@opengeni/contracts 3.1.0-canary.1 → 3.1.2

package/dist/chunk-TLU3UEMD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/site-operations.ts","../src/site-session-http.ts"],"sourcesContent":["// Zod-free on purpose: browser bundles (the Site runtime, the console Site\n// bridge and the gateway shell) import this module, and must not pull in zod.\n\n// ---------------------------------------------------------------------------\n// Site operation allowlist\n// ---------------------------------------------------------------------------\n\n/**\n * Every HTTP operation Site code may perform through a host, as an explicit\n * allowlist (method + exact path shape) rather than a URL prefix. Paths are\n * the suffix after `/v1/workspaces/site-host` that the in-Site SDK client\n * uses; `/v1/config/client` is the one path outside that prefix.\n *\n * The console host forwards an allowed operation to the ordinary workspace\n * route with Site provenance. The gateway forwards it to `/_og/api<suffix>`\n * and the API serves it at `/v1/site-runtime<suffix>`. `agent: true` marks\n * operations that start or message an agent; every such route records which\n * Site (and version) originated it.\n */\nexport type SiteOperationMethod = \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\nexport type SiteOperation = {\n  id: string;\n  method: SiteOperationMethod;\n  /** Anchored pattern on the site-host suffix (`\"\"` is the workspace itself). */\n  pattern: RegExp;\n  agent?: true;\n  stream?: true;\n};\n\nconst ID = \"[A-Za-z0-9_-]{1,128}\";\nconst DATA = \"/published-artifacts/current/(?:data|files)(?:/[A-Za-z0-9._~:@!$&'()*+,;=-]+)*\";\n\nexport const SITE_OPERATIONS: readonly SiteOperation[] = Object.freeze([\n  { id: \"config.client\", method: \"GET\", pattern: /^\\/v1\\/config\\/client$/u },\n  { id: \"workspace.get\", method: \"GET\", pattern: /^$/u },\n  { id: \"site.config\", method: \"GET\", pattern: /^\\/site\\/config$/u },\n  { id: \"models.list\", method: \"GET\", pattern: /^\\/model-catalog$/u },\n  { id: \"sessions.list\", method: \"GET\", pattern: /^\\/sessions$/u },\n  { id: \"sessions.create\", method: \"POST\", pattern: /^\\/sessions$/u, agent: true },\n  { id: \"sessions.get\", method: \"GET\", pattern: new RegExp(`^/sessions/${ID}$`, \"u\") },\n  { id: \"sessions.events\", method: \"GET\", pattern: new RegExp(`^/sessions/${ID}/events$`, \"u\") },\n  {\n    id: \"sessions.stream\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/events/stream$`, \"u\"),\n    stream: true,\n  },\n  {\n    id: \"sessions.send\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/events$`, \"u\"),\n    agent: true,\n  },\n  {\n    id: \"sessions.steer\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/steer$`, \"u\"),\n    agent: true,\n  },\n  {\n    id: \"sessions.control\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/control$`, \"u\"),\n    agent: true,\n  },\n  { id: \"sessions.queue\", method: \"GET\", pattern: new RegExp(`^/sessions/${ID}/queue$`, \"u\") },\n  // SessionConversation's documented queue edit/delete/steer/move.\n  {\n    id: \"sessions.queue.item\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/queue/${ID}/(?:move|edit|steer|delete)$`, \"u\"),\n    agent: true,\n  },\n  // SessionConversation's durable composer draft and its Send.\n  {\n    id: \"sessions.composerDraft.get\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/composer-draft$`, \"u\"),\n  },\n  {\n    id: \"sessions.composerDraft.put\",\n    method: \"PUT\",\n    pattern: new RegExp(`^/sessions/${ID}/composer-draft$`, \"u\"),\n  },\n  {\n    id: \"sessions.composerDraft.submit\",\n    method: \"POST\",\n    pattern: new RegExp(`^/sessions/${ID}/composer-draft/submit$`, \"u\"),\n    agent: true,\n  },\n  {\n    id: \"sessions.humanInput\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/human-input-requests$`, \"u\"),\n  },\n  // SessionConversation's human-input form reads the one open request.\n  {\n    id: \"sessions.humanInput.get\",\n    method: \"GET\",\n    pattern: new RegExp(`^/sessions/${ID}/human-input-requests/${ID}$`, \"u\"),\n  },\n  { id: \"data.read\", method: \"GET\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.write\", method: \"POST\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.put\", method: \"PUT\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.patch\", method: \"PATCH\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  { id: \"data.delete\", method: \"DELETE\", pattern: new RegExp(`^${DATA}$`, \"u\") },\n  // Site SQL (PR B): run one named query the owner defined; never raw SQL.\n  {\n    id: \"sql.run\",\n    method: \"POST\",\n    pattern: /^\\/published-artifacts\\/current\\/sql\\/queries\\/[A-Za-z][A-Za-z0-9_-]{0,63}$/u,\n  },\n  { id: \"site.report\", method: \"POST\", pattern: /^\\/site\\/reports$/u },\n] satisfies SiteOperation[]);\n\n/**\n * Tool bridge methods (MessagePort, not HTTP). The gateway serves them at\n * POST /_og/api/tools/<method>; the console uses its tool gateway client.\n */\nexport const SITE_TOOL_METHODS = Object.freeze([\n  \"catalog\",\n  \"declarations\",\n  \"call\",\n  \"resolve\",\n  \"invoke\",\n] as const);\nexport type SiteToolMethod = (typeof SITE_TOOL_METHODS)[number];\n\nconst SITE_HOST_PREFIX = \"/v1/workspaces/site-host\";\n\n/**\n * Match a Site-originated request against the allowlist. `path` is the\n * pathname the in-Site SDK used (`/v1/workspaces/site-host/...` or\n * `/v1/config/client`), without query. Returns the operation and the\n * site-host suffix, or null when the operation is not allowed. Refuses\n * encoded separators, dot segments and control characters.\n */\nexport function matchSiteOperation(\n  method: string,\n  path: string,\n): { operation: SiteOperation; suffix: string } | null {\n  if (/[%\\\\#\\u0000-\\u0020\\u007f]/u.test(path)) return null;\n  if (path.split(\"/\").some((part) => part === \".\" || part === \"..\")) return null;\n  const upper = method.toUpperCase();\n  let suffix: string;\n  if (path === \"/v1/config/client\") suffix = path;\n  else if (path === SITE_HOST_PREFIX) suffix = \"\";\n  else if (path.startsWith(`${SITE_HOST_PREFIX}/`)) suffix = path.slice(SITE_HOST_PREFIX.length);\n  else return null;\n  const operation = SITE_OPERATIONS.find(\n    (candidate) => candidate.method === upper && candidate.pattern.test(suffix),\n  );\n  return operation ? { operation, suffix } : null;\n}\n","import { matchSiteOperation, type SiteOperation } from \"./site-operations\";\n\nconst SITE_WORKSPACE_PREFIX = \"/v1/workspaces/site-host\";\n/** Site Data and Site SQL routes under any published Site: `<prefix>/published-artifacts/<id>/data|files|sql`. */\nconst SITE_DATA_PATH =\n  /^\\/v1\\/workspaces\\/site-host\\/published-artifacts\\/([^/]+)\\/(?:data|files|sql)(?:\\/|$)/u;\n/** The list filter a frame without a published Site gets: it names no Site, so lists nothing. */\nexport const SITE_NO_ORIGIN_ID = \"00000000-0000-0000-0000-000000000000\";\n\n/**\n * The header a host sets on every request it forwards from a Site frame. The\n * value names the host: `1` for the console bridge, `preview` for a Codemode\n * local preview. The API treats a request carrying it (or the pinned Site id)\n * as Site code: only `SITE_OPERATIONS`, only the frame's own sessions.\n */\nexport const SITE_FRAME_HEADER = \"x-opengeni-site-frame\";\n/** SITE_FRAME_HEADER value a Codemode local preview sets. */\nexport const SITE_PREVIEW_FRAME = \"preview\";\n/**\n * A random id the host mints per mounted frame. A frame without a published\n * Site (inline HTML, previews) records it on the sessions it starts and may\n * reach only those sessions afterwards.\n */\nexport const SITE_FRAME_ID_HEADER = \"x-opengeni-site-frame-id\";\n/** The published Site (artifact id) a host pinned the frame to. */\nexport const SITE_ID_HEADER = \"x-opengeni-site-id\";\n/** The exact Site version the pinned frame runs. */\nexport const SITE_VERSION_HEADER = \"x-opengeni-site-version\";\n\n/** A Site/Codemode SDK request named a route outside the proxied surface. */\nexport class SiteSessionPathError extends Error {\n  readonly code = \"site_session_path_unsupported\";\n\n  constructor() {\n    super(\"Unsupported Site session API path\");\n    this.name = \"SiteSessionPathError\";\n  }\n}\n\n/** The host serves no Site Data: it is not bound to a published Site (inline HTML, previews). */\nexport class SiteDataUnsupportedError extends Error {\n  readonly code = \"site_data_unsupported\";\n\n  constructor() {\n    super(\"This Site host does not provide Site Data\");\n    this.name = \"SiteDataUnsupportedError\";\n  }\n}\n\nfunction unsafePathname(pathname: string): boolean {\n  return (\n    /[%\\\\#\\u0000-\\u0020\\u007f]/u.test(pathname) ||\n    pathname.split(\"/\").some((part) => part === \".\" || part === \"..\")\n  );\n}\n\nfunction hostWorkspacePath(path: string, workspaceId: string): string {\n  return path.replace(\"/workspaces/site-host\", `/workspaces/${encodeURIComponent(workspaceId)}`);\n}\n\n/** Site Data: a Site reaches only its own data, as `current`, through a host bound to a published Site. */\nfunction siteDataPath(path: string, rewritten: string, workspaceId: string, siteId?: string) {\n  // Inside the Site the alias stays unresolved; the host resolves it.\n  if (workspaceId === \"site-host\") return path;\n  // Only a host bound to a published Site serves its data.\n  if (!siteId) throw new SiteDataUnsupportedError();\n  return rewritten.replace(\n    \"/published-artifacts/current/\",\n    `/published-artifacts/${encodeURIComponent(siteId)}/`,\n  );\n}\n\n/**\n * Route a request from Site code (the in-Site SDK, the console bridge, a\n * Codemode preview) to the host workspace. This is the `SITE_OPERATIONS`\n * allowlist: anything else is refused with SiteSessionPathError before any\n * request is made. Ordinary API handlers still authorize every allowed\n * operation with the viewer's own authority, and the API independently\n * refuses frame requests outside the allowlist or to another Site's sessions.\n *\n * `workspaceId` `site-host` checks a path inside the Site without rewriting\n * it. A session list must name `originSiteId=current`; the host binds it to\n * its pinned Site, or to no Site at all when the frame has none.\n */\nexport function siteSessionPath(\n  path: string,\n  workspaceId: string,\n  method = \"GET\",\n  siteId?: string,\n): string {\n  const pathname = path.split(\"?\")[0]!;\n  const match = matchSiteOperation(method, pathname);\n  if (!match) throw new SiteSessionPathError();\n  const rewritten = hostWorkspacePath(path, workspaceId);\n  if (SITE_DATA_PATH.test(pathname)) return siteDataPath(path, rewritten, workspaceId, siteId);\n  if (match.operation.id !== \"sessions.list\") return rewritten;\n  // A Site lists only its own conversations. Never widen a Site list to the workspace.\n  const url = new URL(rewritten, \"http://site.invalid\");\n  const origins = url.searchParams.getAll(\"originSiteId\");\n  if (origins.length !== 1 || origins[0] !== \"current\") throw new SiteSessionPathError();\n  if (workspaceId === \"site-host\") return path;\n  url.searchParams.set(\"originSiteId\", siteId ?? SITE_NO_ORIGIN_ID);\n  return url.pathname + url.search;\n}\n\n/**\n * Route an agent's own SDK request through the Codemode SDK proxy to its\n * workspace. Unlike `siteSessionPath` this is a URL prefix boundary, not an\n * operation allowlist: the proxy signs a short-lived credential bounded by\n * the agent's own permission ceiling and ordinary handlers authorize every\n * operation. Site Data is not served here (an agent uses its tools).\n * Requests a Codemode preview forwards from Site code carry the frame marker\n * and use `siteSessionPath` instead.\n */\nexport function siteHostWorkspacePath(path: string, workspaceId: string): string {\n  const pathname = path.split(\"?\")[0]!;\n  const workspace =\n    pathname === SITE_WORKSPACE_PREFIX || pathname.startsWith(`${SITE_WORKSPACE_PREFIX}/`);\n  if ((!workspace && pathname !== \"/v1/config/client\") || unsafePathname(pathname))\n    throw new SiteSessionPathError();\n  const rewritten = hostWorkspacePath(path, workspaceId);\n  const data = SITE_DATA_PATH.exec(pathname);\n  if (data) {\n    if (data[1] !== \"current\") throw new SiteSessionPathError();\n    return siteDataPath(path, rewritten, workspaceId);\n  }\n  const url = new URL(rewritten, \"http://site.invalid\");\n  if (url.searchParams.get(\"originSiteId\") === \"current\" && workspaceId !== \"site-host\") {\n    url.searchParams.set(\"originSiteId\", SITE_NO_ORIGIN_ID);\n    return url.pathname + url.search;\n  }\n  return rewritten;\n}\n\n/** The Site identity a host attached to a request, from its host-set headers. */\nexport type SiteFrameHeaders = {\n  /** The pinned published Site id, or null for a frame without one. */\n  siteId: string | null;\n  versionId: string | null;\n  /** The host's frame marker value (`1`, `preview`), or null when only the Site id was set. */\n  marker: string | null;\n  frameId: string | null;\n};\n\n/** Read the host-set frame headers. Null when the request did not come from a Site frame. */\nexport function siteFrameFromHeaders(\n  header: (name: string) => string | null | undefined,\n): SiteFrameHeaders | null {\n  const value = (name: string) => header(name) ?? null;\n  const marker = value(SITE_FRAME_HEADER);\n  const siteId = value(SITE_ID_HEADER);\n  const versionId = value(SITE_VERSION_HEADER);\n  const frameId = value(SITE_FRAME_ID_HEADER);\n  if (marker === null && siteId === null && versionId === null && frameId === null) return null;\n  return { siteId: siteId || null, versionId: versionId || null, marker, frameId: frameId || null };\n}\n\n/**\n * Match a request that reached a workspace route from a Site frame against\n * `SITE_OPERATIONS`. `pathname` is the raw request path\n * (`/v1/workspaces/<id>/...` or `/v1/config/client`). The frame's own pinned\n * Site id maps back to `current`; any other Site id does not match.\n */\nexport function siteFrameOperation(\n  method: string,\n  pathname: string,\n  workspaceId: string,\n  frameSiteId: string | null,\n): { operation: SiteOperation; suffix: string; sessionId: string | null } | null {\n  if (unsafePathname(pathname)) return null;\n  let sitePath = pathname;\n  if (pathname !== \"/v1/config/client\") {\n    const prefix = `/v1/workspaces/${workspaceId}`;\n    if (pathname !== prefix && !pathname.startsWith(`${prefix}/`)) return null;\n    sitePath = `${SITE_WORKSPACE_PREFIX}${pathname.slice(prefix.length)}`;\n    const data = /^\\/v1\\/workspaces\\/site-host\\/published-artifacts\\/([^/]+)\\//u.exec(sitePath);\n    if (data) {\n      if (!frameSiteId || data[1] !== frameSiteId) return null;\n      sitePath = sitePath.replace(\n        `/published-artifacts/${frameSiteId}/`,\n        \"/published-artifacts/current/\",\n      );\n    }\n  }\n  const match = matchSiteOperation(method, sitePath);\n  if (!match) return null;\n  const session = /^\\/sessions\\/([^/]+)(?:\\/|$)/u.exec(match.suffix);\n  return { ...match, sessionId: session ? session[1]! : null };\n}\n\n/** Preserve SDK request semantics while the host supplies identity and transport headers. */\nexport function siteRequestHeaders(input: HeadersInit): Headers {\n  const headers = new Headers(input);\n  const connectionHeaders = (headers.get(\"connection\") ?? \"\")\n    .split(\",\")\n    .map((value) => value.trim().toLowerCase());\n  for (const name of [...headers.keys()]) {\n    if (\n      connectionHeaders.includes(name) ||\n      /^(authorization|proxy-authorization|cookie|cookie2|host|origin|referer|connection|keep-alive|proxy-connection|te|trailer|transfer-encoding|upgrade|content-length|accept-encoding|forwarded|x-api-key)$/i.test(\n        name,\n      ) ||\n      /^(sec-|x-forwarded-|x-opengeni-(access-key|external-actor|site-|managed-actor))/i.test(name)\n    )\n      headers.delete(name);\n  }\n  return headers;\n}\n\n// ---------------------------------------------------------------------------\n// What a Site frame may put in a request body\n// ---------------------------------------------------------------------------\n\n/** Message fields a Site page may set: the text and how the model answers it. */\nconst SITE_FRAME_MESSAGE_FIELDS = [\n  \"text\",\n  \"annotations\",\n  \"model\",\n  \"reasoningEffort\",\n  \"latencyMode\",\n  \"controlEtag\",\n  \"expectedDraftRevision\",\n] as const;\n\n/**\n * Body fields a Site frame may send per operation. Anything else with a\n * value (resources, personal resource attachments, MCP credential updates,\n * connection accounts, model context, approval decisions, human-input\n * answers) is the person's to give in the console, never a Site page's.\n */\nconst SITE_FRAME_BODY_FIELDS: Readonly<Record<string, readonly string[]>> = Object.freeze({\n  \"sessions.send\": [\"type\", \"payload\", \"clientEventId\"],\n  \"sessions.steer\": [...SITE_FRAME_MESSAGE_FIELDS, \"clientEventId\"],\n  \"sessions.control\": [\"action\", \"reason\", \"clientEventId\", \"expectedControlEtag\"],\n  \"sessions.composerDraft.put\": [\n    \"text\",\n    \"annotations\",\n    \"resources\",\n    \"model\",\n    \"reasoningEffort\",\n    \"latencyMode\",\n    \"expectedRevision\",\n  ],\n  \"sessions.composerDraft.submit\": [\n    ...SITE_FRAME_MESSAGE_FIELDS,\n    \"resources\",\n    \"connectionAccounts\",\n    \"clientEventId\",\n    \"delivery\",\n  ],\n  \"sessions.queue.move\": [\"clientEventId\", \"expectedQueueVersion\", \"beforeTurnId\"],\n  \"sessions.queue.edit\": [\n    \"clientEventId\",\n    \"expectedTurnVersion\",\n    \"expectedDraftRevision\",\n    \"replaceDraft\",\n  ],\n  \"sessions.queue.steer\": [\"clientEventId\", \"expectedTurnVersion\", \"controlEtag\"],\n  \"sessions.queue.delete\": [\"clientEventId\", \"expectedTurnVersion\", \"reason\"],\n});\n\n/** Fields allowed above only while empty: a draft carries no resources or accounts. */\nconst SITE_FRAME_EMPTY_ONLY_FIELDS = new Set([\"resources\", \"connectionAccounts\"]);\n\n/**\n * Session create fields a Site frame may send. The API starts the session\n * with a minimal Site profile: no tools, servers, connections, permissions,\n * vaults, sandbox or environment choice, resources, Skills, agent overrides,\n * hidden model context, learning overrides, goals, channels, visibility,\n * usage limits or nesting. Metadata keeps only keys outside `_opengeni`.\n */\nexport const SITE_FRAME_SESSION_CREATE_FIELDS: readonly string[] = Object.freeze([\n  \"initialMessage\",\n  \"requestedSessionId\",\n  \"idempotencyKey\",\n  \"clientEventId\",\n  \"model\",\n  \"reasoningEffort\",\n  \"latencyMode\",\n  \"startMode\",\n  \"metadata\",\n]);\n\nfunction bodyRecord(value: unknown): Record<string, unknown> | null {\n  return value && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\n/** Absent, null, an empty list or an empty object asks for nothing. */\nfunction emptyBodyValue(value: unknown): boolean {\n  if (value === undefined || value === null) return true;\n  if (Array.isArray(value)) return value.length === 0;\n  if (typeof value === \"object\") return Object.keys(value).length === 0;\n  return false;\n}\n\nfunction refusedField(\n  body: Record<string, unknown>,\n  allowed: readonly string[],\n  prefix = \"\",\n): string | null {\n  for (const [name, value] of Object.entries(body)) {\n    if (emptyBodyValue(value)) continue;\n    if (!allowed.includes(name) || SITE_FRAME_EMPTY_ONLY_FIELDS.has(name))\n      return `${prefix}${name}`;\n  }\n  return null;\n}\n\n/**\n * The first body field a Site frame may not send for this operation (for\n * example `payload.resources` or `type`), or null when the body is allowed.\n * `suffix` is the operation's site-host suffix (from `siteFrameOperation` or\n * `matchSiteOperation`). A body that is not a JSON object is left to the\n * route, which refuses it. Only `user.message` events are allowed:\n * approvals and answers to questions happen in the console.\n */\nexport function siteFrameBodyRefusal(\n  operationId: string,\n  suffix: string,\n  body: unknown,\n): string | null {\n  const record = bodyRecord(body);\n  if (!record) return null;\n  if (operationId === \"sessions.create\")\n    return refusedField(record, SITE_FRAME_SESSION_CREATE_FIELDS);\n  const action =\n    operationId === \"sessions.queue.item\"\n      ? /\\/queue\\/[^/]+\\/(move|edit|steer|delete)$/u.exec(suffix)?.[1]\n      : undefined;\n  const key = action ? `sessions.queue.${action}` : operationId;\n  const allowed = SITE_FRAME_BODY_FIELDS[key];\n  if (!allowed) return null;\n  const refused = refusedField(record, allowed);\n  if (refused) return refused;\n  if (operationId !== \"sessions.send\") return null;\n  if (record.type !== \"user.message\") return \"type\";\n  const payload = bodyRecord(record.payload);\n  return payload ? refusedField(payload, SITE_FRAME_MESSAGE_FIELDS, \"payload.\") : null;\n}\n"],"mappings":";AA6BA,IAAM,KAAK;AACX,IAAM,OAAO;AAEN,IAAM,kBAA4C,OAAO,OAAO;AAAA,EACrE,EAAE,IAAI,iBAAiB,QAAQ,OAAO,SAAS,0BAA0B;AAAA,EACzE,EAAE,IAAI,iBAAiB,QAAQ,OAAO,SAAS,MAAM;AAAA,EACrD,EAAE,IAAI,eAAe,QAAQ,OAAO,SAAS,oBAAoB;AAAA,EACjE,EAAE,IAAI,eAAe,QAAQ,OAAO,SAAS,qBAAqB;AAAA,EAClE,EAAE,IAAI,iBAAiB,QAAQ,OAAO,SAAS,gBAAgB;AAAA,EAC/D,EAAE,IAAI,mBAAmB,QAAQ,QAAQ,SAAS,iBAAiB,OAAO,KAAK;AAAA,EAC/E,EAAE,IAAI,gBAAgB,QAAQ,OAAO,SAAS,IAAI,OAAO,cAAc,EAAE,KAAK,GAAG,EAAE;AAAA,EACnF,EAAE,IAAI,mBAAmB,QAAQ,OAAO,SAAS,IAAI,OAAO,cAAc,EAAE,YAAY,GAAG,EAAE;AAAA,EAC7F;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,mBAAmB,GAAG;AAAA,IAC1D,QAAQ;AAAA,EACV;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,YAAY,GAAG;AAAA,IACnD,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,WAAW,GAAG;AAAA,IAClD,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,aAAa,GAAG;AAAA,IACpD,OAAO;AAAA,EACT;AAAA,EACA,EAAE,IAAI,kBAAkB,QAAQ,OAAO,SAAS,IAAI,OAAO,cAAc,EAAE,WAAW,GAAG,EAAE;AAAA;AAAA,EAE3F;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,UAAU,EAAE,gCAAgC,GAAG;AAAA,IACnF,OAAO;AAAA,EACT;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,oBAAoB,GAAG;AAAA,EAC7D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,oBAAoB,GAAG;AAAA,EAC7D;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,2BAA2B,GAAG;AAAA,IAClE,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,0BAA0B,GAAG;AAAA,EACnE;AAAA;AAAA,EAEA;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS,IAAI,OAAO,cAAc,EAAE,yBAAyB,EAAE,KAAK,GAAG;AAAA,EACzE;AAAA,EACA,EAAE,IAAI,aAAa,QAAQ,OAAO,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EACxE,EAAE,IAAI,cAAc,QAAQ,QAAQ,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EAC1E,EAAE,IAAI,YAAY,QAAQ,OAAO,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EACvE,EAAE,IAAI,cAAc,QAAQ,SAAS,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA,EAC3E,EAAE,IAAI,eAAe,QAAQ,UAAU,SAAS,IAAI,OAAO,IAAI,IAAI,KAAK,GAAG,EAAE;AAAA;AAAA,EAE7E;AAAA,IACE,IAAI;AAAA,IACJ,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AAAA,EACA,EAAE,IAAI,eAAe,QAAQ,QAAQ,SAAS,qBAAqB;AACrE,CAA2B;AAMpB,IAAM,oBAAoB,OAAO,OAAO;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAU;AAGV,IAAM,mBAAmB;AASlB,SAAS,mBACd,QACA,MACqD;AACrD,MAAI,6BAA6B,KAAK,IAAI,EAAG,QAAO;AACpD,MAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI,EAAG,QAAO;AAC1E,QAAM,QAAQ,OAAO,YAAY;AACjC,MAAI;AACJ,MAAI,SAAS,oBAAqB,UAAS;AAAA,WAClC,SAAS,iBAAkB,UAAS;AAAA,WACpC,KAAK,WAAW,GAAG,gBAAgB,GAAG,EAAG,UAAS,KAAK,MAAM,iBAAiB,MAAM;AAAA,MACxF,QAAO;AACZ,QAAM,YAAY,gBAAgB;AAAA,IAChC,CAAC,cAAc,UAAU,WAAW,SAAS,UAAU,QAAQ,KAAK,MAAM;AAAA,EAC5E;AACA,SAAO,YAAY,EAAE,WAAW,OAAO,IAAI;AAC7C;;;ACvJA,IAAM,wBAAwB;AAE9B,IAAM,iBACJ;AAEK,IAAM,oBAAoB;AAQ1B,IAAM,oBAAoB;AAE1B,IAAM,qBAAqB;AAM3B,IAAM,uBAAuB;AAE7B,IAAM,iBAAiB;AAEvB,IAAM,sBAAsB;AAG5B,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,mCAAmC;AACzC,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,2BAAN,cAAuC,MAAM;AAAA,EACzC,OAAO;AAAA,EAEhB,cAAc;AACZ,UAAM,2CAA2C;AACjD,SAAK,OAAO;AAAA,EACd;AACF;AAEA,SAAS,eAAe,UAA2B;AACjD,SACE,6BAA6B,KAAK,QAAQ,KAC1C,SAAS,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,SAAS,OAAO,SAAS,IAAI;AAEpE;AAEA,SAAS,kBAAkB,MAAc,aAA6B;AACpE,SAAO,KAAK,QAAQ,yBAAyB,eAAe,mBAAmB,WAAW,CAAC,EAAE;AAC/F;AAGA,SAAS,aAAa,MAAc,WAAmB,aAAqB,QAAiB;AAE3F,MAAI,gBAAgB,YAAa,QAAO;AAExC,MAAI,CAAC,OAAQ,OAAM,IAAI,yBAAyB;AAChD,SAAO,UAAU;AAAA,IACf;AAAA,IACA,wBAAwB,mBAAmB,MAAM,CAAC;AAAA,EACpD;AACF;AAcO,SAAS,gBACd,MACA,aACA,SAAS,OACT,QACQ;AACR,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC;AAClC,QAAM,QAAQ,mBAAmB,QAAQ,QAAQ;AACjD,MAAI,CAAC,MAAO,OAAM,IAAI,qBAAqB;AAC3C,QAAM,YAAY,kBAAkB,MAAM,WAAW;AACrD,MAAI,eAAe,KAAK,QAAQ,EAAG,QAAO,aAAa,MAAM,WAAW,aAAa,MAAM;AAC3F,MAAI,MAAM,UAAU,OAAO,gBAAiB,QAAO;AAEnD,QAAM,MAAM,IAAI,IAAI,WAAW,qBAAqB;AACpD,QAAM,UAAU,IAAI,aAAa,OAAO,cAAc;AACtD,MAAI,QAAQ,WAAW,KAAK,QAAQ,CAAC,MAAM,UAAW,OAAM,IAAI,qBAAqB;AACrF,MAAI,gBAAgB,YAAa,QAAO;AACxC,MAAI,aAAa,IAAI,gBAAgB,UAAU,iBAAiB;AAChE,SAAO,IAAI,WAAW,IAAI;AAC5B;AAWO,SAAS,sBAAsB,MAAc,aAA6B;AAC/E,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,CAAC;AAClC,QAAM,YACJ,aAAa,yBAAyB,SAAS,WAAW,GAAG,qBAAqB,GAAG;AACvF,MAAK,CAAC,aAAa,aAAa,uBAAwB,eAAe,QAAQ;AAC7E,UAAM,IAAI,qBAAqB;AACjC,QAAM,YAAY,kBAAkB,MAAM,WAAW;AACrD,QAAM,OAAO,eAAe,KAAK,QAAQ;AACzC,MAAI,MAAM;AACR,QAAI,KAAK,CAAC,MAAM,UAAW,OAAM,IAAI,qBAAqB;AAC1D,WAAO,aAAa,MAAM,WAAW,WAAW;AAAA,EAClD;AACA,QAAM,MAAM,IAAI,IAAI,WAAW,qBAAqB;AACpD,MAAI,IAAI,aAAa,IAAI,cAAc,MAAM,aAAa,gBAAgB,aAAa;AACrF,QAAI,aAAa,IAAI,gBAAgB,iBAAiB;AACtD,WAAO,IAAI,WAAW,IAAI;AAAA,EAC5B;AACA,SAAO;AACT;AAaO,SAAS,qBACd,QACyB;AACzB,QAAM,QAAQ,CAAC,SAAiB,OAAO,IAAI,KAAK;AAChD,QAAM,SAAS,MAAM,iBAAiB;AACtC,QAAM,SAAS,MAAM,cAAc;AACnC,QAAM,YAAY,MAAM,mBAAmB;AAC3C,QAAM,UAAU,MAAM,oBAAoB;AAC1C,MAAI,WAAW,QAAQ,WAAW,QAAQ,cAAc,QAAQ,YAAY,KAAM,QAAO;AACzF,SAAO,EAAE,QAAQ,UAAU,MAAM,WAAW,aAAa,MAAM,QAAQ,SAAS,WAAW,KAAK;AAClG;AAQO,SAAS,mBACd,QACA,UACA,aACA,aAC+E;AAC/E,MAAI,eAAe,QAAQ,EAAG,QAAO;AACrC,MAAI,WAAW;AACf,MAAI,aAAa,qBAAqB;AACpC,UAAM,SAAS,kBAAkB,WAAW;AAC5C,QAAI,aAAa,UAAU,CAAC,SAAS,WAAW,GAAG,MAAM,GAAG,EAAG,QAAO;AACtE,eAAW,GAAG,qBAAqB,GAAG,SAAS,MAAM,OAAO,MAAM,CAAC;AACnE,UAAM,OAAO,gEAAgE,KAAK,QAAQ;AAC1F,QAAI,MAAM;AACR,UAAI,CAAC,eAAe,KAAK,CAAC,MAAM,YAAa,QAAO;AACpD,iBAAW,SAAS;AAAA,QAClB,wBAAwB,WAAW;AAAA,QACnC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,mBAAmB,QAAQ,QAAQ;AACjD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,UAAU,gCAAgC,KAAK,MAAM,MAAM;AACjE,SAAO,EAAE,GAAG,OAAO,WAAW,UAAU,QAAQ,CAAC,IAAK,KAAK;AAC7D;AAGO,SAAS,mBAAmB,OAA6B;AAC9D,QAAM,UAAU,IAAI,QAAQ,KAAK;AACjC,QAAM,qBAAqB,QAAQ,IAAI,YAAY,KAAK,IACrD,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,EAAE,YAAY,CAAC;AAC5C,aAAW,QAAQ,CAAC,GAAG,QAAQ,KAAK,CAAC,GAAG;AACtC,QACE,kBAAkB,SAAS,IAAI,KAC/B,2MAA2M;AAAA,MACzM;AAAA,IACF,KACA,mFAAmF,KAAK,IAAI;AAE5F,cAAQ,OAAO,IAAI;AAAA,EACvB;AACA,SAAO;AACT;AAOA,IAAM,4BAA4B;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQA,IAAM,yBAAsE,OAAO,OAAO;AAAA,EACxF,iBAAiB,CAAC,QAAQ,WAAW,eAAe;AAAA,EACpD,kBAAkB,CAAC,GAAG,2BAA2B,eAAe;AAAA,EAChE,oBAAoB,CAAC,UAAU,UAAU,iBAAiB,qBAAqB;AAAA,EAC/E,8BAA8B;AAAA,IAC5B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,iCAAiC;AAAA,IAC/B,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,uBAAuB,CAAC,iBAAiB,wBAAwB,cAAc;AAAA,EAC/E,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,wBAAwB,CAAC,iBAAiB,uBAAuB,aAAa;AAAA,EAC9E,yBAAyB,CAAC,iBAAiB,uBAAuB,QAAQ;AAC5E,CAAC;AAGD,IAAM,+BAA+B,oBAAI,IAAI,CAAC,aAAa,oBAAoB,CAAC;AASzE,IAAM,mCAAsD,OAAO,OAAO;AAAA,EAC/E;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,WAAW,OAAgD;AAClE,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAC5D,QACD;AACN;AAGA,SAAS,eAAe,OAAyB;AAC/C,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,WAAW;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK,KAAK,EAAE,WAAW;AACpE,SAAO;AACT;AAEA,SAAS,aACP,MACA,SACA,SAAS,IACM;AACf,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,GAAG;AAChD,QAAI,eAAe,KAAK,EAAG;AAC3B,QAAI,CAAC,QAAQ,SAAS,IAAI,KAAK,6BAA6B,IAAI,IAAI;AAClE,aAAO,GAAG,MAAM,GAAG,IAAI;AAAA,EAC3B;AACA,SAAO;AACT;AAUO,SAAS,qBACd,aACA,QACA,MACe;AACf,QAAM,SAAS,WAAW,IAAI;AAC9B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,gBAAgB;AAClB,WAAO,aAAa,QAAQ,gCAAgC;AAC9D,QAAM,SACJ,gBAAgB,wBACZ,6CAA6C,KAAK,MAAM,IAAI,CAAC,IAC7D;AACN,QAAM,MAAM,SAAS,kBAAkB,MAAM,KAAK;AAClD,QAAM,UAAU,uBAAuB,GAAG;AAC1C,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,UAAU,aAAa,QAAQ,OAAO;AAC5C,MAAI,QAAS,QAAO;AACpB,MAAI,gBAAgB,gBAAiB,QAAO;AAC5C,MAAI,OAAO,SAAS,eAAgB,QAAO;AAC3C,QAAM,UAAU,WAAW,OAAO,OAAO;AACzC,SAAO,UAAU,aAAa,SAAS,2BAA2B,UAAU,IAAI;AAClF;","names":[]}

package/dist/chunk-TSWWZMUS.js

@@ -0,0 +1,186 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/usage-allowances.ts
+import { z } from "zod";
+var AllowanceCredits = /* @__PURE__ */ defineSchema(
+  () => z.number().int().nonnegative().safe()
+);
+var Version = /* @__PURE__ */ defineSchema(() => z.number().int().nonnegative().safe());
+var Timestamp = /* @__PURE__ */ defineSchema(() => z.string().datetime({ offset: true }));
+var OperationId = /* @__PURE__ */ defineSchema(
+  () => z.string().min(1).max(256).refine(
+    (value) => value.trim().length > 0 && !value.includes("\0") && !/[\uD800-\uDFFF]/u.test(value) && new TextEncoder().encode(value).byteLength <= 256
+  )
+);
+var SubjectId = /* @__PURE__ */ defineSchema(
+  () => z.string().min(1).max(1024).refine((value) => !value.includes("\0"))
+);
+var MemberAllowanceRule = /* @__PURE__ */ defineSchema(
+  () => z.union([
+    z.object({ share: z.number().finite().nonnegative() }).strict(),
+    z.object({ credits: AllowanceCredits }).strict(),
+    z.null()
+  ])
+);
+var MemberAllowanceDefault = /* @__PURE__ */ defineSchema(
+  () => z.union([
+    z.enum(["none", "equal_share"]),
+    z.object({ share: z.number().finite().nonnegative() }).strict(),
+    z.object({ credits: AllowanceCredits }).strict()
+  ])
+);
+var Thresholds = /* @__PURE__ */ defineSchema(
+  () => z.array(z.number().finite().positive().max(1)).max(16)
+);
+var UnbilledUsageMetering = /* @__PURE__ */ defineSchema(
+  () => z.enum(["ignore", "list_price"])
+);
+var WorkspaceAllowanceConfig = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    includedCredits: AllowanceCredits,
+    period: z.enum(["monthly", "none"]),
+    anchorDay: z.number().int().min(1).max(31).optional(),
+    memberDefault: MemberAllowanceDefault.optional(),
+    thresholds: z.object({ workspace: Thresholds.optional(), member: Thresholds.optional() }).strict().optional(),
+    unbilledUsage: UnbilledUsageMetering.optional()
+  }).strict()
+);
+var WorkspaceAllowance = /* @__PURE__ */ defineSchema(
+  () => WorkspaceAllowanceConfig.extend({ version: Version.min(1) })
+);
+var WorkspaceAllowanceState = /* @__PURE__ */ defineSchema(
+  () => z.object({ version: Version, config: WorkspaceAllowance.nullable() }).strict().refine((state) => state.config === null || state.config.version === state.version, {
+    message: "Allowance configuration and lifecycle versions must match",
+    path: ["config", "version"]
+  })
+);
+var SetWorkspaceAllowanceRequest = /* @__PURE__ */ defineSchema(
+  () => WorkspaceAllowanceConfig.extend({
+    expectedVersion: Version
+  })
+);
+var ClearWorkspaceAllowanceRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({ expectedVersion: Version.min(1), operationId: OperationId.optional() }).strict()
+);
+var ClearWorkspaceAllowanceResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({ version: Version.min(1) }).strict()
+);
+var GrantWorkspaceCreditsRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    operationId: OperationId,
+    credits: AllowanceCredits.positive(),
+    expiresAt: Timestamp.nullable().optional()
+  }).strict()
+);
+var WorkspaceCreditGrant = /* @__PURE__ */ defineSchema(
+  () => GrantWorkspaceCreditsRequest.extend({
+    remaining: AllowanceCredits,
+    expiresAt: Timestamp.nullable()
+  })
+);
+var SetMemberAllowanceRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    rule: MemberAllowanceRule,
+    expectedVersion: Version
+  }).strict()
+);
+var MemberAllowance = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    subjectId: SubjectId,
+    rule: MemberAllowanceRule,
+    version: Version
+  }).strict()
+);
+var UsageAllowancePeriod = /* @__PURE__ */ defineSchema(
+  () => z.union([z.literal("current"), z.string().regex(/^\d{4}-(0[1-9]|1[0-2])$/)])
+);
+var GetUsageRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    period: UsageAllowancePeriod.optional(),
+    limit: z.number().int().min(1).max(200).optional(),
+    cursor: z.string().min(1).max(2048).optional()
+  }).strict()
+);
+var GetMyUsageRequest = /* @__PURE__ */ defineSchema(
+  () => GetUsageRequest.pick({ period: true })
+);
+var UsageAllowanceStatus = /* @__PURE__ */ defineSchema(
+  () => z.enum(["ok", "warning", "exhausted"])
+);
+var UsageAllowanceWindow = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    start: Timestamp.nullable(),
+    end: Timestamp.nullable()
+  }).strict()
+);
+var Usage = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    limit: AllowanceCredits.nullable(),
+    used: AllowanceCredits,
+    remaining: z.number().int().safe().nullable(),
+    /** Display this ratio rather than raw USD micros in human-facing products. */
+    fraction: z.number().finite().nonnegative().nullable(),
+    status: UsageAllowanceStatus,
+    resetsAt: Timestamp.nullable()
+  })
+);
+var WorkspaceAllowanceUsage = /* @__PURE__ */ defineSchema(
+  () => Usage.extend({
+    includedCredits: AllowanceCredits,
+    grantsRemaining: AllowanceCredits
+  }).strict()
+);
+var MemberAllowanceUsage = /* @__PURE__ */ defineSchema(
+  () => Usage.extend({
+    subjectId: SubjectId,
+    externalIdentity: z.object({ source: z.string(), externalId: z.string() }).strict().nullable(),
+    rule: MemberAllowanceRule,
+    version: Version
+  }).strict()
+);
+var WorkspaceUsageResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    period: UsageAllowanceWindow,
+    workspace: WorkspaceAllowanceUsage,
+    members: z.array(MemberAllowanceUsage),
+    nextCursor: z.string().nullable()
+  }).strict()
+);
+var AllowanceExhaustedRefusal = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    code: z.literal("allowance_exhausted"),
+    scope: z.enum(["workspace", "member"]),
+    resetsAt: Timestamp.nullable(),
+    subjectId: SubjectId.optional(),
+    message: z.string()
+  }).strict()
+);
+
+export {
+  AllowanceCredits,
+  MemberAllowanceRule,
+  MemberAllowanceDefault,
+  UnbilledUsageMetering,
+  WorkspaceAllowanceConfig,
+  WorkspaceAllowance,
+  WorkspaceAllowanceState,
+  SetWorkspaceAllowanceRequest,
+  ClearWorkspaceAllowanceRequest,
+  ClearWorkspaceAllowanceResponse,
+  GrantWorkspaceCreditsRequest,
+  WorkspaceCreditGrant,
+  SetMemberAllowanceRequest,
+  MemberAllowance,
+  UsageAllowancePeriod,
+  GetUsageRequest,
+  GetMyUsageRequest,
+  UsageAllowanceStatus,
+  UsageAllowanceWindow,
+  WorkspaceAllowanceUsage,
+  MemberAllowanceUsage,
+  WorkspaceUsageResponse,
+  AllowanceExhaustedRefusal
+};
+//# sourceMappingURL=chunk-TSWWZMUS.js.map

package/dist/chunk-TSWWZMUS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/usage-allowances.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\n/** Credit amounts are integer USD micros (1 USD = 1,000,000), never floating-point dollars. */\nexport const AllowanceCredits = /* @__PURE__ */ defineSchema(() =>\n  z.number().int().nonnegative().safe(),\n);\nconst Version = /* @__PURE__ */ defineSchema(() => z.number().int().nonnegative().safe());\nconst Timestamp = /* @__PURE__ */ defineSchema(() => z.string().datetime({ offset: true }));\nconst OperationId = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .min(1)\n    .max(256)\n    .refine(\n      (value) =>\n        value.trim().length > 0 &&\n        !value.includes(\"\\0\") &&\n        !/[\\uD800-\\uDFFF]/u.test(value) &&\n        new TextEncoder().encode(value).byteLength <= 256,\n    ),\n);\nconst SubjectId = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .min(1)\n    .max(1024)\n    .refine((value) => !value.includes(\"\\0\")),\n);\n\n/**\n * A share scales with the current workspace pool, including unexpired grants.\n * Shares may exceed 1 and their sum may exceed 1: they are ceilings, not reserved\n * allocations. Concurrent/in-flight calls can overshoot a ceiling; enforcement\n * happens before the next call, after actual usage is settled.\n * null removes the override and uses the workspace's memberDefault.\n */\nexport const MemberAllowanceRule = /* @__PURE__ */ defineSchema(() =>\n  z.union([\n    z.object({ share: z.number().finite().nonnegative() }).strict(),\n    z.object({ credits: AllowanceCredits }).strict(),\n    z.null(),\n  ]),\n);\nexport type MemberAllowanceRule = z.infer<typeof MemberAllowanceRule>;\n\nexport const MemberAllowanceDefault = /* @__PURE__ */ defineSchema(() =>\n  z.union([\n    z.enum([\"none\", \"equal_share\"]),\n    z.object({ share: z.number().finite().nonnegative() }).strict(),\n    z.object({ credits: AllowanceCredits }).strict(),\n  ]),\n);\nexport type MemberAllowanceDefault = z.infer<typeof MemberAllowanceDefault>;\n\nconst Thresholds = /* @__PURE__ */ defineSchema(() =>\n  z.array(z.number().finite().positive().max(1)).max(16),\n);\n/**\n * How model calls that spend no Opengeni credits count: subscription\n * connections, workspace-owned keys and deployments without credit billing.\n * \"ignore\" (the default) keeps the allowance credit-only. \"list_price\" counts\n * each such call at its configured list-price estimate in USD micros and\n * admits those turns against the allowance; calls without a list price are\n * not counted.\n */\nexport const UnbilledUsageMetering = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"ignore\", \"list_price\"]),\n);\nexport type UnbilledUsageMetering = z.infer<typeof UnbilledUsageMetering>;\n/** Omitted threshold lists default to [0.8, 1]. Monthly boundaries are UTC. */\nexport const WorkspaceAllowanceConfig = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      includedCredits: AllowanceCredits,\n      period: z.enum([\"monthly\", \"none\"]),\n      anchorDay: z.number().int().min(1).max(31).optional(),\n      memberDefault: MemberAllowanceDefault.optional(),\n      thresholds: z\n        .object({ workspace: Thresholds.optional(), member: Thresholds.optional() })\n        .strict()\n        .optional(),\n      unbilledUsage: UnbilledUsageMetering.optional(),\n    })\n    .strict(),\n);\nexport type WorkspaceAllowanceConfig = z.infer<typeof WorkspaceAllowanceConfig>;\n\nexport const WorkspaceAllowance = /* @__PURE__ */ defineSchema(() =>\n  WorkspaceAllowanceConfig.extend({ version: Version.min(1) }),\n);\nexport type WorkspaceAllowance = z.infer<typeof WorkspaceAllowance>;\n/**\n * Lifecycle version survives clear. version=0 means never configured; a null\n * config with a positive version is cleared. Use this version for recreation.\n * The existing nullable configuration read remains unchanged.\n */\nexport const WorkspaceAllowanceState = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({ version: Version, config: WorkspaceAllowance.nullable() })\n    .strict()\n    .refine((state) => state.config === null || state.config.version === state.version, {\n      message: \"Allowance configuration and lifecycle versions must match\",\n      path: [\"config\", \"version\"],\n    }),\n);\nexport type WorkspaceAllowanceState = z.infer<typeof WorkspaceAllowanceState>;\nexport const SetWorkspaceAllowanceRequest = /* @__PURE__ */ defineSchema(() =>\n  WorkspaceAllowanceConfig.extend({\n    expectedVersion: Version,\n  }),\n);\nexport type SetWorkspaceAllowanceRequest = z.infer<typeof SetWorkspaceAllowanceRequest>;\n/** Reuse operationId and the exact expectedVersion to recover a lost clear\n * receipt. A later lifecycle change conflicts; read the state before deciding\n * on a new mutation, never guess a version or change it for a retry. */\nexport const ClearWorkspaceAllowanceRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({ expectedVersion: Version.min(1), operationId: OperationId.optional() }).strict(),\n);\nexport type ClearWorkspaceAllowanceRequest = z.infer<typeof ClearWorkspaceAllowanceRequest>;\nexport const ClearWorkspaceAllowanceResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({ version: Version.min(1) }).strict(),\n);\nexport type ClearWorkspaceAllowanceResponse = z.infer<typeof ClearWorkspaceAllowanceResponse>;\n\n/** Reuse the operationId and exact request to recover an uncertain grant response. */\nexport const GrantWorkspaceCreditsRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      operationId: OperationId,\n      credits: AllowanceCredits.positive(),\n      expiresAt: Timestamp.nullable().optional(),\n    })\n    .strict(),\n);\nexport type GrantWorkspaceCreditsRequest = z.infer<typeof GrantWorkspaceCreditsRequest>;\nexport const WorkspaceCreditGrant = /* @__PURE__ */ defineSchema(() =>\n  GrantWorkspaceCreditsRequest.extend({\n    remaining: AllowanceCredits,\n    expiresAt: Timestamp.nullable(),\n  }),\n);\nexport type WorkspaceCreditGrant = z.infer<typeof WorkspaceCreditGrant>;\n\nexport const SetMemberAllowanceRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      rule: MemberAllowanceRule,\n      expectedVersion: Version,\n    })\n    .strict(),\n);\nexport type SetMemberAllowanceRequest = z.infer<typeof SetMemberAllowanceRequest>;\nexport const MemberAllowance = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      subjectId: SubjectId,\n      rule: MemberAllowanceRule,\n      version: Version,\n    })\n    .strict(),\n);\nexport type MemberAllowance = z.infer<typeof MemberAllowance>;\n\nexport const UsageAllowancePeriod = /* @__PURE__ */ defineSchema(() =>\n  z.union([z.literal(\"current\"), z.string().regex(/^\\d{4}-(0[1-9]|1[0-2])$/)]),\n);\nexport type UsageAllowancePeriod = z.infer<typeof UsageAllowancePeriod>;\nexport const GetUsageRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      period: UsageAllowancePeriod.optional(),\n      limit: z.number().int().min(1).max(200).optional(),\n      cursor: z.string().min(1).max(2048).optional(),\n    })\n    .strict(),\n);\nexport type GetUsageRequest = z.infer<typeof GetUsageRequest>;\nexport const GetMyUsageRequest = /* @__PURE__ */ defineSchema(() =>\n  GetUsageRequest.pick({ period: true }),\n);\nexport type GetMyUsageRequest = z.infer<typeof GetMyUsageRequest>;\n\nexport const UsageAllowanceStatus = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"ok\", \"warning\", \"exhausted\"]),\n);\nexport type UsageAllowanceStatus = z.infer<typeof UsageAllowanceStatus>;\nexport const UsageAllowanceWindow = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      start: Timestamp.nullable(),\n      end: Timestamp.nullable(),\n    })\n    .strict(),\n);\nexport type UsageAllowanceWindow = z.infer<typeof UsageAllowanceWindow>;\nconst Usage = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    limit: AllowanceCredits.nullable(),\n    used: AllowanceCredits,\n    remaining: z.number().int().safe().nullable(),\n    /** Display this ratio rather than raw USD micros in human-facing products. */\n    fraction: z.number().finite().nonnegative().nullable(),\n    status: UsageAllowanceStatus,\n    resetsAt: Timestamp.nullable(),\n  }),\n);\nexport const WorkspaceAllowanceUsage = /* @__PURE__ */ defineSchema(() =>\n  Usage.extend({\n    includedCredits: AllowanceCredits,\n    grantsRemaining: AllowanceCredits,\n  }).strict(),\n);\nexport type WorkspaceAllowanceUsage = z.infer<typeof WorkspaceAllowanceUsage>;\nexport const MemberAllowanceUsage = /* @__PURE__ */ defineSchema(() =>\n  Usage.extend({\n    subjectId: SubjectId,\n    externalIdentity: z.object({ source: z.string(), externalId: z.string() }).strict().nullable(),\n    rule: MemberAllowanceRule,\n    version: Version,\n  }).strict(),\n);\nexport type MemberAllowanceUsage = z.infer<typeof MemberAllowanceUsage>;\n/** /usage/me returns only the authenticated subject's member row, never the roster. */\nexport const WorkspaceUsageResponse = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      period: UsageAllowanceWindow,\n      workspace: WorkspaceAllowanceUsage,\n      members: z.array(MemberAllowanceUsage),\n      nextCursor: z.string().nullable(),\n    })\n    .strict(),\n);\nexport type WorkspaceUsageResponse = z.infer<typeof WorkspaceUsageResponse>;\n\nexport const AllowanceExhaustedRefusal = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      code: z.literal(\"allowance_exhausted\"),\n      scope: z.enum([\"workspace\", \"member\"]),\n      resetsAt: Timestamp.nullable(),\n      subjectId: SubjectId.optional(),\n      message: z.string(),\n    })\n    .strict(),\n);\nexport type AllowanceExhaustedRefusal = z.infer<typeof AllowanceExhaustedRefusal>;\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAGX,IAAM,mBAAmC;AAAA,EAAa,MAC3D,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AACtC;AACA,IAAM,UAA0B,6BAAa,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC;AACxF,IAAM,YAA4B,6BAAa,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC,CAAC;AAC1F,IAAM,cAA8B;AAAA,EAAa,MAC/C,EACG,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP;AAAA,IACC,CAAC,UACC,MAAM,KAAK,EAAE,SAAS,KACtB,CAAC,MAAM,SAAS,IAAI,KACpB,CAAC,mBAAmB,KAAK,KAAK,KAC9B,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,cAAc;AAAA,EAClD;AACJ;AACA,IAAM,YAA4B;AAAA,EAAa,MAC7C,EACG,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAI,EACR,OAAO,CAAC,UAAU,CAAC,MAAM,SAAS,IAAI,CAAC;AAC5C;AASO,IAAM,sBAAsC;AAAA,EAAa,MAC9D,EAAE,MAAM;AAAA,IACN,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO;AAAA,IAC9D,EAAE,OAAO,EAAE,SAAS,iBAAiB,CAAC,EAAE,OAAO;AAAA,IAC/C,EAAE,KAAK;AAAA,EACT,CAAC;AACH;AAGO,IAAM,yBAAyC;AAAA,EAAa,MACjE,EAAE,MAAM;AAAA,IACN,EAAE,KAAK,CAAC,QAAQ,aAAa,CAAC;AAAA,IAC9B,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO;AAAA,IAC9D,EAAE,OAAO,EAAE,SAAS,iBAAiB,CAAC,EAAE,OAAO;AAAA,EACjD,CAAC;AACH;AAGA,IAAM,aAA6B;AAAA,EAAa,MAC9C,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE;AACvD;AASO,IAAM,wBAAwC;AAAA,EAAa,MAChE,EAAE,KAAK,CAAC,UAAU,YAAY,CAAC;AACjC;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnE,EACG,OAAO;AAAA,IACN,iBAAiB;AAAA,IACjB,QAAQ,EAAE,KAAK,CAAC,WAAW,MAAM,CAAC;AAAA,IAClC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,IACpD,eAAe,uBAAuB,SAAS;AAAA,IAC/C,YAAY,EACT,OAAO,EAAE,WAAW,WAAW,SAAS,GAAG,QAAQ,WAAW,SAAS,EAAE,CAAC,EAC1E,OAAO,EACP,SAAS;AAAA,IACZ,eAAe,sBAAsB,SAAS;AAAA,EAChD,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,qBAAqC;AAAA,EAAa,MAC7D,yBAAyB,OAAO,EAAE,SAAS,QAAQ,IAAI,CAAC,EAAE,CAAC;AAC7D;AAOO,IAAM,0BAA0C;AAAA,EAAa,MAClE,EACG,OAAO,EAAE,SAAS,SAAS,QAAQ,mBAAmB,SAAS,EAAE,CAAC,EAClE,OAAO,EACP,OAAO,CAAC,UAAU,MAAM,WAAW,QAAQ,MAAM,OAAO,YAAY,MAAM,SAAS;AAAA,IAClF,SAAS;AAAA,IACT,MAAM,CAAC,UAAU,SAAS;AAAA,EAC5B,CAAC;AACL;AAEO,IAAM,+BAA+C;AAAA,EAAa,MACvE,yBAAyB,OAAO;AAAA,IAC9B,iBAAiB;AAAA,EACnB,CAAC;AACH;AAKO,IAAM,iCAAiD;AAAA,EAAa,MACzE,EAAE,OAAO,EAAE,iBAAiB,QAAQ,IAAI,CAAC,GAAG,aAAa,YAAY,SAAS,EAAE,CAAC,EAAE,OAAO;AAC5F;AAEO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EAAE,OAAO,EAAE,SAAS,QAAQ,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAC/C;AAIO,IAAM,+BAA+C;AAAA,EAAa,MACvE,EACG,OAAO;AAAA,IACN,aAAa;AAAA,IACb,SAAS,iBAAiB,SAAS;AAAA,IACnC,WAAW,UAAU,SAAS,EAAE,SAAS;AAAA,EAC3C,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,6BAA6B,OAAO;AAAA,IAClC,WAAW;AAAA,IACX,WAAW,UAAU,SAAS;AAAA,EAChC,CAAC;AACH;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EACG,OAAO;AAAA,IACN,MAAM;AAAA,IACN,iBAAiB;AAAA,EACnB,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,kBAAkC;AAAA,EAAa,MAC1D,EACG,OAAO;AAAA,IACN,WAAW;AAAA,IACX,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EAAE,MAAM,CAAC,EAAE,QAAQ,SAAS,GAAG,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC,CAAC;AAC7E;AAEO,IAAM,kBAAkC;AAAA,EAAa,MAC1D,EACG,OAAO;AAAA,IACN,QAAQ,qBAAqB,SAAS;AAAA,IACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACjD,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,SAAS;AAAA,EAC/C,CAAC,EACA,OAAO;AACZ;AAEO,IAAM,oBAAoC;AAAA,EAAa,MAC5D,gBAAgB,KAAK,EAAE,QAAQ,KAAK,CAAC;AACvC;AAGO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EAAE,KAAK,CAAC,MAAM,WAAW,WAAW,CAAC;AACvC;AAEO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,EACG,OAAO;AAAA,IACN,OAAO,UAAU,SAAS;AAAA,IAC1B,KAAK,UAAU,SAAS;AAAA,EAC1B,CAAC,EACA,OAAO;AACZ;AAEA,IAAM,QAAwB;AAAA,EAAa,MACzC,EAAE,OAAO;AAAA,IACP,OAAO,iBAAiB,SAAS;AAAA,IACjC,MAAM;AAAA,IACN,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA,IAE5C,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,SAAS;AAAA,IACrD,QAAQ;AAAA,IACR,UAAU,UAAU,SAAS;AAAA,EAC/B,CAAC;AACH;AACO,IAAM,0BAA0C;AAAA,EAAa,MAClE,MAAM,OAAO;AAAA,IACX,iBAAiB;AAAA,IACjB,iBAAiB;AAAA,EACnB,CAAC,EAAE,OAAO;AACZ;AAEO,IAAM,uBAAuC;AAAA,EAAa,MAC/D,MAAM,OAAO;AAAA,IACX,WAAW;AAAA,IACX,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7F,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC,EAAE,OAAO;AACZ;AAGO,IAAM,yBAAyC;AAAA,EAAa,MACjE,EACG,OAAO;AAAA,IACN,QAAQ;AAAA,IACR,WAAW;AAAA,IACX,SAAS,EAAE,MAAM,oBAAoB;AAAA,IACrC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,CAAC,EACA,OAAO;AACZ;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,qBAAqB;AAAA,IACrC,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,CAAC;AAAA,IACrC,UAAU,UAAU,SAAS;AAAA,IAC7B,WAAW,UAAU,SAAS;AAAA,IAC9B,SAAS,EAAE,OAAO;AAAA,EACpB,CAAC,EACA,OAAO;AACZ;","names":[]}

package/dist/{chunk-PX3VCKAU.js → chunk-WVCFSOUZ.js}

@@ -26,4 +26,4 @@ export {
   EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION,
   EDITABLE_ARTIFACT_LIVE_WIRE_VERSION
 };
-//# sourceMappingURL=chunk-PX3VCKAU.js.map
+//# sourceMappingURL=chunk-WVCFSOUZ.js.map

package/dist/{chunk-PX3VCKAU.js.map → chunk-WVCFSOUZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/editable-artifact-versions.ts"],"sourcesContent":["/** Modality-specific durable semantic/schema versions. */\nexport const SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION = 2 as const;\nexport const DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION = 1 as const;\nexport const PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION = 1 as const;\n\n/** Direct kernel workbook snapshot version (OGARTK02), never the durable CRDT snapshot. */\nexport const SPREADSHEET_KERNEL_SNAPSHOT_VERSION = 2 as const;\n\n/** Modality-specific canonical snapshot versions. */\nexport const DOCUMENT_ARTIFACT_SNAPSHOT_VERSION = 1 as const;\nexport const PRESENTATION_ARTIFACT_SNAPSHOT_VERSION = 1 as const;\n\n/** Canonical internal spreadsheet kernel command-envelope version. */\nexport const SPREADSHEET_KERNEL_COMMAND_VERSION = 2 as const;\n\n/** Canonical public, identity-free spreadsheet command-envelope version. */\nexport const SPREADSHEET_ARTIFACT_COMMAND_VERSION = 2 as const;\n\n/** Canonical durable spreadsheet collaboration-snapshot version. */\nexport const SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION = 2 as const;\n\n/** Canonical committed spreadsheet transaction protocol version. */\nexport const COMMITTED_TRANSACTION_PROTOCOL_VERSION = 2 as const;\n\n/** Canonical document/presentation serialized-commit protocol version. */\nexport const EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION = 1 as const;\n\n/** Canonical editable-artifact live transport protocol version. */\nexport const EDITABLE_ARTIFACT_LIVE_WIRE_VERSION = 2 as const;\n"],"mappings":";AACO,IAAM,4CAA4C;AAClD,IAAM,yCAAyC;AAC/C,IAAM,6CAA6C;AAGnD,IAAM,sCAAsC;AAG5C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAG/C,IAAM,qCAAqC;AAG3C,IAAM,uCAAuC;AAG7C,IAAM,6CAA6C;AAGnD,IAAM,yCAAyC;AAG/C,IAAM,8CAA8C;AAGpD,IAAM,sCAAsC;","names":[]}
+{"version":3,"sources":["../src/editable-artifact-versions.ts"],"sourcesContent":["/**\n * Modality-specific durable semantic/schema versions.\n * Spreadsheet dimensions are an additive current-schema extension: existing\n * command/operation tags and dimension-free snapshot bytes stay unchanged.\n * Direct snapshots and private projections advertise their explicit extension\n * flags; old executables reject new tags/flags, never silently discard them.\n */\nexport const SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION = 2 as const;\nexport const DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION = 1 as const;\nexport const PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION = 1 as const;\n\n/** Direct kernel workbook snapshot version (OGARTK02), never the durable CRDT snapshot. */\nexport const SPREADSHEET_KERNEL_SNAPSHOT_VERSION = 2 as const;\n\n/** Modality-specific canonical snapshot versions. */\nexport const DOCUMENT_ARTIFACT_SNAPSHOT_VERSION = 1 as const;\nexport const PRESENTATION_ARTIFACT_SNAPSHOT_VERSION = 1 as const;\n\n/** Canonical internal spreadsheet kernel command-envelope version. */\nexport const SPREADSHEET_KERNEL_COMMAND_VERSION = 2 as const;\n\n/** Canonical public, identity-free spreadsheet command-envelope version. */\nexport const SPREADSHEET_ARTIFACT_COMMAND_VERSION = 2 as const;\n\n/** Canonical durable spreadsheet collaboration-snapshot version. */\nexport const SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION = 2 as const;\n\n/** Canonical committed spreadsheet transaction protocol version. */\nexport const COMMITTED_TRANSACTION_PROTOCOL_VERSION = 2 as const;\n\n/** Canonical document/presentation serialized-commit protocol version. */\nexport const EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION = 1 as const;\n\n/** Canonical editable-artifact live transport protocol version. */\nexport const EDITABLE_ARTIFACT_LIVE_WIRE_VERSION = 2 as const;\n"],"mappings":";AAOO,IAAM,4CAA4C;AAClD,IAAM,yCAAyC;AAC/C,IAAM,6CAA6C;AAGnD,IAAM,sCAAsC;AAG5C,IAAM,qCAAqC;AAC3C,IAAM,yCAAyC;AAG/C,IAAM,qCAAqC;AAG3C,IAAM,uCAAuC;AAG7C,IAAM,6CAA6C;AAGnD,IAAM,yCAAyC;AAG/C,IAAM,8CAA8C;AAGpD,IAAM,sCAAsC;","names":[]}

package/dist/chunk-XDLAGX66.js

@@ -0,0 +1,127 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/prepared-mcp-setup.ts
+import { z } from "zod";
+var fieldId = /* @__PURE__ */ defineSchema(
+  () => z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/)
+);
+var headerName = /* @__PURE__ */ defineSchema(
+  () => z.string().min(1).max(256).regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/)
+);
+var headerPart = /* @__PURE__ */ defineSchema(
+  () => z.string().max(16384).regex(/^[^\r\n\0]*$/)
+);
+var PreparedMcpSetup = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    name: z.string().trim().min(1).max(256),
+    endpointUrl: z.string().url().max(2048).refine((value) => {
+      try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash;
+      } catch {
+        return false;
+      }
+    }, "Use an HTTPS endpoint without credentials, query parameters, or a fragment"),
+    headers: z.array(
+      z.union([
+        z.object({ name: headerName, value: headerPart.min(1) }).strict(),
+        z.object({
+          name: headerName,
+          secret: fieldId,
+          prefix: headerPart.optional(),
+          suffix: headerPart.optional()
+        }).strict()
+      ])
+    ).min(1).max(32),
+    secretFields: z.array(z.object({ id: fieldId, label: z.string().trim().min(1).max(256) }).strict()).max(32)
+  }).strict().superRefine((value, context) => {
+    const names = value.headers.map((header) => header.name.toLowerCase());
+    const ids = value.secretFields.map((field) => field.id);
+    if (new Set(names).size !== names.length)
+      context.addIssue({
+        code: "custom",
+        path: ["headers"],
+        message: "Header names must be unique"
+      });
+    if (new Set(ids).size !== ids.length)
+      context.addIssue({
+        code: "custom",
+        path: ["secretFields"],
+        message: "Secret field IDs must be unique"
+      });
+    const used = new Set(
+      value.headers.flatMap((header) => "secret" in header ? [header.secret] : [])
+    );
+    if (used.size !== ids.length || ids.some((id) => !used.has(id)))
+      context.addIssue({
+        code: "custom",
+        path: ["secretFields"],
+        message: "Declare exactly the secret fields used by the headers"
+      });
+    for (const [index, header] of value.headers.entries()) {
+      if ("value" in header && ["authorization", "proxy-authorization", "cookie", "x-api-key", "api-key"].includes(
+        header.name.toLowerCase()
+      ))
+        context.addIssue({
+          code: "custom",
+          path: ["headers", index],
+          message: "Credential headers must reference a protected secret field"
+        });
+    }
+  })
+);
+var CustomMcpSetupRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    kind: z.literal("mcp"),
+    name: z.string().trim().min(1).max(256),
+    endpointUrl: z.string().url().max(2048).refine((value) => {
+      try {
+        const url = new URL(value);
+        return url.protocol === "https:" && !url.username && !url.password && !url.hash && !url.search;
+      } catch {
+        return false;
+      }
+    }),
+    rationale: z.string().trim().min(1).max(2e3),
+    ownership: z.enum(["personal", "workspace"]).optional(),
+    mcpSetup: PreparedMcpSetup.optional()
+  }).strict().superRefine((value, context) => {
+    if (Boolean(value.ownership) !== Boolean(value.mcpSetup))
+      context.addIssue({ code: "custom", message: "Prepared setup requires explicit ownership" });
+    if (value.mcpSetup && (value.name !== value.mcpSetup.name || value.endpointUrl !== value.mcpSetup.endpointUrl))
+      context.addIssue({
+        code: "custom",
+        message: "Prepared setup must match the displayed server"
+      });
+  })
+);
+function preparedMcpHeaders(configuration, values) {
+  const setup = PreparedMcpSetup.parse(configuration);
+  const supplied = Object.keys(values);
+  if (supplied.length !== setup.secretFields.length || setup.secretFields.some((field) => !Object.hasOwn(values, field.id)) || supplied.some((key) => {
+    const value = values[key];
+    return typeof value !== "string" || value.length === 0 || value.length > 16384 || /[\r\n\0]/.test(value);
+  }))
+    throw new Error("Supply exactly the requested secret fields");
+  const headers = {};
+  for (const header of setup.headers) {
+    const value = "value" in header ? header.value : `${header.prefix ?? ""}${values[header.secret]}${header.suffix ?? ""}`;
+    if (value.length > 16384) throw new Error("Prepared credential header is too long");
+    Object.defineProperty(headers, header.name, {
+      value,
+      enumerable: true,
+      configurable: true,
+      writable: true
+    });
+  }
+  return headers;
+}
+
+export {
+  PreparedMcpSetup,
+  CustomMcpSetupRequest,
+  preparedMcpHeaders
+};
+//# sourceMappingURL=chunk-XDLAGX66.js.map

package/dist/chunk-XDLAGX66.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/prepared-mcp-setup.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nconst fieldId = /* @__PURE__ */ defineSchema(() =>\n  z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/),\n);\nconst headerName = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .min(1)\n    .max(256)\n    .regex(/^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/),\n);\nconst headerPart = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .max(16_384)\n    .regex(/^[^\\r\\n\\0]*$/),\n);\n\n/** Configuration is safe to retain; secret values enter only the protected\n * Connect credential request, never this model-visible setup description. */\nexport const PreparedMcpSetup = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      name: z.string().trim().min(1).max(256),\n      endpointUrl: z\n        .string()\n        .url()\n        .max(2048)\n        .refine((value) => {\n          try {\n            const url = new URL(value);\n            return (\n              url.protocol === \"https:\" &&\n              !url.username &&\n              !url.password &&\n              !url.search &&\n              !url.hash\n            );\n          } catch {\n            return false;\n          }\n        }, \"Use an HTTPS endpoint without credentials, query parameters, or a fragment\"),\n      headers: z\n        .array(\n          z.union([\n            z.object({ name: headerName, value: headerPart.min(1) }).strict(),\n            z\n              .object({\n                name: headerName,\n                secret: fieldId,\n                prefix: headerPart.optional(),\n                suffix: headerPart.optional(),\n              })\n              .strict(),\n          ]),\n        )\n        .min(1)\n        .max(32),\n      secretFields: z\n        .array(z.object({ id: fieldId, label: z.string().trim().min(1).max(256) }).strict())\n        .max(32),\n    })\n    .strict()\n    .superRefine((value, context) => {\n      const names = value.headers.map((header) => header.name.toLowerCase());\n      const ids = value.secretFields.map((field) => field.id);\n      if (new Set(names).size !== names.length)\n        context.addIssue({\n          code: \"custom\",\n          path: [\"headers\"],\n          message: \"Header names must be unique\",\n        });\n      if (new Set(ids).size !== ids.length)\n        context.addIssue({\n          code: \"custom\",\n          path: [\"secretFields\"],\n          message: \"Secret field IDs must be unique\",\n        });\n      const used = new Set(\n        value.headers.flatMap((header) => (\"secret\" in header ? [header.secret] : [])),\n      );\n      if (used.size !== ids.length || ids.some((id) => !used.has(id)))\n        context.addIssue({\n          code: \"custom\",\n          path: [\"secretFields\"],\n          message: \"Declare exactly the secret fields used by the headers\",\n        });\n      for (const [index, header] of value.headers.entries()) {\n        if (\n          \"value\" in header &&\n          [\"authorization\", \"proxy-authorization\", \"cookie\", \"x-api-key\", \"api-key\"].includes(\n            header.name.toLowerCase(),\n          )\n        )\n          context.addIssue({\n            code: \"custom\",\n            path: [\"headers\", index],\n            message: \"Credential headers must reference a protected secret field\",\n          });\n      }\n    }),\n);\nexport type PreparedMcpSetup = z.infer<typeof PreparedMcpSetup>;\n\n/** A missing-key proposal retains configuration only. Ownership is explicit\n * and the displayed identity must equal the destination actually configured. */\nexport const CustomMcpSetupRequest = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      kind: z.literal(\"mcp\"),\n      name: z.string().trim().min(1).max(256),\n      endpointUrl: z\n        .string()\n        .url()\n        .max(2048)\n        .refine((value) => {\n          try {\n            const url = new URL(value);\n            return (\n              url.protocol === \"https:\" &&\n              !url.username &&\n              !url.password &&\n              !url.hash &&\n              !url.search\n            );\n          } catch {\n            return false;\n          }\n        }),\n      rationale: z.string().trim().min(1).max(2000),\n      ownership: z.enum([\"personal\", \"workspace\"]).optional(),\n      mcpSetup: PreparedMcpSetup.optional(),\n    })\n    .strict()\n    .superRefine((value, context) => {\n      if (Boolean(value.ownership) !== Boolean(value.mcpSetup))\n        context.addIssue({ code: \"custom\", message: \"Prepared setup requires explicit ownership\" });\n      if (\n        value.mcpSetup &&\n        (value.name !== value.mcpSetup.name || value.endpointUrl !== value.mcpSetup.endpointUrl)\n      )\n        context.addIssue({\n          code: \"custom\",\n          message: \"Prepared setup must match the displayed server\",\n        });\n    }),\n);\nexport type CustomMcpSetupRequest = z.infer<typeof CustomMcpSetupRequest>;\n\n/** Values are intentionally accepted separately. Errors name neither supplied\n * values nor undeclared input keys, which may themselves contain credentials. */\nexport function preparedMcpHeaders(\n  configuration: PreparedMcpSetup,\n  values: Readonly<Record<string, string>>,\n): Record<string, string> {\n  const setup = PreparedMcpSetup.parse(configuration);\n  const supplied = Object.keys(values);\n  if (\n    supplied.length !== setup.secretFields.length ||\n    setup.secretFields.some((field) => !Object.hasOwn(values, field.id)) ||\n    supplied.some((key) => {\n      const value = values[key];\n      return (\n        typeof value !== \"string\" ||\n        value.length === 0 ||\n        value.length > 16_384 ||\n        /[\\r\\n\\0]/.test(value)\n      );\n    })\n  )\n    throw new Error(\"Supply exactly the requested secret fields\");\n  const headers: Record<string, string> = {};\n  for (const header of setup.headers) {\n    const value =\n      \"value\" in header\n        ? header.value\n        : `${header.prefix ?? \"\"}${values[header.secret]}${header.suffix ?? \"\"}`;\n    if (value.length > 16_384) throw new Error(\"Prepared credential header is too long\");\n    Object.defineProperty(headers, header.name, {\n      value,\n      enumerable: true,\n      configurable: true,\n      writable: true,\n    });\n  }\n  return headers;\n}\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAElB,IAAM,UAA0B;AAAA,EAAa,MAC3C,EAAE,OAAO,EAAE,MAAM,8BAA8B;AACjD;AACA,IAAM,aAA6B;AAAA,EAAa,MAC9C,EACG,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,+BAA+B;AAC1C;AACA,IAAM,aAA6B;AAAA,EAAa,MAC9C,EACG,OAAO,EACP,IAAI,KAAM,EACV,MAAM,cAAc;AACzB;AAIO,IAAM,mBAAmC;AAAA,EAAa,MAC3D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,aAAa,EACV,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,KAAK;AACzB,eACE,IAAI,aAAa,YACjB,CAAC,IAAI,YACL,CAAC,IAAI,YACL,CAAC,IAAI,UACL,CAAC,IAAI;AAAA,MAET,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,GAAG,4EAA4E;AAAA,IACjF,SAAS,EACN;AAAA,MACC,EAAE,MAAM;AAAA,QACN,EAAE,OAAO,EAAE,MAAM,YAAY,OAAO,WAAW,IAAI,CAAC,EAAE,CAAC,EAAE,OAAO;AAAA,QAChE,EACG,OAAO;AAAA,UACN,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ,WAAW,SAAS;AAAA,UAC5B,QAAQ,WAAW,SAAS;AAAA,QAC9B,CAAC,EACA,OAAO;AAAA,MACZ,CAAC;AAAA,IACH,EACC,IAAI,CAAC,EACL,IAAI,EAAE;AAAA,IACT,cAAc,EACX,MAAM,EAAE,OAAO,EAAE,IAAI,SAAS,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,EAClF,IAAI,EAAE;AAAA,EACX,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,UAAM,QAAQ,MAAM,QAAQ,IAAI,CAAC,WAAW,OAAO,KAAK,YAAY,CAAC;AACrE,UAAM,MAAM,MAAM,aAAa,IAAI,CAAC,UAAU,MAAM,EAAE;AACtD,QAAI,IAAI,IAAI,KAAK,EAAE,SAAS,MAAM;AAChC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,SAAS;AAAA,QAChB,SAAS;AAAA,MACX,CAAC;AACH,QAAI,IAAI,IAAI,GAAG,EAAE,SAAS,IAAI;AAC5B,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AACH,UAAM,OAAO,IAAI;AAAA,MACf,MAAM,QAAQ,QAAQ,CAAC,WAAY,YAAY,SAAS,CAAC,OAAO,MAAM,IAAI,CAAC,CAAE;AAAA,IAC/E;AACA,QAAI,KAAK,SAAS,IAAI,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;AAC5D,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AACH,eAAW,CAAC,OAAO,MAAM,KAAK,MAAM,QAAQ,QAAQ,GAAG;AACrD,UACE,WAAW,UACX,CAAC,iBAAiB,uBAAuB,UAAU,aAAa,SAAS,EAAE;AAAA,QACzE,OAAO,KAAK,YAAY;AAAA,MAC1B;AAEA,gBAAQ,SAAS;AAAA,UACf,MAAM;AAAA,UACN,MAAM,CAAC,WAAW,KAAK;AAAA,UACvB,SAAS;AAAA,QACX,CAAC;AAAA,IACL;AAAA,EACF,CAAC;AACL;AAKO,IAAM,wBAAwC;AAAA,EAAa,MAChE,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,KAAK;AAAA,IACrB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtC,aAAa,EACV,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,OAAO,CAAC,UAAU;AACjB,UAAI;AACF,cAAM,MAAM,IAAI,IAAI,KAAK;AACzB,eACE,IAAI,aAAa,YACjB,CAAC,IAAI,YACL,CAAC,IAAI,YACL,CAAC,IAAI,QACL,CAAC,IAAI;AAAA,MAET,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,IACH,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI;AAAA,IAC5C,WAAW,EAAE,KAAK,CAAC,YAAY,WAAW,CAAC,EAAE,SAAS;AAAA,IACtD,UAAU,iBAAiB,SAAS;AAAA,EACtC,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAI,QAAQ,MAAM,SAAS,MAAM,QAAQ,MAAM,QAAQ;AACrD,cAAQ,SAAS,EAAE,MAAM,UAAU,SAAS,6CAA6C,CAAC;AAC5F,QACE,MAAM,aACL,MAAM,SAAS,MAAM,SAAS,QAAQ,MAAM,gBAAgB,MAAM,SAAS;AAE5E,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,MACX,CAAC;AAAA,EACL,CAAC;AACL;AAKO,SAAS,mBACd,eACA,QACwB;AACxB,QAAM,QAAQ,iBAAiB,MAAM,aAAa;AAClD,QAAM,WAAW,OAAO,KAAK,MAAM;AACnC,MACE,SAAS,WAAW,MAAM,aAAa,UACvC,MAAM,aAAa,KAAK,CAAC,UAAU,CAAC,OAAO,OAAO,QAAQ,MAAM,EAAE,CAAC,KACnE,SAAS,KAAK,CAAC,QAAQ;AACrB,UAAM,QAAQ,OAAO,GAAG;AACxB,WACE,OAAO,UAAU,YACjB,MAAM,WAAW,KACjB,MAAM,SAAS,SACf,WAAW,KAAK,KAAK;AAAA,EAEzB,CAAC;AAED,UAAM,IAAI,MAAM,4CAA4C;AAC9D,QAAM,UAAkC,CAAC;AACzC,aAAW,UAAU,MAAM,SAAS;AAClC,UAAM,QACJ,WAAW,SACP,OAAO,QACP,GAAG,OAAO,UAAU,EAAE,GAAG,OAAO,OAAO,MAAM,CAAC,GAAG,OAAO,UAAU,EAAE;AAC1E,QAAI,MAAM,SAAS,MAAQ,OAAM,IAAI,MAAM,wCAAwC;AACnF,WAAO,eAAe,SAAS,OAAO,MAAM;AAAA,MAC1C;AAAA,MACA,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,EACH;AACA,SAAO;AACT;","names":[]}

package/dist/chunk-YKZ4WU4P.js

@@ -0,0 +1,33 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/xai-provider-account-authority.ts
+import { z } from "zod";
+var PositiveSafeInteger = /* @__PURE__ */ defineSchema(
+  () => z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+);
+var XaiProviderAccountAuthoritySnapshotV1 = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("scope", [
+    z.object({ version: z.literal(1), scope: z.literal("organization") }).strict(),
+    z.object({
+      version: z.literal(1),
+      scope: z.literal("workspace")
+    }).strict(),
+    z.object({
+      version: z.literal(1),
+      scope: z.literal("user"),
+      authorityGeneration: PositiveSafeInteger
+    }).strict()
+  ])
+);
+var WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {
+  version: 1,
+  scope: "workspace"
+};
+
+export {
+  XaiProviderAccountAuthoritySnapshotV1,
+  WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1
+};
+//# sourceMappingURL=chunk-YKZ4WU4P.js.map

package/dist/chunk-YKZ4WU4P.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/xai-provider-account-authority.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nconst PositiveSafeInteger = /* @__PURE__ */ defineSchema(() =>\n  z.number().int().positive().max(Number.MAX_SAFE_INTEGER),\n);\n\n/**\n * Opaque authority frozen at an xAI provider-account acceptance boundary.\n *\n * This snapshot deliberately carries no organization, membership, credential,\n * provider-account, subject, label, quota, token, or plan identity. User scope\n * becomes executable only after exact live database revalidation against the\n * separately stored causal subject and xAI subscription authority row.\n */\nexport const XaiProviderAccountAuthoritySnapshotV1 = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"scope\", [\n    z.object({ version: z.literal(1), scope: z.literal(\"organization\") }).strict(),\n    z\n      .object({\n        version: z.literal(1),\n        scope: z.literal(\"workspace\"),\n      })\n      .strict(),\n    z\n      .object({\n        version: z.literal(1),\n        scope: z.literal(\"user\"),\n        authorityGeneration: PositiveSafeInteger,\n      })\n      .strict(),\n  ]),\n);\n\nexport type XaiProviderAccountAuthoritySnapshotV1 = z.infer<\n  typeof XaiProviderAccountAuthoritySnapshotV1\n>;\n\n/** Explicit compatibility value for workspace-default accepted work. */\nexport const WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 = {\n  version: 1,\n  scope: \"workspace\",\n} as const satisfies XaiProviderAccountAuthoritySnapshotV1;\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAElB,IAAM,sBAAsC;AAAA,EAAa,MACvD,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB;AACzD;AAUO,IAAM,wCAAwD;AAAA,EAAa,MAChF,EAAE,mBAAmB,SAAS;AAAA,IAC5B,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,GAAG,OAAO,EAAE,QAAQ,cAAc,EAAE,CAAC,EAAE,OAAO;AAAA,IAC7E,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,OAAO,EAAE,QAAQ,WAAW;AAAA,IAC9B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,SAAS,EAAE,QAAQ,CAAC;AAAA,MACpB,OAAO,EAAE,QAAQ,MAAM;AAAA,MACvB,qBAAqB;AAAA,IACvB,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AAOO,IAAM,uDAAuD;AAAA,EAClE,SAAS;AAAA,EACT,OAAO;AACT;","names":[]}

package/dist/{chunk-O5LEQHDM.js → chunk-Z7WEVGCL.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-NVJMJWLL.js";
 import {
   editableArtifactCodecFor
-} from "./chunk-5LYFSZ7O.js";
+} from "./chunk-352X6ENP.js";
 import {
   DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,
   DOCUMENT_ARTIFACT_MAX_STRUCTURAL_COUNTER
@@ -23,7 +23,7 @@ import {
 } from "./chunk-MYBZRDTY.js";
 import {
   EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION
-} from "./chunk-PX3VCKAU.js";
+} from "./chunk-WVCFSOUZ.js";
 
 // src/editable-artifact-serialized-commit.ts
 import { bytesToHex } from "@noble/hashes/utils";
@@ -380,4 +380,4 @@ export {
   decodeEditableArtifactSerializedCommit,
   assertCanonicalEditableArtifactSerializedCommit
 };
-//# sourceMappingURL=chunk-O5LEQHDM.js.map
+//# sourceMappingURL=chunk-Z7WEVGCL.js.map