@opengeni/contracts 4.1.0 → 5.0.0-canary.35625901699001
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/atlassian.d.ts +1 -0
- package/dist/atlassian.js +4 -4
- package/dist/bundled-skills.d.ts +5 -1
- package/dist/{chunk-O5LEQHDM.js → chunk-ENJTPHKP.js} +2 -2
- package/dist/chunk-H6YF3MTS.js +186 -0
- package/dist/chunk-H6YF3MTS.js.map +1 -0
- package/dist/{chunk-HR6NB3CA.js → chunk-KEYW3PCG.js} +8350 -8209
- package/dist/chunk-KEYW3PCG.js.map +1 -0
- package/dist/{chunk-5LYFSZ7O.js → chunk-YJEOWXOE.js} +8 -8
- package/dist/company-profile.d.ts +9 -6
- package/dist/connect.js +4 -4
- package/dist/connection-authority.d.ts +9 -317
- package/dist/connection-authority.js +7 -27
- package/dist/connector-tool-permissions.d.ts +73 -0
- package/dist/editable-artifact-codec-registry.js +2 -2
- package/dist/editable-artifact-live.js +2 -2
- package/dist/editable-artifact-serialized-commit.js +3 -3
- package/dist/editable-artifacts.js +13 -13
- package/dist/google-drive.d.ts +1 -0
- package/dist/google-drive.js +4 -4
- package/dist/host-mcp-bindings.d.ts +5 -0
- package/dist/host-mcp-bindings.js +34 -8
- package/dist/host-mcp-bindings.js.map +1 -1
- package/dist/index.d.ts +771 -3222
- package/dist/index.js +123 -75
- package/dist/knowledge-entries.d.ts +33 -0
- package/dist/knowledge-preparation.d.ts +207 -0
- package/dist/managed-sign-in-methods.d.ts +56 -0
- package/dist/managed-sign-in-methods.js +46 -0
- package/dist/managed-sign-in-methods.js.map +1 -0
- package/dist/mcp-oauth.d.ts +2 -2
- package/dist/organization-integration-policy.d.ts +27 -0
- package/dist/organization-usage.d.ts +102 -0
- package/dist/personal-github.d.ts +1 -0
- package/dist/personal-github.js +4 -4
- package/dist/remember.d.ts +6 -4
- package/dist/sandbox-provider-command.d.ts +91 -1
- package/dist/sandbox-recovery.d.ts +101 -0
- package/dist/session-goal-reports.d.ts +21 -0
- package/dist/session-message-search.d.ts +68 -0
- package/dist/skill-catalog-context.d.ts +7 -0
- package/dist/skill-files.d.ts +1 -1
- package/dist/skills.d.ts +15 -0
- package/dist/tool-catalog.d.ts +7 -0
- package/package.json +4 -4
- package/src/bundled-skills.ts +2 -0
- package/src/connection-authority.ts +25 -225
- package/src/connector-tool-permissions.ts +59 -0
- package/src/host-mcp-bindings.ts +37 -5
- package/src/index.ts +418 -761
- package/src/knowledge-entries.ts +4 -0
- package/src/knowledge-preparation.ts +50 -0
- package/src/managed-sign-in-methods.ts +37 -0
- package/src/mcp-oauth.ts +16 -18
- package/src/organization-integration-policy.ts +54 -0
- package/src/organization-usage.ts +45 -0
- package/src/sandbox-provider-command.ts +57 -1
- package/src/sandbox-recovery.ts +61 -0
- package/src/session-goal-reports.ts +45 -0
- package/src/session-message-search.ts +54 -0
- package/src/skill-catalog-context.ts +50 -0
- package/src/skill-files.ts +3 -3
- package/src/skills.ts +21 -6
- package/src/tool-catalog.ts +10 -0
- package/dist/chunk-HR6NB3CA.js.map +0 -1
- package/dist/chunk-J6QIYKO5.js +0 -348
- package/dist/chunk-J6QIYKO5.js.map +0 -1
- package/dist/host-mcp-resolvers.d.ts +0 -32
- package/dist/host-mcp-resolvers.js +0 -34
- package/dist/host-mcp-resolvers.js.map +0 -1
- package/src/host-mcp-resolvers.ts +0 -50
- /package/dist/{chunk-O5LEQHDM.js.map → chunk-ENJTPHKP.js.map} +0 -0
- /package/dist/{chunk-5LYFSZ7O.js.map → chunk-YJEOWXOE.js.map} +0 -0
package/dist/atlassian.d.ts
CHANGED
|
@@ -181,6 +181,7 @@ export declare const AtlassianBrowseResponse: z.ZodObject<{
|
|
|
181
181
|
connection: z.ZodLazy<z.ZodObject<{
|
|
182
182
|
id: z.ZodString;
|
|
183
183
|
authorityId: z.ZodOptional<z.ZodString>;
|
|
184
|
+
connectionAuthorityGeneration: z.ZodOptional<z.ZodNumber>;
|
|
184
185
|
accountId: z.ZodString;
|
|
185
186
|
workspaceId: z.ZodString;
|
|
186
187
|
subjectId: z.ZodNullable<z.ZodString>;
|
package/dist/atlassian.js
CHANGED
|
@@ -17,9 +17,9 @@ import {
|
|
|
17
17
|
AtlassianSyncCadence,
|
|
18
18
|
SaveAtlassianSourcesRequest,
|
|
19
19
|
atlassianScopesAllowRead
|
|
20
|
-
} from "./chunk-
|
|
20
|
+
} from "./chunk-KEYW3PCG.js";
|
|
21
21
|
import "./chunk-YBW5JSA3.js";
|
|
22
|
-
import "./chunk-
|
|
22
|
+
import "./chunk-ENJTPHKP.js";
|
|
23
23
|
import "./chunk-GRG7PHWQ.js";
|
|
24
24
|
import "./chunk-RKX3NQYS.js";
|
|
25
25
|
import "./chunk-MRWYRAS5.js";
|
|
@@ -29,10 +29,10 @@ import "./chunk-YRKRZ6OF.js";
|
|
|
29
29
|
import "./chunk-JUFK3T4Q.js";
|
|
30
30
|
import "./chunk-M5ZGRVIQ.js";
|
|
31
31
|
import "./chunk-BCS7WHCK.js";
|
|
32
|
-
import "./chunk-
|
|
32
|
+
import "./chunk-YJEOWXOE.js";
|
|
33
33
|
import "./chunk-Y3KNXVTD.js";
|
|
34
|
-
import "./chunk-D2HKF2EF.js";
|
|
35
34
|
import "./chunk-TXTQIYCV.js";
|
|
35
|
+
import "./chunk-D2HKF2EF.js";
|
|
36
36
|
import "./chunk-RIY7GYQS.js";
|
|
37
37
|
import "./chunk-MYBZRDTY.js";
|
|
38
38
|
import "./chunk-PX3VCKAU.js";
|
package/dist/bundled-skills.d.ts
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
2
|
export declare const BundledSkillId: z.ZodEnum<{
|
|
3
3
|
"builtin:document-parsing": "builtin:document-parsing";
|
|
4
|
+
"builtin:opengeni-client": "builtin:opengeni-client";
|
|
4
5
|
"builtin:opengeni-documents": "builtin:opengeni-documents";
|
|
6
|
+
"builtin:opengeni-help": "builtin:opengeni-help";
|
|
5
7
|
"builtin:opengeni-presentations": "builtin:opengeni-presentations";
|
|
6
8
|
"builtin:opengeni-projects": "builtin:opengeni-projects";
|
|
7
9
|
"builtin:opengeni-sites": "builtin:opengeni-sites";
|
|
@@ -13,7 +15,9 @@ export declare const BundledSkillId: z.ZodEnum<{
|
|
|
13
15
|
export type BundledSkillId = z.infer<typeof BundledSkillId>;
|
|
14
16
|
export declare const BundledSkillSelection: z.ZodPipe<z.ZodArray<z.ZodEnum<{
|
|
15
17
|
"builtin:document-parsing": "builtin:document-parsing";
|
|
18
|
+
"builtin:opengeni-client": "builtin:opengeni-client";
|
|
16
19
|
"builtin:opengeni-documents": "builtin:opengeni-documents";
|
|
20
|
+
"builtin:opengeni-help": "builtin:opengeni-help";
|
|
17
21
|
"builtin:opengeni-presentations": "builtin:opengeni-presentations";
|
|
18
22
|
"builtin:opengeni-projects": "builtin:opengeni-projects";
|
|
19
23
|
"builtin:opengeni-sites": "builtin:opengeni-sites";
|
|
@@ -21,7 +25,7 @@ export declare const BundledSkillSelection: z.ZodPipe<z.ZodArray<z.ZodEnum<{
|
|
|
21
25
|
"builtin:opengeni-spreadsheets": "builtin:opengeni-spreadsheets";
|
|
22
26
|
"builtin:opengeni-video-generation": "builtin:opengeni-video-generation";
|
|
23
27
|
"builtin:opengeni-visualize": "builtin:opengeni-visualize";
|
|
24
|
-
}>>, z.ZodTransform<("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[], ("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[]>>;
|
|
28
|
+
}>>, z.ZodTransform<("builtin:document-parsing" | "builtin:opengeni-client" | "builtin:opengeni-documents" | "builtin:opengeni-help" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[], ("builtin:document-parsing" | "builtin:opengeni-client" | "builtin:opengeni-documents" | "builtin:opengeni-help" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[]>>;
|
|
25
29
|
/** Undefined is defaults/inheritance; an explicit empty list disables bundles. */
|
|
26
30
|
export declare function resolveBundledSkillSelection(requested: readonly BundledSkillId[] | undefined, parent: readonly BundledSkillId[] | undefined): BundledSkillId[] | undefined;
|
|
27
31
|
export declare function withBundledSkillSelectionMetadata(metadata: Record<string, unknown>, ids: readonly BundledSkillId[] | undefined): Record<string, unknown>;
|
|
@@ -6,7 +6,7 @@ import {
|
|
|
6
6
|
} from "./chunk-NVJMJWLL.js";
|
|
7
7
|
import {
|
|
8
8
|
editableArtifactCodecFor
|
|
9
|
-
} from "./chunk-
|
|
9
|
+
} from "./chunk-YJEOWXOE.js";
|
|
10
10
|
import {
|
|
11
11
|
DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,
|
|
12
12
|
DOCUMENT_ARTIFACT_MAX_STRUCTURAL_COUNTER
|
|
@@ -380,4 +380,4 @@ export {
|
|
|
380
380
|
decodeEditableArtifactSerializedCommit,
|
|
381
381
|
assertCanonicalEditableArtifactSerializedCommit
|
|
382
382
|
};
|
|
383
|
-
//# sourceMappingURL=chunk-
|
|
383
|
+
//# sourceMappingURL=chunk-ENJTPHKP.js.map
|
|
@@ -0,0 +1,186 @@
|
|
|
1
|
+
import {
|
|
2
|
+
ConnectionKind,
|
|
3
|
+
SessionTenancyVisibility
|
|
4
|
+
} from "./chunk-KEYW3PCG.js";
|
|
5
|
+
|
|
6
|
+
// src/connection-authority.ts
|
|
7
|
+
import { z } from "zod";
|
|
8
|
+
var ConnectionAuthoritySelectionSource = z.enum(["explicit_workspace", "sender"]);
|
|
9
|
+
var ConnectionUseSelectionSource = z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);
|
|
10
|
+
var AcceptedConnectionWork = z.discriminatedUnion("kind", [
|
|
11
|
+
z.object({
|
|
12
|
+
kind: z.literal("turn"),
|
|
13
|
+
turnId: z.string().uuid()
|
|
14
|
+
}).strict(),
|
|
15
|
+
z.object({
|
|
16
|
+
kind: z.literal("scheduled_task"),
|
|
17
|
+
taskId: z.string().uuid(),
|
|
18
|
+
taskAuthorityRevision: z.number().int().positive(),
|
|
19
|
+
runId: z.string().uuid()
|
|
20
|
+
}).strict()
|
|
21
|
+
]);
|
|
22
|
+
var ConnectionUseAuthoritySnapshot = z.object({
|
|
23
|
+
organizationId: z.string().uuid(),
|
|
24
|
+
originWorkspaceId: z.string().uuid(),
|
|
25
|
+
targetWorkspaceId: z.string().uuid(),
|
|
26
|
+
targetSessionId: z.string().uuid(),
|
|
27
|
+
targetSessionVisibility: SessionTenancyVisibility,
|
|
28
|
+
targetSessionAuthorityEpoch: z.number().int().positive(),
|
|
29
|
+
acceptedWork: AcceptedConnectionWork,
|
|
30
|
+
connectionId: z.string().uuid(),
|
|
31
|
+
connectionGeneration: z.number().int().positive(),
|
|
32
|
+
connectionStatus: z.literal("active"),
|
|
33
|
+
providerDomain: z.string().min(1).max(2048),
|
|
34
|
+
connectionKind: ConnectionKind,
|
|
35
|
+
scope: z.enum(["workspace", "user"]),
|
|
36
|
+
ownerSubjectId: z.string().min(1).max(512).nullable(),
|
|
37
|
+
ownerOrganizationMembershipId: z.string().uuid().nullable(),
|
|
38
|
+
ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
|
|
39
|
+
authoritySource: ConnectionAuthoritySelectionSource,
|
|
40
|
+
selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
|
|
41
|
+
userDelegation: z.null()
|
|
42
|
+
}).strict().superRefine((value, context) => {
|
|
43
|
+
const ownedBySubject = value.scope !== "workspace";
|
|
44
|
+
const delegated = value.scope === "user";
|
|
45
|
+
if (ownedBySubject !== (value.ownerSubjectId !== null)) {
|
|
46
|
+
context.addIssue({
|
|
47
|
+
code: "custom",
|
|
48
|
+
path: ["ownerSubjectId"],
|
|
49
|
+
message: "personal connections retain an owner subject"
|
|
50
|
+
});
|
|
51
|
+
}
|
|
52
|
+
if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
|
|
53
|
+
context.addIssue({
|
|
54
|
+
code: "custom",
|
|
55
|
+
path: ["ownerOrganizationMembershipId"],
|
|
56
|
+
message: "only user connections retain an owner membership"
|
|
57
|
+
});
|
|
58
|
+
}
|
|
59
|
+
if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
|
|
60
|
+
context.addIssue({
|
|
61
|
+
code: "custom",
|
|
62
|
+
path: ["ownerMembershipAuthorizationRevision"],
|
|
63
|
+
message: "only user connections retain an owner membership revision"
|
|
64
|
+
});
|
|
65
|
+
}
|
|
66
|
+
if (delegated && value.authoritySource !== "sender") {
|
|
67
|
+
context.addIssue({
|
|
68
|
+
code: "custom",
|
|
69
|
+
path: ["authoritySource"],
|
|
70
|
+
message: "user connections require authenticated sender provenance"
|
|
71
|
+
});
|
|
72
|
+
}
|
|
73
|
+
if (!delegated && value.authoritySource === "sender") {
|
|
74
|
+
context.addIssue({
|
|
75
|
+
code: "custom",
|
|
76
|
+
path: ["authoritySource"],
|
|
77
|
+
message: "workspace connections cannot claim sender provenance"
|
|
78
|
+
});
|
|
79
|
+
}
|
|
80
|
+
if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
|
|
81
|
+
context.addIssue({
|
|
82
|
+
code: "custom",
|
|
83
|
+
path: ["originWorkspaceId"],
|
|
84
|
+
message: "workspace connections must be owned by the target workspace"
|
|
85
|
+
});
|
|
86
|
+
}
|
|
87
|
+
});
|
|
88
|
+
var ConnectionUseDenialReason = z.enum([
|
|
89
|
+
"tenant_mismatch",
|
|
90
|
+
"workspace_access_inactive",
|
|
91
|
+
"session_inactive",
|
|
92
|
+
"session_identity_changed",
|
|
93
|
+
"session_visibility_changed",
|
|
94
|
+
"session_authority_epoch_changed",
|
|
95
|
+
"accepted_attempt_authority_required",
|
|
96
|
+
"accepted_snapshot_digest_changed",
|
|
97
|
+
"connection_missing",
|
|
98
|
+
"connection_identity_changed",
|
|
99
|
+
"connection_generation_changed",
|
|
100
|
+
"connection_status_inactive",
|
|
101
|
+
"connection_owner_changed",
|
|
102
|
+
"owner_membership_inactive",
|
|
103
|
+
"authority_missing",
|
|
104
|
+
"authority_identity_changed",
|
|
105
|
+
"authority_generation_changed",
|
|
106
|
+
"authority_status_inactive",
|
|
107
|
+
"grant_missing",
|
|
108
|
+
"grant_identity_changed",
|
|
109
|
+
"grant_generation_changed",
|
|
110
|
+
"grant_status_inactive",
|
|
111
|
+
"grant_expired",
|
|
112
|
+
"grant_already_consumed"
|
|
113
|
+
]);
|
|
114
|
+
var ConnectionUseAttributionFields = z.object({
|
|
115
|
+
organizationId: z.string().uuid(),
|
|
116
|
+
workspaceId: z.string().uuid(),
|
|
117
|
+
sessionId: z.string().uuid(),
|
|
118
|
+
connectionId: z.string().uuid(),
|
|
119
|
+
connectionGeneration: z.number().int().positive(),
|
|
120
|
+
scope: z.enum(["workspace", "user", "legacy_user"]),
|
|
121
|
+
ownerSubjectId: z.string().min(1).max(512).nullable(),
|
|
122
|
+
authorityId: z.string().uuid().nullable(),
|
|
123
|
+
grantId: z.string().uuid().nullable()
|
|
124
|
+
}).strict();
|
|
125
|
+
function refineConnectionUseAttribution(value, context) {
|
|
126
|
+
const personal = value.scope !== "workspace";
|
|
127
|
+
for (const field of ["ownerSubjectId"]) {
|
|
128
|
+
if (personal !== (value[field] !== null)) {
|
|
129
|
+
context.addIssue({
|
|
130
|
+
code: "custom",
|
|
131
|
+
path: [field],
|
|
132
|
+
message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
|
|
133
|
+
});
|
|
134
|
+
}
|
|
135
|
+
}
|
|
136
|
+
const owned = value.scope === "user";
|
|
137
|
+
for (const field of ["authorityId"]) {
|
|
138
|
+
if (owned !== (value[field] !== null)) {
|
|
139
|
+
context.addIssue({
|
|
140
|
+
code: "custom",
|
|
141
|
+
path: [field],
|
|
142
|
+
message: owned ? `personal attribution requires ${field}` : `non-personal attribution cannot carry ${field}`
|
|
143
|
+
});
|
|
144
|
+
}
|
|
145
|
+
}
|
|
146
|
+
if (!owned && value.grantId !== null) {
|
|
147
|
+
context.addIssue({
|
|
148
|
+
code: "custom",
|
|
149
|
+
path: ["grantId"],
|
|
150
|
+
message: "only historical personal attribution can carry a grant"
|
|
151
|
+
});
|
|
152
|
+
}
|
|
153
|
+
}
|
|
154
|
+
var ConnectionUseAttribution = ConnectionUseAttributionFields.extend({
|
|
155
|
+
scope: z.enum(["workspace", "user"]),
|
|
156
|
+
grantId: z.null()
|
|
157
|
+
}).superRefine(refineConnectionUseAttribution);
|
|
158
|
+
var ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({
|
|
159
|
+
outcome: z.enum(["authorized", "denied"]),
|
|
160
|
+
denialReason: ConnectionUseDenialReason.nullable(),
|
|
161
|
+
occurredAt: z.string().datetime({ offset: true })
|
|
162
|
+
}).superRefine((value, context) => {
|
|
163
|
+
refineConnectionUseAttribution(value, context);
|
|
164
|
+
if (value.outcome === "denied" !== (value.denialReason !== null)) {
|
|
165
|
+
context.addIssue({
|
|
166
|
+
code: "custom",
|
|
167
|
+
path: ["denialReason"],
|
|
168
|
+
message: "only denied connection use carries a denial reason"
|
|
169
|
+
});
|
|
170
|
+
}
|
|
171
|
+
});
|
|
172
|
+
var ConnectionUseAuthorizationResult = z.discriminatedUnion("status", [
|
|
173
|
+
z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
|
|
174
|
+
z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
|
|
175
|
+
]);
|
|
176
|
+
|
|
177
|
+
export {
|
|
178
|
+
ConnectionAuthoritySelectionSource,
|
|
179
|
+
ConnectionUseSelectionSource,
|
|
180
|
+
ConnectionUseAuthoritySnapshot,
|
|
181
|
+
ConnectionUseDenialReason,
|
|
182
|
+
ConnectionUseAttribution,
|
|
183
|
+
ConnectionUseAuditFact,
|
|
184
|
+
ConnectionUseAuthorizationResult
|
|
185
|
+
};
|
|
186
|
+
//# sourceMappingURL=chunk-H6YF3MTS.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { ConnectionKind, SessionTenancyVisibility } from \"./index\";\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\"explicit_workspace\", \"sender\"]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n .string()\n .min(1)\n .max(128)\n .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n z\n .object({\n kind: z.literal(\"turn\"),\n turnId: z.string().uuid(),\n })\n .strict(),\n z\n .object({\n kind: z.literal(\"scheduled_task\"),\n taskId: z.string().uuid(),\n taskAuthorityRevision: z.number().int().positive(),\n runId: z.string().uuid(),\n })\n .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n .object({\n organizationId: z.string().uuid(),\n originWorkspaceId: z.string().uuid(),\n targetWorkspaceId: z.string().uuid(),\n targetSessionId: z.string().uuid(),\n targetSessionVisibility: SessionTenancyVisibility,\n targetSessionAuthorityEpoch: z.number().int().positive(),\n acceptedWork: AcceptedConnectionWork,\n connectionId: z.string().uuid(),\n connectionGeneration: z.number().int().positive(),\n connectionStatus: z.literal(\"active\"),\n providerDomain: z.string().min(1).max(2048),\n connectionKind: ConnectionKind,\n scope: z.enum([\"workspace\", \"user\"]),\n ownerSubjectId: z.string().min(1).max(512).nullable(),\n ownerOrganizationMembershipId: z.string().uuid().nullable(),\n ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n authoritySource: ConnectionAuthoritySelectionSource,\n selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n userDelegation: z.null(),\n })\n .strict()\n .superRefine((value, context) => {\n const ownedBySubject = value.scope !== \"workspace\";\n const delegated = value.scope === \"user\";\n if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"ownerSubjectId\"],\n message: \"personal connections retain an owner subject\",\n });\n }\n if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"ownerOrganizationMembershipId\"],\n message: \"only user connections retain an owner membership\",\n });\n }\n if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"ownerMembershipAuthorizationRevision\"],\n message: \"only user connections retain an owner membership revision\",\n });\n }\n if (delegated && value.authoritySource !== \"sender\") {\n context.addIssue({\n code: \"custom\",\n path: [\"authoritySource\"],\n message: \"user connections require authenticated sender provenance\",\n });\n }\n if (!delegated && value.authoritySource === \"sender\") {\n context.addIssue({\n code: \"custom\",\n path: [\"authoritySource\"],\n message: \"workspace connections cannot claim sender provenance\",\n });\n }\n if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n context.addIssue({\n code: \"custom\",\n path: [\"originWorkspaceId\"],\n message: \"workspace connections must be owned by the target workspace\",\n });\n }\n });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n \"tenant_mismatch\",\n \"workspace_access_inactive\",\n \"session_inactive\",\n \"session_identity_changed\",\n \"session_visibility_changed\",\n \"session_authority_epoch_changed\",\n \"accepted_attempt_authority_required\",\n \"accepted_snapshot_digest_changed\",\n \"connection_missing\",\n \"connection_identity_changed\",\n \"connection_generation_changed\",\n \"connection_status_inactive\",\n \"connection_owner_changed\",\n \"owner_membership_inactive\",\n \"authority_missing\",\n \"authority_identity_changed\",\n \"authority_generation_changed\",\n \"authority_status_inactive\",\n \"grant_missing\",\n \"grant_identity_changed\",\n \"grant_generation_changed\",\n \"grant_status_inactive\",\n \"grant_expired\",\n \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n .object({\n organizationId: z.string().uuid(),\n workspaceId: z.string().uuid(),\n sessionId: z.string().uuid(),\n connectionId: z.string().uuid(),\n connectionGeneration: z.number().int().positive(),\n scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n ownerSubjectId: z.string().min(1).max(512).nullable(),\n authorityId: z.string().uuid().nullable(),\n grantId: z.string().uuid().nullable(),\n })\n .strict();\n\nfunction refineConnectionUseAttribution(\n value: z.infer<typeof ConnectionUseAttributionFields>,\n context: z.RefinementCtx,\n): void {\n const personal = value.scope !== \"workspace\";\n for (const field of [\"ownerSubjectId\"] as const) {\n if (personal !== (value[field] !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [field],\n message: personal\n ? `personal attribution requires ${field}`\n : `workspace attribution cannot carry ${field}`,\n });\n }\n }\n const owned = value.scope === \"user\";\n for (const field of [\"authorityId\"] as const) {\n if (owned !== (value[field] !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [field],\n message: owned\n ? `personal attribution requires ${field}`\n : `non-personal attribution cannot carry ${field}`,\n });\n }\n }\n if (!owned && value.grantId !== null) {\n context.addIssue({\n code: \"custom\",\n path: [\"grantId\"],\n message: \"only historical personal attribution can carry a grant\",\n });\n }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.extend({\n scope: z.enum([\"workspace\", \"user\"]),\n grantId: z.null(),\n}).superRefine(refineConnectionUseAttribution);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n outcome: z.enum([\"authorized\", \"denied\"]),\n denialReason: ConnectionUseDenialReason.nullable(),\n occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n refineConnectionUseAttribution(value, context);\n if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"denialReason\"],\n message: \"only denied connection use carries a denial reason\",\n });\n }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;AAAA,SAAS,SAAS;AAGX,IAAM,qCAAqC,EAAE,KAAK,CAAC,sBAAsB,QAAQ,CAAC;AAGlF,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACnC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,EAAE,KAAK;AACzB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,UAAU;AACnD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,UAAU;AACpD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,UAAU;AAC9B,aAAW,SAAS,CAAC,aAAa,GAAY;AAC5C,QAAI,WAAW,MAAM,KAAK,MAAM,OAAO;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,QACL,iCAAiC,KAAK,KACtC,yCAAyC,KAAK;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,CAAC,SAAS,MAAM,YAAY,MAAM;AACpC,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,IAAM,2BAA2B,+BAA+B,OAAO;AAAA,EAC5E,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACnC,SAAS,EAAE,KAAK;AAClB,CAAC,EAAE,YAAY,8BAA8B;AAGtC,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}
|