@opengeni/contracts 3.1.0-canary.1 → 3.1.0-canary.2

package/dist/agent-instruction-changes.d.ts

@@ -0,0 +1,112 @@
+import { z } from "zod";
+export declare const AgentInstructionEditMode: z.ZodEnum<{
+    append: "append";
+    edit: "edit";
+    replace: "replace";
+}>;
+export type AgentInstructionEditMode = z.infer<typeof AgentInstructionEditMode>;
+export declare const AgentInstructionSaveRequest: z.ZodObject<{
+    operationId: z.ZodUUID;
+    target: z.ZodObject<{
+        kind: z.ZodEnum<{
+            charter: "charter";
+            policy: "policy";
+        }>;
+        scope: z.ZodEnum<{
+            global: "global";
+            role: "role";
+        }>;
+        roleKey: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    editMode: z.ZodEnum<{
+        append: "append";
+        edit: "edit";
+        replace: "replace";
+    }>;
+    content: z.ZodOptional<z.ZodString>;
+    oldText: z.ZodOptional<z.ZodString>;
+    newText: z.ZodOptional<z.ZodString>;
+    expectedCurrentRevisionId: z.ZodNullable<z.ZodUUID>;
+    expectedActivationVersion: z.ZodNumber;
+    evidence: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        entryId: z.ZodUUID;
+        revisionId: z.ZodUUID;
+        location: z.ZodDefault<z.ZodObject<{
+            page: z.ZodOptional<z.ZodNumber>;
+            passage: z.ZodOptional<z.ZodString>;
+            messageIds: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            path: z.ZodOptional<z.ZodString>;
+            commit: z.ZodOptional<z.ZodString>;
+            lineStart: z.ZodOptional<z.ZodNumber>;
+            lineEnd: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        quote: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type AgentInstructionSaveRequest = z.input<typeof AgentInstructionSaveRequest>;
+export declare const AgentInstructionReviewRequest: z.ZodObject<{
+    operationId: z.ZodUUID;
+    revisionId: z.ZodUUID;
+    decision: z.ZodEnum<{
+        approve: "approve";
+        reject: "reject";
+    }>;
+    reason: z.ZodString;
+}, z.core.$strict>;
+export type AgentInstructionReviewRequest = z.infer<typeof AgentInstructionReviewRequest>;
+export declare const AgentInstructionReceipt: z.ZodObject<{
+    operationId: z.ZodUUID;
+    revisionId: z.ZodUUID;
+    outcome: z.ZodEnum<{
+        pending: "pending";
+        published: "published";
+        rejected: "rejected";
+    }>;
+    reviewBatchId: z.ZodNullable<z.ZodUUID>;
+    replayed: z.ZodBoolean;
+}, z.core.$strip>;
+export type AgentInstructionReceipt = z.infer<typeof AgentInstructionReceipt>;
+export declare const AgentInstructionReviewItem: z.ZodObject<{
+    revisionId: z.ZodUUID;
+    content: z.ZodString;
+    target: z.ZodObject<{
+        kind: z.ZodEnum<{
+            charter: "charter";
+            policy: "policy";
+        }>;
+        scope: z.ZodEnum<{
+            global: "global";
+            role: "role";
+        }>;
+        roleKey: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+    reviewBatchId: z.ZodNullable<z.ZodUUID>;
+    sessionId: z.ZodNullable<z.ZodUUID>;
+    reason: z.ZodString;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+export type AgentInstructionReviewItem = z.infer<typeof AgentInstructionReviewItem>;
+export declare const AgentInstructionReviewListResponse: z.ZodObject<{
+    entries: z.ZodArray<z.ZodObject<{
+        revisionId: z.ZodUUID;
+        content: z.ZodString;
+        target: z.ZodObject<{
+            kind: z.ZodEnum<{
+                charter: "charter";
+                policy: "policy";
+            }>;
+            scope: z.ZodEnum<{
+                global: "global";
+                role: "role";
+            }>;
+            roleKey: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+        reviewBatchId: z.ZodNullable<z.ZodUUID>;
+        sessionId: z.ZodNullable<z.ZodUUID>;
+        reason: z.ZodString;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+    nextCursor: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type AgentInstructionReviewListResponse = z.infer<typeof AgentInstructionReviewListResponse>;

package/dist/agent-learning.d.ts

@@ -0,0 +1,243 @@
+import { z } from "zod";
+/** Review controls publication. It never grants content or external-action authority. */
+export declare const AgentLearningMode: z.ZodEnum<{
+    automatic: "automatic";
+    off: "off";
+    review_first: "review_first";
+}>;
+export type AgentLearningMode = z.infer<typeof AgentLearningMode>;
+export declare const AgentLearningCategory: z.ZodEnum<{
+    instructions: "instructions";
+    knowledge: "knowledge";
+    skills: "skills";
+}>;
+export type AgentLearningCategory = z.infer<typeof AgentLearningCategory>;
+export declare const AgentLearningDefaults: z.ZodObject<{
+    knowledge: z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>;
+    instructions: z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>;
+    skills: z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>;
+}, z.core.$strict>;
+export type AgentLearningDefaults = z.infer<typeof AgentLearningDefaults>;
+export declare const DEFAULT_AGENT_LEARNING: Readonly<AgentLearningDefaults>;
+/** An absent category inherits. `inherit` is a reset request, not persisted policy. */
+export declare const AgentLearningOverrides: z.ZodObject<{
+    knowledge: z.ZodOptional<z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>>;
+    instructions: z.ZodOptional<z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>>;
+    skills: z.ZodOptional<z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>>;
+}, z.core.$strict>;
+export type AgentLearningOverrides = z.infer<typeof AgentLearningOverrides>;
+export declare const AgentLearningOverridePatch: z.ZodObject<{
+    knowledge: z.ZodOptional<z.ZodUnion<[z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>, z.ZodLiteral<"inherit">]>>;
+    instructions: z.ZodOptional<z.ZodUnion<[z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>, z.ZodLiteral<"inherit">]>>;
+    skills: z.ZodOptional<z.ZodUnion<[z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>, z.ZodLiteral<"inherit">]>>;
+}, z.core.$strict>;
+export type AgentLearningOverridePatch = z.infer<typeof AgentLearningOverridePatch>;
+export declare const AgentLearningContext: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"chat">;
+    id: z.ZodUUID;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"scheduled_task">;
+    id: z.ZodUUID;
+}, z.core.$strict>], "kind">;
+export type AgentLearningContext = z.infer<typeof AgentLearningContext>;
+export declare const AgentLearningOwner: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"workspace">;
+    workspaceId: z.ZodUUID;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"personal">;
+    subjectId: z.ZodString;
+}, z.core.$strict>], "kind">;
+export type AgentLearningOwner = z.infer<typeof AgentLearningOwner>;
+export declare const AgentLearningSettings: z.ZodObject<{
+    owner: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"workspace">;
+        workspaceId: z.ZodUUID;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"personal">;
+        subjectId: z.ZodString;
+    }, z.core.$strict>], "kind">;
+    version: z.ZodNumber;
+    defaults: z.ZodObject<{
+        knowledge: z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>;
+        instructions: z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>;
+        skills: z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AgentLearningSettings = z.infer<typeof AgentLearningSettings>;
+export declare const AgentLearningContextSettings: z.ZodObject<{
+    context: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"chat">;
+        id: z.ZodUUID;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"scheduled_task">;
+        id: z.ZodUUID;
+    }, z.core.$strict>], "kind">;
+    version: z.ZodNumber;
+    overrides: z.ZodObject<{
+        knowledge: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+        instructions: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+        skills: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AgentLearningContextSettings = z.infer<typeof AgentLearningContextSettings>;
+/** Versioned settings returned by both central and contextual editors. */
+export declare const AgentLearningSettingsRecord: z.ZodObject<{
+    ownerKey: z.ZodString;
+    contextKey: z.ZodString;
+    version: z.ZodNumber;
+    settings: z.ZodObject<{
+        knowledge: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+        instructions: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+        skills: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+    }, z.core.$strict>;
+}, z.core.$strip>;
+export type AgentLearningSettingsRecord = z.infer<typeof AgentLearningSettingsRecord>;
+export declare const AgentLearningOverrideRecord: z.ZodObject<{
+    contextKey: z.ZodString;
+    version: z.ZodNumber;
+    settings: z.ZodObject<{
+        knowledge: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+        instructions: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+        skills: z.ZodOptional<z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>>;
+    }, z.core.$strict>;
+    updatedAt: z.ZodString;
+    label: z.ZodString;
+}, z.core.$strip>;
+export type AgentLearningOverrideRecord = z.infer<typeof AgentLearningOverrideRecord>;
+export type SaveAgentLearningSettingsRequest = {
+    scope: "workspace" | "personal";
+    source?: AgentLearningContext;
+    operationId: string;
+    expectedVersion: number;
+    settings: AgentLearningOverridePatch;
+};
+export declare const AgentLearningEffectiveCategory: z.ZodObject<{
+    mode: z.ZodEnum<{
+        automatic: "automatic";
+        off: "off";
+        review_first: "review_first";
+    }>;
+    inherited: z.ZodBoolean;
+}, z.core.$strict>;
+export declare const AgentLearningEffectivePolicy: z.ZodObject<{
+    knowledge: z.ZodObject<{
+        mode: z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>;
+        inherited: z.ZodBoolean;
+    }, z.core.$strict>;
+    instructions: z.ZodObject<{
+        mode: z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>;
+        inherited: z.ZodBoolean;
+    }, z.core.$strict>;
+    skills: z.ZodObject<{
+        mode: z.ZodEnum<{
+            automatic: "automatic";
+            off: "off";
+            review_first: "review_first";
+        }>;
+        inherited: z.ZodBoolean;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AgentLearningEffectivePolicy = z.infer<typeof AgentLearningEffectivePolicy>;
+/** Apply only at an authorized settings boundary; this function confers no authority. */
+export declare function patchAgentLearningOverrides(current: AgentLearningOverrides, patch: AgentLearningOverridePatch): AgentLearningOverrides;
+/** Pure resolution over accepted settings. Runtime callers persist the resulting snapshot. */
+export declare function resolveAgentLearningPolicy(defaults: AgentLearningDefaults, overrides: AgentLearningOverrides): AgentLearningEffectivePolicy;
+/** Migration adapter preserves explicit opt-outs and existing instruction/Skill choices. */
+export declare function agentLearningDefaultsFromLegacy(input: {
+    memoryEnabled?: boolean;
+    workspaceMode?: "off" | "suggest" | "automatic";
+}): AgentLearningDefaults;
+/** Existing instruction and Skill lifecycles retain their native mode vocabulary. */
+export declare function agentLearningDestinationMode(mode: AgentLearningMode): "automatic" | "off" | "suggest";

package/dist/atlassian.js

@@ -17,11 +17,11 @@ import {
   AtlassianSyncCadence,
   SaveAtlassianSourcesRequest,
   atlassianScopesAllowRead
-} from "./chunk-UR2GFYIE.js";
-import "./chunk-WBYTNVIW.js";
+} from "./chunk-QQUJ6NPW.js";
 import "./chunk-YBW5JSA3.js";
 import "./chunk-O5LEQHDM.js";
 import "./chunk-GRG7PHWQ.js";
+import "./chunk-RKX3NQYS.js";
 import "./chunk-MRWYRAS5.js";
 import "./chunk-3SIZGL3O.js";
 import "./chunk-NVJMJWLL.js";

package/dist/{chunk-TEMFILR7.js → chunk-2AC63F4S.js}

@@ -23,7 +23,32 @@ var ExternalIdentityReference = z.object({
 }).strict();
 var AddExternalWorkspaceMemberRequest = z.object({
   identity: ExternalIdentityReference,
-  permissions: z.array(Permission).min(1).max(Permission.options.length)
+  permissions: z.array(Permission).min(1).max(Permission.options.length),
+  /** Opt-in durable operation identity; unkeyed legacy requests are not cancellable. */
+  operationId: z.string().uuid().optional()
+}).strict();
+var ExternalIdentityLookup = z.discriminatedUnion("found", [
+  z.object({ found: z.literal(false) }).strict(),
+  z.object({
+    found: z.literal(true),
+    subjectId: externalSubject,
+    organizationMembershipId: z.string().uuid(),
+    identityStatus: z.enum(["active", "disabled", "revoked"]),
+    identityAuthorizationRevision: z.number().int().positive().safe(),
+    membershipStatus: z.enum(["provisioning", "active", "suspended", "revoked"]),
+    membershipAuthorizationRevision: z.number().int().positive().safe()
+  }).strict()
+]);
+var CancelExternalWorkspaceMemberGrantRequest = z.object({
+  operationId: z.string().uuid(),
+  cancelGrantOperationId: z.string().uuid()
+}).strict().refine((value) => value.operationId !== value.cancelGrantOperationId, {
+  message: "Revocation and grant must use different operation identities"
+});
+var CancelExternalWorkspaceMemberGrantResponse = z.object({
+  removed: z.boolean(),
+  replay: z.boolean(),
+  fencedGrantOperationId: z.string().uuid()
 }).strict();
 var UpdateExternalIdentityMembershipRequest = z.object({
   kind: z.enum(["suspend", "reactivate", "offboard"]),
@@ -127,6 +152,9 @@ var ExternalLinkWorkSnapshot = z.object({
 export {
   ExternalIdentityReference,
   AddExternalWorkspaceMemberRequest,
+  ExternalIdentityLookup,
+  CancelExternalWorkspaceMemberGrantRequest,
+  CancelExternalWorkspaceMemberGrantResponse,
   UpdateExternalIdentityMembershipRequest,
   ExternalActorSelection,
   ExternalIdentity,
@@ -140,4 +168,4 @@ export {
   ExternalIdentityLinkPreview,
   ExternalLinkWorkSnapshot
 };
-//# sourceMappingURL=chunk-TEMFILR7.js.map
+//# sourceMappingURL=chunk-2AC63F4S.js.map

package/dist/chunk-2AC63F4S.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/external-identities.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { Permission } from \"./permissions\";\n\n// External identifiers are opaque, case-sensitive strings. In particular a\n// native-looking identifier is still host data, never a native subject claim.\n// Bound bytes, not just JS code units: these values share a PostgreSQL B-tree\n// index entry. Never normalize/truncate an identifier to make it fit, and reject\n// text that the driver would replace or PostgreSQL cannot represent.\nconst encoder = new TextEncoder();\nfunction opaqueText(maxBytes: number) {\n  return z\n    .string()\n    .min(1)\n    .max(maxBytes)\n    .refine(\n      (value) =>\n        !value.includes(\"\\0\") &&\n        !/[\\uD800-\\uDFFF]/u.test(value) &&\n        encoder.encode(value).byteLength <= maxBytes,\n      {\n        message: `Identifier must be valid PostgreSQL Unicode text of at most ${maxBytes} UTF-8 bytes`,\n      },\n    );\n}\nconst externalId = opaqueText(1024);\nconst source = opaqueText(200);\nconst externalSubject = z\n  .string()\n  .regex(/^external_user:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$(?![\\s\\S])/);\nconst nativeSubject = z\n  .string()\n  .min(1)\n  .max(1024)\n  .regex(/^user:[^\\r\\n]+$(?![\\s\\S])/);\nexport const ExternalIdentityReference = z\n  .object({\n    externalId,\n    source: source.default(\"default\"),\n  })\n  .strict();\nexport type ExternalIdentityReference = z.infer<typeof ExternalIdentityReference>;\n\nexport const AddExternalWorkspaceMemberRequest = z\n  .object({\n    identity: ExternalIdentityReference,\n    permissions: z.array(Permission).min(1).max(Permission.options.length),\n    /** Opt-in durable operation identity; unkeyed legacy requests are not cancellable. */\n    operationId: z.string().uuid().optional(),\n  })\n  .strict();\nexport type AddExternalWorkspaceMemberRequest = z.infer<typeof AddExternalWorkspaceMemberRequest>;\n\n/** Content-free service lookup, including identities which can no longer act. */\nexport const ExternalIdentityLookup = z.discriminatedUnion(\"found\", [\n  z.object({ found: z.literal(false) }).strict(),\n  z\n    .object({\n      found: z.literal(true),\n      subjectId: externalSubject,\n      organizationMembershipId: z.string().uuid(),\n      identityStatus: z.enum([\"active\", \"disabled\", \"revoked\"]),\n      identityAuthorizationRevision: z.number().int().positive().safe(),\n      membershipStatus: z.enum([\"provisioning\", \"active\", \"suspended\", \"revoked\"]),\n      membershipAuthorizationRevision: z.number().int().positive().safe(),\n    })\n    .strict(),\n]);\nexport type ExternalIdentityLookup = z.infer<typeof ExternalIdentityLookup>;\n\n/** Terminal withdrawal of this external member's workspace access, also fencing\n * an exact earlier onboarding operation whether or not it has reached the API. */\nexport const CancelExternalWorkspaceMemberGrantRequest = z\n  .object({\n    operationId: z.string().uuid(),\n    cancelGrantOperationId: z.string().uuid(),\n  })\n  .strict()\n  .refine((value) => value.operationId !== value.cancelGrantOperationId, {\n    message: \"Revocation and grant must use different operation identities\",\n  });\nexport type CancelExternalWorkspaceMemberGrantRequest = z.infer<\n  typeof CancelExternalWorkspaceMemberGrantRequest\n>;\nexport const CancelExternalWorkspaceMemberGrantResponse = z\n  .object({\n    removed: z.boolean(),\n    replay: z.boolean(),\n    fencedGrantOperationId: z.string().uuid(),\n  })\n  .strict();\nexport type CancelExternalWorkspaceMemberGrantResponse = z.infer<\n  typeof CancelExternalWorkspaceMemberGrantResponse\n>;\n\n/** Uses the organization membership ID returned by lazy identity admission.\n * Reactivation restores admission only, not revoked work or workspace grants. */\nexport const UpdateExternalIdentityMembershipRequest = z\n  .object({\n    kind: z.enum([\"suspend\", \"reactivate\", \"offboard\"]),\n    expectedAuthorizationRevision: z.number().int().positive().safe(),\n    operationId: z.string().uuid(),\n    reason: z.string().max(512).optional(),\n  })\n  .strict();\nexport type UpdateExternalIdentityMembershipRequest = z.infer<\n  typeof UpdateExternalIdentityMembershipRequest\n>;\n\nexport const ExternalActorSelection = z.discriminatedUnion(\"mode\", [\n  z.object({ mode: z.literal(\"external\"), identity: ExternalIdentityReference }).strict(),\n  z\n    .object({\n      mode: z.literal(\"linked_native\"),\n      identity: ExternalIdentityReference,\n      linkId: z.string().uuid(),\n      expectedLinkRevision: z.number().int().positive().safe(),\n    })\n    .strict(),\n]);\nexport type ExternalActorSelection = z.infer<typeof ExternalActorSelection>;\n\nexport const ExternalIdentity = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    source,\n    externalId,\n    subjectId: externalSubject,\n    organizationMembershipId: z.string().uuid(),\n    personalWorkspaceId: z.string().uuid(),\n    status: z.enum([\"active\", \"disabled\", \"revoked\"]),\n    authorizationRevision: z.number().int().positive().safe(),\n  })\n  .strict();\nexport type ExternalIdentity = z.infer<typeof ExternalIdentity>;\n\n// Audit attribution, not authentication. Only the canonical access resolver\n// may establish provenance; accepting this JSON from a browser proves nothing.\nexport const ExternalActorAttribution = z\n  .object({\n    accountId: z.string().uuid(),\n    authenticatingApiKeyId: z.string().uuid(),\n    externalIdentityId: z.string().uuid(),\n    externalSubjectId: externalSubject,\n    externalAuthorizationRevision: z.number().int().positive().safe(),\n    effectiveSubjectId: z.string().min(1).max(1024),\n    actingMode: z.enum([\"external\", \"linked_native\"]),\n    linkId: z.string().uuid().optional(),\n    linkRevision: z.number().int().positive().safe().optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.actingMode === \"external\") {\n      if (\n        value.effectiveSubjectId !== value.externalSubjectId ||\n        value.linkId !== undefined ||\n        value.linkRevision !== undefined\n      ) {\n        context.addIssue({\n          code: \"custom\",\n          message: \"External mode cannot delegate native identity\",\n        });\n      }\n    } else if (\n      !value.linkId ||\n      !value.linkRevision ||\n      !nativeSubject.safeParse(value.effectiveSubjectId).success\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        message: \"Linked mode requires exact native delegation provenance\",\n      });\n    }\n  });\nexport type ExternalActorAttribution = z.infer<typeof ExternalActorAttribution>;\n\n/** Server-signed/encrypted continuation data, never sufficient live authority. */\nexport const ExternalActorContinuation = z\n  .object({\n    identity: ExternalIdentityReference,\n    actor: ExternalActorAttribution,\n  })\n  .strict();\nexport type ExternalActorContinuation = z.infer<typeof ExternalActorContinuation>;\n\nexport const ExternalIdentityLink = z\n  .object({\n    id: z.string().uuid(),\n    accountId: z.string().uuid(),\n    externalIdentityId: z.string().uuid(),\n    externalIdentity: ExternalIdentityReference.optional(),\n    nativeSubjectId: nativeSubject.nullable(),\n    status: z.enum([\"pending\", \"active\", \"revoked\", \"expired\"]),\n    revision: z.number().int().positive().safe(),\n    permissions: z.array(Permission).max(Permission.options.length),\n    expiresAt: z.string().datetime({ offset: true }).nullable(),\n  })\n  .strict()\n  .refine(\n    (value) => value.status !== \"active\" || value.nativeSubjectId !== null,\n    \"An active link requires a confirmed native identity\",\n  );\nexport type ExternalIdentityLink = z.infer<typeof ExternalIdentityLink>;\n\nexport const ExternalIdentityLinkPage = z\n  .object({\n    links: z.array(ExternalIdentityLink).max(50),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\nexport type ExternalIdentityLinkPage = z.infer<typeof ExternalIdentityLinkPage>;\n\n/** A native confirmation may narrow this request, never broaden it. The\n * challenge is delivered once to the host and is not an authentication token. */\nexport const BeginExternalIdentityLinkRequest = z\n  .object({\n    permissions: z.array(Permission).min(1).max(Permission.options.length),\n    expiresAt: z.string().datetime({ offset: true }).nullable().default(null),\n  })\n  .strict();\nexport type BeginExternalIdentityLinkRequest = z.input<typeof BeginExternalIdentityLinkRequest>;\nexport const ConfirmExternalIdentityLinkRequest = z\n  .object({\n    challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),\n    expectedRevision: z.number().int().positive().safe(),\n    permissions: z.array(Permission).min(1).max(Permission.options.length),\n  })\n  .strict();\nexport type ConfirmExternalIdentityLinkRequest = z.infer<typeof ConfirmExternalIdentityLinkRequest>;\nexport const BeginExternalIdentityLinkResponse = z\n  .object({\n    link: ExternalIdentityLink,\n    challenge: z.string().regex(/^[A-Za-z0-9_-]{43}$/),\n    confirmBefore: z.string().datetime({ offset: true }),\n  })\n  .strict();\nexport type BeginExternalIdentityLinkResponse = z.infer<typeof BeginExternalIdentityLinkResponse>;\nexport const ExternalIdentityLinkPreview = z\n  .object({\n    link: ExternalIdentityLink,\n    externalIdentity: ExternalIdentityReference,\n    nativeSubjectId: nativeSubject,\n    organizationId: z.string().uuid(),\n  })\n  .strict();\nexport type ExternalIdentityLinkPreview = z.infer<typeof ExternalIdentityLinkPreview>;\n\n/** Immutable accepted-work restriction, not a browser credential. Original key\n * identity remains audit-only; durable use validates the live link and members. */\nexport const ExternalLinkWorkSnapshot = z\n  .object({\n    identity: ExternalIdentityReference,\n    actor: ExternalActorAttribution.refine((value) => value.actingMode === \"linked_native\"),\n    permissions: z.array(Permission).max(Permission.options.length),\n  })\n  .strict();\nexport type ExternalLinkWorkSnapshot = z.infer<typeof ExternalLinkWorkSnapshot>;\n"],"mappings":";;;;;AAAA,SAAS,SAAS;AAQlB,IAAM,UAAU,IAAI,YAAY;AAChC,SAAS,WAAW,UAAkB;AACpC,SAAO,EACJ,OAAO,EACP,IAAI,CAAC,EACL,IAAI,QAAQ,EACZ;AAAA,IACC,CAAC,UACC,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,QAAQ,OAAO,KAAK,EAAE,cAAc;AAAA,IACtC;AAAA,MACE,SAAS,+DAA+D,QAAQ;AAAA,IAClF;AAAA,EACF;AACJ;AACA,IAAM,aAAa,WAAW,IAAI;AAClC,IAAM,SAAS,WAAW,GAAG;AAC7B,IAAM,kBAAkB,EACrB,OAAO,EACP,MAAM,wFAAwF;AACjG,IAAM,gBAAgB,EACnB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,MAAM,2BAA2B;AAC7B,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN;AAAA,EACA,QAAQ,OAAO,QAAQ,SAAS;AAClC,CAAC,EACA,OAAO;AAGH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,UAAU;AAAA,EACV,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,WAAW,QAAQ,MAAM;AAAA;AAAA,EAErE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC1C,CAAC,EACA,OAAO;AAIH,IAAM,yBAAyB,EAAE,mBAAmB,SAAS;AAAA,EAClE,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,KAAK,EAAE,CAAC,EAAE,OAAO;AAAA,EAC7C,EACG,OAAO;AAAA,IACN,OAAO,EAAE,QAAQ,IAAI;AAAA,IACrB,WAAW;AAAA,IACX,0BAA0B,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1C,gBAAgB,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,IACxD,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,IAChE,kBAAkB,EAAE,KAAK,CAAC,gBAAgB,UAAU,aAAa,SAAS,CAAC;AAAA,IAC3E,iCAAiC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACpE,CAAC,EACA,OAAO;AACZ,CAAC;AAKM,IAAM,4CAA4C,EACtD,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,wBAAwB,EAAE,OAAO,EAAE,KAAK;AAC1C,CAAC,EACA,OAAO,EACP,OAAO,CAAC,UAAU,MAAM,gBAAgB,MAAM,wBAAwB;AAAA,EACrE,SAAS;AACX,CAAC;AAII,IAAM,6CAA6C,EACvD,OAAO;AAAA,EACN,SAAS,EAAE,QAAQ;AAAA,EACnB,QAAQ,EAAE,QAAQ;AAAA,EAClB,wBAAwB,EAAE,OAAO,EAAE,KAAK;AAC1C,CAAC,EACA,OAAO;AAOH,IAAM,0CAA0C,EACpD,OAAO;AAAA,EACN,MAAM,EAAE,KAAK,CAAC,WAAW,cAAc,UAAU,CAAC;AAAA,EAClD,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAChE,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,QAAQ,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AACvC,CAAC,EACA,OAAO;AAKH,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EACjE,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,GAAG,UAAU,0BAA0B,CAAC,EAAE,OAAO;AAAA,EACtF,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,eAAe;AAAA,IAC/B,UAAU;AAAA,IACV,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACzD,CAAC,EACA,OAAO;AACZ,CAAC;AAGM,IAAM,mBAAmB,EAC7B,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B;AAAA,EACA;AAAA,EACA,WAAW;AAAA,EACX,0BAA0B,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1C,qBAAqB,EAAE,OAAO,EAAE,KAAK;AAAA,EACrC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAC1D,CAAC,EACA,OAAO;AAKH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,wBAAwB,EAAE,OAAO,EAAE,KAAK;AAAA,EACxC,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,mBAAmB;AAAA,EACnB,+BAA+B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAChE,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC9C,YAAY,EAAE,KAAK,CAAC,YAAY,eAAe,CAAC;AAAA,EAChD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,eAAe,YAAY;AACnC,QACE,MAAM,uBAAuB,MAAM,qBACnC,MAAM,WAAW,UACjB,MAAM,iBAAiB,QACvB;AACA,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,WACE,CAAC,MAAM,UACP,CAAC,MAAM,gBACP,CAAC,cAAc,UAAU,MAAM,kBAAkB,EAAE,SACnD;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAII,IAAM,4BAA4B,EACtC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uBAAuB,EACjC,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,kBAAkB,0BAA0B,SAAS;AAAA,EACrD,iBAAiB,cAAc,SAAS;AAAA,EACxC,QAAQ,EAAE,KAAK,CAAC,WAAW,UAAU,WAAW,SAAS,CAAC;AAAA,EAC1D,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EAC3C,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,WAAW,QAAQ,MAAM;AAAA,EAC9D,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS;AAC5D,CAAC,EACA,OAAO,EACP;AAAA,EACC,CAAC,UAAU,MAAM,WAAW,YAAY,MAAM,oBAAoB;AAAA,EAClE;AACF;AAGK,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,OAAO,EAAE,MAAM,oBAAoB,EAAE,IAAI,EAAE;AAAA,EAC3C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAKH,IAAM,mCAAmC,EAC7C,OAAO;AAAA,EACN,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,WAAW,QAAQ,MAAM;AAAA,EACrE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,EAAE,SAAS,EAAE,QAAQ,IAAI;AAC1E,CAAC,EACA,OAAO;AAEH,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACjD,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK;AAAA,EACnD,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,CAAC,EAAE,IAAI,WAAW,QAAQ,MAAM;AACvE,CAAC,EACA,OAAO;AAEH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,MAAM;AAAA,EACN,WAAW,EAAE,OAAO,EAAE,MAAM,qBAAqB;AAAA,EACjD,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AACrD,CAAC,EACA,OAAO;AAEH,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,MAAM;AAAA,EACN,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAClC,CAAC,EACA,OAAO;AAKH,IAAM,2BAA2B,EACrC,OAAO;AAAA,EACN,UAAU;AAAA,EACV,OAAO,yBAAyB,OAAO,CAAC,UAAU,MAAM,eAAe,eAAe;AAAA,EACtF,aAAa,EAAE,MAAM,UAAU,EAAE,IAAI,WAAW,QAAQ,MAAM;AAChE,CAAC,EACA,OAAO;","names":[]}

package/dist/{chunk-OSBYTE3O.js → chunk-OVFORMPW.js}

@@ -4,7 +4,7 @@ import {
   SessionTenancyVisibility,
   UserResourceAuthorityGrant,
   UserResourceDelegation
-} from "./chunk-UR2GFYIE.js";
+} from "./chunk-QQUJ6NPW.js";
 
 // src/connection-authority.ts
 import { z } from "zod";
@@ -345,4 +345,4 @@ export {
   ConnectionUseAuditFact,
   ConnectionUseAuthorizationResult
 };
-//# sourceMappingURL=chunk-OSBYTE3O.js.map
+//# sourceMappingURL=chunk-OVFORMPW.js.map