@opengeni/contracts 3.0.1 → 3.0.2-canary.1

package/dist/connect.js

@@ -1,7 +1,8 @@
 import {
   IntegrationInstanceKey,
   IntegrationSource
-} from "./chunk-EHHDZLGY.js";
+} from "./chunk-YRCMZTY2.js";
+import "./chunk-WBYTNVIW.js";
 import "./chunk-YBW5JSA3.js";
 import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";

package/dist/connect.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/connect.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { IntegrationInstanceKey, IntegrationSource } from \"./index\";\n\nconst opaqueId = z.string().min(1).max(512);\nexport const ConnectOwnership = z.enum([\"personal\", \"workspace\"]);\nexport type ConnectOwnership = z.infer<typeof ConnectOwnership>;\nexport const ConnectProvider = z\n  .object({\n    id: opaqueId,\n    label: z.string().min(1).max(256),\n    family: opaqueId,\n    readiness: z.enum([\"available\", \"needs_configuration\", \"operator_only\", \"unsupported\"]),\n    reason: z.string().max(1024).optional(),\n    ownership: z.array(ConnectOwnership).max(2),\n    setup: z\n      .array(\n        z.enum([\"none\", \"oauth\", \"credentials\", \"device\", \"installation\", \"openapi\", \"graphql\"]),\n      )\n      .max(7),\n  })\n  .strict();\nexport type ConnectProvider = z.infer<typeof ConnectProvider>;\nexport const ConnectAccount = z\n  .object({\n    id: opaqueId,\n    providerId: opaqueId,\n    version: z.number().int().positive().optional(),\n    label: z.string().max(256),\n    ownership: ConnectOwnership,\n    status: z.enum([\"connected\", \"auth_needed\", \"disabled\"]),\n  })\n  .strict();\nexport type ConnectAccount = z.infer<typeof ConnectAccount>;\nexport const ConnectResource = z\n  .object({ id: opaqueId, label: z.string().max(512), kind: opaqueId })\n  .strict();\nexport type ConnectResource = z.infer<typeof ConnectResource>;\nexport const ConnectNextAction = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"authorize\"), url: z.string().url().max(16_384) }).strict(),\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      fields: z\n        .array(\n          z\n            .object({\n              name: opaqueId,\n              label: z.string().max(256),\n              required: z.boolean(),\n              secret: z.boolean(),\n              options: z\n                .array(z.object({ value: opaqueId, label: z.string().max(512) }).strict())\n                .max(1000)\n                .optional(),\n            })\n            .strict(),\n        )\n        .max(32),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"wait\"),\n      pollAfterMs: z.number().int().min(250).max(60_000),\n      userCode: z.string().max(128).optional(),\n      verificationUrl: z.string().url().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({ type: z.literal(\"select_account\"), accounts: z.array(ConnectAccount).max(100) })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"select_resources\"),\n      resources: z.array(ConnectResource).max(100),\n      cursor: z.string().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"preview\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operations: z.array(ConnectResource).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"none\") }).strict(),\n]);\nexport type ConnectNextAction = z.infer<typeof ConnectNextAction>;\nexport const ConnectInstallationTarget = z\n  .object({\n    instanceKey: IntegrationInstanceKey,\n    displayName: z.string().min(1).max(200),\n    expectedInstanceVersion: z.number().int().positive().optional(),\n  })\n  .strict();\nexport type ConnectInstallationTarget = z.infer<typeof ConnectInstallationTarget>;\nexport const ConnectAttemptState = z.enum([\n  \"ready\",\n  \"requires_user_action\",\n  \"credential_input\",\n  \"provider_wait\",\n  \"account_selection\",\n  \"resource_selection\",\n  \"preview\",\n  \"installing\",\n  \"connected_but_incomplete\",\n  \"complete\",\n  \"cancelled\",\n  \"expired\",\n  \"failed\",\n  \"uncertain\",\n]);\nexport const ConnectAttempt = z\n  .object({\n    id: opaqueId,\n    workspaceId: opaqueId,\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    revision: z.number().int().positive(),\n    state: ConnectAttemptState,\n    credentialsCommitted: z.boolean(),\n    integrationInstalled: z.boolean(),\n    completionRequirement: z.enum([\"connection\", \"integration\", \"provider_setup\"]),\n    nextAction: ConnectNextAction,\n    expiresAt: z.string().datetime({ offset: true }),\n    account: ConnectAccount.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n    source: IntegrationSource.optional(),\n    error: z\n      .object({ code: opaqueId, message: z.string().max(2048), retryable: z.boolean() })\n      .strict()\n      .optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"integration\" &&\n      !value.integrationInstalled\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Complete setup requires an installed integration\",\n      });\n    }\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"connection\" &&\n      !value.credentialsCommitted\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Connection setup requires committed credentials\",\n      });\n    }\n    if (\n      [\"complete\", \"cancelled\", \"expired\"].includes(value.state) &&\n      value.nextAction.type !== \"none\"\n    ) {\n      context.addIssue({ code: \"custom\", message: \"A terminal setup has no next action\" });\n    }\n  });\nexport type ConnectAttempt = z.infer<typeof ConnectAttempt>;\nexport const ConnectAdvance = z.discriminatedUnion(\"type\", [\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      values: z.record(z.string().max(256), z.string().max(16_384)),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"account\"), accountId: opaqueId }).strict(),\n  z.object({ type: z.literal(\"resources\"), resourceIds: z.array(opaqueId).max(1000) }).strict(),\n  z\n    .object({\n      type: z.literal(\"install\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operationIds: z.array(opaqueId).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"retry\") }).strict(),\n]);\nexport type ConnectAdvance = z.infer<typeof ConnectAdvance>;\nexport const ConnectOperationRequest = z\n  .object({\n    expectedRevision: z.number().int().positive().safe(),\n    idempotencyKey: opaqueId,\n  })\n  .strict();\nexport const AdvanceConnectRequest = ConnectOperationRequest.extend({ action: ConnectAdvance });\nexport const BeginConnectRequest = z\n  .object({\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    // URL parsing validates separately; never transform this original string.\n    returnUrl: z.string().min(1).max(4096),\n    idempotencyKey: opaqueId,\n    reconnectAccountId: opaqueId.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n  })\n  .strict();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAGlB,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnC,IAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,WAAW,CAAC;AAEzD,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,QAAQ;AAAA,EACR,WAAW,EAAE,KAAK,CAAC,aAAa,uBAAuB,iBAAiB,aAAa,CAAC;AAAA,EACtF,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC;AAAA,EAC1C,OAAO,EACJ;AAAA,IACC,EAAE,KAAK,CAAC,QAAQ,SAAS,eAAe,UAAU,gBAAgB,WAAW,SAAS,CAAC;AAAA,EACzF,EACC,IAAI,CAAC;AACV,CAAC,EACA,OAAO;AAEH,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,YAAY;AAAA,EACZ,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,EACzB,WAAW;AAAA,EACX,QAAQ,EAAE,KAAK,CAAC,aAAa,eAAe,UAAU,CAAC;AACzD,CAAC,EACA,OAAO;AAEH,IAAM,kBAAkB,EAC5B,OAAO,EAAE,IAAI,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,EACnE,OAAO;AAEH,IAAM,oBAAoB,EAAE,mBAAmB,QAAQ;AAAA,EAC5D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAM,EAAE,CAAC,EAAE,OAAO;AAAA,EACrF,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EACL;AAAA,MACC,EACG,OAAO;AAAA,QACN,MAAM;AAAA,QACN,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,QACzB,UAAU,EAAE,QAAQ;AAAA,QACpB,QAAQ,EAAE,QAAQ;AAAA,QAClB,SAAS,EACN,MAAM,EAAE,OAAO,EAAE,OAAO,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,EACxE,IAAI,GAAI,EACR,SAAS;AAAA,MACd,CAAC,EACA,OAAO;AAAA,IACZ,EACC,IAAI,EAAE;AAAA,EACX,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAM;AAAA,IACjD,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,GAAG,UAAU,EAAE,MAAM,cAAc,EAAE,IAAI,GAAG,EAAE,CAAC,EACxF,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,kBAAkB;AAAA,IAClC,WAAW,EAAE,MAAM,eAAe,EAAE,IAAI,GAAG;AAAA,IAC3C,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY,EAAE,MAAM,eAAe,EAAE,IAAI,GAAI;AAAA,EAC/C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAC/C,CAAC;AAEM,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,OAAO;AAEH,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACM,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,OAAO;AAAA,EACP,sBAAsB,EAAE,QAAQ;AAAA,EAChC,sBAAsB,EAAE,QAAQ;AAAA,EAChC,uBAAuB,EAAE,KAAK,CAAC,cAAc,eAAe,gBAAgB,CAAC;AAAA,EAC7E,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,SAAS,eAAe,SAAS;AAAA,EACjC,oBAAoB,0BAA0B,SAAS;AAAA,EACvD,QAAQ,kBAAkB,SAAS;AAAA,EACnC,OAAO,EACJ,OAAO,EAAE,MAAM,UAAU,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAChF,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,iBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,gBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,CAAC,YAAY,aAAa,SAAS,EAAE,SAAS,MAAM,KAAK,KACzD,MAAM,WAAW,SAAS,QAC1B;AACA,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,sCAAsC,CAAC;AAAA,EACrF;AACF,CAAC;AAEI,IAAM,iBAAiB,EAAE,mBAAmB,QAAQ;AAAA,EACzD,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,KAAM,CAAC;AAAA,EAC9D,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,WAAW,SAAS,CAAC,EAAE,OAAO;AAAA,EACrE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,aAAa,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI,EAAE,CAAC,EAAE,OAAO;AAAA,EAC5F,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,cAAc,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI;AAAA,EAC1C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,EAAE,OAAO;AAChD,CAAC;AAEM,IAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACnD,gBAAgB;AAClB,CAAC,EACA,OAAO;AACH,IAAM,wBAAwB,wBAAwB,OAAO,EAAE,QAAQ,eAAe,CAAC;AACvF,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,YAAY;AAAA,EACZ,WAAW;AAAA;AAAA,EAEX,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,gBAAgB;AAAA,EAChB,oBAAoB,SAAS,SAAS;AAAA,EACtC,oBAAoB,0BAA0B,SAAS;AACzD,CAAC,EACA,OAAO;","names":[]}
+{"version":3,"sources":["../src/connect.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { IntegrationInstanceKey, IntegrationSource } from \"./index\";\n\nconst opaqueId = z.string().min(1).max(512);\nexport const ConnectOwnership = z.enum([\"personal\", \"workspace\"]);\nexport type ConnectOwnership = z.infer<typeof ConnectOwnership>;\nexport const ConnectProvider = z\n  .object({\n    id: opaqueId,\n    label: z.string().min(1).max(256),\n    family: opaqueId,\n    readiness: z.enum([\"available\", \"needs_configuration\", \"operator_only\", \"unsupported\"]),\n    reason: z.string().max(1024).optional(),\n    ownership: z.array(ConnectOwnership).max(2),\n    setup: z\n      .array(\n        z.enum([\"none\", \"oauth\", \"credentials\", \"device\", \"installation\", \"openapi\", \"graphql\"]),\n      )\n      .max(7),\n  })\n  .strict();\nexport type ConnectProvider = z.infer<typeof ConnectProvider>;\nexport const ConnectAccount = z\n  .object({\n    id: opaqueId,\n    providerId: opaqueId,\n    version: z.number().int().positive().optional(),\n    label: z.string().max(256),\n    ownership: ConnectOwnership,\n    status: z.enum([\"connected\", \"auth_needed\", \"disabled\"]),\n  })\n  .strict();\nexport type ConnectAccount = z.infer<typeof ConnectAccount>;\nexport const ConnectResource = z\n  .object({ id: opaqueId, label: z.string().max(512), kind: opaqueId })\n  .strict();\nexport type ConnectResource = z.infer<typeof ConnectResource>;\nexport const ConnectNextAction = z.discriminatedUnion(\"type\", [\n  z.object({ type: z.literal(\"authorize\"), url: z.string().url().max(16_384) }).strict(),\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      fields: z\n        .array(\n          z\n            .object({\n              name: opaqueId,\n              label: z.string().max(256),\n              required: z.boolean(),\n              secret: z.boolean(),\n              options: z\n                .array(z.object({ value: opaqueId, label: z.string().max(512) }).strict())\n                .max(1000)\n                .optional(),\n            })\n            .strict(),\n        )\n        .max(32),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"wait\"),\n      pollAfterMs: z.number().int().min(250).max(60_000),\n      userCode: z.string().max(128).optional(),\n      verificationUrl: z.string().url().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({ type: z.literal(\"select_account\"), accounts: z.array(ConnectAccount).max(100) })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"select_resources\"),\n      resources: z.array(ConnectResource).max(100),\n      cursor: z.string().max(2048).optional(),\n    })\n    .strict(),\n  z\n    .object({\n      type: z.literal(\"preview\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operations: z.array(ConnectResource).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"none\") }).strict(),\n]);\nexport type ConnectNextAction = z.infer<typeof ConnectNextAction>;\nexport const ConnectInstallationTarget = z\n  .object({\n    instanceKey: IntegrationInstanceKey,\n    displayName: z.string().min(1).max(200),\n    expectedInstanceVersion: z.number().int().positive().optional(),\n  })\n  .strict();\nexport type ConnectInstallationTarget = z.infer<typeof ConnectInstallationTarget>;\nexport const ConnectAttemptState = z.enum([\n  \"ready\",\n  \"requires_user_action\",\n  \"credential_input\",\n  \"provider_wait\",\n  \"account_selection\",\n  \"resource_selection\",\n  \"preview\",\n  \"installing\",\n  \"connected_but_incomplete\",\n  \"complete\",\n  \"cancelled\",\n  \"expired\",\n  \"failed\",\n  \"uncertain\",\n]);\nexport const ConnectAttempt = z\n  .object({\n    id: opaqueId,\n    workspaceId: opaqueId,\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    revision: z.number().int().positive(),\n    state: ConnectAttemptState,\n    credentialsCommitted: z.boolean(),\n    integrationInstalled: z.boolean(),\n    completionRequirement: z.enum([\"connection\", \"integration\", \"provider_setup\"]),\n    nextAction: ConnectNextAction,\n    expiresAt: z.string().datetime({ offset: true }),\n    account: ConnectAccount.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n    source: IntegrationSource.optional(),\n    error: z\n      .object({ code: opaqueId, message: z.string().max(2048), retryable: z.boolean() })\n      .strict()\n      .optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"integration\" &&\n      !value.integrationInstalled\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Complete setup requires an installed integration\",\n      });\n    }\n    if (\n      value.state === \"complete\" &&\n      value.completionRequirement === \"connection\" &&\n      !value.credentialsCommitted\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Connection setup requires committed credentials\",\n      });\n    }\n    if (\n      [\"complete\", \"cancelled\", \"expired\"].includes(value.state) &&\n      value.nextAction.type !== \"none\"\n    ) {\n      context.addIssue({ code: \"custom\", message: \"A terminal setup has no next action\" });\n    }\n  });\nexport type ConnectAttempt = z.infer<typeof ConnectAttempt>;\nexport const ConnectAdvance = z.discriminatedUnion(\"type\", [\n  z\n    .object({\n      type: z.literal(\"credentials\"),\n      values: z.record(z.string().max(256), z.string().max(16_384)),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"account\"), accountId: opaqueId }).strict(),\n  z.object({ type: z.literal(\"resources\"), resourceIds: z.array(opaqueId).max(1000) }).strict(),\n  z\n    .object({\n      type: z.literal(\"install\"),\n      previewId: opaqueId,\n      contentHash: opaqueId,\n      operationIds: z.array(opaqueId).max(2000),\n    })\n    .strict(),\n  z.object({ type: z.literal(\"retry\") }).strict(),\n]);\nexport type ConnectAdvance = z.infer<typeof ConnectAdvance>;\nexport const ConnectOperationRequest = z\n  .object({\n    expectedRevision: z.number().int().positive().safe(),\n    idempotencyKey: opaqueId,\n  })\n  .strict();\nexport const AdvanceConnectRequest = ConnectOperationRequest.extend({ action: ConnectAdvance });\nexport const BeginConnectRequest = z\n  .object({\n    providerId: opaqueId,\n    ownership: ConnectOwnership,\n    // URL parsing validates separately; never transform this original string.\n    returnUrl: z.string().min(1).max(4096),\n    idempotencyKey: opaqueId,\n    reconnectAccountId: opaqueId.optional(),\n    installationTarget: ConnectInstallationTarget.optional(),\n  })\n  .strict();\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAGlB,IAAM,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnC,IAAM,mBAAmB,EAAE,KAAK,CAAC,YAAY,WAAW,CAAC;AAEzD,IAAM,kBAAkB,EAC5B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,QAAQ;AAAA,EACR,WAAW,EAAE,KAAK,CAAC,aAAa,uBAAuB,iBAAiB,aAAa,CAAC;AAAA,EACtF,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC;AAAA,EAC1C,OAAO,EACJ;AAAA,IACC,EAAE,KAAK,CAAC,QAAQ,SAAS,eAAe,UAAU,gBAAgB,WAAW,SAAS,CAAC;AAAA,EACzF,EACC,IAAI,CAAC;AACV,CAAC,EACA,OAAO;AAEH,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,YAAY;AAAA,EACZ,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,EACzB,WAAW;AAAA,EACX,QAAQ,EAAE,KAAK,CAAC,aAAa,eAAe,UAAU,CAAC;AACzD,CAAC,EACA,OAAO;AAEH,IAAM,kBAAkB,EAC5B,OAAO,EAAE,IAAI,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,MAAM,SAAS,CAAC,EACnE,OAAO;AAEH,IAAM,oBAAoB,EAAE,mBAAmB,QAAQ;AAAA,EAC5D,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,KAAM,EAAE,CAAC,EAAE,OAAO;AAAA,EACrF,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EACL;AAAA,MACC,EACG,OAAO;AAAA,QACN,MAAM;AAAA,QACN,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,QACzB,UAAU,EAAE,QAAQ;AAAA,QACpB,QAAQ,EAAE,QAAQ;AAAA,QAClB,SAAS,EACN,MAAM,EAAE,OAAO,EAAE,OAAO,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,EACxE,IAAI,GAAI,EACR,SAAS;AAAA,MACd,CAAC,EACA,OAAO;AAAA,IACZ,EACC,IAAI,EAAE;AAAA,EACX,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,IAAI,GAAM;AAAA,IACjD,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACvC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACvD,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,GAAG,UAAU,EAAE,MAAM,cAAc,EAAE,IAAI,GAAG,EAAE,CAAC,EACxF,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,kBAAkB;AAAA,IAClC,WAAW,EAAE,MAAM,eAAe,EAAE,IAAI,GAAG;AAAA,IAC3C,QAAQ,EAAE,OAAO,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,YAAY,EAAE,MAAM,eAAe,EAAE,IAAI,GAAI;AAAA,EAC/C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAC/C,CAAC;AAEM,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,aAAa;AAAA,EACb,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,yBAAyB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,OAAO;AAEH,IAAM,sBAAsB,EAAE,KAAK;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AACM,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI;AAAA,EACJ,aAAa;AAAA,EACb,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpC,OAAO;AAAA,EACP,sBAAsB,EAAE,QAAQ;AAAA,EAChC,sBAAsB,EAAE,QAAQ;AAAA,EAChC,uBAAuB,EAAE,KAAK,CAAC,cAAc,eAAe,gBAAgB,CAAC;AAAA,EAC7E,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,SAAS,eAAe,SAAS;AAAA,EACjC,oBAAoB,0BAA0B,SAAS;AAAA,EACvD,QAAQ,kBAAkB,SAAS;AAAA,EACnC,OAAO,EACJ,OAAO,EAAE,MAAM,UAAU,SAAS,EAAE,OAAO,EAAE,IAAI,IAAI,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,EAChF,OAAO,EACP,SAAS;AACd,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,iBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,UAAU,cAChB,MAAM,0BAA0B,gBAChC,CAAC,MAAM,sBACP;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,CAAC,YAAY,aAAa,SAAS,EAAE,SAAS,MAAM,KAAK,KACzD,MAAM,WAAW,SAAS,QAC1B;AACA,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,sCAAsC,CAAC;AAAA,EACrF;AACF,CAAC;AAEI,IAAM,iBAAiB,EAAE,mBAAmB,QAAQ;AAAA,EACzD,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,aAAa;AAAA,IAC7B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,GAAG,GAAG,EAAE,OAAO,EAAE,IAAI,KAAM,CAAC;AAAA,EAC9D,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAS,GAAG,WAAW,SAAS,CAAC,EAAE,OAAO;AAAA,EACrE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,WAAW,GAAG,aAAa,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI,EAAE,CAAC,EAAE,OAAO;AAAA,EAC5F,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,WAAW;AAAA,IACX,aAAa;AAAA,IACb,cAAc,EAAE,MAAM,QAAQ,EAAE,IAAI,GAAI;AAAA,EAC1C,CAAC,EACA,OAAO;AAAA,EACV,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,CAAC,EAAE,OAAO;AAChD,CAAC;AAEM,IAAM,0BAA0B,EACpC,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACnD,gBAAgB;AAClB,CAAC,EACA,OAAO;AACH,IAAM,wBAAwB,wBAAwB,OAAO,EAAE,QAAQ,eAAe,CAAC;AACvF,IAAM,sBAAsB,EAChC,OAAO;AAAA,EACN,YAAY;AAAA,EACZ,WAAW;AAAA;AAAA,EAEX,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACrC,gBAAgB;AAAA,EAChB,oBAAoB,SAAS,SAAS;AAAA,EACtC,oBAAoB,0BAA0B,SAAS;AACzD,CAAC,EACA,OAAO;","names":[]}

package/dist/connection-authority.js

@@ -16,8 +16,9 @@ import {
   ListConnectionAuthoritiesQuery,
   ListConnectionAuthoritiesResponse,
   RevokeConnectionUseGrantQuery
-} from "./chunk-IRR7CBBW.js";
-import "./chunk-EHHDZLGY.js";
+} from "./chunk-GJ5SNVJW.js";
+import "./chunk-YRCMZTY2.js";
+import "./chunk-WBYTNVIW.js";
 import "./chunk-YBW5JSA3.js";
 import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";

package/dist/google-drive.js

@@ -1,6 +1,7 @@
 import {
   ConnectionMetadata
-} from "./chunk-EHHDZLGY.js";
+} from "./chunk-YRCMZTY2.js";
+import "./chunk-WBYTNVIW.js";
 import "./chunk-YBW5JSA3.js";
 import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";

package/dist/google-drive.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/google-drive.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\nimport {\n  ConnectorDocumentDestination,\n  ConnectorDocumentDestinationSelection,\n} from \"./connector-destinations\";\n\nexport const GOOGLE_DRIVE_PROVIDER_DOMAIN = \"googleapis.com\" as const;\nexport const GOOGLE_DRIVE_FULL_SCOPE = \"https://www.googleapis.com/auth/drive\" as const;\nexport const GOOGLE_DRIVE_FILE_SCOPE = \"https://www.googleapis.com/auth/drive.file\" as const;\nexport const GOOGLE_DRIVE_METADATA_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.metadata.readonly\" as const;\nexport const GOOGLE_DRIVE_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.readonly\" as const;\n/** Stable serialized role retained for existing connection rows; not product-facing copy. */\nexport const GOOGLE_DRIVE_CREDENTIAL_ROLE = \"google_drive_metadata\" as const;\nexport const GOOGLE_DRIVE_CREDENTIAL_LABEL = \"Google Drive read-only source sync\" as const;\nexport const GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL = \"Google Drive metadata browser\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_SERVER_ID = \"google-drive-publishing\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_TOOL_NAME = \"google_drive_publish_file\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION = \"create\" as const;\n\nexport const GoogleDriveOAuthCapability = z.enum([\n  \"picker_file_read\",\n  \"publish_file\",\n  \"source_metadata_discovery\",\n  \"source_content_read\",\n  \"recursive_source_sync\",\n]);\nexport type GoogleDriveOAuthCapability = z.infer<typeof GoogleDriveOAuthCapability>;\n\nexport type GoogleDriveOAuthScopeDecision = {\n  accessMode: \"file_only\" | \"metadata_readonly\" | \"readonly\" | null;\n  capabilities: GoogleDriveOAuthCapability[];\n};\n\n/**\n * Converts exact Google OAuth grants into the Drive capabilities OpenGeni may\n * rely on. Unknown or malformed grants add no authority. In particular,\n * drive.file covers only files explicitly opened or shared with the app and\n * never authorizes arbitrary recursive descendant discovery.\n */\nexport function googleDriveOAuthScopeDecision(\n  grantedScopes: readonly string[],\n): GoogleDriveOAuthScopeDecision {\n  const granted = new Set(grantedScopes);\n  const hasFullDrive = granted.has(GOOGLE_DRIVE_FULL_SCOPE);\n  const hasSourceContentRead = hasFullDrive || granted.has(GOOGLE_DRIVE_READONLY_SCOPE);\n  const hasFileWrite = hasFullDrive || granted.has(GOOGLE_DRIVE_FILE_SCOPE);\n  const hasSourceMetadataDiscovery =\n    hasSourceContentRead || granted.has(GOOGLE_DRIVE_METADATA_READONLY_SCOPE);\n  const hasPickerFileRead = hasSourceContentRead || hasFileWrite;\n  const capabilities: GoogleDriveOAuthCapability[] = [];\n  if (hasPickerFileRead) capabilities.push(\"picker_file_read\");\n  if (hasFileWrite) capabilities.push(\"publish_file\");\n  if (hasSourceMetadataDiscovery) capabilities.push(\"source_metadata_discovery\");\n  if (hasSourceContentRead) {\n    capabilities.push(\"source_content_read\", \"recursive_source_sync\");\n  }\n  return {\n    accessMode: hasSourceContentRead\n      ? \"readonly\"\n      : hasSourceMetadataDiscovery\n        ? \"metadata_readonly\"\n        : hasFileWrite\n          ? \"file_only\"\n          : null,\n    capabilities,\n  };\n}\n\nexport function googleDriveScopesAllowCapability(\n  grantedScopes: readonly string[],\n  capability: GoogleDriveOAuthCapability,\n): boolean {\n  return googleDriveOAuthScopeDecision(grantedScopes).capabilities.includes(capability);\n}\n\n/** @deprecated Connector document destinations use organization/workspace/personal authority. */\nexport const GoogleDriveTargetScope = z.enum([\"user\", \"workspace\", \"organization\"]);\nexport type GoogleDriveTargetScope = z.infer<typeof GoogleDriveTargetScope>;\n\nexport const GoogleDriveSyncCadence = z.enum([\"manual\", \"hourly\", \"daily\"]);\nexport type GoogleDriveSyncCadence = z.infer<typeof GoogleDriveSyncCadence>;\n\nexport const GoogleDriveReadPolicy = z.enum([\"allow\", \"ask\", \"block\"]);\nexport type GoogleDriveReadPolicy = z.infer<typeof GoogleDriveReadPolicy>;\n\nexport const GoogleDriveConnectionLifecycleState = z.enum([\n  \"active\",\n  \"paused\",\n  \"token_revoked\",\n  \"app_removed\",\n  \"disconnected\",\n  \"reconnect_required\",\n  \"reconsent_required\",\n]);\nexport type GoogleDriveConnectionLifecycleState = z.infer<\n  typeof GoogleDriveConnectionLifecycleState\n>;\n\nconst GoogleDriveLifecycleObservedAt = z.string().datetime({ offset: true });\nexport const GoogleDriveConnectionLifecycle = z.discriminatedUnion(\"state\", [\n  z.object({\n    state: z.literal(\"active\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"paused\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"token_revoked\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"app_removed\"),\n    recoverable: z.literal(false),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"disconnected\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconnect_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconsent_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n]);\nexport type GoogleDriveConnectionLifecycle = z.infer<typeof GoogleDriveConnectionLifecycle>;\n\nexport const GoogleDriveSelectedSource = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(256).nullable().default(null),\n  destination: ConnectorDocumentDestination.optional(),\n  /** @deprecated Missing destinations resolve to the current workspace boundary. */\n  targetScope: GoogleDriveTargetScope.optional(),\n  syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n  syncEnabled: z.boolean().default(false),\n  configGeneration: z.number().int().positive().default(1),\n  readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  selectedAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveSelectedSource = z.infer<typeof GoogleDriveSelectedSource>;\n\nexport const GoogleDriveOutputDestination = z\n  .object({\n    folderId: z.string().min(1).max(256),\n    folderName: z.string().min(1).max(1024),\n    driveId: z.string().min(1).max(256).nullable(),\n    location: z.enum([\"my_drive\", \"shared_drive\"]),\n    selectedAt: z.string().datetime({ offset: true }),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if ((value.location === \"my_drive\") !== (value.driveId === null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"driveId\"],\n        message: \"Google Drive destination location does not match its drive identity\",\n      });\n    }\n  });\nexport type GoogleDriveOutputDestination = z.infer<typeof GoogleDriveOutputDestination>;\n\nexport const GoogleDriveConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(GOOGLE_DRIVE_CREDENTIAL_ROLE),\n    credentialLabel: z.union([\n      z.literal(GOOGLE_DRIVE_CREDENTIAL_LABEL),\n      z.literal(GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL),\n    ]),\n    googlePermissionId: z.string().min(1).max(256),\n    googleEmail: z.string().email().max(320),\n    googleDisplayName: z.string().min(1).max(512).nullable(),\n    verifiedAt: z.string().datetime({ offset: true }),\n    accessMode: z.enum([\"file_only\", \"metadata_readonly\", \"readonly\"]),\n    lifecycle: GoogleDriveConnectionLifecycle.optional(),\n    outputDestination: GoogleDriveOutputDestination.optional(),\n    documentDestination: ConnectorDocumentDestination.optional(),\n    selectedSources: z.array(GoogleDriveSelectedSource).max(100).optional(),\n    /** @deprecated Read `selectedSources`; retained while existing connections migrate. */\n    selectedSource: GoogleDriveSelectedSource.nullable().optional(),\n  })\n  .passthrough();\nexport type GoogleDriveConnectionMetadata = z.infer<typeof GoogleDriveConnectionMetadata>;\n\nexport const GoogleDriveOAuthStartRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n  capability: z.enum([\"source_read\", \"publish\"]).default(\"source_read\"),\n});\nexport type GoogleDriveOAuthStartRequest = z.infer<typeof GoogleDriveOAuthStartRequest>;\n\nexport const GoogleDriveOAuthStartResponse = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveOAuthStartResponse = z.infer<typeof GoogleDriveOAuthStartResponse>;\n\nexport const GoogleDriveLifecycleActionRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  expectedVersion: z.number().int().positive(),\n});\nexport type GoogleDriveLifecycleActionRequest = z.infer<typeof GoogleDriveLifecycleActionRequest>;\n\nexport const GoogleDriveDisconnectRequest = z.object({\n  expectedVersion: z.number().int().positive(),\n  idempotencyKey: z.string().trim().min(1).max(200),\n});\nexport type GoogleDriveDisconnectRequest = z.infer<typeof GoogleDriveDisconnectRequest>;\n\nexport const GoogleDrivePublicationExportFile = z\n  .object({\n    fileId: z.string().uuid(),\n    filename: z.string().trim().min(1).max(512),\n    contentType: z.string().trim().min(1).max(256),\n    sizeBytes: z.number().int().positive(),\n    sha256: z.string().regex(/^[0-9a-f]{64}$/u),\n    artifactId: z.string().regex(/^[0-9a-f]{32}$/u),\n    versionId: z.string().regex(/^[0-9a-f]{32}$/u),\n    materializationJobId: z.string().regex(/^[0-9a-f]{32}$/u),\n    sourceHeadSequence: z.number().int().nonnegative(),\n    sourceStateHash: z.string().regex(/^sha256:[0-9a-f]{64}$/u),\n  })\n  .strict();\nexport type GoogleDrivePublicationExportFile = z.infer<typeof GoogleDrivePublicationExportFile>;\n\nexport const GoogleDrivePublicationToolInput = z\n  .object({\n    title: z.string().trim().min(1).max(512),\n    modality: z.enum([\"document\", \"spreadsheet\", \"presentation\"]),\n    file: GoogleDrivePublicationExportFile,\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type GoogleDrivePublicationToolInput = z.infer<typeof GoogleDrivePublicationToolInput>;\n\nexport const GoogleDrivePublicationReceipt = z\n  .object({\n    connectionId: z.string().uuid(),\n    providerFileId: z.string().min(1).max(256),\n    webViewLink: z.string().url(),\n    mimeType: z.enum([\n      \"application/vnd.google-apps.document\",\n      \"application/vnd.google-apps.spreadsheet\",\n      \"application/vnd.google-apps.presentation\",\n    ]),\n    destination: GoogleDriveOutputDestination,\n    replayed: z.boolean(),\n  })\n  .strict();\nexport type GoogleDrivePublicationReceipt = z.infer<typeof GoogleDrivePublicationReceipt>;\n\nexport const GoogleDriveBrowseItem = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  kind: z.enum([\"folder\", \"file\"]),\n  driveId: z.string().min(1).max(256).nullable(),\n  modifiedTime: z.string().datetime({ offset: true }).nullable(),\n  size: z.string().regex(/^\\d+$/).nullable(),\n  webViewLink: z.string().url().nullable(),\n});\nexport type GoogleDriveBrowseItem = z.infer<typeof GoogleDriveBrowseItem>;\n\nexport const GoogleDriveBrowseResponse = z.object({\n  connection: z.lazy(() => ConnectionMetadata),\n  parentId: z.string().min(1).max(256),\n  current: GoogleDriveBrowseItem.nullable(),\n  items: z.array(GoogleDriveBrowseItem),\n  nextPageToken: z.string().min(1).max(4096).nullable(),\n  incompleteSearch: z.boolean(),\n});\nexport type GoogleDriveBrowseResponse = z.infer<typeof GoogleDriveBrowseResponse>;\n\nconst GoogleDriveSourceSelection = z\n  .array(\n    GoogleDriveBrowseItem.pick({\n      id: true,\n      name: true,\n      mimeType: true,\n      driveId: true,\n    }),\n  )\n  .max(100)\n  .refine((sources) => new Set(sources.map((source) => source.id)).size === sources.length, {\n    message: \"Google Drive sources must be unique\",\n  });\n\nexport const SaveGoogleDriveSourceRequest = z\n  .object({\n    sources: GoogleDriveSourceSelection,\n    destination: ConnectorDocumentDestinationSelection.optional(),\n    /** @deprecated Legacy requests are accepted but resolve to workspace authority. */\n    targetScope: GoogleDriveTargetScope.optional(),\n    syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n    syncEnabled: z.boolean().default(false),\n    readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  })\n  .refine((request) => request.destination !== undefined || request.targetScope !== undefined, {\n    message: \"Google Drive document destination is required\",\n  });\nexport type SaveGoogleDriveSourceRequest = z.infer<typeof SaveGoogleDriveSourceRequest>;\n\nexport const GoogleDriveKnowledgeSourceItem = z.object({\n  id: z.string().min(1).max(512),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(512).optional(),\n  sourceKind: z.enum([\"my_drive\", \"shared_drive\", \"folder\"]),\n  includeDescendants: z.boolean(),\n});\nexport type GoogleDriveKnowledgeSourceItem = z.infer<typeof GoogleDriveKnowledgeSourceItem>;\n\nexport const GoogleDriveKnowledgeSourceDestination = z.object({\n  authorityKind: z.enum([\"organization\", \"workspace\", \"personal\"]),\n  authorityAccountId: z.string().min(1).max(128),\n  authorityWorkspaceId: z.string().min(1).max(128).optional(),\n  authoritySubjectId: z.string().min(1).max(512).optional(),\n  collectionId: z.string().min(1).max(512).optional(),\n});\nexport type GoogleDriveKnowledgeSourceDestination = z.infer<\n  typeof GoogleDriveKnowledgeSourceDestination\n>;\n\nexport const GoogleDriveKnowledgeSourceConfig = z.object({\n  sources: z.array(GoogleDriveKnowledgeSourceItem).min(1).max(100),\n  destination: GoogleDriveKnowledgeSourceDestination,\n  syncCadence: GoogleDriveSyncCadence,\n  readPolicy: GoogleDriveReadPolicy,\n});\nexport type GoogleDriveKnowledgeSourceConfig = z.infer<typeof GoogleDriveKnowledgeSourceConfig>;\n\nexport const SaveGoogleDriveIntegrationSourceRequest = z.intersection(\n  SaveGoogleDriveSourceRequest,\n  z.object({\n    sources: GoogleDriveSourceSelection.refine((sources) => sources.length > 0, {\n      message: \"At least one Google Drive source is required\",\n    }),\n    expectedVersion: z.number().int().positive().optional(),\n    idempotencyKey: z.string().uuid(),\n  }),\n);\nexport type SaveGoogleDriveIntegrationSourceRequest = z.infer<\n  typeof SaveGoogleDriveIntegrationSourceRequest\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,+BAA+B;AACrC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAChC,IAAM,uCACX;AACK,IAAM,8BACX;AAEK,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,uCAAuC;AAC7C,IAAM,qCAAqC;AAC3C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,KAAK;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,8BACd,eAC+B;AAC/B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,eAAe,QAAQ,IAAI,uBAAuB;AACxD,QAAM,uBAAuB,gBAAgB,QAAQ,IAAI,2BAA2B;AACpF,QAAM,eAAe,gBAAgB,QAAQ,IAAI,uBAAuB;AACxE,QAAM,6BACJ,wBAAwB,QAAQ,IAAI,oCAAoC;AAC1E,QAAM,oBAAoB,wBAAwB;AAClD,QAAM,eAA6C,CAAC;AACpD,MAAI,kBAAmB,cAAa,KAAK,kBAAkB;AAC3D,MAAI,aAAc,cAAa,KAAK,cAAc;AAClD,MAAI,2BAA4B,cAAa,KAAK,2BAA2B;AAC7E,MAAI,sBAAsB;AACxB,iBAAa,KAAK,uBAAuB,uBAAuB;AAAA,EAClE;AACA,SAAO;AAAA,IACL,YAAY,uBACR,aACA,6BACE,sBACA,eACE,cACA;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,iCACd,eACA,YACS;AACT,SAAO,8BAA8B,aAAa,EAAE,aAAa,SAAS,UAAU;AACtF;AAGO,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAG3E,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC;AAGnE,IAAM,wBAAwB,EAAE,KAAK,CAAC,SAAS,OAAO,OAAO,CAAC;AAG9D,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACpE,IAAM,iCAAiC,EAAE,mBAAmB,SAAS;AAAA,EAC1E,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,eAAe;AAAA,IAChC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,aAAa;AAAA,IAC9B,aAAa,EAAE,QAAQ,KAAK;AAAA,IAC5B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,cAAc;AAAA,IAC/B,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,aAAa,6BAA6B,SAAS;AAAA;AAAA,EAEnD,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EACvD,YAAY,sBAAsB,QAAQ,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,KAAK,CAAC,YAAY,cAAc,CAAC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAK,MAAM,aAAa,gBAAiB,MAAM,YAAY,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,4BAA4B;AAAA,EACtD,iBAAiB,EAAE,MAAM;AAAA,IACvB,EAAE,QAAQ,6BAA6B;AAAA,IACvC,EAAE,QAAQ,oCAAoC;AAAA,EAChD,CAAC;AAAA,EACD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,YAAY,EAAE,KAAK,CAAC,aAAa,qBAAqB,UAAU,CAAC;AAAA,EACjE,WAAW,+BAA+B,SAAS;AAAA,EACnD,mBAAmB,6BAA6B,SAAS;AAAA,EACzD,qBAAqB,6BAA6B,SAAS;AAAA,EAC3D,iBAAiB,EAAE,MAAM,yBAAyB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgB,0BAA0B,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,YAAY;AAGR,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,KAAK,CAAC,eAAe,SAAS,CAAC,EAAE,QAAQ,aAAa;AACtE,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC;AAGM,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACxD,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,MAAM,wBAAwB;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,UAAU,EAAE,KAAK,CAAC,YAAY,eAAe,cAAc,CAAC;AAAA,EAC5D,MAAM;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,aAAa;AAAA,EACb,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,OAAO;AAGH,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,YAAY,EAAE,KAAK,MAAM,kBAAkB;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,sBAAsB,SAAS;AAAA,EACxC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACpD,kBAAkB,EAAE,QAAQ;AAC9B,CAAC;AAGD,IAAM,6BAA6B,EAChC;AAAA,EACC,sBAAsB,KAAK;AAAA,IACzB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACH,EACC,IAAI,GAAG,EACP,OAAO,CAAC,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACxF,SAAS;AACX,CAAC;AAEI,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,aAAa,sCAAsC,SAAS;AAAA;AAAA,EAE5D,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,YAAY,sBAAsB,QAAQ,OAAO;AACnD,CAAC,EACA,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAa,QAAQ,gBAAgB,QAAW;AAAA,EAC3F,SAAS;AACX,CAAC;AAGI,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,KAAK,CAAC,YAAY,gBAAgB,QAAQ,CAAC;AAAA,EACzD,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAGM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,aAAa,UAAU,CAAC;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC;AAKM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,MAAM,8BAA8B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/D,aAAa;AAAA,EACb,aAAa;AAAA,EACb,YAAY;AACd,CAAC;AAGM,IAAM,0CAA0C,EAAE;AAAA,EACvD;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,2BAA2B,OAAO,CAAC,YAAY,QAAQ,SAAS,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX,CAAC;AAAA,IACD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,CAAC;AACH;","names":[]}
+{"version":3,"sources":["../src/google-drive.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\nimport {\n  ConnectorDocumentDestination,\n  ConnectorDocumentDestinationSelection,\n} from \"./connector-destinations\";\n\nexport const GOOGLE_DRIVE_PROVIDER_DOMAIN = \"googleapis.com\" as const;\nexport const GOOGLE_DRIVE_FULL_SCOPE = \"https://www.googleapis.com/auth/drive\" as const;\nexport const GOOGLE_DRIVE_FILE_SCOPE = \"https://www.googleapis.com/auth/drive.file\" as const;\nexport const GOOGLE_DRIVE_METADATA_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.metadata.readonly\" as const;\nexport const GOOGLE_DRIVE_READONLY_SCOPE =\n  \"https://www.googleapis.com/auth/drive.readonly\" as const;\n/** Stable serialized role retained for existing connection rows; not product-facing copy. */\nexport const GOOGLE_DRIVE_CREDENTIAL_ROLE = \"google_drive_metadata\" as const;\nexport const GOOGLE_DRIVE_CREDENTIAL_LABEL = \"Google Drive read-only source sync\" as const;\nexport const GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL = \"Google Drive metadata browser\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_SERVER_ID = \"google-drive-publishing\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_TOOL_NAME = \"google_drive_publish_file\" as const;\nexport const GOOGLE_DRIVE_PUBLICATION_CREATE_ACTION = \"create\" as const;\n\nexport const GoogleDriveOAuthCapability = z.enum([\n  \"picker_file_read\",\n  \"publish_file\",\n  \"source_metadata_discovery\",\n  \"source_content_read\",\n  \"recursive_source_sync\",\n]);\nexport type GoogleDriveOAuthCapability = z.infer<typeof GoogleDriveOAuthCapability>;\n\nexport type GoogleDriveOAuthScopeDecision = {\n  accessMode: \"file_only\" | \"metadata_readonly\" | \"readonly\" | null;\n  capabilities: GoogleDriveOAuthCapability[];\n};\n\n/**\n * Converts exact Google OAuth grants into the Drive capabilities OpenGeni may\n * rely on. Unknown or malformed grants add no authority. In particular,\n * drive.file covers only files explicitly opened or shared with the app and\n * never authorizes arbitrary recursive descendant discovery.\n */\nexport function googleDriveOAuthScopeDecision(\n  grantedScopes: readonly string[],\n): GoogleDriveOAuthScopeDecision {\n  const granted = new Set(grantedScopes);\n  const hasFullDrive = granted.has(GOOGLE_DRIVE_FULL_SCOPE);\n  const hasSourceContentRead = hasFullDrive || granted.has(GOOGLE_DRIVE_READONLY_SCOPE);\n  const hasFileWrite = hasFullDrive || granted.has(GOOGLE_DRIVE_FILE_SCOPE);\n  const hasSourceMetadataDiscovery =\n    hasSourceContentRead || granted.has(GOOGLE_DRIVE_METADATA_READONLY_SCOPE);\n  const hasPickerFileRead = hasSourceContentRead || hasFileWrite;\n  const capabilities: GoogleDriveOAuthCapability[] = [];\n  if (hasPickerFileRead) capabilities.push(\"picker_file_read\");\n  if (hasFileWrite) capabilities.push(\"publish_file\");\n  if (hasSourceMetadataDiscovery) capabilities.push(\"source_metadata_discovery\");\n  if (hasSourceContentRead) {\n    capabilities.push(\"source_content_read\", \"recursive_source_sync\");\n  }\n  return {\n    accessMode: hasSourceContentRead\n      ? \"readonly\"\n      : hasSourceMetadataDiscovery\n        ? \"metadata_readonly\"\n        : hasFileWrite\n          ? \"file_only\"\n          : null,\n    capabilities,\n  };\n}\n\nexport function googleDriveScopesAllowCapability(\n  grantedScopes: readonly string[],\n  capability: GoogleDriveOAuthCapability,\n): boolean {\n  return googleDriveOAuthScopeDecision(grantedScopes).capabilities.includes(capability);\n}\n\n/** @deprecated Connector document destinations use organization/workspace/personal authority. */\nexport const GoogleDriveTargetScope = z.enum([\"user\", \"workspace\", \"organization\"]);\nexport type GoogleDriveTargetScope = z.infer<typeof GoogleDriveTargetScope>;\n\nexport const GoogleDriveSyncCadence = z.enum([\"manual\", \"hourly\", \"daily\"]);\nexport type GoogleDriveSyncCadence = z.infer<typeof GoogleDriveSyncCadence>;\n\nexport const GoogleDriveReadPolicy = z.enum([\"allow\", \"ask\", \"block\"]);\nexport type GoogleDriveReadPolicy = z.infer<typeof GoogleDriveReadPolicy>;\n\nexport const GoogleDriveConnectionLifecycleState = z.enum([\n  \"active\",\n  \"paused\",\n  \"token_revoked\",\n  \"app_removed\",\n  \"disconnected\",\n  \"reconnect_required\",\n  \"reconsent_required\",\n]);\nexport type GoogleDriveConnectionLifecycleState = z.infer<\n  typeof GoogleDriveConnectionLifecycleState\n>;\n\nconst GoogleDriveLifecycleObservedAt = z.string().datetime({ offset: true });\nexport const GoogleDriveConnectionLifecycle = z.discriminatedUnion(\"state\", [\n  z.object({\n    state: z.literal(\"active\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"paused\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"token_revoked\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"app_removed\"),\n    recoverable: z.literal(false),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"disconnected\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconnect_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n  z.object({\n    state: z.literal(\"reconsent_required\"),\n    recoverable: z.literal(true),\n    observedAt: GoogleDriveLifecycleObservedAt,\n  }),\n]);\nexport type GoogleDriveConnectionLifecycle = z.infer<typeof GoogleDriveConnectionLifecycle>;\n\nexport const GoogleDriveSelectedSource = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(256).nullable().default(null),\n  destination: ConnectorDocumentDestination.optional(),\n  /** @deprecated Missing destinations resolve to the current workspace boundary. */\n  targetScope: GoogleDriveTargetScope.optional(),\n  syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n  syncEnabled: z.boolean().default(false),\n  configGeneration: z.number().int().positive().default(1),\n  readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  selectedAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveSelectedSource = z.infer<typeof GoogleDriveSelectedSource>;\n\nexport const GoogleDriveOutputDestination = z\n  .object({\n    folderId: z.string().min(1).max(256),\n    folderName: z.string().min(1).max(1024),\n    driveId: z.string().min(1).max(256).nullable(),\n    location: z.enum([\"my_drive\", \"shared_drive\"]),\n    selectedAt: z.string().datetime({ offset: true }),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if ((value.location === \"my_drive\") !== (value.driveId === null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"driveId\"],\n        message: \"Google Drive destination location does not match its drive identity\",\n      });\n    }\n  });\nexport type GoogleDriveOutputDestination = z.infer<typeof GoogleDriveOutputDestination>;\n\nexport const GoogleDriveConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(GOOGLE_DRIVE_CREDENTIAL_ROLE),\n    credentialLabel: z.union([\n      z.literal(GOOGLE_DRIVE_CREDENTIAL_LABEL),\n      z.literal(GOOGLE_DRIVE_LEGACY_CREDENTIAL_LABEL),\n    ]),\n    googlePermissionId: z.string().min(1).max(256),\n    googleEmail: z.string().email().max(320),\n    googleDisplayName: z.string().min(1).max(512).nullable(),\n    verifiedAt: z.string().datetime({ offset: true }),\n    accessMode: z.enum([\"file_only\", \"metadata_readonly\", \"readonly\"]),\n    lifecycle: GoogleDriveConnectionLifecycle.optional(),\n    outputDestination: GoogleDriveOutputDestination.optional(),\n    documentDestination: ConnectorDocumentDestination.optional(),\n    selectedSources: z.array(GoogleDriveSelectedSource).max(100).optional(),\n    /** @deprecated Read `selectedSources`; retained while existing connections migrate. */\n    selectedSource: GoogleDriveSelectedSource.nullable().optional(),\n  })\n  .passthrough();\nexport type GoogleDriveConnectionMetadata = z.infer<typeof GoogleDriveConnectionMetadata>;\n\nexport const GoogleDriveOAuthStartRequest = z.object({\n  connectionId: z.string().uuid().optional(),\n  capability: z.enum([\"source_read\", \"publish\"]).default(\"source_read\"),\n});\nexport type GoogleDriveOAuthStartRequest = z.infer<typeof GoogleDriveOAuthStartRequest>;\n\nexport const GoogleDriveOAuthStartResponse = z.object({\n  authorizationUrl: z.string().url(),\n  expiresAt: z.string().datetime({ offset: true }),\n});\nexport type GoogleDriveOAuthStartResponse = z.infer<typeof GoogleDriveOAuthStartResponse>;\n\nexport const GoogleDriveLifecycleActionRequest = z.object({\n  action: z.enum([\"pause\", \"resume\"]),\n  expectedVersion: z.number().int().positive(),\n});\nexport type GoogleDriveLifecycleActionRequest = z.infer<typeof GoogleDriveLifecycleActionRequest>;\n\nexport const GoogleDriveDisconnectRequest = z.object({\n  expectedVersion: z.number().int().positive(),\n  idempotencyKey: z.string().trim().min(1).max(200),\n});\nexport type GoogleDriveDisconnectRequest = z.infer<typeof GoogleDriveDisconnectRequest>;\n\nexport const GoogleDrivePublicationExportFile = z\n  .object({\n    fileId: z.string().uuid(),\n    filename: z.string().trim().min(1).max(512),\n    contentType: z.string().trim().min(1).max(256),\n    sizeBytes: z.number().int().positive(),\n    sha256: z.string().regex(/^[0-9a-f]{64}$/u),\n    artifactId: z.string().regex(/^[0-9a-f]{32}$/u),\n    versionId: z.string().regex(/^[0-9a-f]{32}$/u),\n    materializationJobId: z.string().regex(/^[0-9a-f]{32}$/u),\n    sourceHeadSequence: z.number().int().nonnegative(),\n    sourceStateHash: z.string().regex(/^sha256:[0-9a-f]{64}$/u),\n  })\n  .strict();\nexport type GoogleDrivePublicationExportFile = z.infer<typeof GoogleDrivePublicationExportFile>;\n\nexport const GoogleDrivePublicationToolInput = z\n  .object({\n    title: z.string().trim().min(1).max(512),\n    modality: z.enum([\"document\", \"spreadsheet\", \"presentation\"]),\n    file: GoogleDrivePublicationExportFile,\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type GoogleDrivePublicationToolInput = z.infer<typeof GoogleDrivePublicationToolInput>;\n\nexport const GoogleDrivePublicationReceipt = z\n  .object({\n    connectionId: z.string().uuid(),\n    providerFileId: z.string().min(1).max(256),\n    webViewLink: z.string().url(),\n    mimeType: z.enum([\n      \"application/vnd.google-apps.document\",\n      \"application/vnd.google-apps.spreadsheet\",\n      \"application/vnd.google-apps.presentation\",\n    ]),\n    destination: GoogleDriveOutputDestination,\n    replayed: z.boolean(),\n  })\n  .strict();\nexport type GoogleDrivePublicationReceipt = z.infer<typeof GoogleDrivePublicationReceipt>;\n\nexport const GoogleDriveBrowseItem = z.object({\n  id: z.string().min(1).max(256),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  kind: z.enum([\"folder\", \"file\"]),\n  driveId: z.string().min(1).max(256).nullable(),\n  modifiedTime: z.string().datetime({ offset: true }).nullable(),\n  size: z.string().regex(/^\\d+$/).nullable(),\n  webViewLink: z.string().url().nullable(),\n});\nexport type GoogleDriveBrowseItem = z.infer<typeof GoogleDriveBrowseItem>;\n\nexport const GoogleDriveBrowseResponse = z.object({\n  connection: z.lazy(() => ConnectionMetadata),\n  parentId: z.string().min(1).max(256),\n  current: GoogleDriveBrowseItem.nullable(),\n  items: z.array(GoogleDriveBrowseItem),\n  nextPageToken: z.string().min(1).max(4096).nullable(),\n  incompleteSearch: z.boolean(),\n});\nexport type GoogleDriveBrowseResponse = z.infer<typeof GoogleDriveBrowseResponse>;\n\nconst GoogleDriveSourceSelection = z\n  .array(\n    GoogleDriveBrowseItem.pick({\n      id: true,\n      name: true,\n      mimeType: true,\n      driveId: true,\n    }),\n  )\n  .max(100)\n  .refine((sources) => new Set(sources.map((source) => source.id)).size === sources.length, {\n    message: \"Google Drive sources must be unique\",\n  });\n\nexport const SaveGoogleDriveSourceRequest = z\n  .object({\n    sources: GoogleDriveSourceSelection,\n    destination: ConnectorDocumentDestinationSelection.optional(),\n    /** @deprecated Legacy requests are accepted but resolve to workspace authority. */\n    targetScope: GoogleDriveTargetScope.optional(),\n    syncCadence: GoogleDriveSyncCadence.default(\"hourly\"),\n    syncEnabled: z.boolean().default(false),\n    readPolicy: GoogleDriveReadPolicy.default(\"allow\"),\n  })\n  .refine((request) => request.destination !== undefined || request.targetScope !== undefined, {\n    message: \"Google Drive document destination is required\",\n  });\nexport type SaveGoogleDriveSourceRequest = z.infer<typeof SaveGoogleDriveSourceRequest>;\n\nexport const GoogleDriveKnowledgeSourceItem = z.object({\n  id: z.string().min(1).max(512),\n  name: z.string().min(1).max(1024),\n  mimeType: z.string().min(1).max(256),\n  driveId: z.string().min(1).max(512).optional(),\n  sourceKind: z.enum([\"my_drive\", \"shared_drive\", \"folder\"]),\n  includeDescendants: z.boolean(),\n});\nexport type GoogleDriveKnowledgeSourceItem = z.infer<typeof GoogleDriveKnowledgeSourceItem>;\n\nexport const GoogleDriveKnowledgeSourceDestination = z.object({\n  authorityKind: z.enum([\"organization\", \"workspace\", \"personal\"]),\n  authorityAccountId: z.string().min(1).max(128),\n  authorityWorkspaceId: z.string().min(1).max(128).optional(),\n  authoritySubjectId: z.string().min(1).max(512).optional(),\n  collectionId: z.string().min(1).max(512).optional(),\n});\nexport type GoogleDriveKnowledgeSourceDestination = z.infer<\n  typeof GoogleDriveKnowledgeSourceDestination\n>;\n\nexport const GoogleDriveKnowledgeSourceConfig = z.object({\n  sources: z.array(GoogleDriveKnowledgeSourceItem).min(1).max(100),\n  destination: GoogleDriveKnowledgeSourceDestination,\n  syncCadence: GoogleDriveSyncCadence,\n  readPolicy: GoogleDriveReadPolicy,\n});\nexport type GoogleDriveKnowledgeSourceConfig = z.infer<typeof GoogleDriveKnowledgeSourceConfig>;\n\nexport const SaveGoogleDriveIntegrationSourceRequest = z.intersection(\n  SaveGoogleDriveSourceRequest,\n  z.object({\n    sources: GoogleDriveSourceSelection.refine((sources) => sources.length > 0, {\n      message: \"At least one Google Drive source is required\",\n    }),\n    expectedVersion: z.number().int().positive().optional(),\n    idempotencyKey: z.string().uuid(),\n  }),\n);\nexport type SaveGoogleDriveIntegrationSourceRequest = z.infer<\n  typeof SaveGoogleDriveIntegrationSourceRequest\n>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,+BAA+B;AACrC,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AAChC,IAAM,uCACX;AACK,IAAM,8BACX;AAEK,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AACtC,IAAM,uCAAuC;AAC7C,IAAM,qCAAqC;AAC3C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,KAAK;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,SAAS,8BACd,eAC+B;AAC/B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,eAAe,QAAQ,IAAI,uBAAuB;AACxD,QAAM,uBAAuB,gBAAgB,QAAQ,IAAI,2BAA2B;AACpF,QAAM,eAAe,gBAAgB,QAAQ,IAAI,uBAAuB;AACxE,QAAM,6BACJ,wBAAwB,QAAQ,IAAI,oCAAoC;AAC1E,QAAM,oBAAoB,wBAAwB;AAClD,QAAM,eAA6C,CAAC;AACpD,MAAI,kBAAmB,cAAa,KAAK,kBAAkB;AAC3D,MAAI,aAAc,cAAa,KAAK,cAAc;AAClD,MAAI,2BAA4B,cAAa,KAAK,2BAA2B;AAC7E,MAAI,sBAAsB;AACxB,iBAAa,KAAK,uBAAuB,uBAAuB;AAAA,EAClE;AACA,SAAO;AAAA,IACL,YAAY,uBACR,aACA,6BACE,sBACA,eACE,cACA;AAAA,IACR;AAAA,EACF;AACF;AAEO,SAAS,iCACd,eACA,YACS;AACT,SAAO,8BAA8B,aAAa,EAAE,aAAa,SAAS,UAAU;AACtF;AAGO,IAAM,yBAAyB,EAAE,KAAK,CAAC,QAAQ,aAAa,cAAc,CAAC;AAG3E,IAAM,yBAAyB,EAAE,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC;AAGnE,IAAM,wBAAwB,EAAE,KAAK,CAAC,SAAS,OAAO,OAAO,CAAC;AAG9D,IAAM,sCAAsC,EAAE,KAAK;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKD,IAAM,iCAAiC,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACpE,IAAM,iCAAiC,EAAE,mBAAmB,SAAS;AAAA,EAC1E,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,QAAQ;AAAA,IACzB,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,eAAe;AAAA,IAChC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,aAAa;AAAA,IAC9B,aAAa,EAAE,QAAQ,KAAK;AAAA,IAC5B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,cAAc;AAAA,IAC/B,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,OAAO,EAAE,QAAQ,oBAAoB;AAAA,IACrC,aAAa,EAAE,QAAQ,IAAI;AAAA,IAC3B,YAAY;AAAA,EACd,CAAC;AACH,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EAC3D,aAAa,6BAA6B,SAAS;AAAA;AAAA,EAEnD,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;AAAA,EACvD,YAAY,sBAAsB,QAAQ,OAAO;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,UAAU,EAAE,KAAK,CAAC,YAAY,cAAc,CAAC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAK,MAAM,aAAa,gBAAiB,MAAM,YAAY,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,4BAA4B;AAAA,EACtD,iBAAiB,EAAE,MAAM;AAAA,IACvB,EAAE,QAAQ,6BAA6B;AAAA,IACvC,EAAE,QAAQ,oCAAoC;AAAA,EAChD,CAAC;AAAA,EACD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG;AAAA,EACvC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACvD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,YAAY,EAAE,KAAK,CAAC,aAAa,qBAAqB,UAAU,CAAC;AAAA,EACjE,WAAW,+BAA+B,SAAS;AAAA,EACnD,mBAAmB,6BAA6B,SAAS;AAAA,EACzD,qBAAqB,6BAA6B,SAAS;AAAA,EAC3D,iBAAiB,EAAE,MAAM,yBAAyB,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAEtE,gBAAgB,0BAA0B,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,YAAY;AAGR,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACzC,YAAY,EAAE,KAAK,CAAC,eAAe,SAAS,CAAC,EAAE,QAAQ,aAAa;AACtE,CAAC;AAGM,IAAM,gCAAgC,EAAE,OAAO;AAAA,EACpD,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC;AAGM,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AAAA,EAClC,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAC7C,CAAC;AAGM,IAAM,+BAA+B,EAAE,OAAO;AAAA,EACnD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC;AAGM,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACrC,QAAQ,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC1C,YAAY,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC9C,WAAW,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACxD,oBAAoB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACjD,iBAAiB,EAAE,OAAO,EAAE,MAAM,wBAAwB;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACvC,UAAU,EAAE,KAAK,CAAC,YAAY,eAAe,cAAc,CAAC;AAAA,EAC5D,MAAM;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI;AAAA,EAC5B,UAAU,EAAE,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,aAAa;AAAA,EACb,UAAU,EAAE,QAAQ;AACtB,CAAC,EACA,OAAO;AAGH,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,MAAM,EAAE,KAAK,CAAC,UAAU,MAAM,CAAC;AAAA,EAC/B,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAAA,EAC7D,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACzC,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACzC,CAAC;AAGM,IAAM,4BAA4B,EAAE,OAAO;AAAA,EAChD,YAAY,EAAE,KAAK,MAAM,kBAAkB;AAAA,EAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,sBAAsB,SAAS;AAAA,EACxC,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACpC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EACpD,kBAAkB,EAAE,QAAQ;AAC9B,CAAC;AAGD,IAAM,6BAA6B,EAChC;AAAA,EACC,sBAAsB,KAAK;AAAA,IACzB,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACH,EACC,IAAI,GAAG,EACP,OAAO,CAAC,YAAY,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,EAAE,SAAS,QAAQ,QAAQ;AAAA,EACxF,SAAS;AACX,CAAC;AAEI,IAAM,+BAA+B,EACzC,OAAO;AAAA,EACN,SAAS;AAAA,EACT,aAAa,sCAAsC,SAAS;AAAA;AAAA,EAE5D,aAAa,uBAAuB,SAAS;AAAA,EAC7C,aAAa,uBAAuB,QAAQ,QAAQ;AAAA,EACpD,aAAa,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAAA,EACtC,YAAY,sBAAsB,QAAQ,OAAO;AACnD,CAAC,EACA,OAAO,CAAC,YAAY,QAAQ,gBAAgB,UAAa,QAAQ,gBAAgB,QAAW;AAAA,EAC3F,SAAS;AACX,CAAC;AAGI,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7B,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,YAAY,EAAE,KAAK,CAAC,YAAY,gBAAgB,QAAQ,CAAC;AAAA,EACzD,oBAAoB,EAAE,QAAQ;AAChC,CAAC;AAGM,IAAM,wCAAwC,EAAE,OAAO;AAAA,EAC5D,eAAe,EAAE,KAAK,CAAC,gBAAgB,aAAa,UAAU,CAAC;AAAA,EAC/D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,sBAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC1D,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxD,cAAc,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpD,CAAC;AAKM,IAAM,mCAAmC,EAAE,OAAO;AAAA,EACvD,SAAS,EAAE,MAAM,8BAA8B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC/D,aAAa;AAAA,EACb,aAAa;AAAA,EACb,YAAY;AACd,CAAC;AAGM,IAAM,0CAA0C,EAAE;AAAA,EACvD;AAAA,EACA,EAAE,OAAO;AAAA,IACP,SAAS,2BAA2B,OAAO,CAAC,YAAY,QAAQ,SAAS,GAAG;AAAA,MAC1E,SAAS;AAAA,IACX,CAAC;AAAA,IACD,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IACtD,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAClC,CAAC;AACH;","names":[]}

package/dist/host-mcp-bindings.js

@@ -1,12 +1,13 @@
 import {
   ConnectionUseAuthoritySnapshot,
   IssueConnectionUseGrantRequest
-} from "./chunk-IRR7CBBW.js";
+} from "./chunk-GJ5SNVJW.js";
 import {
   HostMcpCreateSelections,
   McpServerConnectionRef,
   SessionTenancyVisibility
-} from "./chunk-EHHDZLGY.js";
+} from "./chunk-YRCMZTY2.js";
+import "./chunk-WBYTNVIW.js";
 import "./chunk-YBW5JSA3.js";
 import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";

package/dist/host-mcp-bindings.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport { McpServerConnectionRef, SessionTenancyVisibility } from \"./index\";\nimport {\n  ConnectionUseAuthoritySnapshot,\n  IssueConnectionUseGrantRequest,\n} from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = z.union([\n  ExternalIdentity.shape.subjectId,\n  z\n    .string()\n    .max(4096)\n    .regex(/^user:[^\\r\\n\\u0000]+$/),\n]);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = z\n  .object({\n    serverId: z.string().min(1).max(256),\n    destinationUrl: z\n      .string()\n      .url()\n      .max(4096)\n      .refine((value) => {\n        const url = new URL(value);\n        return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n      }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n      .transform((value) => new URL(value).toString()),\n    connectionRef: McpServerConnectionRef,\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.connectionRef.hostBinding)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\", \"hostBinding\"],\n        message: \"A binding definition cannot reference another binding\",\n      });\n    if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\"],\n        message: \"Explicit host connection authority is required\",\n      });\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n      context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n  });\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\nexport const HostMcpBinding = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    authorizationRevision: z.number().int().positive().safe(),\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    definition: HostMcpBindingDefinition,\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    definition: HostMcpBindingDefinition,\n  })\n  .strict();\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = IssueConnectionUseGrantRequest.superRefine((value, context) => {\n  if (\n    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n  ) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"Host session grants require a matching safe authority epoch\",\n    });\n  }\n});\nexport const IssueHostMcpDelegationRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    bindingId: z.string().uuid(),\n    expectedBindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n  })\n  .strict();\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive().safe(),\n    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    scheduledOrigin: z\n      .object({\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive().safe(),\n        runId: z.string().uuid(),\n      })\n      .strict()\n      .optional(),\n    source: z.discriminatedUnion(\"kind\", [\n      z.object({ kind: z.literal(\"direct\") }).strict(),\n      z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n      z\n        .object({\n          kind: z.literal(\"child_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n      z\n        .object({\n          kind: z.literal(\"inherited_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n    ]),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n      (value.source.kind === \"scheduled_task\" &&\n        (!value.scheduledOrigin ||\n          value.acceptedWork.kind !== \"scheduled_task\" ||\n          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n          value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))\n    )\n      context.addIssue({\n        code: \"custom\",\n        message: \"Scheduled host authority must retain its exact run origin\",\n      });\n    if (\n      value.acceptedWork.kind === \"turn\" &&\n      value.source.kind === \"inherited_turn\" &&\n      value.acceptedWork.turnId === value.source.turnId\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"source\"],\n        message: \"Accepted work cannot inherit from itself\",\n      });\n    }\n    if (\n      value.acceptedWork.kind === \"scheduled_task\" &&\n      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptedWork\"],\n        message: \"Task authority revision must be a safe integer\",\n      });\n    }\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n      context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n    }\n  });\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    taskId: z.string().uuid(),\n    taskAuthorityRevision: z.number().int().positive().safe(),\n    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    context: SessionTenancyVisibility,\n  })\n  .strict();\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,iBAAiB,MAAM;AAAA,EACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAClC,CAAC;AAGM,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,EACjD,eAAe;AACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,cAAc;AACtB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,MACrC,SAAS;AAAA,IACX,CAAC;AACH,MAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AACH,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAC1F,CAAC;AAGI,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY;AACd,CAAC,EACA,OAAO;AAIV,IAAM,yBAAyB,+BAA+B,YAAY,CAAC,OAAO,YAAY;AAC5F,MACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AACM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC5D,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7D,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,OAAO;AAAA,EACP,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAQH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC9D,cAAc,+BAA+B,MAAM;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,iBAAiB,EACd,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,IACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,IACvD,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,YAAY;AAAA,MAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BAA0B,MAAM,aAAa;AAEvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACH,MACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EACxF;AACF,CAAC;AAII,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACtD,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC,EACA,OAAO;","names":[]}
+{"version":3,"sources":["../src/host-mcp-bindings.ts"],"sourcesContent":["import { z } from \"zod\";\nexport { HostMcpCreateSelections, type HostMcpCreateSelection } from \"./index\";\nimport { McpServerConnectionRef, SessionTenancyVisibility } from \"./index\";\nimport {\n  ConnectionUseAuthoritySnapshot,\n  IssueConnectionUseGrantRequest,\n} from \"./connection-authority\";\nimport { ExternalIdentity } from \"./external-identities\";\nexport const HostMcpOwnerSubject = z.union([\n  ExternalIdentity.shape.subjectId,\n  z\n    .string()\n    .max(4096)\n    .regex(/^user:[^\\r\\n\\u0000]+$/),\n]);\n\n/** Credential-free, immutable destination and host connection selection. */\nexport const HostMcpBindingDefinition = z\n  .object({\n    serverId: z.string().min(1).max(256),\n    destinationUrl: z\n      .string()\n      .url()\n      .max(4096)\n      .refine((value) => {\n        const url = new URL(value);\n        return url.protocol === \"https:\" && !url.username && !url.password && !url.hash;\n      }, \"Host binding requires an HTTPS destination without userinfo or fragment\")\n      .transform((value) => new URL(value).toString()),\n    connectionRef: McpServerConnectionRef,\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.connectionRef.hostBinding)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\", \"hostBinding\"],\n        message: \"A binding definition cannot reference another binding\",\n      });\n    if (value.connectionRef.authoritySource !== \"host\" || !value.connectionRef.connectionId)\n      context.addIssue({\n        code: \"custom\",\n        path: [\"connectionRef\"],\n        message: \"Explicit host connection authority is required\",\n      });\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536)\n      context.addIssue({ code: \"custom\", message: \"Host binding definition exceeds 64 KiB\" });\n  });\nexport type HostMcpBindingDefinition = z.infer<typeof HostMcpBindingDefinition>;\n\nexport const HostMcpBinding = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    authorizationRevision: z.number().int().positive().safe(),\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    definition: HostMcpBindingDefinition,\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpBinding = z.infer<typeof HostMcpBinding>;\n\nexport const CreateHostMcpBindingRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    definition: HostMcpBindingDefinition,\n  })\n  .strict();\nexport type CreateHostMcpBindingRequest = z.infer<typeof CreateHostMcpBindingRequest>;\n\n/** Internal owner-authorized issuance; never itself proves caller identity. */\nconst HostMcpDelegationGrant = IssueConnectionUseGrantRequest.superRefine((value, context) => {\n  if (\n    Boolean(value.sessionId) !== (value.expectedAuthorityEpoch != null) ||\n    (value.expectedAuthorityEpoch != null && !Number.isSafeInteger(value.expectedAuthorityEpoch))\n  ) {\n    context.addIssue({\n      code: \"custom\",\n      message: \"Host session grants require a matching safe authority epoch\",\n    });\n  }\n});\nexport const IssueHostMcpDelegationRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    bindingId: z.string().uuid(),\n    expectedBindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n  })\n  .strict();\nexport type IssueHostMcpDelegationRequest = z.infer<typeof IssueHostMcpDelegationRequest>;\n\nexport const HostMcpDelegation = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    grant: HostMcpDelegationGrant,\n    generation: z.number().int().positive().safe(),\n    status: z.enum([\"active\", \"revoked\"]),\n    createdAt: z.string().datetime({ offset: true }),\n    revokedAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict();\nexport type HostMcpDelegation = z.infer<typeof HostMcpDelegation>;\n\n/** Internal admission evidence, not a caller-supplied permission or credential.\n * Persistence must construct this from live authenticated authority and freeze\n * it with accepted work. Runtime use must independently revalidate that work,\n * membership, binding and delegation. No API key is retained as execution rights.\n */\nexport const HostMcpAcceptedAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive().safe(),\n    acceptedWork: ConnectionUseAuthoritySnapshot.shape.acceptedWork,\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    scheduledOrigin: z\n      .object({\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive().safe(),\n        runId: z.string().uuid(),\n      })\n      .strict()\n      .optional(),\n    source: z.discriminatedUnion(\"kind\", [\n      z.object({ kind: z.literal(\"direct\") }).strict(),\n      z.object({ kind: z.literal(\"scheduled_task\") }).strict(),\n      z\n        .object({\n          kind: z.literal(\"child_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n      z\n        .object({\n          kind: z.literal(\"inherited_turn\"),\n          sessionId: z.string().uuid(),\n          turnId: z.string().uuid(),\n        })\n        .strict(),\n    ]),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (\n      (value.source.kind === \"direct\" && value.scheduledOrigin) ||\n      (value.source.kind === \"scheduled_task\" &&\n        (!value.scheduledOrigin ||\n          value.acceptedWork.kind !== \"scheduled_task\" ||\n          value.scheduledOrigin.taskId !== value.acceptedWork.taskId ||\n          value.scheduledOrigin.runId !== value.acceptedWork.runId ||\n          value.scheduledOrigin.taskAuthorityRevision !== value.acceptedWork.taskAuthorityRevision))\n    )\n      context.addIssue({\n        code: \"custom\",\n        message: \"Scheduled host authority must retain its exact run origin\",\n      });\n    if (\n      value.acceptedWork.kind === \"turn\" &&\n      value.source.kind === \"inherited_turn\" &&\n      value.acceptedWork.turnId === value.source.turnId\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"source\"],\n        message: \"Accepted work cannot inherit from itself\",\n      });\n    }\n    if (\n      value.acceptedWork.kind === \"scheduled_task\" &&\n      !Number.isSafeInteger(value.acceptedWork.taskAuthorityRevision)\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"acceptedWork\"],\n        message: \"Task authority revision must be a safe integer\",\n      });\n    }\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 65_536) {\n      context.addIssue({ code: \"custom\", message: \"Host accepted authority exceeds 64 KiB\" });\n    }\n  });\nexport type HostMcpAcceptedAuthority = z.infer<typeof HostMcpAcceptedAuthority>;\n\n/** Credential-free selection frozen on one immutable scheduled-task revision. */\nexport const HostMcpTaskAuthority = z\n  .object({\n    version: z.literal(1),\n    accountId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    taskId: z.string().uuid(),\n    taskAuthorityRevision: z.number().int().positive().safe(),\n    taskExecutionDigest: z.string().regex(/^[0-9a-f]{64}$/),\n    ownerSubjectId: HostMcpOwnerSubject,\n    ownerOrganizationMembershipId: z.string().uuid(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().safe(),\n    bindingId: z.string().uuid(),\n    bindingGeneration: z.number().int().positive().safe(),\n    delegationId: z.string().uuid(),\n    delegationGeneration: z.number().int().positive().safe(),\n    definition: HostMcpBindingDefinition,\n    context: SessionTenancyVisibility,\n  })\n  .strict();\nexport type HostMcpTaskAuthority = z.infer<typeof HostMcpTaskAuthority>;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAQX,IAAM,sBAAsB,EAAE,MAAM;AAAA,EACzC,iBAAiB,MAAM;AAAA,EACvB,EACG,OAAO,EACP,IAAI,IAAI,EACR,MAAM,uBAAuB;AAClC,CAAC;AAGM,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACnC,gBAAgB,EACb,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC7E,GAAG,yEAAyE,EAC3E,UAAU,CAAC,UAAU,IAAI,IAAI,KAAK,EAAE,SAAS,CAAC;AAAA,EACjD,eAAe;AACjB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,cAAc;AACtB,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB,aAAa;AAAA,MACrC,SAAS;AAAA,IACX,CAAC;AACH,MAAI,MAAM,cAAc,oBAAoB,UAAU,CAAC,MAAM,cAAc;AACzE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,eAAe;AAAA,MACtB,SAAS;AAAA,IACX,CAAC;AACH,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa;AAC/D,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAC1F,CAAC;AAGI,IAAM,iBAAiB,EAC3B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,YAAY;AAAA,EACZ,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY;AACd,CAAC,EACA,OAAO;AAIV,IAAM,yBAAyB,+BAA+B,YAAY,CAAC,OAAO,YAAY;AAC5F,MACE,QAAQ,MAAM,SAAS,OAAO,MAAM,0BAA0B,SAC7D,MAAM,0BAA0B,QAAQ,CAAC,OAAO,cAAc,MAAM,sBAAsB,GAC3F;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AACM,IAAM,gCAAgC,EAC1C,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,2BAA2B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC5D,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,oBAAoB,EAC9B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,gBAAgB;AAAA,EAChB,4BAA4B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7D,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,OAAO;AAAA,EACP,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC7C,QAAQ,EAAE,KAAK,CAAC,UAAU,SAAS,CAAC;AAAA,EACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO;AAQH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC9D,cAAc,+BAA+B,MAAM;AAAA,EACnD,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,YAAY;AAAA,EACZ,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,iBAAiB,EACd,OAAO;AAAA,IACN,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IACxD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,QAAQ,EAAE,mBAAmB,QAAQ;AAAA,IACnC,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,QAAQ,EAAE,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,gBAAgB,EAAE,CAAC,EAAE,OAAO;AAAA,IACvD,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,YAAY;AAAA,MAC5B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,MAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MACG,MAAM,OAAO,SAAS,YAAY,MAAM,mBACxC,MAAM,OAAO,SAAS,qBACpB,CAAC,MAAM,mBACN,MAAM,aAAa,SAAS,oBAC5B,MAAM,gBAAgB,WAAW,MAAM,aAAa,UACpD,MAAM,gBAAgB,UAAU,MAAM,aAAa,SACnD,MAAM,gBAAgB,0BAA0B,MAAM,aAAa;AAEvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AACH,MACE,MAAM,aAAa,SAAS,UAC5B,MAAM,OAAO,SAAS,oBACtB,MAAM,aAAa,WAAW,MAAM,OAAO,QAC3C;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,aAAa,SAAS,oBAC5B,CAAC,OAAO,cAAc,MAAM,aAAa,qBAAqB,GAC9D;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,OAAQ;AACvE,YAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,yCAAyC,CAAC;AAAA,EACxF;AACF,CAAC;AAII,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACxD,qBAAqB,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACtD,gBAAgB;AAAA,EAChB,+BAA+B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/C,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvE,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,mBAAmB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpD,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACvD,YAAY;AAAA,EACZ,SAAS;AACX,CAAC,EACA,OAAO;","names":[]}

package/dist/index.d.ts

@@ -37,7 +37,7 @@ export { CreateWorkspaceArtifactRequest, PublishWorkspaceArtifactVersionRequest,
 export { MCP_MUTATION_RECEIPT_MAX_BYTES, MCP_MUTATION_RECEIPT_VERSION, McpMutationReceipt, McpMutationReceiptIdempotencyStatus, McpMutationReceiptOutcome, McpMutationResource, type McpMutationReceipt as McpMutationReceiptType, type McpMutationReceiptIdempotencyStatus as McpMutationReceiptIdempotencyStatusType, type McpMutationReceiptOutcome as McpMutationReceiptOutcomeType, type McpMutationResource as McpMutationResourceType, } from "./mcp-receipts.js";
 export { SESSION_EVENT_PAYLOAD_MAX_BYTES, approximateSessionEventTokens, boundSessionEventPayload, measureSessionEventJson, sessionEventJsonBytes, sessionEventMediaPreview, sessionEventMediaPreviewFromDataUrl, sessionEventPayloadTruncation, type BoundSessionEventPayloadOptions, type SessionEventBoundarySurface, type SessionEventMediaPreview, type SessionEventJsonMeasurement, type SessionEventPayloadTruncation, } from "./event-preview.js";
 export { COMPUTER_SCREENSHOT_MAX_BYTES, COMPUTER_SCREENSHOT_MAX_DIMENSION, COMPUTER_SCREENSHOT_MAX_PIXELS, COMPUTER_SCREENSHOT_RETENTION_MS, COMPUTER_SCREENSHOT_WORKSPACE_QUOTA_BYTES, GENERATED_IMAGE_MAX_BYTES, GENERATED_VIDEO_MAX_BYTES, RETAINED_OUTPUT_DEFAULT_PAGE_BYTES, RETAINED_OUTPUT_MAX_PAGE_BYTES, RETAINED_OUTPUT_RECEIPT_MAX_BYTES, RetainedArtifactMetadataSchema, RetainedArtifactReferenceSchema, RetainedArtifactUnavailableSchema, RetainedOutputEvidenceSchema, RetainedOutputKind, RetainedOutputUnavailableReason, retainedArtifactReferenceFromFile, retainedGeneratedImageReferenceFromFile, retainedGeneratedVideoReferenceFromFile, retainedScreenshotReferenceFromFile, retainedOutputUnavailable, resolveRetainedOutputRange, validateRetainedOutputEvidence, type RetainedArtifactFileInput, type RetainedArtifactMetadata, type RetainedArtifactReference, type RetainedGeneratedImageArtifactInput, type RetainedGeneratedVideoArtifactInput, type RetainedScreenshotArtifactInput, type RetainedArtifactUnavailable, type RetainedOutputAvailableEvidence, type RetainedOutputEvidence, type RetainedOutputRangeResolution, type RetainedOutputResolvedRange, } from "./retained-output.js";
-export { NATIVE_SNAPSHOT_PREFIXES, WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, WORKSPACE_ARCHIVE_OBJECT_REF_SCHEMA, backendForNativeSnapshotProvider, decodeNativeSnapshotRef, encodeNativeSnapshotRef, omitInlineWorkspaceArchiveWhenObjectRefPresent, parseWorkspaceArchiveDescriptor, parseWorkspaceArchiveObjectRef, workspaceArchiveObjectKey, workspaceArchivePayloadPresent, type NativeSnapshotDescriptor, type NativeSnapshotProvider, type NativeSnapshotRef, type TarWorkspaceArchiveDescriptor, type WorkspaceArchiveDescriptor, type WorkspaceArchiveObjectRef, type WorkspaceTreeFingerprint, } from "./sandbox-snapshots.js";
+export { NATIVE_SNAPSHOT_PREFIXES, WORKSPACE_ARCHIVE_DESCRIPTOR_VERSION, WORKSPACE_ARCHIVE_OBJECT_REF_SCHEMA, backendForNativeSnapshotProvider, decodeNativeSnapshotRef, encodeNativeSnapshotRef, omitInlineWorkspaceArchiveWhenObjectRefPresent, parseWorkspaceArchiveDescriptor, parseWorkspaceArchiveObjectKey, parseWorkspaceArchiveObjectRef, validateWorkspaceArchiveObjectRef, workspaceArchiveObjectKey, workspaceArchivePayloadPresent, type NativeSnapshotDescriptor, type NativeSnapshotProvider, type NativeSnapshotRef, type TarWorkspaceArchiveDescriptor, type WorkspaceArchiveDescriptor, type WorkspaceArchiveObjectRef, type WorkspaceArchiveObjectKey, type WorkspaceTreeFingerprint, } from "./sandbox-snapshots.js";
 export { canonicalModalCheckpointProviderBinding, type ModalCheckpointProviderBinding, } from "./checkpoint-provider-bindings.js";
 export declare const SandboxBackend: z.ZodEnum<{
     blaxel: "blaxel";
@@ -24195,6 +24195,7 @@ export declare const SkillImportFileSummary: z.ZodObject<{
 }, z.core.$strip>;
 export type SkillImportFileSummary = z.infer<typeof SkillImportFileSummary>;
 export declare const SkillImportPreview: z.ZodObject<{
+    markdown: z.ZodOptional<z.ZodString>;
     source: z.ZodEnum<{
         github: "github";
         skills_sh: "skills_sh";
@@ -25418,6 +25419,7 @@ export declare const PluginInstallationSummary: z.ZodObject<{
     description: z.ZodString;
     category: z.ZodString;
     tags: z.ZodArray<z.ZodString>;
+    logoUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     sourceUrl: z.ZodNullable<z.ZodString>;
     manifestDigest: z.ZodString;
     installationVersion: z.ZodNumber;
@@ -25438,6 +25440,7 @@ export declare const ListInstalledPluginsResponse: z.ZodObject<{
         description: z.ZodString;
         category: z.ZodString;
         tags: z.ZodArray<z.ZodString>;
+        logoUrl: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         sourceUrl: z.ZodNullable<z.ZodString>;
         manifestDigest: z.ZodString;
         installationVersion: z.ZodNumber;
@@ -25691,6 +25694,13 @@ export declare const Session: z.ZodObject<{
         running: "running";
         waiting_capacity: "waiting_capacity";
     }>;
+    failureDiagnostics: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        eventId: z.ZodString;
+        sequence: z.ZodNumber;
+        turnId: z.ZodNullable<z.ZodString>;
+        occurredAt: z.ZodString;
+        payload: z.ZodUnknown;
+    }, z.core.$strip>>>;
     backgroundCommandActivity: z.ZodOptional<z.ZodObject<{
         state: z.ZodEnum<{
             running: "running";
@@ -26329,6 +26339,13 @@ export declare const CreateSessionResponse: z.ZodObject<{
         running: "running";
         waiting_capacity: "waiting_capacity";
     }>;
+    failureDiagnostics: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        eventId: z.ZodString;
+        sequence: z.ZodNumber;
+        turnId: z.ZodNullable<z.ZodString>;
+        occurredAt: z.ZodString;
+        payload: z.ZodUnknown;
+    }, z.core.$strip>>>;
     backgroundCommandActivity: z.ZodOptional<z.ZodObject<{
         state: z.ZodEnum<{
             running: "running";
@@ -26973,6 +26990,13 @@ export declare const SessionListResponse: z.ZodObject<{
             running: "running";
             waiting_capacity: "waiting_capacity";
         }>;
+        failureDiagnostics: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            sequence: z.ZodNumber;
+            turnId: z.ZodNullable<z.ZodString>;
+            occurredAt: z.ZodString;
+            payload: z.ZodUnknown;
+        }, z.core.$strip>>>;
         backgroundCommandActivity: z.ZodOptional<z.ZodObject<{
             state: z.ZodEnum<{
                 running: "running";
@@ -27608,6 +27632,13 @@ export declare const SessionListResponse: z.ZodObject<{
             running: "running";
             waiting_capacity: "waiting_capacity";
         }>;
+        failureDiagnostics: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            sequence: z.ZodNumber;
+            turnId: z.ZodNullable<z.ZodString>;
+            occurredAt: z.ZodString;
+            payload: z.ZodUnknown;
+        }, z.core.$strip>>>;
         backgroundCommandActivity: z.ZodOptional<z.ZodObject<{
             state: z.ZodEnum<{
                 running: "running";
@@ -28276,6 +28307,13 @@ export declare const OrganizationSessionListResponse: z.ZodObject<{
             running: "running";
             waiting_capacity: "waiting_capacity";
         }>;
+        failureDiagnostics: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            sequence: z.ZodNumber;
+            turnId: z.ZodNullable<z.ZodString>;
+            occurredAt: z.ZodString;
+            payload: z.ZodUnknown;
+        }, z.core.$strip>>>;
         backgroundCommandActivity: z.ZodOptional<z.ZodObject<{
             state: z.ZodEnum<{
                 running: "running";
@@ -28918,6 +28956,13 @@ export declare const SessionLineageResponse: z.ZodObject<{
             running: "running";
             waiting_capacity: "waiting_capacity";
         }>;
+        failureDiagnostics: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            eventId: z.ZodString;
+            sequence: z.ZodNumber;
+            turnId: z.ZodNullable<z.ZodString>;
+            occurredAt: z.ZodString;
+            payload: z.ZodUnknown;
+        }, z.core.$strip>>>;
         backgroundCommandActivity: z.ZodOptional<z.ZodObject<{
             state: z.ZodEnum<{
                 running: "running";
@@ -35141,6 +35186,7 @@ export declare const MachineRuntimeCapabilities: z.ZodObject<{
     browserBridge: z.ZodBoolean;
     operationResourcePolicy: z.ZodBoolean;
     operationCpuQuota: z.ZodBoolean;
+    transactionalFsWrite: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>;
 export type MachineRuntimeCapabilities = z.infer<typeof MachineRuntimeCapabilities>;
 export declare const MachineUpdateStatus: z.ZodEnum<{
@@ -35204,6 +35250,7 @@ export declare const MachineRuntime: z.ZodObject<{
         browserBridge: z.ZodBoolean;
         operationResourcePolicy: z.ZodBoolean;
         operationCpuQuota: z.ZodBoolean;
+        transactionalFsWrite: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>;
     update: z.ZodNullable<z.ZodObject<{
         operationId: z.ZodString;
@@ -35335,6 +35382,7 @@ export declare const MachineView: z.ZodObject<{
             browserBridge: z.ZodBoolean;
             operationResourcePolicy: z.ZodBoolean;
             operationCpuQuota: z.ZodBoolean;
+            transactionalFsWrite: z.ZodDefault<z.ZodBoolean>;
         }, z.core.$strip>;
         update: z.ZodNullable<z.ZodObject<{
             operationId: z.ZodString;
@@ -35464,6 +35512,7 @@ export declare const MachinesResponse: z.ZodObject<{
                 browserBridge: z.ZodBoolean;
                 operationResourcePolicy: z.ZodBoolean;
                 operationCpuQuota: z.ZodBoolean;
+                transactionalFsWrite: z.ZodDefault<z.ZodBoolean>;
             }, z.core.$strip>;
             update: z.ZodNullable<z.ZodObject<{
                 operationId: z.ZodString;
@@ -37499,3 +37548,6 @@ export * from "./organization-membership-lifecycle.js";
 export * from "./remember.js";
 export * from "./agent-authored-durable-text.js";
 export * from "./feedback.js";
+export type { PluginDiscoveryItem, PluginDiscoveryPage } from "./plugin-discovery.js";
+export { mcpEndpointIdentity } from "./mcp-endpoint.js";
+export { pluginMcpUnavailableReason } from "./mcp-endpoint.js";

package/dist/index.js

@@ -1798,6 +1798,7 @@ import {
   omitInlineWorkspaceArchiveWhenObjectRefPresent,
   parseSkillFrontmatter,
   parseWorkspaceArchiveDescriptor,
+  parseWorkspaceArchiveObjectKey,
   parseWorkspaceArchiveObjectRef,
   prefixedMcpToolName,
   readCodexCredentialPolicySnapshotV1,
@@ -1851,6 +1852,7 @@ import {
   toolResultSpillSandboxPath,
   turnExecutionPolicyAuditMetadata,
   validateSkillTextFiles,
+  validateWorkspaceArchiveObjectRef,
   variableSetVariableNameReservation,
   verifyDelegatedAccessToken,
   verifyEnrollToken,
@@ -1864,7 +1866,11 @@ import {
   workspaceLearningPolicyRouterContext,
   workspaceLearningSourceKey,
   workspaceSlackReactionChannelAllowed
-} from "./chunk-EHHDZLGY.js";
+} from "./chunk-YRCMZTY2.js";
+import {
+  mcpEndpointIdentity,
+  pluginMcpUnavailableReason
+} from "./chunk-WBYTNVIW.js";
 import {
   CONNECTOR_ATTACHMENT_FILENAME_MAX_UTF8_BYTES,
   CONNECTOR_ATTACHMENT_MAX_BYTES,
@@ -4191,6 +4197,7 @@ export {
   isToolResultSpilledReceipt,
   latencyModeForMetadata,
   legacyWorkspaceConnectorDocumentDestination,
+  mcpEndpointIdentity,
   measureSessionEventJson,
   mergeResourceRefs,
   mergeToolRefs,
@@ -4215,7 +4222,9 @@ export {
   parseConnectorAttachmentTransferEnvelope,
   parseSkillFrontmatter,
   parseWorkspaceArchiveDescriptor,
+  parseWorkspaceArchiveObjectKey,
   parseWorkspaceArchiveObjectRef,
+  pluginMcpUnavailableReason,
   prefixedMcpToolName,
   readCodexCredentialPolicySnapshotV1,
   readCodexFleetReplayRecordV1,
@@ -4279,6 +4288,7 @@ export {
   turnExecutionPolicyAuditMetadata,
   validateRetainedOutputEvidence,
   validateSkillTextFiles,
+  validateWorkspaceArchiveObjectRef,
   variableSetVariableNameReservation,
   verifyDelegatedAccessToken,
   verifyEnrollToken,

package/dist/mcp-endpoint.d.ts

@@ -0,0 +1,7 @@
+/** Exact endpoint identity: normalize URL syntax, preserve paths and query parameters. */
+export declare function mcpEndpointIdentity(value: string | null | undefined): string | null;
+export declare function pluginMcpUnavailableReason(server: {
+    endpoint: string | null;
+    transport?: string;
+    requiresConfiguration?: boolean;
+}): string | null;

package/dist/personal-github.js

@@ -1,6 +1,7 @@
 import {
   ConnectionMetadata
-} from "./chunk-EHHDZLGY.js";
+} from "./chunk-YRCMZTY2.js";
+import "./chunk-WBYTNVIW.js";
 import "./chunk-YBW5JSA3.js";
 import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";

package/dist/personal-github.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}
+{"version":3,"sources":["../src/personal-github.ts"],"sourcesContent":["import { z } from \"zod\";\n\nimport { ConnectionMetadata } from \"./index\";\n\nexport const PERSONAL_GITHUB_PROVIDER_DOMAIN = \"github.com\" as const;\nexport const PERSONAL_GITHUB_PROVIDER_FAMILY = \"github\" as const;\nexport const PERSONAL_GITHUB_CREDENTIAL_ROLE = \"opengeni_github_personal\" as const;\nexport const PERSONAL_GITHUB_CONNECTION_SURFACE_ID = \"github:personal\" as const;\nexport const PERSONAL_GITHUB_REQUESTED_SCOPES = [\"repo\"] as const;\nexport const PERSONAL_GITHUB_AUTHORIZATION_URL =\n  \"https://github.com/login/oauth/authorize\" as const;\nexport const PERSONAL_GITHUB_TOKEN_URL = \"https://github.com/login/oauth/access_token\" as const;\nexport const PERSONAL_GITHUB_USER_URL = \"https://api.github.com/user\" as const;\nexport const PERSONAL_GITHUB_API_ORIGIN = \"https://api.github.com\" as const;\nexport const PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX = 100 as const;\n\nexport const PersonalGitHubRepositoryId = z.string().regex(/^[1-9]\\d*$/u);\nexport type PersonalGitHubRepositoryId = z.infer<typeof PersonalGitHubRepositoryId>;\n\nexport const PersonalGitHubRepositoryAccess = z.enum([\"read\", \"write\"]);\nexport type PersonalGitHubRepositoryAccess = z.infer<typeof PersonalGitHubRepositoryAccess>;\n\nexport const PersonalGitHubRepositoryPermissions = z\n  .object({\n    pull: z.boolean(),\n    push: z.boolean(),\n    admin: z.boolean(),\n    maintain: z.boolean(),\n    triage: z.boolean(),\n  })\n  .strict();\nexport type PersonalGitHubRepositoryPermissions = z.infer<\n  typeof PersonalGitHubRepositoryPermissions\n>;\n\nexport const PersonalGitHubRepositoryVisibility = z.enum([\"public\", \"private\", \"internal\"]);\nexport type PersonalGitHubRepositoryVisibility = z.infer<typeof PersonalGitHubRepositoryVisibility>;\n\nconst PersonalGitHubRepositoryFullName = z\n  .string()\n  .min(3)\n  .max(140)\n  .regex(/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/u);\n\nexport function canonicalPersonalGitHubRepositoryUrl(fullName: string): string {\n  return `https://github.com/${fullName}`;\n}\n\n/** A bounded, credential-free projection verified directly against GitHub. */\nexport const PersonalGitHubRepository = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    canonicalUrl: z.string().url().max(512),\n    defaultBranch: z.string().min(1).max(255),\n    visibility: PersonalGitHubRepositoryVisibility,\n    private: z.boolean(),\n    archived: z.boolean(),\n    disabled: z.boolean(),\n    permissions: PersonalGitHubRepositoryPermissions,\n  })\n  .strict()\n  .superRefine((repository, context) => {\n    if (repository.canonicalUrl !== canonicalPersonalGitHubRepositoryUrl(repository.fullName)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"canonicalUrl\"],\n        message: \"canonicalUrl must be derived from fullName\",\n      });\n    }\n    if (repository.private !== (repository.visibility === \"private\")) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"private\"],\n        message: \"private must agree with visibility\",\n      });\n    }\n  });\nexport type PersonalGitHubRepository = z.infer<typeof PersonalGitHubRepository>;\n\nexport const PersonalGitHubSelectedRepository = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess,\n  selectionGeneration: z.number().int().positive(),\n  selectedAt: z.string().datetime({ offset: true }),\n  lastVerifiedAt: z.string().datetime({ offset: true }),\n}).strict();\nexport type PersonalGitHubSelectedRepository = z.infer<typeof PersonalGitHubSelectedRepository>;\n\nexport const PersonalGitHubRepositorySelectionState = z\n  .object({\n    connectionAuthorityGeneration: z.number().int().positive(),\n    credentialBindingId: z.string().uuid(),\n    providerPrincipalId: PersonalGitHubRepositoryId,\n    selectionGeneration: z.number().int().nonnegative(),\n    repositories: z\n      .array(PersonalGitHubSelectedRepository)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionState = z.infer<\n  typeof PersonalGitHubRepositorySelectionState\n>;\n\nexport const ListPersonalGitHubRepositoriesQuery = z\n  .object({\n    cursor: z.coerce.number().int().positive().max(10_000).default(1),\n    limit: z.coerce.number().int().min(1).max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX).default(50),\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesQuery = z.infer<\n  typeof ListPersonalGitHubRepositoriesQuery\n>;\n\nexport const PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository.safeExtend({\n  selectedAccess: PersonalGitHubRepositoryAccess.nullable(),\n}).strict();\nexport type PersonalGitHubRepositoryCatalogItem = z.infer<\n  typeof PersonalGitHubRepositoryCatalogItem\n>;\n\nexport const ListPersonalGitHubRepositoriesResponse = z\n  .object({\n    repositories: z\n      .array(PersonalGitHubRepositoryCatalogItem)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n    nextCursor: z.number().int().positive().nullable(),\n    selection: PersonalGitHubRepositorySelectionState,\n  })\n  .strict();\nexport type ListPersonalGitHubRepositoriesResponse = z.infer<\n  typeof ListPersonalGitHubRepositoriesResponse\n>;\n\nexport const PersonalGitHubRepositorySelectionInput = z\n  .object({\n    repositoryId: PersonalGitHubRepositoryId,\n    fullName: PersonalGitHubRepositoryFullName,\n    access: PersonalGitHubRepositoryAccess,\n  })\n  .strict();\nexport type PersonalGitHubRepositorySelectionInput = z.infer<\n  typeof PersonalGitHubRepositorySelectionInput\n>;\n\nexport const ReplacePersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n    repositories: z\n      .array(PersonalGitHubRepositorySelectionInput)\n      .max(PERSONAL_GITHUB_REPOSITORY_CATALOG_MAX),\n  })\n  .strict()\n  .superRefine((request, context) => {\n    const repositoryIds = new Set<string>();\n    const fullNames = new Set<string>();\n    request.repositories.forEach((repository, index) => {\n      const normalizedFullName = repository.fullName.toLowerCase();\n      if (repositoryIds.has(repository.repositoryId)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"repositoryId\"],\n          message: \"repositoryId must be unique\",\n        });\n      }\n      if (fullNames.has(normalizedFullName)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"repositories\", index, \"fullName\"],\n          message: \"fullName must be unique\",\n        });\n      }\n      repositoryIds.add(repository.repositoryId);\n      fullNames.add(normalizedFullName);\n    });\n  });\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof ReplacePersonalGitHubRepositorySelectionsRequest\n>;\n\nexport const VerifyPersonalGitHubRepositorySelectionsRequest = z\n  .object({\n    expectedConnectionAuthorityGeneration: z.number().int().positive(),\n    expectedSelectionGeneration: z.number().int().nonnegative(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = z.infer<\n  typeof VerifyPersonalGitHubRepositorySelectionsRequest\n>;\n\n/**\n * Owner-visible, credential-free metadata for one dedicated personal GitHub\n * OAuth connection. Repository selections are a separate authority and never\n * live in this credential record.\n */\nexport const PersonalGitHubConnectionMetadata = z\n  .object({\n    credentialRole: z.literal(PERSONAL_GITHUB_CREDENTIAL_ROLE),\n    providerFamily: z.literal(PERSONAL_GITHUB_PROVIDER_FAMILY),\n    providerPrincipalId: z.string().regex(/^\\d+$/u),\n    githubUserId: z.string().regex(/^\\d+$/u),\n    githubLogin: z.string().min(1).max(100),\n    oauthEnvironment: z.string().min(1).max(128),\n    oauthClientMarker: z.string().regex(/^[a-f0-9]{32}$/u),\n    credentialBindingId: z.string().uuid(),\n    connectedAt: z.string().datetime({ offset: true }),\n    lastVerifiedAt: z.string().datetime({ offset: true }),\n    disconnectedAt: z.string().datetime({ offset: true }).nullable().optional(),\n    refreshTokenExpiresAt: z.string().datetime({ offset: true }).nullable().optional(),\n  })\n  .passthrough();\nexport type PersonalGitHubConnectionMetadata = z.infer<typeof PersonalGitHubConnectionMetadata>;\n\nexport const PersonalGitHubOAuthStartRequest = z\n  .object({\n    /** Existing exact connection generation to re-authorize in place. */\n    connectionId: z.string().uuid().optional(),\n    /** Same-workspace UI path restored after the callback. */\n    returnPath: z.string().min(1).max(2048).optional(),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartRequest = z.infer<typeof PersonalGitHubOAuthStartRequest>;\n\nexport const PersonalGitHubOAuthStartResponse = z\n  .object({\n    authorizationUrl: z.string().url(),\n    expiresAt: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type PersonalGitHubOAuthStartResponse = z.infer<typeof PersonalGitHubOAuthStartResponse>;\n\nexport const PersonalGitHubConnectionStatusResponse = z\n  .object({\n    enabled: z.boolean(),\n    connection: ConnectionMetadata.nullable(),\n    reviewUrl: z.string().url().nullable(),\n  })\n  .strict();\nexport type PersonalGitHubConnectionStatusResponse = z.infer<\n  typeof PersonalGitHubConnectionStatusResponse\n>;\n\nexport const PersonalGitHubDisconnectRequest = z\n  .object({\n    expectedVersion: z.number().int().positive(),\n    idempotencyKey: z.string().trim().min(1).max(200),\n  })\n  .strict();\nexport type PersonalGitHubDisconnectRequest = z.infer<typeof PersonalGitHubDisconnectRequest>;\n\nexport function isPersonalGitHubConnection(\n  connection: Pick<z.infer<typeof ConnectionMetadata>, \"providerDomain\" | \"kind\" | \"metadata\">,\n): boolean {\n  return (\n    connection.providerDomain.toLowerCase() === PERSONAL_GITHUB_PROVIDER_DOMAIN &&\n    connection.kind === \"oauth2\" &&\n    PersonalGitHubConnectionMetadata.safeParse(connection.metadata).success\n  );\n}\n\nexport function hasReservedPersonalGitHubMetadata(\n  metadata: Record<string, unknown> | undefined,\n): boolean {\n  return metadata?.credentialRole === PERSONAL_GITHUB_CREDENTIAL_ROLE;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS;AAIX,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,wCAAwC;AAC9C,IAAM,mCAAmC,CAAC,MAAM;AAChD,IAAM,oCACX;AACK,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,6BAA6B;AACnC,IAAM,yCAAyC;AAE/C,IAAM,6BAA6B,EAAE,OAAO,EAAE,MAAM,aAAa;AAGjE,IAAM,iCAAiC,EAAE,KAAK,CAAC,QAAQ,OAAO,CAAC;AAG/D,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,MAAM,EAAE,QAAQ;AAAA,EAChB,MAAM,EAAE,QAAQ;AAAA,EAChB,OAAO,EAAE,QAAQ;AAAA,EACjB,UAAU,EAAE,QAAQ;AAAA,EACpB,QAAQ,EAAE,QAAQ;AACpB,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK,CAAC,UAAU,WAAW,UAAU,CAAC;AAG1F,IAAM,mCAAmC,EACtC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,6DAA6D;AAE/D,SAAS,qCAAqC,UAA0B;AAC7E,SAAO,sBAAsB,QAAQ;AACvC;AAGO,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG;AAAA,EACtC,eAAe,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,YAAY;AAAA,EACZ,SAAS,EAAE,QAAQ;AAAA,EACnB,UAAU,EAAE,QAAQ;AAAA,EACpB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa;AACf,CAAC,EACA,OAAO,EACP,YAAY,CAAC,YAAY,YAAY;AACpC,MAAI,WAAW,iBAAiB,qCAAqC,WAAW,QAAQ,GAAG;AACzF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,WAAW,aAAa,WAAW,eAAe,YAAY;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmC,yBAAyB,WAAW;AAAA,EAClF,gBAAgB;AAAA,EAChB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACtD,CAAC,EAAE,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,qBAAqB;AAAA,EACrB,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAClD,cAAc,EACX,MAAM,gCAAgC,EACtC,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,EAChD,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAM,EAAE,QAAQ,CAAC;AAAA,EAChE,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,sCAAsC,EAAE,QAAQ,EAAE;AAC9F,CAAC,EACA,OAAO;AAKH,IAAM,sCAAsC,yBAAyB,WAAW;AAAA,EACrF,gBAAgB,+BAA+B,SAAS;AAC1D,CAAC,EAAE,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc,EACX,MAAM,mCAAmC,EACzC,IAAI,sCAAsC;AAAA,EAC7C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,WAAW;AACb,CAAC,EACA,OAAO;AAKH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,cAAc;AAAA,EACd,UAAU;AAAA,EACV,QAAQ;AACV,CAAC,EACA,OAAO;AAKH,IAAM,mDAAmD,EAC7D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChD,cAAc,EACX,MAAM,sCAAsC,EAC5C,IAAI,sCAAsC;AAC/C,CAAC,EACA,OAAO,EACP,YAAY,CAAC,SAAS,YAAY;AACjC,QAAM,gBAAgB,oBAAI,IAAY;AACtC,QAAM,YAAY,oBAAI,IAAY;AAClC,UAAQ,aAAa,QAAQ,CAAC,YAAY,UAAU;AAClD,UAAM,qBAAqB,WAAW,SAAS,YAAY;AAC3D,QAAI,cAAc,IAAI,WAAW,YAAY,GAAG;AAC9C,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,cAAc;AAAA,QAC5C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,UAAU,IAAI,kBAAkB,GAAG;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB,OAAO,UAAU;AAAA,QACxC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,kBAAc,IAAI,WAAW,YAAY;AACzC,cAAU,IAAI,kBAAkB;AAAA,EAClC,CAAC;AACH,CAAC;AAKI,IAAM,kDAAkD,EAC5D,OAAO;AAAA,EACN,uCAAuC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACjE,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC1D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAUH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,gBAAgB,EAAE,QAAQ,+BAA+B;AAAA,EACzD,qBAAqB,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EAC9C,cAAc,EAAE,OAAO,EAAE,MAAM,QAAQ;AAAA,EACvC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,MAAM,iBAAiB;AAAA,EACrD,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACjD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EACpD,gBAAgB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1E,uBAAuB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS;AACnF,CAAC,EACA,YAAY;AAGR,IAAM,kCAAkC,EAC5C,OAAO;AAAA;AAAA,EAEN,cAAc,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,EAEzC,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AACnD,CAAC,EACA,OAAO;AAGH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,kBAAkB,EAAE,OAAO,EAAE,IAAI;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACjD,CAAC,EACA,OAAO;AAGH,IAAM,yCAAyC,EACnD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,YAAY,mBAAmB,SAAS;AAAA,EACxC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAC3C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAClD,CAAC,EACA,OAAO;AAGH,SAAS,2BACd,YACS;AACT,SACE,WAAW,eAAe,YAAY,MAAM,mCAC5C,WAAW,SAAS,YACpB,iCAAiC,UAAU,WAAW,QAAQ,EAAE;AAEpE;AAEO,SAAS,kCACd,UACS;AACT,SAAO,UAAU,mBAAmB;AACtC;","names":[]}