@opengeni/contracts 2.15.2 → 3.0.0-canary.0

package/dist/connection-authority.js

@@ -1,350 +1,44 @@
 import {
-  ConnectionKind,
-  ManagedUserResourceGrantMode,
-  SessionTenancyVisibility,
-  UserResourceAuthorityGrant,
-  UserResourceDelegation
-} from "./chunk-QP3BIGSC.js";
+  ConnectionAuthorityEnvelope,
+  ConnectionAuthorityGrant,
+  ConnectionAuthoritySelectionSource,
+  ConnectionAuthoritySummary,
+  ConnectionUseAction,
+  ConnectionUseAttribution,
+  ConnectionUseAuditFact,
+  ConnectionUseAuthoritySnapshot,
+  ConnectionUseAuthorizationResult,
+  ConnectionUseDenialReason,
+  ConnectionUseGrantMutationResponse,
+  ConnectionUseGrantRevocationResponse,
+  ConnectionUseSelectionSource,
+  IssueConnectionUseGrantRequest,
+  ListConnectionAuthoritiesQuery,
+  ListConnectionAuthoritiesResponse,
+  RevokeConnectionUseGrantQuery
+} from "./chunk-SSWEWU3V.js";
+import "./chunk-OO4AEMQB.js";
 import "./chunk-YBW5JSA3.js";
-import "./chunk-6TCVR53X.js";
+import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";
 import "./chunk-MRWYRAS5.js";
 import "./chunk-3SIZGL3O.js";
+import "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-JUFK3T4Q.js";
 import "./chunk-M5ZGRVIQ.js";
 import "./chunk-BCS7WHCK.js";
-import "./chunk-UGTBTPTQ.js";
-import "./chunk-WYBDERIY.js";
-import "./chunk-7ABONTXE.js";
-import "./chunk-NVJMJWLL.js";
-import "./chunk-YRKRZ6OF.js";
-import "./chunk-NPYLOZAP.js";
-import "./chunk-D2HKF2EF.js";
+import "./chunk-5LYFSZ7O.js";
 import "./chunk-Y3KNXVTD.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-RIY7GYQS.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-PX3VCKAU.js";
-
-// src/connection-authority.ts
-import { z } from "zod";
-var ConnectionUseAction = z.literal("connection.use");
-var ConnectionAuthorityEnvelope = z.object({
-  scope: z.enum(["workspace", "user"]).default("workspace"),
-  userDelegation: UserResourceDelegation.optional()
-}).strict().superRefine((value, context) => {
-  if (value.scope === "workspace" && value.userDelegation !== void 0) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation"],
-      message: "workspace connections cannot carry user delegation"
-    });
-    return;
-  }
-  if (value.scope === "user" && value.userDelegation === void 0) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation"],
-      message: "user connections require an immutable delegation"
-    });
-    return;
-  }
-  if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation", "action"],
-      message: "connection delegation must use connection.use"
-    });
-  }
-});
-var ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({
-  action: ConnectionUseAction
-}).strict();
-var ConnectionAuthoritySummary = z.object({
-  authorityId: z.string().uuid(),
-  resourceId: z.string().uuid(),
-  originWorkspaceId: z.string().uuid().nullable(),
-  generation: z.number().int().positive(),
-  status: z.enum(["active", "retained", "revoked"]),
-  grants: z.array(ConnectionAuthorityGrant)
-}).strict();
-var ListConnectionAuthoritiesQuery = z.object({
-  scope: z.literal("user"),
-  cursor: z.string().uuid().optional(),
-  limit: z.coerce.number().int().min(1).max(100).default(50)
-}).strict();
-var ListConnectionAuthoritiesResponse = z.object({
-  scope: z.literal("user"),
-  authorities: z.array(ConnectionAuthoritySummary),
-  nextCursor: z.string().uuid().nullable()
-}).strict();
-var IssueConnectionUseGrantRequest = z.object({
-  scope: z.literal("user"),
-  mode: ManagedUserResourceGrantMode,
-  context: SessionTenancyVisibility,
-  sessionId: z.string().uuid().nullable().optional(),
-  expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),
-  workspaceSharedAcknowledged: z.boolean().default(false)
-}).strict().superRefine((value, context) => {
-  if (value.context === "workspace_shared" && !value.workspaceSharedAcknowledged) {
-    context.addIssue({
-      code: "custom",
-      path: ["workspaceSharedAcknowledged"],
-      message: "workspace_shared requires durable shared-output acknowledgement"
-    });
-  }
-  if (value.mode === "always" && (value.sessionId || value.expectedAuthorityEpoch)) {
-    context.addIssue({ code: "custom", path: ["sessionId"], message: "always is unbound" });
-  }
-  if (value.mode === "session" && (!value.sessionId || !value.expectedAuthorityEpoch)) {
-    context.addIssue({
-      code: "custom",
-      path: ["sessionId"],
-      message: "session requires a target session and expectedAuthorityEpoch"
-    });
-  }
-});
-var RevokeConnectionUseGrantQuery = z.object({ scope: z.literal("user") }).strict();
-var ConnectionUseGrantMutationResponse = z.object({
-  scope: z.literal("user"),
-  grant: ConnectionAuthorityGrant
-}).strict();
-var ConnectionUseGrantRevocationResponse = z.object({
-  scope: z.literal("user"),
-  grant: z.object({
-    grantId: z.string().uuid(),
-    generation: z.number().int().positive(),
-    status: z.literal("revoked"),
-    revokedAt: z.string().datetime()
-  }).strict()
-}).strict();
-var ConnectionAuthoritySelectionSource = z.enum([
-  "explicit_workspace",
-  "legacy_workspace_omission",
-  "legacy_user_compatibility",
-  "user_delegation"
-]);
-var ConnectionUseSelectionSource = z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);
-var AcceptedConnectionWork = z.discriminatedUnion("kind", [
-  z.object({
-    kind: z.literal("turn"),
-    turnId: z.string().uuid()
-  }).strict(),
-  z.object({
-    kind: z.literal("scheduled_task"),
-    taskId: z.string().uuid(),
-    taskAuthorityRevision: z.number().int().positive(),
-    runId: z.string().uuid()
-  }).strict()
-]);
-var ConnectionUseAuthoritySnapshot = z.object({
-  organizationId: z.string().uuid(),
-  originWorkspaceId: z.string().uuid(),
-  targetWorkspaceId: z.string().uuid(),
-  targetSessionId: z.string().uuid(),
-  targetSessionVisibility: SessionTenancyVisibility,
-  targetSessionAuthorityEpoch: z.number().int().positive(),
-  acceptedWork: AcceptedConnectionWork,
-  connectionId: z.string().uuid(),
-  connectionGeneration: z.number().int().positive(),
-  connectionStatus: z.literal("active"),
-  providerDomain: z.string().min(1).max(2048),
-  connectionKind: ConnectionKind,
-  scope: z.enum(["workspace", "user", "legacy_user"]),
-  ownerSubjectId: z.string().min(1).max(512).nullable(),
-  ownerOrganizationMembershipId: z.string().uuid().nullable(),
-  ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
-  authoritySource: ConnectionAuthoritySelectionSource,
-  selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
-  userDelegation: UserResourceDelegation.nullable()
-}).strict().superRefine((value, context) => {
-  const ownedBySubject = value.scope !== "workspace";
-  const delegated = value.scope === "user";
-  if (ownedBySubject !== (value.ownerSubjectId !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerSubjectId"],
-      message: "personal connections retain an owner subject"
-    });
-  }
-  if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerOrganizationMembershipId"],
-      message: "only user connections retain an owner membership"
-    });
-  }
-  if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerMembershipAuthorizationRevision"],
-      message: "only user connections retain an owner membership revision"
-    });
-  }
-  if (delegated !== (value.userDelegation !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation"],
-      message: "only user connections retain a delegation"
-    });
-  }
-  if (delegated && value.authoritySource !== "user_delegation") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "user connections require user_delegation provenance"
-    });
-  }
-  if (!delegated && value.authoritySource === "user_delegation") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "non-delegated connections cannot claim user delegation provenance"
-    });
-  }
-  if (value.scope === "legacy_user" && value.authoritySource !== "legacy_user_compatibility") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "legacy user connections require explicit compatibility provenance"
-    });
-  }
-  if (value.scope === "workspace" && value.authoritySource === "legacy_user_compatibility") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "workspace connections cannot claim legacy user provenance"
-    });
-  }
-  if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
-    context.addIssue({
-      code: "custom",
-      path: ["originWorkspaceId"],
-      message: "workspace connections must be owned by the target workspace"
-    });
-  }
-  const delegation = value.userDelegation;
-  if (!delegation) return;
-  const exactFacts = [
-    [
-      delegation.organizationId === value.organizationId,
-      ["userDelegation", "organizationId"],
-      "delegation organization mismatch"
-    ],
-    [
-      delegation.workspaceId === value.targetWorkspaceId,
-      ["userDelegation", "workspaceId"],
-      "delegation target workspace mismatch"
-    ],
-    [
-      delegation.action === ConnectionUseAction.value,
-      ["userDelegation", "action"],
-      "delegation action mismatch"
-    ],
-    [
-      delegation.context === value.targetSessionVisibility,
-      ["userDelegation", "context"],
-      "delegation visibility mismatch"
-    ]
-  ];
-  for (const [matches, path, message] of exactFacts) {
-    if (!matches) context.addIssue({ code: "custom", path, message });
-  }
-  if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation", "sessionId"],
-      message: "delegation session mismatch"
-    });
-  }
-  if (delegation.authorityEpoch !== null && delegation.authorityEpoch !== value.targetSessionAuthorityEpoch) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation", "authorityEpoch"],
-      message: "delegation authority epoch mismatch"
-    });
-  }
-});
-var ConnectionUseDenialReason = z.enum([
-  "tenant_mismatch",
-  "workspace_access_inactive",
-  "session_inactive",
-  "session_identity_changed",
-  "session_visibility_changed",
-  "session_authority_epoch_changed",
-  "accepted_attempt_authority_required",
-  "accepted_snapshot_digest_changed",
-  "connection_missing",
-  "connection_identity_changed",
-  "connection_generation_changed",
-  "connection_status_inactive",
-  "connection_owner_changed",
-  "owner_membership_inactive",
-  "authority_missing",
-  "authority_identity_changed",
-  "authority_generation_changed",
-  "authority_status_inactive",
-  "grant_missing",
-  "grant_identity_changed",
-  "grant_generation_changed",
-  "grant_status_inactive",
-  "grant_expired",
-  "grant_already_consumed"
-]);
-var ConnectionUseAttributionFields = z.object({
-  organizationId: z.string().uuid(),
-  workspaceId: z.string().uuid(),
-  sessionId: z.string().uuid(),
-  connectionId: z.string().uuid(),
-  connectionGeneration: z.number().int().positive(),
-  scope: z.enum(["workspace", "user", "legacy_user"]),
-  ownerSubjectId: z.string().min(1).max(512).nullable(),
-  authorityId: z.string().uuid().nullable(),
-  grantId: z.string().uuid().nullable()
-}).strict();
-function refineConnectionUseAttribution(value, context) {
-  const personal = value.scope !== "workspace";
-  for (const field of ["ownerSubjectId"]) {
-    if (personal !== (value[field] !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: [field],
-        message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
-      });
-    }
-  }
-  const delegated = value.scope === "user";
-  for (const field of ["authorityId", "grantId"]) {
-    if (delegated !== (value[field] !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: [field],
-        message: delegated ? `delegated personal attribution requires ${field}` : `non-delegated attribution cannot carry ${field}`
-      });
-    }
-  }
-}
-var ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(
-  refineConnectionUseAttribution
-);
-var ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({
-  outcome: z.enum(["authorized", "denied"]),
-  denialReason: ConnectionUseDenialReason.nullable(),
-  occurredAt: z.string().datetime({ offset: true })
-}).superRefine((value, context) => {
-  refineConnectionUseAttribution(value, context);
-  if (value.outcome === "denied" !== (value.denialReason !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["denialReason"],
-      message: "only denied connection use carries a denial reason"
-    });
-  }
-});
-var ConnectionUseAuthorizationResult = z.discriminatedUnion("status", [
-  z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
-  z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
-]);
+import "./chunk-UGTBTPTQ.js";
+import "./chunk-WYBDERIY.js";
+import "./chunk-P3HLDT77.js";
+import "./chunk-7ABONTXE.js";
 export {
   ConnectionAuthorityEnvelope,
   ConnectionAuthorityGrant,

package/dist/connection-authority.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  ConnectionKind,\n  ManagedUserResourceGrantMode,\n  SessionTenancyVisibility,\n  UserResourceAuthorityGrant,\n  UserResourceDelegation,\n} from \"./index\";\n\n/** The only generic grant action that authorizes use of a connection. */\nexport const ConnectionUseAction = z.literal(\"connection.use\");\nexport type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;\n\n/**\n * Connection authority is either workspace-owned or user-owned. Omission is\n * intentionally compatible with the historical workspace connection path.\n */\nexport const ConnectionAuthorityEnvelope = z\n  .object({\n    scope: z.enum([\"workspace\", \"user\"]).default(\"workspace\"),\n    userDelegation: UserResourceDelegation.optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.scope === \"workspace\" && value.userDelegation !== undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"workspace connections cannot carry user delegation\",\n      });\n      return;\n    }\n    if (value.scope === \"user\" && value.userDelegation === undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"user connections require an immutable delegation\",\n      });\n      return;\n    }\n    if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"action\"],\n        message: \"connection delegation must use connection.use\",\n      });\n    }\n  });\nexport type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;\n\nexport const ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({\n  action: ConnectionUseAction,\n}).strict();\nexport type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;\n\n/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */\nexport const ConnectionAuthoritySummary = z\n  .object({\n    authorityId: z.string().uuid(),\n    resourceId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid().nullable(),\n    generation: z.number().int().positive(),\n    status: z.enum([\"active\", \"retained\", \"revoked\"]),\n    grants: z.array(ConnectionAuthorityGrant),\n  })\n  .strict();\nexport type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;\n\nexport const ListConnectionAuthoritiesQuery = z\n  .object({\n    scope: z.literal(\"user\"),\n    cursor: z.string().uuid().optional(),\n    limit: z.coerce.number().int().min(1).max(100).default(50),\n  })\n  .strict();\nexport const ListConnectionAuthoritiesResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    authorities: z.array(ConnectionAuthoritySummary),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\n\nexport const IssueConnectionUseGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\nexport type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;\n\nexport const RevokeConnectionUseGrantQuery = z.object({ scope: z.literal(\"user\") }).strict();\n\nexport const ConnectionUseGrantMutationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: ConnectionAuthorityGrant,\n  })\n  .strict();\nexport type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;\n\nexport const ConnectionUseGrantRevocationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: z\n      .object({\n        grantId: z.string().uuid(),\n        generation: z.number().int().positive(),\n        status: z.literal(\"revoked\"),\n        revokedAt: z.string().datetime(),\n      })\n      .strict(),\n  })\n  .strict();\nexport type ConnectionUseGrantRevocationResponse = z.infer<\n  typeof ConnectionUseGrantRevocationResponse\n>;\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\n  \"explicit_workspace\",\n  \"legacy_workspace_omission\",\n  \"legacy_user_compatibility\",\n  \"user_delegation\",\n]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n  z\n    .object({\n      kind: z.literal(\"turn\"),\n      turnId: z.string().uuid(),\n    })\n    .strict(),\n  z\n    .object({\n      kind: z.literal(\"scheduled_task\"),\n      taskId: z.string().uuid(),\n      taskAuthorityRevision: z.number().int().positive(),\n      runId: z.string().uuid(),\n    })\n    .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n  .object({\n    organizationId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid(),\n    targetWorkspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive(),\n    acceptedWork: AcceptedConnectionWork,\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    connectionStatus: z.literal(\"active\"),\n    providerDomain: z.string().min(1).max(2048),\n    connectionKind: ConnectionKind,\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    ownerOrganizationMembershipId: z.string().uuid().nullable(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n    authoritySource: ConnectionAuthoritySelectionSource,\n    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n    userDelegation: UserResourceDelegation.nullable(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    const ownedBySubject = value.scope !== \"workspace\";\n    const delegated = value.scope === \"user\";\n    if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerSubjectId\"],\n        message: \"personal connections retain an owner subject\",\n      });\n    }\n    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerOrganizationMembershipId\"],\n        message: \"only user connections retain an owner membership\",\n      });\n    }\n    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerMembershipAuthorizationRevision\"],\n        message: \"only user connections retain an owner membership revision\",\n      });\n    }\n    if (delegated !== (value.userDelegation !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"only user connections retain a delegation\",\n      });\n    }\n    if (delegated && value.authoritySource !== \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"user connections require user_delegation provenance\",\n      });\n    }\n    if (!delegated && value.authoritySource === \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"non-delegated connections cannot claim user delegation provenance\",\n      });\n    }\n    if (value.scope === \"legacy_user\" && value.authoritySource !== \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"legacy user connections require explicit compatibility provenance\",\n      });\n    }\n    if (value.scope === \"workspace\" && value.authoritySource === \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"workspace connections cannot claim legacy user provenance\",\n      });\n    }\n    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"originWorkspaceId\"],\n        message: \"workspace connections must be owned by the target workspace\",\n      });\n    }\n    const delegation = value.userDelegation;\n    if (!delegation) return;\n    const exactFacts: Array<[boolean, (string | number)[], string]> = [\n      [\n        delegation.organizationId === value.organizationId,\n        [\"userDelegation\", \"organizationId\"],\n        \"delegation organization mismatch\",\n      ],\n      [\n        delegation.workspaceId === value.targetWorkspaceId,\n        [\"userDelegation\", \"workspaceId\"],\n        \"delegation target workspace mismatch\",\n      ],\n      [\n        delegation.action === ConnectionUseAction.value,\n        [\"userDelegation\", \"action\"],\n        \"delegation action mismatch\",\n      ],\n      [\n        delegation.context === value.targetSessionVisibility,\n        [\"userDelegation\", \"context\"],\n        \"delegation visibility mismatch\",\n      ],\n    ];\n    for (const [matches, path, message] of exactFacts) {\n      if (!matches) context.addIssue({ code: \"custom\", path, message });\n    }\n    if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"sessionId\"],\n        message: \"delegation session mismatch\",\n      });\n    }\n    if (\n      delegation.authorityEpoch !== null &&\n      delegation.authorityEpoch !== value.targetSessionAuthorityEpoch\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"authorityEpoch\"],\n        message: \"delegation authority epoch mismatch\",\n      });\n    }\n  });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n  \"tenant_mismatch\",\n  \"workspace_access_inactive\",\n  \"session_inactive\",\n  \"session_identity_changed\",\n  \"session_visibility_changed\",\n  \"session_authority_epoch_changed\",\n  \"accepted_attempt_authority_required\",\n  \"accepted_snapshot_digest_changed\",\n  \"connection_missing\",\n  \"connection_identity_changed\",\n  \"connection_generation_changed\",\n  \"connection_status_inactive\",\n  \"connection_owner_changed\",\n  \"owner_membership_inactive\",\n  \"authority_missing\",\n  \"authority_identity_changed\",\n  \"authority_generation_changed\",\n  \"authority_status_inactive\",\n  \"grant_missing\",\n  \"grant_identity_changed\",\n  \"grant_generation_changed\",\n  \"grant_status_inactive\",\n  \"grant_expired\",\n  \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n  .object({\n    organizationId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    sessionId: z.string().uuid(),\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    authorityId: z.string().uuid().nullable(),\n    grantId: z.string().uuid().nullable(),\n  })\n  .strict();\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const delegated = value.scope === \"user\";\n  for (const field of [\"authorityId\", \"grantId\"] as const) {\n    if (delegated !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: delegated\n          ? `delegated personal attribution requires ${field}`\n          : `non-delegated attribution cannot carry ${field}`,\n      });\n    }\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(\n  refineConnectionUseAttribution,\n);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n  outcome: z.enum([\"authorized\", \"denied\"]),\n  denialReason: ConnectionUseDenialReason.nullable(),\n  occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n  refineConnectionUseAttribution(value, context);\n  if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"denialReason\"],\n      message: \"only denied connection use carries a denial reason\",\n    });\n  }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n  z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,QAAQ,gBAAgB;AAOtD,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC,EAAE,QAAQ,WAAW;AAAA,EACxD,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,UAAU,eAAe,MAAM,mBAAmB,QAAW;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,UAAU,UAAU,MAAM,mBAAmB,QAAW;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB,MAAM,eAAe,WAAW,oBAAoB,OAAO;AACrF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,QAAQ;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,2BAA2B,2BAA2B,OAAO;AAAA,EACxE,QAAQ;AACV,CAAC,EAAE,OAAO;AAIH,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,wBAAwB;AAC1C,CAAC,EACA,OAAO;AAGH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC,EACA,OAAO;AACH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,aAAa,EAAE,MAAM,0BAA0B;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAEH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAEpF,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,mBAAmB,OAAO;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,mBAAmB;AAC5D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,mBAAmB;AAC7D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,iBAAiB,MAAM,oBAAoB,6BAA6B;AAC1F,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,eAAe,MAAM,oBAAoB,6BAA6B;AACxF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAM;AACzB,MAAI,CAAC,WAAY;AACjB,QAAM,aAA4D;AAAA,IAChE;AAAA,MACE,WAAW,mBAAmB,MAAM;AAAA,MACpC,CAAC,kBAAkB,gBAAgB;AAAA,MACnC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,gBAAgB,MAAM;AAAA,MACjC,CAAC,kBAAkB,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,WAAW,oBAAoB;AAAA,MAC1C,CAAC,kBAAkB,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,YAAY,MAAM;AAAA,MAC7B,CAAC,kBAAkB,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,SAAS,MAAM,OAAO,KAAK,YAAY;AACjD,QAAI,CAAC,QAAS,SAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,cAAc,QAAQ,WAAW,cAAc,MAAM,iBAAiB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,WAAW;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,WAAW,mBAAmB,QAC9B,WAAW,mBAAmB,MAAM,6BACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,gBAAgB;AAAA,MACzC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,MAAM,UAAU;AAClC,aAAW,SAAS,CAAC,eAAe,SAAS,GAAY;AACvD,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,YACL,2CAA2C,KAAK,KAChD,0CAA0C,KAAK;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,IAAM,2BAA2B,+BAA+B;AAAA,EACrE;AACF;AAGO,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/editable-artifact-codec-registry.js

@@ -2,9 +2,9 @@ import {
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
   currentEditableArtifactCompatibility,
   editableArtifactCodecFor
-} from "./chunk-NPYLOZAP.js";
-import "./chunk-D2HKF2EF.js";
+} from "./chunk-5LYFSZ7O.js";
 import "./chunk-Y3KNXVTD.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-RIY7GYQS.js";
 import "./chunk-MYBZRDTY.js";

package/dist/editable-artifact-live.js

@@ -3,9 +3,9 @@ import {
   hashEditableArtifactMutationIntentBytes
 } from "./chunk-NVJMJWLL.js";
 import "./chunk-YRKRZ6OF.js";
-import "./chunk-NPYLOZAP.js";
-import "./chunk-D2HKF2EF.js";
+import "./chunk-5LYFSZ7O.js";
 import "./chunk-Y3KNXVTD.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-RIY7GYQS.js";
 import "./chunk-MYBZRDTY.js";

package/dist/editable-artifact-serialized-commit.js

@@ -4,12 +4,12 @@ import {
   assertCanonicalEditableArtifactSerializedCommit,
   decodeEditableArtifactSerializedCommit,
   encodeEditableArtifactSerializedCommit
-} from "./chunk-6TCVR53X.js";
+} from "./chunk-O5LEQHDM.js";
 import "./chunk-NVJMJWLL.js";
 import "./chunk-YRKRZ6OF.js";
-import "./chunk-NPYLOZAP.js";
-import "./chunk-D2HKF2EF.js";
+import "./chunk-5LYFSZ7O.js";
 import "./chunk-Y3KNXVTD.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-RIY7GYQS.js";
 import "./chunk-MYBZRDTY.js";

package/dist/editable-artifacts.js

@@ -25,7 +25,30 @@ import {
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
   currentEditableArtifactCompatibility,
   editableArtifactCodecFor
-} from "./chunk-NPYLOZAP.js";
+} from "./chunk-5LYFSZ7O.js";
+import {
+  SPREADSHEET_ARTIFACT_METADATA_MAX_SHEETS,
+  SPREADSHEET_ARTIFACT_METADATA_MIN_RESPONSE_BYTES,
+  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_PROJECTION_MAX_STRING_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_VERSION,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_AREA,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MIN_RESPONSE_BYTES,
+  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
+  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
+  decodeSpreadsheetArtifactKernelProjection,
+  decodeSpreadsheetArtifactKernelQuery,
+  decodeSpreadsheetMetadataKernelProjection,
+  decodeSpreadsheetViewportKernelProjection,
+  encodeSpreadsheetArtifactKernelProjection,
+  encodeSpreadsheetArtifactKernelQuery,
+  encodeSpreadsheetMetadataKernelProjection,
+  encodeSpreadsheetMetadataKernelQuery,
+  encodeSpreadsheetViewportKernelProjection,
+  encodeSpreadsheetViewportKernelQuery
+} from "./chunk-Y3KNXVTD.js";
 import {
   PRESENTATION_ARTIFACT_COMMAND_MAX_BYTES,
   PRESENTATION_ARTIFACT_COMMAND_MAX_COMMANDS,
@@ -58,29 +81,6 @@ import {
   encodePresentationArtifactQuery,
   encodePresentationArtifactQueryResponse
 } from "./chunk-D2HKF2EF.js";
-import {
-  SPREADSHEET_ARTIFACT_METADATA_MAX_SHEETS,
-  SPREADSHEET_ARTIFACT_METADATA_MIN_RESPONSE_BYTES,
-  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_PROJECTION_MAX_STRING_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_VERSION,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_AREA,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MIN_RESPONSE_BYTES,
-  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
-  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
-  decodeSpreadsheetArtifactKernelProjection,
-  decodeSpreadsheetArtifactKernelQuery,
-  decodeSpreadsheetMetadataKernelProjection,
-  decodeSpreadsheetViewportKernelProjection,
-  encodeSpreadsheetArtifactKernelProjection,
-  encodeSpreadsheetArtifactKernelQuery,
-  encodeSpreadsheetMetadataKernelProjection,
-  encodeSpreadsheetMetadataKernelQuery,
-  encodeSpreadsheetViewportKernelProjection,
-  encodeSpreadsheetViewportKernelQuery
-} from "./chunk-Y3KNXVTD.js";
 import {
   SPREADSHEET_ARTIFACT_COMMAND_MAX_BYTES,
   SPREADSHEET_ARTIFACT_COMMAND_MAX_CELLS,