@opengeni/contracts 2.5.0-canary.2 → 2.6.0-canary.0

package/dist/connection-authority.js

@@ -4,24 +4,25 @@ import {
   SessionTenancyVisibility,
   UserResourceAuthorityGrant,
   UserResourceDelegation
-} from "./chunk-4I7DWNRR.js";
+} from "./chunk-MJ3K6ICH.js";
+import "./chunk-WYBDERIY.js";
 import "./chunk-MRWYRAS5.js";
+import "./chunk-CM6BMECR.js";
 import "./chunk-JUFK3T4Q.js";
-import "./chunk-WYBDERIY.js";
+import "./chunk-YBW5JSA3.js";
 import "./chunk-N6GRVXAJ.js";
 import "./chunk-3SIZGL3O.js";
 import "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-7RMTKFJW.js";
 import "./chunk-Y3KNXVTD.js";
 import "./chunk-RIY7GYQS.js";
-import "./chunk-YRKRZ6OF.js";
-import "./chunk-CM6BMECR.js";
 import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-PX3VCKAU.js";
+import "./chunk-BCS7WHCK.js";
 import "./chunk-M5ZGRVIQ.js";
-import "./chunk-YBW5JSA3.js";
 
 // src/connection-authority.ts
 import { z } from "zod";

package/dist/connection-authority.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  ConnectionKind,\n  ManagedUserResourceGrantMode,\n  SessionTenancyVisibility,\n  UserResourceAuthorityGrant,\n  UserResourceDelegation,\n} from \"./index\";\n\n/** The only generic grant action that authorizes use of a connection. */\nexport const ConnectionUseAction = z.literal(\"connection.use\");\nexport type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;\n\n/**\n * Connection authority is either workspace-owned or user-owned. Omission is\n * intentionally compatible with the historical workspace connection path.\n */\nexport const ConnectionAuthorityEnvelope = z\n  .object({\n    scope: z.enum([\"workspace\", \"user\"]).default(\"workspace\"),\n    userDelegation: UserResourceDelegation.optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.scope === \"workspace\" && value.userDelegation !== undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"workspace connections cannot carry user delegation\",\n      });\n      return;\n    }\n    if (value.scope === \"user\" && value.userDelegation === undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"user connections require an immutable delegation\",\n      });\n      return;\n    }\n    if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"action\"],\n        message: \"connection delegation must use connection.use\",\n      });\n    }\n  });\nexport type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;\n\nexport const ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({\n  action: ConnectionUseAction,\n}).strict();\nexport type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;\n\n/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */\nexport const ConnectionAuthoritySummary = z\n  .object({\n    authorityId: z.string().uuid(),\n    resourceId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid().nullable(),\n    generation: z.number().int().positive(),\n    status: z.enum([\"active\", \"retained\", \"revoked\"]),\n    grants: z.array(ConnectionAuthorityGrant),\n  })\n  .strict();\nexport type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;\n\nexport const ListConnectionAuthoritiesQuery = z\n  .object({\n    scope: z.literal(\"user\"),\n    cursor: z.string().uuid().optional(),\n    limit: z.coerce.number().int().min(1).max(100).default(50),\n  })\n  .strict();\nexport const ListConnectionAuthoritiesResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    authorities: z.array(ConnectionAuthoritySummary),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\n\nexport const IssueConnectionUseGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\nexport type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;\n\nexport const RevokeConnectionUseGrantQuery = z.object({ scope: z.literal(\"user\") }).strict();\n\nexport const ConnectionUseGrantMutationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: ConnectionAuthorityGrant,\n  })\n  .strict();\nexport type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;\n\nexport const ConnectionUseGrantRevocationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: z\n      .object({\n        grantId: z.string().uuid(),\n        generation: z.number().int().positive(),\n        status: z.literal(\"revoked\"),\n        revokedAt: z.string().datetime(),\n      })\n      .strict(),\n  })\n  .strict();\nexport type ConnectionUseGrantRevocationResponse = z.infer<\n  typeof ConnectionUseGrantRevocationResponse\n>;\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\n  \"explicit_workspace\",\n  \"legacy_workspace_omission\",\n  \"legacy_user_compatibility\",\n  \"user_delegation\",\n]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n  z\n    .object({\n      kind: z.literal(\"turn\"),\n      turnId: z.string().uuid(),\n    })\n    .strict(),\n  z\n    .object({\n      kind: z.literal(\"scheduled_task\"),\n      taskId: z.string().uuid(),\n      taskAuthorityRevision: z.number().int().positive(),\n      runId: z.string().uuid(),\n    })\n    .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n  .object({\n    organizationId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid(),\n    targetWorkspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive(),\n    acceptedWork: AcceptedConnectionWork,\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    connectionStatus: z.literal(\"active\"),\n    providerDomain: z.string().min(1).max(2048),\n    connectionKind: ConnectionKind,\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    ownerOrganizationMembershipId: z.string().uuid().nullable(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n    authoritySource: ConnectionAuthoritySelectionSource,\n    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n    userDelegation: UserResourceDelegation.nullable(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    const ownedBySubject = value.scope !== \"workspace\";\n    const delegated = value.scope === \"user\";\n    if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerSubjectId\"],\n        message: \"personal connections retain an owner subject\",\n      });\n    }\n    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerOrganizationMembershipId\"],\n        message: \"only user connections retain an owner membership\",\n      });\n    }\n    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerMembershipAuthorizationRevision\"],\n        message: \"only user connections retain an owner membership revision\",\n      });\n    }\n    if (delegated !== (value.userDelegation !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"only user connections retain a delegation\",\n      });\n    }\n    if (delegated && value.authoritySource !== \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"user connections require user_delegation provenance\",\n      });\n    }\n    if (!delegated && value.authoritySource === \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"non-delegated connections cannot claim user delegation provenance\",\n      });\n    }\n    if (value.scope === \"legacy_user\" && value.authoritySource !== \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"legacy user connections require explicit compatibility provenance\",\n      });\n    }\n    if (value.scope === \"workspace\" && value.authoritySource === \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"workspace connections cannot claim legacy user provenance\",\n      });\n    }\n    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"originWorkspaceId\"],\n        message: \"workspace connections must be owned by the target workspace\",\n      });\n    }\n    const delegation = value.userDelegation;\n    if (!delegation) return;\n    const exactFacts: Array<[boolean, (string | number)[], string]> = [\n      [\n        delegation.organizationId === value.organizationId,\n        [\"userDelegation\", \"organizationId\"],\n        \"delegation organization mismatch\",\n      ],\n      [\n        delegation.workspaceId === value.targetWorkspaceId,\n        [\"userDelegation\", \"workspaceId\"],\n        \"delegation target workspace mismatch\",\n      ],\n      [\n        delegation.action === ConnectionUseAction.value,\n        [\"userDelegation\", \"action\"],\n        \"delegation action mismatch\",\n      ],\n      [\n        delegation.context === value.targetSessionVisibility,\n        [\"userDelegation\", \"context\"],\n        \"delegation visibility mismatch\",\n      ],\n    ];\n    for (const [matches, path, message] of exactFacts) {\n      if (!matches) context.addIssue({ code: \"custom\", path, message });\n    }\n    if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"sessionId\"],\n        message: \"delegation session mismatch\",\n      });\n    }\n    if (\n      delegation.authorityEpoch !== null &&\n      delegation.authorityEpoch !== value.targetSessionAuthorityEpoch\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"authorityEpoch\"],\n        message: \"delegation authority epoch mismatch\",\n      });\n    }\n  });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n  \"tenant_mismatch\",\n  \"workspace_access_inactive\",\n  \"session_inactive\",\n  \"session_identity_changed\",\n  \"session_visibility_changed\",\n  \"session_authority_epoch_changed\",\n  \"accepted_attempt_authority_required\",\n  \"accepted_snapshot_digest_changed\",\n  \"connection_missing\",\n  \"connection_identity_changed\",\n  \"connection_generation_changed\",\n  \"connection_status_inactive\",\n  \"connection_owner_changed\",\n  \"owner_membership_inactive\",\n  \"authority_missing\",\n  \"authority_identity_changed\",\n  \"authority_generation_changed\",\n  \"authority_status_inactive\",\n  \"grant_missing\",\n  \"grant_identity_changed\",\n  \"grant_generation_changed\",\n  \"grant_status_inactive\",\n  \"grant_expired\",\n  \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n  .object({\n    organizationId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    sessionId: z.string().uuid(),\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    authorityId: z.string().uuid().nullable(),\n    grantId: z.string().uuid().nullable(),\n  })\n  .strict();\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const delegated = value.scope === \"user\";\n  for (const field of [\"authorityId\", \"grantId\"] as const) {\n    if (delegated !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: delegated\n          ? `delegated personal attribution requires ${field}`\n          : `non-delegated attribution cannot carry ${field}`,\n      });\n    }\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(\n  refineConnectionUseAttribution,\n);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n  outcome: z.enum([\"authorized\", \"denied\"]),\n  denialReason: ConnectionUseDenialReason.nullable(),\n  occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n  refineConnectionUseAttribution(value, context);\n  if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"denialReason\"],\n      message: \"only denied connection use carries a denial reason\",\n    });\n  }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n  z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,QAAQ,gBAAgB;AAOtD,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC,EAAE,QAAQ,WAAW;AAAA,EACxD,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,UAAU,eAAe,MAAM,mBAAmB,QAAW;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,UAAU,UAAU,MAAM,mBAAmB,QAAW;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB,MAAM,eAAe,WAAW,oBAAoB,OAAO;AACrF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,QAAQ;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,2BAA2B,2BAA2B,OAAO;AAAA,EACxE,QAAQ;AACV,CAAC,EAAE,OAAO;AAIH,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,wBAAwB;AAC1C,CAAC,EACA,OAAO;AAGH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC,EACA,OAAO;AACH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,aAAa,EAAE,MAAM,0BAA0B;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAEH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAEpF,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,mBAAmB,OAAO;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,mBAAmB;AAC5D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,mBAAmB;AAC7D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,iBAAiB,MAAM,oBAAoB,6BAA6B;AAC1F,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,eAAe,MAAM,oBAAoB,6BAA6B;AACxF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAM;AACzB,MAAI,CAAC,WAAY;AACjB,QAAM,aAA4D;AAAA,IAChE;AAAA,MACE,WAAW,mBAAmB,MAAM;AAAA,MACpC,CAAC,kBAAkB,gBAAgB;AAAA,MACnC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,gBAAgB,MAAM;AAAA,MACjC,CAAC,kBAAkB,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,WAAW,oBAAoB;AAAA,MAC1C,CAAC,kBAAkB,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,YAAY,MAAM;AAAA,MAC7B,CAAC,kBAAkB,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,SAAS,MAAM,OAAO,KAAK,YAAY;AACjD,QAAI,CAAC,QAAS,SAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,cAAc,QAAQ,WAAW,cAAc,MAAM,iBAAiB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,WAAW;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,WAAW,mBAAmB,QAC9B,WAAW,mBAAmB,MAAM,6BACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,gBAAgB;AAAA,MACzC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,MAAM,UAAU;AAClC,aAAW,SAAS,CAAC,eAAe,SAAS,GAAY;AACvD,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,YACL,2CAA2C,KAAK,KAChD,0CAA0C,KAAK;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,IAAM,2BAA2B,+BAA+B;AAAA,EACrE;AACF;AAGO,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}
+{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  ConnectionKind,\n  ManagedUserResourceGrantMode,\n  SessionTenancyVisibility,\n  UserResourceAuthorityGrant,\n  UserResourceDelegation,\n} from \"./index\";\n\n/** The only generic grant action that authorizes use of a connection. */\nexport const ConnectionUseAction = z.literal(\"connection.use\");\nexport type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;\n\n/**\n * Connection authority is either workspace-owned or user-owned. Omission is\n * intentionally compatible with the historical workspace connection path.\n */\nexport const ConnectionAuthorityEnvelope = z\n  .object({\n    scope: z.enum([\"workspace\", \"user\"]).default(\"workspace\"),\n    userDelegation: UserResourceDelegation.optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.scope === \"workspace\" && value.userDelegation !== undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"workspace connections cannot carry user delegation\",\n      });\n      return;\n    }\n    if (value.scope === \"user\" && value.userDelegation === undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"user connections require an immutable delegation\",\n      });\n      return;\n    }\n    if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"action\"],\n        message: \"connection delegation must use connection.use\",\n      });\n    }\n  });\nexport type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;\n\nexport const ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({\n  action: ConnectionUseAction,\n}).strict();\nexport type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;\n\n/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */\nexport const ConnectionAuthoritySummary = z\n  .object({\n    authorityId: z.string().uuid(),\n    resourceId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid().nullable(),\n    generation: z.number().int().positive(),\n    status: z.enum([\"active\", \"retained\", \"revoked\"]),\n    grants: z.array(ConnectionAuthorityGrant),\n  })\n  .strict();\nexport type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;\n\nexport const ListConnectionAuthoritiesQuery = z\n  .object({\n    scope: z.literal(\"user\"),\n    cursor: z.string().uuid().optional(),\n    limit: z.coerce.number().int().min(1).max(100).default(50),\n  })\n  .strict();\nexport const ListConnectionAuthoritiesResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    authorities: z.array(ConnectionAuthoritySummary),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\n\nexport const IssueConnectionUseGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\nexport type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;\n\nexport const RevokeConnectionUseGrantQuery = z.object({ scope: z.literal(\"user\") }).strict();\n\nexport const ConnectionUseGrantMutationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: ConnectionAuthorityGrant,\n  })\n  .strict();\nexport type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;\n\nexport const ConnectionUseGrantRevocationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: z\n      .object({\n        grantId: z.string().uuid(),\n        generation: z.number().int().positive(),\n        status: z.literal(\"revoked\"),\n        revokedAt: z.string().datetime(),\n      })\n      .strict(),\n  })\n  .strict();\nexport type ConnectionUseGrantRevocationResponse = z.infer<\n  typeof ConnectionUseGrantRevocationResponse\n>;\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\n  \"explicit_workspace\",\n  \"legacy_workspace_omission\",\n  \"legacy_user_compatibility\",\n  \"user_delegation\",\n]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n  z\n    .object({\n      kind: z.literal(\"turn\"),\n      turnId: z.string().uuid(),\n    })\n    .strict(),\n  z\n    .object({\n      kind: z.literal(\"scheduled_task\"),\n      taskId: z.string().uuid(),\n      taskAuthorityRevision: z.number().int().positive(),\n      runId: z.string().uuid(),\n    })\n    .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n  .object({\n    organizationId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid(),\n    targetWorkspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive(),\n    acceptedWork: AcceptedConnectionWork,\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    connectionStatus: z.literal(\"active\"),\n    providerDomain: z.string().min(1).max(2048),\n    connectionKind: ConnectionKind,\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    ownerOrganizationMembershipId: z.string().uuid().nullable(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n    authoritySource: ConnectionAuthoritySelectionSource,\n    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n    userDelegation: UserResourceDelegation.nullable(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    const ownedBySubject = value.scope !== \"workspace\";\n    const delegated = value.scope === \"user\";\n    if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerSubjectId\"],\n        message: \"personal connections retain an owner subject\",\n      });\n    }\n    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerOrganizationMembershipId\"],\n        message: \"only user connections retain an owner membership\",\n      });\n    }\n    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerMembershipAuthorizationRevision\"],\n        message: \"only user connections retain an owner membership revision\",\n      });\n    }\n    if (delegated !== (value.userDelegation !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"only user connections retain a delegation\",\n      });\n    }\n    if (delegated && value.authoritySource !== \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"user connections require user_delegation provenance\",\n      });\n    }\n    if (!delegated && value.authoritySource === \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"non-delegated connections cannot claim user delegation provenance\",\n      });\n    }\n    if (value.scope === \"legacy_user\" && value.authoritySource !== \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"legacy user connections require explicit compatibility provenance\",\n      });\n    }\n    if (value.scope === \"workspace\" && value.authoritySource === \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"workspace connections cannot claim legacy user provenance\",\n      });\n    }\n    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"originWorkspaceId\"],\n        message: \"workspace connections must be owned by the target workspace\",\n      });\n    }\n    const delegation = value.userDelegation;\n    if (!delegation) return;\n    const exactFacts: Array<[boolean, (string | number)[], string]> = [\n      [\n        delegation.organizationId === value.organizationId,\n        [\"userDelegation\", \"organizationId\"],\n        \"delegation organization mismatch\",\n      ],\n      [\n        delegation.workspaceId === value.targetWorkspaceId,\n        [\"userDelegation\", \"workspaceId\"],\n        \"delegation target workspace mismatch\",\n      ],\n      [\n        delegation.action === ConnectionUseAction.value,\n        [\"userDelegation\", \"action\"],\n        \"delegation action mismatch\",\n      ],\n      [\n        delegation.context === value.targetSessionVisibility,\n        [\"userDelegation\", \"context\"],\n        \"delegation visibility mismatch\",\n      ],\n    ];\n    for (const [matches, path, message] of exactFacts) {\n      if (!matches) context.addIssue({ code: \"custom\", path, message });\n    }\n    if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"sessionId\"],\n        message: \"delegation session mismatch\",\n      });\n    }\n    if (\n      delegation.authorityEpoch !== null &&\n      delegation.authorityEpoch !== value.targetSessionAuthorityEpoch\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"authorityEpoch\"],\n        message: \"delegation authority epoch mismatch\",\n      });\n    }\n  });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n  \"tenant_mismatch\",\n  \"workspace_access_inactive\",\n  \"session_inactive\",\n  \"session_identity_changed\",\n  \"session_visibility_changed\",\n  \"session_authority_epoch_changed\",\n  \"accepted_attempt_authority_required\",\n  \"accepted_snapshot_digest_changed\",\n  \"connection_missing\",\n  \"connection_identity_changed\",\n  \"connection_generation_changed\",\n  \"connection_status_inactive\",\n  \"connection_owner_changed\",\n  \"owner_membership_inactive\",\n  \"authority_missing\",\n  \"authority_identity_changed\",\n  \"authority_generation_changed\",\n  \"authority_status_inactive\",\n  \"grant_missing\",\n  \"grant_identity_changed\",\n  \"grant_generation_changed\",\n  \"grant_status_inactive\",\n  \"grant_expired\",\n  \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n  .object({\n    organizationId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    sessionId: z.string().uuid(),\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    authorityId: z.string().uuid().nullable(),\n    grantId: z.string().uuid().nullable(),\n  })\n  .strict();\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const delegated = value.scope === \"user\";\n  for (const field of [\"authorityId\", \"grantId\"] as const) {\n    if (delegated !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: delegated\n          ? `delegated personal attribution requires ${field}`\n          : `non-delegated attribution cannot carry ${field}`,\n      });\n    }\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(\n  refineConnectionUseAttribution,\n);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n  outcome: z.enum([\"authorized\", \"denied\"]),\n  denialReason: ConnectionUseDenialReason.nullable(),\n  occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n  refineConnectionUseAttribution(value, context);\n  if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"denialReason\"],\n      message: \"only denied connection use carries a denial reason\",\n    });\n  }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n  z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,QAAQ,gBAAgB;AAOtD,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC,EAAE,QAAQ,WAAW;AAAA,EACxD,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,UAAU,eAAe,MAAM,mBAAmB,QAAW;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,UAAU,UAAU,MAAM,mBAAmB,QAAW;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB,MAAM,eAAe,WAAW,oBAAoB,OAAO;AACrF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,QAAQ;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,2BAA2B,2BAA2B,OAAO;AAAA,EACxE,QAAQ;AACV,CAAC,EAAE,OAAO;AAIH,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,wBAAwB;AAC1C,CAAC,EACA,OAAO;AAGH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC,EACA,OAAO;AACH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,aAAa,EAAE,MAAM,0BAA0B;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAEH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAEpF,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,mBAAmB,OAAO;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,mBAAmB;AAC5D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,mBAAmB;AAC7D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,iBAAiB,MAAM,oBAAoB,6BAA6B;AAC1F,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,eAAe,MAAM,oBAAoB,6BAA6B;AACxF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAM;AACzB,MAAI,CAAC,WAAY;AACjB,QAAM,aAA4D;AAAA,IAChE;AAAA,MACE,WAAW,mBAAmB,MAAM;AAAA,MACpC,CAAC,kBAAkB,gBAAgB;AAAA,MACnC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,gBAAgB,MAAM;AAAA,MACjC,CAAC,kBAAkB,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,WAAW,oBAAoB;AAAA,MAC1C,CAAC,kBAAkB,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,YAAY,MAAM;AAAA,MAC7B,CAAC,kBAAkB,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,SAAS,MAAM,OAAO,KAAK,YAAY;AACjD,QAAI,CAAC,QAAS,SAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,cAAc,QAAQ,WAAW,cAAc,MAAM,iBAAiB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,WAAW;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,WAAW,mBAAmB,QAC9B,WAAW,mBAAmB,MAAM,6BACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,gBAAgB;AAAA,MACzC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,MAAM,UAAU;AAClC,aAAW,SAAS,CAAC,eAAe,SAAS,GAAY;AACvD,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,YACL,2CAA2C,KAAK,KAChD,0CAA0C,KAAK;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,IAAM,2BAA2B,+BAA+B;AAAA,EACrE;AACF;AAGO,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}

package/dist/editable-artifact-live.js

@@ -2,10 +2,10 @@ import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   hashEditableArtifactMutationIntentBytes
 } from "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-7RMTKFJW.js";
 import "./chunk-Y3KNXVTD.js";
 import "./chunk-RIY7GYQS.js";
-import "./chunk-YRKRZ6OF.js";
 import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-TXTQIYCV.js";

package/dist/editable-artifact-serialized-commit.js

@@ -6,10 +6,10 @@ import {
   encodeEditableArtifactSerializedCommit
 } from "./chunk-N6GRVXAJ.js";
 import "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-7RMTKFJW.js";
 import "./chunk-Y3KNXVTD.js";
 import "./chunk-RIY7GYQS.js";
-import "./chunk-YRKRZ6OF.js";
 import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-TXTQIYCV.js";

package/dist/editable-artifacts.js

@@ -13,6 +13,14 @@ import {
   hashEditableArtifactMutationIntent,
   hashEditableArtifactMutationIntentBytes
 } from "./chunk-NVJMJWLL.js";
+import {
+  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_BYTES,
+  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_REPLICAS,
+  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_VERSION,
+  assertCanonicalEditableArtifactCausalFrontierBytes,
+  decodeEditableArtifactCausalFrontier,
+  encodeEditableArtifactCausalFrontier
+} from "./chunk-YRKRZ6OF.js";
 import {
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
   currentEditableArtifactCompatibility,
@@ -67,14 +75,6 @@ import {
   encodeDocumentArtifactQuery,
   encodeDocumentArtifactQueryResponse
 } from "./chunk-RIY7GYQS.js";
-import {
-  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_BYTES,
-  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_REPLICAS,
-  EDITABLE_ARTIFACT_CAUSAL_FRONTIER_VERSION,
-  assertCanonicalEditableArtifactCausalFrontierBytes,
-  decodeEditableArtifactCausalFrontier,
-  encodeEditableArtifactCausalFrontier
-} from "./chunk-YRKRZ6OF.js";
 import {
   PRESENTATION_ARTIFACT_COMMAND_MAX_BYTES,
   PRESENTATION_ARTIFACT_COMMAND_MAX_COMMANDS,

package/dist/google-drive.js

@@ -1,26 +1,27 @@
 import {
   ConnectionMetadata
-} from "./chunk-4I7DWNRR.js";
-import "./chunk-MRWYRAS5.js";
-import "./chunk-JUFK3T4Q.js";
+} from "./chunk-MJ3K6ICH.js";
 import {
   ConnectorDocumentDestination,
   ConnectorDocumentDestinationSelection
 } from "./chunk-WYBDERIY.js";
+import "./chunk-MRWYRAS5.js";
+import "./chunk-CM6BMECR.js";
+import "./chunk-JUFK3T4Q.js";
+import "./chunk-YBW5JSA3.js";
 import "./chunk-N6GRVXAJ.js";
 import "./chunk-3SIZGL3O.js";
 import "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-7RMTKFJW.js";
 import "./chunk-Y3KNXVTD.js";
 import "./chunk-RIY7GYQS.js";
-import "./chunk-YRKRZ6OF.js";
-import "./chunk-CM6BMECR.js";
 import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-PX3VCKAU.js";
+import "./chunk-BCS7WHCK.js";
 import "./chunk-M5ZGRVIQ.js";
-import "./chunk-YBW5JSA3.js";
 
 // src/google-drive.ts
 import { z } from "zod";

package/dist/google-drive.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/google-drive.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\nimport {\n  ConnectorDocumentDestination,\n  ConnectorDocumentDestinationSelection,\n} from \"./connector-destinations\";\n\nexport const GOOGLE_DRIVE_PROVIDER_DOMAIN = \"googleapis.com\" as const;\nexport const GOOGLE_DRIVE_FULL_SCOPE = \"https://www.googleapis.com/auth/drive\" as const;\nexport const GOOGLE_DRIVE_FILE_SCOPE = \"https://www.googleapis.com/auth/drive.file\" as const;\nexport const GOOGLE_DRIVE_METADATA_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.metadata.readonly\" as const;\nexport const GOOGLE_DRIVE_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.readonly\" as const;\n/** Stable serialized role retained for existing connection rows; not product-facing copy. */\nexport const GOOGLE_DRIVE_CREDENTIAL_ROLE = \"google_drive_metadata\" as const;\nexport const GOOGLE_DRIVE_CREDENTIAL_LABEL = \"Google Drive read-only source sync\" as const;\nexport const GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL = \"Google Drive metadata browser\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_SERVER_ID = \"google-drive-publishing\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_TOOL_NAME = \"google_drive_publish_file\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION = \"create\" as const;\n\nexport const GoogleDriveOAuthCapability = z.enum([\n  \"picker_file_read\",\n  \"publish_file\",\n  \"source_metadata_discovery\",\n  \"source_content_read\",\n  \"recursive_source_sync\",\n]);\nexport type GoogleDriveOAuthCapability = z.infer<typeof GoogleDriveOAuthCapability>;\n\nexport type GoogleDriveOAuthScopeDecision = {\n  accessMode: \"file_only\" | \"metadata_readonly\" | \"readonly\" | null;\n  capabilities: GoogleDriveOAuthCapability[];\n};\n\n/**\n * Converts exact Google OAuth grants into the Drive capabilities OpenGeni may\n * rely on. Unknown or malformed grants add no authority. In particular,\n * drive.file covers only files explicitly opened or shared with the app and\n * never authorizes arbitrary recursive descendant discovery.\n */\nexport function googleDriveOAuthScopeDecision(\n  grantedScopes: readonly string[],\n): GoogleDriveOAuthScopeDecision {\n  const granted = new Set(grantedScopes);\n  const hasFullDrive = granted.has(GOOGLE_DRIVE_FULL_SCOPE);\n  const hasSourceContentRead = hasFullDrive || granted.has(GOOGLE_DRIVE_READONLY_SCOPE);\n  const hasFileWrite = hasFullDrive || granted.has(GOOGLE_DRIVE_FILE_SCOPE);\n  const hasSourceMetadataDiscovery =\n    hasSourceContentRead || granted.has(GOOGLE_DRIVE_METADATA_READONLY_SCOPE);\n  const hasPickerFileRead = hasSourceContentRead || hasFileWrite;\n  const capabilities: GoogleDriveOAuthCapability[] = [];\n  if (hasPickerFileRead) capabilities.push(\"picker_file_read\");\n  if (hasFileWrite) capabilities.push(\"publish_file\");\n  if (hasSourceMetadataDiscovery) capabilities.push(\"source_metadata_discovery\");\n  if (hasSourceContentRead) {\n    capabilities.push(\"source_content_read\", \"recursive_source_sync\");\n  }\n  return {\n    accessMode: hasSourceContentRead\n      ? \"readonly\"\n      : hasSourceMetadataDiscovery\n        ? \"metadata_readonly\"\n        : hasFileWrite\n          ? \"file_only\"\n          : null,\n    capabilities,\n  };\n}\n\nexport function googleDriveScopesAllowCapability(\n  grantedScopes: readonly string[],\n  capability: GoogleDriveOAuthCapability,\n): boolean {\n  return googleDriveOAuthScopeDecision(grantedScopes).capabilities.includes(capability);\n}\n\n/** @deprecated Connector document destinations use organization/workspace/personal authority. */\nexport const GoogleDriveTargetScope = z.enum([\"user\", \"workspace\", \"organization\"]);\nexport type GoogleDriveTargetScope = z.infer<typeof GoogleDriveTargetScope>;\n\nexport const GoogleDriveSyncCadence = z.enum([\"manual\", \"hourly\", \"daily\"]);\nexport type GoogleDriveSyncCadence = z.infer<typeof GoogleDriveSyncCadence>;\n\nexport const GoogleDriveReadPolicy = z.enum([\"allow\", \"ask\", \"block\"]);\nexport type GoogleDriveReadPolicy = z.infer<typeof GoogleDriveReadPolicy>;\n\nexport const GoogleDriveConnectionLifecycleState = z.enum([\n  \"active\",\n  \"paused\",\n  \"token_revoked\",\n  \"app_removed\",\n  \"disconnected\",\n  \"reconnect_required\",\n  \"reconsent_required\",\n]);\nexport type GoogleDriveConnectionLifecycleState = z.infer<\n  typeof GoogleDriveConnectionLifecycleState\n>;\n\nconst GoogleDriveLifecycleObservedAt = z.string().datetime({ offset: true });\nexport const GoogleDriveConnectionLifecycle = z.discriminatedUnion(\"state\", [\n  z.object({\n    state: z.literal(\"active\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"paused\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"token_revoked\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"app_removed\"),\n    recoverable: z.literal(false),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"disconnected\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconnect_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconsent_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n]);\nexport type GoogleDriveConnectionLifecycle = z.infer<typeof GoogleDriveConnectionLifecycle>;\n\nexport const GoogleDriveSelectedSource = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(256).nullable().default(null),\n  destination: ConnectorDocumentDestination.optional(),\n  /** @deprecated Missing destinations resolve to the current workspace boundary. */\n  targetScope: GoogleDriveTargetScope.optional(),\n  syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n  syncEnabled: z.boolean().default(false),\n  configGeneration: z.number().int().positive().default(1),\n  readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  selectedAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveSelectedSource = z.infer<typeof GoogleDriveSelectedSource>;\n\nexport const GoogleDriveOutputDestination = z\n  .object({\n    folderId: z.string().min(1).max(256),\n    folderName: z.string().min(1).max(1024),\n    driveId: z.string().min(1).max(256).nullable(),\n    location: z.enum([\"my_drive\", \"shared_drive\"]),\n    selectedAt: z.string().datetime({ offset: true }),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if ((value.location === \"my_drive\") !== (value.driveId === null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"driveId\"],\n        message: \"Google Drive destination location does not match its drive identity\",\n      });\n    }\n  });\nexport type GoogleDriveOutputDestination = z.infer<typeof GoogleDriveOutputDestination>;\n\nexport const GoogleDriveConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(GOOGLE_DRIVE_CREDENTIAL_ROLE),\n    credentialLabel: z.union([\n      z.literal(GOOGLE_DRIVE_CREDENTIAL_LABEL),\n      z.literal(GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL),\n    ]),\n    googlePermissionId: z.string().min(1).max(256),\n    googleEmail: z.string().email().max(320),\n    googleDisplayName: z.string().min(1).max(512).nullable(),\n    verifiedAt: z.string().datetime({ offset: true }),\n    accessMode: z.enum([\"file_only\", \"metadata_readonly\", \"readonly\"]),\n    lifecycle: GoogleDriveConnectionLifecycle.optional(),\n    outputDestination: GoogleDriveOutputDestination.optional(),\n    documentDestination: ConnectorDocumentDestination.optional(),\n    selectedSources: z.array(GoogleDriveSelectedSource).max(100).optional(),\n    /** @deprecated Read `selectedSources`; retained while existing connections migrate. */\n    selectedSource: GoogleDriveSelectedSource.nullable().optional(),\n  })\n  .passthrough();\nexport type GoogleDriveConnectionMetadata = z.infer<typeof GoogleDriveConnectionMetadata>;\n\nexport const GoogleDriveOAuthStartRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n  capability: z.enum([\"source_read\", \"publish\"]).default(\"source_read\"),\n});\nexport type GoogleDriveOAuthStartRequest = z.infer<typeof GoogleDriveOAuthStartRequest>;\n\nexport const GoogleDriveOAuthStartResponse = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveOAuthStartResponse = z.infer<typeof GoogleDriveOAuthStartResponse>;\n\nexport const GoogleDriveLifecycleActionRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  expectedVersion: z.number().int().positive(),\n});\nexport type GoogleDriveLifecycleActionRequest = z.infer<typeof GoogleDriveLifecycleActionRequest>;\n\nexport const GoogleDriveDisconnectRequest = z.object({\n  expectedVersion: z.number().int().positive(),\n  idempotencyKey: z.string().trim().min(1).max(200),\n});\nexport type GoogleDriveDisconnectRequest = z.infer<typeof GoogleDriveDisconnectRequest>;\n\nexport const GoogleDrivePublicationExportFile = z\n  .object({\n    fileId: z.string().uuid(),\n    filename: z.string().trim().min(1).max(512),\n    contentType: z.string().trim().min(1).max(256),\n    sizeBytes: z.number().int().positive(),\n    sha256: z.string().regex(/^[0-9a-f]{64}$/u),\n    artifactId: z.string().regex(/^[0-9a-f]{32}$/u),\n    versionId: z.string().regex(/^[0-9a-f]{32}$/u),\n    materializationJobId: z.string().regex(/^[0-9a-f]{32}$/u),\n    sourceHeadSequence: z.number().int().nonnegative(),\n    sourceStateHash: z.string().regex(/^sha256:[0-9a-f]{64}$/u),\n  })\n  .strict();\nexport type GoogleDrivePublicationExportFile = z.infer<typeof GoogleDrivePublicationExportFile>;\n\nexport const GoogleDrivePublicationToolInput = z\n  .object({\n    title: z.string().trim().min(1).max(512),\n    modality: z.enum([\"document\", \"spreadsheet\", \"presentation\"]),\n    file: GoogleDrivePublicationExportFile,\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type GoogleDrivePublicationToolInput = z.infer<typeof GoogleDrivePublicationToolInput>;\n\nexport const GoogleDrivePublicationReceipt = z\n  .object({\n    connectionId: z.string().uuid(),\n    providerFileId: z.string().min(1).max(256),\n    webViewLink: z.string().url(),\n    mimeType: z.enum([\n      \"application/vnd.google-apps.document\",\n      \"application/vnd.google-apps.spreadsheet\",\n      \"application/vnd.google-apps.presentation\",\n    ]),\n    destination: GoogleDriveOutputDestination,\n    replayed: z.boolean(),\n  })\n  .strict();\nexport type GoogleDrivePublicationReceipt = z.infer<typeof GoogleDrivePublicationReceipt>;\n\nexport const GoogleDriveBrowseItem = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  kind: z.enum([\"folder\", \"file\"]),\n  driveId: z.string().min(1).max(256).nullable(),\n  modifiedTime: z.string().datetime({ offset: true }).nullable(),\n  size: z.string().regex(/^\\d+$/).nullable(),\n  webViewLink: z.string().url().nullable(),\n});\nexport type GoogleDriveBrowseItem = z.infer<typeof GoogleDriveBrowseItem>;\n\nexport const GoogleDriveBrowseResponse = z.object({\n  connection: z.lazy(() => ConnectionMetadata),\n  parentId: z.string().min(1).max(256),\n  current: GoogleDriveBrowseItem.nullable(),\n  items: z.array(GoogleDriveBrowseItem),\n  nextPageToken: z.string().min(1).max(4096).nullable(),\n  incompleteSearch: z.boolean(),\n});\nexport type GoogleDriveBrowseResponse = z.infer<typeof GoogleDriveBrowseResponse>;\n\nconst GoogleDriveSourceSelection = z\n  .array(\n    GoogleDriveBrowseItem.pick({\n      id: true,\n      name: true,\n      mimeType: true,\n      driveId: true,\n    }),\n  )\n  .max(100)\n  .refine((sources) => new Set(sources.map((source) => source.id)).size === sources.length, {\n    message: \"Google Drive sources must be unique\",\n  });\n\nexport const SaveGoogleDriveSourceRequest = z\n  .object({\n    sources: GoogleDriveSourceSelection,\n    destination: ConnectorDocumentDestinationSelection.optional(),\n    /** @deprecated Legacy requests are accepted but resolve to workspace authority. */\n    targetScope: GoogleDriveTargetScope.optional(),\n    syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n    syncEnabled: z.boolean().default(false),\n    readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  })\n  .refine((request) => request.destination !== undefined || request.targetScope !== undefined, {\n    message: \"Google Drive document destination is required\",\n  });\nexport type SaveGoogleDriveSourceRequest = z.infer<typeof SaveGoogleDriveSourceRequest>;\n\nexport const GoogleDriveKnowledgeSourceItem = z.object({\n  id: z.string().min(1).max(512),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(512).optional(),\n  sourceKind: z.enum([\"my_drive\", \"shared_drive\", \"folder\"]),\n  includeDescendants: z.boolean(),\n});\nexport type GoogleDriveKnowledgeSourceItem = z.infer<typeof GoogleDriveKnowledgeSourceItem>;\n\nexport const GoogleDriveKnowledgeSourceDestination = z.object({\n  authorityKind: z.enum([\"organization\", \"workspace\", \"personal\"]),\n  authorityAccountId: z.string().min(1).max(128),\n  authorityWorkspaceId: z.string().min(1).max(128).optional(),\n  authoritySubjectId: z.string().min(1).max(512).optional(),\n  collectionId: z.string().min(1).max(512).optional(),\n});\nexport type GoogleDriveKnowledgeSourceDestination = z.infer<\n  typeof GoogleDriveKnowledgeSourceDestination\n>;\n\nexport const GoogleDriveKnowledgeSourceConfig = z.object({\n  sources: z.array(GoogleDriveKnowledgeSourceItem).min(1).max(100),\n  destination: GoogleDriveKnowledgeSourceDestination,\n  syncCadence: GoogleDriveSyncCadence,\n  readPolicy: GoogleDriveReadPolicy,\n});\nexport type GoogleDriveKnowledgeSourceConfig = z.infer<typeof GoogleDriveKnowledgeSourceConfig>;\n\nexport const SaveGoogleDriveIntegrationSourceRequest = z.intersection(\n  SaveGoogleDriveSourceRequest,\n  z.object({\n    sources: GoogleDriveSourceSelection.refine((sources) => sources.length > 0, {\n      message: \"At least one Google Drive source is required\",\n    }),\n    expectedVersion: z.number().int().positive().optional(),\n    idempotencyKey: z.string().uuid(),\n  }),\n);\nexport type SaveGoogleDriveIntegrationSourceRequest = z.infer<\n  typeof SaveGoogleDriveIntegrationSourceRequest\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,+BAA+B;AACrC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAChC,IAAM,uCACX;AACK,IAAM,8BACX;AAEK,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,uCAAuC;AAC7C,IAAM,qCAAqC;AAC3C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,KAAK;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,8BACd,eAC+B;AAC/B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,eAAe,QAAQ,IAAI,uBAAuB;AACxD,QAAM,uBAAuB,gBAAgB,QAAQ,IAAI,2BAA2B;AACpF,QAAM,eAAe,gBAAgB,QAAQ,IAAI,uBAAuB;AACxE,QAAM,6BACJ,wBAAwB,QAAQ,IAAI,oCAAoC;AAC1E,QAAM,oBAAoB,wBAAwB;AAClD,QAAM,eAA6C,CAAC;AACpD,MAAI,kBAAmB,cAAa,KAAK,kBAAkB;AAC3D,MAAI,aAAc,cAAa,KAAK,cAAc;AAClD,MAAI,2BAA4B,cAAa,KAAK,2BAA2B;AAC7E,MAAI,sBAAsB;AACxB,iBAAa,KAAK,uBAAuB,uBAAuB;AAAA,EAClE;AACA,SAAO;AAAA,IACL,YAAY,uBACR,aACA,6BACE,sBACA,eACE,cACA;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,iCACd,eACA,YACS;AACT,SAAO,8BAA8B,aAAa,EAAE,aAAa,SAAS,UAAU;AACtF;AAGO,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAG3E,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC;AAGnE,IAAM,wBAAwB,EAAE,KAAK,CAAC,SAAS,OAAO,OAAO,CAAC;AAG9D,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACpE,IAAM,iCAAiC,EAAE,mBAAmB,SAAS;AAAA,EAC1E,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,eAAe;AAAA,IAChC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,aAAa;AAAA,IAC9B,aAAa,EAAE,QAAQ,KAAK;AAAA,IAC5B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,cAAc;AAAA,IAC/B,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,aAAa,6BAA6B,SAAS;AAAA;AAAA,EAEnD,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EACvD,YAAY,sBAAsB,QAAQ,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,KAAK,CAAC,YAAY,cAAc,CAAC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAK,MAAM,aAAa,gBAAiB,MAAM,YAAY,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,4BAA4B;AAAA,EACtD,iBAAiB,EAAE,MAAM;AAAA,IACvB,EAAE,QAAQ,6BAA6B;AAAA,IACvC,EAAE,QAAQ,oCAAoC;AAAA,EAChD,CAAC;AAAA,EACD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,YAAY,EAAE,KAAK,CAAC,aAAa,qBAAqB,UAAU,CAAC;AAAA,EACjE,WAAW,+BAA+B,SAAS;AAAA,EACnD,mBAAmB,6BAA6B,SAAS;AAAA,EACzD,qBAAqB,6BAA6B,SAAS;AAAA,EAC3D,iBAAiB,EAAE,MAAM,yBAAyB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgB,0BAA0B,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,YAAY;AAGR,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,KAAK,CAAC,eAAe,SAAS,CAAC,EAAE,QAAQ,aAAa;AACtE,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC;AAGM,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACxD,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,MAAM,wBAAwB;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,UAAU,EAAE,KAAK,CAAC,YAAY,eAAe,cAAc,CAAC;AAAA,EAC5D,MAAM;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,aAAa;AAAA,EACb,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,OAAO;AAGH,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,YAAY,EAAE,KAAK,MAAM,kBAAkB;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,sBAAsB,SAAS;AAAA,EACxC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACpD,kBAAkB,EAAE,QAAQ;AAC9B,CAAC;AAGD,IAAM,6BAA6B,EAChC;AAAA,EACC,sBAAsB,KAAK;AAAA,IACzB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACH,EACC,IAAI,GAAG,EACP,OAAO,CAAC,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACxF,SAAS;AACX,CAAC;AAEI,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,aAAa,sCAAsC,SAAS;AAAA;AAAA,EAE5D,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,YAAY,sBAAsB,QAAQ,OAAO;AACnD,CAAC,EACA,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAa,QAAQ,gBAAgB,QAAW;AAAA,EAC3F,SAAS;AACX,CAAC;AAGI,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,KAAK,CAAC,YAAY,gBAAgB,QAAQ,CAAC;AAAA,EACzD,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAGM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,aAAa,UAAU,CAAC;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC;AAKM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,MAAM,8BAA8B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/D,aAAa;AAAA,EACb,aAAa;AAAA,EACb,YAAY;AACd,CAAC;AAGM,IAAM,0CAA0C,EAAE;AAAA,EACvD;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,2BAA2B,OAAO,CAAC,YAAY,QAAQ,SAAS,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX,CAAC;AAAA,IACD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/google-drive.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\nimport {\n  ConnectorDocumentDestination,\n  ConnectorDocumentDestinationSelection,\n} from \"./connector-destinations\";\n\nexport const GOOGLE_DRIVE_PROVIDER_DOMAIN = \"googleapis.com\" as const;\nexport const GOOGLE_DRIVE_FULL_SCOPE = \"https://www.googleapis.com/auth/drive\" as const;\nexport const GOOGLE_DRIVE_FILE_SCOPE = \"https://www.googleapis.com/auth/drive.file\" as const;\nexport const GOOGLE_DRIVE_METADATA_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.metadata.readonly\" as const;\nexport const GOOGLE_DRIVE_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.readonly\" as const;\n/** Stable serialized role retained for existing connection rows; not product-facing copy. */\nexport const GOOGLE_DRIVE_CREDENTIAL_ROLE = \"google_drive_metadata\" as const;\nexport const GOOGLE_DRIVE_CREDENTIAL_LABEL = \"Google Drive read-only source sync\" as const;\nexport const GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL = \"Google Drive metadata browser\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_SERVER_ID = \"google-drive-publishing\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_TOOL_NAME = \"google_drive_publish_file\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION = \"create\" as const;\n\nexport const GoogleDriveOAuthCapability = z.enum([\n  \"picker_file_read\",\n  \"publish_file\",\n  \"source_metadata_discovery\",\n  \"source_content_read\",\n  \"recursive_source_sync\",\n]);\nexport type GoogleDriveOAuthCapability = z.infer<typeof GoogleDriveOAuthCapability>;\n\nexport type GoogleDriveOAuthScopeDecision = {\n  accessMode: \"file_only\" | \"metadata_readonly\" | \"readonly\" | null;\n  capabilities: GoogleDriveOAuthCapability[];\n};\n\n/**\n * Converts exact Google OAuth grants into the Drive capabilities OpenGeni may\n * rely on. Unknown or malformed grants add no authority. In particular,\n * drive.file covers only files explicitly opened or shared with the app and\n * never authorizes arbitrary recursive descendant discovery.\n */\nexport function googleDriveOAuthScopeDecision(\n  grantedScopes: readonly string[],\n): GoogleDriveOAuthScopeDecision {\n  const granted = new Set(grantedScopes);\n  const hasFullDrive = granted.has(GOOGLE_DRIVE_FULL_SCOPE);\n  const hasSourceContentRead = hasFullDrive || granted.has(GOOGLE_DRIVE_READONLY_SCOPE);\n  const hasFileWrite = hasFullDrive || granted.has(GOOGLE_DRIVE_FILE_SCOPE);\n  const hasSourceMetadataDiscovery =\n    hasSourceContentRead || granted.has(GOOGLE_DRIVE_METADATA_READONLY_SCOPE);\n  const hasPickerFileRead = hasSourceContentRead || hasFileWrite;\n  const capabilities: GoogleDriveOAuthCapability[] = [];\n  if (hasPickerFileRead) capabilities.push(\"picker_file_read\");\n  if (hasFileWrite) capabilities.push(\"publish_file\");\n  if (hasSourceMetadataDiscovery) capabilities.push(\"source_metadata_discovery\");\n  if (hasSourceContentRead) {\n    capabilities.push(\"source_content_read\", \"recursive_source_sync\");\n  }\n  return {\n    accessMode: hasSourceContentRead\n      ? \"readonly\"\n      : hasSourceMetadataDiscovery\n        ? \"metadata_readonly\"\n        : hasFileWrite\n          ? \"file_only\"\n          : null,\n    capabilities,\n  };\n}\n\nexport function googleDriveScopesAllowCapability(\n  grantedScopes: readonly string[],\n  capability: GoogleDriveOAuthCapability,\n): boolean {\n  return googleDriveOAuthScopeDecision(grantedScopes).capabilities.includes(capability);\n}\n\n/** @deprecated Connector document destinations use organization/workspace/personal authority. */\nexport const GoogleDriveTargetScope = z.enum([\"user\", \"workspace\", \"organization\"]);\nexport type GoogleDriveTargetScope = z.infer<typeof GoogleDriveTargetScope>;\n\nexport const GoogleDriveSyncCadence = z.enum([\"manual\", \"hourly\", \"daily\"]);\nexport type GoogleDriveSyncCadence = z.infer<typeof GoogleDriveSyncCadence>;\n\nexport const GoogleDriveReadPolicy = z.enum([\"allow\", \"ask\", \"block\"]);\nexport type GoogleDriveReadPolicy = z.infer<typeof GoogleDriveReadPolicy>;\n\nexport const GoogleDriveConnectionLifecycleState = z.enum([\n  \"active\",\n  \"paused\",\n  \"token_revoked\",\n  \"app_removed\",\n  \"disconnected\",\n  \"reconnect_required\",\n  \"reconsent_required\",\n]);\nexport type GoogleDriveConnectionLifecycleState = z.infer<\n  typeof GoogleDriveConnectionLifecycleState\n>;\n\nconst GoogleDriveLifecycleObservedAt = z.string().datetime({ offset: true });\nexport const GoogleDriveConnectionLifecycle = z.discriminatedUnion(\"state\", [\n  z.object({\n    state: z.literal(\"active\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"paused\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"token_revoked\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"app_removed\"),\n    recoverable: z.literal(false),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"disconnected\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconnect_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconsent_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n]);\nexport type GoogleDriveConnectionLifecycle = z.infer<typeof GoogleDriveConnectionLifecycle>;\n\nexport const GoogleDriveSelectedSource = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(256).nullable().default(null),\n  destination: ConnectorDocumentDestination.optional(),\n  /** @deprecated Missing destinations resolve to the current workspace boundary. */\n  targetScope: GoogleDriveTargetScope.optional(),\n  syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n  syncEnabled: z.boolean().default(false),\n  configGeneration: z.number().int().positive().default(1),\n  readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  selectedAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveSelectedSource = z.infer<typeof GoogleDriveSelectedSource>;\n\nexport const GoogleDriveOutputDestination = z\n  .object({\n    folderId: z.string().min(1).max(256),\n    folderName: z.string().min(1).max(1024),\n    driveId: z.string().min(1).max(256).nullable(),\n    location: z.enum([\"my_drive\", \"shared_drive\"]),\n    selectedAt: z.string().datetime({ offset: true }),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if ((value.location === \"my_drive\") !== (value.driveId === null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"driveId\"],\n        message: \"Google Drive destination location does not match its drive identity\",\n      });\n    }\n  });\nexport type GoogleDriveOutputDestination = z.infer<typeof GoogleDriveOutputDestination>;\n\nexport const GoogleDriveConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(GOOGLE_DRIVE_CREDENTIAL_ROLE),\n    credentialLabel: z.union([\n      z.literal(GOOGLE_DRIVE_CREDENTIAL_LABEL),\n      z.literal(GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL),\n    ]),\n    googlePermissionId: z.string().min(1).max(256),\n    googleEmail: z.string().email().max(320),\n    googleDisplayName: z.string().min(1).max(512).nullable(),\n    verifiedAt: z.string().datetime({ offset: true }),\n    accessMode: z.enum([\"file_only\", \"metadata_readonly\", \"readonly\"]),\n    lifecycle: GoogleDriveConnectionLifecycle.optional(),\n    outputDestination: GoogleDriveOutputDestination.optional(),\n    documentDestination: ConnectorDocumentDestination.optional(),\n    selectedSources: z.array(GoogleDriveSelectedSource).max(100).optional(),\n    /** @deprecated Read `selectedSources`; retained while existing connections migrate. */\n    selectedSource: GoogleDriveSelectedSource.nullable().optional(),\n  })\n  .passthrough();\nexport type GoogleDriveConnectionMetadata = z.infer<typeof GoogleDriveConnectionMetadata>;\n\nexport const GoogleDriveOAuthStartRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n  capability: z.enum([\"source_read\", \"publish\"]).default(\"source_read\"),\n});\nexport type GoogleDriveOAuthStartRequest = z.infer<typeof GoogleDriveOAuthStartRequest>;\n\nexport const GoogleDriveOAuthStartResponse = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveOAuthStartResponse = z.infer<typeof GoogleDriveOAuthStartResponse>;\n\nexport const GoogleDriveLifecycleActionRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  expectedVersion: z.number().int().positive(),\n});\nexport type GoogleDriveLifecycleActionRequest = z.infer<typeof GoogleDriveLifecycleActionRequest>;\n\nexport const GoogleDriveDisconnectRequest = z.object({\n  expectedVersion: z.number().int().positive(),\n  idempotencyKey: z.string().trim().min(1).max(200),\n});\nexport type GoogleDriveDisconnectRequest = z.infer<typeof GoogleDriveDisconnectRequest>;\n\nexport const GoogleDrivePublicationExportFile = z\n  .object({\n    fileId: z.string().uuid(),\n    filename: z.string().trim().min(1).max(512),\n    contentType: z.string().trim().min(1).max(256),\n    sizeBytes: z.number().int().positive(),\n    sha256: z.string().regex(/^[0-9a-f]{64}$/u),\n    artifactId: z.string().regex(/^[0-9a-f]{32}$/u),\n    versionId: z.string().regex(/^[0-9a-f]{32}$/u),\n    materializationJobId: z.string().regex(/^[0-9a-f]{32}$/u),\n    sourceHeadSequence: z.number().int().nonnegative(),\n    sourceStateHash: z.string().regex(/^sha256:[0-9a-f]{64}$/u),\n  })\n  .strict();\nexport type GoogleDrivePublicationExportFile = z.infer<typeof GoogleDrivePublicationExportFile>;\n\nexport const GoogleDrivePublicationToolInput = z\n  .object({\n    title: z.string().trim().min(1).max(512),\n    modality: z.enum([\"document\", \"spreadsheet\", \"presentation\"]),\n    file: GoogleDrivePublicationExportFile,\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type GoogleDrivePublicationToolInput = z.infer<typeof GoogleDrivePublicationToolInput>;\n\nexport const GoogleDrivePublicationReceipt = z\n  .object({\n    connectionId: z.string().uuid(),\n    providerFileId: z.string().min(1).max(256),\n    webViewLink: z.string().url(),\n    mimeType: z.enum([\n      \"application/vnd.google-apps.document\",\n      \"application/vnd.google-apps.spreadsheet\",\n      \"application/vnd.google-apps.presentation\",\n    ]),\n    destination: GoogleDriveOutputDestination,\n    replayed: z.boolean(),\n  })\n  .strict();\nexport type GoogleDrivePublicationReceipt = z.infer<typeof GoogleDrivePublicationReceipt>;\n\nexport const GoogleDriveBrowseItem = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  kind: z.enum([\"folder\", \"file\"]),\n  driveId: z.string().min(1).max(256).nullable(),\n  modifiedTime: z.string().datetime({ offset: true }).nullable(),\n  size: z.string().regex(/^\\d+$/).nullable(),\n  webViewLink: z.string().url().nullable(),\n});\nexport type GoogleDriveBrowseItem = z.infer<typeof GoogleDriveBrowseItem>;\n\nexport const GoogleDriveBrowseResponse = z.object({\n  connection: z.lazy(() => ConnectionMetadata),\n  parentId: z.string().min(1).max(256),\n  current: GoogleDriveBrowseItem.nullable(),\n  items: z.array(GoogleDriveBrowseItem),\n  nextPageToken: z.string().min(1).max(4096).nullable(),\n  incompleteSearch: z.boolean(),\n});\nexport type GoogleDriveBrowseResponse = z.infer<typeof GoogleDriveBrowseResponse>;\n\nconst GoogleDriveSourceSelection = z\n  .array(\n    GoogleDriveBrowseItem.pick({\n      id: true,\n      name: true,\n      mimeType: true,\n      driveId: true,\n    }),\n  )\n  .max(100)\n  .refine((sources) => new Set(sources.map((source) => source.id)).size === sources.length, {\n    message: \"Google Drive sources must be unique\",\n  });\n\nexport const SaveGoogleDriveSourceRequest = z\n  .object({\n    sources: GoogleDriveSourceSelection,\n    destination: ConnectorDocumentDestinationSelection.optional(),\n    /** @deprecated Legacy requests are accepted but resolve to workspace authority. */\n    targetScope: GoogleDriveTargetScope.optional(),\n    syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n    syncEnabled: z.boolean().default(false),\n    readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  })\n  .refine((request) => request.destination !== undefined || request.targetScope !== undefined, {\n    message: \"Google Drive document destination is required\",\n  });\nexport type SaveGoogleDriveSourceRequest = z.infer<typeof SaveGoogleDriveSourceRequest>;\n\nexport const GoogleDriveKnowledgeSourceItem = z.object({\n  id: z.string().min(1).max(512),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(512).optional(),\n  sourceKind: z.enum([\"my_drive\", \"shared_drive\", \"folder\"]),\n  includeDescendants: z.boolean(),\n});\nexport type GoogleDriveKnowledgeSourceItem = z.infer<typeof GoogleDriveKnowledgeSourceItem>;\n\nexport const GoogleDriveKnowledgeSourceDestination = z.object({\n  authorityKind: z.enum([\"organization\", \"workspace\", \"personal\"]),\n  authorityAccountId: z.string().min(1).max(128),\n  authorityWorkspaceId: z.string().min(1).max(128).optional(),\n  authoritySubjectId: z.string().min(1).max(512).optional(),\n  collectionId: z.string().min(1).max(512).optional(),\n});\nexport type GoogleDriveKnowledgeSourceDestination = z.infer<\n  typeof GoogleDriveKnowledgeSourceDestination\n>;\n\nexport const GoogleDriveKnowledgeSourceConfig = z.object({\n  sources: z.array(GoogleDriveKnowledgeSourceItem).min(1).max(100),\n  destination: GoogleDriveKnowledgeSourceDestination,\n  syncCadence: GoogleDriveSyncCadence,\n  readPolicy: GoogleDriveReadPolicy,\n});\nexport type GoogleDriveKnowledgeSourceConfig = z.infer<typeof GoogleDriveKnowledgeSourceConfig>;\n\nexport const SaveGoogleDriveIntegrationSourceRequest = z.intersection(\n  SaveGoogleDriveSourceRequest,\n  z.object({\n    sources: GoogleDriveSourceSelection.refine((sources) => sources.length > 0, {\n      message: \"At least one Google Drive source is required\",\n    }),\n    expectedVersion: z.number().int().positive().optional(),\n    idempotencyKey: z.string().uuid(),\n  }),\n);\nexport type SaveGoogleDriveIntegrationSourceRequest = z.infer<\n  typeof SaveGoogleDriveIntegrationSourceRequest\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,+BAA+B;AACrC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAChC,IAAM,uCACX;AACK,IAAM,8BACX;AAEK,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,uCAAuC;AAC7C,IAAM,qCAAqC;AAC3C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,KAAK;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,8BACd,eAC+B;AAC/B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,eAAe,QAAQ,IAAI,uBAAuB;AACxD,QAAM,uBAAuB,gBAAgB,QAAQ,IAAI,2BAA2B;AACpF,QAAM,eAAe,gBAAgB,QAAQ,IAAI,uBAAuB;AACxE,QAAM,6BACJ,wBAAwB,QAAQ,IAAI,oCAAoC;AAC1E,QAAM,oBAAoB,wBAAwB;AAClD,QAAM,eAA6C,CAAC;AACpD,MAAI,kBAAmB,cAAa,KAAK,kBAAkB;AAC3D,MAAI,aAAc,cAAa,KAAK,cAAc;AAClD,MAAI,2BAA4B,cAAa,KAAK,2BAA2B;AAC7E,MAAI,sBAAsB;AACxB,iBAAa,KAAK,uBAAuB,uBAAuB;AAAA,EAClE;AACA,SAAO;AAAA,IACL,YAAY,uBACR,aACA,6BACE,sBACA,eACE,cACA;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,iCACd,eACA,YACS;AACT,SAAO,8BAA8B,aAAa,EAAE,aAAa,SAAS,UAAU;AACtF;AAGO,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAG3E,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC;AAGnE,IAAM,wBAAwB,EAAE,KAAK,CAAC,SAAS,OAAO,OAAO,CAAC;AAG9D,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACpE,IAAM,iCAAiC,EAAE,mBAAmB,SAAS;AAAA,EAC1E,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,eAAe;AAAA,IAChC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,aAAa;AAAA,IAC9B,aAAa,EAAE,QAAQ,KAAK;AAAA,IAC5B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,cAAc;AAAA,IAC/B,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,aAAa,6BAA6B,SAAS;AAAA;AAAA,EAEnD,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EACvD,YAAY,sBAAsB,QAAQ,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,KAAK,CAAC,YAAY,cAAc,CAAC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAK,MAAM,aAAa,gBAAiB,MAAM,YAAY,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,4BAA4B;AAAA,EACtD,iBAAiB,EAAE,MAAM;AAAA,IACvB,EAAE,QAAQ,6BAA6B;AAAA,IACvC,EAAE,QAAQ,oCAAoC;AAAA,EAChD,CAAC;AAAA,EACD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,YAAY,EAAE,KAAK,CAAC,aAAa,qBAAqB,UAAU,CAAC;AAAA,EACjE,WAAW,+BAA+B,SAAS;AAAA,EACnD,mBAAmB,6BAA6B,SAAS;AAAA,EACzD,qBAAqB,6BAA6B,SAAS;AAAA,EAC3D,iBAAiB,EAAE,MAAM,yBAAyB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgB,0BAA0B,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,YAAY;AAGR,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,KAAK,CAAC,eAAe,SAAS,CAAC,EAAE,QAAQ,aAAa;AACtE,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC;AAGM,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACxD,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,MAAM,wBAAwB;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,UAAU,EAAE,KAAK,CAAC,YAAY,eAAe,cAAc,CAAC;AAAA,EAC5D,MAAM;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,aAAa;AAAA,EACb,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,OAAO;AAGH,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,YAAY,EAAE,KAAK,MAAM,kBAAkB;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,sBAAsB,SAAS;AAAA,EACxC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACpD,kBAAkB,EAAE,QAAQ;AAC9B,CAAC;AAGD,IAAM,6BAA6B,EAChC;AAAA,EACC,sBAAsB,KAAK;AAAA,IACzB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACH,EACC,IAAI,GAAG,EACP,OAAO,CAAC,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACxF,SAAS;AACX,CAAC;AAEI,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,aAAa,sCAAsC,SAAS;AAAA;AAAA,EAE5D,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,YAAY,sBAAsB,QAAQ,OAAO;AACnD,CAAC,EACA,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAa,QAAQ,gBAAgB,QAAW;AAAA,EAC3F,SAAS;AACX,CAAC;AAGI,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,KAAK,CAAC,YAAY,gBAAgB,QAAQ,CAAC;AAAA,EACzD,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAGM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,aAAa,UAAU,CAAC;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC;AAKM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,MAAM,8BAA8B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/D,aAAa;AAAA,EACb,aAAa;AAAA,EACb,YAAY;AACd,CAAC;AAGM,IAAM,0CAA0C,EAAE;AAAA,EACvD;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,2BAA2B,OAAO,CAAC,YAAY,QAAQ,SAAS,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX,CAAC;AAAA,IACD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,CAAC;AACH;","names":[]}

package/dist/index.d.ts

@@ -2936,7 +2936,7 @@ export declare const UpdateWorkspaceRequest: z.ZodObject<{
     name: z.ZodOptional<z.ZodString>;
     slug: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     agentInstructions: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-}, z.core.$strip>;
+}, z.core.$strict>;
 export type UpdateWorkspaceRequest = z.infer<typeof UpdateWorkspaceRequest>;
 export declare const ApiKey: z.ZodObject<{
     id: z.ZodString;
@@ -10357,6 +10357,36 @@ export declare const VariableSetScope: z.ZodEnum<{
     workspace: "workspace";
 }>;
 export type VariableSetScope = z.infer<typeof VariableSetScope>;
+/**
+ * Exact-ID metadata used only to validate attachments. This deliberately omits
+ * names, descriptions, and variable-name metadata so attach/use authority does
+ * not become general catalog access.
+ */
+export declare const VariableSetAttachmentMetadata: z.ZodObject<{
+    id: z.ZodString;
+    scope: z.ZodEnum<{
+        organization: "organization";
+        user: "user";
+        workspace: "workspace";
+    }>;
+}, z.core.$strip>;
+export type VariableSetAttachmentMetadata = z.infer<typeof VariableSetAttachmentMetadata>;
+export declare const MAX_RESOLVED_VARIABLE_SET_ATTACHMENTS: number;
+export declare const ResolveVariableSetAttachmentsRequest: z.ZodObject<{
+    variableSetIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export type ResolveVariableSetAttachmentsRequest = z.infer<typeof ResolveVariableSetAttachmentsRequest>;
+export declare const ResolveVariableSetAttachmentsResponse: z.ZodObject<{
+    variableSets: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        scope: z.ZodEnum<{
+            organization: "organization";
+            user: "user";
+            workspace: "workspace";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type ResolveVariableSetAttachmentsResponse = z.infer<typeof ResolveVariableSetAttachmentsResponse>;
 export declare const VariableSet: z.ZodObject<{
     id: z.ZodString;
     accountId: z.ZodString;
@@ -10867,6 +10897,7 @@ export declare const RigChange: z.ZodObject<{
     updatedAt: z.ZodString;
 }, z.core.$strip>;
 export type RigChange = z.infer<typeof RigChange>;
+export declare const RIG_SETUP_SCRIPT_MAX_CHARS: number;
 export declare const CreateRigRequest: z.ZodObject<{
     scope: z.ZodDefault<z.ZodEnum<{
         organization: "organization";
@@ -32139,13 +32170,13 @@ export type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalog
  * that rollout boundary. Mutating clients send this value in
  * `x-opengeni-api-contract`; the API rejects any other value before routing.
  */
-export declare const OPENGENI_API_CONTRACT_REVISION: "2026-08-personal-only-organization-setup-v1";
+export declare const OPENGENI_API_CONTRACT_REVISION: "2026-08-organization-recovery-custody-v1";
 export declare const OPENGENI_API_CONTRACT_HEADER: "x-opengeni-api-contract";
 /** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */
 export declare const OPENGENI_CORRELATION_HEADER: "x-opengeni-correlation-id";
 export declare const ClientConfig: z.ZodObject<{
     deploymentRevision: z.ZodString;
-    apiContractRevision: z.ZodLiteral<"2026-08-personal-only-organization-setup-v1">;
+    apiContractRevision: z.ZodLiteral<"2026-08-organization-recovery-custody-v1">;
     serverVersion: z.ZodOptional<z.ZodString>;
     defaultModel: z.ZodString;
     allowedModels: z.ZodArray<z.ZodString>;
@@ -32695,6 +32726,11 @@ export declare const ClientConfig: z.ZodObject<{
         local: "local";
         managed: "managed";
     }>;
+    managedAuthSessionSetMode: z.ZodDefault<z.ZodEnum<{
+        broker: "broker";
+        dual: "dual";
+        legacy: "legacy";
+    }>>;
     auth: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
         mode: z.ZodLiteral<"none">;
     }, z.core.$strip>, z.ZodObject<{
@@ -32777,6 +32813,7 @@ export * from "./governed-learning-activation.js";
 export * from "./knowledge.js";
 export * from "./task-notes.js";
 export * from "./canonical-human-identities.js";
+export * from "./organization-recovery.js";
 export * from "./organization-membership-lifecycle.js";
 export * from "./remember.js";
 export * from "./agent-authored-durable-text.js";