@opengeni/contracts 2.5.0-canary.2 → 2.6.0-canary.0

package/dist/organization-recovery.d.ts

@@ -0,0 +1,337 @@
+import { z } from "zod";
+export declare const OrganizationRecoveryPolicyState: z.ZodEnum<{
+    active: "active";
+    degraded: "degraded";
+    disabled: "disabled";
+    pending_acceptance: "pending_acceptance";
+    superseded: "superseded";
+}>;
+export type OrganizationRecoveryPolicyState = z.infer<typeof OrganizationRecoveryPolicyState>;
+export declare const OrganizationRecoveryOperationState: z.ZodEnum<{
+    cancelled: "cancelled";
+    collecting: "collecting";
+    cooling: "cooling";
+    executed: "executed";
+    expired: "expired";
+    superseded: "superseded";
+}>;
+export type OrganizationRecoveryOperationState = z.infer<typeof OrganizationRecoveryOperationState>;
+export declare const OrganizationRecoveryUnavailableReason: z.ZodEnum<{
+    degraded: "degraded";
+    disabled: "disabled";
+    identity_unavailable: "identity_unavailable";
+    no_policy: "no_policy";
+    pending_acceptance: "pending_acceptance";
+}>;
+export type OrganizationRecoveryUnavailableReason = z.infer<typeof OrganizationRecoveryUnavailableReason>;
+export declare const OrganizationRecoveryMemberSummary: z.ZodObject<{
+    membershipId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type OrganizationRecoveryMemberSummary = z.infer<typeof OrganizationRecoveryMemberSummary>;
+export declare const OrganizationRecoveryCustodian: z.ZodObject<{
+    membershipId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+    ordinal: z.ZodNumber;
+    enrollmentState: z.ZodEnum<{
+        accepted: "accepted";
+        ineligible: "ineligible";
+        pending_acceptance: "pending_acceptance";
+    }>;
+    acceptedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type OrganizationRecoveryCustodian = z.infer<typeof OrganizationRecoveryCustodian>;
+export declare const OrganizationRecoveryPolicy: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    revision: z.ZodNumber;
+    state: z.ZodEnum<{
+        active: "active";
+        degraded: "degraded";
+        disabled: "disabled";
+        pending_acceptance: "pending_acceptance";
+        superseded: "superseded";
+    }>;
+    custodians: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+        ordinal: z.ZodNumber;
+        enrollmentState: z.ZodEnum<{
+            accepted: "accepted";
+            ineligible: "ineligible";
+            pending_acceptance: "pending_acceptance";
+        }>;
+        acceptedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryPolicy = z.infer<typeof OrganizationRecoveryPolicy>;
+export declare const OrganizationRecoveryApproval: z.ZodObject<{
+    membershipId: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    email: z.ZodNullable<z.ZodString>;
+    approvedAt: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryApproval = z.infer<typeof OrganizationRecoveryApproval>;
+export declare const OrganizationRecoveryOperation: z.ZodObject<{
+    id: z.ZodString;
+    organizationId: z.ZodString;
+    policyId: z.ZodString;
+    policyRevision: z.ZodNumber;
+    revision: z.ZodNumber;
+    state: z.ZodEnum<{
+        cancelled: "cancelled";
+        collecting: "collecting";
+        cooling: "cooling";
+        executed: "executed";
+        expired: "expired";
+        superseded: "superseded";
+    }>;
+    target: z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    approvals: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+        approvedAt: z.ZodString;
+    }, z.core.$strict>>;
+    approvalCount: z.ZodNumber;
+    quorumAt: z.ZodNullable<z.ZodString>;
+    executableAt: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodString;
+    executedAt: z.ZodNullable<z.ZodString>;
+    cancelledAt: z.ZodNullable<z.ZodString>;
+    notificationJournaled: z.ZodBoolean;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryOperation = z.infer<typeof OrganizationRecoveryOperation>;
+export declare const OrganizationRecoveryCapabilities: z.ZodObject<{
+    configure: z.ZodBoolean;
+    accept: z.ZodBoolean;
+    disable: z.ZodBoolean;
+    start: z.ZodBoolean;
+    approve: z.ZodBoolean;
+    cancel: z.ZodBoolean;
+    execute: z.ZodBoolean;
+}, z.core.$strict>;
+export type OrganizationRecoveryCapabilities = z.infer<typeof OrganizationRecoveryCapabilities>;
+export declare const OrganizationRecoveryOverview: z.ZodObject<{
+    organizationId: z.ZodString;
+    availability: z.ZodEnum<{
+        available: "available";
+        recovery_unavailable: "recovery_unavailable";
+    }>;
+    unavailableReason: z.ZodNullable<z.ZodEnum<{
+        degraded: "degraded";
+        disabled: "disabled";
+        identity_unavailable: "identity_unavailable";
+        no_policy: "no_policy";
+        pending_acceptance: "pending_acceptance";
+    }>>;
+    recentReauthenticationAt: z.ZodNullable<z.ZodString>;
+    eligibleMembers: z.ZodArray<z.ZodObject<{
+        membershipId: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    policy: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        organizationId: z.ZodString;
+        revision: z.ZodNumber;
+        state: z.ZodEnum<{
+            active: "active";
+            degraded: "degraded";
+            disabled: "disabled";
+            pending_acceptance: "pending_acceptance";
+            superseded: "superseded";
+        }>;
+        custodians: z.ZodArray<z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+            ordinal: z.ZodNumber;
+            enrollmentState: z.ZodEnum<{
+                accepted: "accepted";
+                ineligible: "ineligible";
+                pending_acceptance: "pending_acceptance";
+            }>;
+            acceptedAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>>;
+    operation: z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        organizationId: z.ZodString;
+        policyId: z.ZodString;
+        policyRevision: z.ZodNumber;
+        revision: z.ZodNumber;
+        state: z.ZodEnum<{
+            cancelled: "cancelled";
+            collecting: "collecting";
+            cooling: "cooling";
+            executed: "executed";
+            expired: "expired";
+            superseded: "superseded";
+        }>;
+        target: z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>;
+        approvals: z.ZodArray<z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+            approvedAt: z.ZodString;
+        }, z.core.$strict>>;
+        approvalCount: z.ZodNumber;
+        quorumAt: z.ZodNullable<z.ZodString>;
+        executableAt: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodString;
+        executedAt: z.ZodNullable<z.ZodString>;
+        cancelledAt: z.ZodNullable<z.ZodString>;
+        notificationJournaled: z.ZodBoolean;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>>;
+    capabilities: z.ZodObject<{
+        configure: z.ZodBoolean;
+        accept: z.ZodBoolean;
+        disable: z.ZodBoolean;
+        start: z.ZodBoolean;
+        approve: z.ZodBoolean;
+        cancel: z.ZodBoolean;
+        execute: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type OrganizationRecoveryOverview = z.infer<typeof OrganizationRecoveryOverview>;
+export declare const ConfigureOrganizationRecoveryPolicyRequest: z.ZodObject<{
+    custodianMembershipIds: z.ZodTuple<[z.ZodString, z.ZodString, z.ZodString], null>;
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type ConfigureOrganizationRecoveryPolicyRequest = z.infer<typeof ConfigureOrganizationRecoveryPolicyRequest>;
+export declare const AcceptOrganizationRecoveryCustodyRequest: z.ZodObject<{
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type AcceptOrganizationRecoveryCustodyRequest = z.infer<typeof AcceptOrganizationRecoveryCustodyRequest>;
+export declare const DisableOrganizationRecoveryPolicyRequest: z.ZodObject<{
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type DisableOrganizationRecoveryPolicyRequest = z.infer<typeof DisableOrganizationRecoveryPolicyRequest>;
+export declare const StartOrganizationRecoveryOperationRequest: z.ZodObject<{
+    targetMembershipId: z.ZodString;
+    expectedPolicyRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type StartOrganizationRecoveryOperationRequest = z.infer<typeof StartOrganizationRecoveryOperationRequest>;
+export declare const OrganizationRecoveryOperationCommandRequest: z.ZodObject<{
+    expectedOperationRevision: z.ZodNumber;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type OrganizationRecoveryOperationCommandRequest = z.infer<typeof OrganizationRecoveryOperationCommandRequest>;
+export declare const OrganizationRecoveryMutationResponse: z.ZodObject<{
+    replay: z.ZodBoolean;
+    overview: z.ZodObject<{
+        organizationId: z.ZodString;
+        availability: z.ZodEnum<{
+            available: "available";
+            recovery_unavailable: "recovery_unavailable";
+        }>;
+        unavailableReason: z.ZodNullable<z.ZodEnum<{
+            degraded: "degraded";
+            disabled: "disabled";
+            identity_unavailable: "identity_unavailable";
+            no_policy: "no_policy";
+            pending_acceptance: "pending_acceptance";
+        }>>;
+        recentReauthenticationAt: z.ZodNullable<z.ZodString>;
+        eligibleMembers: z.ZodArray<z.ZodObject<{
+            membershipId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            email: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        policy: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            organizationId: z.ZodString;
+            revision: z.ZodNumber;
+            state: z.ZodEnum<{
+                active: "active";
+                degraded: "degraded";
+                disabled: "disabled";
+                pending_acceptance: "pending_acceptance";
+                superseded: "superseded";
+            }>;
+            custodians: z.ZodArray<z.ZodObject<{
+                membershipId: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                email: z.ZodNullable<z.ZodString>;
+                ordinal: z.ZodNumber;
+                enrollmentState: z.ZodEnum<{
+                    accepted: "accepted";
+                    ineligible: "ineligible";
+                    pending_acceptance: "pending_acceptance";
+                }>;
+                acceptedAt: z.ZodNullable<z.ZodString>;
+            }, z.core.$strict>>;
+            createdAt: z.ZodString;
+            updatedAt: z.ZodString;
+        }, z.core.$strict>>;
+        operation: z.ZodNullable<z.ZodObject<{
+            id: z.ZodString;
+            organizationId: z.ZodString;
+            policyId: z.ZodString;
+            policyRevision: z.ZodNumber;
+            revision: z.ZodNumber;
+            state: z.ZodEnum<{
+                cancelled: "cancelled";
+                collecting: "collecting";
+                cooling: "cooling";
+                executed: "executed";
+                expired: "expired";
+                superseded: "superseded";
+            }>;
+            target: z.ZodObject<{
+                membershipId: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                email: z.ZodNullable<z.ZodString>;
+            }, z.core.$strict>;
+            approvals: z.ZodArray<z.ZodObject<{
+                membershipId: z.ZodString;
+                name: z.ZodNullable<z.ZodString>;
+                email: z.ZodNullable<z.ZodString>;
+                approvedAt: z.ZodString;
+            }, z.core.$strict>>;
+            approvalCount: z.ZodNumber;
+            quorumAt: z.ZodNullable<z.ZodString>;
+            executableAt: z.ZodNullable<z.ZodString>;
+            expiresAt: z.ZodString;
+            executedAt: z.ZodNullable<z.ZodString>;
+            cancelledAt: z.ZodNullable<z.ZodString>;
+            notificationJournaled: z.ZodBoolean;
+            createdAt: z.ZodString;
+            updatedAt: z.ZodString;
+        }, z.core.$strict>>;
+        capabilities: z.ZodObject<{
+            configure: z.ZodBoolean;
+            accept: z.ZodBoolean;
+            disable: z.ZodBoolean;
+            start: z.ZodBoolean;
+            approve: z.ZodBoolean;
+            cancel: z.ZodBoolean;
+            execute: z.ZodBoolean;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type OrganizationRecoveryMutationResponse = z.infer<typeof OrganizationRecoveryMutationResponse>;

package/dist/organization-recovery.js

@@ -0,0 +1,37 @@
+import {
+  AcceptOrganizationRecoveryCustodyRequest,
+  ConfigureOrganizationRecoveryPolicyRequest,
+  DisableOrganizationRecoveryPolicyRequest,
+  OrganizationRecoveryApproval,
+  OrganizationRecoveryCapabilities,
+  OrganizationRecoveryCustodian,
+  OrganizationRecoveryMemberSummary,
+  OrganizationRecoveryMutationResponse,
+  OrganizationRecoveryOperation,
+  OrganizationRecoveryOperationCommandRequest,
+  OrganizationRecoveryOperationState,
+  OrganizationRecoveryOverview,
+  OrganizationRecoveryPolicy,
+  OrganizationRecoveryPolicyState,
+  OrganizationRecoveryUnavailableReason,
+  StartOrganizationRecoveryOperationRequest
+} from "./chunk-BCS7WHCK.js";
+export {
+  AcceptOrganizationRecoveryCustodyRequest,
+  ConfigureOrganizationRecoveryPolicyRequest,
+  DisableOrganizationRecoveryPolicyRequest,
+  OrganizationRecoveryApproval,
+  OrganizationRecoveryCapabilities,
+  OrganizationRecoveryCustodian,
+  OrganizationRecoveryMemberSummary,
+  OrganizationRecoveryMutationResponse,
+  OrganizationRecoveryOperation,
+  OrganizationRecoveryOperationCommandRequest,
+  OrganizationRecoveryOperationState,
+  OrganizationRecoveryOverview,
+  OrganizationRecoveryPolicy,
+  OrganizationRecoveryPolicyState,
+  OrganizationRecoveryUnavailableReason,
+  StartOrganizationRecoveryOperationRequest
+};
+//# sourceMappingURL=organization-recovery.js.map

package/dist/organization-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/personal-github.js

@@ -1,23 +1,24 @@
 import {
   ConnectionMetadata
-} from "./chunk-4I7DWNRR.js";
+} from "./chunk-MJ3K6ICH.js";
+import "./chunk-WYBDERIY.js";
 import "./chunk-MRWYRAS5.js";
+import "./chunk-CM6BMECR.js";
 import "./chunk-JUFK3T4Q.js";
-import "./chunk-WYBDERIY.js";
+import "./chunk-YBW5JSA3.js";
 import "./chunk-N6GRVXAJ.js";
 import "./chunk-3SIZGL3O.js";
 import "./chunk-NVJMJWLL.js";
+import "./chunk-YRKRZ6OF.js";
 import "./chunk-7RMTKFJW.js";
 import "./chunk-Y3KNXVTD.js";
 import "./chunk-RIY7GYQS.js";
-import "./chunk-YRKRZ6OF.js";
-import "./chunk-CM6BMECR.js";
 import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
 import "./chunk-TXTQIYCV.js";
 import "./chunk-PX3VCKAU.js";
+import "./chunk-BCS7WHCK.js";
 import "./chunk-M5ZGRVIQ.js";
-import "./chunk-YBW5JSA3.js";
 
 // src/personal-github.ts
 import { z } from "zod";

package/dist/personal-github.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}
+{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/contracts",
-  "version": "2.5.0-canary.2",
+  "version": "2.6.0-canary.0",
   "description": "Shared zod schemas and wire-contract types for the OpenGeni API.",
   "license": "Apache-2.0",
   "repository": {
@@ -58,6 +58,14 @@
       "types": "./dist/canonical-human-identities.d.ts",
       "import": "./dist/canonical-human-identities.js"
     },
+    "./managed-auth-session-sets": {
+      "types": "./dist/managed-auth-session-sets.d.ts",
+      "import": "./dist/managed-auth-session-sets.js"
+    },
+    "./organization-recovery": {
+      "types": "./dist/organization-recovery.d.ts",
+      "import": "./dist/organization-recovery.js"
+    },
     "./codex-provider-account-authority": {
       "types": "./dist/codex-provider-account-authority.d.ts",
       "import": "./dist/codex-provider-account-authority.js"

package/src/image-generation.ts

@@ -16,7 +16,10 @@ const WorkspaceImagePathSchema = z
   // without sending unsupported regex syntax to model providers.
   .refine((path) => path.split("/").every((segment) => segment !== "." && segment !== ".."), {
     message: "Sandbox image paths cannot contain dot segments",
-  });
+  })
+  .describe(
+    "Absolute /workspace path to a PNG, JPEG, or WebP image. Convert SVG or other formats before using them as image-generation references.",
+  );
 
 /** One ordered, workspace-owned input used to guide or edit an image. */
 export const ImageGenerationReferenceSchema = z.discriminatedUnion("kind", [
@@ -49,7 +52,10 @@ export const GenerateImageToolInput = z
       .array(ImageGenerationReferenceSchema)
       .max(IMAGE_GENERATION_MAX_REFERENCES)
       .optional()
-      .default([]),
+      .default([])
+      .describe(
+        "Ordered image references. Every sandbox path, File, or artifact must resolve to PNG, JPEG, or WebP bytes.",
+      ),
   })
   .strict();
 export type GenerateImageToolInput = z.infer<typeof GenerateImageToolInput>;

package/src/index.ts

@@ -2965,13 +2965,15 @@ export const CreateWorkspaceRequest = z.object({
 });
 export type CreateWorkspaceRequest = z.infer<typeof CreateWorkspaceRequest>;
 
-export const UpdateWorkspaceRequest = z.object({
-  name: z.string().min(1).optional(),
-  slug: z.string().min(1).nullable().optional(),
-  // White-label persona override. Pass null to clear it back to the deployment
-  // default; omit to leave it unchanged.
-  agentInstructions: z.string().min(1).nullable().optional(),
-});
+export const UpdateWorkspaceRequest = z
+  .object({
+    name: z.string().min(1).optional(),
+    slug: z.string().min(1).nullable().optional(),
+    // White-label persona override. Pass null to clear it back to the deployment
+    // default; omit to leave it unchanged.
+    agentInstructions: z.string().min(1).nullable().optional(),
+  })
+  .strict();
 export type UpdateWorkspaceRequest = z.infer<typeof UpdateWorkspaceRequest>;
 
 export const ApiKey = z.object({
@@ -7727,6 +7729,44 @@ export type VariableSetSecret = z.infer<typeof VariableSetSecret>;
 export const VariableSetScope = z.enum(["organization", "workspace", "user"]);
 export type VariableSetScope = z.infer<typeof VariableSetScope>;
 
+/**
+ * Exact-ID metadata used only to validate attachments. This deliberately omits
+ * names, descriptions, and variable-name metadata so attach/use authority does
+ * not become general catalog access.
+ */
+export const VariableSetAttachmentMetadata = z.object({
+  id: z.string().uuid(),
+  scope: VariableSetScope,
+});
+export type VariableSetAttachmentMetadata = z.infer<typeof VariableSetAttachmentMetadata>;
+
+export const MAX_RESOLVED_VARIABLE_SET_ATTACHMENTS = MAX_SELECTED_VARIABLE_SETS * 2;
+export const ResolveVariableSetAttachmentsRequest = z
+  .object({
+    // One create can carry 25 explicit selections plus 25 defaults from its Rig.
+    variableSetIds: z.array(z.string().uuid()).max(MAX_RESOLVED_VARIABLE_SET_ATTACHMENTS),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (new Set(value.variableSetIds).size !== value.variableSetIds.length) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["variableSetIds"],
+        message: "variableSetIds must not contain duplicates",
+      });
+    }
+  });
+export type ResolveVariableSetAttachmentsRequest = z.infer<
+  typeof ResolveVariableSetAttachmentsRequest
+>;
+
+export const ResolveVariableSetAttachmentsResponse = z.object({
+  variableSets: z.array(VariableSetAttachmentMetadata),
+});
+export type ResolveVariableSetAttachmentsResponse = z.infer<
+  typeof ResolveVariableSetAttachmentsResponse
+>;
+
 export const VariableSet = z.object({
   id: z.string().uuid(),
   accountId: z.string().uuid(),
@@ -8008,6 +8048,10 @@ export const RigChange = z.object({
 });
 export type RigChange = z.infer<typeof RigChange>;
 
+// Rig setup payloads are transferred to sandboxes in bounded chunks. Keep the
+// public definition limit independent from provider command-argument ceilings.
+export const RIG_SETUP_SCRIPT_MAX_CHARS = 1024 * 1024;
+
 export const CreateRigRequest = z.object({
   // Omitted remains the compatibility workspace-owned creation path.
   scope: ResourceAuthorityScope.default("workspace"),
@@ -8020,7 +8064,7 @@ export const CreateRigRequest = z.object({
   // explicit never-field instead of silently stripping `image` from older
   // clients: callers must receive a validation error and remove the override.
   image: z.never().optional(),
-  setupScript: z.string().max(131072).optional(),
+  setupScript: z.string().max(RIG_SETUP_SCRIPT_MAX_CHARS).optional(),
   checks: z.array(RigCheck).max(100).default([]),
   credentialHooks: z.array(z.string().min(1).max(200)).max(50).default([]),
   defaultVariableSetIds: z.array(z.string().uuid()).max(25).default([]),
@@ -8090,7 +8134,7 @@ export const RigDefinitionEditPayload = z.object({
   // the read model for compatibility, but no new definition may set or clear
   // one through the public write contract.
   image: z.never().optional(),
-  setupScript: z.string().max(131072).nullish(),
+  setupScript: z.string().max(RIG_SETUP_SCRIPT_MAX_CHARS).nullish(),
   checks: z.array(RigCheck).max(100).optional(),
   credentialHooks: z.array(z.string().min(1).max(200)).max(50).optional(),
   defaultVariableSetIds: z.array(z.string().uuid()).max(25).optional(),
@@ -15704,8 +15748,7 @@ export type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalog
  * that rollout boundary. Mutating clients send this value in
  * `x-opengeni-api-contract`; the API rejects any other value before routing.
  */
-export const OPENGENI_API_CONTRACT_REVISION =
-  "2026-08-personal-only-organization-setup-v1" as const;
+export const OPENGENI_API_CONTRACT_REVISION = "2026-08-organization-recovery-custody-v1" as const;
 export const OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract" as const;
 /** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */
 export const OPENGENI_CORRELATION_HEADER = "x-opengeni-correlation-id" as const;
@@ -15755,6 +15798,9 @@ export const ClientConfig = /* @__PURE__ */ defineModelContractSchema(() =>
       acceptedMimeTypes: [...VOICE_INPUT_ACCEPTED_MIME_TYPES],
     }),
     productAccessMode: ProductAccessMode,
+    // Safe rollout discriminator: the browser only mounts the optional
+    // @opengeni/sdk/accounts controller when this is dual or broker.
+    managedAuthSessionSetMode: z.enum(["legacy", "dual", "broker"]).default("legacy"),
     auth: ClientAuthConfig.default({ mode: "none" }),
     analytics: z
       .object({
@@ -15891,6 +15937,7 @@ export * from "./governed-learning-activation";
 export * from "./knowledge";
 export * from "./task-notes";
 export * from "./canonical-human-identities";
+export * from "./organization-recovery";
 export * from "./organization-membership-lifecycle";
 export * from "./remember";
 export * from "./agent-authored-durable-text";