@opengeni/contracts 0.44.1 → 1.0.0

package/dist/chunk-BCS7WHCK.js

@@ -0,0 +1,139 @@
+// src/organization-recovery.ts
+import { z } from "zod";
+var Uuid = z.string().uuid();
+var Timestamp = z.string().datetime({ offset: true });
+var OrganizationRecoveryPolicyState = z.enum([
+  "pending_acceptance",
+  "active",
+  "degraded",
+  "superseded",
+  "disabled"
+]);
+var OrganizationRecoveryOperationState = z.enum([
+  "collecting",
+  "cooling",
+  "executed",
+  "cancelled",
+  "expired",
+  "superseded"
+]);
+var OrganizationRecoveryUnavailableReason = z.enum([
+  "no_policy",
+  "pending_acceptance",
+  "degraded",
+  "disabled",
+  "identity_unavailable"
+]);
+var OrganizationRecoveryMemberSummary = z.object({
+  membershipId: Uuid,
+  name: z.string().trim().min(1).max(1024).nullable(),
+  email: z.string().email().max(320).nullable()
+}).strict();
+var OrganizationRecoveryCustodian = OrganizationRecoveryMemberSummary.extend({
+  ordinal: z.number().int().min(1).max(3),
+  enrollmentState: z.enum(["pending_acceptance", "accepted", "ineligible"]),
+  acceptedAt: Timestamp.nullable()
+}).strict();
+var OrganizationRecoveryPolicy = z.object({
+  id: Uuid,
+  organizationId: Uuid,
+  revision: z.number().int().positive(),
+  state: OrganizationRecoveryPolicyState,
+  custodians: z.array(OrganizationRecoveryCustodian).length(3),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}).strict();
+var OrganizationRecoveryApproval = OrganizationRecoveryMemberSummary.extend({
+  approvedAt: Timestamp
+}).strict();
+var OrganizationRecoveryOperation = z.object({
+  id: Uuid,
+  organizationId: Uuid,
+  policyId: Uuid,
+  policyRevision: z.number().int().positive(),
+  revision: z.number().int().positive(),
+  state: OrganizationRecoveryOperationState,
+  target: OrganizationRecoveryMemberSummary,
+  approvals: z.array(OrganizationRecoveryApproval).max(3),
+  approvalCount: z.number().int().min(0).max(3),
+  quorumAt: Timestamp.nullable(),
+  executableAt: Timestamp.nullable(),
+  expiresAt: Timestamp,
+  executedAt: Timestamp.nullable(),
+  cancelledAt: Timestamp.nullable(),
+  notificationJournaled: z.boolean(),
+  createdAt: Timestamp,
+  updatedAt: Timestamp
+}).strict();
+var OrganizationRecoveryCapabilities = z.object({
+  configure: z.boolean(),
+  accept: z.boolean(),
+  disable: z.boolean(),
+  start: z.boolean(),
+  approve: z.boolean(),
+  cancel: z.boolean(),
+  execute: z.boolean()
+}).strict();
+var OrganizationRecoveryOverview = z.object({
+  organizationId: Uuid,
+  availability: z.enum(["available", "recovery_unavailable"]),
+  unavailableReason: OrganizationRecoveryUnavailableReason.nullable(),
+  recentReauthenticationAt: Timestamp.nullable(),
+  eligibleMembers: z.array(OrganizationRecoveryMemberSummary).max(1e3),
+  policy: OrganizationRecoveryPolicy.nullable(),
+  operation: OrganizationRecoveryOperation.nullable(),
+  capabilities: OrganizationRecoveryCapabilities
+}).strict();
+var ExpectedPolicyRevision = z.number().int().nonnegative();
+var ExpectedOperationRevision = z.number().int().positive();
+var CommandOperationId = Uuid;
+var ConfigureOrganizationRecoveryPolicyRequest = z.object({
+  custodianMembershipIds: z.tuple([Uuid, Uuid, Uuid]).superRefine((ids, context) => {
+    if (new Set(ids).size !== 3) {
+      context.addIssue({
+        code: "custom",
+        message: "recovery custodians must be three distinct memberships"
+      });
+    }
+  }),
+  expectedPolicyRevision: ExpectedPolicyRevision,
+  operationId: CommandOperationId
+}).strict();
+var AcceptOrganizationRecoveryCustodyRequest = z.object({
+  expectedPolicyRevision: ExpectedPolicyRevision,
+  operationId: CommandOperationId
+}).strict();
+var DisableOrganizationRecoveryPolicyRequest = AcceptOrganizationRecoveryCustodyRequest;
+var StartOrganizationRecoveryOperationRequest = z.object({
+  targetMembershipId: Uuid,
+  expectedPolicyRevision: z.number().int().positive(),
+  operationId: CommandOperationId
+}).strict();
+var OrganizationRecoveryOperationCommandRequest = z.object({
+  expectedOperationRevision: ExpectedOperationRevision,
+  operationId: CommandOperationId
+}).strict();
+var OrganizationRecoveryMutationResponse = z.object({
+  replay: z.boolean(),
+  overview: OrganizationRecoveryOverview
+}).strict();
+
+export {
+  OrganizationRecoveryPolicyState,
+  OrganizationRecoveryOperationState,
+  OrganizationRecoveryUnavailableReason,
+  OrganizationRecoveryMemberSummary,
+  OrganizationRecoveryCustodian,
+  OrganizationRecoveryPolicy,
+  OrganizationRecoveryApproval,
+  OrganizationRecoveryOperation,
+  OrganizationRecoveryCapabilities,
+  OrganizationRecoveryOverview,
+  ConfigureOrganizationRecoveryPolicyRequest,
+  AcceptOrganizationRecoveryCustodyRequest,
+  DisableOrganizationRecoveryPolicyRequest,
+  StartOrganizationRecoveryOperationRequest,
+  OrganizationRecoveryOperationCommandRequest,
+  OrganizationRecoveryMutationResponse
+};
+//# sourceMappingURL=chunk-BCS7WHCK.js.map

package/dist/chunk-BCS7WHCK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/organization-recovery.ts"],"sourcesContent":["import { z } from \"zod\";\n\nconst Uuid = z.string().uuid();\nconst Timestamp = z.string().datetime({ offset: true });\n\nexport const OrganizationRecoveryPolicyState = z.enum([\n  \"pending_acceptance\",\n  \"active\",\n  \"degraded\",\n  \"superseded\",\n  \"disabled\",\n]);\nexport type OrganizationRecoveryPolicyState = z.infer<typeof OrganizationRecoveryPolicyState>;\n\nexport const OrganizationRecoveryOperationState = z.enum([\n  \"collecting\",\n  \"cooling\",\n  \"executed\",\n  \"cancelled\",\n  \"expired\",\n  \"superseded\",\n]);\nexport type OrganizationRecoveryOperationState = z.infer<typeof OrganizationRecoveryOperationState>;\n\nexport const OrganizationRecoveryUnavailableReason = z.enum([\n  \"no_policy\",\n  \"pending_acceptance\",\n  \"degraded\",\n  \"disabled\",\n  \"identity_unavailable\",\n]);\nexport type OrganizationRecoveryUnavailableReason = z.infer<\n  typeof OrganizationRecoveryUnavailableReason\n>;\n\nexport const OrganizationRecoveryMemberSummary = z\n  .object({\n    membershipId: Uuid,\n    name: z.string().trim().min(1).max(1024).nullable(),\n    email: z.string().email().max(320).nullable(),\n  })\n  .strict();\nexport type OrganizationRecoveryMemberSummary = z.infer<typeof OrganizationRecoveryMemberSummary>;\n\nexport const OrganizationRecoveryCustodian = OrganizationRecoveryMemberSummary.extend({\n  ordinal: z.number().int().min(1).max(3),\n  enrollmentState: z.enum([\"pending_acceptance\", \"accepted\", \"ineligible\"]),\n  acceptedAt: Timestamp.nullable(),\n}).strict();\nexport type OrganizationRecoveryCustodian = z.infer<typeof OrganizationRecoveryCustodian>;\n\nexport const OrganizationRecoveryPolicy = z\n  .object({\n    id: Uuid,\n    organizationId: Uuid,\n    revision: z.number().int().positive(),\n    state: OrganizationRecoveryPolicyState,\n    custodians: z.array(OrganizationRecoveryCustodian).length(3),\n    createdAt: Timestamp,\n    updatedAt: Timestamp,\n  })\n  .strict();\nexport type OrganizationRecoveryPolicy = z.infer<typeof OrganizationRecoveryPolicy>;\n\nexport const OrganizationRecoveryApproval = OrganizationRecoveryMemberSummary.extend({\n  approvedAt: Timestamp,\n}).strict();\nexport type OrganizationRecoveryApproval = z.infer<typeof OrganizationRecoveryApproval>;\n\nexport const OrganizationRecoveryOperation = z\n  .object({\n    id: Uuid,\n    organizationId: Uuid,\n    policyId: Uuid,\n    policyRevision: z.number().int().positive(),\n    revision: z.number().int().positive(),\n    state: OrganizationRecoveryOperationState,\n    target: OrganizationRecoveryMemberSummary,\n    approvals: z.array(OrganizationRecoveryApproval).max(3),\n    approvalCount: z.number().int().min(0).max(3),\n    quorumAt: Timestamp.nullable(),\n    executableAt: Timestamp.nullable(),\n    expiresAt: Timestamp,\n    executedAt: Timestamp.nullable(),\n    cancelledAt: Timestamp.nullable(),\n    notificationJournaled: z.boolean(),\n    createdAt: Timestamp,\n    updatedAt: Timestamp,\n  })\n  .strict();\nexport type OrganizationRecoveryOperation = z.infer<typeof OrganizationRecoveryOperation>;\n\nexport const OrganizationRecoveryCapabilities = z\n  .object({\n    configure: z.boolean(),\n    accept: z.boolean(),\n    disable: z.boolean(),\n    start: z.boolean(),\n    approve: z.boolean(),\n    cancel: z.boolean(),\n    execute: z.boolean(),\n  })\n  .strict();\nexport type OrganizationRecoveryCapabilities = z.infer<typeof OrganizationRecoveryCapabilities>;\n\nexport const OrganizationRecoveryOverview = z\n  .object({\n    organizationId: Uuid,\n    availability: z.enum([\"available\", \"recovery_unavailable\"]),\n    unavailableReason: OrganizationRecoveryUnavailableReason.nullable(),\n    recentReauthenticationAt: Timestamp.nullable(),\n    eligibleMembers: z.array(OrganizationRecoveryMemberSummary).max(1000),\n    policy: OrganizationRecoveryPolicy.nullable(),\n    operation: OrganizationRecoveryOperation.nullable(),\n    capabilities: OrganizationRecoveryCapabilities,\n  })\n  .strict();\nexport type OrganizationRecoveryOverview = z.infer<typeof OrganizationRecoveryOverview>;\n\nconst ExpectedPolicyRevision = z.number().int().nonnegative();\nconst ExpectedOperationRevision = z.number().int().positive();\nconst CommandOperationId = Uuid;\n\nexport const ConfigureOrganizationRecoveryPolicyRequest = z\n  .object({\n    custodianMembershipIds: z.tuple([Uuid, Uuid, Uuid]).superRefine((ids, context) => {\n      if (new Set(ids).size !== 3) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"recovery custodians must be three distinct memberships\",\n        });\n      }\n    }),\n    expectedPolicyRevision: ExpectedPolicyRevision,\n    operationId: CommandOperationId,\n  })\n  .strict();\nexport type ConfigureOrganizationRecoveryPolicyRequest = z.infer<\n  typeof ConfigureOrganizationRecoveryPolicyRequest\n>;\n\nexport const AcceptOrganizationRecoveryCustodyRequest = z\n  .object({\n    expectedPolicyRevision: ExpectedPolicyRevision,\n    operationId: CommandOperationId,\n  })\n  .strict();\nexport type AcceptOrganizationRecoveryCustodyRequest = z.infer<\n  typeof AcceptOrganizationRecoveryCustodyRequest\n>;\n\nexport const DisableOrganizationRecoveryPolicyRequest = AcceptOrganizationRecoveryCustodyRequest;\nexport type DisableOrganizationRecoveryPolicyRequest = z.infer<\n  typeof DisableOrganizationRecoveryPolicyRequest\n>;\n\nexport const StartOrganizationRecoveryOperationRequest = z\n  .object({\n    targetMembershipId: Uuid,\n    expectedPolicyRevision: z.number().int().positive(),\n    operationId: CommandOperationId,\n  })\n  .strict();\nexport type StartOrganizationRecoveryOperationRequest = z.infer<\n  typeof StartOrganizationRecoveryOperationRequest\n>;\n\nexport const OrganizationRecoveryOperationCommandRequest = z\n  .object({\n    expectedOperationRevision: ExpectedOperationRevision,\n    operationId: CommandOperationId,\n  })\n  .strict();\nexport type OrganizationRecoveryOperationCommandRequest = z.infer<\n  typeof OrganizationRecoveryOperationCommandRequest\n>;\n\nexport const OrganizationRecoveryMutationResponse = z\n  .object({\n    replay: z.boolean(),\n    overview: OrganizationRecoveryOverview,\n  })\n  .strict();\nexport type OrganizationRecoveryMutationResponse = z.infer<\n  typeof OrganizationRecoveryMutationResponse\n>;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,IAAM,OAAO,EAAE,OAAO,EAAE,KAAK;AAC7B,IAAM,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAE/C,IAAM,kCAAkC,EAAE,KAAK;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,qCAAqC,EAAE,KAAK;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,wCAAwC,EAAE,KAAK;AAAA,EAC1D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,cAAc;AAAA,EACd,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,EAAE,SAAS;AAC9C,CAAC,EACA,OAAO;AAGH,IAAM,gCAAgC,kCAAkC,OAAO;AAAA,EACpF,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EACtC,iBAAiB,EAAE,KAAK,CAAC,sBAAsB,YAAY,YAAY,CAAC;AAAA,EACxE,YAAY,UAAU,SAAS;AACjC,CAAC,EAAE,OAAO;AAGH,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,gBAAgB;AAAA,EAChB,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,OAAO;AAAA,EACP,YAAY,EAAE,MAAM,6BAA6B,EAAE,OAAO,CAAC;AAAA,EAC3D,WAAW;AAAA,EACX,WAAW;AACb,CAAC,EACA,OAAO;AAGH,IAAM,+BAA+B,kCAAkC,OAAO;AAAA,EACnF,YAAY;AACd,CAAC,EAAE,OAAO;AAGH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,gBAAgB;AAAA,EAChB,UAAU;AAAA,EACV,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,WAAW,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAAA,EACtD,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC5C,UAAU,UAAU,SAAS;AAAA,EAC7B,cAAc,UAAU,SAAS;AAAA,EACjC,WAAW;AAAA,EACX,YAAY,UAAU,SAAS;AAAA,EAC/B,aAAa,UAAU,SAAS;AAAA,EAChC,uBAAuB,EAAE,QAAQ;AAAA,EACjC,WAAW;AAAA,EACX,WAAW;AACb,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ;AAAA,EACrB,QAAQ,EAAE,QAAQ;AAAA,EAClB,SAAS,EAAE,QAAQ;AAAA,EACnB,OAAO,EAAE,QAAQ;AAAA,EACjB,SAAS,EAAE,QAAQ;AAAA,EACnB,QAAQ,EAAE,QAAQ;AAAA,EAClB,SAAS,EAAE,QAAQ;AACrB,CAAC,EACA,OAAO;AAGH,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,gBAAgB;AAAA,EAChB,cAAc,EAAE,KAAK,CAAC,aAAa,sBAAsB,CAAC;AAAA,EAC1D,mBAAmB,sCAAsC,SAAS;AAAA,EAClE,0BAA0B,UAAU,SAAS;AAAA,EAC7C,iBAAiB,EAAE,MAAM,iCAAiC,EAAE,IAAI,GAAI;AAAA,EACpE,QAAQ,2BAA2B,SAAS;AAAA,EAC5C,WAAW,8BAA8B,SAAS;AAAA,EAClD,cAAc;AAChB,CAAC,EACA,OAAO;AAGV,IAAM,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAC5D,IAAM,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC5D,IAAM,qBAAqB;AAEpB,IAAM,6CAA6C,EACvD,OAAO;AAAA,EACN,wBAAwB,EAAE,MAAM,CAAC,MAAM,MAAM,IAAI,CAAC,EAAE,YAAY,CAAC,KAAK,YAAY;AAChF,QAAI,IAAI,IAAI,GAAG,EAAE,SAAS,GAAG;AAC3B,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAAA,EACD,wBAAwB;AAAA,EACxB,aAAa;AACf,CAAC,EACA,OAAO;AAKH,IAAM,2CAA2C,EACrD,OAAO;AAAA,EACN,wBAAwB;AAAA,EACxB,aAAa;AACf,CAAC,EACA,OAAO;AAKH,IAAM,2CAA2C;AAKjD,IAAM,4CAA4C,EACtD,OAAO;AAAA,EACN,oBAAoB;AAAA,EACpB,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClD,aAAa;AACf,CAAC,EACA,OAAO;AAKH,IAAM,8CAA8C,EACxD,OAAO;AAAA,EACN,2BAA2B;AAAA,EAC3B,aAAa;AACf,CAAC,EACA,OAAO;AAKH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,QAAQ,EAAE,QAAQ;AAAA,EAClB,UAAU;AACZ,CAAC,EACA,OAAO;","names":[]}

package/dist/chunk-EK7NDGFR.js

@@ -0,0 +1,128 @@
+// src/usage-allowances.ts
+import { z } from "zod";
+var AllowanceCredits = z.number().int().nonnegative().safe();
+var Version = z.number().int().nonnegative().safe();
+var Timestamp = z.string().datetime({ offset: true });
+var OperationId = z.string().min(1).max(256).refine(
+  (value) => value.trim().length > 0 && !value.includes("\0") && !/[\uD800-\uDFFF]/u.test(value) && new TextEncoder().encode(value).byteLength <= 256
+);
+var SubjectId = z.string().min(1).max(1024).refine((value) => !value.includes("\0"));
+var MemberAllowanceRule = z.union([
+  z.object({ share: z.number().finite().nonnegative() }).strict(),
+  z.object({ credits: AllowanceCredits }).strict(),
+  z.null()
+]);
+var MemberAllowanceDefault = z.union([
+  z.enum(["none", "equal_share"]),
+  z.object({ share: z.number().finite().nonnegative() }).strict(),
+  z.object({ credits: AllowanceCredits }).strict()
+]);
+var Thresholds = z.array(z.number().finite().positive().max(1)).max(16);
+var WorkspaceAllowanceConfig = z.object({
+  includedCredits: AllowanceCredits,
+  period: z.enum(["monthly", "none"]),
+  anchorDay: z.number().int().min(1).max(31).optional(),
+  memberDefault: MemberAllowanceDefault.optional(),
+  thresholds: z.object({ workspace: Thresholds.optional(), member: Thresholds.optional() }).strict().optional()
+}).strict();
+var WorkspaceAllowance = WorkspaceAllowanceConfig.extend({ version: Version.min(1) });
+var WorkspaceAllowanceState = z.object({ version: Version, config: WorkspaceAllowance.nullable() }).strict().refine((state) => state.config === null || state.config.version === state.version, {
+  message: "Allowance configuration and lifecycle versions must match",
+  path: ["config", "version"]
+});
+var SetWorkspaceAllowanceRequest = WorkspaceAllowanceConfig.extend({
+  expectedVersion: Version
+});
+var ClearWorkspaceAllowanceRequest = z.object({ expectedVersion: Version.min(1), operationId: OperationId.optional() }).strict();
+var ClearWorkspaceAllowanceResponse = z.object({ version: Version.min(1) }).strict();
+var GrantWorkspaceCreditsRequest = z.object({
+  operationId: OperationId,
+  credits: AllowanceCredits.positive(),
+  expiresAt: Timestamp.nullable().optional()
+}).strict();
+var WorkspaceCreditGrant = GrantWorkspaceCreditsRequest.extend({
+  remaining: AllowanceCredits,
+  expiresAt: Timestamp.nullable()
+});
+var SetMemberAllowanceRequest = z.object({
+  rule: MemberAllowanceRule,
+  expectedVersion: Version
+}).strict();
+var MemberAllowance = z.object({
+  subjectId: SubjectId,
+  rule: MemberAllowanceRule,
+  version: Version
+}).strict();
+var UsageAllowancePeriod = z.union([
+  z.literal("current"),
+  z.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/)
+]);
+var GetUsageRequest = z.object({
+  period: UsageAllowancePeriod.optional(),
+  limit: z.number().int().min(1).max(200).optional(),
+  cursor: z.string().min(1).max(2048).optional()
+}).strict();
+var GetMyUsageRequest = GetUsageRequest.pick({ period: true });
+var UsageAllowanceStatus = z.enum(["ok", "warning", "exhausted"]);
+var UsageAllowanceWindow = z.object({
+  start: Timestamp.nullable(),
+  end: Timestamp.nullable()
+}).strict();
+var Usage = z.object({
+  limit: AllowanceCredits.nullable(),
+  used: AllowanceCredits,
+  remaining: z.number().int().safe().nullable(),
+  /** Display this ratio rather than raw USD micros in human-facing products. */
+  fraction: z.number().finite().nonnegative().nullable(),
+  status: UsageAllowanceStatus,
+  resetsAt: Timestamp.nullable()
+});
+var WorkspaceAllowanceUsage = Usage.extend({
+  includedCredits: AllowanceCredits,
+  grantsRemaining: AllowanceCredits
+}).strict();
+var MemberAllowanceUsage = Usage.extend({
+  subjectId: SubjectId,
+  externalIdentity: z.object({ source: z.string(), externalId: z.string() }).strict().nullable(),
+  rule: MemberAllowanceRule,
+  version: Version
+}).strict();
+var WorkspaceUsageResponse = z.object({
+  period: UsageAllowanceWindow,
+  workspace: WorkspaceAllowanceUsage,
+  members: z.array(MemberAllowanceUsage),
+  nextCursor: z.string().nullable()
+}).strict();
+var AllowanceExhaustedRefusal = z.object({
+  code: z.literal("allowance_exhausted"),
+  scope: z.enum(["workspace", "member"]),
+  resetsAt: Timestamp.nullable(),
+  subjectId: SubjectId.optional(),
+  message: z.string()
+}).strict();
+
+export {
+  AllowanceCredits,
+  MemberAllowanceRule,
+  MemberAllowanceDefault,
+  WorkspaceAllowanceConfig,
+  WorkspaceAllowance,
+  WorkspaceAllowanceState,
+  SetWorkspaceAllowanceRequest,
+  ClearWorkspaceAllowanceRequest,
+  ClearWorkspaceAllowanceResponse,
+  GrantWorkspaceCreditsRequest,
+  WorkspaceCreditGrant,
+  SetMemberAllowanceRequest,
+  MemberAllowance,
+  UsageAllowancePeriod,
+  GetUsageRequest,
+  GetMyUsageRequest,
+  UsageAllowanceStatus,
+  UsageAllowanceWindow,
+  WorkspaceAllowanceUsage,
+  MemberAllowanceUsage,
+  WorkspaceUsageResponse,
+  AllowanceExhaustedRefusal
+};
+//# sourceMappingURL=chunk-EK7NDGFR.js.map

package/dist/chunk-EK7NDGFR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/usage-allowances.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Credit amounts are integer USD micros (1 USD = 1,000,000), never floating-point dollars. */\nexport const AllowanceCredits = z.number().int().nonnegative().safe();\nconst Version = z.number().int().nonnegative().safe();\nconst Timestamp = z.string().datetime({ offset: true });\nconst OperationId = z\n  .string()\n  .min(1)\n  .max(256)\n  .refine(\n    (value) =>\n      value.trim().length > 0 &&\n      !value.includes(\"\\0\") &&\n      !/[\\uD800-\\uDFFF]/u.test(value) &&\n      new TextEncoder().encode(value).byteLength <= 256,\n  );\nconst SubjectId = z\n  .string()\n  .min(1)\n  .max(1024)\n  .refine((value) => !value.includes(\"\\0\"));\n\n/**\n * A share scales with the current workspace pool, including unexpired grants.\n * Shares may exceed 1 and their sum may exceed 1: they are ceilings, not reserved\n * allocations. Concurrent/in-flight calls can overshoot a ceiling; enforcement\n * happens before the next call, after actual usage is settled.\n * null removes the override and uses the workspace's memberDefault.\n */\nexport const MemberAllowanceRule = z.union([\n  z.object({ share: z.number().finite().nonnegative() }).strict(),\n  z.object({ credits: AllowanceCredits }).strict(),\n  z.null(),\n]);\nexport type MemberAllowanceRule = z.infer<typeof MemberAllowanceRule>;\n\nexport const MemberAllowanceDefault = z.union([\n  z.enum([\"none\", \"equal_share\"]),\n  z.object({ share: z.number().finite().nonnegative() }).strict(),\n  z.object({ credits: AllowanceCredits }).strict(),\n]);\nexport type MemberAllowanceDefault = z.infer<typeof MemberAllowanceDefault>;\n\nconst Thresholds = z.array(z.number().finite().positive().max(1)).max(16);\n/** Omitted threshold lists default to [0.8, 1]. Monthly boundaries are UTC. */\nexport const WorkspaceAllowanceConfig = z\n  .object({\n    includedCredits: AllowanceCredits,\n    period: z.enum([\"monthly\", \"none\"]),\n    anchorDay: z.number().int().min(1).max(31).optional(),\n    memberDefault: MemberAllowanceDefault.optional(),\n    thresholds: z\n      .object({ workspace: Thresholds.optional(), member: Thresholds.optional() })\n      .strict()\n      .optional(),\n  })\n  .strict();\nexport type WorkspaceAllowanceConfig = z.infer<typeof WorkspaceAllowanceConfig>;\n\nexport const WorkspaceAllowance = WorkspaceAllowanceConfig.extend({ version: Version.min(1) });\nexport type WorkspaceAllowance = z.infer<typeof WorkspaceAllowance>;\n/**\n * Lifecycle version survives clear. version=0 means never configured; a null\n * config with a positive version is cleared. Use this version for recreation.\n * The existing nullable configuration read remains unchanged.\n */\nexport const WorkspaceAllowanceState = z\n  .object({ version: Version, config: WorkspaceAllowance.nullable() })\n  .strict()\n  .refine((state) => state.config === null || state.config.version === state.version, {\n    message: \"Allowance configuration and lifecycle versions must match\",\n    path: [\"config\", \"version\"],\n  });\nexport type WorkspaceAllowanceState = z.infer<typeof WorkspaceAllowanceState>;\nexport const SetWorkspaceAllowanceRequest = WorkspaceAllowanceConfig.extend({\n  expectedVersion: Version,\n});\nexport type SetWorkspaceAllowanceRequest = z.infer<typeof SetWorkspaceAllowanceRequest>;\n/** Reuse operationId and the exact expectedVersion to recover a lost clear\n * receipt. A later lifecycle change conflicts; read the state before deciding\n * on a new mutation, never guess a version or change it for a retry. */\nexport const ClearWorkspaceAllowanceRequest = z\n  .object({ expectedVersion: Version.min(1), operationId: OperationId.optional() })\n  .strict();\nexport type ClearWorkspaceAllowanceRequest = z.infer<typeof ClearWorkspaceAllowanceRequest>;\nexport const ClearWorkspaceAllowanceResponse = z.object({ version: Version.min(1) }).strict();\nexport type ClearWorkspaceAllowanceResponse = z.infer<typeof ClearWorkspaceAllowanceResponse>;\n\n/** Reuse the operationId and exact request to recover an uncertain grant response. */\nexport const GrantWorkspaceCreditsRequest = z\n  .object({\n    operationId: OperationId,\n    credits: AllowanceCredits.positive(),\n    expiresAt: Timestamp.nullable().optional(),\n  })\n  .strict();\nexport type GrantWorkspaceCreditsRequest = z.infer<typeof GrantWorkspaceCreditsRequest>;\nexport const WorkspaceCreditGrant = GrantWorkspaceCreditsRequest.extend({\n  remaining: AllowanceCredits,\n  expiresAt: Timestamp.nullable(),\n});\nexport type WorkspaceCreditGrant = z.infer<typeof WorkspaceCreditGrant>;\n\nexport const SetMemberAllowanceRequest = z\n  .object({\n    rule: MemberAllowanceRule,\n    expectedVersion: Version,\n  })\n  .strict();\nexport type SetMemberAllowanceRequest = z.infer<typeof SetMemberAllowanceRequest>;\nexport const MemberAllowance = z\n  .object({\n    subjectId: SubjectId,\n    rule: MemberAllowanceRule,\n    version: Version,\n  })\n  .strict();\nexport type MemberAllowance = z.infer<typeof MemberAllowance>;\n\nexport const UsageAllowancePeriod = z.union([\n  z.literal(\"current\"),\n  z.string().regex(/^\\d{4}-(0[1-9]|1[0-2])$/),\n]);\nexport type UsageAllowancePeriod = z.infer<typeof UsageAllowancePeriod>;\nexport const GetUsageRequest = z\n  .object({\n    period: UsageAllowancePeriod.optional(),\n    limit: z.number().int().min(1).max(200).optional(),\n    cursor: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type GetUsageRequest = z.infer<typeof GetUsageRequest>;\nexport const GetMyUsageRequest = GetUsageRequest.pick({ period: true });\nexport type GetMyUsageRequest = z.infer<typeof GetMyUsageRequest>;\n\nexport const UsageAllowanceStatus = z.enum([\"ok\", \"warning\", \"exhausted\"]);\nexport type UsageAllowanceStatus = z.infer<typeof UsageAllowanceStatus>;\nexport const UsageAllowanceWindow = z\n  .object({\n    start: Timestamp.nullable(),\n    end: Timestamp.nullable(),\n  })\n  .strict();\nexport type UsageAllowanceWindow = z.infer<typeof UsageAllowanceWindow>;\nconst Usage = z.object({\n  limit: AllowanceCredits.nullable(),\n  used: AllowanceCredits,\n  remaining: z.number().int().safe().nullable(),\n  /** Display this ratio rather than raw USD micros in human-facing products. */\n  fraction: z.number().finite().nonnegative().nullable(),\n  status: UsageAllowanceStatus,\n  resetsAt: Timestamp.nullable(),\n});\nexport const WorkspaceAllowanceUsage = Usage.extend({\n  includedCredits: AllowanceCredits,\n  grantsRemaining: AllowanceCredits,\n}).strict();\nexport type WorkspaceAllowanceUsage = z.infer<typeof WorkspaceAllowanceUsage>;\nexport const MemberAllowanceUsage = Usage.extend({\n  subjectId: SubjectId,\n  externalIdentity: z.object({ source: z.string(), externalId: z.string() }).strict().nullable(),\n  rule: MemberAllowanceRule,\n  version: Version,\n}).strict();\nexport type MemberAllowanceUsage = z.infer<typeof MemberAllowanceUsage>;\n/** /usage/me returns only the authenticated subject's member row, never the roster. */\nexport const WorkspaceUsageResponse = z\n  .object({\n    period: UsageAllowanceWindow,\n    workspace: WorkspaceAllowanceUsage,\n    members: z.array(MemberAllowanceUsage),\n    nextCursor: z.string().nullable(),\n  })\n  .strict();\nexport type WorkspaceUsageResponse = z.infer<typeof WorkspaceUsageResponse>;\n\nexport const AllowanceExhaustedRefusal = z\n  .object({\n    code: z.literal(\"allowance_exhausted\"),\n    scope: z.enum([\"workspace\", \"member\"]),\n    resetsAt: Timestamp.nullable(),\n    subjectId: SubjectId.optional(),\n    message: z.string(),\n  })\n  .strict();\nexport type AllowanceExhaustedRefusal = z.infer<typeof AllowanceExhaustedRefusal>;\n"],"mappings":";AAAA,SAAS,SAAS;AAGX,IAAM,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AACpE,IAAM,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AACpD,IAAM,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,IAAM,cAAc,EACjB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,EACC,CAAC,UACC,MAAM,KAAK,EAAE,SAAS,KACtB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,cAAc;AAClD;AACF,IAAM,YAAY,EACf,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,OAAO,CAAC,UAAU,CAAC,MAAM,SAAS,IAAI,CAAC;AASnC,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO;AAAA,EAC9D,EAAE,OAAO,EAAE,SAAS,iBAAiB,CAAC,EAAE,OAAO;AAAA,EAC/C,EAAE,KAAK;AACT,CAAC;AAGM,IAAM,yBAAyB,EAAE,MAAM;AAAA,EAC5C,EAAE,KAAK,CAAC,QAAQ,aAAa,CAAC;AAAA,EAC9B,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO;AAAA,EAC9D,EAAE,OAAO,EAAE,SAAS,iBAAiB,CAAC,EAAE,OAAO;AACjD,CAAC;AAGD,IAAM,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE;AAEjE,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,iBAAiB;AAAA,EACjB,QAAQ,EAAE,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACpD,eAAe,uBAAuB,SAAS;AAAA,EAC/C,YAAY,EACT,OAAO,EAAE,WAAW,WAAW,SAAS,GAAG,QAAQ,WAAW,SAAS,EAAE,CAAC,EAC1E,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO;AAGH,IAAM,qBAAqB,yBAAyB,OAAO,EAAE,SAAS,QAAQ,IAAI,CAAC,EAAE,CAAC;AAOtF,IAAM,0BAA0B,EACpC,OAAO,EAAE,SAAS,SAAS,QAAQ,mBAAmB,SAAS,EAAE,CAAC,EAClE,OAAO,EACP,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,MAAM,OAAO,YAAY,MAAM,SAAS;AAAA,EAClF,SAAS;AAAA,EACT,MAAM,CAAC,UAAU,SAAS;AAC5B,CAAC;AAEI,IAAM,+BAA+B,yBAAyB,OAAO;AAAA,EAC1E,iBAAiB;AACnB,CAAC;AAKM,IAAM,iCAAiC,EAC3C,OAAO,EAAE,iBAAiB,QAAQ,IAAI,CAAC,GAAG,aAAa,YAAY,SAAS,EAAE,CAAC,EAC/E,OAAO;AAEH,IAAM,kCAAkC,EAAE,OAAO,EAAE,SAAS,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAIrF,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,aAAa;AAAA,EACb,SAAS,iBAAiB,SAAS;AAAA,EACnC,WAAW,UAAU,SAAS,EAAE,SAAS;AAC3C,CAAC,EACA,OAAO;AAEH,IAAM,uBAAuB,6BAA6B,OAAO;AAAA,EACtE,WAAW;AAAA,EACX,WAAW,UAAU,SAAS;AAChC,CAAC;AAGM,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,MAAM;AAAA,EACN,iBAAiB;AACnB,CAAC,EACA,OAAO;AAEH,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,WAAW;AAAA,EACX,MAAM;AAAA,EACN,SAAS;AACX,CAAC,EACA,OAAO;AAGH,IAAM,uBAAuB,EAAE,MAAM;AAAA,EAC1C,EAAE,QAAQ,SAAS;AAAA,EACnB,EAAE,OAAO,EAAE,MAAM,yBAAyB;AAC5C,CAAC;AAEM,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,QAAQ,qBAAqB,SAAS;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAC/C,CAAC,EACA,OAAO;AAEH,IAAM,oBAAoB,gBAAgB,KAAK,EAAE,QAAQ,KAAK,CAAC;AAG/D,IAAM,uBAAuB,EAAE,KAAK,CAAC,MAAM,WAAW,WAAW,CAAC;AAElE,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,OAAO,UAAU,SAAS;AAAA,EAC1B,KAAK,UAAU,SAAS;AAC1B,CAAC,EACA,OAAO;AAEV,IAAM,QAAQ,EAAE,OAAO;AAAA,EACrB,OAAO,iBAAiB,SAAS;AAAA,EACjC,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAE5C,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,EACrD,QAAQ;AAAA,EACR,UAAU,UAAU,SAAS;AAC/B,CAAC;AACM,IAAM,0BAA0B,MAAM,OAAO;AAAA,EAClD,iBAAiB;AAAA,EACjB,iBAAiB;AACnB,CAAC,EAAE,OAAO;AAEH,IAAM,uBAAuB,MAAM,OAAO;AAAA,EAC/C,WAAW;AAAA,EACX,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7F,MAAM;AAAA,EACN,SAAS;AACX,CAAC,EAAE,OAAO;AAGH,IAAM,yBAAyB,EACnC,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,SAAS,EAAE,MAAM,oBAAoB;AAAA,EACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC,EACA,OAAO;AAGH,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ,qBAAqB;AAAA,EACrC,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,CAAC;AAAA,EACrC,UAAU,UAAU,SAAS;AAAA,EAC7B,WAAW,UAAU,SAAS;AAAA,EAC9B,SAAS,EAAE,OAAO;AACpB,CAAC,EACA,OAAO;","names":[]}

package/dist/{chunk-5UDNP7AO.js → chunk-FZ6BXQHL.js}

@@ -1,3 +1,7 @@
+import {
+  OPENGENI_SLACK_REST_USER_SCOPES
+} from "./chunk-MZLBPKFE.js";
+
 // src/slack-bot-scopes.ts
 var OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [
   "app_mentions:read",
@@ -17,11 +21,25 @@ var OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [
   "users:read"
 ];
 var OPENGENI_SLACK_REACTION_REQUIRED_SCOPE = "reactions:read";
+var OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE = "files:write";
+var OPENGENI_SLACK_BOT_SEARCH_SCOPES = [
+  "search:read.public",
+  "search:read.files",
+  "search:read.users"
+];
 var OPENGENI_SLACK_BOT_REQUESTED_SCOPES = [
   ...OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
-  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE
+  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,
+  OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE
 ];
+function openGeniSlackBotRequestedScopes(mode = "limited") {
+  return [
+    ...OPENGENI_SLACK_BOT_REQUESTED_SCOPES,
+    ...mode === "full" ? OPENGENI_SLACK_BOT_SEARCH_SCOPES : []
+  ];
+}
 var OPENGENI_SLACK_BOT_EVENTS = [
+  "app_home_opened",
   "app_mention",
   "message.channels",
   "message.groups",
@@ -29,34 +47,24 @@ var OPENGENI_SLACK_BOT_EVENTS = [
   "message.mpim",
   "reaction_added"
 ];
-var OPENGENI_SLACK_MCP_USER_SCOPES = [
-  "search:read.public",
-  "search:read.private",
-  "search:read.mpim",
-  "search:read.im",
-  "search:read.files",
-  "files:read",
-  "emoji:read",
-  "search:read.users",
-  "chat:write",
-  "channels:history",
-  "groups:history",
-  "mpim:history",
-  "im:history",
-  "channels:write",
-  "groups:write",
-  "im:write",
-  "mpim:write",
-  "reactions:write",
-  "canvases:read",
-  "canvases:write",
-  "users:read",
-  "users:read.email",
-  "channels:read",
-  "groups:read",
-  "mpim:read"
-];
+var OPENGENI_SLACK_MCP_USER_SCOPES = OPENGENI_SLACK_REST_USER_SCOPES;
 var OPENGENI_MANAGED_PUBLIC_BASE_URL = "https://app.opengeni.ai";
+function normalizedSlackManifestText(value, fallback, label, maxLength) {
+  const normalized = value?.trim() || fallback;
+  if (normalized.length > maxLength || /[\r\n\0]/u.test(normalized)) {
+    throw new Error(`Slack bot manifest ${label} must be at most ${maxLength} plain characters`);
+  }
+  return normalized;
+}
+function normalizedSlackCommand(value) {
+  const command = value?.trim() || "/opengeni";
+  if (!/^\/[a-z0-9_-]{1,31}$/u.test(command)) {
+    throw new Error(
+      "Slack bot manifest slash command must start with / and contain at most 31 lowercase letters, digits, hyphens, or underscores"
+    );
+  }
+  return command;
+}
 function normalizedSlackManifestBaseUrl(publicBaseUrl) {
   const parsed = new URL(publicBaseUrl);
   if (parsed.protocol !== "https:" || parsed.username || parsed.password) {
@@ -67,16 +75,35 @@ function normalizedSlackManifestBaseUrl(publicBaseUrl) {
   parsed.pathname = parsed.pathname.replace(/\/+$/, "");
   return parsed.toString().replace(/\/$/, "");
 }
-function buildOpenGeniSlackBotManifest(publicBaseUrl) {
+function buildOpenGeniSlackBotManifest(publicBaseUrl, options = {}) {
   const baseUrl = normalizedSlackManifestBaseUrl(publicBaseUrl);
+  const appName = normalizedSlackManifestText(options.appName, "OpenGeni", "app name", 35);
+  const botDisplayName = normalizedSlackManifestText(
+    options.botDisplayName,
+    "OpenGeni",
+    "bot display name",
+    80
+  );
+  const slashCommand = normalizedSlackCommand(options.slashCommand);
+  const shortcutName = normalizedSlackManifestText(
+    options.shortcutName,
+    "Open in Opengeni",
+    "shortcut name",
+    35
+  );
   return {
-    display_information: { name: "OpenGeni" },
+    display_information: { name: appName },
     features: {
-      bot_user: { display_name: "OpenGeni", always_online: false },
+      app_home: {
+        home_tab_enabled: true,
+        messages_tab_enabled: true,
+        messages_tab_read_only_enabled: false
+      },
+      bot_user: { display_name: botDisplayName, always_online: false },
       slash_commands: [
         {
-          command: "/opengeni",
-          description: "Start an OpenGeni task in this channel",
+          command: slashCommand,
+          description: "Start an Opengeni task in this channel",
           should_escape: false,
           url: `${baseUrl}/v1/integrations/slack/commands`
         }
@@ -84,8 +111,8 @@ function buildOpenGeniSlackBotManifest(publicBaseUrl) {
       shortcuts: [
         {
           callback_id: "opengeni_message",
-          description: "Start an OpenGeni task from this Slack message",
-          name: "Open in OpenGeni",
+          description: "Start an Opengeni task from this Slack message",
+          name: shortcutName,
           type: "message"
         }
       ]
@@ -96,7 +123,7 @@ function buildOpenGeniSlackBotManifest(publicBaseUrl) {
         `${baseUrl}/v1/integrations/slack/callback`
       ],
       scopes: {
-        bot: [...OPENGENI_SLACK_BOT_REQUESTED_SCOPES],
+        bot: openGeniSlackBotRequestedScopes(options.accessMode),
         user: [...OPENGENI_SLACK_MCP_USER_SCOPES]
       }
     },
@@ -118,8 +145,16 @@ function buildOpenGeniSlackBotManifest(publicBaseUrl) {
 }
 var OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = [
   "team:read",
-  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE
+  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,
+  OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE,
+  ...OPENGENI_SLACK_BOT_SEARCH_SCOPES
 ];
+function hasOpenGeniSlackFileUploadScope(grantedScopes) {
+  return grantedScopes.includes(OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE);
+}
+function hasOpenGeniSlackBotSearchScopes(grantedScopes) {
+  return OPENGENI_SLACK_BOT_SEARCH_SCOPES.every((scope) => grantedScopes.includes(scope));
+}
 var OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = ["channels:join", "chat:write.public"];
 function isOpenGeniSlackBotScopeAllowed(scope) {
   return OPENGENI_SLACK_BOT_REQUIRED_SCOPES.includes(scope) || OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES.includes(scope);
@@ -144,15 +179,20 @@ function evaluateOpenGeniSlackBotScopes(grantedScopes) {
 export {
   OPENGENI_SLACK_BOT_REQUIRED_SCOPES,
   OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,
+  OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE,
+  OPENGENI_SLACK_BOT_SEARCH_SCOPES,
   OPENGENI_SLACK_BOT_REQUESTED_SCOPES,
+  openGeniSlackBotRequestedScopes,
   OPENGENI_SLACK_BOT_EVENTS,
   OPENGENI_SLACK_MCP_USER_SCOPES,
   OPENGENI_MANAGED_PUBLIC_BASE_URL,
   buildOpenGeniSlackBotManifest,
   OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES,
+  hasOpenGeniSlackFileUploadScope,
+  hasOpenGeniSlackBotSearchScopes,
   OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES,
   areOpenGeniSlackBotScopesAccepted,
   hasOpenGeniSlackReactionScope,
   evaluateOpenGeniSlackBotScopes
 };
-//# sourceMappingURL=chunk-5UDNP7AO.js.map
+//# sourceMappingURL=chunk-FZ6BXQHL.js.map

package/dist/chunk-FZ6BXQHL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/slack-bot-scopes.ts"],"sourcesContent":["import { OPENGENI_SLACK_REST_USER_SCOPES } from \"./slack-rest-mcp\";\n\nexport const OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [\n  \"app_mentions:read\",\n  \"canvases:read\",\n  \"channels:history\",\n  \"channels:read\",\n  \"chat:write\",\n  \"commands\",\n  \"files:read\",\n  \"groups:history\",\n  \"groups:read\",\n  \"im:history\",\n  \"im:read\",\n  \"im:write\",\n  \"mpim:history\",\n  \"mpim:read\",\n  \"users:read\",\n] as const;\n\n/** Read-only scope needed only for the optional emoji-reaction summon surface. */\nexport const OPENGENI_SLACK_REACTION_REQUIRED_SCOPE = \"reactions:read\" as const;\n\n/** Optional grant for explicit retained-file delivery to a task's Slack thread. */\nexport const OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE = \"files:write\" as const;\n\n/**\n * Bot-token search scopes for Slack's Real-time Search API\n * (`assistant.search.context`). Slack accepts these as BOT scopes, so\n * workspace-wide public search runs under the bot identity and never needs a\n * human proxy token. Private-channel, DM, and MPIM search remain user-token\n * only and belong exclusively to the personal hosted-MCP grant.\n */\nexport const OPENGENI_SLACK_BOT_SEARCH_SCOPES = [\n  \"search:read.public\",\n  \"search:read.files\",\n  \"search:read.users\",\n] as const;\n\n/**\n * Scopes requested by the managed and generated self-hosted manifests.\n *\n * `reactions:read`, `files:write`, and the bot search scopes are not part of the\n * base eligibility contract: legacy installations may continue using existing\n * Slack interactions and tools while the reaction setting stays disabled, bot\n * search and file delivery stay unavailable, and the tools ask an admin to reinstall.\n */\nexport const OPENGENI_SLACK_BOT_REQUESTED_SCOPES = [\n  ...OPENGENI_SLACK_BOT_REQUIRED_SCOPES,\n  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,\n  OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE,\n] as const;\n\nexport function openGeniSlackBotRequestedScopes(mode: \"limited\" | \"full\" = \"limited\"): string[] {\n  return [\n    ...OPENGENI_SLACK_BOT_REQUESTED_SCOPES,\n    ...(mode === \"full\" ? OPENGENI_SLACK_BOT_SEARCH_SCOPES : []),\n  ];\n}\n\nexport const OPENGENI_SLACK_BOT_EVENTS = [\n  \"app_home_opened\",\n  \"app_mention\",\n  \"message.channels\",\n  \"message.groups\",\n  \"message.im\",\n  \"message.mpim\",\n  \"reaction_added\",\n] as const;\n\n/** User grants required by the reviewed Slack API MCP tools. */\nexport const OPENGENI_SLACK_MCP_USER_SCOPES = OPENGENI_SLACK_REST_USER_SCOPES;\n\nexport const OPENGENI_MANAGED_PUBLIC_BASE_URL = \"https://app.opengeni.ai\" as const;\n\nexport type OpenGeniSlackBotManifestOptions = Readonly<{\n  appName?: string;\n  botDisplayName?: string;\n  slashCommand?: string;\n  shortcutName?: string;\n  accessMode?: \"limited\" | \"full\";\n}>;\n\nfunction normalizedSlackManifestText(\n  value: string | undefined,\n  fallback: string,\n  label: string,\n  maxLength: number,\n): string {\n  const normalized = value?.trim() || fallback;\n  if (normalized.length > maxLength || /[\\r\\n\\0]/u.test(normalized)) {\n    throw new Error(`Slack bot manifest ${label} must be at most ${maxLength} plain characters`);\n  }\n  return normalized;\n}\n\nfunction normalizedSlackCommand(value: string | undefined): string {\n  const command = value?.trim() || \"/opengeni\";\n  if (!/^\\/[a-z0-9_-]{1,31}$/u.test(command)) {\n    throw new Error(\n      \"Slack bot manifest slash command must start with / and contain at most 31 lowercase letters, digits, hyphens, or underscores\",\n    );\n  }\n  return command;\n}\n\nfunction normalizedSlackManifestBaseUrl(publicBaseUrl: string): string {\n  const parsed = new URL(publicBaseUrl);\n  if (parsed.protocol !== \"https:\" || parsed.username || parsed.password) {\n    throw new Error(\"Slack bot manifest public base URL must be credential-free HTTPS\");\n  }\n  parsed.hash = \"\";\n  parsed.search = \"\";\n  parsed.pathname = parsed.pathname.replace(/\\/+$/, \"\");\n  return parsed.toString().replace(/\\/$/, \"\");\n}\n\n/** Canonical managed/self-hosted Slack app manifest. Slack accepts JSON manifests. */\nexport function buildOpenGeniSlackBotManifest(\n  publicBaseUrl: string,\n  options: OpenGeniSlackBotManifestOptions = {},\n) {\n  const baseUrl = normalizedSlackManifestBaseUrl(publicBaseUrl);\n  const appName = normalizedSlackManifestText(options.appName, \"OpenGeni\", \"app name\", 35);\n  const botDisplayName = normalizedSlackManifestText(\n    options.botDisplayName,\n    \"OpenGeni\",\n    \"bot display name\",\n    80,\n  );\n  const slashCommand = normalizedSlackCommand(options.slashCommand);\n  const shortcutName = normalizedSlackManifestText(\n    options.shortcutName,\n    \"Open in Opengeni\",\n    \"shortcut name\",\n    35,\n  );\n  return {\n    display_information: { name: appName },\n    features: {\n      app_home: {\n        home_tab_enabled: true,\n        messages_tab_enabled: true,\n        messages_tab_read_only_enabled: false,\n      },\n      bot_user: { display_name: botDisplayName, always_online: false },\n      slash_commands: [\n        {\n          command: slashCommand,\n          description: \"Start an Opengeni task in this channel\",\n          should_escape: false,\n          url: `${baseUrl}/v1/integrations/slack/commands`,\n        },\n      ],\n      shortcuts: [\n        {\n          callback_id: \"opengeni_message\",\n          description: \"Start an Opengeni task from this Slack message\",\n          name: shortcutName,\n          type: \"message\",\n        },\n      ],\n    },\n    oauth_config: {\n      redirect_urls: [\n        `${baseUrl}/v1/integrations/oauth/callback`,\n        `${baseUrl}/v1/integrations/slack/callback`,\n      ],\n      scopes: {\n        bot: openGeniSlackBotRequestedScopes(options.accessMode),\n        user: [...OPENGENI_SLACK_MCP_USER_SCOPES],\n      },\n    },\n    settings: {\n      event_subscriptions: {\n        bot_events: [...OPENGENI_SLACK_BOT_EVENTS],\n        request_url: `${baseUrl}/v1/integrations/slack/events`,\n      },\n      interactivity: {\n        is_enabled: true,\n        request_url: `${baseUrl}/v1/integrations/slack/interactions`,\n      },\n      is_mcp_enabled: true,\n      org_deploy_enabled: false,\n      socket_mode_enabled: false,\n      token_rotation_enabled: false,\n    },\n  } as const;\n}\n\n/**\n * Optional bot grants used by the shipped read/identity and task-file-delivery\n * surfaces. Every other unrequired scope fails closed, including unknown future\n * Slack scopes, so verification, core routing, and UI eligibility cannot drift.\n */\nexport const OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = [\n  \"team:read\",\n  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,\n  OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE,\n  ...OPENGENI_SLACK_BOT_SEARCH_SCOPES,\n] as const;\n\nexport function hasOpenGeniSlackFileUploadScope(grantedScopes: readonly string[]): boolean {\n  return grantedScopes.includes(OPENGENI_SLACK_FILE_UPLOAD_REQUIRED_SCOPE);\n}\n\nexport function hasOpenGeniSlackBotSearchScopes(grantedScopes: readonly string[]): boolean {\n  return OPENGENI_SLACK_BOT_SEARCH_SCOPES.every((scope) => grantedScopes.includes(scope));\n}\n\n/** @deprecated Use evaluateOpenGeniSlackBotScopes; an allowlist is the policy. */\nexport const OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = [\"channels:join\", \"chat:write.public\"] as const;\n\nexport type OpenGeniSlackBotScopePolicy = {\n  accepted: boolean;\n  missingRequired: string[];\n  unsupported: string[];\n};\n\nfunction isOpenGeniSlackBotScopeAllowed(scope: string): boolean {\n  return (\n    (OPENGENI_SLACK_BOT_REQUIRED_SCOPES as readonly string[]).includes(scope) ||\n    (OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES as readonly string[]).includes(scope)\n  );\n}\n\nexport function areOpenGeniSlackBotScopesAccepted(grantedScopes: readonly string[]): boolean {\n  return (\n    OPENGENI_SLACK_BOT_REQUIRED_SCOPES.every((scope) => grantedScopes.includes(scope)) &&\n    grantedScopes.every(isOpenGeniSlackBotScopeAllowed)\n  );\n}\n\nexport function hasOpenGeniSlackReactionScope(grantedScopes: readonly string[]): boolean {\n  return grantedScopes.includes(OPENGENI_SLACK_REACTION_REQUIRED_SCOPE);\n}\n\nexport function evaluateOpenGeniSlackBotScopes(\n  grantedScopes: readonly string[],\n): OpenGeniSlackBotScopePolicy {\n  const granted = new Set(grantedScopes);\n  const missingRequired = OPENGENI_SLACK_BOT_REQUIRED_SCOPES.filter((scope) => !granted.has(scope));\n  const unsupported = [...granted].filter((scope) => !isOpenGeniSlackBotScopeAllowed(scope)).sort();\n  return {\n    accepted: areOpenGeniSlackBotScopesAccepted(grantedScopes),\n    missingRequired,\n    unsupported,\n  };\n}\n"],"mappings":";;;;;AAEO,IAAM,qCAAqC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,yCAAyC;AAG/C,IAAM,4CAA4C;AASlD,IAAM,mCAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAUO,IAAM,sCAAsC;AAAA,EACjD,GAAG;AAAA,EACH;AAAA,EACA;AACF;AAEO,SAAS,gCAAgC,OAA2B,WAAqB;AAC9F,SAAO;AAAA,IACL,GAAG;AAAA,IACH,GAAI,SAAS,SAAS,mCAAmC,CAAC;AAAA,EAC5D;AACF;AAEO,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,iCAAiC;AAEvC,IAAM,mCAAmC;AAUhD,SAAS,4BACP,OACA,UACA,OACA,WACQ;AACR,QAAM,aAAa,OAAO,KAAK,KAAK;AACpC,MAAI,WAAW,SAAS,aAAa,YAAY,KAAK,UAAU,GAAG;AACjE,UAAM,IAAI,MAAM,sBAAsB,KAAK,oBAAoB,SAAS,mBAAmB;AAAA,EAC7F;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,OAAmC;AACjE,QAAM,UAAU,OAAO,KAAK,KAAK;AACjC,MAAI,CAAC,wBAAwB,KAAK,OAAO,GAAG;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,+BAA+B,eAA+B;AACrE,QAAM,SAAS,IAAI,IAAI,aAAa;AACpC,MAAI,OAAO,aAAa,YAAY,OAAO,YAAY,OAAO,UAAU;AACtE,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,SAAO,OAAO;AACd,SAAO,SAAS;AAChB,SAAO,WAAW,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACpD,SAAO,OAAO,SAAS,EAAE,QAAQ,OAAO,EAAE;AAC5C;AAGO,SAAS,8BACd,eACA,UAA2C,CAAC,GAC5C;AACA,QAAM,UAAU,+BAA+B,aAAa;AAC5D,QAAM,UAAU,4BAA4B,QAAQ,SAAS,YAAY,YAAY,EAAE;AACvF,QAAM,iBAAiB;AAAA,IACrB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe,uBAAuB,QAAQ,YAAY;AAChE,QAAM,eAAe;AAAA,IACnB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL,qBAAqB,EAAE,MAAM,QAAQ;AAAA,IACrC,UAAU;AAAA,MACR,UAAU;AAAA,QACR,kBAAkB;AAAA,QAClB,sBAAsB;AAAA,QACtB,gCAAgC;AAAA,MAClC;AAAA,MACA,UAAU,EAAE,cAAc,gBAAgB,eAAe,MAAM;AAAA,MAC/D,gBAAgB;AAAA,QACd;AAAA,UACE,SAAS;AAAA,UACT,aAAa;AAAA,UACb,eAAe;AAAA,UACf,KAAK,GAAG,OAAO;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,aAAa;AAAA,UACb,aAAa;AAAA,UACb,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,GAAG,OAAO;AAAA,QACV,GAAG,OAAO;AAAA,MACZ;AAAA,MACA,QAAQ;AAAA,QACN,KAAK,gCAAgC,QAAQ,UAAU;AAAA,QACvD,MAAM,CAAC,GAAG,8BAA8B;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,qBAAqB;AAAA,QACnB,YAAY,CAAC,GAAG,yBAAyB;AAAA,QACzC,aAAa,GAAG,OAAO;AAAA,MACzB;AAAA,MACA,eAAe;AAAA,QACb,YAAY;AAAA,QACZ,aAAa,GAAG,OAAO;AAAA,MACzB;AAAA,MACA,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,IAC1B;AAAA,EACF;AACF;AAOO,IAAM,0CAA0C;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEO,SAAS,gCAAgC,eAA2C;AACzF,SAAO,cAAc,SAAS,yCAAyC;AACzE;AAEO,SAAS,gCAAgC,eAA2C;AACzF,SAAO,iCAAiC,MAAM,CAAC,UAAU,cAAc,SAAS,KAAK,CAAC;AACxF;AAGO,IAAM,sCAAsC,CAAC,iBAAiB,mBAAmB;AAQxF,SAAS,+BAA+B,OAAwB;AAC9D,SACG,mCAAyD,SAAS,KAAK,KACvE,wCAA8D,SAAS,KAAK;AAEjF;AAEO,SAAS,kCAAkC,eAA2C;AAC3F,SACE,mCAAmC,MAAM,CAAC,UAAU,cAAc,SAAS,KAAK,CAAC,KACjF,cAAc,MAAM,8BAA8B;AAEtD;AAEO,SAAS,8BAA8B,eAA2C;AACvF,SAAO,cAAc,SAAS,sCAAsC;AACtE;AAEO,SAAS,+BACd,eAC6B;AAC7B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,kBAAkB,mCAAmC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC;AAChG,QAAM,cAAc,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,+BAA+B,KAAK,CAAC,EAAE,KAAK;AAChG,SAAO;AAAA,IACL,UAAU,kCAAkC,aAAa;AAAA,IACzD;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-GRG7PHWQ.js

@@ -0,0 +1,25 @@
+// src/xai-provider-account-authority.ts
+import { z } from "zod";
+var PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var XaiProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion("scope", [
+  z.object({ version: z.literal(1), scope: z.literal("organization") }).strict(),
+  z.object({
+    version: z.literal(1),
+    scope: z.literal("workspace")
+  }).strict(),
+  z.object({
+    version: z.literal(1),
+    scope: z.literal("user"),
+    authorityGeneration: PositiveSafeInteger
+  }).strict()
+]);
+var WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
+  version: 1,
+  scope: "workspace"
+};
+
+export {
+  XaiProviderAccountAuthoritySnapshotV1,
+  WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1
+};
+//# sourceMappingURL=chunk-GRG7PHWQ.js.map

package/dist/chunk-GRG7PHWQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/xai-provider-account-authority.ts"],"sourcesContent":["import { z } from \"zod\";\n\nconst PositiveSafeInteger = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);\n\n/**\n * Opaque authority frozen at an xAI provider-account acceptance boundary.\n *\n * This snapshot deliberately carries no organization, membership, credential,\n * provider-account, subject, label, quota, token, or plan identity. User scope\n * becomes executable only after exact live database revalidation against the\n * separately stored causal subject and xAI subscription authority row.\n */\nexport const XaiProviderAccountAuthoritySnapshotV1 = z.discriminatedUnion(\"scope\", [\n  z.object({ version: z.literal(1), scope: z.literal(\"organization\") }).strict(),\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"workspace\"),\n    })\n    .strict(),\n  z\n    .object({\n      version: z.literal(1),\n      scope: z.literal(\"user\"),\n      authorityGeneration: PositiveSafeInteger,\n    })\n    .strict(),\n]);\n\nexport type XaiProviderAccountAuthoritySnapshotV1 = z.infer<\n  typeof XaiProviderAccountAuthoritySnapshotV1\n>;\n\n/** Explicit compatibility value for workspace-default accepted work. */\nexport const WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {\n  version: 1,\n  scope: \"workspace\",\n} as const satisfies XaiProviderAccountAuthoritySnapshotV1;\n"],"mappings":";AAAA,SAAS,SAAS;AAElB,IAAM,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB;AAU5E,IAAM,wCAAwC,EAAE,mBAAmB,SAAS;AAAA,EACjF,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,OAAO,EAAE,QAAQ,cAAc,EAAE,CAAC,EAAE,OAAO;AAAA,EAC7E,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,WAAW;AAAA,EAC9B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,OAAO,EAAE,QAAQ,MAAM;AAAA,IACvB,qBAAqB;AAAA,EACvB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,uDAAuD;AAAA,EAClE,SAAS;AAAA,EACT,OAAO;AACT;","names":[]}

package/dist/chunk-JUFK3T4Q.js

@@ -0,0 +1,80 @@
+// src/canonical-human-identities.ts
+import { z } from "zod";
+var CanonicalHumanIdentityStatus = z.enum([
+  "active",
+  "recovery_required",
+  "disputed",
+  "disabled"
+]);
+var CanonicalHumanLoginBindingStatus = z.enum([
+  "active",
+  "recovery_pending",
+  "stale",
+  "disputed",
+  "revoked"
+]);
+var CanonicalHumanRecoveryState = z.enum([
+  "ready",
+  "recovery_required",
+  "lost_factor",
+  "disputed",
+  "disabled"
+]);
+var CanonicalHumanLoginBinding = z.object({
+  id: z.string().uuid(),
+  providerId: z.string().min(1).max(128),
+  providerAccountId: z.string().min(1).max(1024),
+  status: CanonicalHumanLoginBindingStatus,
+  revision: z.number().int().positive(),
+  verifiedAt: z.string().datetime(),
+  lastVerifiedAt: z.string().datetime(),
+  revokedAt: z.string().datetime().nullable(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime()
+});
+var CanonicalHumanIdentityProjection = z.object({
+  activeIdentity: z.object({
+    id: z.string().uuid(),
+    displayName: z.string().min(1).max(256),
+    status: CanonicalHumanIdentityStatus,
+    identityRevision: z.number().int().positive(),
+    authRevision: z.number().int().positive(),
+    activeLoginBindingId: z.string().uuid().nullable(),
+    recoveryState: CanonicalHumanRecoveryState,
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime()
+  }),
+  loginBindings: z.array(CanonicalHumanLoginBinding).max(64)
+});
+var OperationFields = {
+  operationId: z.string().uuid().optional(),
+  expectedIdentityRevision: z.number().int().positive(),
+  reason: z.string().trim().min(1).max(512)
+};
+var LinkCanonicalHumanLoginBindingRequest = z.object({
+  ...OperationFields,
+  providerId: z.string().trim().min(1).max(128),
+  providerAccountId: z.string().trim().min(1).max(1024)
+});
+var CanonicalHumanBindingOperationRequest = z.object({
+  ...OperationFields
+});
+var CanonicalHumanIdentityMutationOutcome = z.enum(["applied", "lost_factor", "disputed"]);
+var CanonicalHumanIdentityMutationResponse = z.object({
+  outcome: CanonicalHumanIdentityMutationOutcome,
+  operationId: z.string().uuid(),
+  identity: CanonicalHumanIdentityProjection
+});
+
+export {
+  CanonicalHumanIdentityStatus,
+  CanonicalHumanLoginBindingStatus,
+  CanonicalHumanRecoveryState,
+  CanonicalHumanLoginBinding,
+  CanonicalHumanIdentityProjection,
+  LinkCanonicalHumanLoginBindingRequest,
+  CanonicalHumanBindingOperationRequest,
+  CanonicalHumanIdentityMutationOutcome,
+  CanonicalHumanIdentityMutationResponse
+};
+//# sourceMappingURL=chunk-JUFK3T4Q.js.map

package/dist/chunk-JUFK3T4Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const CanonicalHumanIdentityStatus = z.enum([\n  \"active\",\n  \"recovery_required\",\n  \"disputed\",\n  \"disabled\",\n]);\nexport type CanonicalHumanIdentityStatus = z.infer<typeof CanonicalHumanIdentityStatus>;\n\nexport const CanonicalHumanLoginBindingStatus = z.enum([\n  \"active\",\n  \"recovery_pending\",\n  \"stale\",\n  \"disputed\",\n  \"revoked\",\n]);\nexport type CanonicalHumanLoginBindingStatus = z.infer<typeof CanonicalHumanLoginBindingStatus>;\n\nexport const CanonicalHumanRecoveryState = z.enum([\n  \"ready\",\n  \"recovery_required\",\n  \"lost_factor\",\n  \"disputed\",\n  \"disabled\",\n]);\nexport type CanonicalHumanRecoveryState = z.infer<typeof CanonicalHumanRecoveryState>;\n\nexport const CanonicalHumanLoginBinding = z.object({\n  id: z.string().uuid(),\n  providerId: z.string().min(1).max(128),\n  providerAccountId: z.string().min(1).max(1024),\n  status: CanonicalHumanLoginBindingStatus,\n  revision: z.number().int().positive(),\n  verifiedAt: z.string().datetime(),\n  lastVerifiedAt: z.string().datetime(),\n  revokedAt: z.string().datetime().nullable(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime(),\n});\nexport type CanonicalHumanLoginBinding = z.infer<typeof CanonicalHumanLoginBinding>;\n\nexport const CanonicalHumanIdentityProjection = z.object({\n  activeIdentity: z.object({\n    id: z.string().uuid(),\n    displayName: z.string().min(1).max(256),\n    status: CanonicalHumanIdentityStatus,\n    identityRevision: z.number().int().positive(),\n    authRevision: z.number().int().positive(),\n    activeLoginBindingId: z.string().uuid().nullable(),\n    recoveryState: CanonicalHumanRecoveryState,\n    createdAt: z.string().datetime(),\n    updatedAt: z.string().datetime(),\n  }),\n  loginBindings: z.array(CanonicalHumanLoginBinding).max(64),\n});\nexport type CanonicalHumanIdentityProjection = z.infer<typeof CanonicalHumanIdentityProjection>;\n\nconst OperationFields = {\n  operationId: z.string().uuid().optional(),\n  expectedIdentityRevision: z.number().int().positive(),\n  reason: z.string().trim().min(1).max(512),\n} as const;\n\nexport const LinkCanonicalHumanLoginBindingRequest = z.object({\n  ...OperationFields,\n  providerId: z.string().trim().min(1).max(128),\n  providerAccountId: z.string().trim().min(1).max(1024),\n});\nexport type LinkCanonicalHumanLoginBindingRequest = z.infer<\n  typeof LinkCanonicalHumanLoginBindingRequest\n>;\n\nexport const CanonicalHumanBindingOperationRequest = z.object({\n  ...OperationFields,\n});\nexport type CanonicalHumanBindingOperationRequest = z.infer<\n  typeof CanonicalHumanBindingOperationRequest\n>;\n\nexport const CanonicalHumanIdentityMutationOutcome = z.enum([\"applied\", \"lost_factor\", \"disputed\"]);\nexport type CanonicalHumanIdentityMutationOutcome = z.infer<\n  typeof CanonicalHumanIdentityMutationOutcome\n>;\n\nexport const CanonicalHumanIdentityMutationResponse = z.object({\n  outcome: CanonicalHumanIdentityMutationOutcome,\n  operationId: z.string().uuid(),\n  identity: CanonicalHumanIdentityProjection,\n});\nexport type CanonicalHumanIdentityMutationResponse = z.infer<\n  typeof CanonicalHumanIdentityMutationResponse\n>;\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,+BAA+B,EAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,KAAK;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,8BAA8B,EAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,6BAA6B,EAAE,OAAO;AAAA,EACjD,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACrC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC7C,QAAQ;AAAA,EACR,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAGM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,gBAAgB,EAAE,OAAO;AAAA,IACvB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,QAAQ;AAAA,IACR,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAC5C,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACxC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACjD,eAAe;AAAA,IACf,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AAAA,EACD,eAAe,EAAE,MAAM,0BAA0B,EAAE,IAAI,EAAE;AAC3D,CAAC;AAGD,IAAM,kBAAkB;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC1C;AAEO,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,GAAG;AAAA,EACH,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC5C,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AACtD,CAAC;AAKM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,GAAG;AACL,CAAC;AAKM,IAAM,wCAAwC,EAAE,KAAK,CAAC,WAAW,eAAe,UAAU,CAAC;AAK3F,IAAM,yCAAyC,EAAE,OAAO;AAAA,EAC7D,SAAS;AAAA,EACT,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU;AACZ,CAAC;","names":[]}