@opengeni/contracts 3.1.0-canary.2 → 3.1.2

package/dist/chunk-M5ZGRVIQ.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/video-generation.ts","../src/retained-output.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  GENERATED_VIDEO_MAX_BYTES,\n  RETAINED_OUTPUT_MAX_PAGE_BYTES,\n  RetainedArtifactReferenceSchema,\n} from \"./retained-output\";\n\nexport const VIDEO_GENERATION_SCHEMA_VERSION = 1 as const;\nexport const SEEDANCE_2_5_MODEL_ID = \"bytedance/seedance-2.5\" as const;\nexport const GROK_IMAGINE_VIDEO_1_5_MODEL_ID = \"xai/grok-imagine-video-1.5\" as const;\n\nexport const VideoGenerationSourceMode = z.enum([\n  \"text\",\n  \"first_frame\",\n  \"first_and_last_frames\",\n  \"image_reference\",\n  \"video_reference\",\n]);\nexport type VideoGenerationSourceMode = z.infer<typeof VideoGenerationSourceMode>;\n\nexport const VideoGenerationResolution = z.enum([\"480p\", \"720p\"]);\nexport type VideoGenerationResolution = z.infer<typeof VideoGenerationResolution>;\n\nexport const VideoGenerationFundingSource = z.enum([\n  \"opengeni_credits\",\n  \"workspace_gateway\",\n  \"supergrok_subscription\",\n]);\nexport type VideoGenerationFundingSource = z.infer<typeof VideoGenerationFundingSource>;\n\nexport const VideoGenerationAspectRatio = z.enum([\n  \"16:9\",\n  \"4:3\",\n  \"1:1\",\n  \"3:4\",\n  \"9:16\",\n  \"21:9\",\n  \"adaptive\",\n]);\nexport type VideoGenerationAspectRatio = z.infer<typeof VideoGenerationAspectRatio>;\n\nconst SandboxVideoReferencePath = z\n  .string()\n  .min(1)\n  .max(1_024)\n  .refine((value) => value.startsWith(\"/workspace/\"), {\n    message: \"video references must use an absolute /workspace path\",\n  });\n\nexport const VideoGenerationSource = z.discriminatedUnion(\"mode\", [\n  z.object({ mode: z.literal(\"text\") }).strict(),\n  z\n    .object({\n      mode: z.literal(\"first_frame\"),\n      imagePath: SandboxVideoReferencePath,\n    })\n    .strict(),\n  z\n    .object({\n      mode: z.literal(\"first_and_last_frames\"),\n      firstFramePath: SandboxVideoReferencePath,\n      lastFramePath: SandboxVideoReferencePath,\n    })\n    .strict()\n    .refine((value) => value.firstFramePath !== value.lastFramePath, {\n      path: [\"lastFramePath\"],\n      message: \"first and last frame paths must differ\",\n    }),\n  z\n    .object({\n      mode: z.literal(\"image_reference\"),\n      imagePath: SandboxVideoReferencePath,\n    })\n    .strict(),\n  z\n    .object({\n      mode: z.literal(\"video_reference\"),\n      videoPath: SandboxVideoReferencePath,\n    })\n    .strict(),\n]);\nexport type VideoGenerationSource = z.infer<typeof VideoGenerationSource>;\n\n/** Stable provider-neutral function-tool input. Dynamic capability facts never enter this schema. */\nexport const GenerateVideoToolInput = z\n  .object({\n    prompt: z\n      .string()\n      .min(1)\n      .max(32_000)\n      .refine((value) => value.trim().length > 0),\n    modelId: z.string().min(1).max(256).optional(),\n    source: VideoGenerationSource.optional(),\n    durationSeconds: z.number().int().min(4).max(30).optional(),\n    aspectRatio: VideoGenerationAspectRatio.optional(),\n    resolution: VideoGenerationResolution.optional(),\n    generateAudio: z.boolean().optional(),\n  })\n  .strict();\nexport type GenerateVideoToolInput = z.infer<typeof GenerateVideoToolInput>;\n\nexport const GetVideoGenerationCapabilitiesToolInput = z.object({}).strict();\nexport type GetVideoGenerationCapabilitiesToolInput = z.infer<\n  typeof GetVideoGenerationCapabilitiesToolInput\n>;\n\nexport const VideoGenerationModelCapability = z\n  .object({\n    modelId: z.string().min(1).max(256),\n    label: z.string().min(1).max(128),\n    providerLabel: z.string().min(1).max(128),\n    sourceModes: z.array(VideoGenerationSourceMode).min(1).max(5),\n    resolutions: z.array(VideoGenerationResolution).min(1).max(2),\n    aspectRatios: z.array(VideoGenerationAspectRatio).min(1).max(7),\n    duration: z\n      .object({\n        minSeconds: z.number().int().positive(),\n        maxSeconds: z.number().int().positive(),\n        stepSeconds: z.number().int().positive(),\n      })\n      .strict()\n      .refine((value) => value.maxSeconds >= value.minSeconds),\n    supportsAudio: z.boolean(),\n  })\n  .strict();\nexport type VideoGenerationModelCapability = z.infer<typeof VideoGenerationModelCapability>;\n\nexport const VideoGenerationCapabilities = z\n  .object({\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    capabilityRevision: z.string().min(1).max(128),\n    defaultModelId: z.string().min(1).max(256),\n    models: z.array(VideoGenerationModelCapability).min(1).max(16),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    const ids = new Set(value.models.map((model) => model.modelId));\n    if (ids.size !== value.models.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"models\"],\n        message: \"model ids must be unique\",\n      });\n    }\n    if (!ids.has(value.defaultModelId)) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"defaultModelId\"],\n        message: \"default model must be present in the enabled model list\",\n      });\n    }\n  });\nexport type VideoGenerationCapabilities = z.infer<typeof VideoGenerationCapabilities>;\n\nexport const VideoGenerationPolicy = z\n  .object({\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    revision: z.number().int().nonnegative().safe(),\n    fundingSource: VideoGenerationFundingSource,\n    enabledModelIds: z.array(z.string().min(1).max(256)).max(16),\n    defaultModelId: z.string().min(1).max(256).nullable(),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    const ids = new Set(value.enabledModelIds);\n    if (ids.size !== value.enabledModelIds.length) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"enabledModelIds\"],\n        message: \"enabled model ids must be unique\",\n      });\n    }\n    if (value.defaultModelId !== null && !ids.has(value.defaultModelId)) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"defaultModelId\"],\n        message: \"default model must be enabled\",\n      });\n    }\n  });\nexport type VideoGenerationPolicy = z.infer<typeof VideoGenerationPolicy>;\n\nexport const UpdateVideoGenerationPolicyRequest = z\n  .object({\n    expectedRevision: z.number().int().nonnegative().safe(),\n    fundingSource: VideoGenerationFundingSource,\n    enabledModelIds: z.array(z.string().min(1).max(256)).max(16),\n    defaultModelId: z.string().min(1).max(256).nullable(),\n  })\n  .strict();\nexport type UpdateVideoGenerationPolicyRequest = z.infer<typeof UpdateVideoGenerationPolicyRequest>;\n\nexport const VideoGenerationFundingOption = z\n  .object({\n    source: VideoGenerationFundingSource,\n    label: z.string().min(1).max(128),\n    description: z.string().min(1).max(256),\n    available: z.boolean(),\n    unavailableReason: z.string().min(1).max(256).nullable(),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    if (value.available !== (value.unavailableReason === null)) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"unavailableReason\"],\n        message: \"available funding options cannot have an unavailable reason\",\n      });\n    }\n  });\nexport type VideoGenerationFundingOption = z.infer<typeof VideoGenerationFundingOption>;\n\nexport const WorkspaceVideoGenerationSettings = z\n  .object({\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    policy: VideoGenerationPolicy,\n    fundingOptions: z.array(VideoGenerationFundingOption).length(3),\n    availableModels: z.array(VideoGenerationModelCapability).max(16),\n    capabilities: VideoGenerationCapabilities.nullable(),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    if (\n      new Set(value.fundingOptions.map((option) => option.source)).size !== 3 ||\n      !value.fundingOptions.some((option) => option.source === \"opengeni_credits\") ||\n      !value.fundingOptions.some((option) => option.source === \"workspace_gateway\") ||\n      !value.fundingOptions.some((option) => option.source === \"supergrok_subscription\")\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"fundingOptions\"],\n        message: \"all funding sources must be described exactly once\",\n      });\n    }\n    const selected = value.fundingOptions.find(\n      (option) => option.source === value.policy.fundingSource,\n    );\n    if (!selected) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"fundingOptions\"],\n        message: \"the selected funding source must be described\",\n      });\n    } else if (!selected.available && value.capabilities !== null) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"capabilities\"],\n        message: \"unavailable funding cannot expose executable capabilities\",\n      });\n    }\n  });\nexport type WorkspaceVideoGenerationSettings = z.infer<typeof WorkspaceVideoGenerationSettings>;\n\nexport const VideoGenerationAcceptedReceipt = z\n  .object({\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    status: z.literal(\"accepted\"),\n    operationId: z.string().uuid(),\n  })\n  .strict();\nexport type VideoGenerationAcceptedReceipt = z.infer<typeof VideoGenerationAcceptedReceipt>;\n\nexport const VideoGenerationRejectedCode = z.enum([\n  \"invalid_reference_path\",\n  \"reference_not_stable\",\n  \"reference_too_large\",\n  \"reference_media_type_mismatch\",\n  \"unsupported_reference_media\",\n]);\nexport type VideoGenerationRejectedCode = z.infer<typeof VideoGenerationRejectedCode>;\n\n/** Deterministic pre-admission rejection: no provider request or durable operation was created. */\nexport const VideoGenerationRejectedResult = z\n  .object({\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    status: z.literal(\"rejected\"),\n    code: VideoGenerationRejectedCode,\n    message: z.string().min(1).max(512),\n    operationCreated: z.literal(false),\n  })\n  .strict();\nexport type VideoGenerationRejectedResult = z.infer<typeof VideoGenerationRejectedResult>;\n\nexport const VideoGenerationToolResult = z.discriminatedUnion(\"status\", [\n  VideoGenerationAcceptedReceipt,\n  VideoGenerationRejectedResult,\n]);\nexport type VideoGenerationToolResult = z.infer<typeof VideoGenerationToolResult>;\n\nexport const GeneratedVideoFacts = z\n  .object({\n    durationSeconds: z.number().positive().max(120),\n    width: z.number().int().positive().max(8_192),\n    height: z.number().int().positive().max(8_192),\n    fps: z.number().positive().max(120),\n    hasAudio: z.boolean(),\n    videoCodec: z.literal(\"h264\"),\n    audioCodec: z.literal(\"aac\").nullable(),\n  })\n  .strict();\nexport type GeneratedVideoFacts = z.infer<typeof GeneratedVideoFacts>;\n\nexport const GeneratedVideoReceipt = z\n  .object({\n    type: z.literal(\"generated_video\"),\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    operationId: z.string().uuid(),\n    artifact: RetainedArtifactReferenceSchema,\n    video: GeneratedVideoFacts,\n    sandboxPath: z\n      .string()\n      .max(256)\n      .regex(\n        /^\\/workspace\\/generated-videos\\/generated-video-[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\\.mp4$/,\n      ),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    if (\n      value.artifact.kind !== \"generated_video\" ||\n      value.artifact.contentType !== \"video/mp4\" ||\n      value.artifact.originalBytes <= 0 ||\n      value.artifact.originalBytes > GENERATED_VIDEO_MAX_BYTES ||\n      value.artifact.retention.policy !== \"workspace_file\" ||\n      value.artifact.retrieval.maxRangeBytes !== RETAINED_OUTPUT_MAX_PAGE_BYTES\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"artifact\"],\n        message: \"generated-video artifact metadata is invalid\",\n      });\n    }\n    if (\n      value.artifact.dimensions?.width !== value.video.width ||\n      value.artifact.dimensions?.height !== value.video.height\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"video\"],\n        message: \"video dimensions must match the retained artifact\",\n      });\n    }\n    if (\n      value.sandboxPath !==\n      `/workspace/generated-videos/generated-video-${value.artifact.artifactId}.mp4`\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"sandboxPath\"],\n        message: \"generated-video sandbox path does not match its artifact\",\n      });\n    }\n  });\nexport type GeneratedVideoReceipt = z.infer<typeof GeneratedVideoReceipt>;\n\nexport const VideoGenerationTerminalFailureStatus = z.enum([\n  \"provider_failed\",\n  \"retention_failed\",\n  \"cancelled_before_submit\",\n  \"outcome_unknown\",\n]);\nexport type VideoGenerationTerminalFailureStatus = z.infer<\n  typeof VideoGenerationTerminalFailureStatus\n>;\n\nexport const MediaGenerationResult = z.discriminatedUnion(\"status\", [\n  z\n    .object({\n      type: z.literal(\"media_generation_result\"),\n      schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n      status: z.literal(\"ready\"),\n      operationId: z.string().uuid(),\n      receipt: GeneratedVideoReceipt,\n    })\n    .strict()\n    .refine((value) => value.receipt.operationId === value.operationId, {\n      path: [\"receipt\", \"operationId\"],\n      message: \"terminal receipt must match its operation\",\n    }),\n  z\n    .object({\n      type: z.literal(\"media_generation_result\"),\n      schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n      status: VideoGenerationTerminalFailureStatus,\n      operationId: z.string().uuid(),\n      boundedPublicReason: z.string().min(1).max(1_000),\n    })\n    .strict(),\n]);\nexport type MediaGenerationResult = z.infer<typeof MediaGenerationResult>;\n\nexport const VideoGenerationPublicStatus = z.enum([\n  \"preparing\",\n  \"prepared\",\n  \"accepted\",\n  \"provider_started\",\n  \"retaining\",\n  \"completed\",\n  \"provider_failed\",\n  \"cancelled_before_submit\",\n  \"outcome_unknown\",\n  \"retention_failed\",\n]);\nexport type VideoGenerationPublicStatus = z.infer<typeof VideoGenerationPublicStatus>;\n\nexport const VideoGenerationOperationSummary = z\n  .object({\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    operationId: z.string().uuid(),\n    modelId: z.string().min(1).max(256),\n    status: VideoGenerationPublicStatus,\n    createdAt: z.string().datetime({ offset: true }),\n    updatedAt: z.string().datetime({ offset: true }),\n    terminal: MediaGenerationResult.nullable(),\n  })\n  .strict();\nexport type VideoGenerationOperationSummary = z.infer<typeof VideoGenerationOperationSummary>;\n\nexport const VideoArtifactPlaybackSource = z\n  .object({\n    schemaVersion: z.literal(VIDEO_GENERATION_SCHEMA_VERSION),\n    artifactId: z.string().uuid(),\n    url: z.string().url().max(8_192),\n    expiresAt: z.string().datetime({ offset: true }),\n    contentType: z.literal(\"video/mp4\"),\n    sizeBytes: z.number().int().positive().max(GENERATED_VIDEO_MAX_BYTES),\n    sha256: z.string().regex(/^[0-9a-f]{64}$/),\n    acceptRanges: z.literal(\"bytes\"),\n  })\n  .strict();\nexport type VideoArtifactPlaybackSource = z.infer<typeof VideoArtifactPlaybackSource>;\n","import { z } from \"zod\";\n\n/** Hard server-side ceiling for one retained-output response body. */\nexport const RETAINED_OUTPUT_MAX_PAGE_BYTES = 1024 * 1024;\n/** Default first page when the client does not send a Range header. */\nexport const RETAINED_OUTPUT_DEFAULT_PAGE_BYTES = 256 * 1024;\n/** Receipts are timeline references, never an extensible metadata bag. */\nexport const RETAINED_OUTPUT_RECEIPT_MAX_BYTES = 2 * 1024;\n\n/** Screenshot bytes are accounted separately from the 10k-token text policy. */\nexport const COMPUTER_SCREENSHOT_MAX_BYTES = 32 * 1024 * 1024;\nexport const COMPUTER_SCREENSHOT_MAX_DIMENSION = 16_384;\nexport const COMPUTER_SCREENSHOT_MAX_PIXELS = 67_108_864;\n/** Canonical ready-object retention window: 30 days from successful settlement. */\nexport const COMPUTER_SCREENSHOT_RETENTION_MS = 30 * 24 * 60 * 60 * 1_000;\n/** Hard workspace reservation across pending + ready screenshot artifacts. */\nexport const COMPUTER_SCREENSHOT_WORKSPACE_QUOTA_BYTES = 5 * 1024 * 1024 * 1024;\n/** Generated images are permanent workspace files, never inline history blobs. */\nexport const GENERATED_IMAGE_MAX_BYTES = 64 * 1024 * 1024;\n/** Generated videos are permanent workspace files and are always streamed. */\nexport const GENERATED_VIDEO_MAX_BYTES = 512 * 1024 * 1024;\n\nconst encoder = new TextEncoder();\nconst LOWERCASE_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;\nconst LOWERCASE_SHA256 = /^[0-9a-f]{64}$/;\nconst CANONICAL_MEDIA_TYPE = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,62}\\/[a-z0-9][a-z0-9!#$&^_.+-]{0,62}$/;\nconst WORKSPACE_RETRIEVAL_PATH =\n  /^\\/v1\\/workspaces\\/([0-9a-f-]+)\\/artifacts\\/([0-9a-f-]+)\\/content$/;\nconst SESSION_RETRIEVAL_PATH =\n  /^\\/v1\\/workspaces\\/([0-9a-f-]+)\\/sessions\\/([0-9a-f-]+)\\/artifacts\\/([0-9a-f-]+)\\/content$/;\n\nexport const RetainedOutputKind = z.enum([\n  \"tool_result\",\n  \"assistant_completion\",\n  \"internal_update\",\n  \"event_media\",\n  \"computer_screenshot\",\n  \"generated_image\",\n  \"generated_video\",\n  \"file\",\n]);\nexport type RetainedOutputKind = z.infer<typeof RetainedOutputKind>;\n\nexport const RetainedOutputUnavailableReason = z.enum([\n  \"not_retained\",\n  \"pending\",\n  \"failed\",\n  \"expired\",\n  \"deleted\",\n  \"missing_storage\",\n  \"storage_write_failed\",\n  \"quota_exceeded\",\n  \"invalid_content\",\n  \"oversized\",\n  \"unsupported\",\n]);\nexport type RetainedOutputUnavailableReason = z.infer<typeof RetainedOutputUnavailableReason>;\n\nconst RetainedOutputUnavailableEvidenceSchema = z\n  .object({\n    available: z.literal(false),\n    reason: RetainedOutputUnavailableReason,\n  })\n  .strict();\n\nexport const RetainedArtifactReferenceSchema = z\n  .object({\n    available: z.literal(true),\n    artifactId: z.string().regex(LOWERCASE_UUID),\n    kind: RetainedOutputKind,\n    contentType: z.string().max(127).regex(CANONICAL_MEDIA_TYPE),\n    originalBytes: z.number().int().nonnegative().safe(),\n    sha256: z.string().regex(LOWERCASE_SHA256),\n    retainedAt: z.string().datetime({ offset: true }),\n    dimensions: z\n      .object({\n        width: z.number().int().positive().max(COMPUTER_SCREENSHOT_MAX_DIMENSION),\n        height: z.number().int().positive().max(COMPUTER_SCREENSHOT_MAX_DIMENSION),\n      })\n      .strict()\n      .optional(),\n    retention: z.union([\n      z\n        .object({\n          policy: z.literal(\"workspace_file\"),\n          expiresAt: z.null(),\n        })\n        .strict(),\n      z\n        .object({\n          policy: z.literal(\"session_screenshot\"),\n          expiresAt: z.string().datetime({ offset: true }),\n        })\n        .strict(),\n    ]),\n    retrieval: z\n      .object({\n        method: z.literal(\"GET\"),\n        path: z.string().max(256),\n        acceptRanges: z.literal(\"bytes\"),\n        maxRangeBytes: z.number().int().positive().max(RETAINED_OUTPUT_MAX_PAGE_BYTES),\n      })\n      .strict(),\n  })\n  .strict()\n  .superRefine((value, ctx) => {\n    const workspaceMatch = WORKSPACE_RETRIEVAL_PATH.exec(value.retrieval.path);\n    const sessionMatch = SESSION_RETRIEVAL_PATH.exec(value.retrieval.path);\n    const workspaceId = workspaceMatch?.[1] ?? sessionMatch?.[1];\n    const sessionId = sessionMatch?.[2];\n    const artifactId = workspaceMatch?.[2] ?? sessionMatch?.[3];\n    if (\n      !workspaceId ||\n      !LOWERCASE_UUID.test(workspaceId) ||\n      (sessionId !== undefined && !LOWERCASE_UUID.test(sessionId)) ||\n      artifactId !== value.artifactId\n    ) {\n      ctx.addIssue({\n        code: \"custom\",\n        path: [\"retrieval\", \"path\"],\n        message: \"retrieval path must be a workspace/session API content path for this artifact\",\n      });\n    }\n\n    if (\n      value.kind === \"computer_screenshot\" ||\n      value.kind === \"generated_image\" ||\n      value.kind === \"generated_video\"\n    ) {\n      if (!value.dimensions) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"dimensions\"],\n          message: `${value.kind} receipts require exact dimensions`,\n        });\n      } else if (\n        value.dimensions.width * value.dimensions.height >\n        COMPUTER_SCREENSHOT_MAX_PIXELS\n      ) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"dimensions\"],\n          message: `${value.kind} dimensions exceed the pixel limit`,\n        });\n      }\n    }\n\n    if (value.kind === \"generated_image\") {\n      if (value.retention.policy !== \"workspace_file\" || !workspaceMatch || sessionMatch) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"retention\"],\n          message: \"generated images require permanent workspace-file retrieval\",\n        });\n      }\n      if (\n        ![\"image/png\", \"image/jpeg\", \"image/webp\"].includes(value.contentType) ||\n        value.originalBytes <= 0 ||\n        value.originalBytes > GENERATED_IMAGE_MAX_BYTES\n      ) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"contentType\"],\n          message: \"generated image media metadata is invalid\",\n        });\n      }\n    }\n\n    if (value.kind === \"generated_video\") {\n      if (value.retention.policy !== \"workspace_file\" || !workspaceMatch || sessionMatch) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"retention\"],\n          message: \"generated videos require permanent workspace-file retrieval\",\n        });\n      }\n      if (\n        value.contentType !== \"video/mp4\" ||\n        value.originalBytes <= 0 ||\n        value.originalBytes > GENERATED_VIDEO_MAX_BYTES\n      ) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"contentType\"],\n          message: \"generated video media metadata is invalid\",\n        });\n      }\n    }\n\n    if (value.kind === \"computer_screenshot\") {\n      if (value.retention.policy !== \"session_screenshot\" || !sessionMatch) {\n        ctx.addIssue({\n          code: \"custom\",\n          path: [\"retention\"],\n          message: \"computer screenshots require session-scoped expiring retrieval\",\n        });\n      }\n    }\n\n    if (encoder.encode(JSON.stringify(value)).byteLength > RETAINED_OUTPUT_RECEIPT_MAX_BYTES) {\n      ctx.addIssue({\n        code: \"custom\",\n        message: \"retained-output receipt exceeds its byte envelope\",\n      });\n    }\n  });\n\n/**\n * Canonical evidence fact carried by bounded audit/NATS/SSE/UI previews.\n *\n * The available variant is intentionally provider-neutral and closed: no bucket,\n * object key, signed URL, arbitrary metadata, or producer-controlled labels can\n * cross this boundary.\n */\nexport const RetainedOutputEvidenceSchema = z.discriminatedUnion(\"available\", [\n  RetainedOutputUnavailableEvidenceSchema,\n  RetainedArtifactReferenceSchema,\n]);\nexport type RetainedOutputEvidence = z.infer<typeof RetainedOutputEvidenceSchema>;\nexport type RetainedArtifactReference = z.infer<typeof RetainedArtifactReferenceSchema>;\n/** @deprecated use RetainedArtifactReference. */\nexport type RetainedOutputAvailableEvidence = RetainedArtifactReference;\n\nexport const RetainedArtifactUnavailableSchema = z\n  .object({\n    available: z.literal(false),\n    artifactId: z.string().regex(LOWERCASE_UUID),\n    reason: RetainedOutputUnavailableReason,\n  })\n  .strict();\nexport type RetainedArtifactUnavailable = z.infer<typeof RetainedArtifactUnavailableSchema>;\n\n/** Authenticated metadata result for one opaque workspace file identity. */\nexport const RetainedArtifactMetadataSchema = z.union([\n  RetainedArtifactReferenceSchema,\n  RetainedArtifactUnavailableSchema,\n]);\nexport type RetainedArtifactMetadata = z.infer<typeof RetainedArtifactMetadataSchema>;\n\nexport type RetainedArtifactFileInput = {\n  id: string;\n  workspaceId: string;\n  status: string;\n  contentType: string;\n  sizeBytes: number;\n  sha256: string | null;\n  updatedAt: string;\n};\n\nexport type RetainedScreenshotArtifactInput = RetainedArtifactFileInput & {\n  sessionId: string;\n  width: number;\n  height: number;\n  expiresAt: string;\n};\n\nexport type RetainedGeneratedImageArtifactInput = RetainedArtifactFileInput & {\n  width: number;\n  height: number;\n};\n\nexport type RetainedGeneratedVideoArtifactInput = RetainedArtifactFileInput & {\n  width: number;\n  height: number;\n};\n\n/**\n * Convert a ready, integrity-addressed workspace file into the only available\n * retained-output receipt shape. Invalid, pending, or checksum-less files fail\n * closed instead of implying that full evidence is retrievable.\n */\nexport function retainedArtifactReferenceFromFile(\n  file: RetainedArtifactFileInput,\n  kind: RetainedOutputKind = \"file\",\n): RetainedArtifactReference | null {\n  if (file.status !== \"ready\" || !file.sha256) return null;\n  const value = {\n    available: true as const,\n    artifactId: file.id,\n    kind,\n    contentType: canonicalRetainedContentType(file.contentType),\n    originalBytes: file.sizeBytes,\n    sha256: file.sha256,\n    retainedAt: file.updatedAt,\n    retention: {\n      policy: \"workspace_file\" as const,\n      expiresAt: null,\n    },\n    retrieval: {\n      method: \"GET\" as const,\n      path: `/v1/workspaces/${file.workspaceId}/artifacts/${file.id}/content`,\n      acceptRanges: \"bytes\" as const,\n      maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,\n    },\n  };\n  const parsed = RetainedArtifactReferenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\n/** Build the closed, session-scoped receipt for one ready screenshot file. */\nexport function retainedScreenshotReferenceFromFile(\n  file: RetainedScreenshotArtifactInput,\n): RetainedArtifactReference | null {\n  if (file.status !== \"ready\" || !file.sha256 || file.sizeBytes <= 0) return null;\n  const value = {\n    available: true as const,\n    artifactId: file.id,\n    kind: \"computer_screenshot\" as const,\n    contentType: canonicalRetainedContentType(file.contentType),\n    originalBytes: file.sizeBytes,\n    sha256: file.sha256,\n    retainedAt: file.updatedAt,\n    dimensions: { width: file.width, height: file.height },\n    retention: {\n      policy: \"session_screenshot\" as const,\n      expiresAt: file.expiresAt,\n    },\n    retrieval: {\n      method: \"GET\" as const,\n      path: `/v1/workspaces/${file.workspaceId}/sessions/${file.sessionId}/artifacts/${file.id}/content`,\n      acceptRanges: \"bytes\" as const,\n      maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,\n    },\n  };\n  const parsed = RetainedArtifactReferenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\n/** Build the permanent workspace receipt for one validated generated image. */\nexport function retainedGeneratedImageReferenceFromFile(\n  file: RetainedGeneratedImageArtifactInput,\n): RetainedArtifactReference | null {\n  if (\n    file.status !== \"ready\" ||\n    !file.sha256 ||\n    file.sizeBytes <= 0 ||\n    file.sizeBytes > GENERATED_IMAGE_MAX_BYTES\n  ) {\n    return null;\n  }\n  const value = {\n    available: true as const,\n    artifactId: file.id,\n    kind: \"generated_image\" as const,\n    contentType: canonicalRetainedContentType(file.contentType),\n    originalBytes: file.sizeBytes,\n    sha256: file.sha256,\n    retainedAt: file.updatedAt,\n    dimensions: { width: file.width, height: file.height },\n    retention: {\n      policy: \"workspace_file\" as const,\n      expiresAt: null,\n    },\n    retrieval: {\n      method: \"GET\" as const,\n      path: `/v1/workspaces/${file.workspaceId}/artifacts/${file.id}/content`,\n      acceptRanges: \"bytes\" as const,\n      maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,\n    },\n  };\n  const parsed = RetainedArtifactReferenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\n/** Build the permanent workspace receipt for one validated generated video. */\nexport function retainedGeneratedVideoReferenceFromFile(\n  file: RetainedGeneratedVideoArtifactInput,\n): RetainedArtifactReference | null {\n  if (\n    file.status !== \"ready\" ||\n    file.contentType !== \"video/mp4\" ||\n    !file.sha256 ||\n    file.sizeBytes <= 0 ||\n    file.sizeBytes > GENERATED_VIDEO_MAX_BYTES\n  ) {\n    return null;\n  }\n  const value = {\n    available: true as const,\n    artifactId: file.id,\n    kind: \"generated_video\" as const,\n    contentType: \"video/mp4\" as const,\n    originalBytes: file.sizeBytes,\n    sha256: file.sha256,\n    retainedAt: file.updatedAt,\n    dimensions: { width: file.width, height: file.height },\n    retention: {\n      policy: \"workspace_file\" as const,\n      expiresAt: null,\n    },\n    retrieval: {\n      method: \"GET\" as const,\n      path: `/v1/workspaces/${file.workspaceId}/artifacts/${file.id}/content`,\n      acceptRanges: \"bytes\" as const,\n      maxRangeBytes: RETAINED_OUTPUT_MAX_PAGE_BYTES,\n    },\n  };\n  const parsed = RetainedArtifactReferenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\nfunction canonicalRetainedContentType(value: string): string {\n  const mediaType = value.split(\";\", 1)[0]?.trim().toLowerCase() ?? \"\";\n  return CANONICAL_MEDIA_TYPE.test(mediaType) ? mediaType : \"application/octet-stream\";\n}\n\n/** Parse and clone a trusted server receipt; invalid/untrusted data fails closed. */\nexport function validateRetainedOutputEvidence(value: unknown): RetainedOutputEvidence | null {\n  const parsed = RetainedOutputEvidenceSchema.safeParse(value);\n  return parsed.success ? parsed.data : null;\n}\n\nexport function retainedOutputUnavailable(\n  reason: RetainedOutputUnavailableReason = \"not_retained\",\n): RetainedOutputEvidence {\n  return { available: false, reason };\n}\n\nexport type RetainedOutputResolvedRange = {\n  kind: \"range\";\n  start: number;\n  end: number;\n  length: number;\n  totalBytes: number;\n  status: 200 | 206;\n  contentRange: string | null;\n  acceptRanges: \"bytes\";\n};\n\nexport type RetainedOutputRangeResolution =\n  | RetainedOutputResolvedRange\n  | {\n      kind: \"empty\";\n      length: 0;\n      totalBytes: 0;\n      status: 200;\n      contentRange: null;\n      acceptRanges: \"bytes\";\n    }\n  | {\n      kind: \"invalid\";\n      reason: \"malformed\" | \"multipart_not_supported\" | \"numeric_overflow\" | \"range_too_large\";\n      maxPageBytes: number;\n    }\n  | {\n      kind: \"unsatisfiable\";\n      reason: \"empty_artifact\" | \"start_out_of_bounds\" | \"end_before_start\" | \"zero_suffix\";\n      totalBytes: number;\n      contentRange: string;\n    };\n\n/**\n * Resolve one RFC-style bytes range without ever licensing a response larger\n * than `maxPageBytes`. Multipart ranges and oversized explicit/suffix requests\n * fail closed. An omitted or open-ended range becomes one resumable bounded page.\n */\nexport function resolveRetainedOutputRange(\n  rangeHeader: string | null | undefined,\n  totalBytes: number,\n  maxPageBytes = RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,\n): RetainedOutputRangeResolution {\n  assertRangeInputs(totalBytes, maxPageBytes);\n\n  if (rangeHeader === null || rangeHeader === undefined || rangeHeader === \"\") {\n    if (totalBytes === 0) {\n      return {\n        kind: \"empty\",\n        length: 0,\n        totalBytes: 0,\n        status: 200,\n        contentRange: null,\n        acceptRanges: \"bytes\",\n      };\n    }\n    const end = Math.min(totalBytes - 1, maxPageBytes - 1);\n    const partial = end + 1 < totalBytes;\n    return resolvedRange(0, end, totalBytes, partial ? 206 : 200);\n  }\n\n  if (rangeHeader.length > 128 || /[^\\x20-\\x7e]/.test(rangeHeader)) {\n    return invalidRange(\"malformed\", maxPageBytes);\n  }\n  if (rangeHeader.includes(\",\")) {\n    return invalidRange(\"multipart_not_supported\", maxPageBytes);\n  }\n  const match = /^bytes=(\\d*)-(\\d*)$/.exec(rangeHeader);\n  if (!match || (!match[1] && !match[2])) {\n    return invalidRange(\"malformed\", maxPageBytes);\n  }\n\n  const first = parseRangeInteger(match[1]);\n  const second = parseRangeInteger(match[2]);\n  if (first === \"overflow\" || second === \"overflow\") {\n    return invalidRange(\"numeric_overflow\", maxPageBytes);\n  }\n\n  if (first === null) {\n    const suffixLength = second;\n    if (suffixLength === null) return invalidRange(\"malformed\", maxPageBytes);\n    if (suffixLength === 0) return unsatisfiableRange(\"zero_suffix\", totalBytes);\n    if (suffixLength > maxPageBytes) return invalidRange(\"range_too_large\", maxPageBytes);\n    if (totalBytes === 0) return unsatisfiableRange(\"empty_artifact\", totalBytes);\n    const length = Math.min(suffixLength, totalBytes);\n    return resolvedRange(totalBytes - length, totalBytes - 1, totalBytes, 206);\n  }\n\n  if (totalBytes === 0) return unsatisfiableRange(\"empty_artifact\", totalBytes);\n  if (first >= totalBytes) return unsatisfiableRange(\"start_out_of_bounds\", totalBytes);\n\n  if (second === null) {\n    const end = Math.min(totalBytes - 1, first + maxPageBytes - 1);\n    return resolvedRange(first, end, totalBytes, 206);\n  }\n  if (second < first) return unsatisfiableRange(\"end_before_start\", totalBytes);\n  if (second - first >= maxPageBytes) {\n    return invalidRange(\"range_too_large\", maxPageBytes);\n  }\n  return resolvedRange(first, Math.min(second, totalBytes - 1), totalBytes, 206);\n}\n\nfunction assertRangeInputs(totalBytes: number, maxPageBytes: number): void {\n  if (!Number.isSafeInteger(totalBytes) || totalBytes < 0) {\n    throw new RangeError(\"totalBytes must be a nonnegative safe integer\");\n  }\n  if (\n    !Number.isSafeInteger(maxPageBytes) ||\n    maxPageBytes <= 0 ||\n    maxPageBytes > RETAINED_OUTPUT_MAX_PAGE_BYTES\n  ) {\n    throw new RangeError(\n      `maxPageBytes must be an integer between 1 and ${RETAINED_OUTPUT_MAX_PAGE_BYTES}`,\n    );\n  }\n}\n\nfunction parseRangeInteger(value: string | undefined): number | null | \"overflow\" {\n  if (!value) return null;\n  // Avoid both precision loss and work proportional to an adversarial digit run.\n  if (value.length > 16) return \"overflow\";\n  const parsed = Number(value);\n  return Number.isSafeInteger(parsed) ? parsed : \"overflow\";\n}\n\nfunction resolvedRange(\n  start: number,\n  end: number,\n  totalBytes: number,\n  status: 200 | 206,\n): RetainedOutputResolvedRange {\n  return {\n    kind: \"range\",\n    start,\n    end,\n    length: end - start + 1,\n    totalBytes,\n    status,\n    contentRange: status === 206 ? `bytes ${start}-${end}/${totalBytes}` : null,\n    acceptRanges: \"bytes\",\n  };\n}\n\nfunction invalidRange(\n  reason: Extract<RetainedOutputRangeResolution, { kind: \"invalid\" }>[\"reason\"],\n  maxPageBytes: number,\n): RetainedOutputRangeResolution {\n  return { kind: \"invalid\", reason, maxPageBytes };\n}\n\nfunction unsatisfiableRange(\n  reason: Extract<RetainedOutputRangeResolution, { kind: \"unsatisfiable\" }>[\"reason\"],\n  totalBytes: number,\n): RetainedOutputRangeResolution {\n  return {\n    kind: \"unsatisfiable\",\n    reason,\n    totalBytes,\n    contentRange: `bytes */${totalBytes}`,\n  };\n}\n"],"mappings":";AAAA,SAAS,KAAAA,UAAS;;;ACAlB,SAAS,SAAS;AAGX,IAAM,iCAAiC,OAAO;AAE9C,IAAM,qCAAqC,MAAM;AAEjD,IAAM,oCAAoC,IAAI;AAG9C,IAAM,gCAAgC,KAAK,OAAO;AAClD,IAAM,oCAAoC;AAC1C,IAAM,iCAAiC;AAEvC,IAAM,mCAAmC,KAAK,KAAK,KAAK,KAAK;AAE7D,IAAM,4CAA4C,IAAI,OAAO,OAAO;AAEpE,IAAM,4BAA4B,KAAK,OAAO;AAE9C,IAAM,4BAA4B,MAAM,OAAO;AAEtD,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,iBAAiB;AACvB,IAAM,mBAAmB;AACzB,IAAM,uBAAuB;AAC7B,IAAM,2BACJ;AACF,IAAM,yBACJ;AAEK,IAAM,qBAAqB,EAAE,KAAK;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kCAAkC,EAAE,KAAK;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,0CAA0C,EAC7C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,KAAK;AAAA,EAC1B,QAAQ;AACV,CAAC,EACA,OAAO;AAEH,IAAM,kCAAkC,EAC5C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,IAAI;AAAA,EACzB,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,EAC3C,MAAM;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,MAAM,oBAAoB;AAAA,EAC3D,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AAAA,EACnD,QAAQ,EAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACzC,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAChD,YAAY,EACT,OAAO;AAAA,IACN,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,iCAAiC;AAAA,IACxE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,iCAAiC;AAAA,EAC3E,CAAC,EACA,OAAO,EACP,SAAS;AAAA,EACZ,WAAW,EAAE,MAAM;AAAA,IACjB,EACG,OAAO;AAAA,MACN,QAAQ,EAAE,QAAQ,gBAAgB;AAAA,MAClC,WAAW,EAAE,KAAK;AAAA,IACpB,CAAC,EACA,OAAO;AAAA,IACV,EACG,OAAO;AAAA,MACN,QAAQ,EAAE,QAAQ,oBAAoB;AAAA,MACtC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,IACjD,CAAC,EACA,OAAO;AAAA,EACZ,CAAC;AAAA,EACD,WAAW,EACR,OAAO;AAAA,IACN,QAAQ,EAAE,QAAQ,KAAK;AAAA,IACvB,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG;AAAA,IACxB,cAAc,EAAE,QAAQ,OAAO;AAAA,IAC/B,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,8BAA8B;AAAA,EAC/E,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,iBAAiB,yBAAyB,KAAK,MAAM,UAAU,IAAI;AACzE,QAAM,eAAe,uBAAuB,KAAK,MAAM,UAAU,IAAI;AACrE,QAAM,cAAc,iBAAiB,CAAC,KAAK,eAAe,CAAC;AAC3D,QAAM,YAAY,eAAe,CAAC;AAClC,QAAM,aAAa,iBAAiB,CAAC,KAAK,eAAe,CAAC;AAC1D,MACE,CAAC,eACD,CAAC,eAAe,KAAK,WAAW,KAC/B,cAAc,UAAa,CAAC,eAAe,KAAK,SAAS,KAC1D,eAAe,MAAM,YACrB;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa,MAAM;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AAEA,MACE,MAAM,SAAS,yBACf,MAAM,SAAS,qBACf,MAAM,SAAS,mBACf;AACA,QAAI,CAAC,MAAM,YAAY;AACrB,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,YAAY;AAAA,QACnB,SAAS,GAAG,MAAM,IAAI;AAAA,MACxB,CAAC;AAAA,IACH,WACE,MAAM,WAAW,QAAQ,MAAM,WAAW,SAC1C,gCACA;AACA,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,YAAY;AAAA,QACnB,SAAS,GAAG,MAAM,IAAI;AAAA,MACxB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,mBAAmB;AACpC,QAAI,MAAM,UAAU,WAAW,oBAAoB,CAAC,kBAAkB,cAAc;AAClF,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QACE,CAAC,CAAC,aAAa,cAAc,YAAY,EAAE,SAAS,MAAM,WAAW,KACrE,MAAM,iBAAiB,KACvB,MAAM,gBAAgB,2BACtB;AACA,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,mBAAmB;AACpC,QAAI,MAAM,UAAU,WAAW,oBAAoB,CAAC,kBAAkB,cAAc;AAClF,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QACE,MAAM,gBAAgB,eACtB,MAAM,iBAAiB,KACvB,MAAM,gBAAgB,2BACtB;AACA,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,aAAa;AAAA,QACpB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,MAAM,SAAS,uBAAuB;AACxC,QAAI,MAAM,UAAU,WAAW,wBAAwB,CAAC,cAAc;AACpE,UAAI,SAAS;AAAA,QACX,MAAM;AAAA,QACN,MAAM,CAAC,WAAW;AAAA,QAClB,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,mCAAmC;AACxF,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AASI,IAAM,+BAA+B,EAAE,mBAAmB,aAAa;AAAA,EAC5E;AAAA,EACA;AACF,CAAC;AAMM,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,WAAW,EAAE,QAAQ,KAAK;AAAA,EAC1B,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc;AAAA,EAC3C,QAAQ;AACV,CAAC,EACA,OAAO;AAIH,IAAM,iCAAiC,EAAE,MAAM;AAAA,EACpD;AAAA,EACA;AACF,CAAC;AAmCM,SAAS,kCACd,MACA,OAA2B,QACO;AAClC,MAAI,KAAK,WAAW,WAAW,CAAC,KAAK,OAAQ,QAAO;AACpD,QAAM,QAAQ;AAAA,IACZ,WAAW;AAAA,IACX,YAAY,KAAK;AAAA,IACjB;AAAA,IACA,aAAa,6BAA6B,KAAK,WAAW;AAAA,IAC1D,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM,kBAAkB,KAAK,WAAW,cAAc,KAAK,EAAE;AAAA,MAC7D,cAAc;AAAA,MACd,eAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,gCAAgC,UAAU,KAAK;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAGO,SAAS,oCACd,MACkC;AAClC,MAAI,KAAK,WAAW,WAAW,CAAC,KAAK,UAAU,KAAK,aAAa,EAAG,QAAO;AAC3E,QAAM,QAAQ;AAAA,IACZ,WAAW;AAAA,IACX,YAAY,KAAK;AAAA,IACjB,MAAM;AAAA,IACN,aAAa,6BAA6B,KAAK,WAAW;AAAA,IAC1D,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,YAAY,EAAE,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,IACrD,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,WAAW,KAAK;AAAA,IAClB;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM,kBAAkB,KAAK,WAAW,aAAa,KAAK,SAAS,cAAc,KAAK,EAAE;AAAA,MACxF,cAAc;AAAA,MACd,eAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,gCAAgC,UAAU,KAAK;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAGO,SAAS,wCACd,MACkC;AAClC,MACE,KAAK,WAAW,WAChB,CAAC,KAAK,UACN,KAAK,aAAa,KAClB,KAAK,YAAY,2BACjB;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAQ;AAAA,IACZ,WAAW;AAAA,IACX,YAAY,KAAK;AAAA,IACjB,MAAM;AAAA,IACN,aAAa,6BAA6B,KAAK,WAAW;AAAA,IAC1D,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,YAAY,EAAE,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,IACrD,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM,kBAAkB,KAAK,WAAW,cAAc,KAAK,EAAE;AAAA,MAC7D,cAAc;AAAA,MACd,eAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,gCAAgC,UAAU,KAAK;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAGO,SAAS,wCACd,MACkC;AAClC,MACE,KAAK,WAAW,WAChB,KAAK,gBAAgB,eACrB,CAAC,KAAK,UACN,KAAK,aAAa,KAClB,KAAK,YAAY,2BACjB;AACA,WAAO;AAAA,EACT;AACA,QAAM,QAAQ;AAAA,IACZ,WAAW;AAAA,IACX,YAAY,KAAK;AAAA,IACjB,MAAM;AAAA,IACN,aAAa;AAAA,IACb,eAAe,KAAK;AAAA,IACpB,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA,IACjB,YAAY,EAAE,OAAO,KAAK,OAAO,QAAQ,KAAK,OAAO;AAAA,IACrD,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,IACA,WAAW;AAAA,MACT,QAAQ;AAAA,MACR,MAAM,kBAAkB,KAAK,WAAW,cAAc,KAAK,EAAE;AAAA,MAC7D,cAAc;AAAA,MACd,eAAe;AAAA,IACjB;AAAA,EACF;AACA,QAAM,SAAS,gCAAgC,UAAU,KAAK;AAC9D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEA,SAAS,6BAA6B,OAAuB;AAC3D,QAAM,YAAY,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY,KAAK;AAClE,SAAO,qBAAqB,KAAK,SAAS,IAAI,YAAY;AAC5D;AAGO,SAAS,+BAA+B,OAA+C;AAC5F,QAAM,SAAS,6BAA6B,UAAU,KAAK;AAC3D,SAAO,OAAO,UAAU,OAAO,OAAO;AACxC;AAEO,SAAS,0BACd,SAA0C,gBAClB;AACxB,SAAO,EAAE,WAAW,OAAO,OAAO;AACpC;AAwCO,SAAS,2BACd,aACA,YACA,eAAe,oCACgB;AAC/B,oBAAkB,YAAY,YAAY;AAE1C,MAAI,gBAAgB,QAAQ,gBAAgB,UAAa,gBAAgB,IAAI;AAC3E,QAAI,eAAe,GAAG;AACpB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,cAAc;AAAA,MAChB;AAAA,IACF;AACA,UAAM,MAAM,KAAK,IAAI,aAAa,GAAG,eAAe,CAAC;AACrD,UAAM,UAAU,MAAM,IAAI;AAC1B,WAAO,cAAc,GAAG,KAAK,YAAY,UAAU,MAAM,GAAG;AAAA,EAC9D;AAEA,MAAI,YAAY,SAAS,OAAO,eAAe,KAAK,WAAW,GAAG;AAChE,WAAO,aAAa,aAAa,YAAY;AAAA,EAC/C;AACA,MAAI,YAAY,SAAS,GAAG,GAAG;AAC7B,WAAO,aAAa,2BAA2B,YAAY;AAAA,EAC7D;AACA,QAAM,QAAQ,sBAAsB,KAAK,WAAW;AACpD,MAAI,CAAC,SAAU,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAI;AACtC,WAAO,aAAa,aAAa,YAAY;AAAA,EAC/C;AAEA,QAAM,QAAQ,kBAAkB,MAAM,CAAC,CAAC;AACxC,QAAM,SAAS,kBAAkB,MAAM,CAAC,CAAC;AACzC,MAAI,UAAU,cAAc,WAAW,YAAY;AACjD,WAAO,aAAa,oBAAoB,YAAY;AAAA,EACtD;AAEA,MAAI,UAAU,MAAM;AAClB,UAAM,eAAe;AACrB,QAAI,iBAAiB,KAAM,QAAO,aAAa,aAAa,YAAY;AACxE,QAAI,iBAAiB,EAAG,QAAO,mBAAmB,eAAe,UAAU;AAC3E,QAAI,eAAe,aAAc,QAAO,aAAa,mBAAmB,YAAY;AACpF,QAAI,eAAe,EAAG,QAAO,mBAAmB,kBAAkB,UAAU;AAC5E,UAAM,SAAS,KAAK,IAAI,cAAc,UAAU;AAChD,WAAO,cAAc,aAAa,QAAQ,aAAa,GAAG,YAAY,GAAG;AAAA,EAC3E;AAEA,MAAI,eAAe,EAAG,QAAO,mBAAmB,kBAAkB,UAAU;AAC5E,MAAI,SAAS,WAAY,QAAO,mBAAmB,uBAAuB,UAAU;AAEpF,MAAI,WAAW,MAAM;AACnB,UAAM,MAAM,KAAK,IAAI,aAAa,GAAG,QAAQ,eAAe,CAAC;AAC7D,WAAO,cAAc,OAAO,KAAK,YAAY,GAAG;AAAA,EAClD;AACA,MAAI,SAAS,MAAO,QAAO,mBAAmB,oBAAoB,UAAU;AAC5E,MAAI,SAAS,SAAS,cAAc;AAClC,WAAO,aAAa,mBAAmB,YAAY;AAAA,EACrD;AACA,SAAO,cAAc,OAAO,KAAK,IAAI,QAAQ,aAAa,CAAC,GAAG,YAAY,GAAG;AAC/E;AAEA,SAAS,kBAAkB,YAAoB,cAA4B;AACzE,MAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,GAAG;AACvD,UAAM,IAAI,WAAW,+CAA+C;AAAA,EACtE;AACA,MACE,CAAC,OAAO,cAAc,YAAY,KAClC,gBAAgB,KAChB,eAAe,gCACf;AACA,UAAM,IAAI;AAAA,MACR,iDAAiD,8BAA8B;AAAA,IACjF;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,OAAuD;AAChF,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI,MAAM,SAAS,GAAI,QAAO;AAC9B,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,cAAc,MAAM,IAAI,SAAS;AACjD;AAEA,SAAS,cACP,OACA,KACA,YACA,QAC6B;AAC7B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,MAAM,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA,cAAc,WAAW,MAAM,SAAS,KAAK,IAAI,GAAG,IAAI,UAAU,KAAK;AAAA,IACvE,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,aACP,QACA,cAC+B;AAC/B,SAAO,EAAE,MAAM,WAAW,QAAQ,aAAa;AACjD;AAEA,SAAS,mBACP,QACA,YAC+B;AAC/B,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,cAAc,WAAW,UAAU;AAAA,EACrC;AACF;;;AD3jBO,IAAM,kCAAkC;AACxC,IAAM,wBAAwB;AAC9B,IAAM,kCAAkC;AAExC,IAAM,4BAA4BC,GAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,4BAA4BA,GAAE,KAAK,CAAC,QAAQ,MAAM,CAAC;AAGzD,IAAM,+BAA+BA,GAAE,KAAK;AAAA,EACjD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,6BAA6BA,GAAE,KAAK;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,4BAA4BA,GAC/B,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAK,EACT,OAAO,CAAC,UAAU,MAAM,WAAW,aAAa,GAAG;AAAA,EAClD,SAAS;AACX,CAAC;AAEI,IAAM,wBAAwBA,GAAE,mBAAmB,QAAQ;AAAA,EAChEA,GAAE,OAAO,EAAE,MAAMA,GAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAAA,EAC7CA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,aAAa;AAAA,IAC7B,WAAW;AAAA,EACb,CAAC,EACA,OAAO;AAAA,EACVA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,uBAAuB;AAAA,IACvC,gBAAgB;AAAA,IAChB,eAAe;AAAA,EACjB,CAAC,EACA,OAAO,EACP,OAAO,CAAC,UAAU,MAAM,mBAAmB,MAAM,eAAe;AAAA,IAC/D,MAAM,CAAC,eAAe;AAAA,IACtB,SAAS;AAAA,EACX,CAAC;AAAA,EACHA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,iBAAiB;AAAA,IACjC,WAAW;AAAA,EACb,CAAC,EACA,OAAO;AAAA,EACVA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,iBAAiB;AAAA,IACjC,WAAW;AAAA,EACb,CAAC,EACA,OAAO;AACZ,CAAC;AAIM,IAAM,yBAAyBA,GACnC,OAAO;AAAA,EACN,QAAQA,GACL,OAAO,EACP,IAAI,CAAC,EACL,IAAI,IAAM,EACV,OAAO,CAAC,UAAU,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,EAC5C,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC7C,QAAQ,sBAAsB,SAAS;AAAA,EACvC,iBAAiBA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC1D,aAAa,2BAA2B,SAAS;AAAA,EACjD,YAAY,0BAA0B,SAAS;AAAA,EAC/C,eAAeA,GAAE,QAAQ,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAGH,IAAM,0CAA0CA,GAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAKpE,IAAM,iCAAiCA,GAC3C,OAAO;AAAA,EACN,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAClC,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,eAAeA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACxC,aAAaA,GAAE,MAAM,yBAAyB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC5D,aAAaA,GAAE,MAAM,yBAAyB,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC5D,cAAcA,GAAE,MAAM,0BAA0B,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,EAC9D,UAAUA,GACP,OAAO;AAAA,IACN,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,YAAYA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,aAAaA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACzC,CAAC,EACA,OAAO,EACP,OAAO,CAAC,UAAU,MAAM,cAAc,MAAM,UAAU;AAAA,EACzD,eAAeA,GAAE,QAAQ;AAC3B,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8BA,GACxC,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,oBAAoBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC7C,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACzC,QAAQA,GAAE,MAAM,8BAA8B,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAC/D,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,MAAM,IAAI,IAAI,MAAM,OAAO,IAAI,CAAC,UAAU,MAAM,OAAO,CAAC;AAC9D,MAAI,IAAI,SAAS,MAAM,OAAO,QAAQ;AACpC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,QAAQ;AAAA,MACf,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,IAAI,MAAM,cAAc,GAAG;AAClC,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,UAAUA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AAAA,EAC9C,eAAe;AAAA,EACf,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE;AAAA,EAC3D,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACtD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,QAAM,MAAM,IAAI,IAAI,MAAM,eAAe;AACzC,MAAI,IAAI,SAAS,MAAM,gBAAgB,QAAQ;AAC7C,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,mBAAmB,QAAQ,CAAC,IAAI,IAAI,MAAM,cAAc,GAAG;AACnE,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,qCAAqCA,GAC/C,OAAO;AAAA,EACN,kBAAkBA,GAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK;AAAA,EACtD,eAAe;AAAA,EACf,iBAAiBA,GAAE,MAAMA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE;AAAA,EAC3D,gBAAgBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACtD,CAAC,EACA,OAAO;AAGH,IAAM,+BAA+BA,GACzC,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,OAAOA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAChC,aAAaA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,WAAWA,GAAE,QAAQ;AAAA,EACrB,mBAAmBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACzD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,MAAI,MAAM,eAAe,MAAM,sBAAsB,OAAO;AAC1D,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,mCAAmCA,GAC7C,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,QAAQ;AAAA,EACR,gBAAgBA,GAAE,MAAM,4BAA4B,EAAE,OAAO,CAAC;AAAA,EAC9D,iBAAiBA,GAAE,MAAM,8BAA8B,EAAE,IAAI,EAAE;AAAA,EAC/D,cAAc,4BAA4B,SAAS;AACrD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,MACE,IAAI,IAAI,MAAM,eAAe,IAAI,CAAC,WAAW,OAAO,MAAM,CAAC,EAAE,SAAS,KACtE,CAAC,MAAM,eAAe,KAAK,CAAC,WAAW,OAAO,WAAW,kBAAkB,KAC3E,CAAC,MAAM,eAAe,KAAK,CAAC,WAAW,OAAO,WAAW,mBAAmB,KAC5E,CAAC,MAAM,eAAe,KAAK,CAAC,WAAW,OAAO,WAAW,wBAAwB,GACjF;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,WAAW,MAAM,eAAe;AAAA,IACpC,CAAC,WAAW,OAAO,WAAW,MAAM,OAAO;AAAA,EAC7C;AACA,MAAI,CAAC,UAAU;AACb,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH,WAAW,CAAC,SAAS,aAAa,MAAM,iBAAiB,MAAM;AAC7D,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,iCAAiCA,GAC3C,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,QAAQA,GAAE,QAAQ,UAAU;AAAA,EAC5B,aAAaA,GAAE,OAAO,EAAE,KAAK;AAC/B,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8BA,GAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAIM,IAAM,gCAAgCA,GAC1C,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,QAAQA,GAAE,QAAQ,UAAU;AAAA,EAC5B,MAAM;AAAA,EACN,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAClC,kBAAkBA,GAAE,QAAQ,KAAK;AACnC,CAAC,EACA,OAAO;AAGH,IAAM,4BAA4BA,GAAE,mBAAmB,UAAU;AAAA,EACtE;AAAA,EACA;AACF,CAAC;AAGM,IAAM,sBAAsBA,GAChC,OAAO;AAAA,EACN,iBAAiBA,GAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG;AAAA,EAC9C,OAAOA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAK;AAAA,EAC5C,QAAQA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,IAAK;AAAA,EAC7C,KAAKA,GAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG;AAAA,EAClC,UAAUA,GAAE,QAAQ;AAAA,EACpB,YAAYA,GAAE,QAAQ,MAAM;AAAA,EAC5B,YAAYA,GAAE,QAAQ,KAAK,EAAE,SAAS;AACxC,CAAC,EACA,OAAO;AAGH,IAAM,wBAAwBA,GAClC,OAAO;AAAA,EACN,MAAMA,GAAE,QAAQ,iBAAiB;AAAA,EACjC,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,UAAU;AAAA,EACV,OAAO;AAAA,EACP,aAAaA,GACV,OAAO,EACP,IAAI,GAAG,EACP;AAAA,IACC;AAAA,EACF;AACJ,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,QAAQ;AAC3B,MACE,MAAM,SAAS,SAAS,qBACxB,MAAM,SAAS,gBAAgB,eAC/B,MAAM,SAAS,iBAAiB,KAChC,MAAM,SAAS,gBAAgB,6BAC/B,MAAM,SAAS,UAAU,WAAW,oBACpC,MAAM,SAAS,UAAU,kBAAkB,gCAC3C;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,UAAU;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,SAAS,YAAY,UAAU,MAAM,MAAM,SACjD,MAAM,SAAS,YAAY,WAAW,MAAM,MAAM,QAClD;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,OAAO;AAAA,MACd,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,MAAM,gBACN,+CAA+C,MAAM,SAAS,UAAU,QACxE;AACA,QAAI,SAAS;AAAA,MACX,MAAM;AAAA,MACN,MAAM,CAAC,aAAa;AAAA,MACpB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,uCAAuCA,GAAE,KAAK;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAKM,IAAM,wBAAwBA,GAAE,mBAAmB,UAAU;AAAA,EAClEA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,yBAAyB;AAAA,IACzC,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,IACxD,QAAQA,GAAE,QAAQ,OAAO;AAAA,IACzB,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,SAAS;AAAA,EACX,CAAC,EACA,OAAO,EACP,OAAO,CAAC,UAAU,MAAM,QAAQ,gBAAgB,MAAM,aAAa;AAAA,IAClE,MAAM,CAAC,WAAW,aAAa;AAAA,IAC/B,SAAS;AAAA,EACX,CAAC;AAAA,EACHA,GACG,OAAO;AAAA,IACN,MAAMA,GAAE,QAAQ,yBAAyB;AAAA,IACzC,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,IACxD,QAAQ;AAAA,IACR,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,IAC7B,qBAAqBA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK;AAAA,EAClD,CAAC,EACA,OAAO;AACZ,CAAC;AAGM,IAAM,8BAA8BA,GAAE,KAAK;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,kCAAkCA,GAC5C,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,aAAaA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,SAASA,GAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAClC,QAAQ;AAAA,EACR,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,UAAU,sBAAsB,SAAS;AAC3C,CAAC,EACA,OAAO;AAGH,IAAM,8BAA8BA,GACxC,OAAO;AAAA,EACN,eAAeA,GAAE,QAAQ,+BAA+B;AAAA,EACxD,YAAYA,GAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,KAAKA,GAAE,OAAO,EAAE,IAAI,EAAE,IAAI,IAAK;AAAA,EAC/B,WAAWA,GAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAAA,EAC/C,aAAaA,GAAE,QAAQ,WAAW;AAAA,EAClC,WAAWA,GAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,yBAAyB;AAAA,EACpE,QAAQA,GAAE,OAAO,EAAE,MAAM,gBAAgB;AAAA,EACzC,cAAcA,GAAE,QAAQ,OAAO;AACjC,CAAC,EACA,OAAO;","names":["z","z"]}

package/dist/chunk-MRWYRAS5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/slack-bot-scopes.ts"],"sourcesContent":["export const OPENGENI_SLACK_BOT_REQUIRED_SCOPES = [\n  \"app_mentions:read\",\n  \"canvases:read\",\n  \"channels:history\",\n  \"channels:read\",\n  \"chat:write\",\n  \"commands\",\n  \"files:read\",\n  \"groups:history\",\n  \"groups:read\",\n  \"im:history\",\n  \"im:read\",\n  \"im:write\",\n  \"mpim:history\",\n  \"mpim:read\",\n  \"users:read\",\n] as const;\n\n/** Read-only scope needed only for the optional emoji-reaction summon surface. */\nexport const OPENGENI_SLACK_REACTION_REQUIRED_SCOPE = \"reactions:read\" as const;\n\n/**\n * Bot-token search scopes for Slack's Real-time Search API\n * (`assistant.search.context`). Slack accepts these as BOT scopes, so\n * workspace-wide public search runs under the bot identity and never needs a\n * human proxy token. Private-channel, DM, and MPIM search remain user-token\n * only and belong exclusively to the personal hosted-MCP grant.\n */\nexport const OPENGENI_SLACK_BOT_SEARCH_SCOPES = [\n  \"search:read.public\",\n  \"search:read.files\",\n  \"search:read.users\",\n] as const;\n\n/**\n * Scopes requested by the managed and generated self-hosted manifests.\n *\n * `reactions:read` and the bot search scopes are deliberately not part of the\n * base eligibility contract: legacy installations may continue using existing\n * Slack interactions and tools while the reaction setting stays disabled, bot\n * search stays unavailable, and the UI asks an admin to reinstall.\n */\nexport const OPENGENI_SLACK_BOT_REQUESTED_SCOPES = [\n  ...OPENGENI_SLACK_BOT_REQUIRED_SCOPES,\n  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,\n  ...OPENGENI_SLACK_BOT_SEARCH_SCOPES,\n] as const;\n\nexport const OPENGENI_SLACK_BOT_EVENTS = [\n  \"app_home_opened\",\n  \"app_mention\",\n  \"message.channels\",\n  \"message.groups\",\n  \"message.im\",\n  \"message.mpim\",\n  \"reaction_added\",\n] as const;\n\n/** Full user-token scope set for every tool currently exposed by Slack's hosted MCP server. */\nexport const OPENGENI_SLACK_MCP_USER_SCOPES = [\n  \"search:read.public\",\n  \"search:read.private\",\n  \"search:read.mpim\",\n  \"search:read.im\",\n  \"search:read.files\",\n  \"files:read\",\n  \"emoji:read\",\n  \"search:read.users\",\n  \"chat:write\",\n  \"channels:history\",\n  \"groups:history\",\n  \"mpim:history\",\n  \"im:history\",\n  \"channels:write\",\n  \"groups:write\",\n  \"im:write\",\n  \"mpim:write\",\n  \"reactions:write\",\n  \"canvases:read\",\n  \"canvases:write\",\n  \"users:read\",\n  \"users:read.email\",\n  \"channels:read\",\n  \"groups:read\",\n  \"mpim:read\",\n] as const;\n\nexport const OPENGENI_MANAGED_PUBLIC_BASE_URL = \"https://app.opengeni.ai\" as const;\n\nexport type OpenGeniSlackBotManifestOptions = Readonly<{\n  appName?: string;\n  botDisplayName?: string;\n  slashCommand?: string;\n  shortcutName?: string;\n}>;\n\nfunction normalizedSlackManifestText(\n  value: string | undefined,\n  fallback: string,\n  label: string,\n  maxLength: number,\n): string {\n  const normalized = value?.trim() || fallback;\n  if (normalized.length > maxLength || /[\\r\\n\\0]/u.test(normalized)) {\n    throw new Error(`Slack bot manifest ${label} must be at most ${maxLength} plain characters`);\n  }\n  return normalized;\n}\n\nfunction normalizedSlackCommand(value: string | undefined): string {\n  const command = value?.trim() || \"/opengeni\";\n  if (!/^\\/[a-z0-9_-]{1,31}$/u.test(command)) {\n    throw new Error(\n      \"Slack bot manifest slash command must start with / and contain at most 31 lowercase letters, digits, hyphens, or underscores\",\n    );\n  }\n  return command;\n}\n\nfunction normalizedSlackManifestBaseUrl(publicBaseUrl: string): string {\n  const parsed = new URL(publicBaseUrl);\n  if (parsed.protocol !== \"https:\" || parsed.username || parsed.password) {\n    throw new Error(\"Slack bot manifest public base URL must be credential-free HTTPS\");\n  }\n  parsed.hash = \"\";\n  parsed.search = \"\";\n  parsed.pathname = parsed.pathname.replace(/\\/+$/, \"\");\n  return parsed.toString().replace(/\\/$/, \"\");\n}\n\n/** Canonical managed/self-hosted Slack app manifest. Slack accepts JSON manifests. */\nexport function buildOpenGeniSlackBotManifest(\n  publicBaseUrl: string,\n  options: OpenGeniSlackBotManifestOptions = {},\n) {\n  const baseUrl = normalizedSlackManifestBaseUrl(publicBaseUrl);\n  const appName = normalizedSlackManifestText(options.appName, \"OpenGeni\", \"app name\", 35);\n  const botDisplayName = normalizedSlackManifestText(\n    options.botDisplayName,\n    \"OpenGeni\",\n    \"bot display name\",\n    80,\n  );\n  const slashCommand = normalizedSlackCommand(options.slashCommand);\n  const shortcutName = normalizedSlackManifestText(\n    options.shortcutName,\n    \"Open in OpenGeni\",\n    \"shortcut name\",\n    35,\n  );\n  return {\n    display_information: { name: appName },\n    features: {\n      app_home: {\n        home_tab_enabled: true,\n        messages_tab_enabled: true,\n        messages_tab_read_only_enabled: false,\n      },\n      bot_user: { display_name: botDisplayName, always_online: false },\n      slash_commands: [\n        {\n          command: slashCommand,\n          description: \"Start an OpenGeni task in this channel\",\n          should_escape: false,\n          url: `${baseUrl}/v1/integrations/slack/commands`,\n        },\n      ],\n      shortcuts: [\n        {\n          callback_id: \"opengeni_message\",\n          description: \"Start an OpenGeni task from this Slack message\",\n          name: shortcutName,\n          type: \"message\",\n        },\n      ],\n    },\n    oauth_config: {\n      redirect_urls: [\n        `${baseUrl}/v1/integrations/oauth/callback`,\n        `${baseUrl}/v1/integrations/slack/callback`,\n      ],\n      scopes: {\n        bot: [...OPENGENI_SLACK_BOT_REQUESTED_SCOPES],\n        user: [...OPENGENI_SLACK_MCP_USER_SCOPES],\n      },\n    },\n    settings: {\n      event_subscriptions: {\n        bot_events: [...OPENGENI_SLACK_BOT_EVENTS],\n        request_url: `${baseUrl}/v1/integrations/slack/events`,\n      },\n      interactivity: {\n        is_enabled: true,\n        request_url: `${baseUrl}/v1/integrations/slack/interactions`,\n      },\n      is_mcp_enabled: true,\n      org_deploy_enabled: false,\n      socket_mode_enabled: false,\n      token_rotation_enabled: false,\n    },\n  } as const;\n}\n\n/**\n * Optional bot grants that remain inside the shipped bot's read/identity\n * boundary. Every other unrequired scope fails closed, including unknown future\n * Slack scopes, so verification, core routing, and UI eligibility cannot drift.\n */\nexport const OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES = [\n  \"team:read\",\n  OPENGENI_SLACK_REACTION_REQUIRED_SCOPE,\n  ...OPENGENI_SLACK_BOT_SEARCH_SCOPES,\n] as const;\n\nexport function hasOpenGeniSlackBotSearchScopes(grantedScopes: readonly string[]): boolean {\n  return OPENGENI_SLACK_BOT_SEARCH_SCOPES.every((scope) => grantedScopes.includes(scope));\n}\n\n/** @deprecated Use evaluateOpenGeniSlackBotScopes; an allowlist is the policy. */\nexport const OPENGENI_SLACK_BOT_FORBIDDEN_SCOPES = [\"channels:join\", \"chat:write.public\"] as const;\n\nexport type OpenGeniSlackBotScopePolicy = {\n  accepted: boolean;\n  missingRequired: string[];\n  unsupported: string[];\n};\n\nfunction isOpenGeniSlackBotScopeAllowed(scope: string): boolean {\n  return (\n    (OPENGENI_SLACK_BOT_REQUIRED_SCOPES as readonly string[]).includes(scope) ||\n    (OPENGENI_SLACK_BOT_SAFE_OPTIONAL_SCOPES as readonly string[]).includes(scope)\n  );\n}\n\nexport function areOpenGeniSlackBotScopesAccepted(grantedScopes: readonly string[]): boolean {\n  return (\n    OPENGENI_SLACK_BOT_REQUIRED_SCOPES.every((scope) => grantedScopes.includes(scope)) &&\n    grantedScopes.every(isOpenGeniSlackBotScopeAllowed)\n  );\n}\n\nexport function hasOpenGeniSlackReactionScope(grantedScopes: readonly string[]): boolean {\n  return grantedScopes.includes(OPENGENI_SLACK_REACTION_REQUIRED_SCOPE);\n}\n\nexport function evaluateOpenGeniSlackBotScopes(\n  grantedScopes: readonly string[],\n): OpenGeniSlackBotScopePolicy {\n  const granted = new Set(grantedScopes);\n  const missingRequired = OPENGENI_SLACK_BOT_REQUIRED_SCOPES.filter((scope) => !granted.has(scope));\n  const unsupported = [...granted].filter((scope) => !isOpenGeniSlackBotScopeAllowed(scope)).sort();\n  return {\n    accepted: areOpenGeniSlackBotScopesAccepted(grantedScopes),\n    missingRequired,\n    unsupported,\n  };\n}\n"],"mappings":";AAAO,IAAM,qCAAqC;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,yCAAyC;AAS/C,IAAM,mCAAmC;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AACF;AAUO,IAAM,sCAAsC;AAAA,EACjD,GAAG;AAAA,EACH;AAAA,EACA,GAAG;AACL;AAEO,IAAM,4BAA4B;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,IAAM,iCAAiC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,mCAAmC;AAShD,SAAS,4BACP,OACA,UACA,OACA,WACQ;AACR,QAAM,aAAa,OAAO,KAAK,KAAK;AACpC,MAAI,WAAW,SAAS,aAAa,YAAY,KAAK,UAAU,GAAG;AACjE,UAAM,IAAI,MAAM,sBAAsB,KAAK,oBAAoB,SAAS,mBAAmB;AAAA,EAC7F;AACA,SAAO;AACT;AAEA,SAAS,uBAAuB,OAAmC;AACjE,QAAM,UAAU,OAAO,KAAK,KAAK;AACjC,MAAI,CAAC,wBAAwB,KAAK,OAAO,GAAG;AAC1C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,+BAA+B,eAA+B;AACrE,QAAM,SAAS,IAAI,IAAI,aAAa;AACpC,MAAI,OAAO,aAAa,YAAY,OAAO,YAAY,OAAO,UAAU;AACtE,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,SAAO,OAAO;AACd,SAAO,SAAS;AAChB,SAAO,WAAW,OAAO,SAAS,QAAQ,QAAQ,EAAE;AACpD,SAAO,OAAO,SAAS,EAAE,QAAQ,OAAO,EAAE;AAC5C;AAGO,SAAS,8BACd,eACA,UAA2C,CAAC,GAC5C;AACA,QAAM,UAAU,+BAA+B,aAAa;AAC5D,QAAM,UAAU,4BAA4B,QAAQ,SAAS,YAAY,YAAY,EAAE;AACvF,QAAM,iBAAiB;AAAA,IACrB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,eAAe,uBAAuB,QAAQ,YAAY;AAChE,QAAM,eAAe;AAAA,IACnB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,SAAO;AAAA,IACL,qBAAqB,EAAE,MAAM,QAAQ;AAAA,IACrC,UAAU;AAAA,MACR,UAAU;AAAA,QACR,kBAAkB;AAAA,QAClB,sBAAsB;AAAA,QACtB,gCAAgC;AAAA,MAClC;AAAA,MACA,UAAU,EAAE,cAAc,gBAAgB,eAAe,MAAM;AAAA,MAC/D,gBAAgB;AAAA,QACd;AAAA,UACE,SAAS;AAAA,UACT,aAAa;AAAA,UACb,eAAe;AAAA,UACf,KAAK,GAAG,OAAO;AAAA,QACjB;AAAA,MACF;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,aAAa;AAAA,UACb,aAAa;AAAA,UACb,MAAM;AAAA,UACN,MAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,IACA,cAAc;AAAA,MACZ,eAAe;AAAA,QACb,GAAG,OAAO;AAAA,QACV,GAAG,OAAO;AAAA,MACZ;AAAA,MACA,QAAQ;AAAA,QACN,KAAK,CAAC,GAAG,mCAAmC;AAAA,QAC5C,MAAM,CAAC,GAAG,8BAA8B;AAAA,MAC1C;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,qBAAqB;AAAA,QACnB,YAAY,CAAC,GAAG,yBAAyB;AAAA,QACzC,aAAa,GAAG,OAAO;AAAA,MACzB;AAAA,MACA,eAAe;AAAA,QACb,YAAY;AAAA,QACZ,aAAa,GAAG,OAAO;AAAA,MACzB;AAAA,MACA,gBAAgB;AAAA,MAChB,oBAAoB;AAAA,MACpB,qBAAqB;AAAA,MACrB,wBAAwB;AAAA,IAC1B;AAAA,EACF;AACF;AAOO,IAAM,0CAA0C;AAAA,EACrD;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEO,SAAS,gCAAgC,eAA2C;AACzF,SAAO,iCAAiC,MAAM,CAAC,UAAU,cAAc,SAAS,KAAK,CAAC;AACxF;AAGO,IAAM,sCAAsC,CAAC,iBAAiB,mBAAmB;AAQxF,SAAS,+BAA+B,OAAwB;AAC9D,SACG,mCAAyD,SAAS,KAAK,KACvE,wCAA8D,SAAS,KAAK;AAEjF;AAEO,SAAS,kCAAkC,eAA2C;AAC3F,SACE,mCAAmC,MAAM,CAAC,UAAU,cAAc,SAAS,KAAK,CAAC,KACjF,cAAc,MAAM,8BAA8B;AAEtD;AAEO,SAAS,8BAA8B,eAA2C;AACvF,SAAO,cAAc,SAAS,sCAAsC;AACtE;AAEO,SAAS,+BACd,eAC6B;AAC7B,QAAM,UAAU,IAAI,IAAI,aAAa;AACrC,QAAM,kBAAkB,mCAAmC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,KAAK,CAAC;AAChG,QAAM,cAAc,CAAC,GAAG,OAAO,EAAE,OAAO,CAAC,UAAU,CAAC,+BAA+B,KAAK,CAAC,EAAE,KAAK;AAChG,SAAO;AAAA,IACL,UAAU,kCAAkC,aAAa;AAAA,IACzD;AAAA,IACA;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-OVFORMPW.js

@@ -1,348 +0,0 @@
-import {
-  ConnectionKind,
-  ManagedUserResourceGrantMode,
-  SessionTenancyVisibility,
-  UserResourceAuthorityGrant,
-  UserResourceDelegation
-} from "./chunk-QQUJ6NPW.js";
-
-// src/connection-authority.ts
-import { z } from "zod";
-var ConnectionUseAction = z.literal("connection.use");
-var ConnectionAuthorityEnvelope = z.object({
-  scope: z.enum(["workspace", "user"]).default("workspace"),
-  userDelegation: UserResourceDelegation.optional()
-}).strict().superRefine((value, context) => {
-  if (value.scope === "workspace" && value.userDelegation !== void 0) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation"],
-      message: "workspace connections cannot carry user delegation"
-    });
-    return;
-  }
-  if (value.scope === "user" && value.userDelegation === void 0) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation"],
-      message: "user connections require an immutable delegation"
-    });
-    return;
-  }
-  if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation", "action"],
-      message: "connection delegation must use connection.use"
-    });
-  }
-});
-var ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({
-  action: ConnectionUseAction
-}).strict();
-var ConnectionAuthoritySummary = z.object({
-  authorityId: z.string().uuid(),
-  resourceId: z.string().uuid(),
-  originWorkspaceId: z.string().uuid().nullable(),
-  generation: z.number().int().positive(),
-  status: z.enum(["active", "retained", "revoked"]),
-  grants: z.array(ConnectionAuthorityGrant)
-}).strict();
-var ListConnectionAuthoritiesQuery = z.object({
-  scope: z.literal("user"),
-  cursor: z.string().uuid().optional(),
-  limit: z.coerce.number().int().min(1).max(100).default(50)
-}).strict();
-var ListConnectionAuthoritiesResponse = z.object({
-  scope: z.literal("user"),
-  authorities: z.array(ConnectionAuthoritySummary),
-  nextCursor: z.string().uuid().nullable()
-}).strict();
-var IssueConnectionUseGrantRequest = z.object({
-  scope: z.literal("user"),
-  mode: ManagedUserResourceGrantMode,
-  context: SessionTenancyVisibility,
-  sessionId: z.string().uuid().nullable().optional(),
-  expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),
-  workspaceSharedAcknowledged: z.boolean().default(false)
-}).strict().superRefine((value, context) => {
-  if (value.context === "workspace_shared" && !value.workspaceSharedAcknowledged) {
-    context.addIssue({
-      code: "custom",
-      path: ["workspaceSharedAcknowledged"],
-      message: "workspace_shared requires durable shared-output acknowledgement"
-    });
-  }
-  if (value.mode === "always" && (value.sessionId || value.expectedAuthorityEpoch)) {
-    context.addIssue({ code: "custom", path: ["sessionId"], message: "always is unbound" });
-  }
-  if (value.mode === "session" && (!value.sessionId || !value.expectedAuthorityEpoch)) {
-    context.addIssue({
-      code: "custom",
-      path: ["sessionId"],
-      message: "session requires a target session and expectedAuthorityEpoch"
-    });
-  }
-});
-var RevokeConnectionUseGrantQuery = z.object({ scope: z.literal("user") }).strict();
-var ConnectionUseGrantMutationResponse = z.object({
-  scope: z.literal("user"),
-  grant: ConnectionAuthorityGrant
-}).strict();
-var ConnectionUseGrantRevocationResponse = z.object({
-  scope: z.literal("user"),
-  grant: z.object({
-    grantId: z.string().uuid(),
-    generation: z.number().int().positive(),
-    status: z.literal("revoked"),
-    revokedAt: z.string().datetime()
-  }).strict()
-}).strict();
-var ConnectionAuthoritySelectionSource = z.enum([
-  "explicit_workspace",
-  "legacy_workspace_omission",
-  "legacy_user_compatibility",
-  "user_delegation"
-]);
-var ConnectionUseSelectionSource = z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);
-var AcceptedConnectionWork = z.discriminatedUnion("kind", [
-  z.object({
-    kind: z.literal("turn"),
-    turnId: z.string().uuid()
-  }).strict(),
-  z.object({
-    kind: z.literal("scheduled_task"),
-    taskId: z.string().uuid(),
-    taskAuthorityRevision: z.number().int().positive(),
-    runId: z.string().uuid()
-  }).strict()
-]);
-var ConnectionUseAuthoritySnapshot = z.object({
-  organizationId: z.string().uuid(),
-  originWorkspaceId: z.string().uuid(),
-  targetWorkspaceId: z.string().uuid(),
-  targetSessionId: z.string().uuid(),
-  targetSessionVisibility: SessionTenancyVisibility,
-  targetSessionAuthorityEpoch: z.number().int().positive(),
-  acceptedWork: AcceptedConnectionWork,
-  connectionId: z.string().uuid(),
-  connectionGeneration: z.number().int().positive(),
-  connectionStatus: z.literal("active"),
-  providerDomain: z.string().min(1).max(2048),
-  connectionKind: ConnectionKind,
-  scope: z.enum(["workspace", "user", "legacy_user"]),
-  ownerSubjectId: z.string().min(1).max(512).nullable(),
-  ownerOrganizationMembershipId: z.string().uuid().nullable(),
-  ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
-  authoritySource: ConnectionAuthoritySelectionSource,
-  selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
-  userDelegation: UserResourceDelegation.nullable()
-}).strict().superRefine((value, context) => {
-  const ownedBySubject = value.scope !== "workspace";
-  const delegated = value.scope === "user";
-  if (ownedBySubject !== (value.ownerSubjectId !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerSubjectId"],
-      message: "personal connections retain an owner subject"
-    });
-  }
-  if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerOrganizationMembershipId"],
-      message: "only user connections retain an owner membership"
-    });
-  }
-  if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["ownerMembershipAuthorizationRevision"],
-      message: "only user connections retain an owner membership revision"
-    });
-  }
-  if (delegated !== (value.userDelegation !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation"],
-      message: "only user connections retain a delegation"
-    });
-  }
-  if (delegated && value.authoritySource !== "user_delegation") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "user connections require user_delegation provenance"
-    });
-  }
-  if (!delegated && value.authoritySource === "user_delegation") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "non-delegated connections cannot claim user delegation provenance"
-    });
-  }
-  if (value.scope === "legacy_user" && value.authoritySource !== "legacy_user_compatibility") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "legacy user connections require explicit compatibility provenance"
-    });
-  }
-  if (value.scope === "workspace" && value.authoritySource === "legacy_user_compatibility") {
-    context.addIssue({
-      code: "custom",
-      path: ["authoritySource"],
-      message: "workspace connections cannot claim legacy user provenance"
-    });
-  }
-  if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
-    context.addIssue({
-      code: "custom",
-      path: ["originWorkspaceId"],
-      message: "workspace connections must be owned by the target workspace"
-    });
-  }
-  const delegation = value.userDelegation;
-  if (!delegation) return;
-  const exactFacts = [
-    [
-      delegation.organizationId === value.organizationId,
-      ["userDelegation", "organizationId"],
-      "delegation organization mismatch"
-    ],
-    [
-      delegation.workspaceId === value.targetWorkspaceId,
-      ["userDelegation", "workspaceId"],
-      "delegation target workspace mismatch"
-    ],
-    [
-      delegation.action === ConnectionUseAction.value,
-      ["userDelegation", "action"],
-      "delegation action mismatch"
-    ],
-    [
-      delegation.context === value.targetSessionVisibility,
-      ["userDelegation", "context"],
-      "delegation visibility mismatch"
-    ]
-  ];
-  for (const [matches, path, message] of exactFacts) {
-    if (!matches) context.addIssue({ code: "custom", path, message });
-  }
-  if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation", "sessionId"],
-      message: "delegation session mismatch"
-    });
-  }
-  if (delegation.authorityEpoch !== null && delegation.authorityEpoch !== value.targetSessionAuthorityEpoch) {
-    context.addIssue({
-      code: "custom",
-      path: ["userDelegation", "authorityEpoch"],
-      message: "delegation authority epoch mismatch"
-    });
-  }
-});
-var ConnectionUseDenialReason = z.enum([
-  "tenant_mismatch",
-  "workspace_access_inactive",
-  "session_inactive",
-  "session_identity_changed",
-  "session_visibility_changed",
-  "session_authority_epoch_changed",
-  "accepted_attempt_authority_required",
-  "accepted_snapshot_digest_changed",
-  "connection_missing",
-  "connection_identity_changed",
-  "connection_generation_changed",
-  "connection_status_inactive",
-  "connection_owner_changed",
-  "owner_membership_inactive",
-  "authority_missing",
-  "authority_identity_changed",
-  "authority_generation_changed",
-  "authority_status_inactive",
-  "grant_missing",
-  "grant_identity_changed",
-  "grant_generation_changed",
-  "grant_status_inactive",
-  "grant_expired",
-  "grant_already_consumed"
-]);
-var ConnectionUseAttributionFields = z.object({
-  organizationId: z.string().uuid(),
-  workspaceId: z.string().uuid(),
-  sessionId: z.string().uuid(),
-  connectionId: z.string().uuid(),
-  connectionGeneration: z.number().int().positive(),
-  scope: z.enum(["workspace", "user", "legacy_user"]),
-  ownerSubjectId: z.string().min(1).max(512).nullable(),
-  authorityId: z.string().uuid().nullable(),
-  grantId: z.string().uuid().nullable()
-}).strict();
-function refineConnectionUseAttribution(value, context) {
-  const personal = value.scope !== "workspace";
-  for (const field of ["ownerSubjectId"]) {
-    if (personal !== (value[field] !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: [field],
-        message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
-      });
-    }
-  }
-  const delegated = value.scope === "user";
-  for (const field of ["authorityId", "grantId"]) {
-    if (delegated !== (value[field] !== null)) {
-      context.addIssue({
-        code: "custom",
-        path: [field],
-        message: delegated ? `delegated personal attribution requires ${field}` : `non-delegated attribution cannot carry ${field}`
-      });
-    }
-  }
-}
-var ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(
-  refineConnectionUseAttribution
-);
-var ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({
-  outcome: z.enum(["authorized", "denied"]),
-  denialReason: ConnectionUseDenialReason.nullable(),
-  occurredAt: z.string().datetime({ offset: true })
-}).superRefine((value, context) => {
-  refineConnectionUseAttribution(value, context);
-  if (value.outcome === "denied" !== (value.denialReason !== null)) {
-    context.addIssue({
-      code: "custom",
-      path: ["denialReason"],
-      message: "only denied connection use carries a denial reason"
-    });
-  }
-});
-var ConnectionUseAuthorizationResult = z.discriminatedUnion("status", [
-  z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
-  z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
-]);
-
-export {
-  ConnectionUseAction,
-  ConnectionAuthorityEnvelope,
-  ConnectionAuthorityGrant,
-  ConnectionAuthoritySummary,
-  ListConnectionAuthoritiesQuery,
-  ListConnectionAuthoritiesResponse,
-  IssueConnectionUseGrantRequest,
-  RevokeConnectionUseGrantQuery,
-  ConnectionUseGrantMutationResponse,
-  ConnectionUseGrantRevocationResponse,
-  ConnectionAuthoritySelectionSource,
-  ConnectionUseSelectionSource,
-  ConnectionUseAuthoritySnapshot,
-  ConnectionUseDenialReason,
-  ConnectionUseAttribution,
-  ConnectionUseAuditFact,
-  ConnectionUseAuthorizationResult
-};
-//# sourceMappingURL=chunk-OVFORMPW.js.map

package/dist/chunk-OVFORMPW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport {\n  ConnectionKind,\n  ManagedUserResourceGrantMode,\n  SessionTenancyVisibility,\n  UserResourceAuthorityGrant,\n  UserResourceDelegation,\n} from \"./index\";\n\n/** The only generic grant action that authorizes use of a connection. */\nexport const ConnectionUseAction = z.literal(\"connection.use\");\nexport type ConnectionUseAction = z.infer<typeof ConnectionUseAction>;\n\n/**\n * Connection authority is either workspace-owned or user-owned. Omission is\n * intentionally compatible with the historical workspace connection path.\n */\nexport const ConnectionAuthorityEnvelope = z\n  .object({\n    scope: z.enum([\"workspace\", \"user\"]).default(\"workspace\"),\n    userDelegation: UserResourceDelegation.optional(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.scope === \"workspace\" && value.userDelegation !== undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"workspace connections cannot carry user delegation\",\n      });\n      return;\n    }\n    if (value.scope === \"user\" && value.userDelegation === undefined) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"user connections require an immutable delegation\",\n      });\n      return;\n    }\n    if (value.userDelegation && value.userDelegation.action !== ConnectionUseAction.value) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"action\"],\n        message: \"connection delegation must use connection.use\",\n      });\n    }\n  });\nexport type ConnectionAuthorityEnvelope = z.infer<typeof ConnectionAuthorityEnvelope>;\n\nexport const ConnectionAuthorityGrant = UserResourceAuthorityGrant.extend({\n  action: ConnectionUseAction,\n}).strict();\nexport type ConnectionAuthorityGrant = z.infer<typeof ConnectionAuthorityGrant>;\n\n/** Owner-only opaque projection; connection identity and owner metadata stay server-side. */\nexport const ConnectionAuthoritySummary = z\n  .object({\n    authorityId: z.string().uuid(),\n    resourceId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid().nullable(),\n    generation: z.number().int().positive(),\n    status: z.enum([\"active\", \"retained\", \"revoked\"]),\n    grants: z.array(ConnectionAuthorityGrant),\n  })\n  .strict();\nexport type ConnectionAuthoritySummary = z.infer<typeof ConnectionAuthoritySummary>;\n\nexport const ListConnectionAuthoritiesQuery = z\n  .object({\n    scope: z.literal(\"user\"),\n    cursor: z.string().uuid().optional(),\n    limit: z.coerce.number().int().min(1).max(100).default(50),\n  })\n  .strict();\nexport const ListConnectionAuthoritiesResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    authorities: z.array(ConnectionAuthoritySummary),\n    nextCursor: z.string().uuid().nullable(),\n  })\n  .strict();\n\nexport const IssueConnectionUseGrantRequest = z\n  .object({\n    scope: z.literal(\"user\"),\n    mode: ManagedUserResourceGrantMode,\n    context: SessionTenancyVisibility,\n    sessionId: z.string().uuid().nullable().optional(),\n    expectedAuthorityEpoch: z.number().int().positive().nullable().optional(),\n    workspaceSharedAcknowledged: z.boolean().default(false),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    if (value.context === \"workspace_shared\" && !value.workspaceSharedAcknowledged) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"workspaceSharedAcknowledged\"],\n        message: \"workspace_shared requires durable shared-output acknowledgement\",\n      });\n    }\n    if (value.mode === \"always\" && (value.sessionId || value.expectedAuthorityEpoch)) {\n      context.addIssue({ code: \"custom\", path: [\"sessionId\"], message: \"always is unbound\" });\n    }\n    if (value.mode === \"session\" && (!value.sessionId || !value.expectedAuthorityEpoch)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"sessionId\"],\n        message: \"session requires a target session and expectedAuthorityEpoch\",\n      });\n    }\n  });\nexport type IssueConnectionUseGrantRequest = z.infer<typeof IssueConnectionUseGrantRequest>;\n\nexport const RevokeConnectionUseGrantQuery = z.object({ scope: z.literal(\"user\") }).strict();\n\nexport const ConnectionUseGrantMutationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: ConnectionAuthorityGrant,\n  })\n  .strict();\nexport type ConnectionUseGrantMutationResponse = z.infer<typeof ConnectionUseGrantMutationResponse>;\n\nexport const ConnectionUseGrantRevocationResponse = z\n  .object({\n    scope: z.literal(\"user\"),\n    grant: z\n      .object({\n        grantId: z.string().uuid(),\n        generation: z.number().int().positive(),\n        status: z.literal(\"revoked\"),\n        revokedAt: z.string().datetime(),\n      })\n      .strict(),\n  })\n  .strict();\nexport type ConnectionUseGrantRevocationResponse = z.infer<\n  typeof ConnectionUseGrantRevocationResponse\n>;\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\n  \"explicit_workspace\",\n  \"legacy_workspace_omission\",\n  \"legacy_user_compatibility\",\n  \"user_delegation\",\n]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n  .string()\n  .min(1)\n  .max(128)\n  .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n  z\n    .object({\n      kind: z.literal(\"turn\"),\n      turnId: z.string().uuid(),\n    })\n    .strict(),\n  z\n    .object({\n      kind: z.literal(\"scheduled_task\"),\n      taskId: z.string().uuid(),\n      taskAuthorityRevision: z.number().int().positive(),\n      runId: z.string().uuid(),\n    })\n    .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n  .object({\n    organizationId: z.string().uuid(),\n    originWorkspaceId: z.string().uuid(),\n    targetWorkspaceId: z.string().uuid(),\n    targetSessionId: z.string().uuid(),\n    targetSessionVisibility: SessionTenancyVisibility,\n    targetSessionAuthorityEpoch: z.number().int().positive(),\n    acceptedWork: AcceptedConnectionWork,\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    connectionStatus: z.literal(\"active\"),\n    providerDomain: z.string().min(1).max(2048),\n    connectionKind: ConnectionKind,\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    ownerOrganizationMembershipId: z.string().uuid().nullable(),\n    ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n    authoritySource: ConnectionAuthoritySelectionSource,\n    selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n    userDelegation: UserResourceDelegation.nullable(),\n  })\n  .strict()\n  .superRefine((value, context) => {\n    const ownedBySubject = value.scope !== \"workspace\";\n    const delegated = value.scope === \"user\";\n    if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerSubjectId\"],\n        message: \"personal connections retain an owner subject\",\n      });\n    }\n    if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerOrganizationMembershipId\"],\n        message: \"only user connections retain an owner membership\",\n      });\n    }\n    if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"ownerMembershipAuthorizationRevision\"],\n        message: \"only user connections retain an owner membership revision\",\n      });\n    }\n    if (delegated !== (value.userDelegation !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\"],\n        message: \"only user connections retain a delegation\",\n      });\n    }\n    if (delegated && value.authoritySource !== \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"user connections require user_delegation provenance\",\n      });\n    }\n    if (!delegated && value.authoritySource === \"user_delegation\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"non-delegated connections cannot claim user delegation provenance\",\n      });\n    }\n    if (value.scope === \"legacy_user\" && value.authoritySource !== \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"legacy user connections require explicit compatibility provenance\",\n      });\n    }\n    if (value.scope === \"workspace\" && value.authoritySource === \"legacy_user_compatibility\") {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"authoritySource\"],\n        message: \"workspace connections cannot claim legacy user provenance\",\n      });\n    }\n    if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"originWorkspaceId\"],\n        message: \"workspace connections must be owned by the target workspace\",\n      });\n    }\n    const delegation = value.userDelegation;\n    if (!delegation) return;\n    const exactFacts: Array<[boolean, (string | number)[], string]> = [\n      [\n        delegation.organizationId === value.organizationId,\n        [\"userDelegation\", \"organizationId\"],\n        \"delegation organization mismatch\",\n      ],\n      [\n        delegation.workspaceId === value.targetWorkspaceId,\n        [\"userDelegation\", \"workspaceId\"],\n        \"delegation target workspace mismatch\",\n      ],\n      [\n        delegation.action === ConnectionUseAction.value,\n        [\"userDelegation\", \"action\"],\n        \"delegation action mismatch\",\n      ],\n      [\n        delegation.context === value.targetSessionVisibility,\n        [\"userDelegation\", \"context\"],\n        \"delegation visibility mismatch\",\n      ],\n    ];\n    for (const [matches, path, message] of exactFacts) {\n      if (!matches) context.addIssue({ code: \"custom\", path, message });\n    }\n    if (delegation.sessionId !== null && delegation.sessionId !== value.targetSessionId) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"sessionId\"],\n        message: \"delegation session mismatch\",\n      });\n    }\n    if (\n      delegation.authorityEpoch !== null &&\n      delegation.authorityEpoch !== value.targetSessionAuthorityEpoch\n    ) {\n      context.addIssue({\n        code: \"custom\",\n        path: [\"userDelegation\", \"authorityEpoch\"],\n        message: \"delegation authority epoch mismatch\",\n      });\n    }\n  });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n  \"tenant_mismatch\",\n  \"workspace_access_inactive\",\n  \"session_inactive\",\n  \"session_identity_changed\",\n  \"session_visibility_changed\",\n  \"session_authority_epoch_changed\",\n  \"accepted_attempt_authority_required\",\n  \"accepted_snapshot_digest_changed\",\n  \"connection_missing\",\n  \"connection_identity_changed\",\n  \"connection_generation_changed\",\n  \"connection_status_inactive\",\n  \"connection_owner_changed\",\n  \"owner_membership_inactive\",\n  \"authority_missing\",\n  \"authority_identity_changed\",\n  \"authority_generation_changed\",\n  \"authority_status_inactive\",\n  \"grant_missing\",\n  \"grant_identity_changed\",\n  \"grant_generation_changed\",\n  \"grant_status_inactive\",\n  \"grant_expired\",\n  \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n  .object({\n    organizationId: z.string().uuid(),\n    workspaceId: z.string().uuid(),\n    sessionId: z.string().uuid(),\n    connectionId: z.string().uuid(),\n    connectionGeneration: z.number().int().positive(),\n    scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n    ownerSubjectId: z.string().min(1).max(512).nullable(),\n    authorityId: z.string().uuid().nullable(),\n    grantId: z.string().uuid().nullable(),\n  })\n  .strict();\n\nfunction refineConnectionUseAttribution(\n  value: z.infer<typeof ConnectionUseAttributionFields>,\n  context: z.RefinementCtx,\n): void {\n  const personal = value.scope !== \"workspace\";\n  for (const field of [\"ownerSubjectId\"] as const) {\n    if (personal !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: personal\n          ? `personal attribution requires ${field}`\n          : `workspace attribution cannot carry ${field}`,\n      });\n    }\n  }\n  const delegated = value.scope === \"user\";\n  for (const field of [\"authorityId\", \"grantId\"] as const) {\n    if (delegated !== (value[field] !== null)) {\n      context.addIssue({\n        code: \"custom\",\n        path: [field],\n        message: delegated\n          ? `delegated personal attribution requires ${field}`\n          : `non-delegated attribution cannot carry ${field}`,\n      });\n    }\n  }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.superRefine(\n  refineConnectionUseAttribution,\n);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n  outcome: z.enum([\"authorized\", \"denied\"]),\n  denialReason: ConnectionUseDenialReason.nullable(),\n  occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n  refineConnectionUseAttribution(value, context);\n  if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n    context.addIssue({\n      code: \"custom\",\n      path: [\"denialReason\"],\n      message: \"only denied connection use carries a denial reason\",\n    });\n  }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n  z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n  z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;;;;AAAA,SAAS,SAAS;AAUX,IAAM,sBAAsB,EAAE,QAAQ,gBAAgB;AAOtD,IAAM,8BAA8B,EACxC,OAAO;AAAA,EACN,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC,EAAE,QAAQ,WAAW;AAAA,EACxD,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,UAAU,eAAe,MAAM,mBAAmB,QAAW;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,UAAU,UAAU,MAAM,mBAAmB,QAAW;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AACD;AAAA,EACF;AACA,MAAI,MAAM,kBAAkB,MAAM,eAAe,WAAW,oBAAoB,OAAO;AACrF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,QAAQ;AAAA,MACjC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,2BAA2B,2BAA2B,OAAO;AAAA,EACxE,QAAQ;AACV,CAAC,EAAE,OAAO;AAIH,IAAM,6BAA6B,EACvC,OAAO;AAAA,EACN,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,YAAY,EAAE,OAAO,EAAE,KAAK;AAAA,EAC5B,mBAAmB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC9C,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACtC,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,SAAS,CAAC;AAAA,EAChD,QAAQ,EAAE,MAAM,wBAAwB;AAC1C,CAAC,EACA,OAAO;AAGH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACnC,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAC3D,CAAC,EACA,OAAO;AACH,IAAM,oCAAoC,EAC9C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,aAAa,EAAE,MAAM,0BAA0B;AAAA,EAC/C,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACzC,CAAC,EACA,OAAO;AAEH,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,MAAM;AAAA,EACN,SAAS;AAAA,EACT,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACjD,wBAAwB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAAA,EACxE,6BAA6B,EAAE,QAAQ,EAAE,QAAQ,KAAK;AACxD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,MAAI,MAAM,YAAY,sBAAsB,CAAC,MAAM,6BAA6B;AAC9E,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,6BAA6B;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,SAAS,aAAa,MAAM,aAAa,MAAM,yBAAyB;AAChF,YAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,CAAC,WAAW,GAAG,SAAS,oBAAoB,CAAC;AAAA,EACxF;AACA,MAAI,MAAM,SAAS,cAAc,CAAC,MAAM,aAAa,CAAC,MAAM,yBAAyB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,WAAW;AAAA,MAClB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,gCAAgC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,MAAM,EAAE,CAAC,EAAE,OAAO;AAEpF,IAAM,qCAAqC,EAC/C,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO;AACT,CAAC,EACA,OAAO;AAGH,IAAM,uCAAuC,EACjD,OAAO;AAAA,EACN,OAAO,EAAE,QAAQ,MAAM;AAAA,EACvB,OAAO,EACJ,OAAO;AAAA,IACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,IACzB,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACtC,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,OAAO;AACZ,CAAC,EACA,OAAO;AAKH,IAAM,qCAAqC,EAAE,KAAK;AAAA,EACvD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGM,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,uBAAuB,SAAS;AAClD,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,mBAAmB,OAAO;AACjD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,mBAAmB;AAC5D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,mBAAmB;AAC7D,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,iBAAiB,MAAM,oBAAoB,6BAA6B;AAC1F,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,MAAM,UAAU,eAAe,MAAM,oBAAoB,6BAA6B;AACxF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,aAAa,MAAM;AACzB,MAAI,CAAC,WAAY;AACjB,QAAM,aAA4D;AAAA,IAChE;AAAA,MACE,WAAW,mBAAmB,MAAM;AAAA,MACpC,CAAC,kBAAkB,gBAAgB;AAAA,MACnC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,gBAAgB,MAAM;AAAA,MACjC,CAAC,kBAAkB,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,WAAW,oBAAoB;AAAA,MAC1C,CAAC,kBAAkB,QAAQ;AAAA,MAC3B;AAAA,IACF;AAAA,IACA;AAAA,MACE,WAAW,YAAY,MAAM;AAAA,MAC7B,CAAC,kBAAkB,SAAS;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,SAAS,MAAM,OAAO,KAAK,YAAY;AACjD,QAAI,CAAC,QAAS,SAAQ,SAAS,EAAE,MAAM,UAAU,MAAM,QAAQ,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,cAAc,QAAQ,WAAW,cAAc,MAAM,iBAAiB;AACnF,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,WAAW;AAAA,MACpC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MACE,WAAW,mBAAmB,QAC9B,WAAW,mBAAmB,MAAM,6BACpC;AACA,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,kBAAkB,gBAAgB;AAAA,MACzC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,YAAY,MAAM,UAAU;AAClC,aAAW,SAAS,CAAC,eAAe,SAAS,GAAY;AACvD,QAAI,eAAe,MAAM,KAAK,MAAM,OAAO;AACzC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,YACL,2CAA2C,KAAK,KAChD,0CAA0C,KAAK;AAAA,MACrD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAGO,IAAM,2BAA2B,+BAA+B;AAAA,EACrE;AACF;AAGO,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}

package/dist/chunk-P3HLDT77.js

@@ -1,59 +0,0 @@
-// src/permissions.ts
-import { z } from "zod";
-var Permission = z.enum([
-  "account:read",
-  "account:admin",
-  "members:manage",
-  "workspace:create",
-  "billing:read",
-  "billing:manage",
-  "workspace:read",
-  "workspace:admin",
-  "sessions:create",
-  "sessions:read",
-  "sessions:control",
-  "stream:view",
-  "stream:control",
-  "stream:acknowledge",
-  "files:upload",
-  "files:read",
-  "files:write",
-  "terminal:attach",
-  "documents:manage",
-  "documents:search",
-  "scheduled_tasks:manage",
-  "scheduled_tasks:run",
-  "github:manage",
-  "github:use",
-  "api_keys:manage",
-  "connections:read",
-  "connections:write",
-  "capabilities:manage",
-  /** @deprecated alias of variable-sets:manage */
-  "environments:manage",
-  /** @deprecated alias of variable-sets:use */
-  "environments:use",
-  "variable-sets:list",
-  "variable-sets:read",
-  "variable-sets:write",
-  "variable-sets:manage",
-  "variable-sets:attach",
-  "variable-sets:use",
-  "secrets:list",
-  "secrets:read",
-  "secrets:write",
-  "mcp_servers:attach",
-  "codemode:call",
-  "goals:manage",
-  "enrollments:read",
-  "enrollments:manage",
-  "rigs:use",
-  "rigs:manage",
-  "artifacts:read",
-  "artifacts:publish"
-]);
-
-export {
-  Permission
-};
-//# sourceMappingURL=chunk-P3HLDT77.js.map

package/dist/chunk-P3HLDT77.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/permissions.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/** Canonical public permission vocabulary shared by operational and control-plane contracts. */\nexport const Permission = z.enum([\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  \"stream:view\",\n  \"stream:control\",\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  \"files:write\",\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  \"capabilities:manage\",\n  /** @deprecated alias of variable-sets:manage */\n  \"environments:manage\",\n  /** @deprecated alias of variable-sets:use */\n  \"environments:use\",\n  \"variable-sets:list\",\n  \"variable-sets:read\",\n  \"variable-sets:write\",\n  \"variable-sets:manage\",\n  \"variable-sets:attach\",\n  \"variable-sets:use\",\n  \"secrets:list\",\n  \"secrets:read\",\n  \"secrets:write\",\n  \"mcp_servers:attach\",\n  \"codemode:call\",\n  \"goals:manage\",\n  \"enrollments:read\",\n  \"enrollments:manage\",\n  \"rigs:use\",\n  \"rigs:manage\",\n  \"artifacts:read\",\n  \"artifacts:publish\",\n]);\nexport type Permission = z.infer<typeof Permission>;\n"],"mappings":";AAAA,SAAS,SAAS;AAGX,IAAM,aAAa,EAAE,KAAK;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;","names":[]}