@opengeni/contracts 4.1.0 → 5.0.0-canary.35625901699001

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (73) hide show
  1. package/dist/atlassian.d.ts +1 -0
  2. package/dist/atlassian.js +4 -4
  3. package/dist/bundled-skills.d.ts +5 -1
  4. package/dist/{chunk-O5LEQHDM.js → chunk-ENJTPHKP.js} +2 -2
  5. package/dist/chunk-H6YF3MTS.js +186 -0
  6. package/dist/chunk-H6YF3MTS.js.map +1 -0
  7. package/dist/{chunk-HR6NB3CA.js → chunk-KEYW3PCG.js} +8350 -8209
  8. package/dist/chunk-KEYW3PCG.js.map +1 -0
  9. package/dist/{chunk-5LYFSZ7O.js → chunk-YJEOWXOE.js} +8 -8
  10. package/dist/company-profile.d.ts +9 -6
  11. package/dist/connect.js +4 -4
  12. package/dist/connection-authority.d.ts +9 -317
  13. package/dist/connection-authority.js +7 -27
  14. package/dist/connector-tool-permissions.d.ts +73 -0
  15. package/dist/editable-artifact-codec-registry.js +2 -2
  16. package/dist/editable-artifact-live.js +2 -2
  17. package/dist/editable-artifact-serialized-commit.js +3 -3
  18. package/dist/editable-artifacts.js +13 -13
  19. package/dist/google-drive.d.ts +1 -0
  20. package/dist/google-drive.js +4 -4
  21. package/dist/host-mcp-bindings.d.ts +5 -0
  22. package/dist/host-mcp-bindings.js +34 -8
  23. package/dist/host-mcp-bindings.js.map +1 -1
  24. package/dist/index.d.ts +771 -3222
  25. package/dist/index.js +123 -75
  26. package/dist/knowledge-entries.d.ts +33 -0
  27. package/dist/knowledge-preparation.d.ts +207 -0
  28. package/dist/managed-sign-in-methods.d.ts +56 -0
  29. package/dist/managed-sign-in-methods.js +46 -0
  30. package/dist/managed-sign-in-methods.js.map +1 -0
  31. package/dist/mcp-oauth.d.ts +2 -2
  32. package/dist/organization-integration-policy.d.ts +27 -0
  33. package/dist/organization-usage.d.ts +102 -0
  34. package/dist/personal-github.d.ts +1 -0
  35. package/dist/personal-github.js +4 -4
  36. package/dist/remember.d.ts +6 -4
  37. package/dist/sandbox-provider-command.d.ts +91 -1
  38. package/dist/sandbox-recovery.d.ts +101 -0
  39. package/dist/session-goal-reports.d.ts +21 -0
  40. package/dist/session-message-search.d.ts +68 -0
  41. package/dist/skill-catalog-context.d.ts +7 -0
  42. package/dist/skill-files.d.ts +1 -1
  43. package/dist/skills.d.ts +15 -0
  44. package/dist/tool-catalog.d.ts +7 -0
  45. package/package.json +4 -4
  46. package/src/bundled-skills.ts +2 -0
  47. package/src/connection-authority.ts +25 -225
  48. package/src/connector-tool-permissions.ts +59 -0
  49. package/src/host-mcp-bindings.ts +37 -5
  50. package/src/index.ts +418 -761
  51. package/src/knowledge-entries.ts +4 -0
  52. package/src/knowledge-preparation.ts +50 -0
  53. package/src/managed-sign-in-methods.ts +37 -0
  54. package/src/mcp-oauth.ts +16 -18
  55. package/src/organization-integration-policy.ts +54 -0
  56. package/src/organization-usage.ts +45 -0
  57. package/src/sandbox-provider-command.ts +57 -1
  58. package/src/sandbox-recovery.ts +61 -0
  59. package/src/session-goal-reports.ts +45 -0
  60. package/src/session-message-search.ts +54 -0
  61. package/src/skill-catalog-context.ts +50 -0
  62. package/src/skill-files.ts +3 -3
  63. package/src/skills.ts +21 -6
  64. package/src/tool-catalog.ts +10 -0
  65. package/dist/chunk-HR6NB3CA.js.map +0 -1
  66. package/dist/chunk-J6QIYKO5.js +0 -348
  67. package/dist/chunk-J6QIYKO5.js.map +0 -1
  68. package/dist/host-mcp-resolvers.d.ts +0 -32
  69. package/dist/host-mcp-resolvers.js +0 -34
  70. package/dist/host-mcp-resolvers.js.map +0 -1
  71. package/src/host-mcp-resolvers.ts +0 -50
  72. /package/dist/{chunk-O5LEQHDM.js.map → chunk-ENJTPHKP.js.map} +0 -0
  73. /package/dist/{chunk-5LYFSZ7O.js.map → chunk-YJEOWXOE.js.map} +0 -0
@@ -181,6 +181,7 @@ export declare const AtlassianBrowseResponse: z.ZodObject<{
181
181
  connection: z.ZodLazy<z.ZodObject<{
182
182
  id: z.ZodString;
183
183
  authorityId: z.ZodOptional<z.ZodString>;
184
+ connectionAuthorityGeneration: z.ZodOptional<z.ZodNumber>;
184
185
  accountId: z.ZodString;
185
186
  workspaceId: z.ZodString;
186
187
  subjectId: z.ZodNullable<z.ZodString>;
package/dist/atlassian.js CHANGED
@@ -17,9 +17,9 @@ import {
17
17
  AtlassianSyncCadence,
18
18
  SaveAtlassianSourcesRequest,
19
19
  atlassianScopesAllowRead
20
- } from "./chunk-HR6NB3CA.js";
20
+ } from "./chunk-KEYW3PCG.js";
21
21
  import "./chunk-YBW5JSA3.js";
22
- import "./chunk-O5LEQHDM.js";
22
+ import "./chunk-ENJTPHKP.js";
23
23
  import "./chunk-GRG7PHWQ.js";
24
24
  import "./chunk-RKX3NQYS.js";
25
25
  import "./chunk-MRWYRAS5.js";
@@ -29,10 +29,10 @@ import "./chunk-YRKRZ6OF.js";
29
29
  import "./chunk-JUFK3T4Q.js";
30
30
  import "./chunk-M5ZGRVIQ.js";
31
31
  import "./chunk-BCS7WHCK.js";
32
- import "./chunk-5LYFSZ7O.js";
32
+ import "./chunk-YJEOWXOE.js";
33
33
  import "./chunk-Y3KNXVTD.js";
34
- import "./chunk-D2HKF2EF.js";
35
34
  import "./chunk-TXTQIYCV.js";
35
+ import "./chunk-D2HKF2EF.js";
36
36
  import "./chunk-RIY7GYQS.js";
37
37
  import "./chunk-MYBZRDTY.js";
38
38
  import "./chunk-PX3VCKAU.js";
@@ -1,7 +1,9 @@
1
1
  import { z } from "zod";
2
2
  export declare const BundledSkillId: z.ZodEnum<{
3
3
  "builtin:document-parsing": "builtin:document-parsing";
4
+ "builtin:opengeni-client": "builtin:opengeni-client";
4
5
  "builtin:opengeni-documents": "builtin:opengeni-documents";
6
+ "builtin:opengeni-help": "builtin:opengeni-help";
5
7
  "builtin:opengeni-presentations": "builtin:opengeni-presentations";
6
8
  "builtin:opengeni-projects": "builtin:opengeni-projects";
7
9
  "builtin:opengeni-sites": "builtin:opengeni-sites";
@@ -13,7 +15,9 @@ export declare const BundledSkillId: z.ZodEnum<{
13
15
  export type BundledSkillId = z.infer<typeof BundledSkillId>;
14
16
  export declare const BundledSkillSelection: z.ZodPipe<z.ZodArray<z.ZodEnum<{
15
17
  "builtin:document-parsing": "builtin:document-parsing";
18
+ "builtin:opengeni-client": "builtin:opengeni-client";
16
19
  "builtin:opengeni-documents": "builtin:opengeni-documents";
20
+ "builtin:opengeni-help": "builtin:opengeni-help";
17
21
  "builtin:opengeni-presentations": "builtin:opengeni-presentations";
18
22
  "builtin:opengeni-projects": "builtin:opengeni-projects";
19
23
  "builtin:opengeni-sites": "builtin:opengeni-sites";
@@ -21,7 +25,7 @@ export declare const BundledSkillSelection: z.ZodPipe<z.ZodArray<z.ZodEnum<{
21
25
  "builtin:opengeni-spreadsheets": "builtin:opengeni-spreadsheets";
22
26
  "builtin:opengeni-video-generation": "builtin:opengeni-video-generation";
23
27
  "builtin:opengeni-visualize": "builtin:opengeni-visualize";
24
- }>>, z.ZodTransform<("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[], ("builtin:document-parsing" | "builtin:opengeni-documents" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[]>>;
28
+ }>>, z.ZodTransform<("builtin:document-parsing" | "builtin:opengeni-client" | "builtin:opengeni-documents" | "builtin:opengeni-help" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[], ("builtin:document-parsing" | "builtin:opengeni-client" | "builtin:opengeni-documents" | "builtin:opengeni-help" | "builtin:opengeni-presentations" | "builtin:opengeni-projects" | "builtin:opengeni-sites" | "builtin:opengeni-skills" | "builtin:opengeni-spreadsheets" | "builtin:opengeni-video-generation" | "builtin:opengeni-visualize")[]>>;
25
29
  /** Undefined is defaults/inheritance; an explicit empty list disables bundles. */
26
30
  export declare function resolveBundledSkillSelection(requested: readonly BundledSkillId[] | undefined, parent: readonly BundledSkillId[] | undefined): BundledSkillId[] | undefined;
27
31
  export declare function withBundledSkillSelectionMetadata(metadata: Record<string, unknown>, ids: readonly BundledSkillId[] | undefined): Record<string, unknown>;
@@ -6,7 +6,7 @@ import {
6
6
  } from "./chunk-NVJMJWLL.js";
7
7
  import {
8
8
  editableArtifactCodecFor
9
- } from "./chunk-5LYFSZ7O.js";
9
+ } from "./chunk-YJEOWXOE.js";
10
10
  import {
11
11
  DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,
12
12
  DOCUMENT_ARTIFACT_MAX_STRUCTURAL_COUNTER
@@ -380,4 +380,4 @@ export {
380
380
  decodeEditableArtifactSerializedCommit,
381
381
  assertCanonicalEditableArtifactSerializedCommit
382
382
  };
383
- //# sourceMappingURL=chunk-O5LEQHDM.js.map
383
+ //# sourceMappingURL=chunk-ENJTPHKP.js.map
@@ -0,0 +1,186 @@
1
+ import {
2
+ ConnectionKind,
3
+ SessionTenancyVisibility
4
+ } from "./chunk-KEYW3PCG.js";
5
+
6
+ // src/connection-authority.ts
7
+ import { z } from "zod";
8
+ var ConnectionAuthoritySelectionSource = z.enum(["explicit_workspace", "sender"]);
9
+ var ConnectionUseSelectionSource = z.string().min(1).max(128).regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);
10
+ var AcceptedConnectionWork = z.discriminatedUnion("kind", [
11
+ z.object({
12
+ kind: z.literal("turn"),
13
+ turnId: z.string().uuid()
14
+ }).strict(),
15
+ z.object({
16
+ kind: z.literal("scheduled_task"),
17
+ taskId: z.string().uuid(),
18
+ taskAuthorityRevision: z.number().int().positive(),
19
+ runId: z.string().uuid()
20
+ }).strict()
21
+ ]);
22
+ var ConnectionUseAuthoritySnapshot = z.object({
23
+ organizationId: z.string().uuid(),
24
+ originWorkspaceId: z.string().uuid(),
25
+ targetWorkspaceId: z.string().uuid(),
26
+ targetSessionId: z.string().uuid(),
27
+ targetSessionVisibility: SessionTenancyVisibility,
28
+ targetSessionAuthorityEpoch: z.number().int().positive(),
29
+ acceptedWork: AcceptedConnectionWork,
30
+ connectionId: z.string().uuid(),
31
+ connectionGeneration: z.number().int().positive(),
32
+ connectionStatus: z.literal("active"),
33
+ providerDomain: z.string().min(1).max(2048),
34
+ connectionKind: ConnectionKind,
35
+ scope: z.enum(["workspace", "user"]),
36
+ ownerSubjectId: z.string().min(1).max(512).nullable(),
37
+ ownerOrganizationMembershipId: z.string().uuid().nullable(),
38
+ ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),
39
+ authoritySource: ConnectionAuthoritySelectionSource,
40
+ selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),
41
+ userDelegation: z.null()
42
+ }).strict().superRefine((value, context) => {
43
+ const ownedBySubject = value.scope !== "workspace";
44
+ const delegated = value.scope === "user";
45
+ if (ownedBySubject !== (value.ownerSubjectId !== null)) {
46
+ context.addIssue({
47
+ code: "custom",
48
+ path: ["ownerSubjectId"],
49
+ message: "personal connections retain an owner subject"
50
+ });
51
+ }
52
+ if (delegated !== (value.ownerOrganizationMembershipId !== null)) {
53
+ context.addIssue({
54
+ code: "custom",
55
+ path: ["ownerOrganizationMembershipId"],
56
+ message: "only user connections retain an owner membership"
57
+ });
58
+ }
59
+ if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {
60
+ context.addIssue({
61
+ code: "custom",
62
+ path: ["ownerMembershipAuthorizationRevision"],
63
+ message: "only user connections retain an owner membership revision"
64
+ });
65
+ }
66
+ if (delegated && value.authoritySource !== "sender") {
67
+ context.addIssue({
68
+ code: "custom",
69
+ path: ["authoritySource"],
70
+ message: "user connections require authenticated sender provenance"
71
+ });
72
+ }
73
+ if (!delegated && value.authoritySource === "sender") {
74
+ context.addIssue({
75
+ code: "custom",
76
+ path: ["authoritySource"],
77
+ message: "workspace connections cannot claim sender provenance"
78
+ });
79
+ }
80
+ if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {
81
+ context.addIssue({
82
+ code: "custom",
83
+ path: ["originWorkspaceId"],
84
+ message: "workspace connections must be owned by the target workspace"
85
+ });
86
+ }
87
+ });
88
+ var ConnectionUseDenialReason = z.enum([
89
+ "tenant_mismatch",
90
+ "workspace_access_inactive",
91
+ "session_inactive",
92
+ "session_identity_changed",
93
+ "session_visibility_changed",
94
+ "session_authority_epoch_changed",
95
+ "accepted_attempt_authority_required",
96
+ "accepted_snapshot_digest_changed",
97
+ "connection_missing",
98
+ "connection_identity_changed",
99
+ "connection_generation_changed",
100
+ "connection_status_inactive",
101
+ "connection_owner_changed",
102
+ "owner_membership_inactive",
103
+ "authority_missing",
104
+ "authority_identity_changed",
105
+ "authority_generation_changed",
106
+ "authority_status_inactive",
107
+ "grant_missing",
108
+ "grant_identity_changed",
109
+ "grant_generation_changed",
110
+ "grant_status_inactive",
111
+ "grant_expired",
112
+ "grant_already_consumed"
113
+ ]);
114
+ var ConnectionUseAttributionFields = z.object({
115
+ organizationId: z.string().uuid(),
116
+ workspaceId: z.string().uuid(),
117
+ sessionId: z.string().uuid(),
118
+ connectionId: z.string().uuid(),
119
+ connectionGeneration: z.number().int().positive(),
120
+ scope: z.enum(["workspace", "user", "legacy_user"]),
121
+ ownerSubjectId: z.string().min(1).max(512).nullable(),
122
+ authorityId: z.string().uuid().nullable(),
123
+ grantId: z.string().uuid().nullable()
124
+ }).strict();
125
+ function refineConnectionUseAttribution(value, context) {
126
+ const personal = value.scope !== "workspace";
127
+ for (const field of ["ownerSubjectId"]) {
128
+ if (personal !== (value[field] !== null)) {
129
+ context.addIssue({
130
+ code: "custom",
131
+ path: [field],
132
+ message: personal ? `personal attribution requires ${field}` : `workspace attribution cannot carry ${field}`
133
+ });
134
+ }
135
+ }
136
+ const owned = value.scope === "user";
137
+ for (const field of ["authorityId"]) {
138
+ if (owned !== (value[field] !== null)) {
139
+ context.addIssue({
140
+ code: "custom",
141
+ path: [field],
142
+ message: owned ? `personal attribution requires ${field}` : `non-personal attribution cannot carry ${field}`
143
+ });
144
+ }
145
+ }
146
+ if (!owned && value.grantId !== null) {
147
+ context.addIssue({
148
+ code: "custom",
149
+ path: ["grantId"],
150
+ message: "only historical personal attribution can carry a grant"
151
+ });
152
+ }
153
+ }
154
+ var ConnectionUseAttribution = ConnectionUseAttributionFields.extend({
155
+ scope: z.enum(["workspace", "user"]),
156
+ grantId: z.null()
157
+ }).superRefine(refineConnectionUseAttribution);
158
+ var ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({
159
+ outcome: z.enum(["authorized", "denied"]),
160
+ denialReason: ConnectionUseDenialReason.nullable(),
161
+ occurredAt: z.string().datetime({ offset: true })
162
+ }).superRefine((value, context) => {
163
+ refineConnectionUseAttribution(value, context);
164
+ if (value.outcome === "denied" !== (value.denialReason !== null)) {
165
+ context.addIssue({
166
+ code: "custom",
167
+ path: ["denialReason"],
168
+ message: "only denied connection use carries a denial reason"
169
+ });
170
+ }
171
+ });
172
+ var ConnectionUseAuthorizationResult = z.discriminatedUnion("status", [
173
+ z.object({ status: z.literal("authorized"), attribution: ConnectionUseAttribution }).strict(),
174
+ z.object({ status: z.literal("denied"), reason: ConnectionUseDenialReason }).strict()
175
+ ]);
176
+
177
+ export {
178
+ ConnectionAuthoritySelectionSource,
179
+ ConnectionUseSelectionSource,
180
+ ConnectionUseAuthoritySnapshot,
181
+ ConnectionUseDenialReason,
182
+ ConnectionUseAttribution,
183
+ ConnectionUseAuditFact,
184
+ ConnectionUseAuthorizationResult
185
+ };
186
+ //# sourceMappingURL=chunk-H6YF3MTS.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"sources":["../src/connection-authority.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { ConnectionKind, SessionTenancyVisibility } from \"./index\";\n\nexport const ConnectionAuthoritySelectionSource = z.enum([\"explicit_workspace\", \"sender\"]);\nexport type ConnectionAuthoritySelectionSource = z.infer<typeof ConnectionAuthoritySelectionSource>;\n\nexport const ConnectionUseSelectionSource = z\n .string()\n .min(1)\n .max(128)\n .regex(/^[a-z0-9](?:[a-z0-9._:-]*[a-z0-9])?$/u);\nexport type ConnectionUseSelectionSource = z.infer<typeof ConnectionUseSelectionSource>;\n\nconst AcceptedConnectionWork = z.discriminatedUnion(\"kind\", [\n z\n .object({\n kind: z.literal(\"turn\"),\n turnId: z.string().uuid(),\n })\n .strict(),\n z\n .object({\n kind: z.literal(\"scheduled_task\"),\n taskId: z.string().uuid(),\n taskAuthorityRevision: z.number().int().positive(),\n runId: z.string().uuid(),\n })\n .strict(),\n]);\n\n/**\n * Internal, credential-free authority frozen when work is accepted. Personal\n * owner identity is retained only for live authorization and usage/audit\n * attribution; it is never part of the public delegation envelope.\n */\nexport const ConnectionUseAuthoritySnapshot = z\n .object({\n organizationId: z.string().uuid(),\n originWorkspaceId: z.string().uuid(),\n targetWorkspaceId: z.string().uuid(),\n targetSessionId: z.string().uuid(),\n targetSessionVisibility: SessionTenancyVisibility,\n targetSessionAuthorityEpoch: z.number().int().positive(),\n acceptedWork: AcceptedConnectionWork,\n connectionId: z.string().uuid(),\n connectionGeneration: z.number().int().positive(),\n connectionStatus: z.literal(\"active\"),\n providerDomain: z.string().min(1).max(2048),\n connectionKind: ConnectionKind,\n scope: z.enum([\"workspace\", \"user\"]),\n ownerSubjectId: z.string().min(1).max(512).nullable(),\n ownerOrganizationMembershipId: z.string().uuid().nullable(),\n ownerMembershipAuthorizationRevision: z.number().int().positive().nullable().default(null),\n authoritySource: ConnectionAuthoritySelectionSource,\n selectionSources: z.array(ConnectionUseSelectionSource).min(1).max(128),\n userDelegation: z.null(),\n })\n .strict()\n .superRefine((value, context) => {\n const ownedBySubject = value.scope !== \"workspace\";\n const delegated = value.scope === \"user\";\n if (ownedBySubject !== (value.ownerSubjectId !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"ownerSubjectId\"],\n message: \"personal connections retain an owner subject\",\n });\n }\n if (delegated !== (value.ownerOrganizationMembershipId !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"ownerOrganizationMembershipId\"],\n message: \"only user connections retain an owner membership\",\n });\n }\n if (delegated !== (value.ownerMembershipAuthorizationRevision !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"ownerMembershipAuthorizationRevision\"],\n message: \"only user connections retain an owner membership revision\",\n });\n }\n if (delegated && value.authoritySource !== \"sender\") {\n context.addIssue({\n code: \"custom\",\n path: [\"authoritySource\"],\n message: \"user connections require authenticated sender provenance\",\n });\n }\n if (!delegated && value.authoritySource === \"sender\") {\n context.addIssue({\n code: \"custom\",\n path: [\"authoritySource\"],\n message: \"workspace connections cannot claim sender provenance\",\n });\n }\n if (!delegated && value.originWorkspaceId !== value.targetWorkspaceId) {\n context.addIssue({\n code: \"custom\",\n path: [\"originWorkspaceId\"],\n message: \"workspace connections must be owned by the target workspace\",\n });\n }\n });\nexport type ConnectionUseAuthoritySnapshot = z.infer<typeof ConnectionUseAuthoritySnapshot>;\n\nexport const ConnectionUseDenialReason = z.enum([\n \"tenant_mismatch\",\n \"workspace_access_inactive\",\n \"session_inactive\",\n \"session_identity_changed\",\n \"session_visibility_changed\",\n \"session_authority_epoch_changed\",\n \"accepted_attempt_authority_required\",\n \"accepted_snapshot_digest_changed\",\n \"connection_missing\",\n \"connection_identity_changed\",\n \"connection_generation_changed\",\n \"connection_status_inactive\",\n \"connection_owner_changed\",\n \"owner_membership_inactive\",\n \"authority_missing\",\n \"authority_identity_changed\",\n \"authority_generation_changed\",\n \"authority_status_inactive\",\n \"grant_missing\",\n \"grant_identity_changed\",\n \"grant_generation_changed\",\n \"grant_status_inactive\",\n \"grant_expired\",\n \"grant_already_consumed\",\n]);\nexport type ConnectionUseDenialReason = z.infer<typeof ConnectionUseDenialReason>;\n\nconst ConnectionUseAttributionFields = z\n .object({\n organizationId: z.string().uuid(),\n workspaceId: z.string().uuid(),\n sessionId: z.string().uuid(),\n connectionId: z.string().uuid(),\n connectionGeneration: z.number().int().positive(),\n scope: z.enum([\"workspace\", \"user\", \"legacy_user\"]),\n ownerSubjectId: z.string().min(1).max(512).nullable(),\n authorityId: z.string().uuid().nullable(),\n grantId: z.string().uuid().nullable(),\n })\n .strict();\n\nfunction refineConnectionUseAttribution(\n value: z.infer<typeof ConnectionUseAttributionFields>,\n context: z.RefinementCtx,\n): void {\n const personal = value.scope !== \"workspace\";\n for (const field of [\"ownerSubjectId\"] as const) {\n if (personal !== (value[field] !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [field],\n message: personal\n ? `personal attribution requires ${field}`\n : `workspace attribution cannot carry ${field}`,\n });\n }\n }\n const owned = value.scope === \"user\";\n for (const field of [\"authorityId\"] as const) {\n if (owned !== (value[field] !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [field],\n message: owned\n ? `personal attribution requires ${field}`\n : `non-personal attribution cannot carry ${field}`,\n });\n }\n }\n if (!owned && value.grantId !== null) {\n context.addIssue({\n code: \"custom\",\n path: [\"grantId\"],\n message: \"only historical personal attribution can carry a grant\",\n });\n }\n}\n\n/** Metadata-only attribution emitted after pre-use authorization. */\nexport const ConnectionUseAttribution = ConnectionUseAttributionFields.extend({\n scope: z.enum([\"workspace\", \"user\"]),\n grantId: z.null(),\n}).superRefine(refineConnectionUseAttribution);\nexport type ConnectionUseAttribution = z.infer<typeof ConnectionUseAttribution>;\n\nexport const ConnectionUseAuditFact = ConnectionUseAttributionFields.extend({\n outcome: z.enum([\"authorized\", \"denied\"]),\n denialReason: ConnectionUseDenialReason.nullable(),\n occurredAt: z.string().datetime({ offset: true }),\n}).superRefine((value, context) => {\n refineConnectionUseAttribution(value, context);\n if ((value.outcome === \"denied\") !== (value.denialReason !== null)) {\n context.addIssue({\n code: \"custom\",\n path: [\"denialReason\"],\n message: \"only denied connection use carries a denial reason\",\n });\n }\n});\nexport type ConnectionUseAuditFact = z.infer<typeof ConnectionUseAuditFact>;\n\nexport const ConnectionUseAuthorizationResult = z.discriminatedUnion(\"status\", [\n z.object({ status: z.literal(\"authorized\"), attribution: ConnectionUseAttribution }).strict(),\n z.object({ status: z.literal(\"denied\"), reason: ConnectionUseDenialReason }).strict(),\n]);\nexport type ConnectionUseAuthorizationResult = z.infer<typeof ConnectionUseAuthorizationResult>;\n"],"mappings":";;;;;;AAAA,SAAS,SAAS;AAGX,IAAM,qCAAqC,EAAE,KAAK,CAAC,sBAAsB,QAAQ,CAAC;AAGlF,IAAM,+BAA+B,EACzC,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAG,EACP,MAAM,uCAAuC;AAGhD,IAAM,yBAAyB,EAAE,mBAAmB,QAAQ;AAAA,EAC1D,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,MAAM;AAAA,IACtB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,CAAC,EACA,OAAO;AAAA,EACV,EACG,OAAO;AAAA,IACN,MAAM,EAAE,QAAQ,gBAAgB;AAAA,IAChC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,IACxB,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,IACjD,OAAO,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,CAAC,EACA,OAAO;AACZ,CAAC;AAOM,IAAM,iCAAiC,EAC3C,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,mBAAmB,EAAE,OAAO,EAAE,KAAK;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK;AAAA,EACjC,yBAAyB;AAAA,EACzB,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EACvD,cAAc;AAAA,EACd,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,kBAAkB,EAAE,QAAQ,QAAQ;AAAA,EACpC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,IAAI;AAAA,EAC1C,gBAAgB;AAAA,EAChB,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACnC,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,+BAA+B,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC1D,sCAAsC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,IAAI;AAAA,EACzF,iBAAiB;AAAA,EACjB,kBAAkB,EAAE,MAAM,4BAA4B,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtE,gBAAgB,EAAE,KAAK;AACzB,CAAC,EACA,OAAO,EACP,YAAY,CAAC,OAAO,YAAY;AAC/B,QAAM,iBAAiB,MAAM,UAAU;AACvC,QAAM,YAAY,MAAM,UAAU;AAClC,MAAI,oBAAoB,MAAM,mBAAmB,OAAO;AACtD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,gBAAgB;AAAA,MACvB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,kCAAkC,OAAO;AAChE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,+BAA+B;AAAA,MACtC,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,eAAe,MAAM,yCAAyC,OAAO;AACvE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,sCAAsC;AAAA,MAC7C,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,aAAa,MAAM,oBAAoB,UAAU;AACnD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,oBAAoB,UAAU;AACpD,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,iBAAiB;AAAA,MACxB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,MAAI,CAAC,aAAa,MAAM,sBAAsB,MAAM,mBAAmB;AACrE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,mBAAmB;AAAA,MAC1B,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGI,IAAM,4BAA4B,EAAE,KAAK;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iCAAiC,EACpC,OAAO;AAAA,EACN,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,KAAK;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAChD,OAAO,EAAE,KAAK,CAAC,aAAa,QAAQ,aAAa,CAAC;AAAA,EAClD,gBAAgB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACtC,CAAC,EACA,OAAO;AAEV,SAAS,+BACP,OACA,SACM;AACN,QAAM,WAAW,MAAM,UAAU;AACjC,aAAW,SAAS,CAAC,gBAAgB,GAAY;AAC/C,QAAI,cAAc,MAAM,KAAK,MAAM,OAAO;AACxC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,WACL,iCAAiC,KAAK,KACtC,sCAAsC,KAAK;AAAA,MACjD,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,UAAU;AAC9B,aAAW,SAAS,CAAC,aAAa,GAAY;AAC5C,QAAI,WAAW,MAAM,KAAK,MAAM,OAAO;AACrC,cAAQ,SAAS;AAAA,QACf,MAAM;AAAA,QACN,MAAM,CAAC,KAAK;AAAA,QACZ,SAAS,QACL,iCAAiC,KAAK,KACtC,yCAAyC,KAAK;AAAA,MACpD,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI,CAAC,SAAS,MAAM,YAAY,MAAM;AACpC,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,SAAS;AAAA,MAChB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF;AAGO,IAAM,2BAA2B,+BAA+B,OAAO;AAAA,EAC5E,OAAO,EAAE,KAAK,CAAC,aAAa,MAAM,CAAC;AAAA,EACnC,SAAS,EAAE,KAAK;AAClB,CAAC,EAAE,YAAY,8BAA8B;AAGtC,IAAM,yBAAyB,+BAA+B,OAAO;AAAA,EAC1E,SAAS,EAAE,KAAK,CAAC,cAAc,QAAQ,CAAC;AAAA,EACxC,cAAc,0BAA0B,SAAS;AAAA,EACjD,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,KAAK,CAAC;AAClD,CAAC,EAAE,YAAY,CAAC,OAAO,YAAY;AACjC,iCAA+B,OAAO,OAAO;AAC7C,MAAK,MAAM,YAAY,cAAe,MAAM,iBAAiB,OAAO;AAClE,YAAQ,SAAS;AAAA,MACf,MAAM;AAAA,MACN,MAAM,CAAC,cAAc;AAAA,MACrB,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACF,CAAC;AAGM,IAAM,mCAAmC,EAAE,mBAAmB,UAAU;AAAA,EAC7E,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,YAAY,GAAG,aAAa,yBAAyB,CAAC,EAAE,OAAO;AAAA,EAC5F,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,QAAQ,0BAA0B,CAAC,EAAE,OAAO;AACtF,CAAC;","names":[]}