@opengeni/contracts 2.15.2 → 3.0.0-canary.0

package/dist/index.js

@@ -610,6 +610,7 @@ import {
   HostExportCursor,
   HostExportInitiator,
   HostExportInitiatorContext,
+  HostMcpCreateSelections,
   HostSessionEvent,
   HostUsageEvent,
   HostUsageExport,
@@ -965,7 +966,6 @@ import {
   PackInstallationStatus,
   PackRigResolution,
   PackUninstallPreview,
-  Permission,
   PersonalResourceAttachmentIntent,
   PersonalResourceAttachmentSummary,
   PersonalResourceRetentionMode,
@@ -1126,8 +1126,6 @@ import {
   SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS,
   SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
   SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
-  SESSION_END_USER_ID_MAX_CHARS,
-  SESSION_END_USER_SOURCE_MAX_CHARS,
   SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES,
   SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES,
   SESSION_EVENT_ENVELOPE_MAX_BYTES,
@@ -1213,7 +1211,6 @@ import {
   SessionControlResponse,
   SessionControlState,
   SessionEffectiveToolPolicy,
-  SessionEndUser,
   SessionEvent,
   SessionEventLatestClass,
   SessionEventPayloadMode,
@@ -1259,6 +1256,7 @@ import {
   SessionRealtimeModel,
   SessionRealtimeMutationResponse,
   SessionRealtimeState,
+  SessionScopeSubjectId,
   SessionSkill,
   SessionSkills,
   SessionSpawnDenial,
@@ -1747,6 +1745,7 @@ import {
   bundledSkillSelectionFromMetadata,
   canonicalCodexFleetReplayJsonV1,
   canonicalModalCheckpointProviderBinding,
+  canonicalSkillReviewQuestion,
   canonicalizeSlackTaskPolicy,
   canonicalizeWorkspaceLearningSourceOverrides,
   capabilityCatalogItemIsTrustedForExposure,
@@ -1847,6 +1846,7 @@ import {
   signStreamToken,
   skillReviewHumanInput,
   stableJson,
+  storedSessionMemoryScope,
   toolResultSpillFilename,
   toolResultSpillSandboxPath,
   turnExecutionPolicyAuditMetadata,
@@ -1864,7 +1864,7 @@ import {
   workspaceLearningPolicyRouterContext,
   workspaceLearningSourceKey,
   workspaceSlackReactionChannelAllowed
-} from "./chunk-QP3BIGSC.js";
+} from "./chunk-OO4AEMQB.js";
 import {
   CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,
   CONNECTOR_ATTACHMENT_MAX_BYTES,
@@ -1896,7 +1896,7 @@ import {
   assertCanonicalEditableArtifactSerializedCommit,
   decodeEditableArtifactSerializedCommit,
   encodeEditableArtifactSerializedCommit
-} from "./chunk-6TCVR53X.js";
+} from "./chunk-O5LEQHDM.js";
 import {
   WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1,
   XaiProviderAccountAuthoritySnapshotV1
@@ -1924,6 +1924,29 @@ import {
   MAX_COMMITTED_TRANSACTION_OPERATIONS,
   decodeCommittedTransactionSummary
 } from "./chunk-3SIZGL3O.js";
+import {
+  EDITABLE_ARTIFACT_COMMAND_MAX_BYTES,
+  EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
+  EDITABLE_ARTIFACT_INTENT_MAX_CAUSAL_ACTORS,
+  EDITABLE_ARTIFACT_INTENT_MAX_UNDO_TARGETS,
+  EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION,
+  EDITABLE_ARTIFACT_INTENT_VERSION,
+  EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES,
+  EDITABLE_ARTIFACT_PRODUCT_MAX_SNAPSHOT_BYTES,
+  assertEditableArtifactRequestHash,
+  decodeEditableArtifactMutationIntent,
+  encodeEditableArtifactMutationIntent,
+  hashEditableArtifactMutationIntent,
+  hashEditableArtifactMutationIntentBytes
+} from "./chunk-NVJMJWLL.js";
+import {
+  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_BYTES,
+  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_REPLICAS,
+  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_VERSION,
+  assertCanonicalEditableArtifactCausalFrontierBytes,
+  decodeEditableArtifactCausalFrontier,
+  encodeEditableArtifactCausalFrontier
+} from "./chunk-YRKRZ6OF.js";
 import {
   CanonicalHumanBindingOperationRequest,
   CanonicalHumanIdentityMutationOutcome,
@@ -2005,59 +2028,34 @@ import {
   OrganizationRecoveryUnavailableReason,
   StartOrganizationRecoveryOperationRequest
 } from "./chunk-BCS7WHCK.js";
-import {
-  SiteSessionPathError,
-  siteSessionPath
-} from "./chunk-UGTBTPTQ.js";
-import {
-  ConnectorDocumentDestination,
-  ConnectorDocumentDestinationAuthority,
-  ConnectorDocumentDestinationSelection,
-  bindConnectorDocumentDestination,
-  connectorDestinationDocumentAuthority,
-  connectorDocumentDestinationCollectionId,
-  legacyWorkspaceConnectorDocumentDestination,
-  resolveConnectorDocumentDestination
-} from "./chunk-WYBDERIY.js";
-import {
-  AUTOMATIC_SESSION_TITLE_FALLBACK,
-  AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES,
-  SESSION_TITLE_MAX_CHARACTERS,
-  boundAutomaticSessionTitle,
-  containsSensitiveAutomaticSessionTitleValue,
-  deriveAutomaticSessionTitlePreview,
-  deriveSessionDisplayTitle,
-  normalizeAutomaticSessionTitle,
-  sessionTitleIsPending
-} from "./chunk-7ABONTXE.js";
-import {
-  EDITABLE_ARTIFACT_COMMAND_MAX_BYTES,
-  EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
-  EDITABLE_ARTIFACT_INTENT_MAX_CAUSAL_ACTORS,
-  EDITABLE_ARTIFACT_INTENT_MAX_UNDO_TARGETS,
-  EDITABLE_ARTIFACT_INTENT_PROTOCOL_VERSION,
-  EDITABLE_ARTIFACT_INTENT_VERSION,
-  EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES,
-  EDITABLE_ARTIFACT_PRODUCT_MAX_SNAPSHOT_BYTES,
-  assertEditableArtifactRequestHash,
-  decodeEditableArtifactMutationIntent,
-  encodeEditableArtifactMutationIntent,
-  hashEditableArtifactMutationIntent,
-  hashEditableArtifactMutationIntentBytes
-} from "./chunk-NVJMJWLL.js";
-import {
-  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_BYTES,
-  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_REPLICAS,
-  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_VERSION,
-  assertCanonicalEditableArtifactCausalFrontierBytes,
-  decodeEditableArtifactCausalFrontier,
-  encodeEditableArtifactCausalFrontier
-} from "./chunk-YRKRZ6OF.js";
 import {
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
   currentEditableArtifactCompatibility,
   editableArtifactCodecFor
-} from "./chunk-NPYLOZAP.js";
+} from "./chunk-5LYFSZ7O.js";
+import {
+  SPREADSHEET_ARTIFACT_METADATA_MAX_SHEETS,
+  SPREADSHEET_ARTIFACT_METADATA_MIN_RESPONSE_BYTES,
+  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_PROJECTION_MAX_STRING_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_VERSION,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_AREA,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MIN_RESPONSE_BYTES,
+  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
+  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
+  decodeSpreadsheetArtifactKernelProjection,
+  decodeSpreadsheetArtifactKernelQuery,
+  decodeSpreadsheetMetadataKernelProjection,
+  decodeSpreadsheetViewportKernelProjection,
+  encodeSpreadsheetArtifactKernelProjection,
+  encodeSpreadsheetArtifactKernelQuery,
+  encodeSpreadsheetMetadataKernelProjection,
+  encodeSpreadsheetMetadataKernelQuery,
+  encodeSpreadsheetViewportKernelProjection,
+  encodeSpreadsheetViewportKernelQuery
+} from "./chunk-Y3KNXVTD.js";
 import {
   PRESENTATION_ARTIFACT_COMMAND_MAX_BYTES,
   PRESENTATION_ARTIFACT_COMMAND_MAX_COMMANDS,
@@ -2090,29 +2088,6 @@ import {
   encodePresentationArtifactQuery,
   encodePresentationArtifactQueryResponse
 } from "./chunk-D2HKF2EF.js";
-import {
-  SPREADSHEET_ARTIFACT_METADATA_MAX_SHEETS,
-  SPREADSHEET_ARTIFACT_METADATA_MIN_RESPONSE_BYTES,
-  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_PROJECTION_MAX_STRING_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_VERSION,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_AREA,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MIN_RESPONSE_BYTES,
-  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
-  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
-  decodeSpreadsheetArtifactKernelProjection,
-  decodeSpreadsheetArtifactKernelQuery,
-  decodeSpreadsheetMetadataKernelProjection,
-  decodeSpreadsheetViewportKernelProjection,
-  encodeSpreadsheetArtifactKernelProjection,
-  encodeSpreadsheetArtifactKernelQuery,
-  encodeSpreadsheetMetadataKernelProjection,
-  encodeSpreadsheetMetadataKernelQuery,
-  encodeSpreadsheetViewportKernelProjection,
-  encodeSpreadsheetViewportKernelQuery
-} from "./chunk-Y3KNXVTD.js";
 import {
   SPREADSHEET_ARTIFACT_COMMAND_MAX_BYTES,
   SPREADSHEET_ARTIFACT_COMMAND_MAX_CELLS,
@@ -2163,6 +2138,34 @@ import {
   SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
   SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
 } from "./chunk-PX3VCKAU.js";
+import {
+  SiteSessionPathError,
+  siteSessionPath
+} from "./chunk-UGTBTPTQ.js";
+import {
+  ConnectorDocumentDestination,
+  ConnectorDocumentDestinationAuthority,
+  ConnectorDocumentDestinationSelection,
+  bindConnectorDocumentDestination,
+  connectorDestinationDocumentAuthority,
+  connectorDocumentDestinationCollectionId,
+  legacyWorkspaceConnectorDocumentDestination,
+  resolveConnectorDocumentDestination
+} from "./chunk-WYBDERIY.js";
+import {
+  Permission
+} from "./chunk-P3HLDT77.js";
+import {
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
+  AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES,
+  SESSION_TITLE_MAX_CHARACTERS,
+  boundAutomaticSessionTitle,
+  containsSensitiveAutomaticSessionTitleValue,
+  deriveAutomaticSessionTitlePreview,
+  deriveSessionDisplayTitle,
+  normalizeAutomaticSessionTitle,
+  sessionTitleIsPending
+} from "./chunk-7ABONTXE.js";
 export {
   AGENT_AUTHORED_COMPANY_PROFILE_CONTENT_MAX_UTF8_BYTES,
   AGENT_AUTHORED_COMPANY_PROFILE_ENTRY_MAX_CHARS,
@@ -2858,6 +2861,7 @@ export {
   HostExportCursor,
   HostExportInitiator,
   HostExportInitiatorContext,
+  HostMcpCreateSelections,
   HostSessionEvent,
   HostUsageEvent,
   HostUsageExport,
@@ -3434,8 +3438,6 @@ export {
   SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS,
   SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT,
   SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH,
-  SESSION_END_USER_ID_MAX_CHARS,
-  SESSION_END_USER_SOURCE_MAX_CHARS,
   SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES,
   SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES,
   SESSION_EVENT_ENVELOPE_MAX_BYTES,
@@ -3539,7 +3541,6 @@ export {
   SessionControlResponse,
   SessionControlState,
   SessionEffectiveToolPolicy,
-  SessionEndUser,
   SessionEvent,
   SessionEventLatestClass,
   SessionEventPayloadMode,
@@ -3585,6 +3586,7 @@ export {
   SessionRealtimeModel,
   SessionRealtimeMutationResponse,
   SessionRealtimeState,
+  SessionScopeSubjectId,
   SessionSkill,
   SessionSkills,
   SessionSpawnDenial,
@@ -4113,6 +4115,7 @@ export {
   bundledSkillSelectionFromMetadata,
   canonicalCodexFleetReplayJsonV1,
   canonicalModalCheckpointProviderBinding,
+  canonicalSkillReviewQuestion,
   canonicalizeSlackTaskPolicy,
   canonicalizeWorkspaceLearningSourceOverrides,
   capabilityCatalogItemIsTrustedForExposure,
@@ -4270,6 +4273,7 @@ export {
   skillReviewHumanInput,
   spreadsheetSheetId,
   stableJson,
+  storedSessionMemoryScope,
   toolResultSpillFilename,
   toolResultSpillSandboxPath,
   turnExecutionPolicyAuditMetadata,

package/dist/personal-github.js

@@ -1,26 +1,27 @@
 import {
   ConnectionMetadata
-} from "./chunk-QP3BIGSC.js";
+} from "./chunk-OO4AEMQB.js";
 import "./chunk-YBW5JSA3.js";
-import "./chunk-6TCVR53X.js";
+import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";
 import "./chunk-MRWYRAS5.js";
 import "./chunk-3SIZGL3O.js";
+import "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-JUFK3T4Q.js";
 import "./chunk-M5ZGRVIQ.js";
 import "./chunk-BCS7WHCK.js";
-import "./chunk-UGTBTPTQ.js";
-import "./chunk-WYBDERIY.js";
-import "./chunk-7ABONTXE.js";
-import "./chunk-NVJMJWLL.js";
-import "./chunk-YRKRZ6OF.js";
-import "./chunk-NPYLOZAP.js";
-import "./chunk-D2HKF2EF.js";
+import "./chunk-5LYFSZ7O.js";
 import "./chunk-Y3KNXVTD.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-RIY7GYQS.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-PX3VCKAU.js";
+import "./chunk-UGTBTPTQ.js";
+import "./chunk-WYBDERIY.js";
+import "./chunk-P3HLDT77.js";
+import "./chunk-7ABONTXE.js";
 
 // src/personal-github.ts
 import { z } from "zod";

package/dist/personal-github.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}
+{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/contracts",
-  "version": "2.15.2",
+  "version": "3.0.0-canary.0",
   "description": "Shared zod schemas and wire-contract types for the OpenGeni API.",
   "license": "Apache-2.0",
   "repository": {
@@ -18,6 +18,18 @@
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
+    "./host-mcp-bindings": {
+      "types": "./dist/host-mcp-bindings.d.ts",
+      "import": "./dist/host-mcp-bindings.js"
+    },
+    "./external-identities": {
+      "types": "./dist/external-identities.d.ts",
+      "import": "./dist/external-identities.js"
+    },
+    "./connect": {
+      "types": "./dist/connect.d.ts",
+      "import": "./dist/connect.js"
+    },
     "./site-session-http": {
       "types": "./dist/site-session-http.d.ts",
       "import": "./dist/site-session-http.js"

package/src/connect.ts

@@ -0,0 +1,202 @@
+import { z } from "zod";
+import { IntegrationInstanceKey, IntegrationSource } from "./index";
+
+const opaqueId = z.string().min(1).max(512);
+export const ConnectOwnership = z.enum(["personal", "workspace"]);
+export type ConnectOwnership = z.infer<typeof ConnectOwnership>;
+export const ConnectProvider = z
+  .object({
+    id: opaqueId,
+    label: z.string().min(1).max(256),
+    family: opaqueId,
+    readiness: z.enum(["available", "needs_configuration", "operator_only", "unsupported"]),
+    reason: z.string().max(1024).optional(),
+    ownership: z.array(ConnectOwnership).max(2),
+    setup: z
+      .array(
+        z.enum(["none", "oauth", "credentials", "device", "installation", "openapi", "graphql"]),
+      )
+      .max(7),
+  })
+  .strict();
+export type ConnectProvider = z.infer<typeof ConnectProvider>;
+export const ConnectAccount = z
+  .object({
+    id: opaqueId,
+    providerId: opaqueId,
+    version: z.number().int().positive().optional(),
+    label: z.string().max(256),
+    ownership: ConnectOwnership,
+    status: z.enum(["connected", "auth_needed", "disabled"]),
+  })
+  .strict();
+export type ConnectAccount = z.infer<typeof ConnectAccount>;
+export const ConnectResource = z
+  .object({ id: opaqueId, label: z.string().max(512), kind: opaqueId })
+  .strict();
+export type ConnectResource = z.infer<typeof ConnectResource>;
+export const ConnectNextAction = z.discriminatedUnion("type", [
+  z.object({ type: z.literal("authorize"), url: z.string().url().max(16_384) }).strict(),
+  z
+    .object({
+      type: z.literal("credentials"),
+      fields: z
+        .array(
+          z
+            .object({
+              name: opaqueId,
+              label: z.string().max(256),
+              required: z.boolean(),
+              secret: z.boolean(),
+              options: z
+                .array(z.object({ value: opaqueId, label: z.string().max(512) }).strict())
+                .max(1000)
+                .optional(),
+            })
+            .strict(),
+        )
+        .max(32),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("wait"),
+      pollAfterMs: z.number().int().min(250).max(60_000),
+      userCode: z.string().max(128).optional(),
+      verificationUrl: z.string().url().max(2048).optional(),
+    })
+    .strict(),
+  z
+    .object({ type: z.literal("select_account"), accounts: z.array(ConnectAccount).max(100) })
+    .strict(),
+  z
+    .object({
+      type: z.literal("select_resources"),
+      resources: z.array(ConnectResource).max(100),
+      cursor: z.string().max(2048).optional(),
+    })
+    .strict(),
+  z
+    .object({
+      type: z.literal("preview"),
+      previewId: opaqueId,
+      contentHash: opaqueId,
+      operations: z.array(ConnectResource).max(2000),
+    })
+    .strict(),
+  z.object({ type: z.literal("none") }).strict(),
+]);
+export type ConnectNextAction = z.infer<typeof ConnectNextAction>;
+export const ConnectInstallationTarget = z
+  .object({
+    instanceKey: IntegrationInstanceKey,
+    displayName: z.string().min(1).max(200),
+    expectedInstanceVersion: z.number().int().positive().optional(),
+  })
+  .strict();
+export type ConnectInstallationTarget = z.infer<typeof ConnectInstallationTarget>;
+export const ConnectAttemptState = z.enum([
+  "ready",
+  "requires_user_action",
+  "credential_input",
+  "provider_wait",
+  "account_selection",
+  "resource_selection",
+  "preview",
+  "installing",
+  "connected_but_incomplete",
+  "complete",
+  "cancelled",
+  "expired",
+  "failed",
+  "uncertain",
+]);
+export const ConnectAttempt = z
+  .object({
+    id: opaqueId,
+    workspaceId: opaqueId,
+    providerId: opaqueId,
+    ownership: ConnectOwnership,
+    revision: z.number().int().positive(),
+    state: ConnectAttemptState,
+    credentialsCommitted: z.boolean(),
+    integrationInstalled: z.boolean(),
+    completionRequirement: z.enum(["connection", "integration", "provider_setup"]),
+    nextAction: ConnectNextAction,
+    expiresAt: z.string().datetime({ offset: true }),
+    account: ConnectAccount.optional(),
+    installationTarget: ConnectInstallationTarget.optional(),
+    source: IntegrationSource.optional(),
+    error: z
+      .object({ code: opaqueId, message: z.string().max(2048), retryable: z.boolean() })
+      .strict()
+      .optional(),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (
+      value.state === "complete" &&
+      value.completionRequirement === "integration" &&
+      !value.integrationInstalled
+    ) {
+      context.addIssue({
+        code: "custom",
+        message: "Complete setup requires an installed integration",
+      });
+    }
+    if (
+      value.state === "complete" &&
+      value.completionRequirement === "connection" &&
+      !value.credentialsCommitted
+    ) {
+      context.addIssue({
+        code: "custom",
+        message: "Connection setup requires committed credentials",
+      });
+    }
+    if (
+      ["complete", "cancelled", "expired"].includes(value.state) &&
+      value.nextAction.type !== "none"
+    ) {
+      context.addIssue({ code: "custom", message: "A terminal setup has no next action" });
+    }
+  });
+export type ConnectAttempt = z.infer<typeof ConnectAttempt>;
+export const ConnectAdvance = z.discriminatedUnion("type", [
+  z
+    .object({
+      type: z.literal("credentials"),
+      values: z.record(z.string().max(256), z.string().max(16_384)),
+    })
+    .strict(),
+  z.object({ type: z.literal("account"), accountId: opaqueId }).strict(),
+  z.object({ type: z.literal("resources"), resourceIds: z.array(opaqueId).max(1000) }).strict(),
+  z
+    .object({
+      type: z.literal("install"),
+      previewId: opaqueId,
+      contentHash: opaqueId,
+      operationIds: z.array(opaqueId).max(2000),
+    })
+    .strict(),
+  z.object({ type: z.literal("retry") }).strict(),
+]);
+export type ConnectAdvance = z.infer<typeof ConnectAdvance>;
+export const ConnectOperationRequest = z
+  .object({
+    expectedRevision: z.number().int().positive().safe(),
+    idempotencyKey: opaqueId,
+  })
+  .strict();
+export const AdvanceConnectRequest = ConnectOperationRequest.extend({ action: ConnectAdvance });
+export const BeginConnectRequest = z
+  .object({
+    providerId: opaqueId,
+    ownership: ConnectOwnership,
+    // URL parsing validates separately; never transform this original string.
+    returnUrl: z.string().min(1).max(4096),
+    idempotencyKey: opaqueId,
+    reconnectAccountId: opaqueId.optional(),
+    installationTarget: ConnectInstallationTarget.optional(),
+  })
+  .strict();