resourceType: z.ZodLiteral<"project">;
113
+ }, z.core.$strip>;
114
+ export declare const datadogACLRuleSchema: z.ZodObject<{
115
+ integrationId: z.ZodString;
116
+ resourceId: z.ZodString;
117
+ integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
118
+ resourceType: z.ZodEnum<{
119
+ integration: "integration";
120
+ index: "index";
121
+ }>;
122
+ }, z.core.$strip>;
123
+ export declare const launchDarklyACLRuleSchema: z.ZodObject<{
124
+ integrationId: z.ZodString;
125
+ resourceId: z.ZodString;
126
+ integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
127
+ resourceType: z.ZodEnum<{
128
+ environment: "environment";
129
+ project: "project";
130
+ }>;
131
+ }, z.core.$strip>;
132
+ export declare const attioACLRuleSchema: z.ZodObject<{
133
+ integrationId: z.ZodString;
134
+ resourceId: z.ZodString;
135
+ integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
136
+ resourceType: z.ZodEnum<{
137
+ object: "object";
138
+ integration: "integration";
139
+ }>;
140
+ }, z.core.$strip>;
141
+ export declare const workosACLRuleSchema: z.ZodObject<{
142
+ integrationId: z.ZodString;
143
+ resourceId: z.ZodString;
144
+ integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
145
+ resourceType: z.ZodEnum<{
146
+ integration: "integration";
147
+ organization: "organization";
148
+ }>;
149
+ }, z.core.$strip>;
150
+ export declare const snowflakeACLRuleSchema: z.ZodObject<{
151
+ integrationId: z.ZodString;
152
+ resourceId: z.ZodString;
153
+ integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
154
+ resourceType: z.ZodLiteral<"integration">;
155
+ }, z.core.$strip>;
156
+ export declare const aclRuleSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
157
+ integrationId: z.ZodString;
158
+ resourceId: z.ZodString;
159
+ integrationType: z.ZodLiteral<IntegrationType.SLACK>;
160
+ resourceType: z.ZodEnum<{
161
+ channel: "channel";
162
+ dm_user: "dm_user";
163
+ }>;
164
+ }, z.core.$strip>, z.ZodObject<{
165
+ integrationId: z.ZodString;
166
+ resourceId: z.ZodString;
167
+ integrationType: z.ZodLiteral<IntegrationType.NOTION>;
168
+ resourceType: z.ZodEnum<{
169
+ page: "page";
170
+ database: "database";
171
+ }>;
172
+ }, z.core.$strip>, z.ZodObject<{
173
+ integrationId: z.ZodString;
174
+ resourceId: z.ZodString;
175
+ integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
176
+ resourceType: z.ZodLiteral<"repository">;
177
+ }, z.core.$strip>, z.ZodObject<{
178
+ integrationId: z.ZodString;
179
+ resourceId: z.ZodString;
180
+ integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
181
+ resourceType: z.ZodEnum<{
182
+ send: "send";
183
+ draft: "draft";
184
+ }>;
185
+ }, z.core.$strip>, z.ZodObject<{
186
+ integrationId: z.ZodString;
187
+ resourceId: z.ZodString;
188
+ integrationType: z.ZodLiteral<IntegrationType.TERSE>;
189
+ resourceType: z.ZodEnum<{
190
+ web_capability: "web_capability";
191
+ image_edit_capability: "image_edit_capability";
192
+ }>;
193
+ }, z.core.$strip>, z.ZodObject<{
194
+ integrationId: z.ZodString;
195
+ resourceId: z.ZodString;
196
+ integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
197
+ resourceType: z.ZodEnum<{
198
+ integration: "integration";
199
+ team: "team";
200
+ project: "project";
201
+ }>;
202
+ }, z.core.$strip>, z.ZodObject<{
203
+ integrationId: z.ZodString;
204
+ resourceId: z.ZodString;
205
+ integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
206
+ resourceType: z.ZodLiteral<"project">;
207
+ }, z.core.$strip>, z.ZodObject<{
208
+ integrationId: z.ZodString;
209
+ resourceId: z.ZodString;
210
+ integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
211
+ resourceType: z.ZodEnum<{
212
+ integration: "integration";
213
+ index: "index";
214
+ }>;
215
+ }, z.core.$strip>, z.ZodObject<{
216
+ integrationId: z.ZodString;
217
+ resourceId: z.ZodString;
218
+ integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
219
+ resourceType: z.ZodEnum<{
220
+ environment: "environment";
221
+ project: "project";
222
+ }>;
223
+ }, z.core.$strip>, z.ZodObject<{
224
+ integrationId: z.ZodString;
225
+ resourceId: z.ZodString;
226
+ integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
227
+ resourceType: z.ZodEnum<{
228
+ object: "object";
229
+ integration: "integration";
230
+ }>;
231
+ }, z.core.$strip>, z.ZodObject<{
232
+ integrationId: z.ZodString;
233
+ resourceId: z.ZodString;
234
+ integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
235
+ resourceType: z.ZodEnum<{
236
+ integration: "integration";
237
+ organization: "organization";
238
+ }>;
239
+ }, z.core.$strip>, z.ZodObject<{
240
+ integrationId: z.ZodString;
241
+ resourceId: z.ZodString;
242
+ integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
243
+ resourceType: z.ZodLiteral<"integration">;
244
+ }, z.core.$strip>], "integrationType">;
245
+ export declare const aclRulesSchema: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
246
+ integrationId: z.ZodString;
247
+ resourceId: z.ZodString;
248
+ integrationType: z.ZodLiteral<IntegrationType.SLACK>;
249
+ resourceType: z.ZodEnum<{
250
+ channel: "channel";
251
+ dm_user: "dm_user";
252
+ }>;
253
+ }, z.core.$strip>, z.ZodObject<{
254
+ integrationId: z.ZodString;
255
+ resourceId: z.ZodString;
256
+ integrationType: z.ZodLiteral<IntegrationType.NOTION>;
257
+ resourceType: z.ZodEnum<{
258
+ page: "page";
259
+ database: "database";
260
+ }>;
261
+ }, z.core.$strip>, z.ZodObject<{
262
+ integrationId: z.ZodString;
263
+ resourceId: z.ZodString;
264
+ integrationType: z.ZodLiteral<IntegrationType.GITHUB>;
265
+ resourceType: z.ZodLiteral<"repository">;
266
+ }, z.core.$strip>, z.ZodObject<{
267
+ integrationId: z.ZodString;
268
+ resourceId: z.ZodString;
269
+ integrationType: z.ZodLiteral<IntegrationType.GMAIL>;
270
+ resourceType: z.ZodEnum<{
271
+ send: "send";
272
+ draft: "draft";
273
+ }>;
274
+ }, z.core.$strip>, z.ZodObject<{
275
+ integrationId: z.ZodString;
276
+ resourceId: z.ZodString;
277
+ integrationType: z.ZodLiteral<IntegrationType.TERSE>;
278
+ resourceType: z.ZodEnum<{
279
+ web_capability: "web_capability";
280
+ image_edit_capability: "image_edit_capability";
281
+ }>;
282
+ }, z.core.$strip>, z.ZodObject<{
283
+ integrationId: z.ZodString;
284
+ resourceId: z.ZodString;
285
+ integrationType: z.ZodLiteral<IntegrationType.LINEAR>;
286
+ resourceType: z.ZodEnum<{
287
+ integration: "integration";
288
+ team: "team";
289
+ project: "project";
290
+ }>;
291
+ }, z.core.$strip>, z.ZodObject<{
292
+ integrationId: z.ZodString;
293
+ resourceId: z.ZodString;
294
+ integrationType: z.ZodLiteral<IntegrationType.POSTHOG>;
295
+ resourceType: z.ZodLiteral<"project">;
296
+ }, z.core.$strip>, z.ZodObject<{
297
+ integrationId: z.ZodString;
298
+ resourceId: z.ZodString;
299
+ integrationType: z.ZodLiteral<IntegrationType.DATADOG>;
300
+ resourceType: z.ZodEnum<{
301
+ integration: "integration";
302
+ index: "index";
303
+ }>;
304
+ }, z.core.$strip>, z.ZodObject<{
305
+ integrationId: z.ZodString;
306
+ resourceId: z.ZodString;
307
+ integrationType: z.ZodLiteral<IntegrationType.LAUNCHDARKLY>;
308
+ resourceType: z.ZodEnum<{
309
+ environment: "environment";
310
+ project: "project";
311
+ }>;
312
+ }, z.core.$strip>, z.ZodObject<{
313
+ integrationId: z.ZodString;
314
+ resourceId: z.ZodString;
315
+ integrationType: z.ZodLiteral<IntegrationType.ATTIO>;
316
+ resourceType: z.ZodEnum<{
317
+ object: "object";
318
+ integration: "integration";
319
+ }>;
320
+ }, z.core.$strip>, z.ZodObject<{
321
+ integrationId: z.ZodString;
322
+ resourceId: z.ZodString;
323
+ integrationType: z.ZodLiteral<IntegrationType.WORKOS>;
324
+ resourceType: z.ZodEnum<{
325
+ integration: "integration";
326
+ organization: "organization";
327
+ }>;
328
+ }, z.core.$strip>, z.ZodObject<{
329
+ integrationId: z.ZodString;
330
+ resourceId: z.ZodString;
331
+ integrationType: z.ZodLiteral<IntegrationType.SNOWFLAKE>;
332
+ resourceType: z.ZodLiteral<"integration">;
333
+ }, z.core.$strip>], "integrationType">>;
334
+ export type ACLRule = z.infer<typeof aclRuleSchema>;
335
+ export type SlackACLRule = z.infer<typeof slackACLRuleSchema>;
336
+ export type NotionACLRule = z.infer<typeof notionACLRuleSchema>;
337
+ export type GitHubACLRule = z.infer<typeof githubACLRuleSchema>;
338
+ export type GmailACLRule = z.infer<typeof gmailACLRuleSchema>;
339
+ export type TerseACLRule = z.infer<typeof terseACLRuleSchema>;
340
+ export type WebACLRule = TerseACLRule & {
341
+ resourceType: "web_capability";
342
+ };
343
+ export type ImageEditACLRule = TerseACLRule & {
344
+ resourceType: "image_edit_capability";
345
+ };
346
+ export type LinearACLRule = z.infer<typeof linearACLRuleSchema>;
347
+ export type PosthogACLRule = z.infer<typeof posthogACLRuleSchema>;
348
+ export type DatadogACLRule = z.infer<typeof datadogACLRuleSchema>;
349
+ export type LaunchDarklyACLRule = z.infer<typeof launchDarklyACLRuleSchema>;
350
+ export type AttioACLRule = z.infer<typeof attioACLRuleSchema>;
351
+ export type WorkOSACLRule = z.infer<typeof workosACLRuleSchema>;
352
+ export type SnowflakeACLRule = z.infer<typeof snowflakeACLRuleSchema>;
353
+ export declare function findACLRule(rules: ACLRule[], rule: Pick<ACLRule, "integrationType" | "integrationId" | "resourceType" | "resourceId">): ACLRule | undefined;
354
+ export declare function hasACLRule(rules: ACLRule[], rule: Pick<ACLRule, "integrationType" | "integrationId" | "resourceType" | "resourceId">): boolean;
355
+ export declare function getACLRulesForResourceType(params: {
356
+ rules: ACLRule[];
357
+ integrationType: ACLRule["integrationType"];
358
+ integrationId: string;
359
+ resourceType: ACLRule["resourceType"];
360
+ }): ACLRule[];
361
+ export declare function hasAnyACLRuleForIntegration(params: {
362
+ rules: ACLRule[];
363
+ integrationType: ACLRule["integrationType"];
364
+ integrationId: string;
365
+ }): boolean;
366
+ /**
367
+ * ACL validators are colocated with the output/tool definitions they protect.
368
+ * Each validator receives model tool args, the flat per-run `ACLRule[]`, and run configs (`readOnly`, `integrationId`).
369
+ * Validators decide in-scope only; they must not persist ACL state, mutate configs, or affect deterministic developer-authored tool calls.
370
+ */
371
+ export declare function getACLRulesForIntegration(params: {
372
+ rules: ACLRule[];
373
+ integrationType: ACLRule["integrationType"];
374
+ integrationId: string;
375
+ }): ACLRule[];
package/dist/ACL.js ADDED
@@ -0,0 +1,105 @@
1
+ import * as z from "zod";
2
+ import { IntegrationType } from "./Integrations.js";
3
+ const baseACLRuleSchema = z.object({
4
+ integrationId: z.string(),
5
+ resourceId: z.string()
6
+ });
7
+ export const slackACLResourceTypeSchema = z.enum(["channel", "dm_user"]);
8
+ export const notionACLResourceTypeSchema = z.enum(["page", "database"]);
9
+ export const githubACLResourceTypeSchema = z.literal("repository");
10
+ export const gmailACLResourceTypeSchema = z.enum(["send", "draft"]);
11
+ /** Built-in web / image capabilities use `IntegrationType.TERSE` in configs; resourceType distinguishes them. */
12
+ export const terseACLResourceTypeSchema = z.enum(["web_capability", "image_edit_capability"]);
13
+ export const linearACLResourceTypeSchema = z.enum(["integration", "team", "project"]);
14
+ export const posthogACLResourceTypeSchema = z.literal("project");
15
+ export const datadogACLResourceTypeSchema = z.enum(["integration", "index"]);
16
+ export const launchDarklyACLResourceTypeSchema = z.enum(["project", "environment"]);
17
+ export const attioACLResourceTypeSchema = z.enum(["integration", "object"]);
18
+ export const workosACLResourceTypeSchema = z.enum(["integration", "organization"]);
19
+ export const snowflakeACLResourceTypeSchema = z.literal("integration");
20
+ export const slackACLRuleSchema = baseACLRuleSchema.extend({
21
+ integrationType: z.literal(IntegrationType.SLACK),
22
+ resourceType: slackACLResourceTypeSchema
23
+ });
24
+ export const notionACLRuleSchema = baseACLRuleSchema.extend({
25
+ integrationType: z.literal(IntegrationType.NOTION),
26
+ resourceType: notionACLResourceTypeSchema
27
+ });
28
+ export const githubACLRuleSchema = baseACLRuleSchema.extend({
29
+ integrationType: z.literal(IntegrationType.GITHUB),
30
+ resourceType: githubACLResourceTypeSchema
31
+ });
32
+ export const gmailACLRuleSchema = baseACLRuleSchema.extend({
33
+ integrationType: z.literal(IntegrationType.GMAIL),
34
+ resourceType: gmailACLResourceTypeSchema
35
+ });
36
+ export const terseACLRuleSchema = baseACLRuleSchema.extend({
37
+ integrationType: z.literal(IntegrationType.TERSE),
38
+ resourceType: terseACLResourceTypeSchema
39
+ });
40
+ export const linearACLRuleSchema = baseACLRuleSchema.extend({
41
+ integrationType: z.literal(IntegrationType.LINEAR),
42
+ resourceType: linearACLResourceTypeSchema
43
+ });
44
+ export const posthogACLRuleSchema = baseACLRuleSchema.extend({
45
+ integrationType: z.literal(IntegrationType.POSTHOG),
46
+ resourceType: posthogACLResourceTypeSchema
47
+ });
48
+ export const datadogACLRuleSchema = baseACLRuleSchema.extend({
49
+ integrationType: z.literal(IntegrationType.DATADOG),
50
+ resourceType: datadogACLResourceTypeSchema
51
+ });
52
+ export const launchDarklyACLRuleSchema = baseACLRuleSchema.extend({
53
+ integrationType: z.literal(IntegrationType.LAUNCHDARKLY),
54
+ resourceType: launchDarklyACLResourceTypeSchema
55
+ });
56
+ export const attioACLRuleSchema = baseACLRuleSchema.extend({
57
+ integrationType: z.literal(IntegrationType.ATTIO),
58
+ resourceType: attioACLResourceTypeSchema
59
+ });
60
+ export const workosACLRuleSchema = baseACLRuleSchema.extend({
61
+ integrationType: z.literal(IntegrationType.WORKOS),
62
+ resourceType: workosACLResourceTypeSchema
63
+ });
64
+ export const snowflakeACLRuleSchema = baseACLRuleSchema.extend({
65
+ integrationType: z.literal(IntegrationType.SNOWFLAKE),
66
+ resourceType: snowflakeACLResourceTypeSchema
67
+ });
68
+ export const aclRuleSchema = z.discriminatedUnion("integrationType", [
69
+ slackACLRuleSchema,
70
+ notionACLRuleSchema,
71
+ githubACLRuleSchema,
72
+ gmailACLRuleSchema,
73
+ terseACLRuleSchema,
74
+ linearACLRuleSchema,
75
+ posthogACLRuleSchema,
76
+ datadogACLRuleSchema,
77
+ launchDarklyACLRuleSchema,
78
+ attioACLRuleSchema,
79
+ workosACLRuleSchema,
80
+ snowflakeACLRuleSchema
81
+ ]);
82
+ export const aclRulesSchema = z.array(aclRuleSchema);
83
+ export function findACLRule(rules, rule) {
84
+ return rules.find(candidate => candidate.integrationType === rule.integrationType &&
85
+ candidate.integrationId === rule.integrationId &&
86
+ candidate.resourceType === rule.resourceType &&
87
+ candidate.resourceId === rule.resourceId);
88
+ }
89
+ export function hasACLRule(rules, rule) {
90
+ return !!findACLRule(rules, rule);
91
+ }
92
+ export function getACLRulesForResourceType(params) {
93
+ return params.rules.filter(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId && rule.resourceType === params.resourceType);
94
+ }
95
+ export function hasAnyACLRuleForIntegration(params) {
96
+ return params.rules.some(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId);
97
+ }
98
+ /**
99
+ * ACL validators are colocated with the output/tool definitions they protect.
100
+ * Each validator receives model tool args, the flat per-run `ACLRule[]`, and run configs (`readOnly`, `integrationId`).
101
+ * Validators decide in-scope only; they must not persist ACL state, mutate configs, or affect deterministic developer-authored tool calls.
102
+ */
103
+ export function getACLRulesForIntegration(params) {
104
+ return params.rules.filter(rule => rule.integrationType === params.integrationType && rule.integrationId === params.integrationId);
105
+ }
@@ -0,0 +1,17 @@
1
+ export declare const integrationACLPolicy: {
2
+ readonly github: "scoped";
3
+ readonly gmail: "scoped";
4
+ readonly linear: "scoped";
5
+ readonly slack: "scoped";
6
+ readonly notion: "scoped";
7
+ readonly terse: "capability";
8
+ readonly posthog: "scoped";
9
+ readonly datadog: "scoped";
10
+ readonly cron_job: "none";
11
+ readonly launchdarkly: "scoped";
12
+ readonly workos: "integration";
13
+ readonly attio: "scoped";
14
+ readonly snowflake: "integration";
15
+ readonly webhook: "none";
16
+ readonly webmonitor: "none";
17
+ };
@@ -0,0 +1,18 @@
1
+ import { IntegrationType } from "./Integrations.js";
2
+ export const integrationACLPolicy = {
3
+ [IntegrationType.GITHUB]: "scoped",
4
+ [IntegrationType.GMAIL]: "scoped",
5
+ [IntegrationType.LINEAR]: "scoped",
6
+ [IntegrationType.SLACK]: "scoped",
7
+ [IntegrationType.NOTION]: "scoped",
8
+ [IntegrationType.TERSE]: "capability",
9
+ [IntegrationType.POSTHOG]: "scoped",
10
+ [IntegrationType.DATADOG]: "scoped",
11
+ [IntegrationType.CRON_JOB]: "none",
12
+ [IntegrationType.LAUNCHDARKLY]: "scoped",
13
+ [IntegrationType.WORKOS]: "integration",
14
+ [IntegrationType.ATTIO]: "scoped",
15
+ [IntegrationType.SNOWFLAKE]: "integration",
16
+ [IntegrationType.WEBHOOK]: "none",
17
+ [IntegrationType.WEBMONITOR]: "none"
18
+ };
@@ -97,8 +97,6 @@ export declare const ApiRoutes: {
97
97
  RECENT: string;
98
98
  BY_ID: string;
99
99
  WEBHOOK_URL: string;
100
- FILES: string;
101
- FILE_CONTENT: string;
102
100
  };
103
101
  IMPROVEMENTS: {
104
102
  BY_AGENT_ID: string;
@@ -132,8 +130,6 @@ export declare const ApiRoutes: {
132
130
  LIST: string;
133
131
  BY_ID: string;
134
132
  DEPLOYS: string;
135
- SOURCE_FILES: string;
136
- SOURCE_FILE_CONTENT: string;
137
133
  ROTATE_SIGNING_SECRET: string;
138
134
  ROTATE_API_KEY: string;
139
135
  };
@@ -96,9 +96,7 @@
96
96
  "LIST": "/agents",
97
97
  "RECENT": "/agents/recent",
98
98
  "BY_ID": "/agents/:id",
99
- "WEBHOOK_URL": "/agents/:agentId/webhook-url",
100
- "FILES": "/agents/:agentId/files",
101
- "FILE_CONTENT": "/agents/:agentId/files/:fileId"
99
+ "WEBHOOK_URL": "/agents/:agentId/webhook-url"
102
100
  },
103
101
  "IMPROVEMENTS": {
104
102
  "BY_AGENT_ID": "/agents/:agentId/improvements",
@@ -132,8 +130,6 @@
132
130
  "LIST": "/projects",
133
131
  "BY_ID": "/projects/:id",
134
132
  "DEPLOYS": "/projects/:id/deploys",
135
- "SOURCE_FILES": "/projects/:id/source/files",
136
- "SOURCE_FILE_CONTENT": "/projects/:id/source/files/:fileId",
137
133
  "ROTATE_SIGNING_SECRET": "/projects/:id/rotate-signing-secret",
138
134
  "ROTATE_API_KEY": "/projects/:id/rotate-api-key"
139
135
  },
@@ -143,31 +143,34 @@ export declare const IntegrationInstanceSchema: z.ZodObject<{
143
143
  id: z.ZodString;
144
144
  }, z.core.$strip>;
145
145
  export type IntegrationInstance = z.infer<typeof IntegrationInstanceSchema>;
146
- export interface SlackInstallationOptions {
147
- isBotUser: boolean;
148
- }
149
- export type NoInstallationOptions = Record<string, never>;
146
+ export declare const NoInstallationOptionsSchema: z.ZodObject<{}, z.core.$strict>;
147
+ export type NoInstallationOptions = z.infer<typeof NoInstallationOptionsSchema>;
148
+ export declare const SlackInstallationOptionsSchema: z.ZodObject<{
149
+ isBotUser: z.ZodBoolean;
150
+ }, z.core.$strict>;
151
+ export type SlackInstallationOptions = z.infer<typeof SlackInstallationOptionsSchema>;
150
152
  export type AdditionalStateParams = Record<string, string>;
151
- type EnsureExhaustiveInstallationOptions<T extends Record<IntegrationType, NoInstallationOptions | SlackInstallationOptions>> = T;
152
- export type IntegrationInstallationOptions = EnsureExhaustiveInstallationOptions<{
153
- [IntegrationType.SLACK]: SlackInstallationOptions;
154
- [IntegrationType.GMAIL]: NoInstallationOptions;
155
- [IntegrationType.NOTION]: NoInstallationOptions;
156
- [IntegrationType.LINEAR]: NoInstallationOptions;
157
- [IntegrationType.GITHUB]: NoInstallationOptions;
158
- [IntegrationType.TERSE]: NoInstallationOptions;
159
- [IntegrationType.POSTHOG]: NoInstallationOptions;
160
- [IntegrationType.DATADOG]: NoInstallationOptions;
161
- [IntegrationType.CRON_JOB]: NoInstallationOptions;
162
- [IntegrationType.LAUNCHDARKLY]: NoInstallationOptions;
163
- [IntegrationType.WORKOS]: NoInstallationOptions;
164
- [IntegrationType.ATTIO]: NoInstallationOptions;
165
- [IntegrationType.SNOWFLAKE]: NoInstallationOptions;
166
- [IntegrationType.WEBHOOK]: NoInstallationOptions;
167
- [IntegrationType.WEBMONITOR]: NoInstallationOptions;
168
- [IntegrationType.HEY_REACH]: NoInstallationOptions;
169
- }>;
170
- export type InstallationOptionsFor<T extends IntegrationType> = IntegrationInstallationOptions[T];
153
+ export declare const InstallationOptionsSchemas: {
154
+ readonly slack: z.ZodObject<{
155
+ isBotUser: z.ZodBoolean;
156
+ }, z.core.$strict>;
157
+ readonly gmail: z.ZodObject<{}, z.core.$strict>;
158
+ readonly notion: z.ZodObject<{}, z.core.$strict>;
159
+ readonly linear: z.ZodObject<{}, z.core.$strict>;
160
+ readonly github: z.ZodObject<{}, z.core.$strict>;
161
+ readonly terse: z.ZodObject<{}, z.core.$strict>;
162
+ readonly posthog: z.ZodObject<{}, z.core.$strict>;
163
+ readonly datadog: z.ZodObject<{}, z.core.$strict>;
164
+ readonly cron_job: z.ZodObject<{}, z.core.$strict>;
165
+ readonly launchdarkly: z.ZodObject<{}, z.core.$strict>;
166
+ readonly workos: z.ZodObject<{}, z.core.$strict>;
167
+ readonly attio: z.ZodObject<{}, z.core.$strict>;
168
+ readonly snowflake: z.ZodObject<{}, z.core.$strict>;
169
+ readonly webhook: z.ZodObject<{}, z.core.$strict>;
170
+ readonly webmonitor: z.ZodObject<{}, z.core.$strict>;
171
+ readonly hey_reach: z.ZodObject<{}, z.core.$strict>;
172
+ };
173
+ export type InstallationOptionsFor<T extends IntegrationType> = z.infer<(typeof InstallationOptionsSchemas)[T]>;
171
174
  export declare const SlackIntegrationSchema: z.ZodObject<{
172
175
  id: z.ZodString;
173
176
  teamId: z.ZodOptional<z.ZodString>;
@@ -265,4 +268,3 @@ export declare const IntegrationWithStatusSchema: z.ZodObject<{
265
268
  }, z.core.$strip>], "status">;
266
269
  }, z.core.$strip>;
267
270
  export type IntegrationWithStatus = z.infer<typeof IntegrationWithStatusSchema>;
268
- export {};
@@ -155,6 +155,32 @@ export const INTEGRATION_METADATA = {
155
155
  export const IntegrationInstanceSchema = z.object({
156
156
  id: z.string()
157
157
  });
158
+ export const NoInstallationOptionsSchema = z.object({}).strict();
159
+ export const SlackInstallationOptionsSchema = z
160
+ .object({
161
+ isBotUser: z.boolean()
162
+ })
163
+ .strict();
164
+ // Exhaustive schema map keyed by IntegrationType — adding a new IntegrationType without
165
+ // adding an entry here is a compile error.
166
+ export const InstallationOptionsSchemas = {
167
+ [IntegrationType.SLACK]: SlackInstallationOptionsSchema,
168
+ [IntegrationType.GMAIL]: NoInstallationOptionsSchema,
169
+ [IntegrationType.NOTION]: NoInstallationOptionsSchema,
170
+ [IntegrationType.LINEAR]: NoInstallationOptionsSchema,
171
+ [IntegrationType.GITHUB]: NoInstallationOptionsSchema,
172
+ [IntegrationType.TERSE]: NoInstallationOptionsSchema,
173
+ [IntegrationType.POSTHOG]: NoInstallationOptionsSchema,
174
+ [IntegrationType.DATADOG]: NoInstallationOptionsSchema,
175
+ [IntegrationType.CRON_JOB]: NoInstallationOptionsSchema,
176
+ [IntegrationType.LAUNCHDARKLY]: NoInstallationOptionsSchema,
177
+ [IntegrationType.WORKOS]: NoInstallationOptionsSchema,
178
+ [IntegrationType.ATTIO]: NoInstallationOptionsSchema,
179
+ [IntegrationType.SNOWFLAKE]: NoInstallationOptionsSchema,
180
+ [IntegrationType.WEBHOOK]: NoInstallationOptionsSchema,
181
+ [IntegrationType.WEBMONITOR]: NoInstallationOptionsSchema,
182
+ [IntegrationType.HEY_REACH]: NoInstallationOptionsSchema
183
+ };
158
184
  export const SlackIntegrationSchema = IntegrationInstanceSchema.extend({
159
185
  teamId: z.string().optional(),
160
186
  teamName: z.string().optional(),
@@ -26,6 +26,7 @@ export declare const slackIntegrationsKey: () => readonly [string];
26
26
  export declare const workosIntegrationsKey: () => readonly [string];
27
27
  export declare const attioIntegrationsKey: () => readonly [string];
28
28
  export declare const snowflakeIntegrationsKey: () => readonly [string];
29
+ export declare const heyReachIntegrationsKey: () => readonly [string];
29
30
  export declare const attioObjectsKey: (integrationId: string | null | undefined) => readonly [string, string] | null;
30
31
  export declare const allRunHistoryKey: (params?: GetRunHistoryParams) => readonly [string, string] | readonly [string];
31
32
  export declare const runHistoryKey: (agentId: string, params?: GetRunHistoryParams) => readonly [string, string, string] | readonly [string, string];
@@ -46,12 +47,8 @@ export declare const agentImprovementsKey: (agentId: string | null) => readonly
46
47
  }] | null;
47
48
  export declare const orgLogoKey: (organizationId: string | null | undefined) => readonly [string, string] | null;
48
49
  export declare const userByIdKey: (userId: string | null | undefined) => readonly [string, string] | null;
49
- export declare const agentFilesKey: (agentId: string) => readonly [string, string];
50
- export declare const agentFileContentKey: (agentId: string, fileId: string) => readonly [string, string, string];
51
50
  export declare const projectDeploysKey: (projectId: string) => readonly [string, string];
52
51
  export declare const projectSecretsKey: (projectId: string) => readonly [string, string];
53
- export declare const projectSourceFilesKey: (projectId: string) => readonly [string, string];
54
- export declare const projectSourceFileContentKey: (projectId: string, fileId: string) => readonly [string, string, string];
55
52
  export declare const billingContextKey: (params?: Partial<BillingContextQuery>) => readonly [string, string, string, string];
56
53
  export declare const billingUsageBucketsKey: (params?: Partial<BillingUsageBucketsQuery>) => readonly [string, string, string, string];
57
54
  export declare const billingCatalogKey: () => readonly [string];