@opengeni/contracts 0.50.0 → 2.2.0-canary.0

package/dist/chunk-YBW5JSA3.js

@@ -0,0 +1,251 @@
+// src/connector-attachments.ts
+import { z } from "zod";
+var CONNECTOR_ATTACHMENT_TRANSFER_VERSION = 1;
+var CONNECTOR_ATTACHMENT_RECEIPT_VERSION = 1;
+var CONNECTOR_ATTACHMENT_TRANSFER_META_KEY = "opengeni/connector-attachment-transfers";
+var CONNECTOR_ATTACHMENT_RECEIPT_META_KEY = "opengeni/connector-attachment-receipts";
+var CONNECTOR_ATTACHMENT_MAX_COUNT = 16;
+var CONNECTOR_ATTACHMENT_MAX_BYTES = 5e9;
+var CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES = 255;
+var CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 256;
+var CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES = 128;
+var CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES = 512;
+var CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES = 8 * 1024;
+var CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES = 2 * 1024;
+var PROVIDER_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u;
+var SHA256_PATTERN = /^[0-9a-f]{64}$/u;
+var MEDIA_TYPE_PATTERN = /^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+(?:\s*;\s*[a-z0-9!#$&^_.+-]+=(?:[a-z0-9!#$&^_.+-]+|"[^"\r\n]*"))*$/iu;
+var CONTROL_CHARACTER_PATTERN = /[\u0000-\u001f\u007f]/u;
+var HTTP_URL_REFERENCE_PATTERN = /(?:https?:)?\/\/[^\s]/iu;
+var PORTABLE_FILENAME_FORBIDDEN_PATTERN = /[<>:"|?*]/u;
+var PORTABLE_FILENAME_RESERVED_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/iu;
+var textEncoder = new TextEncoder();
+function utf8Bytes(value) {
+  return textEncoder.encode(value).byteLength;
+}
+function boundedString(maxUtf8Bytes) {
+  return z.string().refine((value) => utf8Bytes(value) <= maxUtf8Bytes, {
+    message: `must be at most ${maxUtf8Bytes} UTF-8 bytes`
+  });
+}
+function isHttpUrl(value) {
+  try {
+    const parsed = new URL(value);
+    return parsed.protocol === "http:" || parsed.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function containsHttpUrlReference(value) {
+  return HTTP_URL_REFERENCE_PATTERN.test(value);
+}
+function isPrivateUrlCredentialQueryName(value) {
+  const normalized = value.toLowerCase().replace(/[^a-z0-9]/gu, "");
+  return normalized === "sig" || normalized === "auth" || normalized.endsWith("signature") || normalized.endsWith("token") || normalized.endsWith("credential") || normalized.endsWith("secret") || normalized.endsWith("password") || normalized.endsWith("passcode") || normalized.endsWith("authorization") || normalized.endsWith("apikey") || normalized.endsWith("accesskey") || normalized.endsWith("securitytoken") || normalized.endsWith("sas") || normalized === "googleaccessid";
+}
+function privateUrlCredentialValues(value) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return [];
+  }
+  const credentials = /* @__PURE__ */ new Set();
+  for (const [name, credential] of parsed.searchParams) {
+    if (credential && isPrivateUrlCredentialQueryName(name)) credentials.add(credential);
+  }
+  for (const pair of parsed.search.slice(1).split("&")) {
+    if (!pair) continue;
+    const separator = pair.indexOf("=");
+    const rawName = separator === -1 ? pair : pair.slice(0, separator);
+    const rawCredential = separator === -1 ? "" : pair.slice(separator + 1);
+    let decodedName;
+    try {
+      decodedName = decodeURIComponent(rawName.replace(/\+/gu, " "));
+    } catch {
+      continue;
+    }
+    if (rawCredential && isPrivateUrlCredentialQueryName(decodedName)) {
+      credentials.add(rawCredential);
+    }
+  }
+  return [...credentials];
+}
+function publicMetadataContainsCredential(publicValue, credential) {
+  return publicValue.includes(credential);
+}
+var ConnectorAttachmentProviderIdentity = z.object({
+  provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),
+  kind: z.literal("attachment"),
+  value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES).min(1).refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {
+    message: "must not contain control characters"
+  }).refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {
+    message: "must be an opaque provider attachment identity, not a URL"
+  })
+}).strict();
+var ConnectorAttachmentFileName = boundedString(
+  CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES
+).min(1).refine(
+  (value) => value !== "." && value !== ".." && value === value.trim() && !value.includes("/") && !value.includes("\\") && !CONTROL_CHARACTER_PATTERN.test(value) && !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(value) && !/[ .]$/u.test(value) && !PORTABLE_FILENAME_RESERVED_PATTERN.test(value),
+  { message: "must be a safe leaf filename" }
+);
+var ConnectorAttachmentMediaType = boundedString(
+  CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES
+).regex(MEDIA_TYPE_PATTERN).refine((value) => !containsHttpUrlReference(value), {
+  message: "must not contain an HTTP URL reference"
+});
+var ConnectorAttachmentSha256 = z.string().regex(SHA256_PATTERN);
+var ConnectorAttachmentPrivateSource = z.object({
+  url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(
+    (value, context) => {
+      let parsed;
+      try {
+        parsed = new URL(value);
+      } catch {
+        context.addIssue({
+          code: "custom",
+          message: "must be an absolute URL"
+        });
+        return;
+      }
+      if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+        context.addIssue({ code: "custom", message: "must use http or https" });
+      }
+      if (parsed.username || parsed.password) {
+        context.addIssue({
+          code: "custom",
+          message: "must not contain URL userinfo"
+        });
+      }
+      if (parsed.hash) {
+        context.addIssue({
+          code: "custom",
+          message: "must not contain a URL fragment"
+        });
+      }
+    }
+  ),
+  expiresAt: z.iso.datetime({ offset: true })
+}).strict();
+var ConnectorAttachmentTransfer = z.object({
+  providerAttachmentId: ConnectorAttachmentProviderIdentity,
+  fileName: ConnectorAttachmentFileName,
+  mediaType: ConnectorAttachmentMediaType,
+  byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+  contentSha256: ConnectorAttachmentSha256,
+  source: ConnectorAttachmentPrivateSource
+}).strict().superRefine((attachment, context) => {
+  const publicValues = [
+    attachment.providerAttachmentId.value,
+    attachment.fileName,
+    attachment.mediaType
+  ];
+  for (const credential of privateUrlCredentialValues(attachment.source.url)) {
+    if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {
+      context.addIssue({
+        code: "custom",
+        message: "private source credentials must not appear in public attachment metadata"
+      });
+      return;
+    }
+  }
+});
+var ConnectorAttachmentTransferEnvelope = z.object({
+  version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),
+  attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
+}).strict().superRefine((envelope, context) => {
+  const identities = /* @__PURE__ */ new Set();
+  for (const [index, attachment] of envelope.attachments.entries()) {
+    const identity = `${attachment.providerAttachmentId.provider}\0${attachment.providerAttachmentId.value}`;
+    if (identities.has(identity)) {
+      context.addIssue({
+        code: "custom",
+        message: "provider attachment identities must be unique",
+        path: ["attachments", index, "providerAttachmentId"]
+      });
+    }
+    identities.add(identity);
+  }
+});
+var ConnectorAttachmentSandboxPath = boundedString(
+  CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES
+).min(1).refine(
+  (value) => {
+    if (value !== value.trim() || value.startsWith("/") || /^[A-Za-z]:[\\/]/u.test(value) || value.includes("\\") || CONTROL_CHARACTER_PATTERN.test(value)) {
+      return false;
+    }
+    const segments = value.split("/");
+    if (segments.length !== 5 || segments[0] !== ".opengeni" || segments[1] !== "connector-attachments" || !PROVIDER_PATTERN.test(segments[2] ?? "") || !/^[0-9a-f]{32}$/u.test(segments[3] ?? "") || !ConnectorAttachmentFileName.safeParse(segments[4]).success) {
+      return false;
+    }
+    return segments.every(
+      (segment) => segment.length > 0 && segment !== "." && segment !== ".." && !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(segment) && !/[ .]$/u.test(segment) && !PORTABLE_FILENAME_RESERVED_PATTERN.test(segment)
+    );
+  },
+  { message: "must be a confined connector attachment sandbox path" }
+);
+var ConnectorAttachmentReceipt = z.object({
+  providerAttachmentId: ConnectorAttachmentProviderIdentity,
+  fileName: ConnectorAttachmentFileName,
+  mediaType: ConnectorAttachmentMediaType,
+  byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),
+  contentSha256: ConnectorAttachmentSha256,
+  sandboxPath: ConnectorAttachmentSandboxPath
+}).strict().superRefine((receipt, context) => {
+  const segments = receipt.sandboxPath.split("/");
+  if (segments[2] !== receipt.providerAttachmentId.provider) {
+    context.addIssue({
+      code: "custom",
+      message: "sandbox path provider must match the provider attachment identity",
+      path: ["sandboxPath"]
+    });
+  }
+  if (segments[4] !== receipt.fileName) {
+    context.addIssue({
+      code: "custom",
+      message: "sandbox path filename must match the attachment filename",
+      path: ["sandboxPath"]
+    });
+  }
+});
+var ConnectorAttachmentReceiptEnvelope = z.object({
+  version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),
+  attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT)
+}).strict();
+function parseConnectorAttachmentTransferEnvelope(value, options = {}) {
+  const envelope = ConnectorAttachmentTransferEnvelope.parse(value);
+  const nowMs = options.nowMs ?? Date.now();
+  for (const attachment of envelope.attachments) {
+    if (Date.parse(attachment.source.expiresAt) <= nowMs) {
+      throw new Error("connector attachment source is expired");
+    }
+  }
+  return envelope;
+}
+
+export {
+  CONNECTOR_ATTACHMENT_TRANSFER_VERSION,
+  CONNECTOR_ATTACHMENT_RECEIPT_VERSION,
+  CONNECTOR_ATTACHMENT_TRANSFER_META_KEY,
+  CONNECTOR_ATTACHMENT_RECEIPT_META_KEY,
+  CONNECTOR_ATTACHMENT_MAX_COUNT,
+  CONNECTOR_ATTACHMENT_MAX_BYTES,
+  CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES,
+  ConnectorAttachmentProviderIdentity,
+  ConnectorAttachmentFileName,
+  ConnectorAttachmentMediaType,
+  ConnectorAttachmentSha256,
+  ConnectorAttachmentPrivateSource,
+  ConnectorAttachmentTransfer,
+  ConnectorAttachmentTransferEnvelope,
+  ConnectorAttachmentSandboxPath,
+  ConnectorAttachmentReceipt,
+  ConnectorAttachmentReceiptEnvelope,
+  parseConnectorAttachmentTransferEnvelope
+};
+//# sourceMappingURL=chunk-YBW5JSA3.js.map

package/dist/chunk-YBW5JSA3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connector-attachments.ts"],"sourcesContent":["import { z } from \"zod\";\n\nexport const CONNECTOR_ATTACHMENT_TRANSFER_VERSION = 1 as const;\nexport const CONNECTOR_ATTACHMENT_RECEIPT_VERSION = 1 as const;\nexport const CONNECTOR_ATTACHMENT_TRANSFER_META_KEY =\n  \"opengeni/connector-attachment-transfers\" as const;\nexport const CONNECTOR_ATTACHMENT_RECEIPT_META_KEY =\n  \"opengeni/connector-attachment-receipts\" as const;\nexport const CONNECTOR_ATTACHMENT_MAX_COUNT = 16;\n// Must remain byte-for-byte aligned with Channel A's exact workspace importer.\nexport const CONNECTOR_ATTACHMENT_MAX_BYTES = 5_000_000_000;\nexport const CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES = 255;\nexport const CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 256;\nexport const CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES = 128;\nexport const CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES = 512;\nexport const CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES = 8 * 1024;\nexport const CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES = 2 * 1024;\n\nconst PROVIDER_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u;\nconst SHA256_PATTERN = /^[0-9a-f]{64}$/u;\nconst MEDIA_TYPE_PATTERN =\n  /^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+(?:\\s*;\\s*[a-z0-9!#$&^_.+-]+=(?:[a-z0-9!#$&^_.+-]+|\"[^\"\\r\\n]*\"))*$/iu;\nconst CONTROL_CHARACTER_PATTERN = /[\\u0000-\\u001f\\u007f]/u;\nconst HTTP_URL_REFERENCE_PATTERN = /(?:https?:)?\\/\\/[^\\s]/iu;\nconst PORTABLE_FILENAME_FORBIDDEN_PATTERN = /[<>:\"|?*]/u;\nconst PORTABLE_FILENAME_RESERVED_PATTERN = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\\.|$)/iu;\nconst textEncoder = new TextEncoder();\n\nfunction utf8Bytes(value: string): number {\n  return textEncoder.encode(value).byteLength;\n}\n\nfunction boundedString(maxUtf8Bytes: number) {\n  return z.string().refine((value) => utf8Bytes(value) <= maxUtf8Bytes, {\n    message: `must be at most ${maxUtf8Bytes} UTF-8 bytes`,\n  });\n}\n\nfunction isHttpUrl(value: string): boolean {\n  try {\n    const parsed = new URL(value);\n    return parsed.protocol === \"http:\" || parsed.protocol === \"https:\";\n  } catch {\n    return false;\n  }\n}\n\nfunction containsHttpUrlReference(value: string): boolean {\n  return HTTP_URL_REFERENCE_PATTERN.test(value);\n}\n\nfunction isPrivateUrlCredentialQueryName(value: string): boolean {\n  const normalized = value.toLowerCase().replace(/[^a-z0-9]/gu, \"\");\n  return (\n    normalized === \"sig\" ||\n    normalized === \"auth\" ||\n    normalized.endsWith(\"signature\") ||\n    normalized.endsWith(\"token\") ||\n    normalized.endsWith(\"credential\") ||\n    normalized.endsWith(\"secret\") ||\n    normalized.endsWith(\"password\") ||\n    normalized.endsWith(\"passcode\") ||\n    normalized.endsWith(\"authorization\") ||\n    normalized.endsWith(\"apikey\") ||\n    normalized.endsWith(\"accesskey\") ||\n    normalized.endsWith(\"securitytoken\") ||\n    normalized.endsWith(\"sas\") ||\n    normalized === \"googleaccessid\"\n  );\n}\n\nfunction privateUrlCredentialValues(value: string): string[] {\n  let parsed: URL;\n  try {\n    parsed = new URL(value);\n  } catch {\n    return [];\n  }\n  const credentials = new Set<string>();\n  for (const [name, credential] of parsed.searchParams) {\n    if (credential && isPrivateUrlCredentialQueryName(name)) credentials.add(credential);\n  }\n  for (const pair of parsed.search.slice(1).split(\"&\")) {\n    if (!pair) continue;\n    const separator = pair.indexOf(\"=\");\n    const rawName = separator === -1 ? pair : pair.slice(0, separator);\n    const rawCredential = separator === -1 ? \"\" : pair.slice(separator + 1);\n    let decodedName: string;\n    try {\n      decodedName = decodeURIComponent(rawName.replace(/\\+/gu, \" \"));\n    } catch {\n      continue;\n    }\n    if (rawCredential && isPrivateUrlCredentialQueryName(decodedName)) {\n      credentials.add(rawCredential);\n    }\n  }\n  return [...credentials];\n}\n\nfunction publicMetadataContainsCredential(publicValue: string, credential: string): boolean {\n  return publicValue.includes(credential);\n}\n\nexport const ConnectorAttachmentProviderIdentity = z\n  .object({\n    provider: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES).regex(PROVIDER_PATTERN),\n    kind: z.literal(\"attachment\"),\n    value: boundedString(CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES)\n      .min(1)\n      .refine((value) => !CONTROL_CHARACTER_PATTERN.test(value), {\n        message: \"must not contain control characters\",\n      })\n      .refine((value) => !isHttpUrl(value) && !containsHttpUrlReference(value), {\n        message: \"must be an opaque provider attachment identity, not a URL\",\n      }),\n  })\n  .strict();\nexport type ConnectorAttachmentProviderIdentity = z.infer<\n  typeof ConnectorAttachmentProviderIdentity\n>;\n\nexport const ConnectorAttachmentFileName = boundedString(\n  CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,\n)\n  .min(1)\n  .refine(\n    (value) =>\n      value !== \".\" &&\n      value !== \"..\" &&\n      value === value.trim() &&\n      !value.includes(\"/\") &&\n      !value.includes(\"\\\\\") &&\n      !CONTROL_CHARACTER_PATTERN.test(value) &&\n      !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(value) &&\n      !/[ .]$/u.test(value) &&\n      !PORTABLE_FILENAME_RESERVED_PATTERN.test(value),\n    { message: \"must be a safe leaf filename\" },\n  );\n\nexport const ConnectorAttachmentMediaType = boundedString(\n  CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,\n)\n  .regex(MEDIA_TYPE_PATTERN)\n  .refine((value) => !containsHttpUrlReference(value), {\n    message: \"must not contain an HTTP URL reference\",\n  });\n\nexport const ConnectorAttachmentSha256 = z.string().regex(SHA256_PATTERN);\n\nexport const ConnectorAttachmentPrivateSource = z\n  .object({\n    url: boundedString(CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES).superRefine(\n      (value, context) => {\n        let parsed: URL;\n        try {\n          parsed = new URL(value);\n        } catch {\n          context.addIssue({\n            code: \"custom\",\n            message: \"must be an absolute URL\",\n          });\n          return;\n        }\n        if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n          context.addIssue({ code: \"custom\", message: \"must use http or https\" });\n        }\n        if (parsed.username || parsed.password) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"must not contain URL userinfo\",\n          });\n        }\n        if (parsed.hash) {\n          context.addIssue({\n            code: \"custom\",\n            message: \"must not contain a URL fragment\",\n          });\n        }\n      },\n    ),\n    expiresAt: z.iso.datetime({ offset: true }),\n  })\n  .strict();\nexport type ConnectorAttachmentPrivateSource = z.infer<typeof ConnectorAttachmentPrivateSource>;\n\nexport const ConnectorAttachmentTransfer = z\n  .object({\n    providerAttachmentId: ConnectorAttachmentProviderIdentity,\n    fileName: ConnectorAttachmentFileName,\n    mediaType: ConnectorAttachmentMediaType,\n    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),\n    contentSha256: ConnectorAttachmentSha256,\n    source: ConnectorAttachmentPrivateSource,\n  })\n  .strict()\n  .superRefine((attachment, context) => {\n    const publicValues = [\n      attachment.providerAttachmentId.value,\n      attachment.fileName,\n      attachment.mediaType,\n    ];\n    for (const credential of privateUrlCredentialValues(attachment.source.url)) {\n      if (publicValues.some((value) => publicMetadataContainsCredential(value, credential))) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"private source credentials must not appear in public attachment metadata\",\n        });\n        return;\n      }\n    }\n  });\nexport type ConnectorAttachmentTransfer = z.infer<typeof ConnectorAttachmentTransfer>;\n\nexport const ConnectorAttachmentTransferEnvelope = z\n  .object({\n    version: z.literal(CONNECTOR_ATTACHMENT_TRANSFER_VERSION),\n    attachments: z.array(ConnectorAttachmentTransfer).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),\n  })\n  .strict()\n  .superRefine((envelope, context) => {\n    const identities = new Set<string>();\n    for (const [index, attachment] of envelope.attachments.entries()) {\n      const identity = `${attachment.providerAttachmentId.provider}\\0${attachment.providerAttachmentId.value}`;\n      if (identities.has(identity)) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"provider attachment identities must be unique\",\n          path: [\"attachments\", index, \"providerAttachmentId\"],\n        });\n      }\n      identities.add(identity);\n    }\n  });\nexport type ConnectorAttachmentTransferEnvelope = z.infer<\n  typeof ConnectorAttachmentTransferEnvelope\n>;\n\nexport const ConnectorAttachmentSandboxPath = boundedString(\n  CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES,\n)\n  .min(1)\n  .refine(\n    (value) => {\n      if (\n        value !== value.trim() ||\n        value.startsWith(\"/\") ||\n        /^[A-Za-z]:[\\\\/]/u.test(value) ||\n        value.includes(\"\\\\\") ||\n        CONTROL_CHARACTER_PATTERN.test(value)\n      ) {\n        return false;\n      }\n      const segments = value.split(\"/\");\n      if (\n        segments.length !== 5 ||\n        segments[0] !== \".opengeni\" ||\n        segments[1] !== \"connector-attachments\" ||\n        !PROVIDER_PATTERN.test(segments[2] ?? \"\") ||\n        !/^[0-9a-f]{32}$/u.test(segments[3] ?? \"\") ||\n        !ConnectorAttachmentFileName.safeParse(segments[4]).success\n      ) {\n        return false;\n      }\n      return segments.every(\n        (segment) =>\n          segment.length > 0 &&\n          segment !== \".\" &&\n          segment !== \"..\" &&\n          !PORTABLE_FILENAME_FORBIDDEN_PATTERN.test(segment) &&\n          !/[ .]$/u.test(segment) &&\n          !PORTABLE_FILENAME_RESERVED_PATTERN.test(segment),\n      );\n    },\n    { message: \"must be a confined connector attachment sandbox path\" },\n  );\n\nexport const ConnectorAttachmentReceipt = z\n  .object({\n    providerAttachmentId: ConnectorAttachmentProviderIdentity,\n    fileName: ConnectorAttachmentFileName,\n    mediaType: ConnectorAttachmentMediaType,\n    byteSize: z.number().int().min(0).max(CONNECTOR_ATTACHMENT_MAX_BYTES),\n    contentSha256: ConnectorAttachmentSha256,\n    sandboxPath: ConnectorAttachmentSandboxPath,\n  })\n  .strict()\n  .superRefine((receipt, context) => {\n    const segments = receipt.sandboxPath.split(\"/\");\n    if (segments[2] !== receipt.providerAttachmentId.provider) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"sandbox path provider must match the provider attachment identity\",\n        path: [\"sandboxPath\"],\n      });\n    }\n    if (segments[4] !== receipt.fileName) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"sandbox path filename must match the attachment filename\",\n        path: [\"sandboxPath\"],\n      });\n    }\n  });\nexport type ConnectorAttachmentReceipt = z.infer<typeof ConnectorAttachmentReceipt>;\n\nexport const ConnectorAttachmentReceiptEnvelope = z\n  .object({\n    version: z.literal(CONNECTOR_ATTACHMENT_RECEIPT_VERSION),\n    attachments: z.array(ConnectorAttachmentReceipt).min(1).max(CONNECTOR_ATTACHMENT_MAX_COUNT),\n  })\n  .strict();\nexport type ConnectorAttachmentReceiptEnvelope = z.infer<typeof ConnectorAttachmentReceiptEnvelope>;\n\nexport function parseConnectorAttachmentTransferEnvelope(\n  value: unknown,\n  options: { nowMs?: number } = {},\n): ConnectorAttachmentTransferEnvelope {\n  const envelope = ConnectorAttachmentTransferEnvelope.parse(value);\n  const nowMs = options.nowMs ?? Date.now();\n  for (const attachment of envelope.attachments) {\n    if (Date.parse(attachment.source.expiresAt) <= nowMs) {\n      throw new Error(\"connector attachment source is expired\");\n    }\n  }\n  return envelope;\n}\n"],"mappings":";AAAA,SAAS,SAAS;AAEX,IAAM,wCAAwC;AAC9C,IAAM,uCAAuC;AAC7C,IAAM,yCACX;AACK,IAAM,wCACX;AACK,IAAM,iCAAiC;AAEvC,IAAM,iCAAiC;AACvC,IAAM,+CAA+C;AACrD,IAAM,iDAAiD;AACvD,IAAM,+CAA+C;AACrD,IAAM,kDAAkD;AACxD,IAAM,iDAAiD,IAAI;AAC3D,IAAM,mDAAmD,IAAI;AAEpE,IAAM,mBAAmB;AACzB,IAAM,iBAAiB;AACvB,IAAM,qBACJ;AACF,IAAM,4BAA4B;AAClC,IAAM,6BAA6B;AACnC,IAAM,sCAAsC;AAC5C,IAAM,qCAAqC;AAC3C,IAAM,cAAc,IAAI,YAAY;AAEpC,SAAS,UAAU,OAAuB;AACxC,SAAO,YAAY,OAAO,KAAK,EAAE;AACnC;AAEA,SAAS,cAAc,cAAsB;AAC3C,SAAO,EAAE,OAAO,EAAE,OAAO,CAAC,UAAU,UAAU,KAAK,KAAK,cAAc;AAAA,IACpE,SAAS,mBAAmB,YAAY;AAAA,EAC1C,CAAC;AACH;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,KAAK;AAC5B,WAAO,OAAO,aAAa,WAAW,OAAO,aAAa;AAAA,EAC5D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBAAyB,OAAwB;AACxD,SAAO,2BAA2B,KAAK,KAAK;AAC9C;AAEA,SAAS,gCAAgC,OAAwB;AAC/D,QAAM,aAAa,MAAM,YAAY,EAAE,QAAQ,eAAe,EAAE;AAChE,SACE,eAAe,SACf,eAAe,UACf,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,OAAO,KAC3B,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,UAAU,KAC9B,WAAW,SAAS,UAAU,KAC9B,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,QAAQ,KAC5B,WAAW,SAAS,WAAW,KAC/B,WAAW,SAAS,eAAe,KACnC,WAAW,SAAS,KAAK,KACzB,eAAe;AAEnB;AAEA,SAAS,2BAA2B,OAAyB;AAC3D,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,CAAC,MAAM,UAAU,KAAK,OAAO,cAAc;AACpD,QAAI,cAAc,gCAAgC,IAAI,EAAG,aAAY,IAAI,UAAU;AAAA,EACrF;AACA,aAAW,QAAQ,OAAO,OAAO,MAAM,CAAC,EAAE,MAAM,GAAG,GAAG;AACpD,QAAI,CAAC,KAAM;AACX,UAAM,YAAY,KAAK,QAAQ,GAAG;AAClC,UAAM,UAAU,cAAc,KAAK,OAAO,KAAK,MAAM,GAAG,SAAS;AACjE,UAAM,gBAAgB,cAAc,KAAK,KAAK,KAAK,MAAM,YAAY,CAAC;AACtE,QAAI;AACJ,QAAI;AACF,oBAAc,mBAAmB,QAAQ,QAAQ,QAAQ,GAAG,CAAC;AAAA,IAC/D,QAAQ;AACN;AAAA,IACF;AACA,QAAI,iBAAiB,gCAAgC,WAAW,GAAG;AACjE,kBAAY,IAAI,aAAa;AAAA,IAC/B;AAAA,EACF;AACA,SAAO,CAAC,GAAG,WAAW;AACxB;AAEA,SAAS,iCAAiC,aAAqB,YAA6B;AAC1F,SAAO,YAAY,SAAS,UAAU;AACxC;AAEO,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,UAAU,cAAc,4CAA4C,EAAE,MAAM,gBAAgB;AAAA,EAC5F,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC5B,OAAO,cAAc,+CAA+C,EACjE,IAAI,CAAC,EACL,OAAO,CAAC,UAAU,CAAC,0BAA0B,KAAK,KAAK,GAAG;AAAA,IACzD,SAAS;AAAA,EACX,CAAC,EACA,OAAO,CAAC,UAAU,CAAC,UAAU,KAAK,KAAK,CAAC,yBAAyB,KAAK,GAAG;AAAA,IACxE,SAAS;AAAA,EACX,CAAC;AACL,CAAC,EACA,OAAO;AAKH,IAAM,8BAA8B;AAAA,EACzC;AACF,EACG,IAAI,CAAC,EACL;AAAA,EACC,CAAC,UACC,UAAU,OACV,UAAU,QACV,UAAU,MAAM,KAAK,KACrB,CAAC,MAAM,SAAS,GAAG,KACnB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,0BAA0B,KAAK,KAAK,KACrC,CAAC,oCAAoC,KAAK,KAAK,KAC/C,CAAC,SAAS,KAAK,KAAK,KACpB,CAAC,mCAAmC,KAAK,KAAK;AAAA,EAChD,EAAE,SAAS,+BAA+B;AAC5C;AAEK,IAAM,+BAA+B;AAAA,EAC1C;AACF,EACG,MAAM,kBAAkB,EACxB,OAAO,CAAC,UAAU,CAAC,yBAAyB,KAAK,GAAG;AAAA,EACnD,SAAS;AACX,CAAC;AAEI,IAAM,4BAA4B,EAAE,OAAO,EAAE,MAAM,cAAc;AAEjE,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,KAAK,cAAc,8CAA8C,EAAE;AAAA,IACjE,CAAC,OAAO,YAAY;AAClB,UAAI;AACJ,UAAI;AACF,iBAAS,IAAI,IAAI,KAAK;AAAA,MACxB,QAAQ;AACN,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AACD;AAAA,MACF;AACA,UAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,gBAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yBAAyB,CAAC;AAAA,MACxE;AACA,UAAI,OAAO,YAAY,OAAO,UAAU;AACtC,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,UAAI,OAAO,MAAM;AACf,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAAA,EACA,WAAW,EAAE,IAAI,SAAS,EAAE,QAAQ,KAAK,CAAC;AAC5C,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,sBAAsB;AAAA,EACtB,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,EACpE,eAAe;AAAA,EACf,QAAQ;AACV,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,QAAM,eAAe;AAAA,IACnB,WAAW,qBAAqB;AAAA,IAChC,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACA,aAAW,cAAc,2BAA2B,WAAW,OAAO,GAAG,GAAG;AAC1E,QAAI,aAAa,KAAK,CAAC,UAAU,iCAAiC,OAAO,UAAU,CAAC,GAAG;AACrF,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAGI,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,qCAAqC;AAAA,EACxD,aAAa,EAAE,MAAM,2BAA2B,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAC7F,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,YAAY;AAClC,QAAM,aAAa,oBAAI,IAAY;AACnC,aAAW,CAAC,OAAO,UAAU,KAAK,SAAS,YAAY,QAAQ,GAAG;AAChE,UAAM,WAAW,GAAG,WAAW,qBAAqB,QAAQ,KAAK,WAAW,qBAAqB,KAAK;AACtG,QAAI,WAAW,IAAI,QAAQ,GAAG;AAC5B,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,MAAM,CAAC,eAAe,OAAO,sBAAsB;AAAA,MACrD,CAAC;AAAA,IACH;AACA,eAAW,IAAI,QAAQ;AAAA,EACzB;AACF,CAAC;AAKI,IAAM,iCAAiC;AAAA,EAC5C;AACF,EACG,IAAI,CAAC,EACL;AAAA,EACC,CAAC,UAAU;AACT,QACE,UAAU,MAAM,KAAK,KACrB,MAAM,WAAW,GAAG,KACpB,mBAAmB,KAAK,KAAK,KAC7B,MAAM,SAAS,IAAI,KACnB,0BAA0B,KAAK,KAAK,GACpC;AACA,aAAO;AAAA,IACT;AACA,UAAM,WAAW,MAAM,MAAM,GAAG;AAChC,QACE,SAAS,WAAW,KACpB,SAAS,CAAC,MAAM,eAChB,SAAS,CAAC,MAAM,2BAChB,CAAC,iBAAiB,KAAK,SAAS,CAAC,KAAK,EAAE,KACxC,CAAC,kBAAkB,KAAK,SAAS,CAAC,KAAK,EAAE,KACzC,CAAC,4BAA4B,UAAU,SAAS,CAAC,CAAC,EAAE,SACpD;AACA,aAAO;AAAA,IACT;AACA,WAAO,SAAS;AAAA,MACd,CAAC,YACC,QAAQ,SAAS,KACjB,YAAY,OACZ,YAAY,QACZ,CAAC,oCAAoC,KAAK,OAAO,KACjD,CAAC,SAAS,KAAK,OAAO,KACtB,CAAC,mCAAmC,KAAK,OAAO;AAAA,IACpD;AAAA,EACF;AAAA,EACA,EAAE,SAAS,uDAAuD;AACpE;AAEK,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,sBAAsB;AAAA,EACtB,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAAA,EACpE,eAAe;AAAA,EACf,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,WAAW,QAAQ,YAAY,MAAM,GAAG;AAC9C,MAAI,SAAS,CAAC,MAAM,QAAQ,qBAAqB,UAAU;AACzD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,aAAa;AAAA,IACtB,CAAC;AAAA,EACH;AACA,MAAI,SAAS,CAAC,MAAM,QAAQ,UAAU;AACpC,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM,CAAC,aAAa;AAAA,IACtB,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,oCAAoC;AAAA,EACvD,aAAa,EAAE,MAAM,0BAA0B,EAAE,IAAI,CAAC,EAAE,IAAI,8BAA8B;AAC5F,CAAC,EACA,OAAO;AAGH,SAAS,yCACd,OACA,UAA8B,CAAC,GACM;AACrC,QAAM,WAAW,oCAAoC,MAAM,KAAK;AAChE,QAAM,QAAQ,QAAQ,SAAS,KAAK,IAAI;AACxC,aAAW,cAAc,SAAS,aAAa;AAC7C,QAAI,KAAK,MAAM,WAAW,OAAO,SAAS,KAAK,OAAO;AACpD,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AAAA,EACF;AACA,SAAO;AACT;","names":[]}