Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Chat has sounds. A short warm cue plays for a message in a conversation you have open but aren't looking at, a direct message, a mention of you and an agent finishing something for you, with a soft tick for sending that is off until you turn it on; never for your own messages, a muted conversation, a conversation you are looking at in a window that has the front, or while you have paused notifications, and never twice for one message or more than once in a second and a half. The cues are made by the browser itself in two sets, Soft and Bright, so nothing is downloaded; the Sounds and notifications section of your notification settings turns them on and off, picks the set and the volume, plays each one, and offers desktop notifications for when the window is behind; Do not disturb is the one pause everyone sees, set from the chat sidebar's bell, the settings, or your avatar menu, now with a two-hour choice, and the top bar's bell shows a dot while it's on. Your choices are kept with your account. The sound layer sits behind one small interface so the desktop app can play them natively later. The chat and notifications guides say the rules. | 1 | import type { SoundSettings, SoundSettingsChange } from "./sounds"; |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 2 | import type { AccessClient, BasePermission, RepoGrant } from "./access"; |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 3 | import type { Permissions, ScopeLevel, ScopeResource } from "./scopes"; |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 4 | import type { MemberPrivileges, OrgRole, PolicyHold } from "./members"; |
| Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API | 5 | import type { Acting, CreateRunCredentialInput, RunBinding } from "./audit"; |
| Deployments work end to end: fixes from the first live run | 6 | import type { RepoPath } from "./repos"; |
| 7 | import type { Result } from "./result"; | |
| Merge branch 'worktree-agent-ad7c6d88d93adc817' | 8 | import type { TeamCreation, TeamsClient } from "./teams"; |
| People and teams are front and centre: one directory of people and agents with presence, local time, titles, teams and what each owns; profiles with manager and reports and the agents they work with; an org chart with each team's agents beside the person who leads it; and teams of any mix, with a lead, a channel, a budget agents keep to and the agents on them. Every agent is told its teams each turn (who leads, who owns what, who's around and who to page), and the team page shows exactly what. Member management is Members and invites; the people and teams guide says how. | 9 | import type { PeopleClient } from "./people"; |
| Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca | 10 | import type { DeployKeysClient } from "./deploy-keys"; |
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 11 | import type { EmailConfirmed } from "./accounts"; |
| Deployments work end to end: fixes from the first live run | 12 | |
| 13 | export type User = { | |
| 14 | id: string; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 15 | /** Lowercased: what the person is found, linked and mentioned by. */ |
| Deployments work end to end: fixes from the first live run | 16 | username: string; |
| 17 | /** | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 18 | * The username as its owner wrote it (`Ana`), when that differs from |
| 19 | * `username`: what pages show (`shownUsername`). Set on the signed-in | |
| 20 | * person and on people looked up by name. | |
| 21 | */ | |
| 22 | display_username?: string; | |
| 23 | /** | |
| Deployments work end to end: fixes from the first live run | 24 | * `workspace` when a workspace is acting through one of its own access |
| Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily | 25 | * tokens: `id` is then the workspace's and `username` its slug. `system` |
| 26 | * is g1t itself doing platform work, such as a security update | |
| 27 | * (`username` `g1t`). Absent means `user`. | |
| Deployments work end to end: fixes from the first live run | 28 | */ |
| Git storage hardened, pages in tens of milliseconds, honest security alerts, and costs reconciled daily | 29 | kind?: "user" | "workspace" | "agent" | "system"; |
| Deployments work end to end: fixes from the first live run | 30 | /** |
| 31 | * Whether the account's email address is confirmed. Only set on users | |
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 32 | * resolved from credentials. An account that has not confirmed it can |
| 33 | * only confirm it: see `awaitsConfirmation`. | |
| Deployments work end to end: fixes from the first live run | 34 | */ |
| 35 | verified?: boolean; | |
| 36 | /** | |
| 37 | * The workspaces this user belongs to. Set on users resolved from | |
| 38 | * credentials, so any service can authorize from it. | |
| 39 | */ | |
| 40 | workspaces?: Membership[]; | |
| Workspace names and icons, and a component kit for every control | 41 | /** |
| 42 | * The person's uploaded avatar: the SHA-256 of its bytes, served at | |
| 43 | * `/avatars/<avatar>`. Only set on the signed-in person; absent means | |
| 44 | * the generated letter avatar. | |
| 45 | */ | |
| 46 | avatar?: string; | |
| Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API | 47 | /** |
| g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent | 48 | * Set on an agent resolved from its token: who it acts for ("g1t |
| Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API | 49 | * on behalf of syntaqx"), with which credential, and what it may do. |
| 50 | */ | |
| 51 | acting?: Acting; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 52 | /** |
| 53 | * The repositories this user has a role on directly, whether or not they | |
| 54 | * belong to its workspace. Set with `workspaces`; see `access.ts`. | |
| 55 | */ | |
| 56 | grants?: RepoGrant[]; | |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 57 | /** |
| 58 | * Set on a user resolved from an access token: its scopes (null for full | |
| 59 | * access) and the workspaces or repositories it reaches. See scopes.ts. | |
| 60 | */ | |
| 61 | token?: { | |
| 62 | token_id: string; | |
| 63 | scopes?: string[] | null; | |
| 64 | legacy?: boolean; | |
| Merge the AI Gateway: Anthropic's Messages API on a workspace's tokens | 65 | /** The token's name, as its owner gave it. */ |
| 66 | name?: string; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 67 | /** |
| 68 | * A token narrowed to one workspace (or none): its workspace and | |
| 69 | * repositories. The key is kept from before tokens were one kind. | |
| 70 | */ | |
| TS access mirrors the workspace token cap and fine-grained reach | 71 | fine_grained?: { |
| 72 | workspace?: string | null; | |
| 73 | repositories?: "all" | "selected" | "public"; | |
| 74 | repo_ids?: string[]; | |
| 75 | }; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 76 | /** A workspace's own token with Repositories: admin. */ |
| TS access mirrors the workspace token cap and fine-grained reach | 77 | admin?: boolean; |
| 78 | /** Set on what a deploy key resolves to. */ | |
| 79 | deploy_key?: string; | |
| 80 | /** The one repository a job's token or a deploy key reaches. */ | |
| 81 | repo?: string; | |
| Merge Actions: cross-repo workflows and actions, release and deployment triggers, step timeouts | 82 | /** Set on a workflow job's token (`G1T_TOKEN`): the run and job it was made for. */ |
| 83 | job?: { run_id: string; job_id: string; pull_requests?: boolean }; | |
| Merge main into Artifacts Phase 2 | 84 | /** |
| 85 | * A person's token whose owner let it use the website as them, sent as | |
| 86 | * `Authorization: Bearer` (apps/web, lib/website-token.ts). Not a scope. | |
| 87 | */ | |
| 88 | website?: boolean; | |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 89 | }; |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 90 | /** |
| 91 | * Workspaces the person belongs to but cannot use until they meet its | |
| 92 | * policy, such as turning on two-factor authentication. Left out of | |
| 93 | * `workspaces` and `grants` meanwhile. | |
| 94 | */ | |
| 95 | held?: PolicyHold[]; | |
| Deployments work end to end: fixes from the first live run | 96 | }; |
| 97 | ||
| 98 | /** What a member may do: an owner also manages the workspace's members. */ | |
| 99 | export type Role = "owner" | "member"; | |
| 100 | ||
| Workspace names and icons, and a component kit for every control | 101 | export type Membership = { |
| 102 | /** The workspace's name in URLs: `g1t.sh/<slug>`. */ | |
| 103 | slug: string; | |
| 104 | role: Role; | |
| 105 | /** Its display name. Set on users resolved from credentials. */ | |
| 106 | name?: string; | |
| 107 | /** Its uploaded icon, as `Workspace.avatar`. */ | |
| 108 | avatar?: string; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 109 | /** The workspace's base permission: what members get on every repository. Absent means `write`. */ |
| 110 | base_permission?: BasePermission; | |
| Merge branch 'worktree-agent-ad7c6d88d93adc817' | 111 | /** Who may create its teams. Absent means any member. */ |
| 112 | team_creation?: TeamCreation; | |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 113 | /** The roles held besides owner or member. */ |
| 114 | org_roles?: OrgRole[]; | |
| 115 | /** What the workspace lets its members do. Absent means the defaults. */ | |
| 116 | privileges?: MemberPrivileges; | |
| Chat and workspace agents: channels, DMs and named agents you talk to | 117 | /** |
| 118 | * Whether this member uses Code: repositories, issues, pull requests, | |
| 119 | * checks, deploys. False for people who only use Chat, Docs and agents | |
| 120 | * (support, sales, finance): they see no repository, whatever the base | |
| 121 | * permission, and agents treat them as unable to change code. Absent | |
| 122 | * means true. | |
| 123 | */ | |
| 124 | code_access?: boolean; | |
| Workspace names and icons, and a component kit for every control | 125 | }; |
| Deployments work end to end: fixes from the first live run | 126 | |
| Chat and workspace agents: channels, DMs and named agents you talk to | 127 | /** Whether a member uses Code. See `Membership.code_access`. */ |
| 128 | export function hasCodeAccess(membership: Pick<Membership, "code_access"> | null | undefined): boolean { | |
| 129 | return membership?.code_access !== false; | |
| 130 | } | |
| 131 | ||
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 132 | /** How long an old workspace slug redirects, and stays reserved for it, after a rename. */ |
| 133 | export const SLUG_HOLD_DAYS = 90; | |
| 134 | ||
| 135 | /** How long a workspace must wait between renames. */ | |
| 136 | export const RENAME_COOLDOWN_HOURS = 24; | |
| 137 | ||
| Workspace names and icons, and a component kit for every control | 138 | /** The largest avatar that can be uploaded, in bytes. */ |
| 139 | export const MAX_AVATAR_BYTES = 1024 * 1024; | |
| 140 | ||
| Deployments work end to end: fixes from the first live run | 141 | /** |
| Merge branch 'worktree-agent-a2013627e5ea4ab13' | 142 | * Where a workspace keeps its repositories' git data: anywhere g1t stores |
| 143 | * it (the default), or in the EU only. It applies to repositories made | |
| 144 | * after it is set. | |
| 145 | */ | |
| 146 | export type DataResidency = "anywhere" | "eu"; | |
| 147 | ||
| 148 | /** | |
| Deployments work end to end: fixes from the first live run | 149 | * A workspace: the owner of repositories, and the first segment of their |
| 150 | * URLs. A person's own space and a team's are the same thing. | |
| 151 | */ | |
| 152 | export type Workspace = { | |
| 153 | id: string; | |
| 154 | slug: string; | |
| 155 | name: string; | |
| 156 | /** One line saying what the workspace is for. */ | |
| 157 | description: string | null; | |
| 158 | /** RFC 3339. */ | |
| 159 | createdAt: string; | |
| 160 | memberCount: number; | |
| Workspace names and icons, and a component kit for every control | 161 | /** |
| 162 | * The workspace's uploaded icon: the SHA-256 of its bytes, served at | |
| 163 | * `/avatars/<avatar>`. Null means the generated letter avatar. | |
| 164 | */ | |
| 165 | avatar: string | null; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 166 | /** What every member gets on each repository; owners have Admin. */ |
| 167 | basePermission?: BasePermission; | |
| Merge branch 'worktree-agent-ad7c6d88d93adc817' | 168 | /** Who may create its teams. Absent means any member. */ |
| 169 | teamCreation?: TeamCreation; | |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 170 | /** Whether members and outside collaborators need two-factor authentication. */ |
| 171 | twoFactorRequirementEnabled?: boolean; | |
| 172 | } & Partial<MemberPrivileges>; | |
| Deployments work end to end: fixes from the first live run | 173 | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 174 | export type Member = { |
| 175 | username: string; | |
| Cards you act on in chat; agents comment and review as themselves; names shown cleanly; commits on the calendar | 176 | /** The username as its owner wrote it (`Ana`), when that differs from `username`. */ |
| 177 | display_username?: string; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 178 | role: Role; |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 179 | /** The roles they hold besides `role`. */ |
| 180 | org_roles?: OrgRole[]; | |
| 181 | /** Whether two-factor authentication is on; owners only, null for anyone else. */ | |
| 182 | two_factor?: boolean | null; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 183 | /** Their display name, when they set one. */ |
| 184 | name?: string | null; | |
| 185 | /** Their uploaded avatar's hash, served at `/avatars/<avatar>`; null for the generated letter avatar. */ | |
| 186 | avatar?: string | null; | |
| 187 | }; | |
| Deployments work end to end: fixes from the first live run | 188 | |
| Billing on Stripe's pages, month-end charges, warnings; sudo by workspace | 189 | /** An owner of a workspace, as staff see them. */ |
| 190 | export type AdminOwner = { username: string; email: string | null }; | |
| 191 | ||
| 192 | /** A workspace as staff see it. Mirrors `AdminWorkspace` in `crates/contracts/src/identity.rs`. */ | |
| 193 | export type AdminWorkspace = { | |
| 194 | slug: string; | |
| 195 | name: string; | |
| 196 | /** RFC 3339. */ | |
| 197 | createdAt: string; | |
| 198 | owners: AdminOwner[]; | |
| 199 | memberCount: number; | |
| 200 | }; | |
| 201 | ||
| 202 | /** A member of a workspace, as staff see them. */ | |
| 203 | export type AdminMember = { username: string; email: string | null; role: Role; /** RFC 3339. */ joined: string }; | |
| 204 | ||
| 205 | export type AdminWorkspaceDetail = { | |
| 206 | slug: string; | |
| 207 | name: string; | |
| 208 | description: string | null; | |
| 209 | /** RFC 3339. */ | |
| 210 | createdAt: string; | |
| 211 | /** Owners first, then by username. */ | |
| 212 | members: AdminMember[]; | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 213 | /** It can never be deleted, by anyone (identity's `PROTECTED_WORKSPACES`). */ |
| 214 | protected: boolean; | |
| Billing on Stripe's pages, month-end charges, warnings; sudo by workspace | 215 | }; |
| 216 | ||
| 217 | /** The most workspaces one `workspaces` call returns. */ | |
| 218 | export const ADMIN_WORKSPACES_LIMIT = 500; | |
| 219 | ||
| 220 | /** | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 221 | * Whether anyone may make an account, or only someone with an invite. |
| 222 | * Identity's `REGISTRATION_MODE`; unset means `invite`. | |
| 223 | */ | |
| 224 | export type RegistrationMode = "invite" | "open"; | |
| 225 | ||
| 226 | /** How many invites a person may have out at once, unless identity's `INVITES_PER_USER` says otherwise. */ | |
| 227 | export const INVITES_PER_USER = 5; | |
| 228 | /** How long an invite works, unless identity's `INVITE_TTL_DAYS` says otherwise. */ | |
| 229 | export const INVITE_TTL_DAYS = 30; | |
| 230 | ||
| 231 | /** Only a pending invite can be used or revoked. Revoked and expired ones never used give the invite back. */ | |
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 232 | /** |
| 233 | * `awaiting_confirmation`: used to make an account that has not confirmed its | |
| 234 | * email address yet; what it gives is joined when the address is confirmed, | |
| 235 | * unless it is revoked first. | |
| 236 | */ | |
| Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040) | 237 | /** |
| 238 | * `awaiting_answer`: the account it made is confirmed, and the workspace it | |
| 239 | * names waits for the person to accept or decline. `declined`: they said no. | |
| 240 | */ | |
| 241 | export type InviteStatus = | |
| 242 | | "pending" | |
| 243 | | "awaiting_confirmation" | |
| 244 | | "awaiting_answer" | |
| 245 | | "redeemed" | |
| 246 | | "declined" | |
| 247 | | "expired" | |
| 248 | | "revoked"; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 249 | |
| 250 | /** One invite. Mirrors `Invite` in `crates/contracts/src/identity.rs`. */ | |
| 251 | export type Invite = { | |
| 252 | id: string; | |
| 253 | /** `g1t-k7m2-…`: returned when it is made, and to its maker while pending. */ | |
| 254 | code: string | null; | |
| 255 | /** The code's first group, such as `g1t-k7m2`. */ | |
| 256 | hint: string; | |
| 257 | /** Only this address can use it. */ | |
| 258 | email: string | null; | |
| 259 | /** `account` makes an account; `workspace` joins an existing one to `workspace`. */ | |
| 260 | kind: "account" | "workspace"; | |
| 261 | /** The workspace using it joins. */ | |
| 262 | workspace: string | null; | |
| 263 | status: InviteStatus; | |
| 264 | /** Whose allowance it used. */ | |
| 265 | chargedTo: "user" | "workspace" | "none"; | |
| 266 | /** Its maker's username; null when g1t staff made it. */ | |
| 267 | invitedBy: string | null; | |
| 268 | /** The account that used it. */ | |
| 269 | redeemedBy: string | null; | |
| 270 | /** RFC 3339. */ | |
| 271 | createdAt: string; | |
| 272 | /** RFC 3339. */ | |
| 273 | expiresAt: string; | |
| 274 | redeemedAt: string | null; | |
| 275 | revokedAt: string | null; | |
| Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040) | 276 | /** The account a workspace invitation is for, by username: someone invited by username, or the account the invite made. */ |
| 277 | invitee?: string | null; | |
| 278 | /** The role `workspace` is joined with; null when it names none. */ | |
| 279 | role?: Role | null; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 280 | /** The staff member who minted it; only in staff views. */ |
| 281 | staff?: string | null; | |
| 282 | }; | |
| 283 | ||
| Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040) | 284 | /** |
| 285 | * A workspace invitation waiting for its person's answer, as they see it. | |
| 286 | * Mirrors `WorkspaceInvitation` in `crates/contracts/src/identity.rs`. | |
| 287 | */ | |
| 288 | export type WorkspaceInvitation = { | |
| 289 | id: string; | |
| 290 | workspace: ProfileWorkspace; | |
| 291 | /** The role accepting joins with. */ | |
| 292 | role: Role; | |
| 293 | /** Null when g1t staff sent it. */ | |
| 294 | invitedBy: { username: string; name: string | null; avatar: string | null } | null; | |
| 295 | createdAt: string; | |
| 296 | expiresAt: string; | |
| 297 | }; | |
| 298 | ||
| 299 | /** Someone to invite, as `findPeople` finds them: never an email address. */ | |
| 300 | export type PersonMatch = { username: string; name: string | null; avatar: string | null }; | |
| 301 | ||
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 302 | /** How many invites someone may have out. `limit` and `remaining` are null for no limit. */ |
| 303 | export type Allowance = { limit: number | null; used: number; remaining: number | null }; | |
| 304 | ||
| 305 | export type InvitesOverview = { | |
| 306 | mode: RegistrationMode; | |
| 307 | allowance: Allowance; | |
| 308 | /** Workspaces the person owns that were granted invites to share. */ | |
| 309 | workspaces: { slug: string; allowance: Allowance }[]; | |
| 310 | invites: Invite[]; | |
| 311 | }; | |
| 312 | ||
| 313 | /** What a valid code is for, before it is used. */ | |
| 314 | export type InvitePreview = { | |
| 315 | kind: "account" | "workspace"; | |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 316 | /** Pending, unless `anyStatus` asked about a code that is spent. */ |
| 317 | status: InviteStatus; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 318 | /** Null when g1t staff sent it. */ |
| 319 | invitedBy: { username: string; name: string | null; avatar: string | null } | null; | |
| 320 | workspace: ProfileWorkspace | null; | |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 321 | /** The repository it accepts an invitation to, such as `{ name: "flagon-io/g1t", role: "write" }`. */ |
| 322 | repository: { name: string; role: string } | null; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 323 | /** Partly hidden, such as `a•••@example.com`. */ |
| 324 | email: string | null; | |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 325 | /** The bound address in full, while the invite is pending: it fills in and locks the sign-up form. */ |
| 326 | address: string | null; | |
| 327 | /** Whether the bound address has a g1t account already: sign in to accept. */ | |
| 328 | hasAccount: boolean; | |
| 329 | /** With a viewer: whether it is theirs (for one of their confirmed addresses, or used by them). */ | |
| 330 | forViewer: boolean | null; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 331 | expiresAt: string; |
| Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038) | 332 | /** A shared invite link's group, such as `Cloudflare judges`; null for a one-person invite. Not secret. */ |
| 333 | sharedLabel: string | null; | |
| 334 | /** The email domains a shared invite link is limited to; empty for any address. */ | |
| 335 | sharedDomains: string[]; | |
| Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm | 336 | /** |
| 337 | * Whether the page was opened from this pending invite's own email (its | |
| 338 | * `proof` checked out): the account made with it starts with `address` | |
| 339 | * confirmed. False without a proof, with a wrong one, or for an invite | |
| 340 | * bound to no address. | |
| 341 | */ | |
| 342 | emailProven: boolean; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 343 | }; |
| 344 | ||
| 345 | export type WaitlistStatus = "waiting" | "invited" | "dismissed"; | |
| 346 | ||
| 347 | export type WaitlistEntry = { | |
| 348 | id: string; | |
| 349 | email: string; | |
| 350 | about: string | null; | |
| 351 | status: WaitlistStatus; | |
| 352 | inviteId: string | null; | |
| 353 | decidedBy: string | null; | |
| 354 | decidedAt: string | null; | |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 355 | /** What staff wrote when approving; it went in the invite email. */ |
| 356 | note: string | null; | |
| 357 | /** The account made with the invite, once it was used. */ | |
| 358 | joinedAs: string | null; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 359 | /** When they first asked. */ |
| 360 | createdAt: string; | |
| 361 | /** When they last asked. */ | |
| 362 | updatedAt: string; | |
| 363 | }; | |
| 364 | ||
| 365 | export type InviteGrant = { amount: number; note: string | null; grantedBy: string; createdAt: string }; | |
| 366 | export type InviteTreeNode = { username: string; joinedAt: string; invited: InviteTreeNode[] }; | |
| 367 | ||
| 368 | /** Where a person came from and whom they brought. For a workspace, `username` is its slug. */ | |
| 369 | export type InviteTree = { | |
| 370 | username: string; | |
| 371 | /** Who invited them, then who invited that person, and so on. */ | |
| 372 | invitedBy: string[]; | |
| 373 | /** The staff member who minted their invite, when staff did. */ | |
| 374 | staff: string | null; | |
| 375 | allowance: Allowance; | |
| 376 | grants: InviteGrant[]; | |
| 377 | invites: Invite[]; | |
| 378 | /** Whom they invited, three levels down. */ | |
| 379 | invited: InviteTreeNode[]; | |
| Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038) | 380 | /** The shared invite link the account was made with, if it was. */ |
| 381 | shared: SharedInviteSource | null; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 382 | }; |
| 383 | ||
| Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038) | 384 | // --- Shared invite links, staff only --------------------------------------------------- |
| 385 | // | |
| 386 | // One link for a group (a conference's judges, a post, a community): up to | |
| 387 | // `maxUses` new accounts, until it expires or staff revoke it, optionally only | |
| 388 | // for addresses at some domains. Each use makes a new account, which makes its | |
| 389 | // own workspace; it never joins an existing one and uses nobody's allowance. | |
| 390 | // The link is `https://g1t.sh/register?invite=<code>`. Mirrors the shared | |
| 391 | // invite types in `crates/contracts/src/identity.rs`. | |
| 392 | ||
| 393 | /** How long a shared invite link works when staff give no date. */ | |
| 394 | export const SHARED_INVITE_TTL_DAYS = 14; | |
| 395 | /** The furthest ahead a shared invite link's last day may be set. */ | |
| 396 | export const SHARED_INVITE_MAX_DAYS = 365; | |
| 397 | /** The most accounts one shared invite link makes. */ | |
| 398 | export const MAX_SHARED_INVITE_USES = 1000; | |
| 399 | /** The most characters a shared invite link's label keeps. */ | |
| 400 | export const MAX_SHARED_INVITE_LABEL = 80; | |
| 401 | /** The most email domains one shared invite link may be limited to. */ | |
| 402 | export const MAX_SHARED_INVITE_DOMAINS = 10; | |
| 403 | ||
| 404 | /** Only a live link makes accounts; `used_up`: every use is taken. */ | |
| 405 | export type SharedInviteStatus = "live" | "used_up" | "expired" | "revoked"; | |
| 406 | ||
| 407 | /** The shared invite link an account was made with. */ | |
| 408 | export type SharedInviteSource = { id: string; label: string }; | |
| 409 | ||
| 410 | /** One shared invite link, as staff see it. */ | |
| 411 | export type SharedInvite = { | |
| 412 | /** `sinv_…`. */ | |
| 413 | id: string; | |
| 414 | /** Whom it is for, such as `Cloudflare judges`. */ | |
| 415 | label: string; | |
| 416 | /** The code, while it is live. */ | |
| 417 | code: string | null; | |
| 418 | /** The code's first group, such as `g1t-k7m2`. */ | |
| 419 | hint: string; | |
| 420 | maxUses: number; | |
| 421 | /** Accounts made with it so far. */ | |
| 422 | uses: number; | |
| 423 | /** Only addresses at these domains may use it; empty for any. */ | |
| 424 | domains: string[]; | |
| 425 | status: SharedInviteStatus; | |
| 426 | /** The staff member who made it, by email. */ | |
| 427 | staff: string; | |
| 428 | createdAt: string; | |
| 429 | expiresAt: string; | |
| 430 | revokedAt: string | null; | |
| 431 | revokedBy: string | null; | |
| 432 | /** The accounts made with it, oldest first; `username` is null once one is purged. */ | |
| 433 | accounts: { username: string | null; joinedAt: string }[]; | |
| 434 | }; | |
| 435 | ||
| 436 | /** What staff make a shared invite link from. */ | |
| 437 | export type NewSharedInvite = { | |
| 438 | label: string; | |
| 439 | /** 1 to 1000. */ | |
| 440 | maxUses: number; | |
| 441 | /** The last day it works, `YYYY-MM-DD` (UTC); null for 14 days from now. */ | |
| 442 | expiresOn: string | null; | |
| 443 | /** Email domains it is limited to, such as `cloudflare.com`; empty for any address. */ | |
| 444 | domains: string[]; | |
| 445 | }; | |
| 446 | ||
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 447 | /** The most rows one staff listing of invites or the waitlist returns. */ |
| 448 | export const ADMIN_INVITES_LIMIT = 500; | |
| 449 | ||
| 450 | /** | |
| Billing on Stripe's pages, month-end charges, warnings; sudo by workspace | 451 | * Staff-only identity, for sudo.g1t.sh. It takes no viewer and checks no |
| 452 | * membership: only sudo calls it, over its service binding, once Cloudflare | |
| 453 | * Access and its staff list have let someone in. Never call it on behalf of | |
| 454 | * a customer. | |
| 455 | */ | |
| 456 | export interface IdentityAdminApi { | |
| 457 | /** Every workspace, newest first, at most 500; `query` matches slug, name, or an owner's username or email. */ | |
| 458 | workspaces(query?: string): Promise<AdminWorkspace[]>; | |
| 459 | /** One workspace with all its members, or null. */ | |
| 460 | workspace(slug: string): Promise<AdminWorkspaceDetail | null>; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 461 | |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 462 | /** The waitlist, newest first; `query` matches the address or what they said. */ |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 463 | waitlist(query?: string | null, status?: WaitlistStatus | null): Promise<WaitlistEntry[]>; |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 464 | /** How many requests are waiting, for the navigation's badge. */ |
| 465 | waitlistPending(): Promise<number>; | |
| 466 | /** | |
| 467 | * Approving mints an invite bound to the address and emails it, with | |
| 468 | * `note` (up to 500 characters) if given; dismissing only marks it. | |
| 469 | */ | |
| 470 | decideWaitlist(id: string, approve: boolean, staff: string, note?: string | null): Promise<Result<WaitlistEntry>>; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 471 | /** Invites, newest first; `query` is a code's start, or part of an email, inviter or redeemer. */ |
| 472 | invites(query?: string | null): Promise<Invite[]>; | |
| 473 | revokeInvite(id: string, staff: string): Promise<Result<Invite>>; | |
| 474 | /** An invite that uses nobody's allowance, optionally bound to (and emailed to) `email`. */ | |
| 475 | mintInvite(email: string | null, staff: string): Promise<Result<Invite>>; | |
| 476 | /** More invites (or fewer, with a negative amount) for a person or a workspace. */ | |
| 477 | grantInvites( | |
| 478 | target: "user" | "workspace", | |
| 479 | name: string, | |
| 480 | amount: number, | |
| 481 | note: string, | |
| 482 | staff: string, | |
| 483 | ): Promise<Result<Allowance>>; | |
| 484 | /** Where a person came from and whom they brought, or null. */ | |
| 485 | inviteTree(username: string): Promise<InviteTree | null>; | |
| 486 | /** A workspace's granted invites and the invites made for it, or null. */ | |
| 487 | workspaceInvites(slug: string): Promise<InviteTree | null>; | |
| Merge shared invite links: label, uses, expiry, domains; joined through recorded (identity 0038) | 488 | /** Shared invite links, newest first, each with the accounts it made. */ |
| 489 | sharedInvites(): Promise<SharedInvite[]>; | |
| 490 | /** Makes a shared invite link; the result carries its code. Recorded in the audit log. */ | |
| 491 | createSharedInvite(link: NewSharedInvite, staff: string): Promise<Result<SharedInvite>>; | |
| 492 | /** Stops a shared invite link making more accounts; those it made stay. Recorded in the audit log. */ | |
| 493 | revokeSharedInvite(id: string, staff: string): Promise<Result<SharedInvite>>; | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 494 | |
| 495 | /** Workspaces owners deleted that are not purged yet, newest first. */ | |
| 496 | deletedWorkspaces(): Promise<DeletedWorkspace[]>; | |
| 497 | /** | |
| 498 | * Brings a deleted workspace back, with its members, tokens and what went | |
| 499 | * with it, while it is still restorable. Publishes `workspace.restored`. | |
| 500 | */ | |
| 501 | restoreWorkspace(workspaceId: string, staff: string): Promise<Result<boolean>>; | |
| 502 | /** | |
| 503 | * Purges a deleted workspace now rather than at `purgeAfter`. `confirm` is | |
| 504 | * its slug, typed out. Refused for a protected workspace. Publishes | |
| 505 | * `workspace.deleted`. | |
| 506 | */ | |
| 507 | purgeWorkspace(workspaceId: string, staff: string, confirm: string): Promise<Result<boolean>>; | |
| Merge branch 'worktree-agent-a8385d293d42c913a' | 508 | |
| 509 | /** Every workspace alias, by name. */ | |
| 510 | aliases(): Promise<WorkspaceAlias[]>; | |
| 511 | /** | |
| 512 | * Points `alias` at the workspace whose slug is `workspace`. Refused for | |
| 513 | * one of the site's routes, anyone's username, a workspace's slug (deleted | |
| 514 | * or held after a rename) and an existing alias. `note` says why. | |
| 515 | */ | |
| 516 | setAlias(alias: string, workspace: string, note: string, staff: string): Promise<Result<WorkspaceAlias>>; | |
| 517 | /** Removes an alias; `reason` goes in sudo's audit log. */ | |
| 518 | removeAlias(alias: string, reason: string, staff: string): Promise<Result<boolean>>; | |
| Billing on Stripe's pages, month-end charges, warnings; sudo by workspace | 519 | } |
| 520 | ||
| Merge branch 'worktree-agent-a8385d293d42c913a' | 521 | /** |
| 522 | * A name g1t's staff point at a workspace, so its addresses lead there under | |
| 523 | * the workspace's own name: `g1t`, the product, leads to `flagon-io`, Flagon, | |
| 524 | * Inc. Staff-managed only; it follows the workspace through renames. | |
| 525 | */ | |
| 526 | export type WorkspaceAlias = { | |
| 527 | alias: string; | |
| 528 | workspaceId: string; | |
| 529 | /** The workspace's slug and name now. */ | |
| 530 | workspace: string; | |
| 531 | workspaceName: string; | |
| 532 | /** Why it exists. */ | |
| 533 | note: string; | |
| 534 | /** The staff member who set it, or `migration`. */ | |
| 535 | createdBy: string; | |
| 536 | /** RFC 3339. */ | |
| 537 | createdAt: string; | |
| 538 | }; | |
| 539 | ||
| Deployments work end to end: fixes from the first live run | 540 | /** Who is asking. Every read and write in every service takes one. */ |
| 541 | export type Viewer = User | null; | |
| 542 | ||
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 543 | /** |
| 544 | * Whether this is a person whose account has not confirmed its email | |
| 545 | * address. Such an account can only confirm it, change it, or sign out. | |
| 546 | */ | |
| 547 | export function awaitsConfirmation(user: Pick<User, "kind" | "verified"> | null | undefined): boolean { | |
| 548 | return !!user && (user.kind ?? "user") === "user" && !user.verified; | |
| 549 | } | |
| 550 | ||
| Deployments work end to end: fixes from the first live run | 551 | export type SshKey = { |
| 552 | id: string; | |
| 553 | title: string; | |
| 554 | fingerprint: string; | |
| 555 | /** RFC 3339. */ | |
| 556 | createdAt: string; | |
| Merge branch 'worktree-agent-a5a5de74d8863d554' into worktree-agent-a16631325aecf58ca | 557 | /** When it last signed in over SSH, RFC 3339, to within 5 minutes; null when it never has. */ |
| 558 | lastUsedAt: string | null; | |
| Deployments work end to end: fixes from the first live run | 559 | }; |
| 560 | ||
| 561 | export type AccessToken = { | |
| 562 | id: string; | |
| 563 | name: string; | |
| 564 | /** RFC 3339. */ | |
| 565 | createdAt: string; | |
| 566 | /** RFC 3339, to within a few minutes. Null until it is first used. */ | |
| 567 | lastUsedAt: string | null; | |
| 568 | /** | |
| 569 | * For a workspace's token, the username of the member who made it. Null | |
| 570 | * once that account is gone, and on personal tokens. | |
| 571 | */ | |
| 572 | createdBy: string | null; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 573 | /** Its scopes, as `resource:level`, the highest of each resource. Null: full access. */ |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 574 | scopes: string[] | null; |
| 575 | /** Made before tokens had scopes: full access until someone narrows it. */ | |
| 576 | legacy: boolean; | |
| 577 | /** RFC 3339. Null: it does not expire. */ | |
| 578 | expiresAt: string | null; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 579 | /** Its scopes as permissions: each resource it may use, at the highest level. */ |
| 580 | permissions?: Permissions; | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 581 | /** What it is for, as its owner wrote it. */ |
| 582 | description?: string | null; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 583 | /** |
| 584 | * A personal token's reach: the workspace it is made for; null for every | |
| 585 | * workspace you belong to (or, with `repositorySelection` public, none). | |
| 586 | * Null on a workspace's own token, which reaches its workspace. | |
| 587 | */ | |
| 588 | workspace?: string | null; | |
| 589 | /** Which repositories of that workspace it reaches. */ | |
| 590 | repositorySelection?: RepositorySelection; | |
| 591 | /** With `selected`: the repositories, as `owner/name`, that you can see. */ | |
| 592 | repositories?: string[]; | |
| 593 | /** Whether a token made for a workspace that approves tokens may be used there yet. */ | |
| 594 | status?: TokenStatus; | |
| 595 | /** Why an owner denied or revoked it. */ | |
| 596 | reviewReason?: string | null; | |
| 597 | /** A workspace's own token, acting as the workspace. */ | |
| 598 | workspaceOwned?: boolean; | |
| 599 | /** A workspace's own token with Repositories: admin, an admin of its repositories. */ | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 600 | admin?: boolean; |
| Merge main into Artifacts Phase 2 | 601 | /** A personal token its owner let use the website as them. */ |
| 602 | website?: boolean; | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 603 | }; |
| 604 | ||
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 605 | /** Which repositories a token reaches in its workspace: all, the selected ones, or public ones only. */ |
| 606 | export type RepositorySelection = "all" | "selected" | "public"; | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 607 | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 608 | /** Whether a token made for a workspace may be used there yet. */ |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 609 | export type TokenStatus = "active" | "pending" | "denied" | "revoked"; |
| 610 | ||
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 611 | /** A new access token: a person's, or (with `owner`) a workspace's. */ |
| 612 | export type TokenInput = { | |
| 613 | /** A workspace's slug to make that workspace's token; null for your own. */ | |
| 614 | owner?: string | null; | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 615 | name: string; |
| 616 | description?: string | null; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 617 | /** 1 to 366 days; null for no expiry, where the workspaces it reaches allow that. */ |
| 618 | ttlSeconds: number | null; | |
| 619 | /** | |
| 620 | * A personal token's reach: a workspace's slug, or null for every | |
| 621 | * workspace you belong to (with `repositorySelection` public: none). | |
| 622 | */ | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 623 | workspace: string | null; |
| 624 | repositorySelection: RepositorySelection; | |
| 625 | /** With `selected`: `owner/name` or names in the workspace. */ | |
| 626 | repositories: string[]; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 627 | /** Each resource's level; left out is no access. */ |
| 628 | permissions: Partial<Record<ScopeResource, ScopeLevel>>; | |
| Merge main into Artifacts Phase 2 | 629 | /** A personal token: whether it may use the website as you. Off unless set. */ |
| 630 | website?: boolean; | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 631 | }; |
| 632 | ||
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 633 | /** A change to a token; what is left out stays. */ |
| Merge main into Artifacts Phase 2 | 634 | export type TokenChange = Partial<Pick<TokenInput, "name" | "description" | "repositorySelection" | "repositories" | "permissions" | "website">>; |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 635 | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 636 | /** A workspace's rules for personal access tokens. */ |
| 637 | export type TokenPolicy = { | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 638 | /** A token made for every workspace of its owner reaches this one. */ |
| 639 | allowTokensForAllWorkspaces: boolean; | |
| 640 | /** A token may be made for this workspace alone. */ | |
| 641 | allowTokensForThisWorkspace: boolean; | |
| 642 | /** A token made for this workspace waits for an owner's approval. */ | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 643 | requireApproval: boolean; |
| 644 | /** Null: no limit. */ | |
| 645 | maxLifetimeDays: number | null; | |
| 646 | forbidNoExpiry: boolean; | |
| 647 | updatedBy?: string | null; | |
| 648 | updatedAt?: string | null; | |
| 649 | }; | |
| 650 | ||
| 651 | /** A member's personal token that reaches a workspace, as its owners see it. */ | |
| 652 | export type MemberToken = { | |
| 653 | owner: string; | |
| 654 | token: AccessToken; | |
| 655 | /** Whether it reaches the workspace now. */ | |
| 656 | reaches: boolean; | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 657 | /** Why not: pending approval, denied, revoked, tokens for all workspaces not allowed, tokens made for this workspace not allowed, lasts too long, never expires. */ |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 658 | blockedBy?: string | null; |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 659 | }; |
| 660 | ||
| 661 | /** What a new or changed token may do. */ | |
| 662 | export type TokenGrant = { | |
| 663 | /** Null: full access. */ | |
| 664 | scopes: string[] | null; | |
| Deployments work end to end: fixes from the first live run | 665 | }; |
| 666 | ||
| 667 | export type DeviceStart = { | |
| 668 | /** Secret held by the tool and exchanged for a token once approved. */ | |
| 669 | deviceCode: string; | |
| 670 | /** Short code shown to the person, e.g. `WDJB-MJHT`. */ | |
| 671 | userCode: string; | |
| 672 | /** Seconds until both codes stop working. */ | |
| 673 | expiresIn: number; | |
| 674 | /** Seconds the tool should wait between polls. */ | |
| 675 | interval: number; | |
| 676 | }; | |
| 677 | ||
| 678 | export type DeviceRequest = { userCode: string; clientName: string }; | |
| 679 | ||
| 680 | export type DeviceClaim = | |
| 681 | | { status: "pending" | "denied" | "expired" } | |
| 682 | | { status: "approved"; token: string; user: User }; | |
| 683 | ||
| 684 | /** What the site passes on once a person has approved an application. */ | |
| 685 | export type OAuthApproval = { | |
| 686 | clientId: string; | |
| 687 | /** Shown wherever the application's access is listed. */ | |
| 688 | clientName: string; | |
| 689 | redirectUri: string; | |
| 690 | /** PKCE challenge, method S256. */ | |
| 691 | codeChallenge: string; | |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 692 | /** What the person granted. Null: full access. */ |
| 693 | scopes: string[] | null; | |
| Deployments work end to end: fixes from the first live run | 694 | }; |
| 695 | ||
| 696 | export type OAuthTokens = { | |
| 697 | accessToken: string; | |
| 698 | /** Works once; using it returns the next one. */ | |
| 699 | refreshToken: string; | |
| 700 | /** Seconds until the access token stops working. */ | |
| 701 | expiresIn: number; | |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 702 | /** The scopes granted, space-separated, or `*` for full access. */ |
| 703 | scope?: string | null; | |
| Deployments work end to end: fixes from the first live run | 704 | }; |
| 705 | ||
| 706 | /** An application a person has signed in to. */ | |
| 707 | export type OAuthGrant = { | |
| 708 | id: string; | |
| 709 | clientName: string; | |
| 710 | /** RFC 3339. */ | |
| 711 | createdAt: string; | |
| 712 | /** RFC 3339. */ | |
| 713 | lastUsedAt: string; | |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 714 | /** What the person granted. Null: full access. */ |
| 715 | scopes: string[] | null; | |
| 716 | /** Signed in before applications had scopes: full access until narrowed. */ | |
| 717 | legacy: boolean; | |
| Deployments work end to end: fixes from the first live run | 718 | }; |
| 719 | ||
| 720 | /** Accounts, credentials and sessions. */ | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 721 | /** |
| 722 | * What deleting a workspace takes with it, and what stands in the way: | |
| 723 | * nothing does while `billing` is null and it is not `protected`. | |
| 724 | */ | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 725 | export type WorkspaceDeletion = { |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 726 | /** Its live repositories, deleted with it. */ |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 727 | repositories: number; |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 728 | /** Its projects, hidden with it. */ |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 729 | projects: number; |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 730 | members: number; |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 731 | /** Why billing cannot close it yet, in words for its owner. */ |
| 732 | billing: string | null; | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 733 | /** It can never be deleted, by anyone. */ |
| 734 | protected: boolean; | |
| 735 | }; | |
| 736 | ||
| 737 | /** How long a deleted workspace is kept, for g1t's staff to restore, before it is purged. */ | |
| 738 | export const WORKSPACE_RESTORE_DAYS = 30; | |
| 739 | ||
| 740 | /** | |
| 741 | * Workspaces nobody can delete, whatever identity's `PROTECTED_WORKSPACES` | |
| 742 | * says: Flagon's, which runs g1t. Services that act on `workspace.deleting` | |
| 743 | * check it too, so one published for it by mistake changes nothing. | |
| 744 | */ | |
| 745 | export const ALWAYS_PROTECTED_WORKSPACES: readonly string[] = ["flagon-io"]; | |
| 746 | ||
| 747 | /** Whether `slug` is one of `ALWAYS_PROTECTED_WORKSPACES`, in any case. */ | |
| 748 | export function isProtectedWorkspace(slug: string): boolean { | |
| 749 | return ALWAYS_PROTECTED_WORKSPACES.includes(slug.trim().toLowerCase()); | |
| 750 | } | |
| 751 | ||
| 752 | /** A workspace an owner deleted, kept until `purgeAfter` for staff to restore. */ | |
| 753 | export type DeletedWorkspace = { | |
| 754 | workspaceId: string; | |
| 755 | slug: string; | |
| 756 | name: string; | |
| 757 | /** RFC 3339. */ | |
| 758 | deletedAt: string; | |
| Merge sudo: delete an account with the workspaces it alone owns, purge each | 759 | /** The username of the owner who deleted it, or the staff member who deleted it with the account that alone owned it. */ |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 760 | deletedBy: string; |
| 761 | /** RFC 3339: when it is purged unless restored first. */ | |
| 762 | purgeAfter: string; | |
| 763 | /** What went with it, counted when it was deleted. */ | |
| 764 | went: WorkspaceDeletion; | |
| 765 | /** Whether staff can still restore it. */ | |
| 766 | restorable: boolean; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 767 | }; |
| 768 | ||
| People and teams are front and centre: one directory of people and agents with presence, local time, titles, teams and what each owns; profiles with manager and reports and the agents they work with; an org chart with each team's agents beside the person who leads it; and teams of any mix, with a lead, a channel, a budget agents keep to and the agents on them. Every agent is told its teams each turn (who leads, who owns what, who's around and who to page), and the team page shows exactly what. Member management is Members and invites; the people and teams guide says how. | 769 | export interface IdentityApi extends AccessClient, TeamsClient, PeopleClient, DeployKeysClient { |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 770 | /** |
| 771 | * Creates an account and signs it in. While registration is invite-only, | |
| 772 | * `inviteCode` must be an unused, unexpired invite (and, when it names an | |
| 773 | * email, that address); it is ignored while registration is open. | |
| 774 | */ | |
| 775 | register( | |
| 776 | username: string, | |
| 777 | email: string, | |
| 778 | password: string, | |
| 779 | inviteCode?: string | null, | |
| 780 | /** Who is asking, such as the visitor's IP address, for rate limits. */ | |
| 781 | client?: string | null, | |
| Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm | 782 | /** |
| 783 | * The `proof` from the invite email's link. When it is the invite's own | |
| 784 | * and `email` is the address it was sent to, the account starts with that | |
| 785 | * address confirmed; otherwise it is ignored. | |
| 786 | */ | |
| 787 | emailProof?: string | null, | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 788 | ): Promise<Result<{ user: User; sessionToken: string }>>; |
| Deployments work end to end: fixes from the first live run | 789 | /** Verifies a username and password for website sign-in. */ |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 790 | /** |
| 791 | * Verifies a username, or any confirmed address of the account, and its | |
| 792 | * password. Wrong passwords are counted against the account and `client` | |
| 793 | * (the visitor's IP address); past a limit nothing is checked for a while. | |
| 794 | */ | |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 795 | signIn( |
| 796 | username: string, | |
| 797 | password: string, | |
| 798 | client?: string | null, | |
| 799 | ): Promise<Result<{ user: User; sessionToken: string; twoFactorChallenge?: string | null }>>; | |
| 800 | /** | |
| 801 | * The second step of signing in, for an account with two-factor | |
| 802 | * authentication: the challenge `signIn` returned, and a code from the | |
| 803 | * app or a recovery code. | |
| 804 | */ | |
| 805 | twoFactorSignIn(challenge: string, code: string, client?: string | null): Promise<Result<{ user: User; sessionToken: string }>>; | |
| Deployments work end to end: fixes from the first live run | 806 | signOut(sessionToken: string): Promise<void>; |
| 807 | ||
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 808 | /** |
| 809 | * Sends a new confirmation code and link to the primary of an account | |
| 810 | * that has not confirmed it, at most once a minute. | |
| 811 | */ | |
| Deployments work end to end: fixes from the first live run | 812 | resendVerification(user: User): Promise<Result<boolean>>; |
| Merge email confirmation gate: a code and a link, nothing until confirmed (identity 0036) | 813 | /** Confirms the address the emailed link was sent to, signed in or not; ends the code sent with it. */ |
| 814 | verifyEmail(token: string): Promise<Result<EmailConfirmed>>; | |
| Deployments work end to end: fixes from the first live run | 815 | /** Emails a reset link if the address has an account. Always resolves. */ |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 816 | /** |
| 817 | * Any confirmed address of an account works; the link goes to it, and the | |
| 818 | * primary and backup are told. A few an hour per address and per `client`. | |
| 819 | */ | |
| 820 | requestPasswordReset(email: string, client?: string | null): Promise<boolean>; | |
| Deployments work end to end: fixes from the first live run | 821 | /** Sets a new password from an emailed token and ends every session. */ |
| 822 | resetPassword(token: string, password: string): Promise<Result<User>>; | |
| 823 | ||
| 824 | /** | |
| 825 | * Device sign-in (RFC 8628). A tool starts a request, a person approves | |
| 826 | * its short code in a browser, and the tool claims an access token. | |
| 827 | */ | |
| 828 | deviceStart(clientName: string): Promise<DeviceStart>; | |
| 829 | /** What a user code is asking for, or null if it is not valid. */ | |
| 830 | deviceLookup(userCode: string): Promise<DeviceRequest | null>; | |
| 831 | deviceResolve(userCode: string, user: User, approve: boolean): Promise<Result<boolean>>; | |
| 832 | deviceClaim(deviceCode: string): Promise<DeviceClaim>; | |
| 833 | ||
| 834 | /** | |
| 835 | * OAuth 2.1 for applications that sign a person in through the browser. | |
| 836 | * The caller has checked the client and its redirect address; this | |
| 837 | * returns the one-time code the application exchanges for tokens. | |
| 838 | */ | |
| 839 | oauthAuthorize(user: User, approval: OAuthApproval): Promise<{ code: string }>; | |
| 840 | /** Redeems a code. It works once, for that client, with the PKCE verifier. */ | |
| 841 | oauthExchange(code: string, codeVerifier: string, clientId: string, redirectUri: string): Promise<Result<OAuthTokens>>; | |
| 842 | /** Trades a refresh token for new tokens; the old ones stop working. */ | |
| 843 | oauthRefresh(refreshToken: string, clientId: string): Promise<Result<OAuthTokens>>; | |
| 844 | /** Applications the user has signed in to, most recently used first. */ | |
| 845 | listOAuthGrants(user: User): Promise<OAuthGrant[]>; | |
| 846 | /** Signs an application out. */ | |
| 847 | revokeOAuthGrant(user: User, id: string): Promise<void>; | |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 848 | /** Changes what an application may do, at once and when it refreshes. */ |
| 849 | updateOAuthGrant(user: User, id: string, grant: TokenGrant): Promise<Result<OAuthGrant>>; | |
| Deployments work end to end: fixes from the first live run | 850 | |
| 851 | createWorkspace(user: User, slug: string, name: string): Promise<Result<Workspace>>; | |
| 852 | /** Public details of a workspace, or null. */ | |
| 853 | getWorkspace(slug: string): Promise<Workspace | null>; | |
| Merge branch 'worktree-agent-a2013627e5ea4ab13' | 854 | /** Where a workspace keeps its repositories' git data; null when there is no such workspace. */ |
| 855 | workspaceResidency(slug: string): Promise<DataResidency | null>; | |
| 856 | /** | |
| 857 | * Owners only. Applies to repositories made from then on. Offer `eu` | |
| 858 | * only when the repos service's `storageOptions()` says it is available. | |
| 859 | */ | |
| 860 | setWorkspaceResidency(actor: User, slug: string, residency: DataResidency): Promise<Result<DataResidency>>; | |
| Deployments work end to end: fixes from the first live run | 861 | /** Members only. */ |
| 862 | listMembers(slug: string, viewer: Viewer): Promise<Result<Member[]>>; | |
| 863 | /** Owners only. */ | |
| 864 | addMember(actor: User, slug: string, username: string): Promise<Result<boolean>>; | |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 865 | /** Owners only; your own username is leaving. Never the last owner. */ |
| Deployments work end to end: fixes from the first live run | 866 | removeMember(actor: User, slug: string, username: string): Promise<Result<boolean>>; |
| Merge main (membership, two-factor, GitHub repo roles) into tokens | 867 | /** Owners only: owner or member, and the roles held besides it. Never leaves no owner. */ |
| 868 | updateMember(actor: User, slug: string, username: string, change: { role?: Role; org_roles?: OrgRole[] }): Promise<Result<Member>>; | |
| 869 | /** Owners only: `username` becomes an owner, and you a member. */ | |
| 870 | transferOwnership(actor: User, slug: string, username: string): Promise<Result<boolean>>; | |
| 871 | /** You leave the workspace. Never the last owner. */ | |
| 872 | leaveWorkspace(user: User, slug: string): Promise<Result<boolean>>; | |
| 873 | /** Owners only: change some member privileges; returns all of them. */ | |
| 874 | setMemberPrivileges(actor: User, slug: string, change: Partial<MemberPrivileges>): Promise<Result<MemberPrivileges>>; | |
| 875 | /** Owners only, with two-factor on themselves: require it of everyone. */ | |
| 876 | setTwoFactorRequirement(actor: User, slug: string, required: boolean): Promise<Result<boolean>>; | |
| Deployments work end to end: fixes from the first live run | 877 | /** Owners only. An empty name falls back to the slug. */ |
| 878 | updateWorkspace(actor: User, slug: string, details: { name: string; description: string }): Promise<Result<Workspace>>; | |
| Workspace names and icons, and a component kit for every control | 879 | /** |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 880 | * Owners only. Changes the slug, the first segment of the workspace's |
| 881 | * URLs; the display name is untouched. The old slug redirects to the new | |
| 882 | * one, and stays reserved for this workspace, for `SLUG_HOLD_DAYS`. | |
| 883 | * Publishes `workspace.renamed`. | |
| 884 | */ | |
| 885 | renameWorkspace(actor: User, slug: string, newSlug: string): Promise<Result<Workspace>>; | |
| 886 | /** Whether `renameWorkspace` would be allowed, changing nothing. */ | |
| 887 | checkWorkspaceRename(actor: User, slug: string, newSlug: string): Promise<Result<boolean>>; | |
| 888 | /** | |
| 889 | * The workspace's current slug when `slug` is one it was renamed from | |
| Merge branch 'worktree-agent-a8385d293d42c913a' | 890 | * within `SLUG_HOLD_DAYS`, or when `slug` is an alias staff set for it |
| 891 | * (`WorkspaceAlias`); null otherwise, including for a slug in use. | |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 892 | */ |
| 893 | resolveSlug(slug: string): Promise<string | null>; | |
| 894 | /** | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 895 | * Owners only, a person only. `confirm` is the slug, typed out. Refused |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 896 | * for a protected workspace, and while billing cannot settle it. Its |
| 897 | * repositories, projects and apps go with it; it is kept for | |
| 898 | * `WORKSPACE_RESTORE_DAYS`, when g1t's staff can restore it, then purged. | |
| 899 | * Its slug is never given to anyone else; the person whose username it is | |
| 900 | * may make it again once it is purged. Publishes `workspace.deleting`. | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 901 | */ |
| 902 | deleteWorkspace(actor: User, slug: string, confirm: string): Promise<Result<boolean>>; | |
| Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member | 903 | /** What `deleteWorkspace` would take with it, and what stands in its way, changing nothing. */ |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 904 | checkWorkspaceDeletion(actor: User, slug: string): Promise<Result<WorkspaceDeletion>>; |
| 905 | /** | |
| Workspace names and icons, and a component kit for every control | 906 | * Owners only. `image` is the file in base64: PNG, JPEG, WebP or GIF, at |
| 907 | * most `MAX_AVATAR_BYTES`, checked by its bytes. Null removes the icon. | |
| 908 | */ | |
| 909 | setWorkspaceAvatar(actor: User, slug: string, image: string | null): Promise<Result<Workspace>>; | |
| 910 | /** A person's own avatar, as `setWorkspaceAvatar`: the new one, or null. */ | |
| 911 | setUserAvatar(user: User, image: string | null): Promise<Result<string | null>>; | |
| Deployments work end to end: fixes from the first live run | 912 | |
| 913 | /** | |
| 914 | * A workspace's own access tokens. They belong to the workspace, act as | |
| 915 | * it, and keep working when the member who made one leaves. Members only. | |
| 916 | */ | |
| 917 | listWorkspaceTokens(slug: string, viewer: Viewer): Promise<Result<AccessToken[]>>; | |
| 918 | /** Owners only. */ | |
| 919 | removeWorkspaceToken(actor: User, slug: string, id: string): Promise<Result<boolean>>; | |
| 920 | ||
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 921 | /** |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 922 | * An access token: yours, or (with `input.owner`, owners only) a |
| 923 | * workspace's. People only, signed in. The plaintext token is returned | |
| 924 | * once and never stored. A personal token made for a workspace that asks | |
| 925 | * for approval starts pending unless you are an owner there. | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 926 | */ |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 927 | createToken(actor: User, input: TokenInput): Promise<Result<{ token: string; info: AccessToken }>>; |
| 928 | /** | |
| 929 | * Changes a token of yours, or (with `owner`, owners only) a | |
| 930 | * workspace's; what is left out stays. Widening a token made for a | |
| 931 | * workspace that approves tokens asks for approval again. | |
| 932 | */ | |
| 933 | updateToken(actor: User, id: string, change: TokenChange, owner?: string | null): Promise<Result<AccessToken>>; | |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 934 | /** A workspace's rules for personal access tokens. Members only. */ |
| 935 | getTokenPolicy(slug: string, viewer: Viewer): Promise<Result<TokenPolicy>>; | |
| 936 | /** Owners only, as people. `maxLifetimeDays` of 0 removes the limit. */ | |
| 937 | setTokenPolicy( | |
| 938 | actor: User, | |
| 939 | slug: string, | |
| 940 | change: Partial<Omit<TokenPolicy, "updatedBy" | "updatedAt">>, | |
| 941 | ): Promise<Result<TokenPolicy>>; | |
| 942 | /** The members' tokens that can reach a workspace. Owners only. */ | |
| 943 | listMemberTokens( | |
| 944 | actor: User, | |
| 945 | slug: string, | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 946 | filter?: { status?: TokenStatus }, |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 947 | ): Promise<Result<MemberToken[]>>; |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 948 | /** Approve or deny a token waiting for approval. Owners only. */ |
| Settings: fine-grained tokens, workspace token Admin, workspace personal access token rules | 949 | reviewTokenRequest(actor: User, slug: string, id: string, approve: boolean, reason?: string | null): Promise<Result<MemberToken>>; |
| 950 | /** Take a member's token out of the workspace. Owners only. */ | |
| 951 | revokeMemberToken(actor: User, slug: string, id: string, reason?: string | null): Promise<Result<boolean>>; | |
| 952 | ||
| Deployments work end to end: fixes from the first live run | 953 | userForSession(sessionToken: string): Promise<Viewer>; |
| 954 | ||
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 955 | /** Whether registration is invite-only. */ |
| 956 | registration(): Promise<RegistrationMode>; | |
| 957 | /** A person's invites and what they have left. */ | |
| 958 | listInvites(user: User): Promise<InvitesOverview>; | |
| 959 | /** | |
| 960 | * A person makes an invite, optionally for one address (emailed to it), | |
| 961 | * using one of theirs or, with `workspace`, one the workspace was granted. | |
| 962 | * People only: never an agent or a workspace's token. | |
| 963 | */ | |
| Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040) | 964 | createInvite( |
| 965 | user: User, | |
| Merge two kinds of invite, kept apart: an invite to g1t (Settings, invite-only only, no workspace unless asked) and an invitation to a workspace (its People page) | 966 | options?: { email?: string | null; workspace?: string | null; join?: string | null; joinRole?: "owner" | "member" | null }, |
| Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040) | 967 | ): Promise<Result<Invite>>; |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 968 | /** Its maker, or an owner of its workspace, revokes a pending invite; the invite comes back. */ |
| 969 | revokeInvite(user: User, id: string): Promise<Result<Invite>>; | |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 970 | /** |
| 971 | * What a code is for. Unknown, used, revoked and expired codes all get the | |
| 972 | * same answer, unless `anyStatus`: then a real code that is spent is | |
| Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm | 973 | * described, with its `status`. `viewer` sets `forViewer`; `emailProof`, |
| 974 | * the `proof` from the invite email's link, sets `emailProven`. | |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 975 | */ |
| 976 | checkInvite( | |
| 977 | code: string, | |
| 978 | client?: string | null, | |
| Merge invite emails that confirm the address: the emailed link carries a proof only that email has, so signing up from it needs no code; shared links and typed codes still confirm | 979 | options?: { viewer?: User | null; anyStatus?: boolean; emailProof?: string | null }, |
| status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas | 980 | ): Promise<Result<InvitePreview>>; |
| 981 | /** | |
| 982 | * A signed-in person uses a workspace invite sent to their address, or one | |
| 983 | * sent with a repository invitation; returns the workspace's slug, or | |
| 984 | * `workspace/repo`. | |
| 985 | */ | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 986 | acceptInvite(user: User, code: string): Promise<Result<string>>; |
| Merge workspace invitations: nobody joins a workspace without saying yes, people are found by username, your own invites can bring someone in, and nobody is left without a workspace (identity 0040) | 987 | /** |
| 988 | * Owners only. Invites someone into a workspace by address (always with an | |
| 989 | * invite bound to it) or by `username`: a workspace invitation they accept | |
| 990 | * or decline. Nobody joins without saying yes. `role` is what they join as. | |
| 991 | */ | |
| 992 | inviteMember( | |
| 993 | actor: User, | |
| 994 | slug: string, | |
| 995 | who: { email?: string | null; username?: string | null; role?: Role | null }, | |
| 996 | ): Promise<Result<Invite>>; | |
| 997 | /** The workspace invitations waiting for the person's answer, newest first. */ | |
| 998 | listInvitations(user: User): Promise<WorkspaceInvitation[]>; | |
| 999 | /** Joins the invitation's workspace with its role; returns the workspace's slug. */ | |
| 1000 | acceptInvitation(user: User, id: string): Promise<Result<string>>; | |
| 1001 | /** Declines it; whoever sent it is told in their inbox. */ | |
| 1002 | declineInvitation(user: User, id: string): Promise<Result<boolean>>; | |
| 1003 | /** People to invite, by username prefix or name: a username, a name and an avatar each. */ | |
| 1004 | findPeople(query: string, limit?: number): Promise<PersonMatch[]>; | |
| Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look | 1005 | /** Owners only: the workspace's invites, newest first. */ |
| 1006 | workspaceInvites(slug: string, viewer: Viewer): Promise<Result<Invite[]>>; | |
| 1007 | /** Owners only. */ | |
| 1008 | revokeWorkspaceInvite(actor: User, slug: string, id: string): Promise<Result<Invite>>; | |
| 1009 | /** Someone without an invite asks for one. Always the same answer for a valid address. */ | |
| 1010 | requestAccess(email: string, about: string, client?: string | null): Promise<Result<boolean>>; | |
| 1011 | ||
| Deployments work end to end: fixes from the first live run | 1012 | /** Verifies git credentials: the account password or an access token. */ |
| 1013 | userForGitCredentials(username: string, secret: string): Promise<Viewer>; | |
| 1014 | /** Resolves a `g1t_…` access token, as sent to the API and MCP server. */ | |
| 1015 | userForAccessToken(token: string): Promise<Viewer>; | |
| 1016 | userForSshKey(fingerprint: string): Promise<Viewer>; | |
| 1017 | userByUsername(username: string): Promise<Viewer>; | |
| 1018 | /** The names behind account and workspace ids; unknown ids are left out. */ | |
| 1019 | usernames(ids: string[]): Promise<Record<string, string>>; | |
| Merge the workspace shell: navigation and phone shell, g1t as orchestrator, agents in roles with audience-checked reads, reactions and custom emoji, live notifications and browser push, the homepage tour (agents 0002, chat 0002) | 1020 | /** |
| 1021 | * Internal: the people behind these ids (at most 50) with their | |
| 1022 | * workspaces, roles and repository grants, as a signed-in viewer has | |
| 1023 | * them. For the agents service's audience checks only. Ids of no live | |
| 1024 | * account are left out. | |
| 1025 | */ | |
| 1026 | usersForAudience(ids: string[]): Promise<User[]>; | |
| Deployments work end to end: fixes from the first live run | 1027 | |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1028 | /** A person's public profile, or null if there is no such account. Never an email address. */ |
| 1029 | profile(username: string): Promise<Profile | null>; | |
| 1030 | /** A person changes their own profile. Every field is replaced; an empty one is cleared. */ | |
| 1031 | updateProfile(actor: User, fields: ProfileFields): Promise<Result<Profile>>; | |
| 1032 | /** | |
| 1033 | * The workspaces a profile shows `viewer`: those the viewer belongs to | |
| 1034 | * as well, and those of `publicIn` (where the person made a public | |
| 1035 | * project) that the person really belongs to. Nothing else. | |
| 1036 | */ | |
| 1037 | profileWorkspaces(username: string, viewer: Viewer, publicIn: string[]): Promise<ProfileWorkspace[]>; | |
| 1038 | ||
| The apps you pin to your dock are kept with your account, per workspace and in your order, so the dock is the same on every device: identity keeps them in dock_pins and answers dock_pins and set_dock_pins, the dock reads them with the rest of the page, pins kept only on this device carry over with your first change, this device's copy still draws the dock when identity can't be reached, a pin that can't be saved says so, and they go when you or the workspace do; the workspaces guide says how. | 1039 | /** |
| 1040 | * The apps `user` pinned to their dock in the workspace `workspace` (a | |
| 1041 | * slug), in the order they set; null when they never saved any there or | |
| 1042 | * are not one of its members. Kept with the account, so every device | |
| 1043 | * shows the same dock. | |
| 1044 | */ | |
| 1045 | dockPins(user: User, workspace: string): Promise<string[] | null>; | |
| 1046 | /** | |
| 1047 | * Replaces `user`'s dock pins in `workspace` with `apps`, in that order: | |
| 1048 | * keys of lowercase letters, digits and hyphens, repeats dropped, at | |
| 1049 | * most `MAX_DOCK_PINS`. Which keys are real apps is the caller's to check. | |
| 1050 | */ | |
| 1051 | setDockPins(user: User, workspace: string, apps: string[]): Promise<Result<string[]>>; | |
| 1052 | ||
| Chat has sounds. A short warm cue plays for a message in a conversation you have open but aren't looking at, a direct message, a mention of you and an agent finishing something for you, with a soft tick for sending that is off until you turn it on; never for your own messages, a muted conversation, a conversation you are looking at in a window that has the front, or while you have paused notifications, and never twice for one message or more than once in a second and a half. The cues are made by the browser itself in two sets, Soft and Bright, so nothing is downloaded; the Sounds and notifications section of your notification settings turns them on and off, picks the set and the volume, plays each one, and offers desktop notifications for when the window is behind; Do not disturb is the one pause everyone sees, set from the chat sidebar's bell, the settings, or your avatar menu, now with a two-hour choice, and the top bar's bell shows a dot while it's on. Your choices are kept with your account. The sound layer sits behind one small interface so the desktop app can play them natively later. The chat and notifications guides say the rules. | 1053 | /** |
| 1054 | * How chat sounds and desktop notifications reach `user`, kept with the | |
| 1055 | * account so every device and the desktop app behave the same | |
| 1056 | * (`SoundSettings`). The defaults when they never changed them. | |
| 1057 | */ | |
| 1058 | soundSettings(user: User): Promise<SoundSettings>; | |
| 1059 | /** | |
| 1060 | * Changes some of them: only the fields sent change, and `sound_cues` | |
| 1061 | * merges one cue at a time. Returns the settings as kept. | |
| 1062 | */ | |
| 1063 | setSoundSettings(user: User, change: SoundSettingsChange): Promise<Result<SoundSettings>>; | |
| 1064 | ||
| Deployments work end to end: fixes from the first live run | 1065 | listSshKeys(user: User): Promise<SshKey[]>; |
| 1066 | /** Takes one line in OpenSSH public key format. */ | |
| 1067 | addSshKey(user: User, title: string, publicKey: string): Promise<Result<SshKey>>; | |
| 1068 | removeSshKey(user: User, id: string): Promise<void>; | |
| 1069 | ||
| 1070 | listAccessTokens(user: User): Promise<AccessToken[]>; | |
| 1071 | /** | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 1072 | * A credential minted for a person or workspace by another service. The |
| 1073 | * plaintext token is returned once and never stored. With `ttlSeconds` | |
| 1074 | * the token expires and is left out of token lists; that form is used | |
| 1075 | * for hosted agents. Tokens people make use `createToken`. | |
| Deployments work end to end: fixes from the first live run | 1076 | */ |
| Thirteen MCP tools and classic token scopes; agents rate their confidence and can be put on an issue in one step | 1077 | createAccessToken( |
| 1078 | user: User, | |
| 1079 | name: string, | |
| 1080 | ttlSeconds?: number, | |
| 1081 | grant?: TokenGrant & { listed?: boolean }, | |
| 1082 | ): Promise<{ token: string; info: AccessToken }>; | |
| Deployments work end to end: fixes from the first live run | 1083 | /** |
| 1084 | * A token for a g1t agent working for `onBehalfOf`: it acts as | |
| g1t is one name: its agent's work, commits and comments show as @g1t, and nobody can claim g1t or g1t-agent | 1085 | * `g1t`, in `scope.repo` only, and only for `scope.operations`. |
| Deployments work end to end: fixes from the first live run | 1086 | */ |
| 1087 | createAgentToken( | |
| 1088 | onBehalfOf: User, | |
| 1089 | scope: AgentScope, | |
| 1090 | ttlSeconds: number, | |
| 1091 | ): Promise<{ token: string; info: AccessToken }>; | |
| 1092 | removeAccessToken(user: User, id: string): Promise<void>; | |
| Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API | 1093 | /** |
| 1094 | * A token for one sandbox run: it acts as the agent on behalf of | |
| 1095 | * `onBehalfOf`, can do only what the run's kind needs in `repo`, and | |
| 1096 | * expires after `ttlSeconds`. See `audit.ts`. | |
| 1097 | */ | |
| 1098 | createRunCredential(input: CreateRunCredentialInput): Promise<{ token: string; info: AccessToken }>; | |
| 1099 | /** Ties tokens, by the SHA-256 of their text in hex, to the agent run their sandbox recorded. */ | |
| 1100 | bindRunCredentials(tokenHashes: string[], runId: string): Promise<boolean>; | |
| 1101 | /** Ends a sandbox's run credentials, by hash or by run. Never touches another token. */ | |
| 1102 | revokeRunCredentials(target: { tokenHashes?: string[]; runId?: string | null }): Promise<boolean>; | |
| Deployments work end to end: fixes from the first live run | 1103 | } |
| 1104 | ||
| 1105 | ||
| 1106 | /** What an agent's token may do: these operations, in this repository. */ | |
| Agents get guardrails, run credentials, an audit log, a context hub, repository instructions and mentions; security upkeep; snake_case API | 1107 | export type AgentScope = { repo: RepoPath; operations: string[]; run?: RunBinding }; |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1108 | |
| The apps you pin to your dock are kept with your account, per workspace and in your order, so the dock is the same on every device: identity keeps them in dock_pins and answers dock_pins and set_dock_pins, the dock reads them with the rest of the page, pins kept only on this device carry over with your first change, this device's copy still draws the dock when identity can't be reached, a pin that can't be saved says so, and they go when you or the workspace do; the workspaces guide says how. | 1109 | /** The most apps a person pins in one workspace. Mirrors `MAX_DOCK_PINS` in `crates/contracts/src/identity.rs`. */ |
| 1110 | export const MAX_DOCK_PINS = 24; | |
| 1111 | ||
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1112 | /** The most characters each profile field takes. Mirrors `crates/contracts/src/identity.rs`. */ |
| Merge leftovers: plan activity filtered in the query, pushes counted by account, ghost during the deletion window, profile time zones (identity 0039) | 1113 | export const PROFILE_LIMITS = { name: 80, bio: 160, location: 80, website: 200, pronouns: 40, timezone: 64 } as const; |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1114 | |
| 1115 | /** What anyone may see about a person, at `g1t.sh/u/<username>`. */ | |
| 1116 | export type Profile = { | |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 1117 | /** Lowercased: what the profile is found and linked by. */ |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1118 | username: string; |
| One kind of access token; presence and status; usernames keep their case; the tour is a miniature of the real app; icons for password managers | 1119 | /** The username as its owner wrote it (`Ana`), when that differs: what the page shows. */ |
| 1120 | displayUsername?: string | null; | |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1121 | /** The name they go by, if they gave one. */ |
| 1122 | name: string | null; | |
| 1123 | bio: string | null; | |
| 1124 | location: string | null; | |
| 1125 | /** Always an `https://` address. */ | |
| 1126 | website: string | null; | |
| 1127 | pronouns: string | null; | |
| Merge leftovers: plan activity filtered in the query, pushes counted by account, ghost during the deletion window, profile time zones (identity 0039) | 1128 | /** The time zone they are in, an IANA name such as `America/Denver`. */ |
| 1129 | timezone: string | null; | |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1130 | /** The uploaded avatar's hash, served at `/avatars/<avatar>`. */ |
| 1131 | avatar: string | null; | |
| 1132 | /** When the account was made. RFC 3339. */ | |
| 1133 | createdAt: string; | |
| 1134 | }; | |
| 1135 | ||
| 1136 | /** What a person may change on their profile. Empty clears a field. */ | |
| 1137 | export type ProfileFields = { | |
| 1138 | name: string; | |
| 1139 | bio: string; | |
| 1140 | location: string; | |
| 1141 | /** `https://…`; a bare `example.com` is taken as `https://example.com`. */ | |
| 1142 | website: string; | |
| 1143 | pronouns: string; | |
| Merge leftovers: plan activity filtered in the query, pushes counted by account, ghost during the deletion window, profile time zones (identity 0039) | 1144 | /** An IANA time zone name, such as `America/Denver`; empty clears it. */ |
| 1145 | timezone: string; | |
| Agents and memory, checks and conflicts, profiles, slug renames, custom domains | 1146 | }; |
| 1147 | ||
| 1148 | /** A workspace on a person's profile. */ | |
| 1149 | export type ProfileWorkspace = { slug: string; name: string; avatar: string | null }; |
This file's history is long; its oldest lines are credited to the oldest commit read.