@opengeni/contracts 1.0.1 → 2.2.0-canary.0

package/dist/connection-authority.js

@@ -0,0 +1,364 @@
+import {
+  ConnectionKind,
+  ManagedUserResourceGrantMode,
+  SessionTenancyVisibility,
+  UserResourceAuthorityGrant,
+  UserResourceDelegation
+} from "./chunk-7ZZ3R27P.js";
+import "./chunk-MRWYRAS5.js";
+import "./chunk-JUFK3T4Q.js";
+import "./chunk-WYBDERIY.js";
+import "./chunk-N6GRVXAJ.js";
+import "./chunk-3SIZGL3O.js";
+import "./chunk-NVJMJWLL.js";
+import "./chunk-7RMTKFJW.js";
+import "./chunk-Y3KNXVTD.js";
+import "./chunk-RIY7GYQS.js";
+import "./chunk-YRKRZ6OF.js";
+import "./chunk-CM6BMECR.js";
+import "./chunk-D2HKF2EF.js";
+import "./chunk-MYBZRDTY.js";
+import "./chunk-TXTQIYCV.js";
+import "./chunk-PX3VCKAU.js";
+import "./chunk-M5ZGRVIQ.js";
+import "./chunk-YBW5JSA3.js";
+
+// src/connection-authority.ts
+import { z } from "zod";
+var ConnectionUseAction = z.literal("connection.use");
+var ConnectionAuthorityEnvelope = z.object({
+  scope: z.enum(["workspace", "user"]).default("workspace"),
+  userDelegation: UserResourceDelegation.optional()
+}).strict().superRefine((value, context) => {
+  if (value.scope === "workspace" && value.userDelegation !== void 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation"],
+      message: "workspace connections cannot carry user delegation"
+    });
+    return;
+  }
+  if (value.scope === "user" && value.userDelegation === void 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation"],
+      message: "user connections require an immutable delegation"
+    });
+    return;
+  }
+  if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation", "action"],
+      message: "connection delegation must use connection.use"
+    });
+  }
+});
+var ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({
+  action: ConnectionUseAction
+}).strict();
+var ConnectionAuthoritySummary = z.object({
+  authorityId: z.string().uuid(),
+  resourceId: z.string().uuid(),
+  originWorkspaceId: z.string().uuid().nullable(),
+  generation: z.number().int().positive(),
+  status: z.enum(["active", "retained", "revoked"]),
+  grants: z.array(ConnectionAuthorityGrant)
+}).strict();
+var ListConnectionAuthoritiesQuery = z.object({
+  scope: z.literal("user"),
+  cursor: z.string().uuid().optional(),
+  limit: z.coerce.number().int().min(1).max(100).default(50)
+}).strict();
+var ListConnectionAuthoritiesResponse = z.object({
+  scope: z.literal("user"),
+  authorities: z.array(ConnectionAuthoritySummary),
+  nextCursor: z.string().uuid().nullable()
+}).strict();
+var IssueConnectionUseGrantRequest = z.object({
+  scope: z.literal("user"),
+  mode: ManagedUserResourceGrantMode,
+  context: SessionTenancyVisibility,
+  sessionId: z.string().uuid().nullable().optional(),
+  expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),
+  workspaceSharedAcknowledged: z.boolean().default(false)
+}).strict().superRefine((value, context) => {
+  if (value.context === "workspace_shared" && !value.workspaceSharedAcknowledged) {
+    context.addIssue({
+      code: "custom",
+      path: ["workspaceSharedAcknowledged"],
+      message: "workspace_shared requires durable shared-output acknowledgement"
+    });
+  }
+  if (value.mode === "always" && (value.sessionId || value.expectedAuthorityEpoch)) {
+    context.addIssue({ code: "custom", path: ["sessionId"], message: "always is unbound" });
+  }
+  if (value.mode === "session" && (!value.sessionId || !value.expectedAuthorityEpoch)) {
+    context.addIssue({
+      code: "custom",
+      path: ["sessionId"],
+      message: "session requires a target session and expectedAuthorityEpoch"
+    });
+  }
+});
+var RevokeConnectionUseGrantQuery = z.object({ scope: z.literal("user") }).strict();
+var ConnectionUseGrantMutationResponse = z.object({
+  scope: z.literal("user"),
+  grant: ConnectionAuthorityGrant
+}).strict();
+var ConnectionUseGrantRevocationResponse = z.object({
+  scope: z.literal("user"),
+  grant: z.object({
+    grantId: z.string().uuid(),
+    generation: z.number().int().positive(),
+    status: z.literal("revoked"),
+    revokedAt: z.string().datetime()
+  }).strict()
+}).strict();
+var ConnectionAuthoritySelectionSource = z.enum([
+  "explicit_workspace",
+  "legacy_workspace_omission",
+  "legacy_user_compatibility",
+  "user_delegation"
+]);
+var ConnectionUseSelectionSource = z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);
+var AcceptedConnectionWork = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("turn"),
+    turnId: z.string().uuid()
+  }).strict(),
+  z.object({
+    kind: z.literal("scheduled_task"),
+    taskId: z.string().uuid(),
+    taskAuthorityRevision: z.number().int().positive(),
+    runId: z.string().uuid()
+  }).strict()
+]);
+var ConnectionUseAuthoritySnapshot = z.object({
+  organizationId: z.string().uuid(),
+  originWorkspaceId: z.string().uuid(),
+  targetWorkspaceId: z.string().uuid(),
+  targetSessionId: z.string().uuid(),
+  targetSessionVisibility: SessionTenancyVisibility,
+  targetSessionAuthorityEpoch: z.number().int().positive(),
+  acceptedWork: AcceptedConnectionWork,
+  connectionId: z.string().uuid(),
+  connectionGeneration: z.number().int().positive(),
+  connectionStatus: z.literal("active"),
+  providerDomain: z.string().min(1).max(2048),
+  connectionKind: ConnectionKind,
+  scope: z.enum(["workspace", "user", "legacy_user"]),
+  ownerSubjectId: z.string().min(1).max(512).nullable(),
+  ownerOrganizationMembershipId: z.string().uuid().nullable(),
+  ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
+  authoritySource: ConnectionAuthoritySelectionSource,
+  selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
+  userDelegation: UserResourceDelegation.nullable()
+}).strict().superRefine((value, context) => {
+  const ownedBySubject = value.scope !== "workspace";
+  const delegated = value.scope === "user";
+  if (ownedBySubject !== (value.ownerSubjectId !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["ownerSubjectId"],
+      message: "personal connections retain an owner subject"
+    });
+  }
+  if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["ownerOrganizationMembershipId"],
+      message: "only user connections retain an owner membership"
+    });
+  }
+  if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["ownerMembershipAuthorizationRevision"],
+      message: "only user connections retain an owner membership revision"
+    });
+  }
+  if (delegated !== (value.userDelegation !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation"],
+      message: "only user connections retain a delegation"
+    });
+  }
+  if (delegated && value.authoritySource !== "user_delegation") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "user connections require user_delegation provenance"
+    });
+  }
+  if (!delegated && value.authoritySource === "user_delegation") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "non-delegated connections cannot claim user delegation provenance"
+    });
+  }
+  if (value.scope === "legacy_user" && value.authoritySource !== "legacy_user_compatibility") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "legacy user connections require explicit compatibility provenance"
+    });
+  }
+  if (value.scope === "workspace" && value.authoritySource === "legacy_user_compatibility") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "workspace connections cannot claim legacy user provenance"
+    });
+  }
+  if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
+    context.addIssue({
+      code: "custom",
+      path: ["originWorkspaceId"],
+      message: "workspace connections must be owned by the target workspace"
+    });
+  }
+  const delegation = value.userDelegation;
+  if (!delegation) return;
+  const exactFacts = [
+    [
+      delegation.organizationId === value.organizationId,
+      ["userDelegation", "organizationId"],
+      "delegation organization mismatch"
+    ],
+    [
+      delegation.workspaceId === value.targetWorkspaceId,
+      ["userDelegation", "workspaceId"],
+      "delegation target workspace mismatch"
+    ],
+    [
+      delegation.action === ConnectionUseAction.value,
+      ["userDelegation", "action"],
+      "delegation action mismatch"
+    ],
+    [
+      delegation.context === value.targetSessionVisibility,
+      ["userDelegation", "context"],
+      "delegation visibility mismatch"
+    ]
+  ];
+  for (const [matches, path, message] of exactFacts) {
+    if (!matches) context.addIssue({ code: "custom", path, message });
+  }
+  if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation", "sessionId"],
+      message: "delegation session mismatch"
+    });
+  }
+  if (delegation.authorityEpoch !== null && delegation.authorityEpoch !== value.targetSessionAuthorityEpoch) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation", "authorityEpoch"],
+      message: "delegation authority epoch mismatch"
+    });
+  }
+});
+var ConnectionUseDenialReason = z.enum([
+  "tenant_mismatch",
+  "workspace_access_inactive",
+  "session_inactive",
+  "session_identity_changed",
+  "session_visibility_changed",
+  "session_authority_epoch_changed",
+  "accepted_attempt_authority_required",
+  "accepted_snapshot_digest_changed",
+  "connection_missing",
+  "connection_identity_changed",
+  "connection_generation_changed",
+  "connection_status_inactive",
+  "connection_owner_changed",
+  "owner_membership_inactive",
+  "authority_missing",
+  "authority_identity_changed",
+  "authority_generation_changed",
+  "authority_status_inactive",
+  "grant_missing",
+  "grant_identity_changed",
+  "grant_generation_changed",
+  "grant_status_inactive",
+  "grant_expired",
+  "grant_already_consumed"
+]);
+var ConnectionUseAttributionFields = z.object({
+  organizationId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  sessionId: z.string().uuid(),
+  connectionId: z.string().uuid(),
+  connectionGeneration: z.number().int().positive(),
+  scope: z.enum(["workspace", "user", "legacy_user"]),
+  ownerSubjectId: z.string().min(1).max(512).nullable(),
+  authorityId: z.string().uuid().nullable(),
+  grantId: z.string().uuid().nullable()
+}).strict();
+function refineConnectionUseAttribution(value, context) {
+  const personal = value.scope !== "workspace";
+  for (const field of ["ownerSubjectId"]) {
+    if (personal !== (value[field] !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
+      });
+    }
+  }
+  const delegated = value.scope === "user";
+  for (const field of ["authorityId", "grantId"]) {
+    if (delegated !== (value[field] !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: delegated ? `delegated personal attribution requires ${field}` : `non-delegated attribution cannot carry ${field}`
+      });
+    }
+  }
+}
+var ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(
+  refineConnectionUseAttribution
+);
+var ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({
+  outcome: z.enum(["authorized", "denied"]),
+  denialReason: ConnectionUseDenialReason.nullable(),
+  occurredAt: z.string().datetime({ offset: true })
+}).superRefine((value, context) => {
+  refineConnectionUseAttribution(value, context);
+  if (value.outcome === "denied" !== (value.denialReason !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["denialReason"],
+      message: "only denied connection use carries a denial reason"
+    });
+  }
+});
+var ConnectionUseAuthorizationResult = z.discriminatedUnion("status", [
+  z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
+  z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
+]);
+export {
+  ConnectionAuthorityEnvelope,
+  ConnectionAuthorityGrant,
+  ConnectionAuthoritySelectionSource,
+  ConnectionAuthoritySummary,
+  ConnectionUseAction,
+  ConnectionUseAttribution,
+  ConnectionUseAuditFact,
+  ConnectionUseAuthoritySnapshot,
+  ConnectionUseAuthorizationResult,
+  ConnectionUseDenialReason,
+  ConnectionUseGrantMutationResponse,
+  ConnectionUseGrantRevocationResponse,
+  ConnectionUseSelectionSource,
+  IssueConnectionUseGrantRequest,
+  ListConnectionAuthoritiesQuery,
+  ListConnectionAuthoritiesResponse,
+  RevokeConnectionUseGrantQuery
+};
+//# sourceMappingURL=connection-authority.js.map

package/dist/connection-authority.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  ConnectionKind,\n  ManagedUserResourceGrantMode,\n  SessionTenancyVisibility,\n  UserResourceAuthorityGrant,\n  UserResourceDelegation,\n} from \"./index\";\n\n/** The only generic grant action that authorizes use of a connection. */\nexport const ConnectionUseAction = z.literal(\"connection.use\");\nexport type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;\n\n/**\n * Connection authority is either workspace-owned or user-owned. Omission is\n * intentionally compatible with the historical workspace connection path.\n */\nexport const ConnectionAuthorityEnvelope = z\n  .object({\n    scope: z.enum([\"workspace\", \"user\"]).default(\"workspace\"),\n    userDelegation: UserResourceDelegation.optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.scope === \"workspace\" && value.userDelegation !== undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"workspace connections cannot carry user delegation\",\n      });\n      return;\n    }\n    if (value.scope === \"user\" && value.userDelegation === undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"user connections require an immutable delegation\",\n      });\n      return;\n    }\n    if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"action\"],\n        message: \"connection delegation must use connection.use\",\n      });\n    }\n  });\nexport type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;\n\nexport const ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({\n  action: ConnectionUseAction,\n}).strict();\nexport type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;\n\n/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */\nexport const ConnectionAuthoritySummary = z\n  .object({\n    authorityId: z.string().uuid(),\n    resourceId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid().nullable(),\n    generation: z.number().int().positive(),\n    status: z.enum([\"active\", \"retained\", \"revoked\"]),\n    grants: z.array(ConnectionAuthorityGrant),\n  })\n  .strict();\nexport type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;\n\nexport const ListConnectionAuthoritiesQuery = z\n  .object({\n    scope: z.literal(\"user\"),\n    cursor: z.string().uuid().optional(),\n    limit: z.coerce.number().int().min(1).max(100).default(50),\n  })\n  .strict();\nexport const ListConnectionAuthoritiesResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    authorities: z.array(ConnectionAuthoritySummary),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\n\nexport const IssueConnectionUseGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\nexport type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;\n\nexport const RevokeConnectionUseGrantQuery = z.object({ scope: z.literal(\"user\") }).strict();\n\nexport const ConnectionUseGrantMutationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: ConnectionAuthorityGrant,\n  })\n  .strict();\nexport type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;\n\nexport const ConnectionUseGrantRevocationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: z\n      .object({\n        grantId: z.string().uuid(),\n        generation: z.number().int().positive(),\n        status: z.literal(\"revoked\"),\n        revokedAt: z.string().datetime(),\n      })\n      .strict(),\n  })\n  .strict();\nexport type ConnectionUseGrantRevocationResponse = z.infer<\n  typeof ConnectionUseGrantRevocationResponse\n>;\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\n  \"explicit_workspace\",\n  \"legacy_workspace_omission\",\n  \"legacy_user_compatibility\",\n  \"user_delegation\",\n]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n  z\n    .object({\n      kind: z.literal(\"turn\"),\n      turnId: z.string().uuid(),\n    })\n    .strict(),\n  z\n    .object({\n      kind: z.literal(\"scheduled_task\"),\n      taskId: z.string().uuid(),\n      taskAuthorityRevision: z.number().int().positive(),\n      runId: z.string().uuid(),\n    })\n    .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n  .object({\n    organizationId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid(),\n    targetWorkspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive(),\n    acceptedWork: AcceptedConnectionWork,\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    connectionStatus: z.literal(\"active\"),\n    providerDomain: z.string().min(1).max(2048),\n    connectionKind: ConnectionKind,\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    ownerOrganizationMembershipId: z.string().uuid().nullable(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n    authoritySource: ConnectionAuthoritySelectionSource,\n    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n    userDelegation: UserResourceDelegation.nullable(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    const ownedBySubject = value.scope !== \"workspace\";\n    const delegated = value.scope === \"user\";\n    if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerSubjectId\"],\n        message: \"personal connections retain an owner subject\",\n      });\n    }\n    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerOrganizationMembershipId\"],\n        message: \"only user connections retain an owner membership\",\n      });\n    }\n    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerMembershipAuthorizationRevision\"],\n        message: \"only user connections retain an owner membership revision\",\n      });\n    }\n    if (delegated !== (value.userDelegation !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"only user connections retain a delegation\",\n      });\n    }\n    if (delegated && value.authoritySource !== \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"user connections require user_delegation provenance\",\n      });\n    }\n    if (!delegated && value.authoritySource === \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"non-delegated connections cannot claim user delegation provenance\",\n      });\n    }\n    if (value.scope === \"legacy_user\" && value.authoritySource !== \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"legacy user connections require explicit compatibility provenance\",\n      });\n    }\n    if (value.scope === \"workspace\" && value.authoritySource === \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"workspace connections cannot claim legacy user provenance\",\n      });\n    }\n    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"originWorkspaceId\"],\n        message: \"workspace connections must be owned by the target workspace\",\n      });\n    }\n    const delegation = value.userDelegation;\n    if (!delegation) return;\n    const exactFacts: Array<[boolean, (string | number)[], string]> = [\n      [\n        delegation.organizationId === value.organizationId,\n        [\"userDelegation\", \"organizationId\"],\n        \"delegation organization mismatch\",\n      ],\n      [\n        delegation.workspaceId === value.targetWorkspaceId,\n        [\"userDelegation\", \"workspaceId\"],\n        \"delegation target workspace mismatch\",\n      ],\n      [\n        delegation.action === ConnectionUseAction.value,\n        [\"userDelegation\", \"action\"],\n        \"delegation action mismatch\",\n      ],\n      [\n        delegation.context === value.targetSessionVisibility,\n        [\"userDelegation\", \"context\"],\n        \"delegation visibility mismatch\",\n      ],\n    ];\n    for (const [matches, path, message] of exactFacts) {\n      if (!matches) context.addIssue({ code: \"custom\", path, message });\n    }\n    if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"sessionId\"],\n        message: \"delegation session mismatch\",\n      });\n    }\n    if (\n      delegation.authorityEpoch !== null &&\n      delegation.authorityEpoch !== value.targetSessionAuthorityEpoch\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"authorityEpoch\"],\n        message: \"delegation authority epoch mismatch\",\n      });\n    }\n  });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n  \"tenant_mismatch\",\n  \"workspace_access_inactive\",\n  \"session_inactive\",\n  \"session_identity_changed\",\n  \"session_visibility_changed\",\n  \"session_authority_epoch_changed\",\n  \"accepted_attempt_authority_required\",\n  \"accepted_snapshot_digest_changed\",\n  \"connection_missing\",\n  \"connection_identity_changed\",\n  \"connection_generation_changed\",\n  \"connection_status_inactive\",\n  \"connection_owner_changed\",\n  \"owner_membership_inactive\",\n  \"authority_missing\",\n  \"authority_identity_changed\",\n  \"authority_generation_changed\",\n  \"authority_status_inactive\",\n  \"grant_missing\",\n  \"grant_identity_changed\",\n  \"grant_generation_changed\",\n  \"grant_status_inactive\",\n  \"grant_expired\",\n  \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n  .object({\n    organizationId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    sessionId: z.string().uuid(),\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    authorityId: z.string().uuid().nullable(),\n    grantId: z.string().uuid().nullable(),\n  })\n  .strict();\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const delegated = value.scope === \"user\";\n  for (const field of [\"authorityId\", \"grantId\"] as const) {\n    if (delegated !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: delegated\n          ? `delegated personal attribution requires ${field}`\n          : `non-delegated attribution cannot carry ${field}`,\n      });\n    }\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(\n  refineConnectionUseAttribution,\n);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n  outcome: z.enum([\"authorized\", \"denied\"]),\n  denialReason: ConnectionUseDenialReason.nullable(),\n  occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n  refineConnectionUseAttribution(value, context);\n  if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"denialReason\"],\n      message: \"only denied connection use carries a denial reason\",\n    });\n  }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n  z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,QAAQ,gBAAgB;AAOtD,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC,EAAE,QAAQ,WAAW;AAAA,EACxD,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,UAAU,eAAe,MAAM,mBAAmB,QAAW;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,UAAU,UAAU,MAAM,mBAAmB,QAAW;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB,MAAM,eAAe,WAAW,oBAAoB,OAAO;AACrF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,QAAQ;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,2BAA2B,2BAA2B,OAAO;AAAA,EACxE,QAAQ;AACV,CAAC,EAAE,OAAO;AAIH,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,wBAAwB;AAC1C,CAAC,EACA,OAAO;AAGH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC,EACA,OAAO;AACH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,aAAa,EAAE,MAAM,0BAA0B;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAEH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAEpF,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,mBAAmB,OAAO;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,mBAAmB;AAC5D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,mBAAmB;AAC7D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,iBAAiB,MAAM,oBAAoB,6BAA6B;AAC1F,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,eAAe,MAAM,oBAAoB,6BAA6B;AACxF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAM;AACzB,MAAI,CAAC,WAAY;AACjB,QAAM,aAA4D;AAAA,IAChE;AAAA,MACE,WAAW,mBAAmB,MAAM;AAAA,MACpC,CAAC,kBAAkB,gBAAgB;AAAA,MACnC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,gBAAgB,MAAM;AAAA,MACjC,CAAC,kBAAkB,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,WAAW,oBAAoB;AAAA,MAC1C,CAAC,kBAAkB,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,YAAY,MAAM;AAAA,MAC7B,CAAC,kBAAkB,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,SAAS,MAAM,OAAO,KAAK,YAAY;AACjD,QAAI,CAAC,QAAS,SAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,cAAc,QAAQ,WAAW,cAAc,MAAM,iBAAiB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,WAAW;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,WAAW,mBAAmB,QAC9B,WAAW,mBAAmB,MAAM,6BACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,gBAAgB;AAAA,MACzC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,MAAM,UAAU;AAClC,aAAW,SAAS,CAAC,eAAe,SAAS,GAAY;AACvD,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,YACL,2CAA2C,KAAK,KAChD,0CAA0C,KAAK;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,IAAM,2BAA2B,+BAA+B;AAAA,EACrE;AACF;AAGO,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}

package/dist/connector-attachments.d.ts

@@ -0,0 +1,95 @@
+import { z } from "zod";
+export declare const CONNECTOR_ATTACHMENT_TRANSFER_VERSION: 1;
+export declare const CONNECTOR_ATTACHMENT_RECEIPT_VERSION: 1;
+export declare const CONNECTOR_ATTACHMENT_TRANSFER_META_KEY: "opengeni/connector-attachment-transfers";
+export declare const CONNECTOR_ATTACHMENT_RECEIPT_META_KEY: "opengeni/connector-attachment-receipts";
+export declare const CONNECTOR_ATTACHMENT_MAX_COUNT = 16;
+export declare const CONNECTOR_ATTACHMENT_MAX_BYTES = 5000000000;
+export declare const CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES = 255;
+export declare const CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES = 256;
+export declare const CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES = 128;
+export declare const CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES = 512;
+export declare const CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES: number;
+export declare const CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES: number;
+export declare const ConnectorAttachmentProviderIdentity: z.ZodObject<{
+    provider: z.ZodString;
+    kind: z.ZodLiteral<"attachment">;
+    value: z.ZodString;
+}, z.core.$strict>;
+export type ConnectorAttachmentProviderIdentity = z.infer<typeof ConnectorAttachmentProviderIdentity>;
+export declare const ConnectorAttachmentFileName: z.ZodString;
+export declare const ConnectorAttachmentMediaType: z.ZodString;
+export declare const ConnectorAttachmentSha256: z.ZodString;
+export declare const ConnectorAttachmentPrivateSource: z.ZodObject<{
+    url: z.ZodString;
+    expiresAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type ConnectorAttachmentPrivateSource = z.infer<typeof ConnectorAttachmentPrivateSource>;
+export declare const ConnectorAttachmentTransfer: z.ZodObject<{
+    providerAttachmentId: z.ZodObject<{
+        provider: z.ZodString;
+        kind: z.ZodLiteral<"attachment">;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    fileName: z.ZodString;
+    mediaType: z.ZodString;
+    byteSize: z.ZodNumber;
+    contentSha256: z.ZodString;
+    source: z.ZodObject<{
+        url: z.ZodString;
+        expiresAt: z.ZodISODateTime;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ConnectorAttachmentTransfer = z.infer<typeof ConnectorAttachmentTransfer>;
+export declare const ConnectorAttachmentTransferEnvelope: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    attachments: z.ZodArray<z.ZodObject<{
+        providerAttachmentId: z.ZodObject<{
+            provider: z.ZodString;
+            kind: z.ZodLiteral<"attachment">;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        fileName: z.ZodString;
+        mediaType: z.ZodString;
+        byteSize: z.ZodNumber;
+        contentSha256: z.ZodString;
+        source: z.ZodObject<{
+            url: z.ZodString;
+            expiresAt: z.ZodISODateTime;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ConnectorAttachmentTransferEnvelope = z.infer<typeof ConnectorAttachmentTransferEnvelope>;
+export declare const ConnectorAttachmentSandboxPath: z.ZodString;
+export declare const ConnectorAttachmentReceipt: z.ZodObject<{
+    providerAttachmentId: z.ZodObject<{
+        provider: z.ZodString;
+        kind: z.ZodLiteral<"attachment">;
+        value: z.ZodString;
+    }, z.core.$strict>;
+    fileName: z.ZodString;
+    mediaType: z.ZodString;
+    byteSize: z.ZodNumber;
+    contentSha256: z.ZodString;
+    sandboxPath: z.ZodString;
+}, z.core.$strict>;
+export type ConnectorAttachmentReceipt = z.infer<typeof ConnectorAttachmentReceipt>;
+export declare const ConnectorAttachmentReceiptEnvelope: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    attachments: z.ZodArray<z.ZodObject<{
+        providerAttachmentId: z.ZodObject<{
+            provider: z.ZodString;
+            kind: z.ZodLiteral<"attachment">;
+            value: z.ZodString;
+        }, z.core.$strict>;
+        fileName: z.ZodString;
+        mediaType: z.ZodString;
+        byteSize: z.ZodNumber;
+        contentSha256: z.ZodString;
+        sandboxPath: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type ConnectorAttachmentReceiptEnvelope = z.infer<typeof ConnectorAttachmentReceiptEnvelope>;
+export declare function parseConnectorAttachmentTransferEnvelope(value: unknown, options?: {
+    nowMs?: number;
+}): ConnectorAttachmentTransferEnvelope;

package/dist/connector-attachments.js

@@ -0,0 +1,51 @@
+import {
+  CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_MAX_BYTES,
+  CONNECTOR_ATTACHMENT_MAX_COUNT,
+  CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_RECEIPT_META_KEY,
+  CONNECTOR_ATTACHMENT_RECEIPT_VERSION,
+  CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_TRANSFER_META_KEY,
+  CONNECTOR_ATTACHMENT_TRANSFER_VERSION,
+  ConnectorAttachmentFileName,
+  ConnectorAttachmentMediaType,
+  ConnectorAttachmentPrivateSource,
+  ConnectorAttachmentProviderIdentity,
+  ConnectorAttachmentReceipt,
+  ConnectorAttachmentReceiptEnvelope,
+  ConnectorAttachmentSandboxPath,
+  ConnectorAttachmentSha256,
+  ConnectorAttachmentTransfer,
+  ConnectorAttachmentTransferEnvelope,
+  parseConnectorAttachmentTransferEnvelope
+} from "./chunk-YBW5JSA3.js";
+export {
+  CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_MAX_BYTES,
+  CONNECTOR_ATTACHMENT_MAX_COUNT,
+  CONNECTOR_ATTACHMENT_MEDIA_TYPE_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_PROVIDER_ID_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_PROVIDER_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_RECEIPT_META_KEY,
+  CONNECTOR_ATTACHMENT_RECEIPT_VERSION,
+  CONNECTOR_ATTACHMENT_SANDBOX_PATH_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_SOURCE_URL_MAX_UTF8_BYTES,
+  CONNECTOR_ATTACHMENT_TRANSFER_META_KEY,
+  CONNECTOR_ATTACHMENT_TRANSFER_VERSION,
+  ConnectorAttachmentFileName,
+  ConnectorAttachmentMediaType,
+  ConnectorAttachmentPrivateSource,
+  ConnectorAttachmentProviderIdentity,
+  ConnectorAttachmentReceipt,
+  ConnectorAttachmentReceiptEnvelope,
+  ConnectorAttachmentSandboxPath,
+  ConnectorAttachmentSha256,
+  ConnectorAttachmentTransfer,
+  ConnectorAttachmentTransferEnvelope,
+  parseConnectorAttachmentTransferEnvelope
+};
+//# sourceMappingURL=connector-attachments.js.map

package/dist/connector-attachments.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/editable-artifact-codec-registry.d.ts

@@ -1,14 +1,21 @@
-import { EDITABLE_ARTIFACT_MODEL_SCHEMA_VERSION, EDITABLE_ARTIFACT_SNAPSHOT_VERSION } from "./editable-artifact-versions.js";
-export { EDITABLE_ARTIFACT_MODEL_SCHEMA_VERSION, EDITABLE_ARTIFACT_SNAPSHOT_VERSION, } from "./editable-artifact-versions.js";
+export { DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION, DOCUMENT_ARTIFACT_SNAPSHOT_VERSION, PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION, PRESENTATION_ARTIFACT_SNAPSHOT_VERSION, SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION, SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION, } from "./editable-artifact-versions.js";
 export type EditableArtifactModality = "spreadsheet" | "document" | "presentation";
 export type EditableArtifactConcurrencySemantics = "causal-crdt-v1" | "authoritative-serialized-stale-base-v1";
+export type CurrentEditableArtifactCompatibility = Readonly<{
+    modality: EditableArtifactModality;
+    liveProtocolVersion: number;
+    modelSchemaVersion: number;
+    snapshotVersion: number;
+    commandProtocolVersion: number;
+    committedTransactionProtocolVersion: number;
+}>;
 export type EditableArtifactCodecDescriptor = Readonly<{
     modality: EditableArtifactModality;
-    modelSchemaVersion: typeof EDITABLE_ARTIFACT_MODEL_SCHEMA_VERSION;
-    snapshotVersion: typeof EDITABLE_ARTIFACT_SNAPSHOT_VERSION;
+    modelSchemaVersion: 1 | 2;
+    snapshotVersion: 1 | 2;
     command: Readonly<{
-        magic: "OGASC001" | "OGADC001" | "OGAPC001";
-        version: 1;
+        magic: "OGASC002" | "OGADC001" | "OGAPC001";
+        version: 1 | 2;
         maximumBytes: number;
         maximumCommands: number;
         encode: (value: unknown) => Uint8Array;
@@ -31,11 +38,13 @@ export type EditableArtifactCodecDescriptor = Readonly<{
     }>;
     concurrency: Readonly<{
         semantics: EditableArtifactConcurrencySemantics;
-        collaborationEnvelope: "OGACO001" | null;
+        collaborationEnvelope: "OGACO002" | null;
         staleBaseMustBeRejected: boolean;
     }>;
 }>;
 export declare const EDITABLE_ARTIFACT_CODEC_REGISTRY: Readonly<Record<EditableArtifactModality, EditableArtifactCodecDescriptor>>;
+/** One exact current compatibility tuple per durable modality. */
+export declare function currentEditableArtifactCompatibility(modality: EditableArtifactModality): CurrentEditableArtifactCompatibility;
 /**
  * Selects solely from the durable artifact modality plus persisted versions.
  * Modality intentionally never enters OGATX001: the durable artifact row is

package/dist/editable-artifact-codec-registry.js

@@ -1,20 +1,30 @@
 import {
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
+  currentEditableArtifactCompatibility,
   editableArtifactCodecFor
-} from "./chunk-JBCIY7QD.js";
+} from "./chunk-7RMTKFJW.js";
+import "./chunk-Y3KNXVTD.js";
 import "./chunk-RIY7GYQS.js";
-import "./chunk-CADSX6UN.js";
 import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
-import "./chunk-LSB7GRLG.js";
+import "./chunk-TXTQIYCV.js";
 import {
-  EDITABLE_ARTIFACT_MODEL_SCHEMA_VERSION,
-  EDITABLE_ARTIFACT_SNAPSHOT_VERSION
-} from "./chunk-BVGIYW7D.js";
+  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
+  DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,
+  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,
+  PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,
+  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
+  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
+} from "./chunk-PX3VCKAU.js";
 export {
+  DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
+  DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
-  EDITABLE_ARTIFACT_MODEL_SCHEMA_VERSION,
-  EDITABLE_ARTIFACT_SNAPSHOT_VERSION,
+  PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION,
+  PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,
+  SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
+  SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,
+  currentEditableArtifactCompatibility,
   editableArtifactCodecFor
 };
 //# sourceMappingURL=editable-artifact-codec-registry.js.map

package/dist/editable-artifact-committed-transaction.d.ts

@@ -1,5 +1,5 @@
 /**
- * Strict, allocation-bounded inspection of canonical OGACO001 transactions.
+ * Strict, allocation-bounded inspection of canonical OGACO002 transactions.
  *
  * The Rust kernel remains the authority for applying operations. This decoder
  * validates the complete envelope and every typed operation so metadata after
@@ -27,7 +27,7 @@ export type CommittedTransactionSummary = Readonly<{
     stateHash: string;
 }>;
 /**
- * Decodes only the metadata of one exact canonical OGACO001 byte envelope.
+ * Decodes only the metadata of one exact canonical OGACO002 byte envelope.
  *
  * This function is synchronous and never mutates or retains `bytes`. The
  * caller remains the owner of the exact canonical envelope.