@opengeni/contracts 1.0.2 → 1.2.0

package/dist/{chunk-46KLD2UH.js → chunk-QZPIUG3I.js}

@@ -1,7 +1,7 @@
 import {
   ConnectionKind,
   SessionTenancyVisibility
-} from "./chunk-X7ETVO4P.js";
+} from "./chunk-L73LKLKP.js";
 
 // src/connection-authority.ts
 import { z } from "zod";
@@ -183,4 +183,4 @@ export {
   ConnectionUseAuditFact,
   ConnectionUseAuthorizationResult
 };
-//# sourceMappingURL=chunk-46KLD2UH.js.map
+//# sourceMappingURL=chunk-QZPIUG3I.js.map

package/dist/chunk-XSBEB2HQ.js

@@ -0,0 +1,146 @@
+// src/model-display.ts
+function modelLogoUrl(input) {
+  const value = typeof input === "string" ? void 0 : input.logoUrl;
+  if (!value || value.length > 2048 || value !== value.trim()) return null;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && !url.username && !url.password ? value : null;
+  } catch {
+    return null;
+  }
+}
+var WORDS = {
+  gpt: "GPT",
+  chatgpt: "ChatGPT",
+  claude: "Claude",
+  grok: "Grok",
+  gemini: "Gemini",
+  gemma: "Gemma",
+  llama: "Llama",
+  deepseek: "DeepSeek",
+  qwen: "Qwen",
+  glm: "GLM",
+  kimi: "Kimi",
+  mistral: "Mistral",
+  codestral: "Codestral",
+  devstral: "Devstral",
+  magistral: "Magistral",
+  nemotron: "Nemotron",
+  oss: "OSS"
+};
+function modelSlug(value) {
+  const last = value.split("/").filter(Boolean).at(-1) ?? value;
+  return last.replace(/:[^:]*$/, "") || last;
+}
+function upstreamOf(input) {
+  return input.upstreamModelId?.trim() || input.deployment?.upstreamModelId?.trim() || null;
+}
+function titleToken(token, index) {
+  const lower = token.toLowerCase();
+  const word = WORDS[lower];
+  if (word) return word;
+  if (index === 0 && /^o\d+$/.test(lower)) return lower;
+  if (/^\d+(?:\.\d+)?[bkmt]$/.test(lower) || /^[a-z]\d+[a-z\d]*$/.test(lower)) {
+    return lower.toUpperCase();
+  }
+  if (/^\d/.test(token)) return lower;
+  return lower.charAt(0).toUpperCase() + lower.slice(1);
+}
+function humanizeModelSlug(value) {
+  const slug = modelSlug(value.trim()).replace(/[-_](?:\d{8}|\d{4}-\d{2}-\d{2})$/, "").replace(/[-_]latest$/i, "");
+  const raw = slug.split(/[-_\s]+/).filter(Boolean);
+  if (raw.length === 0) return value.trim() || value;
+  const tokens = [];
+  for (const token of raw) {
+    const previous = tokens.at(-1);
+    if (previous !== void 0 && /^\d{1,2}$/.test(token) && /^\d{1,2}$/.test(previous)) {
+      tokens[tokens.length - 1] = `${previous}.${token}`;
+      continue;
+    }
+    tokens.push(token);
+  }
+  const words = tokens.map(titleToken);
+  if (words[0] === "GPT" && words.length > 1 && /^\d/.test(words[1])) {
+    return [`GPT-${words[1]}`, ...words.slice(2)].join(" ");
+  }
+  return words.join(" ");
+}
+function isRawModelLabel(label, ids = []) {
+  const text = label.trim();
+  if (!text) return true;
+  return ids.some((id) => {
+    if (!id) return false;
+    const segments = id.trim().split("/").filter(Boolean);
+    return segments.some((_, index) => {
+      const tail = segments.slice(index).join("/");
+      return tail === text || modelSlug(tail) === text;
+    });
+  });
+}
+function modelDisplayName(input) {
+  if (typeof input === "string") {
+    return input.trim() && !/\s/.test(input.trim()) ? humanizeModelSlug(input) : input;
+  }
+  const upstream = upstreamOf(input);
+  const label = input.label?.trim();
+  if (label && !isRawModelLabel(label, [input.id, upstream])) return label;
+  return humanizeModelSlug(upstream ?? label ?? input.id);
+}
+var VENDOR_PATTERNS = [
+  ["anthropic", /^claude\b/],
+  ["openai", /^(?:gpt|chatgpt|o\d+|codex|dall-e|sora|text-embedding|whisper)\b/],
+  ["xai", /^grok\b/],
+  ["google", /^(?:gemini|gemma)\b/],
+  ["meta", /^llama\b/],
+  ["mistral", /^(?:mistral|codestral|devstral|magistral|ministral|pixtral)\b/],
+  ["deepseek", /^deepseek\b/],
+  ["moonshot", /^(?:kimi|moonshot)\b/],
+  ["qwen", /^(?:qwen|qwq)\b/],
+  ["zhipu", /^glm\b/],
+  ["nvidia", /^nemotron\b/]
+];
+var VENDOR_SEGMENTS = {
+  anthropic: "anthropic",
+  openai: "openai",
+  "x-ai": "xai",
+  xai: "xai",
+  google: "google",
+  "meta-llama": "meta",
+  mistralai: "mistral",
+  deepseek: "deepseek",
+  moonshotai: "moonshot",
+  qwen: "qwen",
+  "z-ai": "zhipu",
+  nvidia: "nvidia"
+};
+function vendorFromSlug(slug) {
+  for (const [vendor, pattern] of VENDOR_PATTERNS) if (pattern.test(slug)) return vendor;
+  return null;
+}
+function modelVendor(input) {
+  const ids = typeof input === "string" ? [input] : [upstreamOf(input), input.id];
+  for (const id of ids) {
+    if (!id) continue;
+    const lower = id.trim().toLowerCase();
+    if (lower.startsWith("codex/")) return "openai";
+    if (lower.startsWith("supergrok/")) return "xai";
+    const vendor = vendorFromSlug(modelSlug(lower));
+    if (vendor) return vendor;
+    const segment = lower.split("/").filter(Boolean).at(-2);
+    if (segment && Object.hasOwn(VENDOR_SEGMENTS, segment)) return VENDOR_SEGMENTS[segment];
+  }
+  if (typeof input !== "string" && input.label) {
+    return vendorFromSlug(input.label.trim().toLowerCase().replace(/\s+/g, "-"));
+  }
+  return null;
+}
+
+export {
+  modelLogoUrl,
+  modelSlug,
+  humanizeModelSlug,
+  isRawModelLabel,
+  modelDisplayName,
+  modelVendor
+};
+//# sourceMappingURL=chunk-XSBEB2HQ.js.map

package/dist/chunk-XSBEB2HQ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/model-display.ts"],"sourcesContent":["/**\n * One display identity for a model everywhere outside the Models settings page.\n *\n * Catalog ids carry routing facts (`codex/`, `organization-claude-subscription/`,\n * `workspace-openrouter/anthropic/...`) and custom models may have no curated\n * label. People should only ever see the model itself: `GPT-6.1 Sol`,\n * `Claude Opus 5.5`. The same upstream model therefore renders identically\n * whether an organization or a workspace connection serves it.\n *\n * Pure and dependency-free so the API, SDK, React package and web app share it.\n */\n\nexport type ModelVendor =\n  | \"openai\"\n  | \"anthropic\"\n  | \"xai\"\n  | \"google\"\n  | \"meta\"\n  | \"mistral\"\n  | \"deepseek\"\n  | \"moonshot\"\n  | \"qwen\"\n  | \"zhipu\"\n  | \"nvidia\";\n\nexport type ModelDisplayInput =\n  | string\n  | {\n      id: string;\n      label?: string | null | undefined;\n      logoUrl?: string | null | undefined;\n      upstreamModelId?: string | null | undefined;\n      deployment?: { upstreamModelId?: string | null | undefined } | null | undefined;\n    };\n\n/** Catalog maker logo; remote images must use HTTPS without embedded credentials. */\nexport function modelLogoUrl(input: ModelDisplayInput): string | null {\n  const value = typeof input === \"string\" ? undefined : input.logoUrl;\n  if (!value || value.length > 2048 || value !== value.trim()) return null;\n  try {\n    const url = new URL(value);\n    return url.protocol === \"https:\" && !url.username && !url.password ? value : null;\n  } catch {\n    return null;\n  }\n}\n\nconst WORDS: Readonly<Record<string, string>> = {\n  gpt: \"GPT\",\n  chatgpt: \"ChatGPT\",\n  claude: \"Claude\",\n  grok: \"Grok\",\n  gemini: \"Gemini\",\n  gemma: \"Gemma\",\n  llama: \"Llama\",\n  deepseek: \"DeepSeek\",\n  qwen: \"Qwen\",\n  glm: \"GLM\",\n  kimi: \"Kimi\",\n  mistral: \"Mistral\",\n  codestral: \"Codestral\",\n  devstral: \"Devstral\",\n  magistral: \"Magistral\",\n  nemotron: \"Nemotron\",\n  oss: \"OSS\",\n};\n\n/** The upstream model slug without routing prefixes or `:variant` suffixes. */\nexport function modelSlug(value: string): string {\n  const last = value.split(\"/\").filter(Boolean).at(-1) ?? value;\n  return last.replace(/:[^:]*$/, \"\") || last;\n}\n\nfunction upstreamOf(input: Exclude<ModelDisplayInput, string>): string | null {\n  return input.upstreamModelId?.trim() || input.deployment?.upstreamModelId?.trim() || null;\n}\n\nfunction titleToken(token: string, index: number): string {\n  const lower = token.toLowerCase();\n  const word = WORDS[lower];\n  if (word) return word;\n  // OpenAI reasoning series stay lowercase: o3, o4 Mini.\n  if (index === 0 && /^o\\d+$/.test(lower)) return lower;\n  // Sizes and lettered versions read as identifiers: 120B, V4, K3, A12B.\n  if (/^\\d+(?:\\.\\d+)?[bkmt]$/.test(lower) || /^[a-z]\\d+[a-z\\d]*$/.test(lower)) {\n    return lower.toUpperCase();\n  }\n  if (/^\\d/.test(token)) return lower;\n  return lower.charAt(0).toUpperCase() + lower.slice(1);\n}\n\n/** `claude-opus-5-5` → `Claude Opus 5.5`, `codex/gpt-6.1-sol` → `GPT-6.1 Sol`. */\nexport function humanizeModelSlug(value: string): string {\n  const slug = modelSlug(value.trim())\n    // Snapshot dates are release detail, not a different model name.\n    .replace(/[-_](?:\\d{8}|\\d{4}-\\d{2}-\\d{2})$/, \"\")\n    .replace(/[-_]latest$/i, \"\");\n  const raw = slug.split(/[-_\\s]+/).filter(Boolean);\n  if (raw.length === 0) return value.trim() || value;\n  // Consecutive short numbers are one version: 5-5 → 5.5, 3-5 → 3.5. Longer\n  // numbers are snapshots (gpt-4-1106-preview), never a minor version.\n  const tokens: string[] = [];\n  for (const token of raw) {\n    const previous = tokens.at(-1);\n    if (previous !== undefined && /^\\d{1,2}$/.test(token) && /^\\d{1,2}$/.test(previous)) {\n      tokens[tokens.length - 1] = `${previous}.${token}`;\n      continue;\n    }\n    tokens.push(token);\n  }\n  const words = tokens.map(titleToken);\n  // OpenAI's own spelling joins family and version: GPT-6.1, GPT-4o.\n  if (words[0] === \"GPT\" && words.length > 1 && /^\\d/.test(words[1]!)) {\n    return [`GPT-${words[1]}`, ...words.slice(2)].join(\" \");\n  }\n  return words.join(\" \");\n}\n\n/**\n * True when a catalog label is only the model's identifier: empty, or exactly\n * its id, upstream id, or any trailing path of them (`claude-opus-4-8`,\n * `anthropic/claude-sonnet-4.6`). Any other label is a curated name and wins.\n */\nexport function isRawModelLabel(\n  label: string,\n  ids: readonly (string | null | undefined)[] = [],\n): boolean {\n  const text = label.trim();\n  if (!text) return true;\n  return ids.some((id) => {\n    if (!id) return false;\n    const segments = id.trim().split(\"/\").filter(Boolean);\n    return segments.some((_, index) => {\n      const tail = segments.slice(index).join(\"/\");\n      return tail === text || modelSlug(tail) === text;\n    });\n  });\n}\n\n/**\n * The clean name to show for a model: its curated catalog label when it has\n * one, otherwise a readable form of the upstream model id. Never a routing\n * prefix, connection id or connection scope.\n */\nexport function modelDisplayName(input: ModelDisplayInput): string {\n  if (typeof input === \"string\") {\n    // A bare id is humanized; text with spaces is already a name (\"Workspace default\").\n    return input.trim() && !/\\s/.test(input.trim()) ? humanizeModelSlug(input) : input;\n  }\n  const upstream = upstreamOf(input);\n  const label = input.label?.trim();\n  if (label && !isRawModelLabel(label, [input.id, upstream])) return label;\n  return humanizeModelSlug(upstream ?? label ?? input.id);\n}\n\nconst VENDOR_PATTERNS: ReadonlyArray<readonly [ModelVendor, RegExp]> = [\n  [\"anthropic\", /^claude\\b/],\n  [\"openai\", /^(?:gpt|chatgpt|o\\d+|codex|dall-e|sora|text-embedding|whisper)\\b/],\n  [\"xai\", /^grok\\b/],\n  [\"google\", /^(?:gemini|gemma)\\b/],\n  [\"meta\", /^llama\\b/],\n  [\"mistral\", /^(?:mistral|codestral|devstral|magistral|ministral|pixtral)\\b/],\n  [\"deepseek\", /^deepseek\\b/],\n  [\"moonshot\", /^(?:kimi|moonshot)\\b/],\n  [\"qwen\", /^(?:qwen|qwq)\\b/],\n  [\"zhipu\", /^glm\\b/],\n  [\"nvidia\", /^nemotron\\b/],\n];\n\n/** OpenRouter / Gateway vendor path segments (`anthropic/claude-…`). */\nconst VENDOR_SEGMENTS: Readonly<Record<string, ModelVendor>> = {\n  anthropic: \"anthropic\",\n  openai: \"openai\",\n  \"x-ai\": \"xai\",\n  xai: \"xai\",\n  google: \"google\",\n  \"meta-llama\": \"meta\",\n  mistralai: \"mistral\",\n  deepseek: \"deepseek\",\n  moonshotai: \"moonshot\",\n  qwen: \"qwen\",\n  \"z-ai\": \"zhipu\",\n  nvidia: \"nvidia\",\n};\n\nfunction vendorFromSlug(slug: string): ModelVendor | null {\n  for (const [vendor, pattern] of VENDOR_PATTERNS) if (pattern.test(slug)) return vendor;\n  return null;\n}\n\n/** Who makes the model, for its logo. Null when it cannot be told. */\nexport function modelVendor(input: ModelDisplayInput): ModelVendor | null {\n  const ids = typeof input === \"string\" ? [input] : [upstreamOf(input), input.id];\n  for (const id of ids) {\n    if (!id) continue;\n    const lower = id.trim().toLowerCase();\n    if (lower.startsWith(\"codex/\")) return \"openai\";\n    if (lower.startsWith(\"supergrok/\")) return \"xai\";\n    const vendor = vendorFromSlug(modelSlug(lower));\n    if (vendor) return vendor;\n    const segment = lower.split(\"/\").filter(Boolean).at(-2);\n    if (segment && Object.hasOwn(VENDOR_SEGMENTS, segment)) return VENDOR_SEGMENTS[segment]!;\n  }\n  if (typeof input !== \"string\" && input.label) {\n    return vendorFromSlug(input.label.trim().toLowerCase().replace(/\\s+/g, \"-\"));\n  }\n  return null;\n}\n"],"mappings":";AAoCO,SAAS,aAAa,OAAyC;AACpE,QAAM,QAAQ,OAAO,UAAU,WAAW,SAAY,MAAM;AAC5D,MAAI,CAAC,SAAS,MAAM,SAAS,QAAQ,UAAU,MAAM,KAAK,EAAG,QAAO;AACpE,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,WAAW,QAAQ;AAAA,EAC/E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,QAA0C;AAAA,EAC9C,KAAK;AAAA,EACL,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,OAAO;AAAA,EACP,OAAO;AAAA,EACP,UAAU;AAAA,EACV,MAAM;AAAA,EACN,KAAK;AAAA,EACL,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW;AAAA,EACX,UAAU;AAAA,EACV,WAAW;AAAA,EACX,UAAU;AAAA,EACV,KAAK;AACP;AAGO,SAAS,UAAU,OAAuB;AAC/C,QAAM,OAAO,MAAM,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,GAAG,EAAE,KAAK;AACxD,SAAO,KAAK,QAAQ,WAAW,EAAE,KAAK;AACxC;AAEA,SAAS,WAAW,OAA0D;AAC5E,SAAO,MAAM,iBAAiB,KAAK,KAAK,MAAM,YAAY,iBAAiB,KAAK,KAAK;AACvF;AAEA,SAAS,WAAW,OAAe,OAAuB;AACxD,QAAM,QAAQ,MAAM,YAAY;AAChC,QAAM,OAAO,MAAM,KAAK;AACxB,MAAI,KAAM,QAAO;AAEjB,MAAI,UAAU,KAAK,SAAS,KAAK,KAAK,EAAG,QAAO;AAEhD,MAAI,wBAAwB,KAAK,KAAK,KAAK,qBAAqB,KAAK,KAAK,GAAG;AAC3E,WAAO,MAAM,YAAY;AAAA,EAC3B;AACA,MAAI,MAAM,KAAK,KAAK,EAAG,QAAO;AAC9B,SAAO,MAAM,OAAO,CAAC,EAAE,YAAY,IAAI,MAAM,MAAM,CAAC;AACtD;AAGO,SAAS,kBAAkB,OAAuB;AACvD,QAAM,OAAO,UAAU,MAAM,KAAK,CAAC,EAEhC,QAAQ,oCAAoC,EAAE,EAC9C,QAAQ,gBAAgB,EAAE;AAC7B,QAAM,MAAM,KAAK,MAAM,SAAS,EAAE,OAAO,OAAO;AAChD,MAAI,IAAI,WAAW,EAAG,QAAO,MAAM,KAAK,KAAK;AAG7C,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,KAAK;AACvB,UAAM,WAAW,OAAO,GAAG,EAAE;AAC7B,QAAI,aAAa,UAAa,YAAY,KAAK,KAAK,KAAK,YAAY,KAAK,QAAQ,GAAG;AACnF,aAAO,OAAO,SAAS,CAAC,IAAI,GAAG,QAAQ,IAAI,KAAK;AAChD;AAAA,IACF;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,QAAM,QAAQ,OAAO,IAAI,UAAU;AAEnC,MAAI,MAAM,CAAC,MAAM,SAAS,MAAM,SAAS,KAAK,MAAM,KAAK,MAAM,CAAC,CAAE,GAAG;AACnE,WAAO,CAAC,OAAO,MAAM,CAAC,CAAC,IAAI,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,KAAK,GAAG;AAAA,EACxD;AACA,SAAO,MAAM,KAAK,GAAG;AACvB;AAOO,SAAS,gBACd,OACA,MAA8C,CAAC,GACtC;AACT,QAAM,OAAO,MAAM,KAAK;AACxB,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,IAAI,KAAK,CAAC,OAAO;AACtB,QAAI,CAAC,GAAI,QAAO;AAChB,UAAM,WAAW,GAAG,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AACpD,WAAO,SAAS,KAAK,CAAC,GAAG,UAAU;AACjC,YAAM,OAAO,SAAS,MAAM,KAAK,EAAE,KAAK,GAAG;AAC3C,aAAO,SAAS,QAAQ,UAAU,IAAI,MAAM;AAAA,IAC9C,CAAC;AAAA,EACH,CAAC;AACH;AAOO,SAAS,iBAAiB,OAAkC;AACjE,MAAI,OAAO,UAAU,UAAU;AAE7B,WAAO,MAAM,KAAK,KAAK,CAAC,KAAK,KAAK,MAAM,KAAK,CAAC,IAAI,kBAAkB,KAAK,IAAI;AAAA,EAC/E;AACA,QAAM,WAAW,WAAW,KAAK;AACjC,QAAM,QAAQ,MAAM,OAAO,KAAK;AAChC,MAAI,SAAS,CAAC,gBAAgB,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC,EAAG,QAAO;AACnE,SAAO,kBAAkB,YAAY,SAAS,MAAM,EAAE;AACxD;AAEA,IAAM,kBAAiE;AAAA,EACrE,CAAC,aAAa,WAAW;AAAA,EACzB,CAAC,UAAU,kEAAkE;AAAA,EAC7E,CAAC,OAAO,SAAS;AAAA,EACjB,CAAC,UAAU,qBAAqB;AAAA,EAChC,CAAC,QAAQ,UAAU;AAAA,EACnB,CAAC,WAAW,+DAA+D;AAAA,EAC3E,CAAC,YAAY,aAAa;AAAA,EAC1B,CAAC,YAAY,sBAAsB;AAAA,EACnC,CAAC,QAAQ,iBAAiB;AAAA,EAC1B,CAAC,SAAS,QAAQ;AAAA,EAClB,CAAC,UAAU,aAAa;AAC1B;AAGA,IAAM,kBAAyD;AAAA,EAC7D,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,WAAW;AAAA,EACX,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ;AACV;AAEA,SAAS,eAAe,MAAkC;AACxD,aAAW,CAAC,QAAQ,OAAO,KAAK,gBAAiB,KAAI,QAAQ,KAAK,IAAI,EAAG,QAAO;AAChF,SAAO;AACT;AAGO,SAAS,YAAY,OAA8C;AACxE,QAAM,MAAM,OAAO,UAAU,WAAW,CAAC,KAAK,IAAI,CAAC,WAAW,KAAK,GAAG,MAAM,EAAE;AAC9E,aAAW,MAAM,KAAK;AACpB,QAAI,CAAC,GAAI;AACT,UAAM,QAAQ,GAAG,KAAK,EAAE,YAAY;AACpC,QAAI,MAAM,WAAW,QAAQ,EAAG,QAAO;AACvC,QAAI,MAAM,WAAW,YAAY,EAAG,QAAO;AAC3C,UAAM,SAAS,eAAe,UAAU,KAAK,CAAC;AAC9C,QAAI,OAAQ,QAAO;AACnB,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,OAAO,OAAO,EAAE,GAAG,EAAE;AACtD,QAAI,WAAW,OAAO,OAAO,iBAAiB,OAAO,EAAG,QAAO,gBAAgB,OAAO;AAAA,EACxF;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,OAAO;AAC5C,WAAO,eAAe,MAAM,MAAM,KAAK,EAAE,YAAY,EAAE,QAAQ,QAAQ,GAAG,CAAC;AAAA,EAC7E;AACA,SAAO;AACT;","names":[]}

package/dist/connect.js

@@ -1,12 +1,13 @@
 import {
   IntegrationInstanceKey,
   IntegrationSource
-} from "./chunk-X7ETVO4P.js";
+} from "./chunk-L73LKLKP.js";
 import "./chunk-5IXYF6XN.js";
 import "./chunk-NRMCVHAU.js";
 import "./chunk-WYBDERIY.js";
 import "./chunk-4JGHSSB7.js";
 import "./chunk-EK7NDGFR.js";
+import "./chunk-XSBEB2HQ.js";
 import "./chunk-O77VSFYZ.js";
 import "./chunk-NVJMJWLL.js";
 import "./chunk-SIOU2K4U.js";

package/dist/connect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/connect.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { IntegrationInstanceKey, IntegrationSource } from \"./index\";\n\nconst opaqueId = z.string().min(1).max(512);\nexport const ConnectOwnership = z.enum([\"personal\", \"workspace\"]);\nexport type ConnectOwnership = z.infer<typeof ConnectOwnership>;\nexport const ConnectProvider = z\n  .object({\n    id: opaqueId,\n    label: z.string().min(1).max(256),\n    family: opaqueId,\n    readiness: z.enum([\"available\", \"needs_configuration\", \"operator_only\", \"unsupported\"]),\n    reason: z.string().max(1024).optional(),\n    ownership: z.array(ConnectOwnership).max(2),\n    setup: z\n      .array(\n        z.enum([\"none\", \"oauth\", \"credentials\", \"device\", \"installation\", \"openapi\", \"graphql\"]),\n      )\n      .max(7),\n  })\n  .strict();\nexport type ConnectProvider = z.infer<typeof ConnectProvider>;\nexport const ConnectAccount = z\n  .object({\n    id: opaqueId,\n    providerId: opaqueId,\n    version: z.number().int().positive().optional(),\n    label: z.string().max(256),\n    ownership: ConnectOwnership,\n    status: z.enum([\"connected\", \"auth_needed\", \"disabled\"]),\n  })\n  .strict();\nexport type ConnectAccount = z.infer<typeof ConnectAccount>;\nexport const ConnectResource = z\n  .object({ id: opaqueId, label: z.string().max(512), kind: opaqueId })\n  .strict();\nexport type ConnectResource = z.infer<typeof ConnectResource>;\nexport const ConnectNextAction = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"authorize\"), url: z.string().url().max(16_384) }).strict(),\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      fields: z\n        .array(\n          z\n            .object({\n              name: opaqueId,\n              label: z.string().max(256),\n              required: z.boolean(),\n              secret: z.boolean(),\n              options: z\n                .array(z.object({ value: opaqueId, label: z.string().max(512) }).strict())\n                .max(1000)\n                .optional(),\n            })\n            .strict(),\n        )\n        .max(32),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"wait\"),\n      pollAfterMs: z.number().int().min(250).max(60_000),\n      userCode: z.string().max(128).optional(),\n      verificationUrl: z.string().url().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({ type: z.literal(\"select_account\"), accounts: z.array(ConnectAccount).max(100) })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"select_resources\"),\n      resources: z.array(ConnectResource).max(100),\n      cursor: z.string().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"preview\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operations: z.array(ConnectResource).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"none\") }).strict(),\n]);\nexport type ConnectNextAction = z.infer<typeof ConnectNextAction>;\nexport const ConnectInstallationTarget = z\n  .object({\n    instanceKey: IntegrationInstanceKey,\n    displayName: z.string().min(1).max(200),\n    expectedInstanceVersion: z.number().int().positive().optional(),\n  })\n  .strict();\nexport type ConnectInstallationTarget = z.infer<typeof ConnectInstallationTarget>;\nexport const ConnectAttemptState = z.enum([\n  \"ready\",\n  \"requires_user_action\",\n  \"credential_input\",\n  \"provider_wait\",\n  \"account_selection\",\n  \"resource_selection\",\n  \"preview\",\n  \"installing\",\n  \"connected_but_incomplete\",\n  \"complete\",\n  \"cancelled\",\n  \"expired\",\n  \"failed\",\n  \"uncertain\",\n]);\nexport const ConnectAttempt = z\n  .object({\n    id: opaqueId,\n    workspaceId: opaqueId,\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    revision: z.number().int().positive(),\n    state: ConnectAttemptState,\n    credentialsCommitted: z.boolean(),\n    integrationInstalled: z.boolean(),\n    completionRequirement: z.enum([\"connection\", \"integration\", \"provider_setup\"]),\n    nextAction: ConnectNextAction,\n    expiresAt: z.string().datetime({ offset: true }),\n    account: ConnectAccount.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n    source: IntegrationSource.optional(),\n    error: z\n      .object({ code: opaqueId, message: z.string().max(2048), retryable: z.boolean() })\n      .strict()\n      .optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"integration\" &&\n      !value.integrationInstalled\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Complete setup requires an installed integration\",\n      });\n    }\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"connection\" &&\n      !value.credentialsCommitted\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Connection setup requires committed credentials\",\n      });\n    }\n    if (\n      [\"complete\", \"cancelled\", \"expired\"].includes(value.state) &&\n      value.nextAction.type !== \"none\"\n    ) {\n      context.addIssue({ code: \"custom\", message: \"A terminal setup has no next action\" });\n    }\n  });\nexport type ConnectAttempt = z.infer<typeof ConnectAttempt>;\nexport const ConnectAdvance = z.discriminatedUnion(\"type\", [\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      values: z.record(z.string().max(256), z.string().max(16_384)),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"account\"), accountId: opaqueId }).strict(),\n  z.object({ type: z.literal(\"resources\"), resourceIds: z.array(opaqueId).max(1000) }).strict(),\n  z\n    .object({\n      type: z.literal(\"install\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operationIds: z.array(opaqueId).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"retry\") }).strict(),\n]);\nexport type ConnectAdvance = z.infer<typeof ConnectAdvance>;\nexport const ConnectOperationRequest = z\n  .object({\n    expectedRevision: z.number().int().positive().safe(),\n    idempotencyKey: opaqueId,\n  })\n  .strict();\nexport const AdvanceConnectRequest = ConnectOperationRequest.extend({ action: ConnectAdvance });\nexport const BeginConnectRequest = z\n  .object({\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    // URL parsing validates separately; never transform this original string.\n    returnUrl: z.string().min(1).max(4096),\n    idempotencyKey: opaqueId,\n    reconnectAccountId: opaqueId.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n  })\n  .strict();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAGlB,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnC,IAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,WAAW,CAAC;AAEzD,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,QAAQ;AAAA,EACR,WAAW,EAAE,KAAK,CAAC,aAAa,uBAAuB,iBAAiB,aAAa,CAAC;AAAA,EACtF,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC;AAAA,EAC1C,OAAO,EACJ;AAAA,IACC,EAAE,KAAK,CAAC,QAAQ,SAAS,eAAe,UAAU,gBAAgB,WAAW,SAAS,CAAC;AAAA,EACzF,EACC,IAAI,CAAC;AACV,CAAC,EACA,OAAO;AAEH,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,YAAY;AAAA,EACZ,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,EACzB,WAAW;AAAA,EACX,QAAQ,EAAE,KAAK,CAAC,aAAa,eAAe,UAAU,CAAC;AACzD,CAAC,EACA,OAAO;AAEH,IAAM,kBAAkB,EAC5B,OAAO,EAAE,IAAI,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,EACnE,OAAO;AAEH,IAAM,oBAAoB,EAAE,mBAAmB,QAAQ;AAAA,EAC5D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAM,EAAE,CAAC,EAAE,OAAO;AAAA,EACrF,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EACL;AAAA,MACC,EACG,OAAO;AAAA,QACN,MAAM;AAAA,QACN,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,QACzB,UAAU,EAAE,QAAQ;AAAA,QACpB,QAAQ,EAAE,QAAQ;AAAA,QAClB,SAAS,EACN,MAAM,EAAE,OAAO,EAAE,OAAO,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,EACxE,IAAI,GAAI,EACR,SAAS;AAAA,MACd,CAAC,EACA,OAAO;AAAA,IACZ,EACC,IAAI,EAAE;AAAA,EACX,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAM;AAAA,IACjD,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,GAAG,UAAU,EAAE,MAAM,cAAc,EAAE,IAAI,GAAG,EAAE,CAAC,EACxF,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,kBAAkB;AAAA,IAClC,WAAW,EAAE,MAAM,eAAe,EAAE,IAAI,GAAG;AAAA,IAC3C,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY,EAAE,MAAM,eAAe,EAAE,IAAI,GAAI;AAAA,EAC/C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAC/C,CAAC;AAEM,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,OAAO;AAEH,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACM,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,OAAO;AAAA,EACP,sBAAsB,EAAE,QAAQ;AAAA,EAChC,sBAAsB,EAAE,QAAQ;AAAA,EAChC,uBAAuB,EAAE,KAAK,CAAC,cAAc,eAAe,gBAAgB,CAAC;AAAA,EAC7E,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,SAAS,eAAe,SAAS;AAAA,EACjC,oBAAoB,0BAA0B,SAAS;AAAA,EACvD,QAAQ,kBAAkB,SAAS;AAAA,EACnC,OAAO,EACJ,OAAO,EAAE,MAAM,UAAU,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAChF,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,iBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,gBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,CAAC,YAAY,aAAa,SAAS,EAAE,SAAS,MAAM,KAAK,KACzD,MAAM,WAAW,SAAS,QAC1B;AACA,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,sCAAsC,CAAC;AAAA,EACrF;AACF,CAAC;AAEI,IAAM,iBAAiB,EAAE,mBAAmB,QAAQ;AAAA,EACzD,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,KAAM,CAAC;AAAA,EAC9D,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,WAAW,SAAS,CAAC,EAAE,OAAO;AAAA,EACrE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,aAAa,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI,EAAE,CAAC,EAAE,OAAO;AAAA,EAC5F,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,cAAc,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI;AAAA,EAC1C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,EAAE,OAAO;AAChD,CAAC;AAEM,IAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACnD,gBAAgB;AAClB,CAAC,EACA,OAAO;AACH,IAAM,wBAAwB,wBAAwB,OAAO,EAAE,QAAQ,eAAe,CAAC;AACvF,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,YAAY;AAAA,EACZ,WAAW;AAAA;AAAA,EAEX,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,gBAAgB;AAAA,EAChB,oBAAoB,SAAS,SAAS;AAAA,EACtC,oBAAoB,0BAA0B,SAAS;AACzD,CAAC,EACA,OAAO;","names":[]}
+{"version":3,"sources":["../src/connect.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { IntegrationInstanceKey, IntegrationSource } from \"./index\";\n\nconst opaqueId = z.string().min(1).max(512);\nexport const ConnectOwnership = z.enum([\"personal\", \"workspace\"]);\nexport type ConnectOwnership = z.infer<typeof ConnectOwnership>;\nexport const ConnectProvider = z\n  .object({\n    id: opaqueId,\n    label: z.string().min(1).max(256),\n    family: opaqueId,\n    readiness: z.enum([\"available\", \"needs_configuration\", \"operator_only\", \"unsupported\"]),\n    reason: z.string().max(1024).optional(),\n    ownership: z.array(ConnectOwnership).max(2),\n    setup: z\n      .array(\n        z.enum([\"none\", \"oauth\", \"credentials\", \"device\", \"installation\", \"openapi\", \"graphql\"]),\n      )\n      .max(7),\n  })\n  .strict();\nexport type ConnectProvider = z.infer<typeof ConnectProvider>;\nexport const ConnectAccount = z\n  .object({\n    id: opaqueId,\n    providerId: opaqueId,\n    version: z.number().int().positive().optional(),\n    label: z.string().max(256),\n    ownership: ConnectOwnership,\n    status: z.enum([\"connected\", \"auth_needed\", \"disabled\"]),\n  })\n  .strict();\nexport type ConnectAccount = z.infer<typeof ConnectAccount>;\nexport const ConnectResource = z\n  .object({ id: opaqueId, label: z.string().max(512), kind: opaqueId })\n  .strict();\nexport type ConnectResource = z.infer<typeof ConnectResource>;\nexport const ConnectNextAction = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"authorize\"), url: z.string().url().max(16_384) }).strict(),\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      fields: z\n        .array(\n          z\n            .object({\n              name: opaqueId,\n              label: z.string().max(256),\n              required: z.boolean(),\n              secret: z.boolean(),\n              options: z\n                .array(z.object({ value: opaqueId, label: z.string().max(512) }).strict())\n                .max(1000)\n                .optional(),\n            })\n            .strict(),\n        )\n        .max(32),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"wait\"),\n      pollAfterMs: z.number().int().min(250).max(60_000),\n      userCode: z.string().max(128).optional(),\n      verificationUrl: z.string().url().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({ type: z.literal(\"select_account\"), accounts: z.array(ConnectAccount).max(100) })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"select_resources\"),\n      resources: z.array(ConnectResource).max(100),\n      cursor: z.string().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"preview\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operations: z.array(ConnectResource).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"none\") }).strict(),\n]);\nexport type ConnectNextAction = z.infer<typeof ConnectNextAction>;\nexport const ConnectInstallationTarget = z\n  .object({\n    instanceKey: IntegrationInstanceKey,\n    displayName: z.string().min(1).max(200),\n    expectedInstanceVersion: z.number().int().positive().optional(),\n  })\n  .strict();\nexport type ConnectInstallationTarget = z.infer<typeof ConnectInstallationTarget>;\nexport const ConnectAttemptState = z.enum([\n  \"ready\",\n  \"requires_user_action\",\n  \"credential_input\",\n  \"provider_wait\",\n  \"account_selection\",\n  \"resource_selection\",\n  \"preview\",\n  \"installing\",\n  \"connected_but_incomplete\",\n  \"complete\",\n  \"cancelled\",\n  \"expired\",\n  \"failed\",\n  \"uncertain\",\n]);\nexport const ConnectAttempt = z\n  .object({\n    id: opaqueId,\n    workspaceId: opaqueId,\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    revision: z.number().int().positive(),\n    state: ConnectAttemptState,\n    credentialsCommitted: z.boolean(),\n    integrationInstalled: z.boolean(),\n    completionRequirement: z.enum([\"connection\", \"integration\", \"provider_setup\"]),\n    nextAction: ConnectNextAction,\n    expiresAt: z.string().datetime({ offset: true }),\n    account: ConnectAccount.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n    source: IntegrationSource.optional(),\n    error: z\n      .object({ code: opaqueId, message: z.string().max(2048), retryable: z.boolean() })\n      .strict()\n      .optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"integration\" &&\n      !value.integrationInstalled\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Complete setup requires an installed integration\",\n      });\n    }\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"connection\" &&\n      !value.credentialsCommitted\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Connection setup requires committed credentials\",\n      });\n    }\n    if (\n      [\"complete\", \"cancelled\", \"expired\"].includes(value.state) &&\n      value.nextAction.type !== \"none\"\n    ) {\n      context.addIssue({ code: \"custom\", message: \"A terminal setup has no next action\" });\n    }\n  });\nexport type ConnectAttempt = z.infer<typeof ConnectAttempt>;\nexport const ConnectAdvance = z.discriminatedUnion(\"type\", [\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      values: z.record(z.string().max(256), z.string().max(16_384)),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"account\"), accountId: opaqueId }).strict(),\n  z.object({ type: z.literal(\"resources\"), resourceIds: z.array(opaqueId).max(1000) }).strict(),\n  z\n    .object({\n      type: z.literal(\"install\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operationIds: z.array(opaqueId).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"retry\") }).strict(),\n]);\nexport type ConnectAdvance = z.infer<typeof ConnectAdvance>;\nexport const ConnectOperationRequest = z\n  .object({\n    expectedRevision: z.number().int().positive().safe(),\n    idempotencyKey: opaqueId,\n  })\n  .strict();\nexport const AdvanceConnectRequest = ConnectOperationRequest.extend({ action: ConnectAdvance });\nexport const BeginConnectRequest = z\n  .object({\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    // URL parsing validates separately; never transform this original string.\n    returnUrl: z.string().min(1).max(4096),\n    idempotencyKey: opaqueId,\n    reconnectAccountId: opaqueId.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n  })\n  .strict();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAGlB,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnC,IAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,WAAW,CAAC;AAEzD,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,QAAQ;AAAA,EACR,WAAW,EAAE,KAAK,CAAC,aAAa,uBAAuB,iBAAiB,aAAa,CAAC;AAAA,EACtF,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC;AAAA,EAC1C,OAAO,EACJ;AAAA,IACC,EAAE,KAAK,CAAC,QAAQ,SAAS,eAAe,UAAU,gBAAgB,WAAW,SAAS,CAAC;AAAA,EACzF,EACC,IAAI,CAAC;AACV,CAAC,EACA,OAAO;AAEH,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,YAAY;AAAA,EACZ,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,EACzB,WAAW;AAAA,EACX,QAAQ,EAAE,KAAK,CAAC,aAAa,eAAe,UAAU,CAAC;AACzD,CAAC,EACA,OAAO;AAEH,IAAM,kBAAkB,EAC5B,OAAO,EAAE,IAAI,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,EACnE,OAAO;AAEH,IAAM,oBAAoB,EAAE,mBAAmB,QAAQ;AAAA,EAC5D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAM,EAAE,CAAC,EAAE,OAAO;AAAA,EACrF,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EACL;AAAA,MACC,EACG,OAAO;AAAA,QACN,MAAM;AAAA,QACN,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,QACzB,UAAU,EAAE,QAAQ;AAAA,QACpB,QAAQ,EAAE,QAAQ;AAAA,QAClB,SAAS,EACN,MAAM,EAAE,OAAO,EAAE,OAAO,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,EACxE,IAAI,GAAI,EACR,SAAS;AAAA,MACd,CAAC,EACA,OAAO;AAAA,IACZ,EACC,IAAI,EAAE;AAAA,EACX,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAM;AAAA,IACjD,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,GAAG,UAAU,EAAE,MAAM,cAAc,EAAE,IAAI,GAAG,EAAE,CAAC,EACxF,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,kBAAkB;AAAA,IAClC,WAAW,EAAE,MAAM,eAAe,EAAE,IAAI,GAAG;AAAA,IAC3C,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY,EAAE,MAAM,eAAe,EAAE,IAAI,GAAI;AAAA,EAC/C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAC/C,CAAC;AAEM,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,OAAO;AAEH,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACM,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,OAAO;AAAA,EACP,sBAAsB,EAAE,QAAQ;AAAA,EAChC,sBAAsB,EAAE,QAAQ;AAAA,EAChC,uBAAuB,EAAE,KAAK,CAAC,cAAc,eAAe,gBAAgB,CAAC;AAAA,EAC7E,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,SAAS,eAAe,SAAS;AAAA,EACjC,oBAAoB,0BAA0B,SAAS;AAAA,EACvD,QAAQ,kBAAkB,SAAS;AAAA,EACnC,OAAO,EACJ,OAAO,EAAE,MAAM,UAAU,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAChF,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,iBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,gBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,CAAC,YAAY,aAAa,SAAS,EAAE,SAAS,MAAM,KAAK,KACzD,MAAM,WAAW,SAAS,QAC1B;AACA,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,sCAAsC,CAAC;AAAA,EACrF;AACF,CAAC;AAEI,IAAM,iBAAiB,EAAE,mBAAmB,QAAQ;AAAA,EACzD,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,KAAM,CAAC;AAAA,EAC9D,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,WAAW,SAAS,CAAC,EAAE,OAAO;AAAA,EACrE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,aAAa,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI,EAAE,CAAC,EAAE,OAAO;AAAA,EAC5F,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,cAAc,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI;AAAA,EAC1C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,EAAE,OAAO;AAChD,CAAC;AAEM,IAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACnD,gBAAgB;AAClB,CAAC,EACA,OAAO;AACH,IAAM,wBAAwB,wBAAwB,OAAO,EAAE,QAAQ,eAAe,CAAC;AACvF,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,YAAY;AAAA,EACZ,WAAW;AAAA;AAAA,EAEX,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,gBAAgB;AAAA,EAChB,oBAAoB,SAAS,SAAS;AAAA,EACtC,oBAAoB,0BAA0B,SAAS;AACzD,CAAC,EACA,OAAO;","names":[]}

package/dist/connection-authority.js

@@ -6,13 +6,14 @@ import {
   ConnectionUseAuthorizationResult,
   ConnectionUseDenialReason,
   ConnectionUseSelectionSource
-} from "./chunk-46KLD2UH.js";
-import "./chunk-X7ETVO4P.js";
+} from "./chunk-QZPIUG3I.js";
+import "./chunk-L73LKLKP.js";
 import "./chunk-5IXYF6XN.js";
 import "./chunk-NRMCVHAU.js";
 import "./chunk-WYBDERIY.js";
 import "./chunk-4JGHSSB7.js";
 import "./chunk-EK7NDGFR.js";
+import "./chunk-XSBEB2HQ.js";
 import "./chunk-O77VSFYZ.js";
 import "./chunk-NVJMJWLL.js";
 import "./chunk-SIOU2K4U.js";

package/dist/google-drive.js

@@ -1,6 +1,6 @@
 import {
   ConnectionMetadata
-} from "./chunk-X7ETVO4P.js";
+} from "./chunk-L73LKLKP.js";
 import "./chunk-5IXYF6XN.js";
 import "./chunk-NRMCVHAU.js";
 import {
@@ -9,6 +9,7 @@ import {
 } from "./chunk-WYBDERIY.js";
 import "./chunk-4JGHSSB7.js";
 import "./chunk-EK7NDGFR.js";
+import "./chunk-XSBEB2HQ.js";
 import "./chunk-O77VSFYZ.js";
 import "./chunk-NVJMJWLL.js";
 import "./chunk-SIOU2K4U.js";

package/dist/google-drive.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/google-drive.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\nimport {\n  ConnectorDocumentDestination,\n  ConnectorDocumentDestinationSelection,\n} from \"./connector-destinations\";\n\nexport const GOOGLE_DRIVE_PROVIDER_DOMAIN = \"googleapis.com\" as const;\nexport const GOOGLE_DRIVE_FULL_SCOPE = \"https://www.googleapis.com/auth/drive\" as const;\nexport const GOOGLE_DRIVE_FILE_SCOPE = \"https://www.googleapis.com/auth/drive.file\" as const;\nexport const GOOGLE_DRIVE_METADATA_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.metadata.readonly\" as const;\nexport const GOOGLE_DRIVE_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.readonly\" as const;\n/** Stable serialized role retained for existing connection rows; not product-facing copy. */\nexport const GOOGLE_DRIVE_CREDENTIAL_ROLE = \"google_drive_metadata\" as const;\nexport const GOOGLE_DRIVE_CREDENTIAL_LABEL = \"Google Drive read-only source sync\" as const;\nexport const GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL = \"Google Drive metadata browser\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_SERVER_ID = \"google-drive-publishing\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_TOOL_NAME = \"google_drive_publish_file\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION = \"create\" as const;\n\nexport const GoogleDriveOAuthCapability = z.enum([\n  \"picker_file_read\",\n  \"publish_file\",\n  \"source_metadata_discovery\",\n  \"source_content_read\",\n  \"recursive_source_sync\",\n]);\nexport type GoogleDriveOAuthCapability = z.infer<typeof GoogleDriveOAuthCapability>;\n\nexport type GoogleDriveOAuthScopeDecision = {\n  accessMode: \"file_only\" | \"metadata_readonly\" | \"readonly\" | null;\n  capabilities: GoogleDriveOAuthCapability[];\n};\n\n/**\n * Converts exact Google OAuth grants into the Drive capabilities OpenGeni may\n * rely on. Unknown or malformed grants add no authority. In particular,\n * drive.file covers only files explicitly opened or shared with the app and\n * never authorizes arbitrary recursive descendant discovery.\n */\nexport function googleDriveOAuthScopeDecision(\n  grantedScopes: readonly string[],\n): GoogleDriveOAuthScopeDecision {\n  const granted = new Set(grantedScopes);\n  const hasFullDrive = granted.has(GOOGLE_DRIVE_FULL_SCOPE);\n  const hasSourceContentRead = hasFullDrive || granted.has(GOOGLE_DRIVE_READONLY_SCOPE);\n  const hasFileWrite = hasFullDrive || granted.has(GOOGLE_DRIVE_FILE_SCOPE);\n  const hasSourceMetadataDiscovery =\n    hasSourceContentRead || granted.has(GOOGLE_DRIVE_METADATA_READONLY_SCOPE);\n  const hasPickerFileRead = hasSourceContentRead || hasFileWrite;\n  const capabilities: GoogleDriveOAuthCapability[] = [];\n  if (hasPickerFileRead) capabilities.push(\"picker_file_read\");\n  if (hasFileWrite) capabilities.push(\"publish_file\");\n  if (hasSourceMetadataDiscovery) capabilities.push(\"source_metadata_discovery\");\n  if (hasSourceContentRead) {\n    capabilities.push(\"source_content_read\", \"recursive_source_sync\");\n  }\n  return {\n    accessMode: hasSourceContentRead\n      ? \"readonly\"\n      : hasSourceMetadataDiscovery\n        ? \"metadata_readonly\"\n        : hasFileWrite\n          ? \"file_only\"\n          : null,\n    capabilities,\n  };\n}\n\nexport function googleDriveScopesAllowCapability(\n  grantedScopes: readonly string[],\n  capability: GoogleDriveOAuthCapability,\n): boolean {\n  return googleDriveOAuthScopeDecision(grantedScopes).capabilities.includes(capability);\n}\n\n/** @deprecated Connector document destinations use organization/workspace/personal authority. */\nexport const GoogleDriveTargetScope = z.enum([\"user\", \"workspace\", \"organization\"]);\nexport type GoogleDriveTargetScope = z.infer<typeof GoogleDriveTargetScope>;\n\nexport const GoogleDriveSyncCadence = z.enum([\"manual\", \"hourly\", \"daily\"]);\nexport type GoogleDriveSyncCadence = z.infer<typeof GoogleDriveSyncCadence>;\n\nexport const GoogleDriveReadPolicy = z.enum([\"allow\", \"ask\", \"block\"]);\nexport type GoogleDriveReadPolicy = z.infer<typeof GoogleDriveReadPolicy>;\n\nexport const GoogleDriveConnectionLifecycleState = z.enum([\n  \"active\",\n  \"paused\",\n  \"token_revoked\",\n  \"app_removed\",\n  \"disconnected\",\n  \"reconnect_required\",\n  \"reconsent_required\",\n]);\nexport type GoogleDriveConnectionLifecycleState = z.infer<\n  typeof GoogleDriveConnectionLifecycleState\n>;\n\nconst GoogleDriveLifecycleObservedAt = z.string().datetime({ offset: true });\nexport const GoogleDriveConnectionLifecycle = z.discriminatedUnion(\"state\", [\n  z.object({\n    state: z.literal(\"active\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"paused\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"token_revoked\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"app_removed\"),\n    recoverable: z.literal(false),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"disconnected\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconnect_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconsent_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n]);\nexport type GoogleDriveConnectionLifecycle = z.infer<typeof GoogleDriveConnectionLifecycle>;\n\nexport const GoogleDriveSelectedSource = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(256).nullable().default(null),\n  destination: ConnectorDocumentDestination.optional(),\n  /** @deprecated Missing destinations resolve to the current workspace boundary. */\n  targetScope: GoogleDriveTargetScope.optional(),\n  syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n  syncEnabled: z.boolean().default(false),\n  configGeneration: z.number().int().positive().default(1),\n  readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  selectedAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveSelectedSource = z.infer<typeof GoogleDriveSelectedSource>;\n\nexport const GoogleDriveOutputDestination = z\n  .object({\n    folderId: z.string().min(1).max(256),\n    folderName: z.string().min(1).max(1024),\n    driveId: z.string().min(1).max(256).nullable(),\n    location: z.enum([\"my_drive\", \"shared_drive\"]),\n    selectedAt: z.string().datetime({ offset: true }),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if ((value.location === \"my_drive\") !== (value.driveId === null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"driveId\"],\n        message: \"Google Drive destination location does not match its drive identity\",\n      });\n    }\n  });\nexport type GoogleDriveOutputDestination = z.infer<typeof GoogleDriveOutputDestination>;\n\nexport const GoogleDriveConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(GOOGLE_DRIVE_CREDENTIAL_ROLE),\n    credentialLabel: z.union([\n      z.literal(GOOGLE_DRIVE_CREDENTIAL_LABEL),\n      z.literal(GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL),\n    ]),\n    googlePermissionId: z.string().min(1).max(256),\n    googleEmail: z.string().email().max(320),\n    googleDisplayName: z.string().min(1).max(512).nullable(),\n    verifiedAt: z.string().datetime({ offset: true }),\n    accessMode: z.enum([\"file_only\", \"metadata_readonly\", \"readonly\"]),\n    lifecycle: GoogleDriveConnectionLifecycle.optional(),\n    outputDestination: GoogleDriveOutputDestination.optional(),\n    documentDestination: ConnectorDocumentDestination.optional(),\n    selectedSources: z.array(GoogleDriveSelectedSource).max(100).optional(),\n    /** @deprecated Read `selectedSources`; retained while existing connections migrate. */\n    selectedSource: GoogleDriveSelectedSource.nullable().optional(),\n  })\n  .passthrough();\nexport type GoogleDriveConnectionMetadata = z.infer<typeof GoogleDriveConnectionMetadata>;\n\nexport const GoogleDriveOAuthStartRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n  capability: z.enum([\"source_read\", \"publish\"]).default(\"source_read\"),\n});\nexport type GoogleDriveOAuthStartRequest = z.infer<typeof GoogleDriveOAuthStartRequest>;\n\nexport const GoogleDriveOAuthStartResponse = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveOAuthStartResponse = z.infer<typeof GoogleDriveOAuthStartResponse>;\n\nexport const GoogleDriveLifecycleActionRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  expectedVersion: z.number().int().positive(),\n});\nexport type GoogleDriveLifecycleActionRequest = z.infer<typeof GoogleDriveLifecycleActionRequest>;\n\nexport const GoogleDriveDisconnectRequest = z.object({\n  expectedVersion: z.number().int().positive(),\n  idempotencyKey: z.string().trim().min(1).max(200),\n});\nexport type GoogleDriveDisconnectRequest = z.infer<typeof GoogleDriveDisconnectRequest>;\n\nexport const GoogleDrivePublicationExportFile = z\n  .object({\n    fileId: z.string().uuid(),\n    filename: z.string().trim().min(1).max(512),\n    contentType: z.string().trim().min(1).max(256),\n    sizeBytes: z.number().int().positive(),\n    sha256: z.string().regex(/^[0-9a-f]{64}$/u),\n    artifactId: z.string().regex(/^[0-9a-f]{32}$/u),\n    versionId: z.string().regex(/^[0-9a-f]{32}$/u),\n    materializationJobId: z.string().regex(/^[0-9a-f]{32}$/u),\n    sourceHeadSequence: z.number().int().nonnegative(),\n    sourceStateHash: z.string().regex(/^sha256:[0-9a-f]{64}$/u),\n  })\n  .strict();\nexport type GoogleDrivePublicationExportFile = z.infer<typeof GoogleDrivePublicationExportFile>;\n\nexport const GoogleDrivePublicationToolInput = z\n  .object({\n    title: z.string().trim().min(1).max(512),\n    modality: z.enum([\"document\", \"spreadsheet\", \"presentation\"]),\n    file: GoogleDrivePublicationExportFile,\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type GoogleDrivePublicationToolInput = z.infer<typeof GoogleDrivePublicationToolInput>;\n\nexport const GoogleDrivePublicationReceipt = z\n  .object({\n    connectionId: z.string().uuid(),\n    providerFileId: z.string().min(1).max(256),\n    webViewLink: z.string().url(),\n    mimeType: z.enum([\n      \"application/vnd.google-apps.document\",\n      \"application/vnd.google-apps.spreadsheet\",\n      \"application/vnd.google-apps.presentation\",\n    ]),\n    destination: GoogleDriveOutputDestination,\n    replayed: z.boolean(),\n  })\n  .strict();\nexport type GoogleDrivePublicationReceipt = z.infer<typeof GoogleDrivePublicationReceipt>;\n\nexport const GoogleDriveBrowseItem = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  kind: z.enum([\"folder\", \"file\"]),\n  driveId: z.string().min(1).max(256).nullable(),\n  modifiedTime: z.string().datetime({ offset: true }).nullable(),\n  size: z.string().regex(/^\\d+$/).nullable(),\n  webViewLink: z.string().url().nullable(),\n});\nexport type GoogleDriveBrowseItem = z.infer<typeof GoogleDriveBrowseItem>;\n\nexport const GoogleDriveBrowseResponse = z.object({\n  connection: z.lazy(() => ConnectionMetadata),\n  parentId: z.string().min(1).max(256),\n  current: GoogleDriveBrowseItem.nullable(),\n  items: z.array(GoogleDriveBrowseItem),\n  nextPageToken: z.string().min(1).max(4096).nullable(),\n  incompleteSearch: z.boolean(),\n});\nexport type GoogleDriveBrowseResponse = z.infer<typeof GoogleDriveBrowseResponse>;\n\nconst GoogleDriveSourceSelection = z\n  .array(\n    GoogleDriveBrowseItem.pick({\n      id: true,\n      name: true,\n      mimeType: true,\n      driveId: true,\n    }),\n  )\n  .max(100)\n  .refine((sources) => new Set(sources.map((source) => source.id)).size === sources.length, {\n    message: \"Google Drive sources must be unique\",\n  });\n\nexport const SaveGoogleDriveSourceRequest = z\n  .object({\n    sources: GoogleDriveSourceSelection,\n    destination: ConnectorDocumentDestinationSelection.optional(),\n    /** @deprecated Legacy requests are accepted but resolve to workspace authority. */\n    targetScope: GoogleDriveTargetScope.optional(),\n    syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n    syncEnabled: z.boolean().default(false),\n    readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  })\n  .refine((request) => request.destination !== undefined || request.targetScope !== undefined, {\n    message: \"Google Drive document destination is required\",\n  });\nexport type SaveGoogleDriveSourceRequest = z.infer<typeof SaveGoogleDriveSourceRequest>;\n\nexport const GoogleDriveKnowledgeSourceItem = z.object({\n  id: z.string().min(1).max(512),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(512).optional(),\n  sourceKind: z.enum([\"my_drive\", \"shared_drive\", \"folder\"]),\n  includeDescendants: z.boolean(),\n});\nexport type GoogleDriveKnowledgeSourceItem = z.infer<typeof GoogleDriveKnowledgeSourceItem>;\n\nexport const GoogleDriveKnowledgeSourceDestination = z.object({\n  authorityKind: z.enum([\"organization\", \"workspace\", \"personal\"]),\n  authorityAccountId: z.string().min(1).max(128),\n  authorityWorkspaceId: z.string().min(1).max(128).optional(),\n  authoritySubjectId: z.string().min(1).max(512).optional(),\n  collectionId: z.string().min(1).max(512).optional(),\n});\nexport type GoogleDriveKnowledgeSourceDestination = z.infer<\n  typeof GoogleDriveKnowledgeSourceDestination\n>;\n\nexport const GoogleDriveKnowledgeSourceConfig = z.object({\n  sources: z.array(GoogleDriveKnowledgeSourceItem).min(1).max(100),\n  destination: GoogleDriveKnowledgeSourceDestination,\n  syncCadence: GoogleDriveSyncCadence,\n  readPolicy: GoogleDriveReadPolicy,\n});\nexport type GoogleDriveKnowledgeSourceConfig = z.infer<typeof GoogleDriveKnowledgeSourceConfig>;\n\nexport const SaveGoogleDriveIntegrationSourceRequest = z.intersection(\n  SaveGoogleDriveSourceRequest,\n  z.object({\n    sources: GoogleDriveSourceSelection.refine((sources) => sources.length > 0, {\n      message: \"At least one Google Drive source is required\",\n    }),\n    expectedVersion: z.number().int().positive().optional(),\n    idempotencyKey: z.string().uuid(),\n  }),\n);\nexport type SaveGoogleDriveIntegrationSourceRequest = z.infer<\n  typeof SaveGoogleDriveIntegrationSourceRequest\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,+BAA+B;AACrC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAChC,IAAM,uCACX;AACK,IAAM,8BACX;AAEK,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,uCAAuC;AAC7C,IAAM,qCAAqC;AAC3C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,KAAK;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,8BACd,eAC+B;AAC/B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,eAAe,QAAQ,IAAI,uBAAuB;AACxD,QAAM,uBAAuB,gBAAgB,QAAQ,IAAI,2BAA2B;AACpF,QAAM,eAAe,gBAAgB,QAAQ,IAAI,uBAAuB;AACxE,QAAM,6BACJ,wBAAwB,QAAQ,IAAI,oCAAoC;AAC1E,QAAM,oBAAoB,wBAAwB;AAClD,QAAM,eAA6C,CAAC;AACpD,MAAI,kBAAmB,cAAa,KAAK,kBAAkB;AAC3D,MAAI,aAAc,cAAa,KAAK,cAAc;AAClD,MAAI,2BAA4B,cAAa,KAAK,2BAA2B;AAC7E,MAAI,sBAAsB;AACxB,iBAAa,KAAK,uBAAuB,uBAAuB;AAAA,EAClE;AACA,SAAO;AAAA,IACL,YAAY,uBACR,aACA,6BACE,sBACA,eACE,cACA;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,iCACd,eACA,YACS;AACT,SAAO,8BAA8B,aAAa,EAAE,aAAa,SAAS,UAAU;AACtF;AAGO,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAG3E,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC;AAGnE,IAAM,wBAAwB,EAAE,KAAK,CAAC,SAAS,OAAO,OAAO,CAAC;AAG9D,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACpE,IAAM,iCAAiC,EAAE,mBAAmB,SAAS;AAAA,EAC1E,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,eAAe;AAAA,IAChC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,aAAa;AAAA,IAC9B,aAAa,EAAE,QAAQ,KAAK;AAAA,IAC5B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,cAAc;AAAA,IAC/B,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,aAAa,6BAA6B,SAAS;AAAA;AAAA,EAEnD,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EACvD,YAAY,sBAAsB,QAAQ,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,KAAK,CAAC,YAAY,cAAc,CAAC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAK,MAAM,aAAa,gBAAiB,MAAM,YAAY,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,4BAA4B;AAAA,EACtD,iBAAiB,EAAE,MAAM;AAAA,IACvB,EAAE,QAAQ,6BAA6B;AAAA,IACvC,EAAE,QAAQ,oCAAoC;AAAA,EAChD,CAAC;AAAA,EACD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,YAAY,EAAE,KAAK,CAAC,aAAa,qBAAqB,UAAU,CAAC;AAAA,EACjE,WAAW,+BAA+B,SAAS;AAAA,EACnD,mBAAmB,6BAA6B,SAAS;AAAA,EACzD,qBAAqB,6BAA6B,SAAS;AAAA,EAC3D,iBAAiB,EAAE,MAAM,yBAAyB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgB,0BAA0B,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,YAAY;AAGR,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,KAAK,CAAC,eAAe,SAAS,CAAC,EAAE,QAAQ,aAAa;AACtE,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC;AAGM,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACxD,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,MAAM,wBAAwB;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,UAAU,EAAE,KAAK,CAAC,YAAY,eAAe,cAAc,CAAC;AAAA,EAC5D,MAAM;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,aAAa;AAAA,EACb,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,OAAO;AAGH,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,YAAY,EAAE,KAAK,MAAM,kBAAkB;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,sBAAsB,SAAS;AAAA,EACxC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACpD,kBAAkB,EAAE,QAAQ;AAC9B,CAAC;AAGD,IAAM,6BAA6B,EAChC;AAAA,EACC,sBAAsB,KAAK;AAAA,IACzB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACH,EACC,IAAI,GAAG,EACP,OAAO,CAAC,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACxF,SAAS;AACX,CAAC;AAEI,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,aAAa,sCAAsC,SAAS;AAAA;AAAA,EAE5D,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,YAAY,sBAAsB,QAAQ,OAAO;AACnD,CAAC,EACA,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAa,QAAQ,gBAAgB,QAAW;AAAA,EAC3F,SAAS;AACX,CAAC;AAGI,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,KAAK,CAAC,YAAY,gBAAgB,QAAQ,CAAC;AAAA,EACzD,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAGM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,aAAa,UAAU,CAAC;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC;AAKM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,MAAM,8BAA8B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/D,aAAa;AAAA,EACb,aAAa;AAAA,EACb,YAAY;AACd,CAAC;AAGM,IAAM,0CAA0C,EAAE;AAAA,EACvD;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,2BAA2B,OAAO,CAAC,YAAY,QAAQ,SAAS,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX,CAAC;AAAA,IACD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/google-drive.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\nimport {\n  ConnectorDocumentDestination,\n  ConnectorDocumentDestinationSelection,\n} from \"./connector-destinations\";\n\nexport const GOOGLE_DRIVE_PROVIDER_DOMAIN = \"googleapis.com\" as const;\nexport const GOOGLE_DRIVE_FULL_SCOPE = \"https://www.googleapis.com/auth/drive\" as const;\nexport const GOOGLE_DRIVE_FILE_SCOPE = \"https://www.googleapis.com/auth/drive.file\" as const;\nexport const GOOGLE_DRIVE_METADATA_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.metadata.readonly\" as const;\nexport const GOOGLE_DRIVE_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.readonly\" as const;\n/** Stable serialized role retained for existing connection rows; not product-facing copy. */\nexport const GOOGLE_DRIVE_CREDENTIAL_ROLE = \"google_drive_metadata\" as const;\nexport const GOOGLE_DRIVE_CREDENTIAL_LABEL = \"Google Drive read-only source sync\" as const;\nexport const GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL = \"Google Drive metadata browser\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_SERVER_ID = \"google-drive-publishing\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_TOOL_NAME = \"google_drive_publish_file\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION = \"create\" as const;\n\nexport const GoogleDriveOAuthCapability = z.enum([\n  \"picker_file_read\",\n  \"publish_file\",\n  \"source_metadata_discovery\",\n  \"source_content_read\",\n  \"recursive_source_sync\",\n]);\nexport type GoogleDriveOAuthCapability = z.infer<typeof GoogleDriveOAuthCapability>;\n\nexport type GoogleDriveOAuthScopeDecision = {\n  accessMode: \"file_only\" | \"metadata_readonly\" | \"readonly\" | null;\n  capabilities: GoogleDriveOAuthCapability[];\n};\n\n/**\n * Converts exact Google OAuth grants into the Drive capabilities OpenGeni may\n * rely on. Unknown or malformed grants add no authority. In particular,\n * drive.file covers only files explicitly opened or shared with the app and\n * never authorizes arbitrary recursive descendant discovery.\n */\nexport function googleDriveOAuthScopeDecision(\n  grantedScopes: readonly string[],\n): GoogleDriveOAuthScopeDecision {\n  const granted = new Set(grantedScopes);\n  const hasFullDrive = granted.has(GOOGLE_DRIVE_FULL_SCOPE);\n  const hasSourceContentRead = hasFullDrive || granted.has(GOOGLE_DRIVE_READONLY_SCOPE);\n  const hasFileWrite = hasFullDrive || granted.has(GOOGLE_DRIVE_FILE_SCOPE);\n  const hasSourceMetadataDiscovery =\n    hasSourceContentRead || granted.has(GOOGLE_DRIVE_METADATA_READONLY_SCOPE);\n  const hasPickerFileRead = hasSourceContentRead || hasFileWrite;\n  const capabilities: GoogleDriveOAuthCapability[] = [];\n  if (hasPickerFileRead) capabilities.push(\"picker_file_read\");\n  if (hasFileWrite) capabilities.push(\"publish_file\");\n  if (hasSourceMetadataDiscovery) capabilities.push(\"source_metadata_discovery\");\n  if (hasSourceContentRead) {\n    capabilities.push(\"source_content_read\", \"recursive_source_sync\");\n  }\n  return {\n    accessMode: hasSourceContentRead\n      ? \"readonly\"\n      : hasSourceMetadataDiscovery\n        ? \"metadata_readonly\"\n        : hasFileWrite\n          ? \"file_only\"\n          : null,\n    capabilities,\n  };\n}\n\nexport function googleDriveScopesAllowCapability(\n  grantedScopes: readonly string[],\n  capability: GoogleDriveOAuthCapability,\n): boolean {\n  return googleDriveOAuthScopeDecision(grantedScopes).capabilities.includes(capability);\n}\n\n/** @deprecated Connector document destinations use organization/workspace/personal authority. */\nexport const GoogleDriveTargetScope = z.enum([\"user\", \"workspace\", \"organization\"]);\nexport type GoogleDriveTargetScope = z.infer<typeof GoogleDriveTargetScope>;\n\nexport const GoogleDriveSyncCadence = z.enum([\"manual\", \"hourly\", \"daily\"]);\nexport type GoogleDriveSyncCadence = z.infer<typeof GoogleDriveSyncCadence>;\n\nexport const GoogleDriveReadPolicy = z.enum([\"allow\", \"ask\", \"block\"]);\nexport type GoogleDriveReadPolicy = z.infer<typeof GoogleDriveReadPolicy>;\n\nexport const GoogleDriveConnectionLifecycleState = z.enum([\n  \"active\",\n  \"paused\",\n  \"token_revoked\",\n  \"app_removed\",\n  \"disconnected\",\n  \"reconnect_required\",\n  \"reconsent_required\",\n]);\nexport type GoogleDriveConnectionLifecycleState = z.infer<\n  typeof GoogleDriveConnectionLifecycleState\n>;\n\nconst GoogleDriveLifecycleObservedAt = z.string().datetime({ offset: true });\nexport const GoogleDriveConnectionLifecycle = z.discriminatedUnion(\"state\", [\n  z.object({\n    state: z.literal(\"active\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"paused\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"token_revoked\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"app_removed\"),\n    recoverable: z.literal(false),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"disconnected\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconnect_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconsent_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n]);\nexport type GoogleDriveConnectionLifecycle = z.infer<typeof GoogleDriveConnectionLifecycle>;\n\nexport const GoogleDriveSelectedSource = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(256).nullable().default(null),\n  destination: ConnectorDocumentDestination.optional(),\n  /** @deprecated Missing destinations resolve to the current workspace boundary. */\n  targetScope: GoogleDriveTargetScope.optional(),\n  syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n  syncEnabled: z.boolean().default(false),\n  configGeneration: z.number().int().positive().default(1),\n  readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  selectedAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveSelectedSource = z.infer<typeof GoogleDriveSelectedSource>;\n\nexport const GoogleDriveOutputDestination = z\n  .object({\n    folderId: z.string().min(1).max(256),\n    folderName: z.string().min(1).max(1024),\n    driveId: z.string().min(1).max(256).nullable(),\n    location: z.enum([\"my_drive\", \"shared_drive\"]),\n    selectedAt: z.string().datetime({ offset: true }),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if ((value.location === \"my_drive\") !== (value.driveId === null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"driveId\"],\n        message: \"Google Drive destination location does not match its drive identity\",\n      });\n    }\n  });\nexport type GoogleDriveOutputDestination = z.infer<typeof GoogleDriveOutputDestination>;\n\nexport const GoogleDriveConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(GOOGLE_DRIVE_CREDENTIAL_ROLE),\n    credentialLabel: z.union([\n      z.literal(GOOGLE_DRIVE_CREDENTIAL_LABEL),\n      z.literal(GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL),\n    ]),\n    googlePermissionId: z.string().min(1).max(256),\n    googleEmail: z.string().email().max(320),\n    googleDisplayName: z.string().min(1).max(512).nullable(),\n    verifiedAt: z.string().datetime({ offset: true }),\n    accessMode: z.enum([\"file_only\", \"metadata_readonly\", \"readonly\"]),\n    lifecycle: GoogleDriveConnectionLifecycle.optional(),\n    outputDestination: GoogleDriveOutputDestination.optional(),\n    documentDestination: ConnectorDocumentDestination.optional(),\n    selectedSources: z.array(GoogleDriveSelectedSource).max(100).optional(),\n    /** @deprecated Read `selectedSources`; retained while existing connections migrate. */\n    selectedSource: GoogleDriveSelectedSource.nullable().optional(),\n  })\n  .passthrough();\nexport type GoogleDriveConnectionMetadata = z.infer<typeof GoogleDriveConnectionMetadata>;\n\nexport const GoogleDriveOAuthStartRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n  capability: z.enum([\"source_read\", \"publish\"]).default(\"source_read\"),\n});\nexport type GoogleDriveOAuthStartRequest = z.infer<typeof GoogleDriveOAuthStartRequest>;\n\nexport const GoogleDriveOAuthStartResponse = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveOAuthStartResponse = z.infer<typeof GoogleDriveOAuthStartResponse>;\n\nexport const GoogleDriveLifecycleActionRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  expectedVersion: z.number().int().positive(),\n});\nexport type GoogleDriveLifecycleActionRequest = z.infer<typeof GoogleDriveLifecycleActionRequest>;\n\nexport const GoogleDriveDisconnectRequest = z.object({\n  expectedVersion: z.number().int().positive(),\n  idempotencyKey: z.string().trim().min(1).max(200),\n});\nexport type GoogleDriveDisconnectRequest = z.infer<typeof GoogleDriveDisconnectRequest>;\n\nexport const GoogleDrivePublicationExportFile = z\n  .object({\n    fileId: z.string().uuid(),\n    filename: z.string().trim().min(1).max(512),\n    contentType: z.string().trim().min(1).max(256),\n    sizeBytes: z.number().int().positive(),\n    sha256: z.string().regex(/^[0-9a-f]{64}$/u),\n    artifactId: z.string().regex(/^[0-9a-f]{32}$/u),\n    versionId: z.string().regex(/^[0-9a-f]{32}$/u),\n    materializationJobId: z.string().regex(/^[0-9a-f]{32}$/u),\n    sourceHeadSequence: z.number().int().nonnegative(),\n    sourceStateHash: z.string().regex(/^sha256:[0-9a-f]{64}$/u),\n  })\n  .strict();\nexport type GoogleDrivePublicationExportFile = z.infer<typeof GoogleDrivePublicationExportFile>;\n\nexport const GoogleDrivePublicationToolInput = z\n  .object({\n    title: z.string().trim().min(1).max(512),\n    modality: z.enum([\"document\", \"spreadsheet\", \"presentation\"]),\n    file: GoogleDrivePublicationExportFile,\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type GoogleDrivePublicationToolInput = z.infer<typeof GoogleDrivePublicationToolInput>;\n\nexport const GoogleDrivePublicationReceipt = z\n  .object({\n    connectionId: z.string().uuid(),\n    providerFileId: z.string().min(1).max(256),\n    webViewLink: z.string().url(),\n    mimeType: z.enum([\n      \"application/vnd.google-apps.document\",\n      \"application/vnd.google-apps.spreadsheet\",\n      \"application/vnd.google-apps.presentation\",\n    ]),\n    destination: GoogleDriveOutputDestination,\n    replayed: z.boolean(),\n  })\n  .strict();\nexport type GoogleDrivePublicationReceipt = z.infer<typeof GoogleDrivePublicationReceipt>;\n\nexport const GoogleDriveBrowseItem = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  kind: z.enum([\"folder\", \"file\"]),\n  driveId: z.string().min(1).max(256).nullable(),\n  modifiedTime: z.string().datetime({ offset: true }).nullable(),\n  size: z.string().regex(/^\\d+$/).nullable(),\n  webViewLink: z.string().url().nullable(),\n});\nexport type GoogleDriveBrowseItem = z.infer<typeof GoogleDriveBrowseItem>;\n\nexport const GoogleDriveBrowseResponse = z.object({\n  connection: z.lazy(() => ConnectionMetadata),\n  parentId: z.string().min(1).max(256),\n  current: GoogleDriveBrowseItem.nullable(),\n  items: z.array(GoogleDriveBrowseItem),\n  nextPageToken: z.string().min(1).max(4096).nullable(),\n  incompleteSearch: z.boolean(),\n});\nexport type GoogleDriveBrowseResponse = z.infer<typeof GoogleDriveBrowseResponse>;\n\nconst GoogleDriveSourceSelection = z\n  .array(\n    GoogleDriveBrowseItem.pick({\n      id: true,\n      name: true,\n      mimeType: true,\n      driveId: true,\n    }),\n  )\n  .max(100)\n  .refine((sources) => new Set(sources.map((source) => source.id)).size === sources.length, {\n    message: \"Google Drive sources must be unique\",\n  });\n\nexport const SaveGoogleDriveSourceRequest = z\n  .object({\n    sources: GoogleDriveSourceSelection,\n    destination: ConnectorDocumentDestinationSelection.optional(),\n    /** @deprecated Legacy requests are accepted but resolve to workspace authority. */\n    targetScope: GoogleDriveTargetScope.optional(),\n    syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n    syncEnabled: z.boolean().default(false),\n    readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  })\n  .refine((request) => request.destination !== undefined || request.targetScope !== undefined, {\n    message: \"Google Drive document destination is required\",\n  });\nexport type SaveGoogleDriveSourceRequest = z.infer<typeof SaveGoogleDriveSourceRequest>;\n\nexport const GoogleDriveKnowledgeSourceItem = z.object({\n  id: z.string().min(1).max(512),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(512).optional(),\n  sourceKind: z.enum([\"my_drive\", \"shared_drive\", \"folder\"]),\n  includeDescendants: z.boolean(),\n});\nexport type GoogleDriveKnowledgeSourceItem = z.infer<typeof GoogleDriveKnowledgeSourceItem>;\n\nexport const GoogleDriveKnowledgeSourceDestination = z.object({\n  authorityKind: z.enum([\"organization\", \"workspace\", \"personal\"]),\n  authorityAccountId: z.string().min(1).max(128),\n  authorityWorkspaceId: z.string().min(1).max(128).optional(),\n  authoritySubjectId: z.string().min(1).max(512).optional(),\n  collectionId: z.string().min(1).max(512).optional(),\n});\nexport type GoogleDriveKnowledgeSourceDestination = z.infer<\n  typeof GoogleDriveKnowledgeSourceDestination\n>;\n\nexport const GoogleDriveKnowledgeSourceConfig = z.object({\n  sources: z.array(GoogleDriveKnowledgeSourceItem).min(1).max(100),\n  destination: GoogleDriveKnowledgeSourceDestination,\n  syncCadence: GoogleDriveSyncCadence,\n  readPolicy: GoogleDriveReadPolicy,\n});\nexport type GoogleDriveKnowledgeSourceConfig = z.infer<typeof GoogleDriveKnowledgeSourceConfig>;\n\nexport const SaveGoogleDriveIntegrationSourceRequest = z.intersection(\n  SaveGoogleDriveSourceRequest,\n  z.object({\n    sources: GoogleDriveSourceSelection.refine((sources) => sources.length > 0, {\n      message: \"At least one Google Drive source is required\",\n    }),\n    expectedVersion: z.number().int().positive().optional(),\n    idempotencyKey: z.string().uuid(),\n  }),\n);\nexport type SaveGoogleDriveIntegrationSourceRequest = z.infer<\n  typeof SaveGoogleDriveIntegrationSourceRequest\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,+BAA+B;AACrC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAChC,IAAM,uCACX;AACK,IAAM,8BACX;AAEK,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,uCAAuC;AAC7C,IAAM,qCAAqC;AAC3C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,KAAK;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,8BACd,eAC+B;AAC/B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,eAAe,QAAQ,IAAI,uBAAuB;AACxD,QAAM,uBAAuB,gBAAgB,QAAQ,IAAI,2BAA2B;AACpF,QAAM,eAAe,gBAAgB,QAAQ,IAAI,uBAAuB;AACxE,QAAM,6BACJ,wBAAwB,QAAQ,IAAI,oCAAoC;AAC1E,QAAM,oBAAoB,wBAAwB;AAClD,QAAM,eAA6C,CAAC;AACpD,MAAI,kBAAmB,cAAa,KAAK,kBAAkB;AAC3D,MAAI,aAAc,cAAa,KAAK,cAAc;AAClD,MAAI,2BAA4B,cAAa,KAAK,2BAA2B;AAC7E,MAAI,sBAAsB;AACxB,iBAAa,KAAK,uBAAuB,uBAAuB;AAAA,EAClE;AACA,SAAO;AAAA,IACL,YAAY,uBACR,aACA,6BACE,sBACA,eACE,cACA;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,iCACd,eACA,YACS;AACT,SAAO,8BAA8B,aAAa,EAAE,aAAa,SAAS,UAAU;AACtF;AAGO,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAG3E,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC;AAGnE,IAAM,wBAAwB,EAAE,KAAK,CAAC,SAAS,OAAO,OAAO,CAAC;AAG9D,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACpE,IAAM,iCAAiC,EAAE,mBAAmB,SAAS;AAAA,EAC1E,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,eAAe;AAAA,IAChC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,aAAa;AAAA,IAC9B,aAAa,EAAE,QAAQ,KAAK;AAAA,IAC5B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,cAAc;AAAA,IAC/B,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,aAAa,6BAA6B,SAAS;AAAA;AAAA,EAEnD,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EACvD,YAAY,sBAAsB,QAAQ,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,KAAK,CAAC,YAAY,cAAc,CAAC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAK,MAAM,aAAa,gBAAiB,MAAM,YAAY,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,4BAA4B;AAAA,EACtD,iBAAiB,EAAE,MAAM;AAAA,IACvB,EAAE,QAAQ,6BAA6B;AAAA,IACvC,EAAE,QAAQ,oCAAoC;AAAA,EAChD,CAAC;AAAA,EACD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,YAAY,EAAE,KAAK,CAAC,aAAa,qBAAqB,UAAU,CAAC;AAAA,EACjE,WAAW,+BAA+B,SAAS;AAAA,EACnD,mBAAmB,6BAA6B,SAAS;AAAA,EACzD,qBAAqB,6BAA6B,SAAS;AAAA,EAC3D,iBAAiB,EAAE,MAAM,yBAAyB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgB,0BAA0B,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,YAAY;AAGR,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,KAAK,CAAC,eAAe,SAAS,CAAC,EAAE,QAAQ,aAAa;AACtE,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC;AAGM,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACxD,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,MAAM,wBAAwB;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,UAAU,EAAE,KAAK,CAAC,YAAY,eAAe,cAAc,CAAC;AAAA,EAC5D,MAAM;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,aAAa;AAAA,EACb,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,OAAO;AAGH,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,YAAY,EAAE,KAAK,MAAM,kBAAkB;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,sBAAsB,SAAS;AAAA,EACxC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACpD,kBAAkB,EAAE,QAAQ;AAC9B,CAAC;AAGD,IAAM,6BAA6B,EAChC;AAAA,EACC,sBAAsB,KAAK;AAAA,IACzB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACH,EACC,IAAI,GAAG,EACP,OAAO,CAAC,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACxF,SAAS;AACX,CAAC;AAEI,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,aAAa,sCAAsC,SAAS;AAAA;AAAA,EAE5D,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,YAAY,sBAAsB,QAAQ,OAAO;AACnD,CAAC,EACA,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAa,QAAQ,gBAAgB,QAAW;AAAA,EAC3F,SAAS;AACX,CAAC;AAGI,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,KAAK,CAAC,YAAY,gBAAgB,QAAQ,CAAC;AAAA,EACzD,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAGM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,aAAa,UAAU,CAAC;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC;AAKM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,MAAM,8BAA8B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/D,aAAa;AAAA,EACb,aAAa;AAAA,EACb,YAAY;AACd,CAAC;AAGM,IAAM,0CAA0C,EAAE;AAAA,EACvD;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,2BAA2B,OAAO,CAAC,YAAY,QAAQ,SAAS,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX,CAAC;AAAA,IACD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,CAAC;AACH;","names":[]}

package/dist/host-mcp-bindings.js

@@ -3,19 +3,20 @@ import {
 } from "./chunk-KR2V42UZ.js";
 import {
   ConnectionUseAuthoritySnapshot
-} from "./chunk-46KLD2UH.js";
+} from "./chunk-QZPIUG3I.js";
 import {
   HostMcpCreateSelections,
   ManagedUserResourceGrantMode,
   McpServerConnectionRef,
   SessionTenancyVisibility,
   stableJson
-} from "./chunk-X7ETVO4P.js";
+} from "./chunk-L73LKLKP.js";
 import "./chunk-5IXYF6XN.js";
 import "./chunk-NRMCVHAU.js";
 import "./chunk-WYBDERIY.js";
 import "./chunk-4JGHSSB7.js";
 import "./chunk-EK7NDGFR.js";
+import "./chunk-XSBEB2HQ.js";
 import "./chunk-O77VSFYZ.js";
 import "./chunk-NVJMJWLL.js";
 import "./chunk-SIOU2K4U.js";

package/dist/host-mcp-bindings.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport {\n  McpServerConnectionRef,\n  SessionTenancyVisibility,\n  ManagedUserResourceGrantMode,\n  stableJson,\n} from \"./index\";\nimport { ConnectionUseAuthoritySnapshot } from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = z.union([\n  ExternalIdentity.shape.subjectId,\n  z\n    .string()\n    .max(4096)\n    .regex(/^user:[^\\r\\n\\u0000]+$/),\n]);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = z\n  .object({\n    serverId: z.string().min(1).max(256),\n    destinationUrl: z\n      .string()\n      .url()\n      .max(4096)\n      .refine((value) => {\n        const url = new URL(value);\n        return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n      }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n      .transform((value) => new URL(value).toString()),\n    connectionRef: McpServerConnectionRef,\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.connectionRef.hostBinding)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\", \"hostBinding\"],\n        message: \"A binding definition cannot reference another binding\",\n      });\n    if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\"],\n        message: \"Explicit host connection authority is required\",\n      });\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n      context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n  });\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\n/** Configuration ceiling, never execution authority. The complete destination\n * and provider/scope/resource selection stay exact; only the account identifier\n * is chosen by a captured owner grant in explicit accepted-turn mode. */\nexport type HostMcpBindingSelection = {\n  serverId: string;\n  destinationUrl: string;\n  connectionRef: McpServerConnectionRef;\n};\n\nexport function hostMcpBindingMatchesSelection(\n  binding: { id: string; generation: number; definition: HostMcpBindingDefinition },\n  selection: HostMcpBindingSelection,\n): boolean {\n  const parsed = McpServerConnectionRef.safeParse(selection.connectionRef);\n  if (!parsed.success || !parsed.data.hostBinding) return false;\n  const { hostBinding, ...configuredRef } = parsed.data;\n  const definition = HostMcpBindingDefinition.safeParse(binding.definition);\n  if (!definition.success) return false;\n  let destinationUrl: string;\n  try {\n    destinationUrl = new URL(selection.destinationUrl).toString();\n  } catch {\n    return false;\n  }\n  if (\n    selection.serverId !== definition.data.serverId ||\n    destinationUrl !== definition.data.destinationUrl\n  )\n    return false;\n  if (\"selection\" in hostBinding) {\n    const { connectionId: _connectionId, ...selectedRef } = definition.data.connectionRef;\n    return stableJson(configuredRef) === stableJson(selectedRef);\n  }\n  return (\n    binding.id === hostBinding.bindingId &&\n    binding.generation === hostBinding.generation &&\n    stableJson(configuredRef) === stableJson(definition.data.connectionRef)\n  );\n}\n\nexport const HostMcpBinding = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    authorizationRevision: z.number().int().positive().safe(),\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    definition: HostMcpBindingDefinition,\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    definition: HostMcpBindingDefinition,\n  })\n  .strict();\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\nconst HostMcpGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = HostMcpGrantRequest.superRefine((value, context) => {\n  if (\n    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n  ) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"Host session grants require a matching safe authority epoch\",\n    });\n  }\n});\nexport const IssueHostMcpDelegationRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    bindingId: z.string().uuid(),\n    expectedBindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n  })\n  .strict();\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive().safe(),\n    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    scheduledOrigin: z\n      .object({\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive().safe(),\n        runId: z.string().uuid(),\n      })\n      .strict()\n      .optional(),\n    source: z.discriminatedUnion(\"kind\", [\n      z.object({ kind: z.literal(\"direct\") }).strict(),\n      z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n      z\n        .object({\n          kind: z.literal(\"child_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n      z\n        .object({\n          kind: z.literal(\"inherited_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n    ]),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n      (value.source.kind === \"scheduled_task\" &&\n        (!value.scheduledOrigin ||\n          value.acceptedWork.kind !== \"scheduled_task\" ||\n          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n          value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))\n    )\n      context.addIssue({\n        code: \"custom\",\n        message: \"Scheduled host authority must retain its exact run origin\",\n      });\n    if (\n      value.acceptedWork.kind === \"turn\" &&\n      value.source.kind === \"inherited_turn\" &&\n      value.acceptedWork.turnId === value.source.turnId\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"source\"],\n        message: \"Accepted work cannot inherit from itself\",\n      });\n    }\n    if (\n      value.acceptedWork.kind === \"scheduled_task\" &&\n      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptedWork\"],\n        message: \"Task authority revision must be a safe integer\",\n      });\n    }\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n      context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n    }\n  });\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    taskId: z.string().uuid(),\n    taskAuthorityRevision: z.number().int().positive().safe(),\n    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    context: SessionTenancyVisibility,\n  })\n  .strict();\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,iBAAiB,MAAM;AAAA,EACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAClC,CAAC;AAGM,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,EACjD,eAAe;AACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,cAAc;AACtB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,MACrC,SAAS;AAAA,IACX,CAAC;AACH,MAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AACH,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAC1F,CAAC;AAYI,SAAS,+BACd,SACA,WACS;AACT,QAAM,SAAS,uBAAuB,UAAU,UAAU,aAAa;AACvE,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAK,YAAa,QAAO;AACxD,QAAM,EAAE,aAAa,GAAG,cAAc,IAAI,OAAO;AACjD,QAAM,aAAa,yBAAyB,UAAU,QAAQ,UAAU;AACxE,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAI;AACJ,MAAI;AACF,qBAAiB,IAAI,IAAI,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,UAAU,aAAa,WAAW,KAAK,YACvC,mBAAmB,WAAW,KAAK;AAEnC,WAAO;AACT,MAAI,eAAe,aAAa;AAC9B,UAAM,EAAE,cAAc,eAAe,GAAG,YAAY,IAAI,WAAW,KAAK;AACxE,WAAO,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,EAC7D;AACA,SACE,QAAQ,OAAO,YAAY,aAC3B,QAAQ,eAAe,YAAY,cACnC,WAAW,aAAa,MAAM,WAAW,WAAW,KAAK,aAAa;AAE1E;AAEO,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY;AACd,CAAC,EACA,OAAO;AAGV,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,yBAAyB,oBAAoB,YAAY,CAAC,OAAO,YAAY;AACjF,MACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AACM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC5D,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7D,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,OAAO;AAAA,EACP,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAQH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC9D,cAAc,+BAA+B,MAAM;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,iBAAiB,EACd,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,IACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,IACvD,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,YAAY;AAAA,MAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BAA0B,MAAM,aAAa;AAEvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACH,MACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EACxF;AACF,CAAC;AAII,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACtD,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC,EACA,OAAO;","names":[]}
+{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport {\n  McpServerConnectionRef,\n  SessionTenancyVisibility,\n  ManagedUserResourceGrantMode,\n  stableJson,\n} from \"./index\";\nimport { ConnectionUseAuthoritySnapshot } from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = z.union([\n  ExternalIdentity.shape.subjectId,\n  z\n    .string()\n    .max(4096)\n    .regex(/^user:[^\\r\\n\\u0000]+$/),\n]);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = z\n  .object({\n    serverId: z.string().min(1).max(256),\n    destinationUrl: z\n      .string()\n      .url()\n      .max(4096)\n      .refine((value) => {\n        const url = new URL(value);\n        return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n      }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n      .transform((value) => new URL(value).toString()),\n    connectionRef: McpServerConnectionRef,\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.connectionRef.hostBinding)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\", \"hostBinding\"],\n        message: \"A binding definition cannot reference another binding\",\n      });\n    if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\"],\n        message: \"Explicit host connection authority is required\",\n      });\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n      context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n  });\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\n/** Configuration ceiling, never execution authority. The complete destination\n * and provider/scope/resource selection stay exact; only the account identifier\n * is chosen by a captured owner grant in explicit accepted-turn mode. */\nexport type HostMcpBindingSelection = {\n  serverId: string;\n  destinationUrl: string;\n  connectionRef: McpServerConnectionRef;\n};\n\nexport function hostMcpBindingMatchesSelection(\n  binding: { id: string; generation: number; definition: HostMcpBindingDefinition },\n  selection: HostMcpBindingSelection,\n): boolean {\n  const parsed = McpServerConnectionRef.safeParse(selection.connectionRef);\n  if (!parsed.success || !parsed.data.hostBinding) return false;\n  const { hostBinding, ...configuredRef } = parsed.data;\n  const definition = HostMcpBindingDefinition.safeParse(binding.definition);\n  if (!definition.success) return false;\n  let destinationUrl: string;\n  try {\n    destinationUrl = new URL(selection.destinationUrl).toString();\n  } catch {\n    return false;\n  }\n  if (\n    selection.serverId !== definition.data.serverId ||\n    destinationUrl !== definition.data.destinationUrl\n  )\n    return false;\n  if (\"selection\" in hostBinding) {\n    const { connectionId: _connectionId, ...selectedRef } = definition.data.connectionRef;\n    return stableJson(configuredRef) === stableJson(selectedRef);\n  }\n  return (\n    binding.id === hostBinding.bindingId &&\n    binding.generation === hostBinding.generation &&\n    stableJson(configuredRef) === stableJson(definition.data.connectionRef)\n  );\n}\n\nexport const HostMcpBinding = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    authorizationRevision: z.number().int().positive().safe(),\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    definition: HostMcpBindingDefinition,\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    definition: HostMcpBindingDefinition,\n  })\n  .strict();\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\nconst HostMcpGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = HostMcpGrantRequest.superRefine((value, context) => {\n  if (\n    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n  ) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"Host session grants require a matching safe authority epoch\",\n    });\n  }\n});\nexport const IssueHostMcpDelegationRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    bindingId: z.string().uuid(),\n    expectedBindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n  })\n  .strict();\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive().safe(),\n    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    scheduledOrigin: z\n      .object({\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive().safe(),\n        runId: z.string().uuid(),\n      })\n      .strict()\n      .optional(),\n    source: z.discriminatedUnion(\"kind\", [\n      z.object({ kind: z.literal(\"direct\") }).strict(),\n      z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n      z\n        .object({\n          kind: z.literal(\"child_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n      z\n        .object({\n          kind: z.literal(\"inherited_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n    ]),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n      (value.source.kind === \"scheduled_task\" &&\n        (!value.scheduledOrigin ||\n          value.acceptedWork.kind !== \"scheduled_task\" ||\n          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n          value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))\n    )\n      context.addIssue({\n        code: \"custom\",\n        message: \"Scheduled host authority must retain its exact run origin\",\n      });\n    if (\n      value.acceptedWork.kind === \"turn\" &&\n      value.source.kind === \"inherited_turn\" &&\n      value.acceptedWork.turnId === value.source.turnId\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"source\"],\n        message: \"Accepted work cannot inherit from itself\",\n      });\n    }\n    if (\n      value.acceptedWork.kind === \"scheduled_task\" &&\n      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptedWork\"],\n        message: \"Task authority revision must be a safe integer\",\n      });\n    }\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n      context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n    }\n  });\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    taskId: z.string().uuid(),\n    taskAuthorityRevision: z.number().int().positive().safe(),\n    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    context: SessionTenancyVisibility,\n  })\n  .strict();\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,iBAAiB,MAAM;AAAA,EACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAClC,CAAC;AAGM,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,EACjD,eAAe;AACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,cAAc;AACtB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,MACrC,SAAS;AAAA,IACX,CAAC;AACH,MAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AACH,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAC1F,CAAC;AAYI,SAAS,+BACd,SACA,WACS;AACT,QAAM,SAAS,uBAAuB,UAAU,UAAU,aAAa;AACvE,MAAI,CAAC,OAAO,WAAW,CAAC,OAAO,KAAK,YAAa,QAAO;AACxD,QAAM,EAAE,aAAa,GAAG,cAAc,IAAI,OAAO;AACjD,QAAM,aAAa,yBAAyB,UAAU,QAAQ,UAAU;AACxE,MAAI,CAAC,WAAW,QAAS,QAAO;AAChC,MAAI;AACJ,MAAI;AACF,qBAAiB,IAAI,IAAI,UAAU,cAAc,EAAE,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MACE,UAAU,aAAa,WAAW,KAAK,YACvC,mBAAmB,WAAW,KAAK;AAEnC,WAAO;AACT,MAAI,eAAe,aAAa;AAC9B,UAAM,EAAE,cAAc,eAAe,GAAG,YAAY,IAAI,WAAW,KAAK;AACxE,WAAO,WAAW,aAAa,MAAM,WAAW,WAAW;AAAA,EAC7D;AACA,SACE,QAAQ,OAAO,YAAY,aAC3B,QAAQ,eAAe,YAAY,cACnC,WAAW,aAAa,MAAM,WAAW,WAAW,KAAK,aAAa;AAE1E;AAEO,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY;AACd,CAAC,EACA,OAAO;AAGV,IAAM,sBAAsB,EACzB,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGH,IAAM,yBAAyB,oBAAoB,YAAY,CAAC,OAAO,YAAY;AACjF,MACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AACM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC5D,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7D,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,OAAO;AAAA,EACP,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAQH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC9D,cAAc,+BAA+B,MAAM;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,iBAAiB,EACd,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,IACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,IACvD,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,YAAY;AAAA,MAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BAA0B,MAAM,aAAa;AAEvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACH,MACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EACxF;AACF,CAAC;AAII,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACtD,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC,EACA,OAAO;","names":[]}