@opengeni/contracts 0.44.1 → 1.0.0

package/dist/chunk-O77VSFYZ.js

@@ -0,0 +1,70 @@
+// src/workspace-integration-wire.ts
+var WORKSPACE_WEBHOOK_EVENT_TYPES = [
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "session.status.changed",
+  "session.requiresAction",
+  "session.humanInput.requested",
+  "usage.threshold_reached",
+  "usage.exhausted",
+  "usage.period_reset"
+];
+var OPENGENI_WEBHOOK_TEST_EVENT_TYPE = "webhook.test";
+var OPENGENI_TEST_REQUEST_NIL_ID = "00000000-0000-0000-0000-000000000000";
+var OPENGENI_SIGNATURE_HEADER = "OpenGeni-Signature";
+var OPENGENI_EVENT_ID_HEADER = "OpenGeni-Event-Id";
+var OPENGENI_DELIVERY_ID_HEADER = "OpenGeni-Delivery-Id";
+var OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;
+var encoder = new TextEncoder();
+async function hmacSha256Hex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+  return Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return difference === 0;
+}
+async function signOpenGeniPayload(secret, body, timestampSeconds = Math.floor(Date.now() / 1e3)) {
+  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;
+}
+async function verifyOpenGeniSignature(input) {
+  if (!input.signature) return false;
+  let timestamp = null;
+  const candidates = [];
+  for (const part of input.signature.split(",")) {
+    const [key, value] = part.trim().split("=", 2);
+    if (key === "t" && value && /^\d{1,12}$/.test(value)) timestamp = Number(value);
+    if (key === "v1" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);
+  }
+  if (timestamp === null || candidates.length === 0) return false;
+  const now = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;
+  if (Math.abs(now - timestamp) > tolerance) return false;
+  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);
+  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));
+}
+
+export {
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_DELIVERY_ID_HEADER,
+  OPENGENI_SIGNATURE_TOLERANCE_SECONDS,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature
+};
+//# sourceMappingURL=chunk-O77VSFYZ.js.map

package/dist/chunk-O77VSFYZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/workspace-integration-wire.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"usage.threshold_reached\",\n  \"usage.exhausted\",\n  \"usage.period_reset\",\n] as const;\n\n/**\n * Sent only when an administrator presses \"Send test event\". It is never a\n * subscribable type: every endpoint can receive it, and a receiver that does\n * not care acknowledges it with any 2xx.\n */\nexport const OPENGENI_WEBHOOK_TEST_EVENT_TYPE = \"webhook.test\";\n\n/**\n * The session, turn and attempt ids of a credential-provider test request\n * (`purpose: \"test\"`). A test is not a run, so no real ids exist.\n */\nexport const OPENGENI_TEST_REQUEST_NIL_ID = \"00000000-0000-0000-0000-000000000000\";\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,mCAAmC;AAMzC,IAAM,+BAA+B;AAErC,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;","names":[]}

package/dist/chunk-PX3VCKAU.js

@@ -0,0 +1,29 @@
+// src/editable-artifact-versions.ts
+var SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION = 2;
+var DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION = 1;
+var PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION = 1;
+var SPREADSHEET_KERNEL_SNAPSHOT_VERSION = 2;
+var DOCUMENT_ARTIFACT_SNAPSHOT_VERSION = 1;
+var PRESENTATION_ARTIFACT_SNAPSHOT_VERSION = 1;
+var SPREADSHEET_KERNEL_COMMAND_VERSION = 2;
+var SPREADSHEET_ARTIFACT_COMMAND_VERSION = 2;
+var SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION = 2;
+var COMMITTED_TRANSACTION_PROTOCOL_VERSION = 2;
+var EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION = 1;
+var EDITABLE_ARTIFACT_LIVE_WIRE_VERSION = 2;
+
+export {
+  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
+  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
+  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,
+  SPREADSHEET_KERNEL_SNAPSHOT_VERSION,
+  DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,
+  PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,
+  SPREADSHEET_KERNEL_COMMAND_VERSION,
+  SPREADSHEET_ARTIFACT_COMMAND_VERSION,
+  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,
+  COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+  EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,
+  EDITABLE_ARTIFACT_LIVE_WIRE_VERSION
+};
+//# sourceMappingURL=chunk-PX3VCKAU.js.map

package/dist/chunk-PX3VCKAU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/editable-artifact-versions.ts"],"sourcesContent":["/** Modality-specific durable semantic/schema versions. */\nexport const SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION = 2 as const;\nexport const DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION = 1 as const;\nexport const PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION = 1 as const;\n\n/** Direct kernel workbook snapshot version (OGARTK02), never the durable CRDT snapshot. */\nexport const SPREADSHEET_KERNEL_SNAPSHOT_VERSION = 2 as const;\n\n/** Modality-specific canonical snapshot versions. */\nexport const DOCUMENT_ARTIFACT_SNAPSHOT_VERSION = 1 as const;\nexport const PRESENTATION_ARTIFACT_SNAPSHOT_VERSION = 1 as const;\n\n/** Canonical internal spreadsheet kernel command-envelope version. */\nexport const SPREADSHEET_KERNEL_COMMAND_VERSION = 2 as const;\n\n/** Canonical public, identity-free spreadsheet command-envelope version. */\nexport const SPREADSHEET_ARTIFACT_COMMAND_VERSION = 2 as const;\n\n/** Canonical durable spreadsheet collaboration-snapshot version. */\nexport const SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION = 2 as const;\n\n/** Canonical committed spreadsheet transaction protocol version. */\nexport const COMMITTED_TRANSACTION_PROTOCOL_VERSION = 2 as const;\n\n/** Canonical document/presentation serialized-commit protocol version. */\nexport const EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION = 1 as const;\n\n/** Canonical editable-artifact live transport protocol version. */\nexport const EDITABLE_ARTIFACT_LIVE_WIRE_VERSION = 2 as const;\n"],"mappings":";AACO,IAAM,4CAA4C;AAClD,IAAM,yCAAyC;AAC/C,IAAM,6CAA6C;AAGnD,IAAM,sCAAsC;AAG5C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAG/C,IAAM,qCAAqC;AAG3C,IAAM,uCAAuC;AAG7C,IAAM,6CAA6C;AAGnD,IAAM,yCAAyC;AAG/C,IAAM,8CAA8C;AAGpD,IAAM,sCAAsC;","names":[]}

package/dist/chunk-QR5D2IQC.js

@@ -0,0 +1,61 @@
+// src/permissions.ts
+import { z } from "zod";
+var Permission = z.enum([
+  "account:read",
+  "account:admin",
+  "members:manage",
+  "workspace:create",
+  "billing:read",
+  "billing:manage",
+  "workspace:read",
+  "workspace:admin",
+  "sessions:create",
+  "sessions:read",
+  "sessions:control",
+  "stream:view",
+  "stream:control",
+  "stream:acknowledge",
+  "files:upload",
+  "files:read",
+  "files:write",
+  "terminal:attach",
+  "documents:manage",
+  "documents:search",
+  "scheduled_tasks:manage",
+  "scheduled_tasks:run",
+  "github:manage",
+  "github:use",
+  "api_keys:manage",
+  /** Literal organization-key authority to configure workspace usage allowances. */
+  "usage_allowances:manage",
+  "connections:read",
+  "connections:write",
+  "capabilities:manage",
+  /** @deprecated alias of variable-sets:manage */
+  "environments:manage",
+  /** @deprecated alias of variable-sets:use */
+  "environments:use",
+  "variable-sets:list",
+  "variable-sets:read",
+  "variable-sets:write",
+  "variable-sets:manage",
+  "variable-sets:attach",
+  "variable-sets:use",
+  "secrets:list",
+  "secrets:read",
+  "secrets:write",
+  "mcp_servers:attach",
+  "codemode:call",
+  "goals:manage",
+  "enrollments:read",
+  "enrollments:manage",
+  "rigs:use",
+  "rigs:manage",
+  "artifacts:read",
+  "artifacts:publish"
+]);
+
+export {
+  Permission
+};
+//# sourceMappingURL=chunk-QR5D2IQC.js.map

package/dist/chunk-QR5D2IQC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/permissions.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Canonical public permission vocabulary shared by operational and control-plane contracts. */\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  \"stream:view\",\n  \"stream:control\",\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  \"files:write\",\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  /** Literal organization-key authority to configure workspace usage allowances. */\n  \"usage_allowances:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  \"capabilities:manage\",\n  /** @deprecated alias of variable-sets:manage */\n  \"environments:manage\",\n  /** @deprecated alias of variable-sets:use */\n  \"environments:use\",\n  \"variable-sets:list\",\n  \"variable-sets:read\",\n  \"variable-sets:write\",\n  \"variable-sets:manage\",\n  \"variable-sets:attach\",\n  \"variable-sets:use\",\n  \"secrets:list\",\n  \"secrets:read\",\n  \"secrets:write\",\n  \"mcp_servers:attach\",\n  \"codemode:call\",\n  \"goals:manage\",\n  \"enrollments:read\",\n  \"enrollments:manage\",\n  \"rigs:use\",\n  \"rigs:manage\",\n  \"artifacts:read\",\n  \"artifacts:publish\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n"],"mappings":";AAAA,SAAS,SAAS;AAGX,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}

package/dist/chunk-RJ76DRPO.js

@@ -0,0 +1,117 @@
+import {
+  Permission
+} from "./chunk-QR5D2IQC.js";
+
+// src/organization-access.ts
+import { z } from "zod";
+var OrganizationAccessPreset = z.enum(["read_only", "full", "custom"]);
+var OrganizationWorkspaceScope = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("all") }).strict(),
+  z.object({
+    kind: z.literal("selected"),
+    workspaceIds: z.array(
+      z.string().uuid().transform((id) => id.toLowerCase())
+    ).max(500).refine((ids) => new Set(ids).size === ids.length, "Workspace IDs must be unique")
+  }).strict()
+]);
+var OrganizationActor = z.enum(["user", "organization"]);
+var aliases = {
+  "environments:manage": "variable-sets:manage",
+  "environments:use": "variable-sets:use"
+};
+var permissionSets;
+function sets() {
+  if (permissionSets) return permissionSets;
+  const canonical = Permission.options.filter((permission) => !aliases[permission]);
+  const observational = canonical.filter(
+    (permission) => /:(read|list|view|search)$/.test(permission)
+  );
+  const secretValue = /* @__PURE__ */ new Set(["secrets:read", "variable-sets:read"]);
+  const readOnly = observational.filter((permission) => !secretValue.has(permission));
+  permissionSets = { canonical, observational, readOnly };
+  return permissionSets;
+}
+function organizationAccessPresetPermissions(preset) {
+  return preset === "full" ? [...sets().canonical] : preset === "read_only" ? [...sets().readOnly] : [];
+}
+function isReadOnlyPermissionSet(permissions) {
+  return permissions.every(
+    (permission) => sets().observational.includes(aliases[permission] ?? permission)
+  );
+}
+var OrganizationAccessPolicyInput = z.object({
+  preset: OrganizationAccessPreset,
+  // Lazy for the same module-order reason as `sets()` above.
+  permissions: z.array(z.lazy(() => Permission)),
+  workspaceScope: OrganizationWorkspaceScope
+}).strict();
+function normalizeOrganizationAccessPolicy(policy) {
+  const parsed = OrganizationAccessPolicyInput.parse(policy);
+  const requested = new Set(
+    parsed.permissions.map((permission) => aliases[permission] ?? permission)
+  );
+  const { canonical, readOnly } = sets();
+  const permissions = canonical.filter((permission) => requested.has(permission));
+  const same = (candidate) => candidate.length === permissions.length && candidate.every((permission) => requested.has(permission));
+  return {
+    preset: same(canonical) ? "full" : same(readOnly) ? "read_only" : "custom",
+    permissions,
+    workspaceScope: parsed.workspaceScope.kind === "selected" ? { kind: "selected", workspaceIds: [...parsed.workspaceScope.workspaceIds].sort() } : { kind: "all" }
+  };
+}
+var OrganizationAccessPolicy = OrganizationAccessPolicyInput.transform(
+  normalizeOrganizationAccessPolicy
+);
+var OrganizationServiceAccountRole = z.enum(["admin", "member"]);
+var ORGANIZATION_ADMIN_ONLY_PERMISSIONS = [
+  "account:admin",
+  "members:manage",
+  "billing:manage",
+  "api_keys:manage",
+  "usage_allowances:manage"
+];
+function serviceAccountAllowsPermission(role, permission) {
+  return role === "admin" || !ORGANIZATION_ADMIN_ONLY_PERMISSIONS.includes(permission);
+}
+var OrganizationServiceAccount = z.object({
+  id: z.string().uuid(),
+  organizationId: z.string().uuid(),
+  name: z.string().min(1).max(200),
+  description: z.string().nullable(),
+  role: OrganizationServiceAccountRole,
+  /** Keys that are not revoked, including expired ones. */
+  activeKeyCount: z.number().int().nonnegative(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var ListOrganizationServiceAccountsResponse = z.object({
+  serviceAccounts: z.array(OrganizationServiceAccount)
+});
+var CreateOrganizationServiceAccountRequest = z.object({
+  name: z.string().trim().min(1).max(200),
+  description: z.string().trim().min(1).max(500).optional(),
+  role: OrganizationServiceAccountRole.default("member")
+}).strict();
+var UpdateOrganizationServiceAccountRequest = z.object({
+  name: z.string().trim().min(1).max(200).optional(),
+  description: z.string().trim().min(1).max(500).nullable().optional(),
+  role: OrganizationServiceAccountRole.optional()
+}).strict().refine((request) => Object.keys(request).length > 0, "At least one change is required");
+
+export {
+  OrganizationAccessPreset,
+  OrganizationWorkspaceScope,
+  OrganizationActor,
+  organizationAccessPresetPermissions,
+  isReadOnlyPermissionSet,
+  normalizeOrganizationAccessPolicy,
+  OrganizationAccessPolicy,
+  OrganizationServiceAccountRole,
+  ORGANIZATION_ADMIN_ONLY_PERMISSIONS,
+  serviceAccountAllowsPermission,
+  OrganizationServiceAccount,
+  ListOrganizationServiceAccountsResponse,
+  CreateOrganizationServiceAccountRequest,
+  UpdateOrganizationServiceAccountRequest
+};
+//# sourceMappingURL=chunk-RJ76DRPO.js.map

package/dist/chunk-RJ76DRPO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/organization-access.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { Permission } from \"./permissions\";\n\nexport const OrganizationAccessPreset = z.enum([\"read_only\", \"full\", \"custom\"]);\nexport type OrganizationAccessPreset = z.infer<typeof OrganizationAccessPreset>;\n\nexport const OrganizationWorkspaceScope = z.discriminatedUnion(\"kind\", [\n  z.object({ kind: z.literal(\"all\") }).strict(),\n  z\n    .object({\n      kind: z.literal(\"selected\"),\n      workspaceIds: z\n        .array(\n          z\n            .string()\n            .uuid()\n            .transform((id) => id.toLowerCase()),\n        )\n        .max(500)\n        .refine((ids) => new Set(ids).size === ids.length, \"Workspace IDs must be unique\"),\n    })\n    .strict(),\n]);\nexport type OrganizationWorkspaceScope = z.infer<typeof OrganizationWorkspaceScope>;\n\nexport const OrganizationActor = z.enum([\"user\", \"organization\"]);\nexport type OrganizationActor = z.infer<typeof OrganizationActor>;\n\nconst aliases: Partial<Record<Permission, Permission>> = {\n  \"environments:manage\": \"variable-sets:manage\",\n  \"environments:use\": \"variable-sets:use\",\n};\n// Computed on first use, never at module load: the web build can place\n// `Permission` in a chunk that finishes initializing after this one, and a\n// top-level read of `Permission.options` then crashes the whole app.\nlet permissionSets:\n  | { canonical: Permission[]; observational: Permission[]; readOnly: Permission[] }\n  | undefined;\nfunction sets() {\n  if (permissionSets) return permissionSets;\n  const canonical = Permission.options.filter((permission) => !aliases[permission]);\n  /** Everything that only observes. Reading secret values observes too. */\n  const observational = canonical.filter((permission) =>\n    /:(read|list|view|search)$/.test(permission),\n  );\n  /** Secret values are opt-in: Read only leaves them out, Custom can add them. */\n  const secretValue = new Set<Permission>([\"secrets:read\", \"variable-sets:read\"]);\n  const readOnly = observational.filter((permission) => !secretValue.has(permission));\n  permissionSets = { canonical, observational, readOnly };\n  return permissionSets;\n}\n\n/** Custom has no implicit permissions. Presets are expanded only by this helper. */\nexport function organizationAccessPresetPermissions(\n  preset: OrganizationAccessPreset,\n): Permission[] {\n  return preset === \"full\"\n    ? [...sets().canonical]\n    : preset === \"read_only\"\n      ? [...sets().readOnly]\n      : [];\n}\n\n/** True when nothing can be changed, including an empty set and secret-value reads. */\nexport function isReadOnlyPermissionSet(permissions: readonly Permission[]): boolean {\n  return permissions.every((permission) =>\n    sets().observational.includes(aliases[permission] ?? permission),\n  );\n}\n\nconst OrganizationAccessPolicyInput = z\n  .object({\n    preset: OrganizationAccessPreset,\n    // Lazy for the same module-order reason as `sets()` above.\n    permissions: z.array(z.lazy(() => Permission)),\n    workspaceScope: OrganizationWorkspaceScope,\n  })\n  .strict();\n\nexport type OrganizationAccessPolicy = z.infer<typeof OrganizationAccessPolicyInput>;\n\n/** Canonical ordering, alias mapping and labels; never adds an unrequested grant. */\nexport function normalizeOrganizationAccessPolicy(\n  policy: OrganizationAccessPolicy,\n): OrganizationAccessPolicy {\n  const parsed = OrganizationAccessPolicyInput.parse(policy);\n  const requested = new Set(\n    parsed.permissions.map((permission) => aliases[permission] ?? permission),\n  );\n  const { canonical, readOnly } = sets();\n  const permissions = canonical.filter((permission) => requested.has(permission));\n  const same = (candidate: readonly Permission[]) =>\n    candidate.length === permissions.length &&\n    candidate.every((permission) => requested.has(permission));\n  return {\n    preset: same(canonical) ? \"full\" : same(readOnly) ? \"read_only\" : \"custom\",\n    permissions,\n    workspaceScope:\n      parsed.workspaceScope.kind === \"selected\"\n        ? { kind: \"selected\", workspaceIds: [...parsed.workspaceScope.workspaceIds].sort() }\n        : { kind: \"all\" },\n  };\n}\n\nexport const OrganizationAccessPolicy = OrganizationAccessPolicyInput.transform(\n  normalizeOrganizationAccessPolicy,\n);\n\n/* ----------------------------------------------------------------------------\n   Service accounts: an organization identity with no person behind it. It\n   holds organization API keys; its role caps what those keys can be given.\n   Up to admin, never owner.\n   -------------------------------------------------------------------------- */\n\nexport const OrganizationServiceAccountRole = z.enum([\"admin\", \"member\"]);\nexport type OrganizationServiceAccountRole = z.infer<typeof OrganizationServiceAccountRole>;\n\n/** What only an organization administrator can do; a member service account's keys never hold it. */\nexport const ORGANIZATION_ADMIN_ONLY_PERMISSIONS: readonly Permission[] = [\n  \"account:admin\",\n  \"members:manage\",\n  \"billing:manage\",\n  \"api_keys:manage\",\n  \"usage_allowances:manage\",\n];\n\n/** The permissions a service account's keys may hold, given its role. */\nexport function serviceAccountAllowsPermission(\n  role: OrganizationServiceAccountRole,\n  permission: Permission,\n): boolean {\n  return role === \"admin\" || !ORGANIZATION_ADMIN_ONLY_PERMISSIONS.includes(permission);\n}\n\nexport const OrganizationServiceAccount = z.object({\n  id: z.string().uuid(),\n  organizationId: z.string().uuid(),\n  name: z.string().min(1).max(200),\n  description: z.string().nullable(),\n  role: OrganizationServiceAccountRole,\n  /** Keys that are not revoked, including expired ones. */\n  activeKeyCount: z.number().int().nonnegative(),\n  createdAt: z.string(),\n  updatedAt: z.string(),\n});\nexport type OrganizationServiceAccount = z.infer<typeof OrganizationServiceAccount>;\n\nexport const ListOrganizationServiceAccountsResponse = z.object({\n  serviceAccounts: z.array(OrganizationServiceAccount),\n});\nexport type ListOrganizationServiceAccountsResponse = z.infer<\n  typeof ListOrganizationServiceAccountsResponse\n>;\n\nexport const CreateOrganizationServiceAccountRequest = z\n  .object({\n    name: z.string().trim().min(1).max(200),\n    description: z.string().trim().min(1).max(500).optional(),\n    role: OrganizationServiceAccountRole.default(\"member\"),\n  })\n  .strict();\nexport type CreateOrganizationServiceAccountRequest = z.infer<\n  typeof CreateOrganizationServiceAccountRequest\n>;\n\nexport const UpdateOrganizationServiceAccountRequest = z\n  .object({\n    name: z.string().trim().min(1).max(200).optional(),\n    description: z.string().trim().min(1).max(500).nullable().optional(),\n    role: OrganizationServiceAccountRole.optional(),\n  })\n  .strict()\n  .refine((request) => Object.keys(request).length > 0, \"At least one change is required\");\nexport type UpdateOrganizationServiceAccountRequest = z.infer<\n  typeof UpdateOrganizationServiceAccountRequest\n>;\n"],"mappings":";;;;;AAAA,SAAS,SAAS;AAGX,IAAM,2BAA2B,EAAE,KAAK,CAAC,aAAa,QAAQ,QAAQ,CAAC;AAGvE,IAAM,6BAA6B,EAAE,mBAAmB,QAAQ;AAAA,EACrE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,KAAK,EAAE,CAAC,EAAE,OAAO;AAAA,EAC5C,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,UAAU;AAAA,IAC1B,cAAc,EACX;AAAA,MACC,EACG,OAAO,EACP,KAAK,EACL,UAAU,CAAC,OAAO,GAAG,YAAY,CAAC;AAAA,IACvC,EACC,IAAI,GAAG,EACP,OAAO,CAAC,QAAQ,IAAI,IAAI,GAAG,EAAE,SAAS,IAAI,QAAQ,8BAA8B;AAAA,EACrF,CAAC,EACA,OAAO;AACZ,CAAC;AAGM,IAAM,oBAAoB,EAAE,KAAK,CAAC,QAAQ,cAAc,CAAC;AAGhE,IAAM,UAAmD;AAAA,EACvD,uBAAuB;AAAA,EACvB,oBAAoB;AACtB;AAIA,IAAI;AAGJ,SAAS,OAAO;AACd,MAAI,eAAgB,QAAO;AAC3B,QAAM,YAAY,WAAW,QAAQ,OAAO,CAAC,eAAe,CAAC,QAAQ,UAAU,CAAC;AAEhF,QAAM,gBAAgB,UAAU;AAAA,IAAO,CAAC,eACtC,4BAA4B,KAAK,UAAU;AAAA,EAC7C;AAEA,QAAM,cAAc,oBAAI,IAAgB,CAAC,gBAAgB,oBAAoB,CAAC;AAC9E,QAAM,WAAW,cAAc,OAAO,CAAC,eAAe,CAAC,YAAY,IAAI,UAAU,CAAC;AAClF,mBAAiB,EAAE,WAAW,eAAe,SAAS;AACtD,SAAO;AACT;AAGO,SAAS,oCACd,QACc;AACd,SAAO,WAAW,SACd,CAAC,GAAG,KAAK,EAAE,SAAS,IACpB,WAAW,cACT,CAAC,GAAG,KAAK,EAAE,QAAQ,IACnB,CAAC;AACT;AAGO,SAAS,wBAAwB,aAA6C;AACnF,SAAO,YAAY;AAAA,IAAM,CAAC,eACxB,KAAK,EAAE,cAAc,SAAS,QAAQ,UAAU,KAAK,UAAU;AAAA,EACjE;AACF;AAEA,IAAM,gCAAgC,EACnC,OAAO;AAAA,EACN,QAAQ;AAAA;AAAA,EAER,aAAa,EAAE,MAAM,EAAE,KAAK,MAAM,UAAU,CAAC;AAAA,EAC7C,gBAAgB;AAClB,CAAC,EACA,OAAO;AAKH,SAAS,kCACd,QAC0B;AAC1B,QAAM,SAAS,8BAA8B,MAAM,MAAM;AACzD,QAAM,YAAY,IAAI;AAAA,IACpB,OAAO,YAAY,IAAI,CAAC,eAAe,QAAQ,UAAU,KAAK,UAAU;AAAA,EAC1E;AACA,QAAM,EAAE,WAAW,SAAS,IAAI,KAAK;AACrC,QAAM,cAAc,UAAU,OAAO,CAAC,eAAe,UAAU,IAAI,UAAU,CAAC;AAC9E,QAAM,OAAO,CAAC,cACZ,UAAU,WAAW,YAAY,UACjC,UAAU,MAAM,CAAC,eAAe,UAAU,IAAI,UAAU,CAAC;AAC3D,SAAO;AAAA,IACL,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,QAAQ,IAAI,cAAc;AAAA,IAClE;AAAA,IACA,gBACE,OAAO,eAAe,SAAS,aAC3B,EAAE,MAAM,YAAY,cAAc,CAAC,GAAG,OAAO,eAAe,YAAY,EAAE,KAAK,EAAE,IACjF,EAAE,MAAM,MAAM;AAAA,EACtB;AACF;AAEO,IAAM,2BAA2B,8BAA8B;AAAA,EACpE;AACF;AAQO,IAAM,iCAAiC,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAIjE,IAAM,sCAA6D;AAAA,EACxE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,+BACd,MACA,YACS;AACT,SAAO,SAAS,WAAW,CAAC,oCAAoC,SAAS,UAAU;AACrF;AAEO,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,MAAM;AAAA;AAAA,EAEN,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC7C,WAAW,EAAE,OAAO;AAAA,EACpB,WAAW,EAAE,OAAO;AACtB,CAAC;AAGM,IAAM,0CAA0C,EAAE,OAAO;AAAA,EAC9D,iBAAiB,EAAE,MAAM,0BAA0B;AACrD,CAAC;AAKM,IAAM,0CAA0C,EACpD,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,MAAM,+BAA+B,QAAQ,QAAQ;AACvD,CAAC,EACA,OAAO;AAKH,IAAM,0CAA0C,EACpD,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,SAAS;AAAA,EACnE,MAAM,+BAA+B,SAAS;AAChD,CAAC,EACA,OAAO,EACP,OAAO,CAAC,YAAY,OAAO,KAAK,OAAO,EAAE,SAAS,GAAG,iCAAiC;","names":[]}

package/dist/chunk-RKX3NQYS.js

@@ -0,0 +1,28 @@
+// src/mcp-endpoint.ts
+function mcpEndpointIdentity(value) {
+  if (!value) return null;
+  try {
+    const url = new URL(value);
+    if (!["https:", "http:"].includes(url.protocol) || url.username || url.password) return null;
+    url.hash = "";
+    return url.href;
+  } catch {
+    return null;
+  }
+}
+function pluginMcpUnavailableReason(server) {
+  if (server.transport === "stdio" || !server.endpoint) return "Requires a local runtime";
+  if (server.transport && !["http", "streamable-http", "streamable_http"].includes(server.transport))
+    return "Unsupported transport: " + server.transport;
+  if (server.requiresConfiguration || server.endpoint.includes("{"))
+    return "Requires custom connection configuration";
+  const endpoint = mcpEndpointIdentity(server.endpoint);
+  if (!endpoint?.startsWith("https://")) return "Requires a valid HTTPS endpoint";
+  return null;
+}
+
+export {
+  mcpEndpointIdentity,
+  pluginMcpUnavailableReason
+};
+//# sourceMappingURL=chunk-RKX3NQYS.js.map

package/dist/chunk-RKX3NQYS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/mcp-endpoint.ts"],"sourcesContent":["/** Exact endpoint identity: normalize URL syntax, preserve paths and query parameters. */\nexport function mcpEndpointIdentity(value: string | null | undefined): string | null {\n  if (!value) return null;\n  try {\n    const url = new URL(value);\n    if (![\"https:\", \"http:\"].includes(url.protocol) || url.username || url.password) return null;\n    url.hash = \"\";\n    return url.href;\n  } catch {\n    return null;\n  }\n}\n\nexport function pluginMcpUnavailableReason(server: {\n  endpoint: string | null;\n  transport?: string;\n  requiresConfiguration?: boolean;\n}): string | null {\n  if (server.transport === \"stdio\" || !server.endpoint) return \"Requires a local runtime\";\n  if (\n    server.transport &&\n    ![\"http\", \"streamable-http\", \"streamable_http\"].includes(server.transport)\n  )\n    return \"Unsupported transport: \" + server.transport;\n  if (server.requiresConfiguration || server.endpoint.includes(\"{\"))\n    return \"Requires custom connection configuration\";\n  const endpoint = mcpEndpointIdentity(server.endpoint);\n  if (!endpoint?.startsWith(\"https://\")) return \"Requires a valid HTTPS endpoint\";\n  return null;\n}\n"],"mappings":";AACO,SAAS,oBAAoB,OAAiD;AACnF,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,QAAI,CAAC,CAAC,UAAU,OAAO,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,SAAU,QAAO;AACxF,QAAI,OAAO;AACX,WAAO,IAAI;AAAA,EACb,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,2BAA2B,QAIzB;AAChB,MAAI,OAAO,cAAc,WAAW,CAAC,OAAO,SAAU,QAAO;AAC7D,MACE,OAAO,aACP,CAAC,CAAC,QAAQ,mBAAmB,iBAAiB,EAAE,SAAS,OAAO,SAAS;AAEzE,WAAO,4BAA4B,OAAO;AAC5C,MAAI,OAAO,yBAAyB,OAAO,SAAS,SAAS,GAAG;AAC9D,WAAO;AACT,QAAM,WAAW,oBAAoB,OAAO,QAAQ;AACpD,MAAI,CAAC,UAAU,WAAW,UAAU,EAAG,QAAO;AAC9C,SAAO;AACT;","names":[]}

package/dist/{chunk-FJBG5E4O.js → chunk-SIOU2K4U.js}

@@ -1,14 +1,3 @@
-import {
-  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_VERSION,
-  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
-  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
-  decodeSpreadsheetArtifactKernelProjection,
-  decodeSpreadsheetArtifactKernelQuery,
-  encodeSpreadsheetArtifactKernelProjection,
-  encodeSpreadsheetArtifactKernelQuery
-} from "./chunk-CADSX6UN.js";
 import {
   DOCUMENT_ARTIFACT_COMMAND_MAX_BYTES,
   DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,
@@ -45,22 +34,44 @@ import {
   encodePresentationArtifactQuery,
   encodePresentationArtifactQueryResponse
 } from "./chunk-D2HKF2EF.js";
+import {
+  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_VERSION,
+  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
+  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
+  decodeSpreadsheetArtifactKernelProjection,
+  decodeSpreadsheetArtifactKernelQuery,
+  encodeSpreadsheetArtifactKernelProjection,
+  encodeSpreadsheetArtifactKernelQuery
+} from "./chunk-Y3KNXVTD.js";
 import {
   SPREADSHEET_ARTIFACT_COMMAND_MAX_BYTES,
   SPREADSHEET_ARTIFACT_COMMAND_MAX_COMMANDS,
-  SPREADSHEET_ARTIFACT_COMMAND_VERSION,
   assertCanonicalSpreadsheetArtifactCommandBytes,
   decodeSpreadsheetArtifactCommandBatch,
   encodeSpreadsheetArtifactCommandBatch
-} from "./chunk-LSB7GRLG.js";
+} from "./chunk-TXTQIYCV.js";
+import {
+  COMMITTED_TRANSACTION_PROTOCOL_VERSION,
+  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
+  DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,
+  EDITABLE_ARTIFACT_LIVE_WIRE_VERSION,
+  EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,
+  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,
+  PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,
+  SPREADSHEET_ARTIFACT_COMMAND_VERSION,
+  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
+  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
+} from "./chunk-PX3VCKAU.js";
 
 // src/editable-artifact-codec-registry.ts
 var spreadsheet = Object.freeze({
   modality: "spreadsheet",
-  modelSchemaVersion: 1,
-  snapshotVersion: 1,
+  modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
+  snapshotVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,
   command: Object.freeze({
-    magic: "OGASC001",
+    magic: "OGASC002",
     version: SPREADSHEET_ARTIFACT_COMMAND_VERSION,
     maximumBytes: SPREADSHEET_ARTIFACT_COMMAND_MAX_BYTES,
     maximumCommands: SPREADSHEET_ARTIFACT_COMMAND_MAX_COMMANDS,
@@ -90,14 +101,14 @@ var spreadsheet = Object.freeze({
   }),
   concurrency: Object.freeze({
     semantics: "causal-crdt-v1",
-    collaborationEnvelope: "OGACO001",
+    collaborationEnvelope: "OGACO002",
     staleBaseMustBeRejected: false
   })
 });
 var document = Object.freeze({
   modality: "document",
-  modelSchemaVersion: 1,
-  snapshotVersion: 1,
+  modelSchemaVersion: DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
+  snapshotVersion: DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,
   command: Object.freeze({
     magic: "OGADC001",
     version: DOCUMENT_ARTIFACT_COMMAND_VERSION,
@@ -133,8 +144,8 @@ var document = Object.freeze({
 });
 var presentation = Object.freeze({
   modality: "presentation",
-  modelSchemaVersion: 1,
-  snapshotVersion: 1,
+  modelSchemaVersion: PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,
+  snapshotVersion: PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,
   command: Object.freeze({
     magic: "OGAPC001",
     version: PRESENTATION_ARTIFACT_COMMAND_VERSION,
@@ -171,6 +182,17 @@ var presentation = Object.freeze({
   })
 });
 var EDITABLE_ARTIFACT_CODEC_REGISTRY = Object.freeze({ spreadsheet, document, presentation });
+function currentEditableArtifactCompatibility(modality) {
+  const descriptor = EDITABLE_ARTIFACT_CODEC_REGISTRY[modality];
+  return Object.freeze({
+    modality,
+    liveProtocolVersion: EDITABLE_ARTIFACT_LIVE_WIRE_VERSION,
+    modelSchemaVersion: descriptor.modelSchemaVersion,
+    snapshotVersion: descriptor.snapshotVersion,
+    commandProtocolVersion: descriptor.command.version,
+    committedTransactionProtocolVersion: modality === "spreadsheet" ? COMMITTED_TRANSACTION_PROTOCOL_VERSION : EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION
+  });
+}
 function editableArtifactCodecFor(input) {
   const descriptor = EDITABLE_ARTIFACT_CODEC_REGISTRY[input.durableModality];
   if (!descriptor) throw new TypeError("unsupported durable editable artifact modality");
@@ -189,6 +211,7 @@ function editableArtifactCodecFor(input) {
 
 export {
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
+  currentEditableArtifactCompatibility,
   editableArtifactCodecFor
 };
-//# sourceMappingURL=chunk-FJBG5E4O.js.map
+//# sourceMappingURL=chunk-SIOU2K4U.js.map

package/dist/chunk-SIOU2K4U.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/editable-artifact-codec-registry.ts"],"sourcesContent":["import {\n  DOCUMENT_ARTIFACT_COMMAND_MAX_BYTES,\n  DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,\n  DOCUMENT_ARTIFACT_COMMAND_VERSION,\n  DOCUMENT_ARTIFACT_QUERY_MAX_BYTES,\n  DOCUMENT_ARTIFACT_QUERY_RESPONSE_MAX_BYTES,\n  DOCUMENT_ARTIFACT_QUERY_RESPONSE_VERSION,\n  DOCUMENT_ARTIFACT_QUERY_VERSION,\n  assertCanonicalDocumentArtifactCommandBytes,\n  assertCanonicalDocumentArtifactQueryBytes,\n  assertCanonicalDocumentArtifactQueryResponseBytes,\n  decodeDocumentArtifactCommandBatch,\n  decodeDocumentArtifactQuery,\n  decodeDocumentArtifactQueryResponse,\n  encodeDocumentArtifactCommandBatch,\n  encodeDocumentArtifactQuery,\n  encodeDocumentArtifactQueryResponse,\n} from \"./document-artifact-commands\";\nimport {\n  PRESENTATION_ARTIFACT_COMMAND_MAX_BYTES,\n  PRESENTATION_ARTIFACT_COMMAND_MAX_COMMANDS,\n  PRESENTATION_ARTIFACT_COMMAND_VERSION,\n  PRESENTATION_ARTIFACT_QUERY_MAX_BYTES,\n  PRESENTATION_ARTIFACT_QUERY_RESPONSE_MAX_BYTES,\n  PRESENTATION_ARTIFACT_QUERY_RESPONSE_VERSION,\n  PRESENTATION_ARTIFACT_QUERY_VERSION,\n  assertCanonicalPresentationArtifactCommandBytes,\n  assertCanonicalPresentationArtifactQueryBytes,\n  assertCanonicalPresentationArtifactQueryResponseBytes,\n  decodePresentationArtifactCommandBatch,\n  decodePresentationArtifactQuery,\n  decodePresentationArtifactQueryResponse,\n  encodePresentationArtifactCommandBatch,\n  encodePresentationArtifactQuery,\n  encodePresentationArtifactQueryResponse,\n} from \"./presentation-artifact-commands\";\nimport {\n  SPREADSHEET_ARTIFACT_COMMAND_MAX_BYTES,\n  SPREADSHEET_ARTIFACT_COMMAND_MAX_COMMANDS,\n  SPREADSHEET_ARTIFACT_COMMAND_VERSION,\n  assertCanonicalSpreadsheetArtifactCommandBytes,\n  decodeSpreadsheetArtifactCommandBatch,\n  encodeSpreadsheetArtifactCommandBatch,\n} from \"./spreadsheet-artifact-commands\";\nimport {\n  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,\n  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,\n  SPREADSHEET_ARTIFACT_QUERY_VERSION,\n  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,\n  assertCanonicalSpreadsheetArtifactKernelQueryBytes,\n  decodeSpreadsheetArtifactKernelProjection,\n  decodeSpreadsheetArtifactKernelQuery,\n  encodeSpreadsheetArtifactKernelProjection,\n  encodeSpreadsheetArtifactKernelQuery,\n} from \"./spreadsheet-artifact-query\";\nimport {\n  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,\n  DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,\n  EDITABLE_ARTIFACT_LIVE_WIRE_VERSION,\n  EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,\n  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,\n  PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,\n  COMMITTED_TRANSACTION_PROTOCOL_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n} from \"./editable-artifact-versions\";\n\nexport {\n  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,\n  DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,\n  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,\n  PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,\n  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n} from \"./editable-artifact-versions\";\n\nexport type EditableArtifactModality = \"spreadsheet\" | \"document\" | \"presentation\";\nexport type EditableArtifactConcurrencySemantics =\n  | \"causal-crdt-v1\"\n  | \"authoritative-serialized-stale-base-v1\";\n\nexport type CurrentEditableArtifactCompatibility = Readonly<{\n  modality: EditableArtifactModality;\n  liveProtocolVersion: number;\n  modelSchemaVersion: number;\n  snapshotVersion: number;\n  commandProtocolVersion: number;\n  committedTransactionProtocolVersion: number;\n}>;\n\nexport type EditableArtifactCodecDescriptor = Readonly<{\n  modality: EditableArtifactModality;\n  modelSchemaVersion: 1 | 2;\n  snapshotVersion: 1 | 2;\n  command: Readonly<{\n    magic: \"OGASC002\" | \"OGADC001\" | \"OGAPC001\";\n    version: 1 | 2;\n    maximumBytes: number;\n    maximumCommands: number;\n    encode: (value: unknown) => Uint8Array;\n    decode: (bytes: Uint8Array) => unknown;\n    assertCanonical: (bytes: Uint8Array) => void;\n  }>;\n  query: Readonly<{\n    magic: \"OGAKQ001\" | \"OGADQ001\" | \"OGAPQ001\";\n    responseMagic: \"OGAKV001\" | \"OGADP001\" | \"OGAPV001\";\n    version: 1;\n    responseVersion: 1;\n    maximumBytes: number;\n    maximumResponseBytes: number;\n    encode: (value: unknown) => Uint8Array;\n    decode: (bytes: Uint8Array) => unknown;\n    assertCanonical: (bytes: Uint8Array) => void;\n    encodeResponse: (value: unknown) => Uint8Array;\n    decodeResponse: (bytes: Uint8Array) => unknown;\n    assertCanonicalResponse: (bytes: Uint8Array) => void;\n  }>;\n  concurrency: Readonly<{\n    semantics: EditableArtifactConcurrencySemantics;\n    collaborationEnvelope: \"OGACO002\" | null;\n    staleBaseMustBeRejected: boolean;\n  }>;\n}>;\n\nconst spreadsheet = Object.freeze({\n  modality: \"spreadsheet\",\n  modelSchemaVersion: SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,\n  snapshotVersion: SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,\n  command: Object.freeze({\n    magic: \"OGASC002\",\n    version: SPREADSHEET_ARTIFACT_COMMAND_VERSION,\n    maximumBytes: SPREADSHEET_ARTIFACT_COMMAND_MAX_BYTES,\n    maximumCommands: SPREADSHEET_ARTIFACT_COMMAND_MAX_COMMANDS,\n    encode: (value: unknown) =>\n      encodeSpreadsheetArtifactCommandBatch(\n        value as Parameters<typeof encodeSpreadsheetArtifactCommandBatch>[0],\n      ),\n    decode: decodeSpreadsheetArtifactCommandBatch,\n    assertCanonical: assertCanonicalSpreadsheetArtifactCommandBytes,\n  }),\n  query: Object.freeze({\n    magic: \"OGAKQ001\",\n    responseMagic: \"OGAKV001\",\n    version: SPREADSHEET_ARTIFACT_QUERY_VERSION,\n    responseVersion: SPREADSHEET_ARTIFACT_QUERY_VERSION,\n    maximumBytes: SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,\n    maximumResponseBytes: SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,\n    encode: (value: unknown) =>\n      encodeSpreadsheetArtifactKernelQuery(\n        value as Parameters<typeof encodeSpreadsheetArtifactKernelQuery>[0],\n      ),\n    decode: decodeSpreadsheetArtifactKernelQuery,\n    assertCanonical: assertCanonicalSpreadsheetArtifactKernelQueryBytes,\n    encodeResponse: (value: unknown) =>\n      encodeSpreadsheetArtifactKernelProjection(\n        value as Parameters<typeof encodeSpreadsheetArtifactKernelProjection>[0],\n      ),\n    decodeResponse: decodeSpreadsheetArtifactKernelProjection,\n    assertCanonicalResponse: assertCanonicalSpreadsheetArtifactKernelProjectionBytes,\n  }),\n  concurrency: Object.freeze({\n    semantics: \"causal-crdt-v1\",\n    collaborationEnvelope: \"OGACO002\",\n    staleBaseMustBeRejected: false,\n  }),\n}) satisfies EditableArtifactCodecDescriptor;\n\nconst document = Object.freeze({\n  modality: \"document\",\n  modelSchemaVersion: DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,\n  snapshotVersion: DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,\n  command: Object.freeze({\n    magic: \"OGADC001\",\n    version: DOCUMENT_ARTIFACT_COMMAND_VERSION,\n    maximumBytes: DOCUMENT_ARTIFACT_COMMAND_MAX_BYTES,\n    maximumCommands: DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,\n    encode: (value: unknown) =>\n      encodeDocumentArtifactCommandBatch(\n        value as Parameters<typeof encodeDocumentArtifactCommandBatch>[0],\n      ),\n    decode: decodeDocumentArtifactCommandBatch,\n    assertCanonical: assertCanonicalDocumentArtifactCommandBytes,\n  }),\n  query: Object.freeze({\n    magic: \"OGADQ001\",\n    responseMagic: \"OGADP001\",\n    version: DOCUMENT_ARTIFACT_QUERY_VERSION,\n    responseVersion: DOCUMENT_ARTIFACT_QUERY_RESPONSE_VERSION,\n    maximumBytes: DOCUMENT_ARTIFACT_QUERY_MAX_BYTES,\n    maximumResponseBytes: DOCUMENT_ARTIFACT_QUERY_RESPONSE_MAX_BYTES,\n    encode: (value: unknown) =>\n      encodeDocumentArtifactQuery(value as Parameters<typeof encodeDocumentArtifactQuery>[0]),\n    decode: decodeDocumentArtifactQuery,\n    assertCanonical: assertCanonicalDocumentArtifactQueryBytes,\n    encodeResponse: (value: unknown) =>\n      encodeDocumentArtifactQueryResponse(\n        value as Parameters<typeof encodeDocumentArtifactQueryResponse>[0],\n      ),\n    decodeResponse: decodeDocumentArtifactQueryResponse,\n    assertCanonicalResponse: assertCanonicalDocumentArtifactQueryResponseBytes,\n  }),\n  concurrency: Object.freeze({\n    semantics: \"authoritative-serialized-stale-base-v1\",\n    collaborationEnvelope: null,\n    staleBaseMustBeRejected: true,\n  }),\n}) satisfies EditableArtifactCodecDescriptor;\n\nconst presentation = Object.freeze({\n  modality: \"presentation\",\n  modelSchemaVersion: PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,\n  snapshotVersion: PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,\n  command: Object.freeze({\n    magic: \"OGAPC001\",\n    version: PRESENTATION_ARTIFACT_COMMAND_VERSION,\n    maximumBytes: PRESENTATION_ARTIFACT_COMMAND_MAX_BYTES,\n    maximumCommands: PRESENTATION_ARTIFACT_COMMAND_MAX_COMMANDS,\n    encode: (value: unknown) =>\n      encodePresentationArtifactCommandBatch(\n        value as Parameters<typeof encodePresentationArtifactCommandBatch>[0],\n      ),\n    decode: decodePresentationArtifactCommandBatch,\n    assertCanonical: assertCanonicalPresentationArtifactCommandBytes,\n  }),\n  query: Object.freeze({\n    magic: \"OGAPQ001\",\n    responseMagic: \"OGAPV001\",\n    version: PRESENTATION_ARTIFACT_QUERY_VERSION,\n    responseVersion: PRESENTATION_ARTIFACT_QUERY_RESPONSE_VERSION,\n    maximumBytes: PRESENTATION_ARTIFACT_QUERY_MAX_BYTES,\n    maximumResponseBytes: PRESENTATION_ARTIFACT_QUERY_RESPONSE_MAX_BYTES,\n    encode: (value: unknown) =>\n      encodePresentationArtifactQuery(\n        value as Parameters<typeof encodePresentationArtifactQuery>[0],\n      ),\n    decode: decodePresentationArtifactQuery,\n    assertCanonical: assertCanonicalPresentationArtifactQueryBytes,\n    encodeResponse: (value: unknown) =>\n      encodePresentationArtifactQueryResponse(\n        value as Parameters<typeof encodePresentationArtifactQueryResponse>[0],\n      ),\n    decodeResponse: decodePresentationArtifactQueryResponse,\n    assertCanonicalResponse: assertCanonicalPresentationArtifactQueryResponseBytes,\n  }),\n  concurrency: Object.freeze({\n    semantics: \"authoritative-serialized-stale-base-v1\",\n    collaborationEnvelope: null,\n    staleBaseMustBeRejected: true,\n  }),\n}) satisfies EditableArtifactCodecDescriptor;\n\nexport const EDITABLE_ARTIFACT_CODEC_REGISTRY: Readonly<\n  Record<EditableArtifactModality, EditableArtifactCodecDescriptor>\n> = Object.freeze({ spreadsheet, document, presentation });\n\n/** One exact current compatibility tuple per durable modality. */\nexport function currentEditableArtifactCompatibility(\n  modality: EditableArtifactModality,\n): CurrentEditableArtifactCompatibility {\n  const descriptor = EDITABLE_ARTIFACT_CODEC_REGISTRY[modality];\n  return Object.freeze({\n    modality,\n    liveProtocolVersion: EDITABLE_ARTIFACT_LIVE_WIRE_VERSION,\n    modelSchemaVersion: descriptor.modelSchemaVersion,\n    snapshotVersion: descriptor.snapshotVersion,\n    commandProtocolVersion: descriptor.command.version,\n    committedTransactionProtocolVersion:\n      modality === \"spreadsheet\"\n        ? COMMITTED_TRANSACTION_PROTOCOL_VERSION\n        : EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,\n  });\n}\n\n/**\n * Selects solely from the durable artifact modality plus persisted versions.\n * Modality intentionally never enters OGATX001: the durable artifact row is\n * authoritative and prevents client-controlled cross-modality decoding.\n */\nexport function editableArtifactCodecFor(\n  input: Readonly<{\n    durableModality: EditableArtifactModality;\n    modelSchemaVersion: number;\n    commandProtocolVersion: number;\n  }>,\n): EditableArtifactCodecDescriptor {\n  const descriptor = EDITABLE_ARTIFACT_CODEC_REGISTRY[input.durableModality];\n  if (!descriptor) throw new TypeError(\"unsupported durable editable artifact modality\");\n  if (input.modelSchemaVersion !== descriptor.modelSchemaVersion) {\n    throw new TypeError(\n      \"editable artifact model schema version is incompatible with its durable modality\",\n    );\n  }\n  if (input.commandProtocolVersion !== descriptor.command.version) {\n    throw new TypeError(\n      \"editable artifact command protocol version is incompatible with its durable modality\",\n    );\n  }\n  return descriptor;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4HA,IAAM,cAAc,OAAO,OAAO;AAAA,EAChC,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,SAAS,OAAO,OAAO;AAAA,IACrB,OAAO;AAAA,IACP,SAAS;AAAA,IACT,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,QAAQ,CAAC,UACP;AAAA,MACE;AAAA,IACF;AAAA,IACF,QAAQ;AAAA,IACR,iBAAiB;AAAA,EACnB,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,IACnB,OAAO;AAAA,IACP,eAAe;AAAA,IACf,SAAS;AAAA,IACT,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,sBAAsB;AAAA,IACtB,QAAQ,CAAC,UACP;AAAA,MACE;AAAA,IACF;AAAA,IACF,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,gBAAgB,CAAC,UACf;AAAA,MACE;AAAA,IACF;AAAA,IACF,gBAAgB;AAAA,IAChB,yBAAyB;AAAA,EAC3B,CAAC;AAAA,EACD,aAAa,OAAO,OAAO;AAAA,IACzB,WAAW;AAAA,IACX,uBAAuB;AAAA,IACvB,yBAAyB;AAAA,EAC3B,CAAC;AACH,CAAC;AAED,IAAM,WAAW,OAAO,OAAO;AAAA,EAC7B,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,SAAS,OAAO,OAAO;AAAA,IACrB,OAAO;AAAA,IACP,SAAS;AAAA,IACT,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,QAAQ,CAAC,UACP;AAAA,MACE;AAAA,IACF;AAAA,IACF,QAAQ;AAAA,IACR,iBAAiB;AAAA,EACnB,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,IACnB,OAAO;AAAA,IACP,eAAe;AAAA,IACf,SAAS;AAAA,IACT,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,sBAAsB;AAAA,IACtB,QAAQ,CAAC,UACP,4BAA4B,KAA0D;AAAA,IACxF,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,gBAAgB,CAAC,UACf;AAAA,MACE;AAAA,IACF;AAAA,IACF,gBAAgB;AAAA,IAChB,yBAAyB;AAAA,EAC3B,CAAC;AAAA,EACD,aAAa,OAAO,OAAO;AAAA,IACzB,WAAW;AAAA,IACX,uBAAuB;AAAA,IACvB,yBAAyB;AAAA,EAC3B,CAAC;AACH,CAAC;AAED,IAAM,eAAe,OAAO,OAAO;AAAA,EACjC,UAAU;AAAA,EACV,oBAAoB;AAAA,EACpB,iBAAiB;AAAA,EACjB,SAAS,OAAO,OAAO;AAAA,IACrB,OAAO;AAAA,IACP,SAAS;AAAA,IACT,cAAc;AAAA,IACd,iBAAiB;AAAA,IACjB,QAAQ,CAAC,UACP;AAAA,MACE;AAAA,IACF;AAAA,IACF,QAAQ;AAAA,IACR,iBAAiB;AAAA,EACnB,CAAC;AAAA,EACD,OAAO,OAAO,OAAO;AAAA,IACnB,OAAO;AAAA,IACP,eAAe;AAAA,IACf,SAAS;AAAA,IACT,iBAAiB;AAAA,IACjB,cAAc;AAAA,IACd,sBAAsB;AAAA,IACtB,QAAQ,CAAC,UACP;AAAA,MACE;AAAA,IACF;AAAA,IACF,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,gBAAgB,CAAC,UACf;AAAA,MACE;AAAA,IACF;AAAA,IACF,gBAAgB;AAAA,IAChB,yBAAyB;AAAA,EAC3B,CAAC;AAAA,EACD,aAAa,OAAO,OAAO;AAAA,IACzB,WAAW;AAAA,IACX,uBAAuB;AAAA,IACvB,yBAAyB;AAAA,EAC3B,CAAC;AACH,CAAC;AAEM,IAAM,mCAET,OAAO,OAAO,EAAE,aAAa,UAAU,aAAa,CAAC;AAGlD,SAAS,qCACd,UACsC;AACtC,QAAM,aAAa,iCAAiC,QAAQ;AAC5D,SAAO,OAAO,OAAO;AAAA,IACnB;AAAA,IACA,qBAAqB;AAAA,IACrB,oBAAoB,WAAW;AAAA,IAC/B,iBAAiB,WAAW;AAAA,IAC5B,wBAAwB,WAAW,QAAQ;AAAA,IAC3C,qCACE,aAAa,gBACT,yCACA;AAAA,EACR,CAAC;AACH;AAOO,SAAS,yBACd,OAKiC;AACjC,QAAM,aAAa,iCAAiC,MAAM,eAAe;AACzE,MAAI,CAAC,WAAY,OAAM,IAAI,UAAU,gDAAgD;AACrF,MAAI,MAAM,uBAAuB,WAAW,oBAAoB;AAC9D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,MAAM,2BAA2B,WAAW,QAAQ,SAAS;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-TSCDAGET.js

@@ -0,0 +1,75 @@
+// src/organization-usage.ts
+import { z } from "zod";
+var OrganizationUsagePeriod = z.enum(["today", "week", "month", "ytd"]);
+var OrganizationUsageQuery = z.object({
+  period: OrganizationUsagePeriod.default("month")
+});
+var OrganizationUsageWorkspacePageQuery = OrganizationUsageQuery.extend({
+  until: z.string().datetime(),
+  afterWorkspaceId: z.string().uuid().optional()
+});
+var OrganizationUsageTotal = z.object({
+  eventType: z.string(),
+  unit: z.string(),
+  quantity: z.string().regex(/^-?\d+$/),
+  eventCount: z.string().regex(/^\d+$/)
+});
+var OrganizationUsagePersonalWorkspace = z.object({
+  membershipId: z.string().uuid(),
+  totals: z.array(OrganizationUsageTotal)
+});
+var OrganizationUsageSummary = z.object({
+  accountId: z.string().uuid(),
+  period: OrganizationUsagePeriod,
+  since: z.string().datetime(),
+  until: z.string().datetime(),
+  granularity: z.enum(["hour", "day"]),
+  totals: z.array(OrganizationUsageTotal),
+  buckets: z.array(z.object({ bucket: z.string(), totals: z.array(OrganizationUsageTotal) })),
+  workspaces: z.array(
+    z.object({
+      workspaceId: z.string().uuid(),
+      name: z.string().nullable(),
+      totals: z.array(OrganizationUsageTotal)
+    })
+  ).max(50),
+  nextWorkspaceCursor: z.string().uuid().nullable(),
+  /**
+   * Usage in each member's Personal workspace, keyed by the owner's
+   * organization membership: amounts only, never the workspace's id, name or
+   * content. Only Personal workspaces with usage in the period, the 50 that
+   * spent the most. Absent before migration 0543, hence the defaults.
+   */
+  personalWorkspaces: z.array(OrganizationUsagePersonalWorkspace).max(50).default([]),
+  /** How many Personal workspaces had usage in the period, listed or not. */
+  personalWorkspaceCount: z.number().int().nonnegative().default(0),
+  /** Other people's Only-me chats in shared workspaces: member amounts only. */
+  privateChats: z.array(
+    z.object({
+      workspaceId: z.string().uuid(),
+      membershipId: z.string().uuid().nullable(),
+      name: z.string().nullable(),
+      totals: z.array(OrganizationUsageTotal)
+    })
+  ).default([]),
+  privateChatsTruncated: z.boolean().default(false)
+});
+var OrganizationUsageWorkspacePage = OrganizationUsageSummary.omit({
+  totals: true,
+  buckets: true,
+  personalWorkspaces: true,
+  personalWorkspaceCount: true,
+  privateChats: true,
+  privateChatsTruncated: true
+});
+
+export {
+  OrganizationUsagePeriod,
+  OrganizationUsageQuery,
+  OrganizationUsageWorkspacePageQuery,
+  OrganizationUsageTotal,
+  OrganizationUsagePersonalWorkspace,
+  OrganizationUsageSummary,
+  OrganizationUsageWorkspacePage
+};
+//# sourceMappingURL=chunk-TSCDAGET.js.map

package/dist/chunk-TSCDAGET.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/organization-usage.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const OrganizationUsagePeriod = z.enum([\"today\", \"week\", \"month\", \"ytd\"]);\nexport type OrganizationUsagePeriod = z.infer<typeof OrganizationUsagePeriod>;\nexport const OrganizationUsageQuery = z.object({\n  period: OrganizationUsagePeriod.default(\"month\"),\n});\nexport const OrganizationUsageWorkspacePageQuery = OrganizationUsageQuery.extend({\n  until: z.string().datetime(),\n  afterWorkspaceId: z.string().uuid().optional(),\n});\n// PostgreSQL SUM(bigint) must never pass through a JavaScript number.\nexport const OrganizationUsageTotal = z.object({\n  eventType: z.string(),\n  unit: z.string(),\n  quantity: z.string().regex(/^-?\\d+$/),\n  eventCount: z.string().regex(/^\\d+$/),\n});\n/** One member's Personal workspace, as usage only. */\nexport const OrganizationUsagePersonalWorkspace = z.object({\n  membershipId: z.string().uuid(),\n  totals: z.array(OrganizationUsageTotal),\n});\nexport type OrganizationUsagePersonalWorkspace = z.infer<typeof OrganizationUsagePersonalWorkspace>;\nexport const OrganizationUsageSummary = z.object({\n  accountId: z.string().uuid(),\n  period: OrganizationUsagePeriod,\n  since: z.string().datetime(),\n  until: z.string().datetime(),\n  granularity: z.enum([\"hour\", \"day\"]),\n  totals: z.array(OrganizationUsageTotal),\n  buckets: z.array(z.object({ bucket: z.string(), totals: z.array(OrganizationUsageTotal) })),\n  workspaces: z\n    .array(\n      z.object({\n        workspaceId: z.string().uuid(),\n        name: z.string().nullable(),\n        totals: z.array(OrganizationUsageTotal),\n      }),\n    )\n    .max(50),\n  nextWorkspaceCursor: z.string().uuid().nullable(),\n  /**\n   * Usage in each member's Personal workspace, keyed by the owner's\n   * organization membership: amounts only, never the workspace's id, name or\n   * content. Only Personal workspaces with usage in the period, the 50 that\n   * spent the most. Absent before migration 0543, hence the defaults.\n   */\n  personalWorkspaces: z.array(OrganizationUsagePersonalWorkspace).max(50).default([]),\n  /** How many Personal workspaces had usage in the period, listed or not. */\n  personalWorkspaceCount: z.number().int().nonnegative().default(0),\n  /** Other people's Only-me chats in shared workspaces: member amounts only. */\n  privateChats: z\n    .array(\n      z.object({\n        workspaceId: z.string().uuid(),\n        membershipId: z.string().uuid().nullable(),\n        name: z.string().nullable(),\n        totals: z.array(OrganizationUsageTotal),\n      }),\n    )\n    .default([]),\n  privateChatsTruncated: z.boolean().default(false),\n});\nexport type OrganizationUsageSummary = z.infer<typeof OrganizationUsageSummary>;\n\n/**\n * A page deliberately excludes totals, charts and Personal rows: those are not\n * recomputed. Pages continue the shared workspaces only.\n */\nexport const OrganizationUsageWorkspacePage = OrganizationUsageSummary.omit({\n  totals: true,\n  buckets: true,\n  personalWorkspaces: true,\n  personalWorkspaceCount: true,\n  privateChats: true,\n  privateChatsTruncated: true,\n});\nexport type OrganizationUsageWorkspacePage = z.infer<typeof OrganizationUsageWorkspacePage>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,0BAA0B,EAAE,KAAK,CAAC,SAAS,QAAQ,SAAS,KAAK,CAAC;AAExE,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,QAAQ,wBAAwB,QAAQ,OAAO;AACjD,CAAC;AACM,IAAM,sCAAsC,uBAAuB,OAAO;AAAA,EAC/E,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC/C,CAAC;AAEM,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,WAAW,EAAE,OAAO;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,UAAU,EAAE,OAAO,EAAE,MAAM,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,MAAM,OAAO;AACtC,CAAC;AAEM,IAAM,qCAAqC,EAAE,OAAO;AAAA,EACzD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,QAAQ,EAAE,MAAM,sBAAsB;AACxC,CAAC;AAEM,IAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ;AAAA,EACR,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3B,aAAa,EAAE,KAAK,CAAC,QAAQ,KAAK,CAAC;AAAA,EACnC,QAAQ,EAAE,MAAM,sBAAsB;AAAA,EACtC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,QAAQ,EAAE,MAAM,sBAAsB,EAAE,CAAC,CAAC;AAAA,EAC1F,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,MAC7B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,QAAQ,EAAE,MAAM,sBAAsB;AAAA,IACxC,CAAC;AAAA,EACH,EACC,IAAI,EAAE;AAAA,EACT,qBAAqB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOhD,oBAAoB,EAAE,MAAM,kCAAkC,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;AAAA;AAAA,EAElF,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC;AAAA;AAAA,EAEhE,cAAc,EACX;AAAA,IACC,EAAE,OAAO;AAAA,MACP,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,MAC7B,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,MACzC,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,MAC1B,QAAQ,EAAE,MAAM,sBAAsB;AAAA,IACxC,CAAC;AAAA,EACH,EACC,QAAQ,CAAC,CAAC;AAAA,EACb,uBAAuB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAClD,CAAC;AAOM,IAAM,iCAAiC,yBAAyB,KAAK;AAAA,EAC1E,QAAQ;AAAA,EACR,SAAS;AAAA,EACT,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,cAAc;AAAA,EACd,uBAAuB;AACzB,CAAC;","names":[]}