@opengeni/contracts 3.1.0-canary.1 → 3.1.2

package/dist/chunk-4QO6GJUX.js

@@ -0,0 +1,85 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/canonical-human-identities.ts
+import { z } from "zod";
+var CanonicalHumanIdentityStatus = /* @__PURE__ */ defineSchema(
+  () => z.enum(["active", "recovery_required", "disputed", "disabled"])
+);
+var CanonicalHumanLoginBindingStatus = /* @__PURE__ */ defineSchema(
+  () => z.enum(["active", "recovery_pending", "stale", "disputed", "revoked"])
+);
+var CanonicalHumanRecoveryState = /* @__PURE__ */ defineSchema(
+  () => z.enum(["ready", "recovery_required", "lost_factor", "disputed", "disabled"])
+);
+var CanonicalHumanLoginBinding = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    id: z.string().uuid(),
+    providerId: z.string().min(1).max(128),
+    providerAccountId: z.string().min(1).max(1024),
+    status: CanonicalHumanLoginBindingStatus,
+    revision: z.number().int().positive(),
+    verifiedAt: z.string().datetime(),
+    lastVerifiedAt: z.string().datetime(),
+    revokedAt: z.string().datetime().nullable(),
+    createdAt: z.string().datetime(),
+    updatedAt: z.string().datetime()
+  })
+);
+var CanonicalHumanIdentityProjection = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    activeIdentity: z.object({
+      id: z.string().uuid(),
+      displayName: z.string().min(1).max(256),
+      status: CanonicalHumanIdentityStatus,
+      identityRevision: z.number().int().positive(),
+      authRevision: z.number().int().positive(),
+      activeLoginBindingId: z.string().uuid().nullable(),
+      recoveryState: CanonicalHumanRecoveryState,
+      createdAt: z.string().datetime(),
+      updatedAt: z.string().datetime()
+    }),
+    loginBindings: z.array(CanonicalHumanLoginBinding).max(64)
+  })
+);
+var OperationFields = {
+  operationId: z.string().uuid().optional(),
+  expectedIdentityRevision: z.number().int().positive(),
+  reason: z.string().trim().min(1).max(512)
+};
+var LinkCanonicalHumanLoginBindingRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    ...OperationFields,
+    providerId: z.string().trim().min(1).max(128),
+    providerAccountId: z.string().trim().min(1).max(1024)
+  })
+);
+var CanonicalHumanBindingOperationRequest = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    ...OperationFields
+  })
+);
+var CanonicalHumanIdentityMutationOutcome = /* @__PURE__ */ defineSchema(
+  () => z.enum(["applied", "lost_factor", "disputed"])
+);
+var CanonicalHumanIdentityMutationResponse = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    outcome: CanonicalHumanIdentityMutationOutcome,
+    operationId: z.string().uuid(),
+    identity: CanonicalHumanIdentityProjection
+  })
+);
+
+export {
+  CanonicalHumanIdentityStatus,
+  CanonicalHumanLoginBindingStatus,
+  CanonicalHumanRecoveryState,
+  CanonicalHumanLoginBinding,
+  CanonicalHumanIdentityProjection,
+  LinkCanonicalHumanLoginBindingRequest,
+  CanonicalHumanBindingOperationRequest,
+  CanonicalHumanIdentityMutationOutcome,
+  CanonicalHumanIdentityMutationResponse
+};
+//# sourceMappingURL=chunk-4QO6GJUX.js.map

package/dist/chunk-4QO6GJUX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/canonical-human-identities.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nexport const CanonicalHumanIdentityStatus = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"active\", \"recovery_required\", \"disputed\", \"disabled\"]),\n);\nexport type CanonicalHumanIdentityStatus = z.infer<typeof CanonicalHumanIdentityStatus>;\n\nexport const CanonicalHumanLoginBindingStatus = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"active\", \"recovery_pending\", \"stale\", \"disputed\", \"revoked\"]),\n);\nexport type CanonicalHumanLoginBindingStatus = z.infer<typeof CanonicalHumanLoginBindingStatus>;\n\nexport const CanonicalHumanRecoveryState = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"ready\", \"recovery_required\", \"lost_factor\", \"disputed\", \"disabled\"]),\n);\nexport type CanonicalHumanRecoveryState = z.infer<typeof CanonicalHumanRecoveryState>;\n\nexport const CanonicalHumanLoginBinding = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    id: z.string().uuid(),\n    providerId: z.string().min(1).max(128),\n    providerAccountId: z.string().min(1).max(1024),\n    status: CanonicalHumanLoginBindingStatus,\n    revision: z.number().int().positive(),\n    verifiedAt: z.string().datetime(),\n    lastVerifiedAt: z.string().datetime(),\n    revokedAt: z.string().datetime().nullable(),\n    createdAt: z.string().datetime(),\n    updatedAt: z.string().datetime(),\n  }),\n);\nexport type CanonicalHumanLoginBinding = z.infer<typeof CanonicalHumanLoginBinding>;\n\nexport const CanonicalHumanIdentityProjection = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    activeIdentity: z.object({\n      id: z.string().uuid(),\n      displayName: z.string().min(1).max(256),\n      status: CanonicalHumanIdentityStatus,\n      identityRevision: z.number().int().positive(),\n      authRevision: z.number().int().positive(),\n      activeLoginBindingId: z.string().uuid().nullable(),\n      recoveryState: CanonicalHumanRecoveryState,\n      createdAt: z.string().datetime(),\n      updatedAt: z.string().datetime(),\n    }),\n    loginBindings: z.array(CanonicalHumanLoginBinding).max(64),\n  }),\n);\nexport type CanonicalHumanIdentityProjection = z.infer<typeof CanonicalHumanIdentityProjection>;\n\nconst OperationFields = {\n  operationId: z.string().uuid().optional(),\n  expectedIdentityRevision: z.number().int().positive(),\n  reason: z.string().trim().min(1).max(512),\n} as const;\n\nexport const LinkCanonicalHumanLoginBindingRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    ...OperationFields,\n    providerId: z.string().trim().min(1).max(128),\n    providerAccountId: z.string().trim().min(1).max(1024),\n  }),\n);\nexport type LinkCanonicalHumanLoginBindingRequest = z.infer<\n  typeof LinkCanonicalHumanLoginBindingRequest\n>;\n\nexport const CanonicalHumanBindingOperationRequest = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    ...OperationFields,\n  }),\n);\nexport type CanonicalHumanBindingOperationRequest = z.infer<\n  typeof CanonicalHumanBindingOperationRequest\n>;\n\nexport const CanonicalHumanIdentityMutationOutcome = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"applied\", \"lost_factor\", \"disputed\"]),\n);\nexport type CanonicalHumanIdentityMutationOutcome = z.infer<\n  typeof CanonicalHumanIdentityMutationOutcome\n>;\n\nexport const CanonicalHumanIdentityMutationResponse = /* @__PURE__ */ defineSchema(() =>\n  z.object({\n    outcome: CanonicalHumanIdentityMutationOutcome,\n    operationId: z.string().uuid(),\n    identity: CanonicalHumanIdentityProjection,\n  }),\n);\nexport type CanonicalHumanIdentityMutationResponse = z.infer<\n  typeof CanonicalHumanIdentityMutationResponse\n>;\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAEX,IAAM,+BAA+C;AAAA,EAAa,MACvE,EAAE,KAAK,CAAC,UAAU,qBAAqB,YAAY,UAAU,CAAC;AAChE;AAGO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EAAE,KAAK,CAAC,UAAU,oBAAoB,SAAS,YAAY,SAAS,CAAC;AACvE;AAGO,IAAM,8BAA8C;AAAA,EAAa,MACtE,EAAE,KAAK,CAAC,SAAS,qBAAqB,eAAe,YAAY,UAAU,CAAC;AAC9E;AAGO,IAAM,6BAA6C;AAAA,EAAa,MACrE,EAAE,OAAO;AAAA,IACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACrC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,IAC7C,QAAQ;AAAA,IACR,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACpC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,IAChC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,IACpC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IAC1C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AACH;AAGO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EAAE,OAAO;AAAA,IACP,gBAAgB,EAAE,OAAO;AAAA,MACvB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,MACpB,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,MACtC,QAAQ;AAAA,MACR,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MAC5C,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACxC,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,MACjD,eAAe;AAAA,MACf,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,MAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IACjC,CAAC;AAAA,IACD,eAAe,EAAE,MAAM,0BAA0B,EAAE,IAAI,EAAE;AAAA,EAC3D,CAAC;AACH;AAGA,IAAM,kBAAkB;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,0BAA0B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACpD,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC1C;AAEO,IAAM,wCAAwD;AAAA,EAAa,MAChF,EAAE,OAAO;AAAA,IACP,GAAG;AAAA,IACH,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IAC5C,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EACtD,CAAC;AACH;AAKO,IAAM,wCAAwD;AAAA,EAAa,MAChF,EAAE,OAAO;AAAA,IACP,GAAG;AAAA,EACL,CAAC;AACH;AAKO,IAAM,wCAAwD;AAAA,EAAa,MAChF,EAAE,KAAK,CAAC,WAAW,eAAe,UAAU,CAAC;AAC/C;AAKO,IAAM,yCAAyD;AAAA,EAAa,MACjF,EAAE,OAAO;AAAA,IACP,SAAS;AAAA,IACT,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,UAAU;AAAA,EACZ,CAAC;AACH;","names":[]}

package/dist/chunk-4VDMHLLL.js

@@ -0,0 +1,49 @@
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/subscription-personal-authority-v2.ts
+import { z } from "zod";
+var PositiveSafeInteger = /* @__PURE__ */ defineSchema(
+  () => z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+);
+var CanonicalUuid = /* @__PURE__ */ defineSchema(
+  () => z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/)
+);
+var SubscriptionPersonalAuthorityV2 = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    version: z.literal(2),
+    personal: z.array(
+      z.object({
+        provider: z.enum(["codex", "claude", "xai"]),
+        ownerMembershipId: CanonicalUuid,
+        authorityGeneration: PositiveSafeInteger,
+        /**
+         * Explicit personal consent accepted in a shared chat. Unlike the
+         * historical private-work pool, this authorizes only this connection
+         * in this session. Copies retain the restriction verbatim.
+         */
+        sharedSessionChoice: z.object({ sessionId: CanonicalUuid, connectionId: CanonicalUuid }).strict().optional()
+      }).strict()
+    ).max(3)
+  }).strict().superRefine((snapshot, ctx) => {
+    const providers = snapshot.personal.map((authority) => authority.provider);
+    if (new Set(providers).size !== providers.length) {
+      ctx.addIssue({ code: "custom", message: "Duplicate provider personal authority" });
+    }
+  })
+);
+function subscriptionPersonalAuthorityForProviderV2(snapshot, provider) {
+  return snapshot.personal.find((authority) => authority.provider === provider) ?? null;
+}
+var EMPTY_SUBSCRIPTION_PERSONAL_AUTHORITY_V2 = {
+  version: 2,
+  personal: []
+};
+
+export {
+  SubscriptionPersonalAuthorityV2,
+  subscriptionPersonalAuthorityForProviderV2,
+  EMPTY_SUBSCRIPTION_PERSONAL_AUTHORITY_V2
+};
+//# sourceMappingURL=chunk-4VDMHLLL.js.map

package/dist/chunk-4VDMHLLL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/subscription-personal-authority-v2.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\n\nconst PositiveSafeInteger = /* @__PURE__ */ defineSchema(() =>\n  z.number().int().positive().max(Number.MAX_SAFE_INTEGER),\n);\n/**\n * Canonical lowercase UUID, matching PostgreSQL uuid::text and the\n * session_turns CHECK, so an accepted snapshot can never silently mismatch.\n */\nconst CanonicalUuid = /* @__PURE__ */ defineSchema(() =>\n  z.string().regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/),\n);\n\n/**\n * Immutable personal authority for accepted subscription work. Shared pool\n * eligibility is live and deliberately absent from this snapshot.\n */\nexport const SubscriptionPersonalAuthorityV2 = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      version: z.literal(2),\n      personal: z\n        .array(\n          z\n            .object({\n              provider: z.enum([\"codex\", \"claude\", \"xai\"]),\n              ownerMembershipId: CanonicalUuid,\n              authorityGeneration: PositiveSafeInteger,\n              /**\n               * Explicit personal consent accepted in a shared chat. Unlike the\n               * historical private-work pool, this authorizes only this connection\n               * in this session. Copies retain the restriction verbatim.\n               */\n              sharedSessionChoice: z\n                .object({ sessionId: CanonicalUuid, connectionId: CanonicalUuid })\n                .strict()\n                .optional(),\n            })\n            .strict(),\n        )\n        .max(3),\n    })\n    .strict()\n    .superRefine((snapshot, ctx) => {\n      const providers = snapshot.personal.map((authority) => authority.provider);\n      if (new Set(providers).size !== providers.length) {\n        ctx.addIssue({ code: \"custom\", message: \"Duplicate provider personal authority\" });\n      }\n    }),\n);\n\nexport type SubscriptionPersonalAuthorityV2 = z.infer<typeof SubscriptionPersonalAuthorityV2>;\n\n/** Return one provider's immutable personal authority from a parsed snapshot. */\nexport function subscriptionPersonalAuthorityForProviderV2(\n  snapshot: SubscriptionPersonalAuthorityV2,\n  provider: SubscriptionPersonalAuthorityV2[\"personal\"][number][\"provider\"],\n): SubscriptionPersonalAuthorityV2[\"personal\"][number] | null {\n  return snapshot.personal.find((authority) => authority.provider === provider) ?? null;\n}\n\nexport const EMPTY_SUBSCRIPTION_PERSONAL_AUTHORITY_V2 = {\n  version: 2,\n  personal: [],\n} as const satisfies SubscriptionPersonalAuthorityV2;\n"],"mappings":";;;;;AACA,SAAS,SAAS;AAElB,IAAM,sBAAsC;AAAA,EAAa,MACvD,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,OAAO,gBAAgB;AACzD;AAKA,IAAM,gBAAgC;AAAA,EAAa,MACjD,EAAE,OAAO,EAAE,MAAM,2EAA2E;AAC9F;AAMO,IAAM,kCAAkD;AAAA,EAAa,MAC1E,EACG,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,CAAC;AAAA,IACpB,UAAU,EACP;AAAA,MACC,EACG,OAAO;AAAA,QACN,UAAU,EAAE,KAAK,CAAC,SAAS,UAAU,KAAK,CAAC;AAAA,QAC3C,mBAAmB;AAAA,QACnB,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMrB,qBAAqB,EAClB,OAAO,EAAE,WAAW,eAAe,cAAc,cAAc,CAAC,EAChE,OAAO,EACP,SAAS;AAAA,MACd,CAAC,EACA,OAAO;AAAA,IACZ,EACC,IAAI,CAAC;AAAA,EACV,CAAC,EACA,OAAO,EACP,YAAY,CAAC,UAAU,QAAQ;AAC9B,UAAM,YAAY,SAAS,SAAS,IAAI,CAAC,cAAc,UAAU,QAAQ;AACzE,QAAI,IAAI,IAAI,SAAS,EAAE,SAAS,UAAU,QAAQ;AAChD,UAAI,SAAS,EAAE,MAAM,UAAU,SAAS,wCAAwC,CAAC;AAAA,IACnF;AAAA,EACF,CAAC;AACL;AAKO,SAAS,2CACd,UACA,UAC4D;AAC5D,SAAO,SAAS,SAAS,KAAK,CAAC,cAAc,UAAU,aAAa,QAAQ,KAAK;AACnF;AAEO,IAAM,2CAA2C;AAAA,EACtD,SAAS;AAAA,EACT,UAAU,CAAC;AACb;","names":[]}

package/dist/chunk-56SNIMDO.js

@@ -0,0 +1,9 @@
+// src/define-schema.ts
+function defineSchema(factory) {
+  return factory();
+}
+
+export {
+  defineSchema
+};
+//# sourceMappingURL=chunk-56SNIMDO.js.map

package/dist/chunk-56SNIMDO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/define-schema.ts"],"sourcesContent":["/**\n * Construct a schema eagerly, but give bundlers one removable boundary around\n * the whole initializer (including nested schemas and chained builders).\n * Annotate calls with @__PURE__ only when the factory has no effects beyond\n * constructing its returned schema. This is not lazy validation: used schemas\n * are created once, in the same module evaluation order as ordinary constants.\n */\nexport function defineSchema<Schema>(factory: () => Schema): Schema {\n  return factory();\n}\n"],"mappings":";AAOO,SAAS,aAAqB,SAA+B;AAClE,SAAO,QAAQ;AACjB;","names":[]}

package/dist/chunk-6C2HKFTU.js

@@ -0,0 +1,207 @@
+import {
+  ConnectionKind,
+  SessionTenancyVisibility
+} from "./chunk-OF6OKOBF.js";
+import {
+  defineSchema
+} from "./chunk-56SNIMDO.js";
+
+// src/connection-authority.ts
+import { z } from "zod";
+var ConnectionAuthoritySelectionSource = /* @__PURE__ */ defineSchema(
+  () => z.enum(["explicit_workspace", "sender"])
+);
+var ConnectionUseSelectionSource = /* @__PURE__ */ defineSchema(
+  () => z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u)
+);
+var AcceptedConnectionWork = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("kind", [
+    z.object({
+      kind: z.literal("turn"),
+      turnId: z.string().uuid()
+    }).strict(),
+    z.object({
+      kind: z.literal("scheduled_task"),
+      taskId: z.string().uuid(),
+      taskAuthorityRevision: z.number().int().positive(),
+      runId: z.string().uuid()
+    }).strict()
+  ])
+);
+var ConnectionUseAuthoritySnapshot = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    organizationId: z.string().uuid(),
+    originWorkspaceId: z.string().uuid(),
+    targetWorkspaceId: z.string().uuid(),
+    targetSessionId: z.string().uuid(),
+    targetSessionVisibility: SessionTenancyVisibility,
+    targetSessionAuthorityEpoch: z.number().int().positive(),
+    acceptedWork: AcceptedConnectionWork,
+    connectionId: z.string().uuid(),
+    connectionGeneration: z.number().int().positive(),
+    connectionStatus: z.literal("active"),
+    providerDomain: z.string().min(1).max(2048),
+    connectionKind: ConnectionKind,
+    scope: z.enum(["workspace", "user"]),
+    ownerSubjectId: z.string().min(1).max(512).nullable(),
+    ownerOrganizationMembershipId: z.string().uuid().nullable(),
+    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
+    authoritySource: ConnectionAuthoritySelectionSource,
+    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
+    userDelegation: z.null()
+  }).strict().superRefine((value, context) => {
+    const ownedBySubject = value.scope !== "workspace";
+    const delegated = value.scope === "user";
+    if (ownedBySubject !== (value.ownerSubjectId !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["ownerSubjectId"],
+        message: "personal connections retain an owner subject"
+      });
+    }
+    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["ownerOrganizationMembershipId"],
+        message: "only user connections retain an owner membership"
+      });
+    }
+    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["ownerMembershipAuthorizationRevision"],
+        message: "only user connections retain an owner membership revision"
+      });
+    }
+    if (delegated && value.authoritySource !== "sender") {
+      context.addIssue({
+        code: "custom",
+        path: ["authoritySource"],
+        message: "user connections require authenticated sender provenance"
+      });
+    }
+    if (!delegated && value.authoritySource === "sender") {
+      context.addIssue({
+        code: "custom",
+        path: ["authoritySource"],
+        message: "workspace connections cannot claim sender provenance"
+      });
+    }
+    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
+      context.addIssue({
+        code: "custom",
+        path: ["originWorkspaceId"],
+        message: "workspace connections must be owned by the target workspace"
+      });
+    }
+  })
+);
+var ConnectionUseDenialReason = /* @__PURE__ */ defineSchema(
+  () => z.enum([
+    "tenant_mismatch",
+    "workspace_access_inactive",
+    "session_inactive",
+    "session_identity_changed",
+    "session_visibility_changed",
+    "session_authority_epoch_changed",
+    "accepted_attempt_authority_required",
+    "accepted_snapshot_digest_changed",
+    "connection_missing",
+    "connection_identity_changed",
+    "connection_generation_changed",
+    "connection_status_inactive",
+    "connection_owner_changed",
+    "owner_membership_inactive",
+    "authority_missing",
+    "authority_identity_changed",
+    "authority_generation_changed",
+    "authority_status_inactive",
+    "grant_missing",
+    "grant_identity_changed",
+    "grant_generation_changed",
+    "grant_status_inactive",
+    "grant_expired",
+    "grant_already_consumed"
+  ])
+);
+var ConnectionUseAttributionFields = /* @__PURE__ */ defineSchema(
+  () => z.object({
+    organizationId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    sessionId: z.string().uuid(),
+    connectionId: z.string().uuid(),
+    connectionGeneration: z.number().int().positive(),
+    scope: z.enum(["workspace", "user", "legacy_user"]),
+    ownerSubjectId: z.string().min(1).max(512).nullable(),
+    authorityId: z.string().uuid().nullable(),
+    grantId: z.string().uuid().nullable()
+  }).strict()
+);
+function refineConnectionUseAttribution(value, context) {
+  const personal = value.scope !== "workspace";
+  for (const field of ["ownerSubjectId"]) {
+    if (personal !== (value[field] !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
+      });
+    }
+  }
+  const owned = value.scope === "user";
+  for (const field of ["authorityId"]) {
+    if (owned !== (value[field] !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: [field],
+        message: owned ? `personal attribution requires ${field}` : `non-personal attribution cannot carry ${field}`
+      });
+    }
+  }
+  if (!owned && value.grantId !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["grantId"],
+      message: "only historical personal attribution can carry a grant"
+    });
+  }
+}
+var ConnectionUseAttribution = /* @__PURE__ */ defineSchema(
+  () => ConnectionUseAttributionFields.extend({
+    scope: z.enum(["workspace", "user"]),
+    grantId: z.null()
+  }).superRefine(refineConnectionUseAttribution)
+);
+var ConnectionUseAuditFact = /* @__PURE__ */ defineSchema(
+  () => ConnectionUseAttributionFields.extend({
+    outcome: z.enum(["authorized", "denied"]),
+    denialReason: ConnectionUseDenialReason.nullable(),
+    occurredAt: z.string().datetime({ offset: true })
+  }).superRefine((value, context) => {
+    refineConnectionUseAttribution(value, context);
+    if (value.outcome === "denied" !== (value.denialReason !== null)) {
+      context.addIssue({
+        code: "custom",
+        path: ["denialReason"],
+        message: "only denied connection use carries a denial reason"
+      });
+    }
+  })
+);
+var ConnectionUseAuthorizationResult = /* @__PURE__ */ defineSchema(
+  () => z.discriminatedUnion("status", [
+    z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
+    z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
+  ])
+);
+
+export {
+  ConnectionAuthoritySelectionSource,
+  ConnectionUseSelectionSource,
+  ConnectionUseAuthoritySnapshot,
+  ConnectionUseDenialReason,
+  ConnectionUseAttribution,
+  ConnectionUseAuditFact,
+  ConnectionUseAuthorizationResult
+};
+//# sourceMappingURL=chunk-6C2HKFTU.js.map

package/dist/chunk-6C2HKFTU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { defineSchema } from \"./define-schema\";\nimport { z } from \"zod\";\nimport { ConnectionKind, SessionTenancyVisibility } from \"./index\";\n\nexport const ConnectionAuthoritySelectionSource = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\"explicit_workspace\", \"sender\"]),\n);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = /* @__PURE__ */ defineSchema(() =>\n  z\n    .string()\n    .min(1)\n    .max(128)\n    .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u),\n);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"kind\", [\n    z\n      .object({\n        kind: z.literal(\"turn\"),\n        turnId: z.string().uuid(),\n      })\n      .strict(),\n    z\n      .object({\n        kind: z.literal(\"scheduled_task\"),\n        taskId: z.string().uuid(),\n        taskAuthorityRevision: z.number().int().positive(),\n        runId: z.string().uuid(),\n      })\n      .strict(),\n  ]),\n);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      organizationId: z.string().uuid(),\n      originWorkspaceId: z.string().uuid(),\n      targetWorkspaceId: z.string().uuid(),\n      targetSessionId: z.string().uuid(),\n      targetSessionVisibility: SessionTenancyVisibility,\n      targetSessionAuthorityEpoch: z.number().int().positive(),\n      acceptedWork: AcceptedConnectionWork,\n      connectionId: z.string().uuid(),\n      connectionGeneration: z.number().int().positive(),\n      connectionStatus: z.literal(\"active\"),\n      providerDomain: z.string().min(1).max(2048),\n      connectionKind: ConnectionKind,\n      scope: z.enum([\"workspace\", \"user\"]),\n      ownerSubjectId: z.string().min(1).max(512).nullable(),\n      ownerOrganizationMembershipId: z.string().uuid().nullable(),\n      ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n      authoritySource: ConnectionAuthoritySelectionSource,\n      selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n      userDelegation: z.null(),\n    })\n    .strict()\n    .superRefine((value, context) => {\n      const ownedBySubject = value.scope !== \"workspace\";\n      const delegated = value.scope === \"user\";\n      if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"ownerSubjectId\"],\n          message: \"personal connections retain an owner subject\",\n        });\n      }\n      if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"ownerOrganizationMembershipId\"],\n          message: \"only user connections retain an owner membership\",\n        });\n      }\n      if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"ownerMembershipAuthorizationRevision\"],\n          message: \"only user connections retain an owner membership revision\",\n        });\n      }\n      if (delegated && value.authoritySource !== \"sender\") {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"authoritySource\"],\n          message: \"user connections require authenticated sender provenance\",\n        });\n      }\n      if (!delegated && value.authoritySource === \"sender\") {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"authoritySource\"],\n          message: \"workspace connections cannot claim sender provenance\",\n        });\n      }\n      if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n        context.addIssue({\n          code: \"custom\",\n          path: [\"originWorkspaceId\"],\n          message: \"workspace connections must be owned by the target workspace\",\n        });\n      }\n    }),\n);\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = /* @__PURE__ */ defineSchema(() =>\n  z.enum([\n    \"tenant_mismatch\",\n    \"workspace_access_inactive\",\n    \"session_inactive\",\n    \"session_identity_changed\",\n    \"session_visibility_changed\",\n    \"session_authority_epoch_changed\",\n    \"accepted_attempt_authority_required\",\n    \"accepted_snapshot_digest_changed\",\n    \"connection_missing\",\n    \"connection_identity_changed\",\n    \"connection_generation_changed\",\n    \"connection_status_inactive\",\n    \"connection_owner_changed\",\n    \"owner_membership_inactive\",\n    \"authority_missing\",\n    \"authority_identity_changed\",\n    \"authority_generation_changed\",\n    \"authority_status_inactive\",\n    \"grant_missing\",\n    \"grant_identity_changed\",\n    \"grant_generation_changed\",\n    \"grant_status_inactive\",\n    \"grant_expired\",\n    \"grant_already_consumed\",\n  ]),\n);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = /* @__PURE__ */ defineSchema(() =>\n  z\n    .object({\n      organizationId: z.string().uuid(),\n      workspaceId: z.string().uuid(),\n      sessionId: z.string().uuid(),\n      connectionId: z.string().uuid(),\n      connectionGeneration: z.number().int().positive(),\n      scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n      ownerSubjectId: z.string().min(1).max(512).nullable(),\n      authorityId: z.string().uuid().nullable(),\n      grantId: z.string().uuid().nullable(),\n    })\n    .strict(),\n);\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const owned = value.scope === \"user\";\n  for (const field of [\"authorityId\"] as const) {\n    if (owned !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: owned\n          ? `personal attribution requires ${field}`\n          : `non-personal attribution cannot carry ${field}`,\n      });\n    }\n  }\n  if (!owned && value.grantId !== null) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"grantId\"],\n      message: \"only historical personal attribution can carry a grant\",\n    });\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = /* @__PURE__ */ defineSchema(() =>\n  ConnectionUseAttributionFields.extend({\n    scope: z.enum([\"workspace\", \"user\"]),\n    grantId: z.null(),\n  }).superRefine(refineConnectionUseAttribution),\n);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = /* @__PURE__ */ defineSchema(() =>\n  ConnectionUseAttributionFields.extend({\n    outcome: z.enum([\"authorized\", \"denied\"]),\n    denialReason: ConnectionUseDenialReason.nullable(),\n    occurredAt: z.string().datetime({ offset: true }),\n  }).superRefine((value, context) => {\n    refineConnectionUseAttribution(value, context);\n    if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"denialReason\"],\n        message: \"only denied connection use carries a denial reason\",\n      });\n    }\n  }),\n);\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = /* @__PURE__ */ defineSchema(() =>\n  z.discriminatedUnion(\"status\", [\n    z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n    z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n  ]),\n);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;;;;AACA,SAAS,SAAS;AAGX,IAAM,qCAAqD;AAAA,EAAa,MAC7E,EAAE,KAAK,CAAC,sBAAsB,QAAQ,CAAC;AACzC;AAGO,IAAM,+BAA+C;AAAA,EAAa,MACvE,EACG,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAClD;AAGA,IAAM,yBAAyC;AAAA,EAAa,MAC1D,EAAE,mBAAmB,QAAQ;AAAA,IAC3B,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,MAAM;AAAA,MACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,MAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,MACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,MACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AACH;AAOO,IAAM,iCAAiD;AAAA,EAAa,MACzE,EACG,OAAO;AAAA,IACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,IAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,IACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,IACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,IACjC,yBAAyB;AAAA,IACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACvD,cAAc;AAAA,IACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,IAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,IACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,IAC1C,gBAAgB;AAAA,IAChB,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACnC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,IACzF,iBAAiB;AAAA,IACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,IACtE,gBAAgB,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,UAAM,iBAAiB,MAAM,UAAU;AACvC,UAAM,YAAY,MAAM,UAAU;AAClC,QAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,gBAAgB;AAAA,QACvB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,+BAA+B;AAAA,QACtC,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,sCAAsC;AAAA,QAC7C,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,aAAa,MAAM,oBAAoB,UAAU;AACnD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,iBAAiB;AAAA,QACxB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,CAAC,aAAa,MAAM,oBAAoB,UAAU;AACpD,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,iBAAiB;AAAA,QACxB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,mBAAmB;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACL;AAGO,IAAM,4BAA4C;AAAA,EAAa,MACpE,EAAE,KAAK;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAGA,IAAM,iCAAiD;AAAA,EAAa,MAClE,EACG,OAAO;AAAA,IACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,IAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,IAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,IAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,IAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,CAAC,EACA,OAAO;AACZ;AAEA,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,UAAU;AAC9B,aAAW,SAAS,CAAC,aAAa,GAAY;AAC5C,QAAI,WAAW,MAAM,KAAK,MAAM,OAAO;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,QACL,iCAAiC,KAAK,KACtC,yCAAyC,KAAK;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,CAAC,SAAS,MAAM,YAAY,MAAM;AACpC,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,IAAM,2BAA2C;AAAA,EAAa,MACnE,+BAA+B,OAAO;AAAA,IACpC,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,IACnC,SAAS,EAAE,KAAK;AAAA,EAClB,CAAC,EAAE,YAAY,8BAA8B;AAC/C;AAGO,IAAM,yBAAyC;AAAA,EAAa,MACjE,+BAA+B,OAAO;AAAA,IACpC,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,IACxC,cAAc,0BAA0B,SAAS;AAAA,IACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,mCAA+B,OAAO,OAAO;AAC7C,QAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,cAAc;AAAA,QACrB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAGO,IAAM,mCAAmD;AAAA,EAAa,MAC3E,EAAE,mBAAmB,UAAU;AAAA,IAC7B,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,IAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AAAA,EACtF,CAAC;AACH;","names":[]}

package/dist/chunk-6IXO76Z6.js

@@ -0,0 +1,72 @@
+// src/workspace-integration-wire.ts
+var WORKSPACE_WEBHOOK_EVENT_TYPES = [
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "session.status.changed",
+  "session.requiresAction",
+  "session.humanInput.requested",
+  "session.notification.posted",
+  "session.notification.withdrawn",
+  "usage.threshold_reached",
+  "usage.exhausted",
+  "usage.period_reset"
+];
+var OPENGENI_WEBHOOK_TEST_EVENT_TYPE = "webhook.test";
+var OPENGENI_TEST_REQUEST_NIL_ID = "00000000-0000-0000-0000-000000000000";
+var OPENGENI_SIGNATURE_HEADER = "OpenGeni-Signature";
+var OPENGENI_EVENT_ID_HEADER = "OpenGeni-Event-Id";
+var OPENGENI_DELIVERY_ID_HEADER = "OpenGeni-Delivery-Id";
+var OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;
+var encoder = new TextEncoder();
+async function hmacSha256Hex(secret, message) {
+  const key = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const signature = new Uint8Array(await crypto.subtle.sign("HMAC", key, encoder.encode(message)));
+  return Array.from(signature, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function constantTimeEqualHex(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index += 1) {
+    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);
+  }
+  return difference === 0;
+}
+async function signOpenGeniPayload(secret, body, timestampSeconds = Math.floor(Date.now() / 1e3)) {
+  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;
+}
+async function verifyOpenGeniSignature(input) {
+  if (!input.signature) return false;
+  let timestamp = null;
+  const candidates = [];
+  for (const part of input.signature.split(",")) {
+    const [key, value] = part.trim().split("=", 2);
+    if (key === "t" && value && /^\d{1,12}$/.test(value)) timestamp = Number(value);
+    if (key === "v1" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);
+  }
+  if (timestamp === null || candidates.length === 0) return false;
+  const now = input.nowSeconds ?? Math.floor(Date.now() / 1e3);
+  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;
+  if (Math.abs(now - timestamp) > tolerance) return false;
+  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);
+  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));
+}
+
+export {
+  WORKSPACE_WEBHOOK_EVENT_TYPES,
+  OPENGENI_WEBHOOK_TEST_EVENT_TYPE,
+  OPENGENI_TEST_REQUEST_NIL_ID,
+  OPENGENI_SIGNATURE_HEADER,
+  OPENGENI_EVENT_ID_HEADER,
+  OPENGENI_DELIVERY_ID_HEADER,
+  OPENGENI_SIGNATURE_TOLERANCE_SECONDS,
+  signOpenGeniPayload,
+  verifyOpenGeniSignature
+};
+//# sourceMappingURL=chunk-6IXO76Z6.js.map

package/dist/chunk-6IXO76Z6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/workspace-integration-wire.ts"],"sourcesContent":["/**\n * Dependency-free wire constants and the OpenGeni-Signature scheme shared by\n * workspace webhooks and credential providers. Kept free of zod so browser and\n * React Native bundles can verify signatures without the schema runtime.\n */\n\nexport const WORKSPACE_WEBHOOK_EVENT_TYPES = [\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"session.status.changed\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"session.notification.posted\",\n  \"session.notification.withdrawn\",\n  \"usage.threshold_reached\",\n  \"usage.exhausted\",\n  \"usage.period_reset\",\n] as const;\n\n/**\n * Sent only when an administrator presses \"Send test event\". It is never a\n * subscribable type: every endpoint can receive it, and a receiver that does\n * not care acknowledges it with any 2xx.\n */\nexport const OPENGENI_WEBHOOK_TEST_EVENT_TYPE = \"webhook.test\";\n\n/**\n * The session, turn and attempt ids of a credential-provider test request\n * (`purpose: \"test\"`). A test is not a run, so no real ids exist.\n */\nexport const OPENGENI_TEST_REQUEST_NIL_ID = \"00000000-0000-0000-0000-000000000000\";\n\nexport const OPENGENI_SIGNATURE_HEADER = \"OpenGeni-Signature\";\nexport const OPENGENI_EVENT_ID_HEADER = \"OpenGeni-Event-Id\";\nexport const OPENGENI_DELIVERY_ID_HEADER = \"OpenGeni-Delivery-Id\";\nexport const OPENGENI_SIGNATURE_TOLERANCE_SECONDS = 300;\n\nconst encoder = new TextEncoder();\n\nasync function hmacSha256Hex(secret: string, message: string): Promise<string> {\n  const key = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(secret),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const signature = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, encoder.encode(message)));\n  return Array.from(signature, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction constantTimeEqualHex(left: string, right: string): boolean {\n  if (left.length !== right.length) return false;\n  let difference = 0;\n  for (let index = 0; index < left.length; index += 1) {\n    difference |= left.charCodeAt(index) ^ right.charCodeAt(index);\n  }\n  return difference === 0;\n}\n\n/**\n * `OpenGeni-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256(secret, \"<t>.<body>\")>`.\n * The timestamp is signed so a captured request cannot be replayed later.\n */\nexport async function signOpenGeniPayload(\n  secret: string,\n  body: string,\n  timestampSeconds = Math.floor(Date.now() / 1000),\n): Promise<string> {\n  return `t=${timestampSeconds},v1=${await hmacSha256Hex(secret, `${timestampSeconds}.${body}`)}`;\n}\n\nexport type VerifyOpenGeniSignatureInput = {\n  secret: string;\n  /** The exact raw request body, before JSON parsing. */\n  body: string;\n  /** The `OpenGeni-Signature` header value. */\n  signature: string | null | undefined;\n  toleranceSeconds?: number;\n  nowSeconds?: number;\n};\n\nexport async function verifyOpenGeniSignature(\n  input: VerifyOpenGeniSignatureInput,\n): Promise<boolean> {\n  if (!input.signature) return false;\n  let timestamp: number | null = null;\n  const candidates: string[] = [];\n  for (const part of input.signature.split(\",\")) {\n    const [key, value] = part.trim().split(\"=\", 2);\n    if (key === \"t\" && value && /^\\d{1,12}$/.test(value)) timestamp = Number(value);\n    if (key === \"v1\" && value && /^[0-9a-f]{64}$/.test(value)) candidates.push(value);\n  }\n  if (timestamp === null || candidates.length === 0) return false;\n  const now = input.nowSeconds ?? Math.floor(Date.now() / 1000);\n  const tolerance = input.toleranceSeconds ?? OPENGENI_SIGNATURE_TOLERANCE_SECONDS;\n  if (Math.abs(now - timestamp) > tolerance) return false;\n  const expected = await hmacSha256Hex(input.secret, `${timestamp}.${input.body}`);\n  return candidates.some((candidate) => constantTimeEqualHex(candidate, expected));\n}\n"],"mappings":";AAMO,IAAM,gCAAgC;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,mCAAmC;AAMzC,IAAM,+BAA+B;AAErC,IAAM,4BAA4B;AAClC,IAAM,2BAA2B;AACjC,IAAM,8BAA8B;AACpC,IAAM,uCAAuC;AAEpD,IAAM,UAAU,IAAI,YAAY;AAEhC,eAAe,cAAc,QAAgB,SAAkC;AAC7E,QAAM,MAAM,MAAM,OAAO,OAAO;AAAA,IAC9B;AAAA,IACA,QAAQ,OAAO,MAAM;AAAA,IACrB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,YAAY,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,WAAW,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACpF;AAEA,SAAS,qBAAqB,MAAc,OAAwB;AAClE,MAAI,KAAK,WAAW,MAAM,OAAQ,QAAO;AACzC,MAAI,aAAa;AACjB,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,kBAAc,KAAK,WAAW,KAAK,IAAI,MAAM,WAAW,KAAK;AAAA,EAC/D;AACA,SAAO,eAAe;AACxB;AAMA,eAAsB,oBACpB,QACA,MACA,mBAAmB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAC9B;AACjB,SAAO,KAAK,gBAAgB,OAAO,MAAM,cAAc,QAAQ,GAAG,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAC/F;AAYA,eAAsB,wBACpB,OACkB;AAClB,MAAI,CAAC,MAAM,UAAW,QAAO;AAC7B,MAAI,YAA2B;AAC/B,QAAM,aAAuB,CAAC;AAC9B,aAAW,QAAQ,MAAM,UAAU,MAAM,GAAG,GAAG;AAC7C,UAAM,CAAC,KAAK,KAAK,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,CAAC;AAC7C,QAAI,QAAQ,OAAO,SAAS,aAAa,KAAK,KAAK,EAAG,aAAY,OAAO,KAAK;AAC9E,QAAI,QAAQ,QAAQ,SAAS,iBAAiB,KAAK,KAAK,EAAG,YAAW,KAAK,KAAK;AAAA,EAClF;AACA,MAAI,cAAc,QAAQ,WAAW,WAAW,EAAG,QAAO;AAC1D,QAAM,MAAM,MAAM,cAAc,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AAC5D,QAAM,YAAY,MAAM,oBAAoB;AAC5C,MAAI,KAAK,IAAI,MAAM,SAAS,IAAI,UAAW,QAAO;AAClD,QAAM,WAAW,MAAM,cAAc,MAAM,QAAQ,GAAG,SAAS,IAAI,MAAM,IAAI,EAAE;AAC/E,SAAO,WAAW,KAAK,CAAC,cAAc,qBAAqB,WAAW,QAAQ,CAAC;AACjF;","names":[]}

package/dist/chunk-7272KVWZ.js

@@ -0,0 +1,60 @@
+// src/session-usage-limit-refusal.ts
+var SESSION_USAGE_LIMIT_SEGMENT = "session_usage_limit";
+var SESSION_USAGE_LIMIT_GOAL_PAUSED_REASON = "session_usage_limit";
+var BASIS = "model_api_equivalent_v1";
+var MAX_LIMIT_MICROS = 1e7 * 1e6;
+var MESSAGE_MAX_UTF8_BYTES = 1024;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function micros(value, max = Number.MAX_SAFE_INTEGER) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= max;
+}
+function boundedMessage(value) {
+  const normalized = value.slice(0, MESSAGE_MAX_UTF8_BYTES * 2).replace(/[\u0000-\u001f\u007f]+/g, " ").trim();
+  const bytes = new TextEncoder().encode(normalized);
+  let end = Math.min(bytes.length, MESSAGE_MAX_UTF8_BYTES);
+  while (end > 0 && end < bytes.length && (bytes[end] & 192) === 128) end -= 1;
+  return new TextDecoder().decode(bytes.slice(0, end)).trim();
+}
+function parseSessionUsageLimitReachedRefusal(value) {
+  const outer = record(value);
+  if (!outer) return null;
+  const source = record(outer.sessionUsageLimit) ?? outer;
+  if (source.code !== "session_usage_limit_reached") return null;
+  const fields = record(source.details) ?? source;
+  if (fields.basis !== BASIS || typeof fields.rootSessionId !== "string" || !UUID.test(fields.rootSessionId) || !micros(fields.limitMicros, MAX_LIMIT_MICROS) || !micros(fields.usedMicros)) {
+    return null;
+  }
+  const refusal = {
+    code: "session_usage_limit_reached",
+    basis: BASIS,
+    rootSessionId: fields.rootSessionId.toLowerCase(),
+    limitMicros: fields.limitMicros,
+    usedMicros: fields.usedMicros,
+    message: ""
+  };
+  const message = typeof source.message === "string" ? boundedMessage(source.message) : "";
+  return { ...refusal, message: message || sessionUsageLimitReachedMessage(refusal) };
+}
+function formatSessionUsageMicros(value) {
+  if (value > 0 && value < 1e4) return "<$0.01";
+  const dollars = value / 1e6;
+  return `$${dollars.toLocaleString("en-US", {
+    minimumFractionDigits: 2,
+    maximumFractionDigits: 2
+  })}`;
+}
+function sessionUsageLimitReachedMessage(refusal) {
+  return `This task's usage limit is reached (${formatSessionUsageMicros(refusal.usedMicros)} of ${formatSessionUsageMicros(refusal.limitMicros)} API-equivalent model usage). A person can raise or remove the limit to continue.`;
+}
+
+export {
+  SESSION_USAGE_LIMIT_SEGMENT,
+  SESSION_USAGE_LIMIT_GOAL_PAUSED_REASON,
+  parseSessionUsageLimitReachedRefusal,
+  formatSessionUsageMicros,
+  sessionUsageLimitReachedMessage
+};
+//# sourceMappingURL=chunk-7272KVWZ.js.map

package/dist/chunk-7272KVWZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/session-usage-limit-refusal.ts"],"sourcesContent":["/**\n * Browser/React Native-safe session usage limit helpers. Deliberately free of\n * the zod runtime so synchronous timeline projection can use it; contract\n * parity tests keep it aligned with `session-usage-limits.ts`.\n */\n\n/** `turn.completed.segmentLimit` for a stop caused by a task usage limit. */\nexport const SESSION_USAGE_LIMIT_SEGMENT = \"session_usage_limit\" as const;\n/** `SessionGoal.pausedReason` for a goal paused by a task usage limit. */\nexport const SESSION_USAGE_LIMIT_GOAL_PAUSED_REASON = \"session_usage_limit\" as const;\n\nconst BASIS = \"model_api_equivalent_v1\";\nconst MAX_LIMIT_MICROS = 10_000_000 * 1_000_000;\nconst MESSAGE_MAX_UTF8_BYTES = 1_024;\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nexport type ParsedSessionUsageLimitReachedRefusal = {\n  code: \"session_usage_limit_reached\";\n  basis: \"model_api_equivalent_v1\";\n  rootSessionId: string;\n  limitMicros: number;\n  usedMicros: number;\n  message: string;\n};\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : null;\n}\n\nfunction micros(value: unknown, max = Number.MAX_SAFE_INTEGER): value is number {\n  return typeof value === \"number\" && Number.isSafeInteger(value) && value >= 0 && value <= max;\n}\n\nfunction boundedMessage(value: string): string {\n  const normalized = value\n    .slice(0, MESSAGE_MAX_UTF8_BYTES * 2)\n    .replace(/[\\u0000-\\u001f\\u007f]+/g, \" \")\n    .trim();\n  const bytes = new TextEncoder().encode(normalized);\n  let end = Math.min(bytes.length, MESSAGE_MAX_UTF8_BYTES);\n  while (end > 0 && end < bytes.length && (bytes[end]! & 0xc0) === 0x80) end -= 1;\n  return new TextDecoder().decode(bytes.slice(0, end)).trim();\n}\n\n/**\n * Select only the public refusal fields from an API error body (fields may sit\n * in `details`), a `turn.completed` payload's `sessionUsageLimit` record, or a\n * refusal object. Anything malformed returns null instead of a guessed amount.\n */\nexport function parseSessionUsageLimitReachedRefusal(\n  value: unknown,\n): ParsedSessionUsageLimitReachedRefusal | null {\n  const outer = record(value);\n  if (!outer) return null;\n  const source = record(outer.sessionUsageLimit) ?? outer;\n  if (source.code !== \"session_usage_limit_reached\") return null;\n  const fields = record(source.details) ?? source;\n  if (\n    fields.basis !== BASIS ||\n    typeof fields.rootSessionId !== \"string\" ||\n    !UUID.test(fields.rootSessionId) ||\n    !micros(fields.limitMicros, MAX_LIMIT_MICROS) ||\n    !micros(fields.usedMicros)\n  ) {\n    return null;\n  }\n  const refusal = {\n    code: \"session_usage_limit_reached\" as const,\n    basis: BASIS as \"model_api_equivalent_v1\",\n    rootSessionId: fields.rootSessionId.toLowerCase(),\n    limitMicros: fields.limitMicros,\n    usedMicros: fields.usedMicros,\n    message: \"\",\n  };\n  const message = typeof source.message === \"string\" ? boundedMessage(source.message) : \"\";\n  return { ...refusal, message: message || sessionUsageLimitReachedMessage(refusal) };\n}\n\n/**\n * \"$12.34\" for known amounts, \"<$0.01\" for a positive amount under a cent.\n * Callers must not pass unknown usage: render \"Preparing usage\" or\n * \"Usage unavailable\" instead of a dollar figure.\n */\nexport function formatSessionUsageMicros(value: number): string {\n  if (value > 0 && value < 10_000) return \"<$0.01\";\n  const dollars = value / 1_000_000;\n  return `$${dollars.toLocaleString(\"en-US\", {\n    minimumFractionDigits: 2,\n    maximumFractionDigits: 2,\n  })}`;\n}\n\n/** Fixed, bounded wording: no reset date, purchase remedy or invoice claim. */\nexport function sessionUsageLimitReachedMessage(refusal: {\n  limitMicros: number;\n  usedMicros: number;\n}): string {\n  return `This task's usage limit is reached (${formatSessionUsageMicros(refusal.usedMicros)} of ${formatSessionUsageMicros(refusal.limitMicros)} API-equivalent model usage). A person can raise or remove the limit to continue.`;\n}\n"],"mappings":";AAOO,IAAM,8BAA8B;AAEpC,IAAM,yCAAyC;AAEtD,IAAM,QAAQ;AACd,IAAM,mBAAmB,MAAa;AACtC,IAAM,yBAAyB;AAC/B,IAAM,OAAO;AAWb,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD;AACN;AAEA,SAAS,OAAO,OAAgB,MAAM,OAAO,kBAAmC;AAC9E,SAAO,OAAO,UAAU,YAAY,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,SAAS;AAC5F;AAEA,SAAS,eAAe,OAAuB;AAC7C,QAAM,aAAa,MAChB,MAAM,GAAG,yBAAyB,CAAC,EACnC,QAAQ,2BAA2B,GAAG,EACtC,KAAK;AACR,QAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,UAAU;AACjD,MAAI,MAAM,KAAK,IAAI,MAAM,QAAQ,sBAAsB;AACvD,SAAO,MAAM,KAAK,MAAM,MAAM,WAAW,MAAM,GAAG,IAAK,SAAU,IAAM,QAAO;AAC9E,SAAO,IAAI,YAAY,EAAE,OAAO,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,KAAK;AAC5D;AAOO,SAAS,qCACd,OAC8C;AAC9C,QAAM,QAAQ,OAAO,KAAK;AAC1B,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,SAAS,OAAO,MAAM,iBAAiB,KAAK;AAClD,MAAI,OAAO,SAAS,8BAA+B,QAAO;AAC1D,QAAM,SAAS,OAAO,OAAO,OAAO,KAAK;AACzC,MACE,OAAO,UAAU,SACjB,OAAO,OAAO,kBAAkB,YAChC,CAAC,KAAK,KAAK,OAAO,aAAa,KAC/B,CAAC,OAAO,OAAO,aAAa,gBAAgB,KAC5C,CAAC,OAAO,OAAO,UAAU,GACzB;AACA,WAAO;AAAA,EACT;AACA,QAAM,UAAU;AAAA,IACd,MAAM;AAAA,IACN,OAAO;AAAA,IACP,eAAe,OAAO,cAAc,YAAY;AAAA,IAChD,aAAa,OAAO;AAAA,IACpB,YAAY,OAAO;AAAA,IACnB,SAAS;AAAA,EACX;AACA,QAAM,UAAU,OAAO,OAAO,YAAY,WAAW,eAAe,OAAO,OAAO,IAAI;AACtF,SAAO,EAAE,GAAG,SAAS,SAAS,WAAW,gCAAgC,OAAO,EAAE;AACpF;AAOO,SAAS,yBAAyB,OAAuB;AAC9D,MAAI,QAAQ,KAAK,QAAQ,IAAQ,QAAO;AACxC,QAAM,UAAU,QAAQ;AACxB,SAAO,IAAI,QAAQ,eAAe,SAAS;AAAA,IACzC,uBAAuB;AAAA,IACvB,uBAAuB;AAAA,EACzB,CAAC,CAAC;AACJ;AAGO,SAAS,gCAAgC,SAGrC;AACT,SAAO,uCAAuC,yBAAyB,QAAQ,UAAU,CAAC,OAAO,yBAAyB,QAAQ,WAAW,CAAC;AAChJ;","names":[]}