@opengeni/contracts 2.15.2 → 3.0.0-canary.0

package/dist/chunk-P3HLDT77.js

@@ -0,0 +1,59 @@
+// src/permissions.ts
+import { z } from "zod";
+var Permission = z.enum([
+  "account:read",
+  "account:admin",
+  "members:manage",
+  "workspace:create",
+  "billing:read",
+  "billing:manage",
+  "workspace:read",
+  "workspace:admin",
+  "sessions:create",
+  "sessions:read",
+  "sessions:control",
+  "stream:view",
+  "stream:control",
+  "stream:acknowledge",
+  "files:upload",
+  "files:read",
+  "files:write",
+  "terminal:attach",
+  "documents:manage",
+  "documents:search",
+  "scheduled_tasks:manage",
+  "scheduled_tasks:run",
+  "github:manage",
+  "github:use",
+  "api_keys:manage",
+  "connections:read",
+  "connections:write",
+  "capabilities:manage",
+  /** @deprecated alias of variable-sets:manage */
+  "environments:manage",
+  /** @deprecated alias of variable-sets:use */
+  "environments:use",
+  "variable-sets:list",
+  "variable-sets:read",
+  "variable-sets:write",
+  "variable-sets:manage",
+  "variable-sets:attach",
+  "variable-sets:use",
+  "secrets:list",
+  "secrets:read",
+  "secrets:write",
+  "mcp_servers:attach",
+  "codemode:call",
+  "goals:manage",
+  "enrollments:read",
+  "enrollments:manage",
+  "rigs:use",
+  "rigs:manage",
+  "artifacts:read",
+  "artifacts:publish"
+]);
+
+export {
+  Permission
+};
+//# sourceMappingURL=chunk-P3HLDT77.js.map

package/dist/chunk-P3HLDT77.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/permissions.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Canonical public permission vocabulary shared by operational and control-plane contracts. */\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  \"stream:view\",\n  \"stream:control\",\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  \"files:write\",\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  \"capabilities:manage\",\n  /** @deprecated alias of variable-sets:manage */\n  \"environments:manage\",\n  /** @deprecated alias of variable-sets:use */\n  \"environments:use\",\n  \"variable-sets:list\",\n  \"variable-sets:read\",\n  \"variable-sets:write\",\n  \"variable-sets:manage\",\n  \"variable-sets:attach\",\n  \"variable-sets:use\",\n  \"secrets:list\",\n  \"secrets:read\",\n  \"secrets:write\",\n  \"mcp_servers:attach\",\n  \"codemode:call\",\n  \"goals:manage\",\n  \"enrollments:read\",\n  \"enrollments:manage\",\n  \"rigs:use\",\n  \"rigs:manage\",\n  \"artifacts:read\",\n  \"artifacts:publish\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n"],"mappings":";AAAA,SAAS,SAAS;AAGX,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}

package/dist/chunk-SSWEWU3V.js

@@ -0,0 +1,348 @@
+import {
+  ConnectionKind,
+  ManagedUserResourceGrantMode,
+  SessionTenancyVisibility,
+  UserResourceAuthorityGrant,
+  UserResourceDelegation
+} from "./chunk-OO4AEMQB.js";
+
+// src/connection-authority.ts
+import { z } from "zod";
+var ConnectionUseAction = z.literal("connection.use");
+var ConnectionAuthorityEnvelope = z.object({
+  scope: z.enum(["workspace", "user"]).default("workspace"),
+  userDelegation: UserResourceDelegation.optional()
+}).strict().superRefine((value, context) => {
+  if (value.scope === "workspace" && value.userDelegation !== void 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation"],
+      message: "workspace connections cannot carry user delegation"
+    });
+    return;
+  }
+  if (value.scope === "user" && value.userDelegation === void 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation"],
+      message: "user connections require an immutable delegation"
+    });
+    return;
+  }
+  if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation", "action"],
+      message: "connection delegation must use connection.use"
+    });
+  }
+});
+var ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({
+  action: ConnectionUseAction
+}).strict();
+var ConnectionAuthoritySummary = z.object({
+  authorityId: z.string().uuid(),
+  resourceId: z.string().uuid(),
+  originWorkspaceId: z.string().uuid().nullable(),
+  generation: z.number().int().positive(),
+  status: z.enum(["active", "retained", "revoked"]),
+  grants: z.array(ConnectionAuthorityGrant)
+}).strict();
+var ListConnectionAuthoritiesQuery = z.object({
+  scope: z.literal("user"),
+  cursor: z.string().uuid().optional(),
+  limit: z.coerce.number().int().min(1).max(100).default(50)
+}).strict();
+var ListConnectionAuthoritiesResponse = z.object({
+  scope: z.literal("user"),
+  authorities: z.array(ConnectionAuthoritySummary),
+  nextCursor: z.string().uuid().nullable()
+}).strict();
+var IssueConnectionUseGrantRequest = z.object({
+  scope: z.literal("user"),
+  mode: ManagedUserResourceGrantMode,
+  context: SessionTenancyVisibility,
+  sessionId: z.string().uuid().nullable().optional(),
+  expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),
+  workspaceSharedAcknowledged: z.boolean().default(false)
+}).strict().superRefine((value, context) => {
+  if (value.context === "workspace_shared" && !value.workspaceSharedAcknowledged) {
+    context.addIssue({
+      code: "custom",
+      path: ["workspaceSharedAcknowledged"],
+      message: "workspace_shared requires durable shared-output acknowledgement"
+    });
+  }
+  if (value.mode === "always" && (value.sessionId || value.expectedAuthorityEpoch)) {
+    context.addIssue({ code: "custom", path: ["sessionId"], message: "always is unbound" });
+  }
+  if (value.mode === "session" && (!value.sessionId || !value.expectedAuthorityEpoch)) {
+    context.addIssue({
+      code: "custom",
+      path: ["sessionId"],
+      message: "session requires a target session and expectedAuthorityEpoch"
+    });
+  }
+});
+var RevokeConnectionUseGrantQuery = z.object({ scope: z.literal("user") }).strict();
+var ConnectionUseGrantMutationResponse = z.object({
+  scope: z.literal("user"),
+  grant: ConnectionAuthorityGrant
+}).strict();
+var ConnectionUseGrantRevocationResponse = z.object({
+  scope: z.literal("user"),
+  grant: z.object({
+    grantId: z.string().uuid(),
+    generation: z.number().int().positive(),
+    status: z.literal("revoked"),
+    revokedAt: z.string().datetime()
+  }).strict()
+}).strict();
+var ConnectionAuthoritySelectionSource = z.enum([
+  "explicit_workspace",
+  "legacy_workspace_omission",
+  "legacy_user_compatibility",
+  "user_delegation"
+]);
+var ConnectionUseSelectionSource = z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);
+var AcceptedConnectionWork = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("turn"),
+    turnId: z.string().uuid()
+  }).strict(),
+  z.object({
+    kind: z.literal("scheduled_task"),
+    taskId: z.string().uuid(),
+    taskAuthorityRevision: z.number().int().positive(),
+    runId: z.string().uuid()
+  }).strict()
+]);
+var ConnectionUseAuthoritySnapshot = z.object({
+  organizationId: z.string().uuid(),
+  originWorkspaceId: z.string().uuid(),
+  targetWorkspaceId: z.string().uuid(),
+  targetSessionId: z.string().uuid(),
+  targetSessionVisibility: SessionTenancyVisibility,
+  targetSessionAuthorityEpoch: z.number().int().positive(),
+  acceptedWork: AcceptedConnectionWork,
+  connectionId: z.string().uuid(),
+  connectionGeneration: z.number().int().positive(),
+  connectionStatus: z.literal("active"),
+  providerDomain: z.string().min(1).max(2048),
+  connectionKind: ConnectionKind,
+  scope: z.enum(["workspace", "user", "legacy_user"]),
+  ownerSubjectId: z.string().min(1).max(512).nullable(),
+  ownerOrganizationMembershipId: z.string().uuid().nullable(),
+  ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
+  authoritySource: ConnectionAuthoritySelectionSource,
+  selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
+  userDelegation: UserResourceDelegation.nullable()
+}).strict().superRefine((value, context) => {
+  const ownedBySubject = value.scope !== "workspace";
+  const delegated = value.scope === "user";
+  if (ownedBySubject !== (value.ownerSubjectId !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["ownerSubjectId"],
+      message: "personal connections retain an owner subject"
+    });
+  }
+  if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["ownerOrganizationMembershipId"],
+      message: "only user connections retain an owner membership"
+    });
+  }
+  if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["ownerMembershipAuthorizationRevision"],
+      message: "only user connections retain an owner membership revision"
+    });
+  }
+  if (delegated !== (value.userDelegation !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation"],
+      message: "only user connections retain a delegation"
+    });
+  }
+  if (delegated && value.authoritySource !== "user_delegation") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "user connections require user_delegation provenance"
+    });
+  }
+  if (!delegated && value.authoritySource === "user_delegation") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "non-delegated connections cannot claim user delegation provenance"
+    });
+  }
+  if (value.scope === "legacy_user" && value.authoritySource !== "legacy_user_compatibility") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "legacy user connections require explicit compatibility provenance"
+    });
+  }
+  if (value.scope === "workspace" && value.authoritySource === "legacy_user_compatibility") {
+    context.addIssue({
+      code: "custom",
+      path: ["authoritySource"],
+      message: "workspace connections cannot claim legacy user provenance"
+    });
+  }
+  if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
+    context.addIssue({
+      code: "custom",
+      path: ["originWorkspaceId"],
+      message: "workspace connections must be owned by the target workspace"
+    });
+  }
+  const delegation = value.userDelegation;
+  if (!delegation) return;
+  const exactFacts = [
+    [
+      delegation.organizationId === value.organizationId,
+      ["userDelegation", "organizationId"],
+      "delegation organization mismatch"
+    ],
+    [
+      delegation.workspaceId === value.targetWorkspaceId,
+      ["userDelegation", "workspaceId"],
+      "delegation target workspace mismatch"
+    ],
+    [
+      delegation.action === ConnectionUseAction.value,
+      ["userDelegation", "action"],
+      "delegation action mismatch"
+    ],
+    [
+      delegation.context === value.targetSessionVisibility,
+      ["userDelegation", "context"],
+      "delegation visibility mismatch"
+    ]
+  ];
+  for (const [matches, path, message] of exactFacts) {
+    if (!matches) context.addIssue({ code: "custom", path, message });
+  }
+  if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation", "sessionId"],
+      message: "delegation session mismatch"
+    });
+  }
+  if (delegation.authorityEpoch !== null && delegation.authorityEpoch !== value.targetSessionAuthorityEpoch) {
+    context.addIssue({
+      code: "custom",
+      path: ["userDelegation", "authorityEpoch"],
+      message: "delegation authority epoch mismatch"
+    });
+  }
+});
+var ConnectionUseDenialReason = z.enum([
+  "tenant_mismatch",
+  "workspace_access_inactive",
+  "session_inactive",
+  "session_identity_changed",
+  "session_visibility_changed",
+  "session_authority_epoch_changed",
+  "accepted_attempt_authority_required",
+  "accepted_snapshot_digest_changed",
+  "connection_missing",
+  "connection_identity_changed",
+  "connection_generation_changed",
+  "connection_status_inactive",
+  "connection_owner_changed",
+  "owner_membership_inactive",
+  "authority_missing",
+  "authority_identity_changed",
+  "authority_generation_changed",
+  "authority_status_inactive",
+  "grant_missing",
+  "grant_identity_changed",
+  "grant_generation_changed",
+  "grant_status_inactive",
+  "grant_expired",
+  "grant_already_consumed"
+]);
+var ConnectionUseAttributionFields = z.object({
+  organizationId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  sessionId: z.string().uuid(),
+  connectionId: z.string().uuid(),
+  connectionGeneration: z.number().int().positive(),
+  scope: z.enum(["workspace", "user", "legacy_user"]),
+  ownerSubjectId: z.string().min(1).max(512).nullable(),
+  authorityId: z.string().uuid().nullable(),
+  grantId: z.string().uuid().nullable()
+}).strict();
+function refineConnectionUseAttribution(value, context) {
+  const personal = value.scope !== "workspace";
+  for (const field of ["ownerSubjectId"]) {
+    if (personal !== (value[field] !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
+      });
+    }
+  }
+  const delegated = value.scope === "user";
+  for (const field of ["authorityId", "grantId"]) {
+    if (delegated !== (value[field] !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: delegated ? `delegated personal attribution requires ${field}` : `non-delegated attribution cannot carry ${field}`
+      });
+    }
+  }
+}
+var ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(
+  refineConnectionUseAttribution
+);
+var ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({
+  outcome: z.enum(["authorized", "denied"]),
+  denialReason: ConnectionUseDenialReason.nullable(),
+  occurredAt: z.string().datetime({ offset: true })
+}).superRefine((value, context) => {
+  refineConnectionUseAttribution(value, context);
+  if (value.outcome === "denied" !== (value.denialReason !== null)) {
+    context.addIssue({
+      code: "custom",
+      path: ["denialReason"],
+      message: "only denied connection use carries a denial reason"
+    });
+  }
+});
+var ConnectionUseAuthorizationResult = z.discriminatedUnion("status", [
+  z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
+  z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
+]);
+
+export {
+  ConnectionUseAction,
+  ConnectionAuthorityEnvelope,
+  ConnectionAuthorityGrant,
+  ConnectionAuthoritySummary,
+  ListConnectionAuthoritiesQuery,
+  ListConnectionAuthoritiesResponse,
+  IssueConnectionUseGrantRequest,
+  RevokeConnectionUseGrantQuery,
+  ConnectionUseGrantMutationResponse,
+  ConnectionUseGrantRevocationResponse,
+  ConnectionAuthoritySelectionSource,
+  ConnectionUseSelectionSource,
+  ConnectionUseAuthoritySnapshot,
+  ConnectionUseDenialReason,
+  ConnectionUseAttribution,
+  ConnectionUseAuditFact,
+  ConnectionUseAuthorizationResult
+};
+//# sourceMappingURL=chunk-SSWEWU3V.js.map

package/dist/chunk-SSWEWU3V.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  ConnectionKind,\n  ManagedUserResourceGrantMode,\n  SessionTenancyVisibility,\n  UserResourceAuthorityGrant,\n  UserResourceDelegation,\n} from \"./index\";\n\n/** The only generic grant action that authorizes use of a connection. */\nexport const ConnectionUseAction = z.literal(\"connection.use\");\nexport type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;\n\n/**\n * Connection authority is either workspace-owned or user-owned. Omission is\n * intentionally compatible with the historical workspace connection path.\n */\nexport const ConnectionAuthorityEnvelope = z\n  .object({\n    scope: z.enum([\"workspace\", \"user\"]).default(\"workspace\"),\n    userDelegation: UserResourceDelegation.optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.scope === \"workspace\" && value.userDelegation !== undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"workspace connections cannot carry user delegation\",\n      });\n      return;\n    }\n    if (value.scope === \"user\" && value.userDelegation === undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"user connections require an immutable delegation\",\n      });\n      return;\n    }\n    if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"action\"],\n        message: \"connection delegation must use connection.use\",\n      });\n    }\n  });\nexport type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;\n\nexport const ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({\n  action: ConnectionUseAction,\n}).strict();\nexport type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;\n\n/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */\nexport const ConnectionAuthoritySummary = z\n  .object({\n    authorityId: z.string().uuid(),\n    resourceId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid().nullable(),\n    generation: z.number().int().positive(),\n    status: z.enum([\"active\", \"retained\", \"revoked\"]),\n    grants: z.array(ConnectionAuthorityGrant),\n  })\n  .strict();\nexport type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;\n\nexport const ListConnectionAuthoritiesQuery = z\n  .object({\n    scope: z.literal(\"user\"),\n    cursor: z.string().uuid().optional(),\n    limit: z.coerce.number().int().min(1).max(100).default(50),\n  })\n  .strict();\nexport const ListConnectionAuthoritiesResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    authorities: z.array(ConnectionAuthoritySummary),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\n\nexport const IssueConnectionUseGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\nexport type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;\n\nexport const RevokeConnectionUseGrantQuery = z.object({ scope: z.literal(\"user\") }).strict();\n\nexport const ConnectionUseGrantMutationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: ConnectionAuthorityGrant,\n  })\n  .strict();\nexport type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;\n\nexport const ConnectionUseGrantRevocationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: z\n      .object({\n        grantId: z.string().uuid(),\n        generation: z.number().int().positive(),\n        status: z.literal(\"revoked\"),\n        revokedAt: z.string().datetime(),\n      })\n      .strict(),\n  })\n  .strict();\nexport type ConnectionUseGrantRevocationResponse = z.infer<\n  typeof ConnectionUseGrantRevocationResponse\n>;\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\n  \"explicit_workspace\",\n  \"legacy_workspace_omission\",\n  \"legacy_user_compatibility\",\n  \"user_delegation\",\n]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n  z\n    .object({\n      kind: z.literal(\"turn\"),\n      turnId: z.string().uuid(),\n    })\n    .strict(),\n  z\n    .object({\n      kind: z.literal(\"scheduled_task\"),\n      taskId: z.string().uuid(),\n      taskAuthorityRevision: z.number().int().positive(),\n      runId: z.string().uuid(),\n    })\n    .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n  .object({\n    organizationId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid(),\n    targetWorkspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive(),\n    acceptedWork: AcceptedConnectionWork,\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    connectionStatus: z.literal(\"active\"),\n    providerDomain: z.string().min(1).max(2048),\n    connectionKind: ConnectionKind,\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    ownerOrganizationMembershipId: z.string().uuid().nullable(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n    authoritySource: ConnectionAuthoritySelectionSource,\n    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n    userDelegation: UserResourceDelegation.nullable(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    const ownedBySubject = value.scope !== \"workspace\";\n    const delegated = value.scope === \"user\";\n    if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerSubjectId\"],\n        message: \"personal connections retain an owner subject\",\n      });\n    }\n    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerOrganizationMembershipId\"],\n        message: \"only user connections retain an owner membership\",\n      });\n    }\n    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerMembershipAuthorizationRevision\"],\n        message: \"only user connections retain an owner membership revision\",\n      });\n    }\n    if (delegated !== (value.userDelegation !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"only user connections retain a delegation\",\n      });\n    }\n    if (delegated && value.authoritySource !== \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"user connections require user_delegation provenance\",\n      });\n    }\n    if (!delegated && value.authoritySource === \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"non-delegated connections cannot claim user delegation provenance\",\n      });\n    }\n    if (value.scope === \"legacy_user\" && value.authoritySource !== \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"legacy user connections require explicit compatibility provenance\",\n      });\n    }\n    if (value.scope === \"workspace\" && value.authoritySource === \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"workspace connections cannot claim legacy user provenance\",\n      });\n    }\n    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"originWorkspaceId\"],\n        message: \"workspace connections must be owned by the target workspace\",\n      });\n    }\n    const delegation = value.userDelegation;\n    if (!delegation) return;\n    const exactFacts: Array<[boolean, (string | number)[], string]> = [\n      [\n        delegation.organizationId === value.organizationId,\n        [\"userDelegation\", \"organizationId\"],\n        \"delegation organization mismatch\",\n      ],\n      [\n        delegation.workspaceId === value.targetWorkspaceId,\n        [\"userDelegation\", \"workspaceId\"],\n        \"delegation target workspace mismatch\",\n      ],\n      [\n        delegation.action === ConnectionUseAction.value,\n        [\"userDelegation\", \"action\"],\n        \"delegation action mismatch\",\n      ],\n      [\n        delegation.context === value.targetSessionVisibility,\n        [\"userDelegation\", \"context\"],\n        \"delegation visibility mismatch\",\n      ],\n    ];\n    for (const [matches, path, message] of exactFacts) {\n      if (!matches) context.addIssue({ code: \"custom\", path, message });\n    }\n    if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"sessionId\"],\n        message: \"delegation session mismatch\",\n      });\n    }\n    if (\n      delegation.authorityEpoch !== null &&\n      delegation.authorityEpoch !== value.targetSessionAuthorityEpoch\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"authorityEpoch\"],\n        message: \"delegation authority epoch mismatch\",\n      });\n    }\n  });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n  \"tenant_mismatch\",\n  \"workspace_access_inactive\",\n  \"session_inactive\",\n  \"session_identity_changed\",\n  \"session_visibility_changed\",\n  \"session_authority_epoch_changed\",\n  \"accepted_attempt_authority_required\",\n  \"accepted_snapshot_digest_changed\",\n  \"connection_missing\",\n  \"connection_identity_changed\",\n  \"connection_generation_changed\",\n  \"connection_status_inactive\",\n  \"connection_owner_changed\",\n  \"owner_membership_inactive\",\n  \"authority_missing\",\n  \"authority_identity_changed\",\n  \"authority_generation_changed\",\n  \"authority_status_inactive\",\n  \"grant_missing\",\n  \"grant_identity_changed\",\n  \"grant_generation_changed\",\n  \"grant_status_inactive\",\n  \"grant_expired\",\n  \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n  .object({\n    organizationId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    sessionId: z.string().uuid(),\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    authorityId: z.string().uuid().nullable(),\n    grantId: z.string().uuid().nullable(),\n  })\n  .strict();\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const delegated = value.scope === \"user\";\n  for (const field of [\"authorityId\", \"grantId\"] as const) {\n    if (delegated !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: delegated\n          ? `delegated personal attribution requires ${field}`\n          : `non-delegated attribution cannot carry ${field}`,\n      });\n    }\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(\n  refineConnectionUseAttribution,\n);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n  outcome: z.enum([\"authorized\", \"denied\"]),\n  denialReason: ConnectionUseDenialReason.nullable(),\n  occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n  refineConnectionUseAttribution(value, context);\n  if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"denialReason\"],\n      message: \"only denied connection use carries a denial reason\",\n    });\n  }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n  z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,QAAQ,gBAAgB;AAOtD,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC,EAAE,QAAQ,WAAW;AAAA,EACxD,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,UAAU,eAAe,MAAM,mBAAmB,QAAW;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,UAAU,UAAU,MAAM,mBAAmB,QAAW;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB,MAAM,eAAe,WAAW,oBAAoB,OAAO;AACrF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,QAAQ;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,2BAA2B,2BAA2B,OAAO;AAAA,EACxE,QAAQ;AACV,CAAC,EAAE,OAAO;AAIH,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,wBAAwB;AAC1C,CAAC,EACA,OAAO;AAGH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC,EACA,OAAO;AACH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,aAAa,EAAE,MAAM,0BAA0B;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAEH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAEpF,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,mBAAmB,OAAO;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,mBAAmB;AAC5D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,mBAAmB;AAC7D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,iBAAiB,MAAM,oBAAoB,6BAA6B;AAC1F,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,eAAe,MAAM,oBAAoB,6BAA6B;AACxF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAM;AACzB,MAAI,CAAC,WAAY;AACjB,QAAM,aAA4D;AAAA,IAChE;AAAA,MACE,WAAW,mBAAmB,MAAM;AAAA,MACpC,CAAC,kBAAkB,gBAAgB;AAAA,MACnC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,gBAAgB,MAAM;AAAA,MACjC,CAAC,kBAAkB,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,WAAW,oBAAoB;AAAA,MAC1C,CAAC,kBAAkB,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,YAAY,MAAM;AAAA,MAC7B,CAAC,kBAAkB,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,SAAS,MAAM,OAAO,KAAK,YAAY;AACjD,QAAI,CAAC,QAAS,SAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,cAAc,QAAQ,WAAW,cAAc,MAAM,iBAAiB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,WAAW;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,WAAW,mBAAmB,QAC9B,WAAW,mBAAmB,MAAM,6BACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,gBAAgB;AAAA,MACzC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,MAAM,UAAU;AAClC,aAAW,SAAS,CAAC,eAAe,SAAS,GAAY;AACvD,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,YACL,2CAA2C,KAAK,KAChD,0CAA0C,KAAK;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,IAAM,2BAA2B,+BAA+B;AAAA,EACrE;AACF;AAGO,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}

package/dist/chunk-TEMFILR7.js

@@ -0,0 +1,143 @@
+import {
+  Permission
+} from "./chunk-P3HLDT77.js";
+
+// src/external-identities.ts
+import { z } from "zod";
+var encoder = new TextEncoder();
+function opaqueText(maxBytes) {
+  return z.string().min(1).max(maxBytes).refine(
+    (value) => !value.includes("\0") && !/[\uD800-\uDFFF]/u.test(value) && encoder.encode(value).byteLength <= maxBytes,
+    {
+      message: `Identifier must be valid PostgreSQL Unicode text of at most ${maxBytes} UTF-8 bytes`
+    }
+  );
+}
+var externalId = opaqueText(1024);
+var source = opaqueText(200);
+var externalSubject = z.string().regex(/^external_user:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$(?![\s\S])/);
+var nativeSubject = z.string().min(1).max(1024).regex(/^user:[^\r\n]+$(?![\s\S])/);
+var ExternalIdentityReference = z.object({
+  externalId,
+  source: source.default("default")
+}).strict();
+var AddExternalWorkspaceMemberRequest = z.object({
+  identity: ExternalIdentityReference,
+  permissions: z.array(Permission).min(1).max(Permission.options.length)
+}).strict();
+var UpdateExternalIdentityMembershipRequest = z.object({
+  kind: z.enum(["suspend", "reactivate", "offboard"]),
+  expectedAuthorizationRevision: z.number().int().positive().safe(),
+  operationId: z.string().uuid(),
+  reason: z.string().max(512).optional()
+}).strict();
+var ExternalActorSelection = z.discriminatedUnion("mode", [
+  z.object({ mode: z.literal("external"), identity: ExternalIdentityReference }).strict(),
+  z.object({
+    mode: z.literal("linked_native"),
+    identity: ExternalIdentityReference,
+    linkId: z.string().uuid(),
+    expectedLinkRevision: z.number().int().positive().safe()
+  }).strict()
+]);
+var ExternalIdentity = z.object({
+  id: z.string().uuid(),
+  accountId: z.string().uuid(),
+  source,
+  externalId,
+  subjectId: externalSubject,
+  organizationMembershipId: z.string().uuid(),
+  personalWorkspaceId: z.string().uuid(),
+  status: z.enum(["active", "disabled", "revoked"]),
+  authorizationRevision: z.number().int().positive().safe()
+}).strict();
+var ExternalActorAttribution = z.object({
+  accountId: z.string().uuid(),
+  authenticatingApiKeyId: z.string().uuid(),
+  externalIdentityId: z.string().uuid(),
+  externalSubjectId: externalSubject,
+  externalAuthorizationRevision: z.number().int().positive().safe(),
+  effectiveSubjectId: z.string().min(1).max(1024),
+  actingMode: z.enum(["external", "linked_native"]),
+  linkId: z.string().uuid().optional(),
+  linkRevision: z.number().int().positive().safe().optional()
+}).strict().superRefine((value, context) => {
+  if (value.actingMode === "external") {
+    if (value.effectiveSubjectId !== value.externalSubjectId || value.linkId !== void 0 || value.linkRevision !== void 0) {
+      context.addIssue({
+        code: "custom",
+        message: "External mode cannot delegate native identity"
+      });
+    }
+  } else if (!value.linkId || !value.linkRevision || !nativeSubject.safeParse(value.effectiveSubjectId).success) {
+    context.addIssue({
+      code: "custom",
+      message: "Linked mode requires exact native delegation provenance"
+    });
+  }
+});
+var ExternalActorContinuation = z.object({
+  identity: ExternalIdentityReference,
+  actor: ExternalActorAttribution
+}).strict();
+var ExternalIdentityLink = z.object({
+  id: z.string().uuid(),
+  accountId: z.string().uuid(),
+  externalIdentityId: z.string().uuid(),
+  externalIdentity: ExternalIdentityReference.optional(),
+  nativeSubjectId: nativeSubject.nullable(),
+  status: z.enum(["pending", "active", "revoked", "expired"]),
+  revision: z.number().int().positive().safe(),
+  permissions: z.array(Permission).max(Permission.options.length),
+  expiresAt: z.string().datetime({ offset: true }).nullable()
+}).strict().refine(
+  (value) => value.status !== "active" || value.nativeSubjectId !== null,
+  "An active link requires a confirmed native identity"
+);
+var ExternalIdentityLinkPage = z.object({
+  links: z.array(ExternalIdentityLink).max(50),
+  nextCursor: z.string().uuid().nullable()
+}).strict();
+var BeginExternalIdentityLinkRequest = z.object({
+  permissions: z.array(Permission).min(1).max(Permission.options.length),
+  expiresAt: z.string().datetime({ offset: true }).nullable().default(null)
+}).strict();
+var ConfirmExternalIdentityLinkRequest = z.object({
+  challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  expectedRevision: z.number().int().positive().safe(),
+  permissions: z.array(Permission).min(1).max(Permission.options.length)
+}).strict();
+var BeginExternalIdentityLinkResponse = z.object({
+  link: ExternalIdentityLink,
+  challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),
+  confirmBefore: z.string().datetime({ offset: true })
+}).strict();
+var ExternalIdentityLinkPreview = z.object({
+  link: ExternalIdentityLink,
+  externalIdentity: ExternalIdentityReference,
+  nativeSubjectId: nativeSubject,
+  organizationId: z.string().uuid()
+}).strict();
+var ExternalLinkWorkSnapshot = z.object({
+  identity: ExternalIdentityReference,
+  actor: ExternalActorAttribution.refine((value) => value.actingMode === "linked_native"),
+  permissions: z.array(Permission).max(Permission.options.length)
+}).strict();
+
+export {
+  ExternalIdentityReference,
+  AddExternalWorkspaceMemberRequest,
+  UpdateExternalIdentityMembershipRequest,
+  ExternalActorSelection,
+  ExternalIdentity,
+  ExternalActorAttribution,
+  ExternalActorContinuation,
+  ExternalIdentityLink,
+  ExternalIdentityLinkPage,
+  BeginExternalIdentityLinkRequest,
+  ConfirmExternalIdentityLinkRequest,
+  BeginExternalIdentityLinkResponse,
+  ExternalIdentityLinkPreview,
+  ExternalLinkWorkSnapshot
+};
+//# sourceMappingURL=chunk-TEMFILR7.js.map

package/dist/chunk-TEMFILR7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/external-identities.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { Permission } from \"./permissions\";\n\n// External identifiers are opaque, case-sensitive strings. In particular a\n// native-looking identifier is still host data, never a native subject claim.\n// Bound bytes, not just JS code units: these values share a PostgreSQL B-tree\n// index entry. Never normalize/truncate an identifier to make it fit, and reject\n// text that the driver would replace or PostgreSQL cannot represent.\nconst encoder = new TextEncoder();\nfunction opaqueText(maxBytes: number) {\n  return z\n    .string()\n    .min(1)\n    .max(maxBytes)\n    .refine(\n      (value) =>\n        !value.includes(\"\\0\") &&\n        !/[\\uD800-\\uDFFF]/u.test(value) &&\n        encoder.encode(value).byteLength <= maxBytes,\n      {\n        message: `Identifier must be valid PostgreSQL Unicode text of at most ${maxBytes} UTF-8 bytes`,\n      },\n    );\n}\nconst externalId = opaqueText(1024);\nconst source = opaqueText(200);\nconst externalSubject = z\n  .string()\n  .regex(/^external_user:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$(?![\\s\\S])/);\nconst nativeSubject = z\n  .string()\n  .min(1)\n  .max(1024)\n  .regex(/^user:[^\\r\\n]+$(?![\\s\\S])/);\nexport const ExternalIdentityReference = z\n  .object({\n    externalId,\n    source: source.default(\"default\"),\n  })\n  .strict();\nexport type ExternalIdentityReference = z.infer<typeof ExternalIdentityReference>;\n\nexport const AddExternalWorkspaceMemberRequest = z\n  .object({\n    identity: ExternalIdentityReference,\n    permissions: z.array(Permission).min(1).max(Permission.options.length),\n  })\n  .strict();\nexport type AddExternalWorkspaceMemberRequest = z.infer<typeof AddExternalWorkspaceMemberRequest>;\n\n/** Uses the organization membership ID returned by lazy identity admission.\n * Reactivation restores admission only, not revoked work or workspace grants. */\nexport const UpdateExternalIdentityMembershipRequest = z\n  .object({\n    kind: z.enum([\"suspend\", \"reactivate\", \"offboard\"]),\n    expectedAuthorizationRevision: z.number().int().positive().safe(),\n    operationId: z.string().uuid(),\n    reason: z.string().max(512).optional(),\n  })\n  .strict();\nexport type UpdateExternalIdentityMembershipRequest = z.infer<\n  typeof UpdateExternalIdentityMembershipRequest\n>;\n\nexport const ExternalActorSelection = z.discriminatedUnion(\"mode\", [\n  z.object({ mode: z.literal(\"external\"), identity: ExternalIdentityReference }).strict(),\n  z\n    .object({\n      mode: z.literal(\"linked_native\"),\n      identity: ExternalIdentityReference,\n      linkId: z.string().uuid(),\n      expectedLinkRevision: z.number().int().positive().safe(),\n    })\n    .strict(),\n]);\nexport type ExternalActorSelection = z.infer<typeof ExternalActorSelection>;\n\nexport const ExternalIdentity = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    source,\n    externalId,\n    subjectId: externalSubject,\n    organizationMembershipId: z.string().uuid(),\n    personalWorkspaceId: z.string().uuid(),\n    status: z.enum([\"active\", \"disabled\", \"revoked\"]),\n    authorizationRevision: z.number().int().positive().safe(),\n  })\n  .strict();\nexport type ExternalIdentity = z.infer<typeof ExternalIdentity>;\n\n// Audit attribution, not authentication. Only the canonical access resolver\n// may establish provenance; accepting this JSON from a browser proves nothing.\nexport const ExternalActorAttribution = z\n  .object({\n    accountId: z.string().uuid(),\n    authenticatingApiKeyId: z.string().uuid(),\n    externalIdentityId: z.string().uuid(),\n    externalSubjectId: externalSubject,\n    externalAuthorizationRevision: z.number().int().positive().safe(),\n    effectiveSubjectId: z.string().min(1).max(1024),\n    actingMode: z.enum([\"external\", \"linked_native\"]),\n    linkId: z.string().uuid().optional(),\n    linkRevision: z.number().int().positive().safe().optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.actingMode === \"external\") {\n      if (\n        value.effectiveSubjectId !== value.externalSubjectId ||\n        value.linkId !== undefined ||\n        value.linkRevision !== undefined\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"External mode cannot delegate native identity\",\n        });\n      }\n    } else if (\n      !value.linkId ||\n      !value.linkRevision ||\n      !nativeSubject.safeParse(value.effectiveSubjectId).success\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Linked mode requires exact native delegation provenance\",\n      });\n    }\n  });\nexport type ExternalActorAttribution = z.infer<typeof ExternalActorAttribution>;\n\n/** Server-signed/encrypted continuation data, never sufficient live authority. */\nexport const ExternalActorContinuation = z\n  .object({\n    identity: ExternalIdentityReference,\n    actor: ExternalActorAttribution,\n  })\n  .strict();\nexport type ExternalActorContinuation = z.infer<typeof ExternalActorContinuation>;\n\nexport const ExternalIdentityLink = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    externalIdentityId: z.string().uuid(),\n    externalIdentity: ExternalIdentityReference.optional(),\n    nativeSubjectId: nativeSubject.nullable(),\n    status: z.enum([\"pending\", \"active\", \"revoked\", \"expired\"]),\n    revision: z.number().int().positive().safe(),\n    permissions: z.array(Permission).max(Permission.options.length),\n    expiresAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict()\n  .refine(\n    (value) => value.status !== \"active\" || value.nativeSubjectId !== null,\n    \"An active link requires a confirmed native identity\",\n  );\nexport type ExternalIdentityLink = z.infer<typeof ExternalIdentityLink>;\n\nexport const ExternalIdentityLinkPage = z\n  .object({\n    links: z.array(ExternalIdentityLink).max(50),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\nexport type ExternalIdentityLinkPage = z.infer<typeof ExternalIdentityLinkPage>;\n\n/** A native confirmation may narrow this request, never broaden it. The\n * challenge is delivered once to the host and is not an authentication token. */\nexport const BeginExternalIdentityLinkRequest = z\n  .object({\n    permissions: z.array(Permission).min(1).max(Permission.options.length),\n    expiresAt: z.string().datetime({ offset: true }).nullable().default(null),\n  })\n  .strict();\nexport type BeginExternalIdentityLinkRequest = z.input<typeof BeginExternalIdentityLinkRequest>;\nexport const ConfirmExternalIdentityLinkRequest = z\n  .object({\n    challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),\n    expectedRevision: z.number().int().positive().safe(),\n    permissions: z.array(Permission).min(1).max(Permission.options.length),\n  })\n  .strict();\nexport type ConfirmExternalIdentityLinkRequest = z.infer<typeof ConfirmExternalIdentityLinkRequest>;\nexport const BeginExternalIdentityLinkResponse = z\n  .object({\n    link: ExternalIdentityLink,\n    challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),\n    confirmBefore: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type BeginExternalIdentityLinkResponse = z.infer<typeof BeginExternalIdentityLinkResponse>;\nexport const ExternalIdentityLinkPreview = z\n  .object({\n    link: ExternalIdentityLink,\n    externalIdentity: ExternalIdentityReference,\n    nativeSubjectId: nativeSubject,\n    organizationId: z.string().uuid(),\n  })\n  .strict();\nexport type ExternalIdentityLinkPreview = z.infer<typeof ExternalIdentityLinkPreview>;\n\n/** Immutable accepted-work restriction, not a browser credential. Original key\n * identity remains audit-only; durable use validates the live link and members. */\nexport const ExternalLinkWorkSnapshot = z\n  .object({\n    identity: ExternalIdentityReference,\n    actor: ExternalActorAttribution.refine((value) => value.actingMode === \"linked_native\"),\n    permissions: z.array(Permission).max(Permission.options.length),\n  })\n  .strict();\nexport type ExternalLinkWorkSnapshot = z.infer<typeof ExternalLinkWorkSnapshot>;\n"],"mappings":";;;;;AAAA,SAAS,SAAS;AAQlB,IAAM,UAAU,IAAI,YAAY;AAChC,SAAS,WAAW,UAAkB;AACpC,SAAO,EACJ,OAAO,EACP,IAAI,CAAC,EACL,IAAI,QAAQ,EACZ;AAAA,IACC,CAAC,UACC,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,QAAQ,OAAO,KAAK,EAAE,cAAc;AAAA,IACtC;AAAA,MACE,SAAS,+DAA+D,QAAQ;AAAA,IAClF;AAAA,EACF;AACJ;AACA,IAAM,aAAa,WAAW,IAAI;AAClC,IAAM,SAAS,WAAW,GAAG;AAC7B,IAAM,kBAAkB,EACrB,OAAO,EACP,MAAM,wFAAwF;AACjG,IAAM,gBAAgB,EACnB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,MAAM,2BAA2B;AAC7B,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN;AAAA,EACA,QAAQ,OAAO,QAAQ,SAAS;AAClC,CAAC,EACA,OAAO;AAGH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,UAAU;AAAA,EACV,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,WAAW,QAAQ,MAAM;AACvE,CAAC,EACA,OAAO;AAKH,IAAM,0CAA0C,EACpD,OAAO;AAAA,EACN,MAAM,EAAE,KAAK,CAAC,WAAW,cAAc,UAAU,CAAC;AAAA,EAClD,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAChE,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EACjE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,GAAG,UAAU,0BAA0B,CAAC,EAAE,OAAO;AAAA,EACtF,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,eAAe;AAAA,IAC/B,UAAU;AAAA,IACV,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACzD,CAAC,EACA,OAAO;AACZ,CAAC;AAGM,IAAM,mBAAmB,EAC7B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,0BAA0B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1C,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAC1D,CAAC,EACA,OAAO;AAKH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,wBAAwB,EAAE,OAAO,EAAE,KAAK;AAAA,EACxC,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,mBAAmB;AAAA,EACnB,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAChE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC9C,YAAY,EAAE,KAAK,CAAC,YAAY,eAAe,CAAC;AAAA,EAChD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,eAAe,YAAY;AACnC,QACE,MAAM,uBAAuB,MAAM,qBACnC,MAAM,WAAW,UACjB,MAAM,iBAAiB,QACvB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,WACE,CAAC,MAAM,UACP,CAAC,MAAM,gBACP,CAAC,cAAc,UAAU,MAAM,kBAAkB,EAAE,SACnD;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAII,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,kBAAkB,0BAA0B,SAAS;AAAA,EACrD,iBAAiB,cAAc,SAAS;AAAA,EACxC,QAAQ,EAAE,KAAK,CAAC,WAAW,UAAU,WAAW,SAAS,CAAC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC3C,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,WAAW,QAAQ,MAAM;AAAA,EAC9D,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO,EACP;AAAA,EACC,CAAC,UAAU,MAAM,WAAW,YAAY,MAAM,oBAAoB;AAAA,EAClE;AACF;AAGK,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,EAAE;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAKH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,WAAW,QAAQ,MAAM;AAAA,EACrE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAC1E,CAAC,EACA,OAAO;AAEH,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACjD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACnD,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,WAAW,QAAQ,MAAM;AACvE,CAAC,EACA,OAAO;AAEH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACjD,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACrD,CAAC,EACA,OAAO;AAEH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAClC,CAAC,EACA,OAAO;AAKH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,OAAO,yBAAyB,OAAO,CAAC,UAAU,MAAM,eAAe,eAAe;AAAA,EACtF,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,WAAW,QAAQ,MAAM;AAChE,CAAC,EACA,OAAO;","names":[]}